@askexenow/exe-os 0.9.365 → 0.9.367

package/dist/{worker-gate-35VZINZG.js → worker-gate-62PZATOV.js}

@@ -6,7 +6,7 @@ import {
   releaseBackfillLock,
   tryAcquireBackfillLock,
   tryAcquireWorkerSlot
-} from "./chunk-MPQXQ5IE.js";
+} from "./chunk-ALYI3P5D.js";
 import "./chunk-QMSEL5YS.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";

package/dist/{workflow-engine-4DA6RSHI.js → workflow-engine-7YIRU62F.js}

@@ -10,8 +10,8 @@ import {
   persistWorkflows,
   runWorkflow,
   startWorkflow
-} from "./chunk-P47MPWNU.js";
-import "./chunk-UY6HRDB2.js";
+} from "./chunk-Y4JVM3SI.js";
+import "./chunk-YNPOELAN.js";
 import "./chunk-MLKGABMK.js";
 export {
   advanceWorkflow,

package/dist/{worktree-H3YFJ3NU.js → worktree-3TUKIZWY.js}

@@ -16,13 +16,13 @@ import {
   resolveGitWithRetrySync,
   worktreeBranch,
   worktreePath
-} from "./chunk-FXPAUDCZ.js";
-import "./chunk-WR75WUEP.js";
-import "./chunk-BRLS5OLZ.js";
+} from "./chunk-7W6FDHHY.js";
+import "./chunk-UI3K73LD.js";
+import "./chunk-HSBKV5LB.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-NO3M2AFM.js";
+import "./chunk-Y7OK5PJE.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";

package/dist/{worktree-sweep-4EDLLQ2E.js → worktree-sweep-MYQHUXDE.js}

@@ -4,14 +4,14 @@ import {
   discoverRepoPathsAsync,
   isWorktreePathOccupiedByCwd,
   sweepWorktrees
-} from "./chunk-NV6A5HDN.js";
-import "./chunk-FXPAUDCZ.js";
-import "./chunk-WR75WUEP.js";
-import "./chunk-BRLS5OLZ.js";
+} from "./chunk-KDD26FUY.js";
+import "./chunk-7W6FDHHY.js";
+import "./chunk-UI3K73LD.js";
+import "./chunk-HSBKV5LB.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-NO3M2AFM.js";
+import "./chunk-Y7OK5PJE.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.365",
+  "version": "0.9.367",
   "description": "AI employee operating system \u2014 persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -112,6 +112,7 @@
     "test:watch": "vitest",
     "lint": "eslint src/ --max-warnings 53",
     "typecheck": "tsc --noEmit",
+    "typecheck:workers": "tsc --noEmit -p api-router/tsconfig.json && tsc --noEmit -p api-router/tsconfig.test.json && tsc --noEmit -p worker/tsconfig.json",
     "build": "node scripts/dist-ownership-guard.mjs && bash scripts/build-lock.sh && mkdir -p dist/assets && cp src/assets/tmux.conf dist/assets/ && cp src/assets/ghostty.conf dist/assets/ && cp src/assets/statusline-command.sh dist/assets/ && cp src/assets/wezterm.lua dist/assets/ && cp src/assets/com.askexe.exed.plist dist/assets/ && cp src/bin/exe-start.sh dist/bin/exe-start.sh && (node dist/bin/generate-hook-manifest.js 2>/dev/null || true) && node scripts/dist-integrity.mjs --record",
     "deploy": "node dist/bin/pre-build-guard.js && EXE_DIST_OP_RESTARTS_DAEMON=1 EXE_DIST_CLEAN=1 npm run build && node scripts/dist-integrity.mjs --verify && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",
     "postinstall": "node postinstall.mjs",
@@ -120,6 +121,7 @@
     "benchmark:longmemeval": "npx tsx tests/benchmarks/longmemeval.ts",
     "guard:esm-require": "node scripts/check-no-runtime-require.mjs",
     "guard:defect-classes": "node scripts/check-defect-gates.mjs",
+    "guard:required-checks": "node scripts/check-required-checks-evaluable.mjs",
     "check:schema-version": "node scripts/check-schema-version.mjs",
     "check:perms-ui-sync": "node packages/permissions-ui/sync.mjs --check",
     "check:switcher-ui-sync": "node packages/exe-service-switcher/sync.mjs --check",
@@ -158,6 +160,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@cloudflare/workers-types": "^4.0.0",
     "@types/node": "^22.0.0",
     "@types/nodemailer": "^8.0.0",
     "@types/pg": "^8.20.0",
@@ -168,7 +171,8 @@
     "eslint": "^10.4.0",
     "tsup": "^8.5.1",
     "tsx": "^4.0.0",
-    "vitest": "^4.1.0"
+    "vitest": "^4.1.0",
+    "yaml": "2.8.3"
   },
   "optionalDependencies": {
     "keytar": "^7.9.0",

