@askexenow/exe-os 0.9.370 → 0.9.372

package/dist/{chunk-U6SWEAAK.js → chunk-CNC57JCS.js}

@@ -2,15 +2,15 @@ import {
   BUSY_PATTERN,
   sendIntercom,
   updateTaskStatus
-} from "./chunk-LMZD3A6K.js";
+} from "./chunk-XHYHX6F7.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-TTAPKUQV.js";
+} from "./chunk-E2WEFZOR.js";
 import {
   baseAgentName,
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-5XRKPKHJ.js";
+} from "./chunk-5DCCKHDY.js";
 
 // src/lib/play-mode.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
@@ -332,7 +332,7 @@ async function surfaceStaleDispatchPendingSignals(scopeList, now, thresholdMs =
     const sessionScope = signalScope ?? (scopeList.length === 1 ? scopeList[0] : null);
     if (allowedScopes.size > 0 && sessionScope && !allowedScopes.has(sessionScope)) continue;
     try {
-      const { writeNotification } = await import("./notifications-JGVJO7S2.js");
+      const { writeNotification } = await import("./notifications-7B6D7Y5C.js");
       await writeNotification({
         agentId: getCoordinatorName(),
         agentRole: "COO",

package/dist/{chunk-I3FXDCUE.js → chunk-DKBPCOU4.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-A7XLR3K7.js";
 import {
   getDeviceInfo
-} from "./chunk-2A76BLAD.js";
+} from "./chunk-GB3AHV5F.js";
 import {
   EXE_AI_DIR
 } from "./chunk-QMSEL5YS.js";
@@ -232,6 +232,12 @@ function cacheResponse(token) {
   } catch {
   }
 }
+function clearLicenseCache() {
+  try {
+    if (existsSync(CACHE_PATH)) rmSync(CACHE_PATH, { force: true });
+  } catch {
+  }
+}
 async function validateViaCFWorker(apiKey, deviceId, timeoutMs = 1e4) {
   try {
     const res = await fetchRetry(`${API_BASE}/auth/activate`, {
@@ -240,38 +246,51 @@ async function validateViaCFWorker(apiKey, deviceId, timeoutMs = 1e4) {
       body: JSON.stringify({ apiKey, deviceId }),
       signal: AbortSignal.timeout(timeoutMs)
     }, timeoutMs);
-    if (!res.ok) return null;
-    const data = await res.json();
-    if (data.error === "device_limit_exceeded") return null;
+    if (!res.ok) return { kind: "unreachable" };
+    let data;
+    try {
+      data = await res.json();
+    } catch {
+      return { kind: "unreachable" };
+    }
+    if (data.error === "device_limit_exceeded") return { kind: "unreachable" };
     if (data.error === "seat_released") {
       markPersonalFreeGrandfather(data.email ?? "", data.org_id);
-      return grandfatheredFreeLicense();
+      return { kind: "valid", license: grandfatheredFreeLicense() };
     }
-    if (!data.valid) return null;
+    if (!data.valid) return { kind: "invalid" };
     clearPersonalFreeGrandfather();
     if (data.token) {
       cacheResponse(data.token);
       const verified = await verifyLicenseJwt(data.token);
-      if (verified) return verified;
+      if (verified) return { kind: "valid", license: verified };
     }
     const limits = PLAN_LIMITS[data.plan] ?? PLAN_LIMITS.free;
     return {
-      valid: data.valid,
-      plan: data.plan,
-      email: data.email,
-      expiresAt: data.expiresAt,
-      deviceLimit: limits.devices,
-      employeeLimit: limits.employees,
-      memoryLimit: limits.memories
+      kind: "valid",
+      license: {
+        valid: data.valid,
+        plan: data.plan,
+        email: data.email,
+        expiresAt: data.expiresAt,
+        deviceLimit: limits.devices,
+        employeeLimit: limits.employees,
+        memoryLimit: limits.memories
+      }
     };
   } catch {
-    return null;
+    return { kind: "unreachable" };
   }
 }
 async function validateLicense(apiKey, deviceId) {
   const did = deviceId ?? loadDeviceId();
-  const cfResult = await validateViaCFWorker(apiKey, did);
-  if (cfResult) return cfResult;
+  const cf = await validateViaCFWorker(apiKey, did);
+  if (cf.kind === "valid") return cf.license;
+  if (cf.kind === "invalid") {
+    clearLicenseCache();
+    clearPersonalFreeGrandfather();
+    return { ...FREE_LICENSE, valid: false };
+  }
   const cached = await getCachedLicense();
   if (cached) return cached;
   const graced = await getGraceVerifiedLicense();
@@ -323,12 +342,22 @@ async function refreshLicense(opts) {
   }
   const deviceId = loadDeviceId();
   const online = await validateViaCFWorker(key, deviceId, opts?.timeoutMs ?? 1e4);
-  if (online) {
+  if (online.kind === "valid") {
+    return {
+      reachedCloud: true,
+      changed: oldPlan !== null && oldPlan !== online.license.plan,
+      oldPlan,
+      license: online.license
+    };
+  }
+  if (online.kind === "invalid") {
+    clearLicenseCache();
+    clearPersonalFreeGrandfather();
     return {
       reachedCloud: true,
-      changed: oldPlan !== null && oldPlan !== online.plan,
+      changed: oldPlan !== null,
       oldPlan,
-      license: online
+      license: { ...FREE_LICENSE, valid: false }
     };
   }
   const fallback = before ?? await getGraceVerifiedLicense() ?? { ...FREE_LICENSE, valid: false };
@@ -463,6 +492,7 @@ export {
   getGraceVerifiedLicense,
   readCachedLicenseToken,
   getLicenseCacheAgeMs,
+  clearLicenseCache,
   validateLicense,
   checkLicense,
   refreshLicense,

