@askexenow/exe-os 0.9.382 → 0.9.384

package/dist/{chunk-GGEKMY6G.js → chunk-P3UX5EH4.js}

@@ -1,16 +1,16 @@
 import {
   isExeSession
-} from "./chunk-ZVBVPX4W.js";
+} from "./chunk-7UHZBVP3.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-VUOAPKPI.js";
+} from "./chunk-LSNBTGW4.js";
 import {
   getClient,
   isCoordinatorName
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 import {
   isDaemonAlive
-} from "./chunk-CL4J4757.js";
+} from "./chunk-QH5ZQ5SJ.js";
 
 // src/lib/session-kill-telemetry.ts
 import crypto from "crypto";

package/dist/{chunk-F7IRZU5G.js → chunk-P4PIZOL2.js}

@@ -4,10 +4,10 @@ import {
   extractIdentifiers,
   isGarbageEntity,
   normalizeEntityName
-} from "./chunk-CRHI5QTZ.js";
+} from "./chunk-46VSBDUW.js";
 import {
   getClient
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 
 // src/lib/memory-graph-extractor.ts
 function relationshipId(sourceId, targetId, relType) {
@@ -432,7 +432,7 @@ async function upsertMemoryGraph(result, memoryId, opts) {
     });
   }
   try {
-    const { createCoOccurrenceEdges } = await import("./co-occurrence-DMOOGBVV.js");
+    const { createCoOccurrenceEdges } = await import("./co-occurrence-R5AG4OAU.js");
     await createCoOccurrenceEdges(result.entities, memoryId, { linkOnly });
   } catch {
   }

package/dist/{chunk-GEPFKUUR.js → chunk-P4XLIPB7.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-GPUOUUHA.js → chunk-PCV52RYM.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-BTSWFMEH.js";
 import {
   EXE_AI_DIR
-} from "./chunk-ZIG7VPJV.js";
+} from "./chunk-MMS2HBRT.js";
 import {
   enforcePrivateFileSync,
   ensurePrivateDirSync

package/dist/{chunk-XR3773KZ.js → chunk-PL4CFSQ7.js}

@@ -1,7 +1,7 @@
 import {
   getIdentity,
   loadEmployeesSync
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 
 // src/lib/drift-probes.ts
 var DRIFT_THRESHOLD = 80;