package/release-notes.json

@@ -1,47 +1,81 @@
 {
-  "current": "0.9.365",
+  "current": "0.9.367",
   "notes": {
+    "0.9.367": {
+      "version": "0.9.367",
+      "date": "2026-08-13",
+      "features": [],
+      "fixes": [],
+      "security": [],
+      "other": [
+        "v0.9.367 (#699)"
+      ],
+      "migration_notes": []
+    },
+    "0.9.366": {
+      "version": "0.9.366",
+      "date": "2026-08-13",
+      "features": [
+        "atomic work claims — two sessions can no longer take the same job, enforced at every dispatch path",
+        "Codex session consolidation + hook trust: Codex hooks were never actually running, so fresh installs captured nothing",
+        "auth page: confirmation state, gated token tab, and opt-in cross-app SSO",
+        "wiki docs: seal/unseal capability with cloud-docs worker endpoints"
+      ],
+      "fixes": [
+        "SECURITY: GoTrue's admin API is no longer published on the public internet",
+        "SECURITY: account termination was reversible by the terminated user — now tombstoned and lock-fenced",
+        "SSO cookie contract is gated at deploy and monitored live",
+        "task + tracker close gates now require a verification artifact, so automated completion cannot close work that was never verified",
+        "runtime: exe-os MCP tools are registered and the agent loop detects stalls",
+        "stack-update: unset-pin rollback and a stale-deploy alert",
+        "preflight: SMTP recovery fails on incomplete credentials instead of silently continuing",
+        "hook tests: empty stdout is now a clear diagnostic rather than an opaque JSON parse error, and hook fixtures are isolated from the live daemon"
+      ],
+      "infrastructure": [
+        "restored 52 test files that ran in NO CI job at all — including 33 gateway security suites covering permission-guard, api-router enforcement, read-only SQL and rate limiting, dark since 2026-04-20 and green in 17 seconds",
+        "a guard that fails loudly when a required check cannot evaluate on a pull request, so a required context can never again be satisfied by never running",
+        "native-addon smoke gate: node-llama-cpp's addon had zero coverage, meaning production was the first place it ever executed",
+        "the CI sweeper's four correctness fixes finally reached main — an absent required check no longer reads as green",
+        "stopped paying for lint and typecheck twice per PR; sweeps every 5 minutes",
+        "SHA-pinned the last mutable action ref"
+      ],
+      "security": [],
+      "other": [],
+      "migration_notes": []
+    },
     "0.9.365": {
       "version": "0.9.365",
       "date": "2026-08-13",
       "features": [
-        "mount cross-app service switcher in dashboard + team pages (#683)",
-        "phase 5 — org-aware usage/credits/keys/billing + persisted alert threshold (e51ca54c) (#677)",
-        "phase 6a — invite email via Resend + redeemability corrections (e51ca54c) (#678)",
-        "phase 4 — atomic spend-cap admission + freeze kill-switch (api-router lane) (#672)",
-        "phase 2 — self-serve org scoping (GET /v1/orgs, is_staff, panel mode 'self') (#653)",
-        "phase 3 — spend-limits model, authoring + ceiling guard, claim projection (e51ca54c) (#663)",
-        "detect the unsupervised-daemon state (ad8886b8) (#623)",
-        "phase 0 — planning-doc truth, permsSubject() identity join, live self-edit warning (#649)"
+        "org permissions: self-serve org scoping, spend-limits with an atomic admission cap and freeze kill-switch, role revoke path, and invite emails that are actually redeemable",
+        "dashboard: org-aware usage, credits, keys and billing with persisted alert thresholds, plus the cross-app service switcher",