package/dist/{chunk-TTAPKUQV.js → chunk-E2WEFZOR.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-5XRKPKHJ.js";
+} from "./chunk-5DCCKHDY.js";
 
 // src/lib/orchestration-events.ts
 import crypto from "crypto";

package/dist/{chunk-AYMYU3RC.js → chunk-E7UCDSUE.js}

@@ -1,11 +1,11 @@
-import {
-  ingest
-} from "./chunk-4OVLY2NR.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-RHDDSIFC.js";
+} from "./chunk-KXYFBBZR.js";
+import {
+  ingest
+} from "./chunk-TK4MI6F6.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";

package/dist/{chunk-AWWAZBL7.js → chunk-ECHLVLA7.js}

@@ -1,6 +1,6 @@
 import {
   processCRMEvent
-} from "./chunk-EQJ462VM.js";
+} from "./chunk-ADNBOKYZ.js";
 
 // src/gateway/adapters/crm-webhook.ts
 function parseTwentyWebhook(payload) {

package/dist/{chunk-EKOB53FE.js → chunk-EEXX4UMQ.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-5XRKPKHJ.js";
+} from "./chunk-5DCCKHDY.js";
 
 // src/lib/token-budget.ts
 var WARN_THRESHOLD = 0.8;

package/dist/{chunk-YTDIGGFZ.js → chunk-ELXFSIIM.js}

@@ -1,9 +1,9 @@
 import {
   listBehaviors
-} from "./chunk-5CYFJQGV.js";
+} from "./chunk-MBNIJXKI.js";
 import {
   incrementSkillUsage
-} from "./chunk-J7OPJPYG.js";
+} from "./chunk-L6ZNURWN.js";
 
 // src/lib/behavior-injection.ts
 import { appendFile } from "fs/promises";

package/dist/{chunk-XFZHTFH5.js → chunk-ERVQTR7P.js}

@@ -3,13 +3,13 @@ import {
 } from "./chunk-THIJIOE2.js";
 import {
   isGhostBehaviorRow
-} from "./chunk-5CYFJQGV.js";
+} from "./chunk-MBNIJXKI.js";
 import {
   getClient,
   getIdentity,
   listIdentities,
   updateIdentity
-} from "./chunk-5XRKPKHJ.js";
+} from "./chunk-5DCCKHDY.js";
 import {
   atomicWriteJsonSync
 } from "./chunk-HSGBZSCA.js";

package/dist/{chunk-VFI3HGKM.js → chunk-FB343XQX.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-75H4R62K.js";
 import {
   initStore
-} from "./chunk-HIIEIDD2.js";
+} from "./chunk-OYQNNKNS.js";
 import {
   getClient,
   isInitialized
-} from "./chunk-5XRKPKHJ.js";
+} from "./chunk-5DCCKHDY.js";
 