package/dist/{chunk-LLZNPOGB.js → chunk-PLII76NJ.js}

@@ -373,6 +373,63 @@ function checkGotrueExternalDomain(env, expectedDomain) {
     message: `all ${present.length} GoTrue URL var(s) on the deployment domain (${domain})`
   };
 }
+function checkCrmAdminSeat(env, compose) {
+  const bug = "cff0de47 (crm-admin-seat)";
+  if (!compose.exists || !/\$\{EXE_CRM_ADMIN_EMAIL\b/.test(compose.text)) {
+    return {
+      check: "crm-admin-seat",
+      status: "pass",
+      bug,
+      message: "compose does not deploy exe-crm (no EXE_CRM_ADMIN_EMAIL reference) \u2014 no first admin to seat"
+    };
+  }
+  if (!env.exists) {
+    return {
+      check: "crm-admin-seat",
+      status: "warn",
+      bug,
+      message: "env file not provided \u2014 CRM first-admin seat not verified (pass --env to enforce)"
+    };
+  }
+  const domain = (env.values.get("DOMAIN") ?? "").trim();
+  if (domain === "" || /changeme/i.test(domain)) {
+    return {
+      check: "crm-admin-seat",
+      status: "pass",
+      bug,
+      message: `DOMAIN is unset or a placeholder (${domain || "unset"}) \u2014 template env, not a deployment; first-admin seat not applicable`
+    };
+  }
+  const raw = (env.values.get("EXE_CRM_ADMIN_EMAIL") ?? "").trim();
+  if (raw === "") {
+    return {
+      check: "crm-admin-seat",
+      status: "fail",
+      bug,
+      offenders: ["EXE_CRM_ADMIN_EMAIL="],
+      message: "EXE_CRM_ADMIN_EMAIL is empty \u2014 exe-crm would boot HEALTHY with no workspace and no user, and the first sign-in would be refused (403) with no way in. Emptying it is not a way past the placeholder gate. Set it to the real mailbox that will own this stack (it must also exist in GoTrue)."
+    };
+  }
+  if (/changeme/i.test(raw)) {
+    return {
+      check: "crm-admin-seat",
+      status: "fail",
+      bug,
+      offenders: [`EXE_CRM_ADMIN_EMAIL=${raw}`],
+      message: "EXE_CRM_ADMIN_EMAIL is still a placeholder \u2014 set it to the real mailbox that will own this stack (it must also exist in GoTrue)."
+    };
+  }
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(raw)) {
+    return {
+      check: "crm-admin-seat",
+      status: "fail",
+      bug,
+      offenders: [`EXE_CRM_ADMIN_EMAIL=${raw}`],
+      message: `EXE_CRM_ADMIN_EMAIL is not an email address (${raw}) \u2014 the CRM seeds its first workspace owner from this value and GoTrue must be able to match it.`
+    };
+  }
+  return { check: "crm-admin-seat", status: "pass", bug, message: `CRM first admin seated (${raw})` };
+}
 function runChecks(services, env, envValues, compose, monitorCompose, customerComposeLabel, expectedDomain) {
   return [
     checkDigestPinning(services),
@@ -382,6 +439,7 @@ function runChecks(services, env, envValues, compose, monitorCompose, customerCo
     checkEnvContract(env, compose),
     checkImageEnvContract(services, compose),
     checkGotrueExternalDomain(envValues, expectedDomain),
+    checkCrmAdminSeat(envValues, compose),
     checkNoHostNet([
       { label: customerComposeLabel, text: compose.text, exists: compose.exists },
       monitorCompose

package/dist/{chunk-FT5PPV2C.js → chunk-PRDDPQLC.js}

@@ -1,22 +1,22 @@
 import {
   sendMessage
-} from "./chunk-IDB3EZLW.js";
+} from "./chunk-YLB365YX.js";
 import {
   getActiveAgent
-} from "./chunk-F6H7GP2O.js";
+} from "./chunk-F4BBMIPG.js";
 import {
   resolveExeSession
-} from "./chunk-ZVBVPX4W.js";
+} from "./chunk-7UHZBVP3.js";
 import {
   getDispatcherSession
-} from "./chunk-GPUOUUHA.js";
+} from "./chunk-PCV52RYM.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 
 // src/mcp/tools/send-message.ts
 import { z } from "zod";

package/dist/{chunk-BZ546I4Q.js → chunk-PUBA5B4M.js}

@@ -81,6 +81,29 @@ async function listTmuxSessionsAsync() {
     return [];
   }
 }
+async function classifyTmuxSessionsAsync() {
+  try {
+    const { promisify } = await import("util");
+    const { execFile } = await import("child_process");
+    const exec = promisify(execFile);
+    const { stdout } = await exec("tmux", ["list-sessions", "-F", "#{session_name}"], {
+      encoding: "utf8",
+      timeout: 3e3
+    });
+    return { kind: "ok", sessions: String(stdout ?? "").trim().split("\n").filter(Boolean) };
+  } catch (err) {
+    if (err?.code === "ENOENT") {
+      return { kind: "not_applicable" };
+    }
+    const stderr = String(err?.stderr ?? "");
+    const confirmedNoServer = /no server running/i.test(stderr) || /error connecting to .*\(no such file or directory\)/i.test(stderr);
+    if (confirmedNoServer) {
+      return { kind: "ok", sessions: [] };
+    }
+    warnTmuxAbsenceOnce(err);
+    return { kind: "unknown", error: err };
+  }
+}
 function capturePaneLines(windowName, lines = 10) {
   try {
     const out = execFileSync(
@@ -357,6 +380,7 @@ export {
   listTmuxSessions,
   listTmuxWindows,
   listTmuxSessionsAsync,
+  classifyTmuxSessionsAsync,
   capturePaneLines,
   capturePaneLinesAsync,
   getPaneCwd,