+        "daemon: detects the unsupervised-daemon state instead of failing silently"
       ],
       "fixes": [
-        "deadlock-proof the release path — drift monitor + required-context gate off the release lane (#675)",
-        "write stack state files 0644 so the drift watchdog can read them (exe-monitor#27) (#680)",
-        "teach the named-subagent default at every layer, not just the ladder (#614)",
-        "honest backup verification — index is healthy, the alarm was not (e0b92e67) (#632)",
-        "attribute every kill + verify PID identity before signalling (7a915790, 9fc28233, 42aa8c56) (#636)",
-        "digest-pin every shipped image, make strict-digest the DEFAULT (#679)",
-        "move extended-tests out of CI workflow so a non-required job stops gating releases (debdb921) (#655)",
-        "match agent healthcheck to the PINNED image generation (bug 9ce2a68b coupling) (#676)",
-        "live manifest first, packaged only as offline fallback (bug c00e1544) (#674)",
-        "resolve the exe-db container dynamically in wire-update-service.sh (bug 7ff62674) (#666)",
-        "project attribution must survive git worktrees (e19ce3a3) (#661)",
-        "--services is run-scoped, managed-set writes additive-only (bug db262248) (#660)",
-        "fail-closed manifest signatures + built-in verification key (bug c00e1544) (#664)",
-        "make managed-permissions mode explicit in the shipped stack (e51ca54c) (#668)",
-        "role 'none' clears the roster admin bit + a real revoke path in the panel (Phase 1, e51ca54c) (#650)",
-        "enforce prepaid credit balance with a 402 gate (5a862f9c) (#642)",
-        "add missing /openai segment to Gemini base URL (#648)",
-        "stop committing empty secrets in wrangler [vars] (b6f1cbf9) (#647)",
-        "make isolation real and non-optional (2b7072a7) (#621)"
+        "api-router: prepaid credit balance is now enforced with a 402 gate — a zero or negative balance could previously consume AI indefinitely (P0 5a862f9c)",
+        "daemon: every kill is attributed and the PID identity verified before signalling (7a915790)",
+        "memory: project attribution survives git worktrees (e19ce3a3)",
+        "stack: every shipped image is digest-pinned and strict-digest is now the DEFAULT",
+        "stack-update: fail-closed manifest signatures with a built-in verification key; live manifest first with the packaged copy only as an offline fallback (c00e1544)",
+        "stack-update: --services is run-scoped and managed-set writes are additive-only (db262248)",
+        "stack-update: state files written 0644 so the drift watchdog can read them",
+        "db-integrity: honest backup verification — the index was healthy and the alarm was not (e0b92e67)",
+        "worker: stop committing empty secrets in wrangler [vars] (b6f1cbf9)",
+        "api-router: add the missing /openai segment to the Gemini base URL",
+        "monitor: agent healthcheck matches the pinned image generation (9ce2a68b)",
+        "deploy: resolve the exe-db container dynamically; managed-permissions mode is explicit in the shipped stack",
+        "dispatch: the named-subagent default is taught at every layer, not just the ladder",
+        "tests: hermetic isolation is real and non-optional (2b7072a7)"
       ],
-      "security": [],
-      "other": [
-        "v0.9.365 (#686)",
-        "build + push the exe-dashboard image on main (was hand-shipped) (#654)",
-        "right-size the x64 Linux release gate to native-module verification (e8f2cccd) (#651)",
-        "release(stack): 0.9.35 — pin exe-auth v0.5.0 (EXE INTELLIGENCE front door) (#645)"
+      "infrastructure": [