 // src/lib/schedules.ts
 import crypto from "crypto";

package/dist/{chunk-MMDOULD5.js → chunk-FBYAXTDM.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentSessionScope,
   strictSessionScopeFilter
-} from "./chunk-LMZD3A6K.js";
+} from "./chunk-XHYHX6F7.js";
 import {
   getProjectName
 } from "./chunk-W2IRQJ6R.js";

package/dist/{chunk-XWTZEVBQ.js → chunk-GH6YJOOC.js}

@@ -1,24 +1,24 @@
 import {
   recordSessionKill
-} from "./chunk-75IYPYUY.js";
+} from "./chunk-RBYHJDAT.js";
 import {
   sessionScopeFilter,
   verifyPaneAtCapacity,
   writeNotification
-} from "./chunk-LMZD3A6K.js";
+} from "./chunk-XHYHX6F7.js";
 import {
   listSessions
-} from "./chunk-RYDR7TRT.js";
+} from "./chunk-MDGYXUOV.js";
 import {
   getTransport
 } from "./chunk-UXLO7VHX.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-TTAPKUQV.js";
+} from "./chunk-E2WEFZOR.js";
 import {
   getClient,
   isCoordinatorName
-} from "./chunk-5XRKPKHJ.js";
+} from "./chunk-5DCCKHDY.js";
 
 // src/lib/capacity-monitor.ts
 var CAPACITY_PATTERNS = [

package/dist/{chunk-4HNVZDCM.js → chunk-GU62SNDH.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-L25OAFOU.js";
 import {
   loadLicense
-} from "./chunk-I3FXDCUE.js";
+} from "./chunk-DKBPCOU4.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync as spawnSync2 } from "child_process";

package/dist/{chunk-RLWSVSDV.js → chunk-HDW4XPDV.js}

@@ -1,6 +1,6 @@
 import {
   canonicalizeStackManifest
-} from "./chunk-4HNVZDCM.js";
+} from "./chunk-GU62SNDH.js";
 
 // src/lib/stack-manifest-write.ts
 import { readFileSync, writeFileSync } from "fs";

package/dist/{chunk-6LU3DRZF.js → chunk-HECXZGGZ.js}

@@ -2,7 +2,7 @@ import {
   dispatchTaskToEmployee,
   markTaskNotificationsRead,
   notifyTaskDone
-} from "./chunk-ZXZHEAWO.js";
+} from "./chunk-QTYJPWJN.js";
 import {
   clearCurrentTask,
   writeCurrentTask
@@ -16,7 +16,7 @@ import {
   strictSessionScopeFilter,
   updateTaskStatus,
   writeNotification
-} from "./chunk-LMZD3A6K.js";
+} from "./chunk-XHYHX6F7.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
@@ -27,7 +27,7 @@ import {
   getClient,
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-5XRKPKHJ.js";
+} from "./chunk-5DCCKHDY.js";
 
 // src/lib/tasks-chain.ts
 import path from "path";
@@ -62,7 +62,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
   }
   if (unblockedRows.rows.length > 0 && !process.env.VITEST) {
     try {
-      const { dispatchTaskToEmployee: dispatchTaskToEmployee2 } = await import("./tasks-notify-4F3HFDCG.js");
+      const { dispatchTaskToEmployee: dispatchTaskToEmployee2 } = await import("./tasks-notify-VFMAURTN.js");
       const dispatched = /* @__PURE__ */ new Set();
       for (const ur of unblockedRows.rows) {
         const assignee = String(ur.assigned_to);
@@ -87,7 +87,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
       }
     } catch {
       try {
-        const { queueIntercom } = await import("./intercom-queue-D57B3JR3.js");
+        const { queueIntercom } = await import("./intercom-queue-6DZ7BANV.js");
         const dispatched = /* @__PURE__ */ new Set();
         for (const ur of unblockedRows.rows) {
           const assignee = String(ur.assigned_to);
@@ -285,7 +285,7 @@ async function updateTask(input) {
         try {
           process.stderr.write(`[tasks] EVENT: tmux delivery failed for reviewer="${reviewer}". Queueing for daemon delivery.
 `);
-          const { queueIntercom } = await import("./intercom-queue-D57B3JR3.js");
+          const { queueIntercom } = await import("./intercom-queue-6DZ7BANV.js");
           const { resolveExeSession } = await import("./lib/tmux-routing.js");
           const exeSession = row.session_scope ? String(row.session_scope) : resolveExeSession();
           if (exeSession) {
@@ -302,7 +302,7 @@ async function updateTask(input) {
         }
       }
       try {
-        const { pushNotifyAsync } = await import("./push-notifications-P2HVB7LZ.js");
+        const { pushNotifyAsync } = await import("./push-notifications-HR3FZRDI.js");
         pushNotifyAsync({
           event: "review_ready",
           title: `Review ready: ${taskTitle.slice(0, 50)}`,
@@ -314,7 +314,7 @@ async function updateTask(input) {
     }
     if (!isCoordinator && isCompletionReviewTransition) {
       try {
-        const { pushNotifyAsync } = await import("./push-notifications-P2HVB7LZ.js");
+        const { pushNotifyAsync } = await import("./push-notifications-HR3FZRDI.js");
         const event = input.status === "needs_review" ? "review_ready" : "task_complete";
         pushNotifyAsync({
           event,
@@ -329,7 +329,7 @@ async function updateTask(input) {
     await markTaskNotificationsRead(taskFile);
     if (isCompletionReviewTransition && !isCoordinator && row.reviewer) {
       try {
-        const { writeNotification: writeNotification2 } = await import("./notifications-JGVJO7S2.js");
+        const { writeNotification: writeNotification2 } = await import("./notifications-7B6D7Y5C.js");
         const reviewer = String(row.reviewer);
         await writeNotification2({
           agentId: reviewer,