+        "release path is deadlock-proof: the publish gate now asserts the branch-protection REQUIRED CONTEXTS on the release SHA instead of waiting for a whole workflow run to conclude, and it runs on a local runner so it can never hold the lane it is waiting for. A non-required job can no longer gate a release",
+        "release-drift monitor: every 30 minutes the published npm dist-tag is compared against main's package.json and alerts on divergence — v0.9.363 was believed shipped while npm served 0.9.362 for five days",
+        "x64 Linux release gate right-sized to native-module verification (e8f2cccd) — the full 8,400-test matrix no longer runs on the shared VPS",
+        "extended-tests moved out of the CI workflow so a non-required nightly job stops gating releases",
+        "dashboard image is built and pushed on main instead of being hand-shipped"
       ],
+      "security": [],
+      "other": [],
       "migration_notes": []
     },
     "0.9.364": {
@@ -91,34 +125,6 @@
       "security": [],
       "other": [],
       "migration_notes": []
-    },
-    "0.9.362": {
-      "version": "0.9.362",
-      "date": "2026-08-08",
-      "features": [
-        "p0 timers: daemon timers moved off the event loop — long-running timer callbacks no longer block the daemon event loop, and a worker-race in timer scheduling is closed so overlapping ticks cannot starve MCP handling (Codex gpt-5.5 build, triage 2026-08-06) (#562, re-review findings closed in #571)",
-        "p0 durability: last-mile durability for the local store — encrypted backups now actually run, the write path preserves the WAL and does not drop the ledger, and duplicate writes are de-duplicated (Codex gpt-5.5 build) (#560, 5 Codex NO-GO findings closed in #570)",
-        "p0 postinstall: postinstall now fails loud on genuine failures — the real exit code is propagated instead of being swallowed, so a broken install surfaces immediately instead of silently degrading (rebuild of #561, Codex findings fixed) (#574)"
-      ],
-      "fixes": [
-        "p0 provenance: app-image provenance repo map hardened against spoofing — the imageName→ghRepo mapping is enforced so a cross-named app image cannot masquerade under another repo's provenance (#572)"
-      ],
-      "security": [],
-      "other": [],
-      "migration_notes": []
-    },
-    "0.9.359": {
-      "version": "0.9.359",
-      "date": "2026-07-30",
-      "features": [],
-      "fixes": [
-        "org-mode: the org-mode-anchor keychain probe no longer risks raising the DESTRUCTIVE macOS 'A keychain cannot be found to store org-mode-anchor' dialog (whose 'Reset To Defaults' button can wipe the login keychain). nativeKeychainAllowed() now skips the native keychain — a best-effort mirror of the authoritative home-anchored file, so nothing is lost — in the daemon (EXE_IS_DAEMON), SSH/remote sessions, and on macOS with no default keychain (probed via a read-only `security default-keychain` that never invokes SecurityAgent). A healthy interactive GUI login is unaffected. Strictly-safer 1-file guard tightening (#514)",
-        "privacy: stop unconsented telemetry + support-content egress (bug 4b8b47fd, P0) (#510)",
-        "internal (dormant — no user-facing change until the org feature is wired): AI-Partner phase-1 infrastructure — B1 org-mode privacy/crypto boundary via a boot-resolved SyncCipher (existing single-user installs keep byte-identical v=1 cloud-sync encryption; the org path stays dormant until an org-membership anchor exists) + partner signing identity + sealed mailbox envelope (#504), and B2 sealed-mailbox relay/transport with cross-tenant SQL-predicate scoping (#505)"
-      ],
-      "security": [],
-      "other": [],
-      "migration_notes": []
     }
   }
 }

package/dist/chunk-2RQT7TED.js

@@ -1,275 +0,0 @@
-import {
-  sessionScopeFilter
-} from "./chunk-ORNCMRIX.js";
-
-// src/lib/git-task-sweep.ts
-import { execSync } from "child_process";
-var DEFAULT_COMMIT_LIMIT = 50;
-var DEFAULT_STALE_MINUTES = 10;
-var AUTO_ESCALATE_THRESHOLD = 0.6;
-var EXACT_UUID_SCORE = 1;
-var TITLE_KEYWORD_SCORE = 0.5;
-var FILE_PATH_SCORE = 0.3;
-var MIN_KEYWORD_OVERLAP = 3;
-var STOP_WORDS = /* @__PURE__ */ new Set([
-  "a",
-  "an",
-  "the",
-  "and",
-  "or",
-  "but",
-  "in",
-  "on",
-  "at",
-  "to",
-  "for",
-  "of",
-  "with",
-  "by",
-  "from",
-  "is",
-  "it",
-  "as",
-  "be",
-  "was",
-  "are",
-  "this",
-  "that",
-  "not",
-  "no",
-  "if",
-  "so",
-  "do",
-  "up"
-]);
-function extractKeywords(text) {
-  return text.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length >= 3 && !STOP_WORDS.has(w));
-}
-function matchScore(task, commitMessage, changedFiles) {
-  if (task.id.length >= 8 && commitMessage.includes(task.id)) {
-    return EXACT_UUID_SCORE;
-  }
-  let score = 0;
-  const titleWords = extractKeywords(task.title);
-  const commitWords = new Set(extractKeywords(commitMessage));
-  const overlap = titleWords.filter((w) => commitWords.has(w));
-  if (overlap.length >= MIN_KEYWORD_OVERLAP) {
-    score += TITLE_KEYWORD_SCORE;
-  }
-  if (task.context && changedFiles.length > 0) {
-    const contextLower = task.context.toLowerCase();
-    const hasFileMatch = changedFiles.some(
-      (f) => contextLower.includes(f.toLowerCase())
-    );
-    if (hasFileMatch) {
-      score += FILE_PATH_SCORE;
-    }
-  }
-  return score;
-}
-function getRecentCommits(limit = DEFAULT_COMMIT_LIMIT) {
-  try {
-    const SEPARATOR = "<<SEP>>";
-    const output = execSync(
-      `git log --format="%h${SEPARATOR}%s${SEPARATOR}%aI" --name-only -n ${limit} -z`,
-      { encoding: "utf8", timeout: 1e4 }
-    );
-    const entries = output.split("\0").filter(Boolean);
-    const commits = [];
-    let current = null;
-    for (const entry of entries) {
-      if (entry.includes(SEPARATOR)) {
-        const lines = entry.split("\n");
-        const headerLine = lines[0];
-        const parts = headerLine.split(SEPARATOR);
-        if (parts.length >= 3) {
-          if (current) commits.push(current);
-          current = {
-            hash: parts[0],
-            message: parts[1],
-            files: lines.slice(1).filter(Boolean),
-            date: new Date(parts[2])
-          };
-        }
-      } else if (current) {
-        const files = entry.split("\n").filter(Boolean);
-        current.files.push(...files);
-      }
-    }
-    if (current) commits.push(current);
-    return commits;
-  } catch {
-    return [];
-  }
-}
-function pushUnpushedCommits() {
-  const run = (args) => execSync(`git ${args}`, { encoding: "utf8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
-  let branch;
-  try {
-    branch = run("rev-parse --abbrev-ref HEAD");
-  } catch {
-    return { branch: null, ahead: 0, pushed: false, status: "not_a_repo" };
-  }
-  if (!branch || branch === "HEAD") {
-    return { branch: null, ahead: 0, pushed: false, status: "no_branch" };
-  }
-  if (branch === "main" || branch === "master") {
-    return { branch, ahead: 0, pushed: false, status: "default_branch_skipped" };
-  }
-  let ahead = 0;
-  let hasUpstream = false;
-  try {
-    run("rev-parse --abbrev-ref --symbolic-full-name @{u}");
-    hasUpstream = true;
-    const count = run("rev-list --count @{u}..HEAD");
-    ahead = Number.parseInt(count, 10) || 0;
-  } catch {
-    hasUpstream = false;
-    for (const base of ["origin/main", "origin/master"]) {
-      try {
-        const count = run(`rev-list --count ${base}..HEAD`);
-        ahead = Number.parseInt(count, 10) || 0;
-        if (ahead > 0) break;
-      } catch {
-      }
-    }
-    if (ahead === 0) {
-      try {
-        const count = run("rev-list --count HEAD");
-        ahead = Number.parseInt(count, 10) || 0;
-      } catch {
-        ahead = 0;
-      }
-    }
-  }
-  if (ahead <= 0) {