package/dist/{chunk-DZU7LMXH.js → chunk-HHE2HV3V.js}

@@ -1,6 +1,6 @@
 import {
   listReminders
-} from "./chunk-T3TSX4XB.js";
+} from "./chunk-SEP5ITFQ.js";
 
 // src/mcp/tools/list-reminders.ts
 import { z } from "zod";

package/dist/{chunk-637HNKYP.js → chunk-HIIXCAEE.js}

@@ -3,12 +3,12 @@ import {
   getClient,
   isInitialized,
   loadEmployees
-} from "./chunk-5XRKPKHJ.js";
+} from "./chunk-5DCCKHDY.js";
 import {
   checkLicense,
   isFeatureAllowed,
   isPersonalFreeGrandfathered
-} from "./chunk-I3FXDCUE.js";
+} from "./chunk-DKBPCOU4.js";
 import {
   PLAN_LIMITS
 } from "./chunk-A7XLR3K7.js";

package/dist/{chunk-REOG2KQS.js → chunk-HIVZ53YB.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-THIJIOE2.js";
 import {
   getClient
-} from "./chunk-5XRKPKHJ.js";
+} from "./chunk-5DCCKHDY.js";
 
 // src/lib/global-procedures.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-QCQT5RXR.js → chunk-HV6Y6F4X.js}