-    return { branch, ahead: 0, pushed: false, status: "nothing_to_push" };
-  }
-  try {
-    if (hasUpstream) {
-      run("push");
-    } else {
-      run(`push --set-upstream origin ${branch}`);
-    }
-    return { branch, ahead, pushed: true, status: "pushed" };
-  } catch (err) {
-    return {
-      branch,
-      ahead,
-      pushed: false,
-      status: "push_failed",
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-function isStale(updatedAt, staleMinutes) {
-  const updated = new Date(updatedAt).getTime();
-  const threshold = Date.now() - staleMinutes * 6e4;
-  return updated < threshold;
-}
-function findBestMatch(task, commits) {
-  let best = null;
-  for (const commit of commits) {
-    const score = matchScore(task, commit.message, commit.files);
-    if (score >= AUTO_ESCALATE_THRESHOLD && (!best || score > best.score)) {
-      best = { commit, score };
-    }
-  }
-  return best;
-}
-async function sweepTasks(projectName, options = {}) {
-  const commitLimit = options.commitLimit ?? DEFAULT_COMMIT_LIMIT;
-  const staleMinutes = options.staleMinutes ?? DEFAULT_STALE_MINUTES;
-  const dryRun = options.dryRun ?? false;
-  const result = { escalated: [], unchanged: 0, errors: [] };
-  const commits = getRecentCommits(commitLimit);
-  if (commits.length === 0) {
-    result.errors.push("No git commits found (not a git repo or empty history)");
-    return result;
-  }
-  let tasks;
-  try {
-    const { initStore } = await import("./lib/store.js");
-    await initStore();
-    const { getClient } = await import("./lib/database.js");
-    const client = getClient();
-    const conditions = ["status = 'in_progress'"];
-    const args = [];
-    if (projectName) {
-      conditions.push("project_name = ?");
-      args.push(projectName);
-    }
-    const swScope = sessionScopeFilter();
-    if (swScope.sql) {
-      conditions.push("(session_scope IS NULL OR session_scope = ?)");
-      args.push(...swScope.args);
-    }
-    const queryResult = await client.execute({
-      sql: `SELECT id, title, assigned_to, project_name, status, updated_at, context
-            FROM tasks WHERE ${conditions.join(" AND ")}
-            ORDER BY updated_at ASC`,
-      args
-    });
-    tasks = queryResult.rows.map((r) => ({
-      id: String(r.id),
-      title: String(r.title),
-      assignedTo: String(r.assigned_to),
-      projectName: String(r.project_name),
-      status: String(r.status),
-      updatedAt: String(r.updated_at),
-      context: r.context ? String(r.context) : void 0
-    }));
-  } catch (err) {
-    result.errors.push(`DB query failed: ${err instanceof Error ? err.message : String(err)}`);
-    return result;
-  }
-  if (tasks.length === 0) {
-    return result;
-  }
-  for (const task of tasks) {
-    if (!isStale(task.updatedAt, staleMinutes)) {
-      result.unchanged++;
-      continue;
-    }
-    const match = findBestMatch(task, commits);
-    if (!match) {
-      result.unchanged++;
-      continue;
-    }
-    if (!dryRun) {
-      try {
-        const { updateTaskStatus } = await import("./tasks-crud-W7VGWRUV.js");
-        await updateTaskStatus({
-          taskId: task.id,
-          status: "needs_review",
-          result: `Auto-escalated by git-sweep: matching commit ${match.commit.hash} found (score: ${match.score.toFixed(2)})`
-        });
-      } catch (err) {
-        result.errors.push(
-          `Failed to escalate task ${task.id}: ${err instanceof Error ? err.message : String(err)}`
-        );
-        continue;
-      }
-    }
-    result.escalated.push({
-      taskId: task.id,
-      title: task.title,
-      matchedCommit: match.commit.hash,
-      score: match.score
-    });
-    process.stderr.write(
-      `[git-sweep] ${dryRun ? "WOULD escalate" : "Escalated"} task ${task.id} \u2192 commit ${match.commit.hash} (score: ${match.score.toFixed(2)})
-`
-    );
-  }
-  return result;
-}
-
-export {
-  extractKeywords,
-  matchScore,
-  getRecentCommits,
-  pushUnpushedCommits,
-  findBestMatch,
-  sweepTasks
-};