@@ -8,13 +8,14 @@ var GIT_TIMEOUT_MS = (() => {
   const n = raw ? Number.parseInt(raw, 10) : Number.NaN;
   return Number.isFinite(n) && n > 0 ? n : 1e4;
 })();
-function runGit(cwd, args) {
+function runGit(cwd, args, extraEnv) {
   try {
     const out = execFileSync("git", args, {
       cwd,
       encoding: "utf8",
       timeout: GIT_TIMEOUT_MS,
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      ...extraEnv ? { env: { ...process.env, ...extraEnv } } : {}
     });
     return { status: "ok", stdout: out.trim() };
   } catch (err) {
@@ -422,15 +423,25 @@ function parsePush(args, contextDir) {
     positionals.push(a);
   }
   if (mirror) return { kind: "force-remote", verb: "push --mirror", contextDir };
+  const deleteFlag = del;
+  const remote = positionals[0] ?? null;
   const refspecs = positionals.length > 1 ? positionals.slice(1) : [];
   let targetsMain = false;
   let needsUpstream = false;
+  const deleteTargets = [];
   for (const spec of refspecs) {
     if (/^\+/.test(spec)) force = true;
     if (/^\+?:/.test(spec)) del = true;
     const bare = spec.replace(/^\+/, "");
     const colon = bare.indexOf(":");
     const dst = colon >= 0 ? bare.slice(colon + 1) : bare;
+    if (colon === 0) deleteTargets.push(dst);
+    else if (deleteFlag) {
+      if (colon > 0) {
+        return { kind: "unparseable", reason: `push --delete with a src:dst refspec ("${spec}") \u2014 the deleted ref cannot be determined` };
+      }
+      deleteTargets.push(bare);
+    }
     if (dst === "HEAD") {
       needsUpstream = true;
       continue;
@@ -439,7 +450,7 @@ function parsePush(args, contextDir) {
   }
   if (refspecs.length === 0) needsUpstream = true;
   const destructive = force || del;
-  return { kind: "push", destructive, targetsMain, needsUpstream, contextDir };
+  return { kind: "push", destructive, targetsMain, needsUpstream, contextDir, remote, deleteTargets };
 }
 function resolveRepoStateOnce(cwd) {
   const root = runGit(cwd, ["rev-parse", "--show-toplevel"]);
@@ -477,6 +488,62 @@ function resolveRepoState(cwd) {
   if (first.ok || first.reason !== "unverifiable") return first;
   return resolveRepoStateOnce(cwd);
 }
+function isResolvableRefName(name) {
+  if (name.length === 0 || name.length > 255) return false;
+  if (!/^[A-Za-z0-9._\-/]+$/.test(name)) return false;
+  if (name.startsWith("-") || name.startsWith("/") || name.endsWith("/")) return false;
+  if (name.includes("..") || name.includes("//")) return false;
+  if (name.endsWith(".lock") || name.endsWith(".")) return false;
+  return true;
+}
+function isUsableRemoteOperand(remote) {
+  return remote.length > 0 && !remote.startsWith("-");
+}
+function resolveRemoteRefKind(cwd, remote, name) {
+  if (!isUsableRemoteOperand(remote) || !isResolvableRefName(name)) return "unavailable";
+  const tagRef = `refs/tags/${name}`;
+  const headRef = `refs/heads/${name}`;
+  const res = runGit(cwd, ["ls-remote", remote, tagRef, headRef], { GIT_TERMINAL_PROMPT: "0" });
+  if (res.status !== "ok") return "unavailable";
+  let isTag = false;
+  let isBranch = false;
+  for (const line of res.stdout.split("\n")) {
+    const ref = line.split("	")[1]?.trim();
+    if (!ref) continue;
+    if (ref === tagRef || ref === `${tagRef}^{}`) isTag = true;
+    else if (ref === headRef) isBranch = true;
+  }
+  if (isTag && isBranch) return "both";
+  if (isTag) return "tag";
+  if (isBranch) return "branch";
+  return "absent";
+}
+function classifyDeleteTarget(target, remote, resolve) {
+  if (target.startsWith("refs/tags/") || target.startsWith("tags/")) return { verdict: "tag" };
+  const head = destHeadShortName(target);
+  if (head !== null && headTargetsMainOrGlob(head)) return { verdict: "main" };
+  if (target.startsWith("refs/heads/") || target.startsWith("heads/")) {
+    return { verdict: "blocked", reason: `"${target}" is a branch ref, not a tag` };
+  }
+  if (target.startsWith("refs/")) {
+    return { verdict: "blocked", reason: `"${target}" is not a tag ref and cannot be proven safe to delete` };
+  }
+  if (remote === null) return { verdict: "blocked", reason: `no remote given, so "${target}" cannot be resolved` };
+  if (!isUsableRemoteOperand(remote)) return { verdict: "blocked", reason: `remote "${remote}" is not a usable operand` };
+  if (!isResolvableRefName(target)) return { verdict: "blocked", reason: `"${target}" is not a resolvable ref name (globs and exotic characters are never resolved)` };
+  switch (resolve(remote, target)) {
+    case "tag":
+      return { verdict: "tag" };
+    case "branch":
+      return { verdict: "blocked", reason: `"${target}" exists on ${remote} as a BRANCH, not a tag` };
+    case "both":
+      return { verdict: "blocked", reason: `"${target}" exists on ${remote} as BOTH a tag and a branch \u2014 the target is genuinely ambiguous` };
+    case "absent":
+      return { verdict: "blocked", reason: `"${target}" does not exist on ${remote} as either a tag or a branch, so it cannot be proven to be a tag` };
+    default:
+      return { verdict: "blocked", reason: `the guard could not reach ${remote} to prove "${target}" is a tag (network, auth, or timeout) \u2014 a failed lookup is never a permit` };
+  }
+}
 function resolvePushTargetOnce(cwd) {
   for (const rev of ["@{push}", "@{upstream}"]) {
     const r = runGit(cwd, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", rev]);
@@ -557,6 +624,17 @@ function evaluateMainGuard(command, opts = {}) {
     return { block: true, message: formatMainAheadBlockMessage({ repoRoot: ctxDir, branch: state.mainBranch, ahead: state.mainAhead, commits: state.aheadCommits }, parsed.verb) };
   }
   if (!parsed.destructive) return { block: false };
+  const resolveRemoteRef = opts.remoteRefResolver ?? resolveRemoteRefKind;
+  for (const target of parsed.deleteTargets) {
+    const v = classifyDeleteTarget(
+      target,
+      parsed.remote,
+      (remote, name) => resolveRemoteRef(ctxDir, remote, name)
+    );
+    if (v.verdict === "tag") continue;
+    if (v.verdict === "main") return { block: true, message: formatForcePushBlockMessage("force/delete push to main") };
+    return { block: true, message: formatUnprovableDeleteBlockMessage(target, parsed.remote, v.reason) };
+  }
   let targetsMain = parsed.targetsMain;
   if (!targetsMain && parsed.needsUpstream) {
     const state = resolveState(ctxDir);
@@ -592,6 +670,15 @@ SAFE ALTERNATIVES:
   \u2022 Force-pushing a FEATURE branch is allowed; only main/master is guarded.
 ${OVERRIDE_LINE}`;
 }
+function formatUnprovableDeleteBlockMessage(target, remote, reason) {
+  return `\u{1F6AB} BLOCKED: \`git push --delete ${remote ?? "<remote>"} ${target}\` \u2014 the guard could not PROVE this is a tag: ${reason}.
+WHY: deleting a remote BRANCH destroys shared work; deleting a TAG does not. A bare ref name does not say which it is, so the guard resolves it on the remote and permits ONLY a name that exists as a tag and NOT as a branch (bug 6aaea78f). Branch, both, absent, or an unreachable remote all keep blocking \u2014 a failed lookup is not a permit.
+SAFE ALTERNATIVES:
+  \u2022 Deleting a TAG: say so explicitly \u2014 git push ${remote ?? "origin"} --delete refs/tags/${target.replace(/^refs\/(tags|heads)\//, "")}
+  \u2022 Deleting a BRANCH on the remote: do it from the GitHub/host UI, or ask a human \u2014 this guard will not do it for you.
+  \u2022 If the remote was just unreachable, re-run once the network/auth is working; the guard will resolve it then.
+NOTE: EXE_FORCE_ALLOW_MAIN_HISTORY_REWRITE is NOT the escape hatch for this \u2014 it declares a main-history rewrite, which this is not.`;
+}
 function formatUnverifiableBlockMessage(reason) {
   return `\u{1F6AB} BLOCKED: this git command could rewrite main/master and the guard CANNOT verify its target \u2014 ${reason}.
 WHY: exe-os fails CLOSED here \u2014 a compound/wrapped command can move HEAD before a check runs, so an unverifiable destructive-git command is denied rather than parsed permissively (bug 6aaea78f).
@@ -613,6 +700,10 @@ export {
   containsDestructiveGitCandidate,
   parseSingleGitCommand,
   resolveRepoState,
+  isResolvableRefName,
+  isUsableRemoteOperand,
+  resolveRemoteRefKind,
+  classifyDeleteTarget,
   resolvePushTargetBranch,
   getLocalMainAheadInfo,
   getCurrentBranch,
@@ -620,6 +711,7 @@ export {
   evaluateMainGuard,
   formatMainAheadBlockMessage,
   formatForcePushBlockMessage,
+  formatUnprovableDeleteBlockMessage,
   formatUnverifiableBlockMessage,
   formatStateUnverifiableBlockMessage
 };

package/dist/{chunk-RLDMUSRM.js → chunk-IDZPQG2D.js}

@@ -2,7 +2,7 @@ import {
   connectEmbedDaemon,
   disconnectClient,
   embedViaClient
-} from "./chunk-BNHAZ65R.js";
+} from "./chunk-UQUUNGTP.js";
 import {
   EMBEDDING_DIM
 } from "./chunk-FXU7JOXK.js";

package/dist/{chunk-NHJUJWLY.js → chunk-IPMUWYRQ.js}

@@ -1,9 +1,9 @@
 import {
   sendMessage
-} from "./chunk-BFP7JOD7.js";
+} from "./chunk-7WQRFSZI.js";
 import {
   getActiveAgent
-} from "./chunk-MO2A7GUU.js";
+} from "./chunk-KYFFVTGO.js";
 
 // src/mcp/tools/send-message.ts
 import { z } from "zod";