package/dist/{chunk-2TGJ5XCV.js → chunk-PWC3C5ME.js}

@@ -1,18 +1,18 @@
 import {
   updateTask
-} from "./chunk-CTCCYKOV.js";
+} from "./chunk-2FKU4ZEO.js";
 import {
   TASK_ALREADY_CLAIMED_PREFIX,
   TASK_CLAIM_NOT_HELD_PREFIX,
   TASK_PR_TRACEABILITY_REQUIRED_PREFIX,
   TASK_SIDECHAIN_WRITE_BLOCKED_PREFIX
-} from "./chunk-ZVBVPX4W.js";
+} from "./chunk-7UHZBVP3.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 
 // src/mcp/tools/update-task.ts
 import { z } from "zod";
@@ -75,7 +75,7 @@ function registerUpdateTask(server) {
       let callerSession;
       let callerIsSidechain = false;
       try {
-        const { getActiveAgent: getAgent } = await import("./active-agent-LE6FE6SO.js");
+        const { getActiveAgent: getAgent } = await import("./active-agent-YTBB4ZQM.js");
         const active = getAgent();
         callerAgentId = active.agentId;
         callerSession = resolveCallerSessionForUpdate();

package/dist/{chunk-A4YCLD3L.js → chunk-QFAFKEB5.js}

@@ -4,7 +4,7 @@ import {
   supportProductSchema,
   supportTaskIdSchema,
   supportVersionSchema
-} from "./chunk-UWX6MMCX.js";
+} from "./chunk-3B6FLNLV.js";
 import {
   assessAttribution,
   assessDisposition,
@@ -14,17 +14,17 @@ import {
 } from "./chunk-4YNA3CM6.js";
 import {
   getActiveAgent
-} from "./chunk-F6H7GP2O.js";
+} from "./chunk-F4BBMIPG.js";
 import {
   SUPPORT_PRODUCTS,
   sanitizeProductFilter,
   sanitizeUpstreamId,
   sanitizedUpstreamBody
-} from "./chunk-5QCIWWFA.js";
+} from "./chunk-ELEGH4DX.js";
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-5DFE2NAF.js";
+} from "./chunk-TNS63ATU.js";
 
 // src/mcp/tools/support-inbox.ts
 import { z as z2 } from "zod";
@@ -221,10 +221,44 @@ var NO_ARTIFACT_HELP = [
   "  manual \u2014 verification_kind='manual', fix_commit, repo_path, verifier (a real identity,",
   "      not the bug's filer or assignee), verification_method, verification_observation",
   "      describing what you saw that shows the defect is gone.",
+  "  ops_transcript \u2014 verification_kind='ops_transcript', verifier, claim_type",
+  "      ('point_in_time' for a fact true when observed, e.g. a config now routes",
+  "      correctly; 'ongoing_state' for a claim that a condition HOLDS, e.g. an agent is",
+  "      reporting or CI is green \u2014 that needs 2+ probes at distinct times, since one",
+  "      sample cannot evidence a continuing condition), ops_probes (verbatim",
+  "      {command, output, host, ran_at} entries). Use this when there is no commit to",
+  "      measure \u2014 the defect was settled by running commands against a live system",
+  "      (CI state, a VPS config edit, an ops confirmation).",
   "",
   "The fix commit's diff is measured from the repository; substance is never taken from the caller.",
   "If you have not verified the defect is absent, do not close it \u2014 record what you found with notes instead."
 ].join("\n");
+var REQUIRED_ARGUMENTS_BY_KIND = {
+  regression_test: ["fix_commit", "regression_test_id", "parent_result", "fix_result"],
+  manual: ["fix_commit", "verifier", "verification_method", "verification_observation"],
+  ops_transcript: ["verifier", "claim_type", "ops_probes", "verification_observation"]
+};
+function argumentArrived(value) {
+  if (value === void 0 || value === null) return false;
+  if (typeof value === "string") return value.trim().length > 0;
+  return true;
+}
+function assertVerificationArgumentsArrived(kind, input) {
+  const missing = REQUIRED_ARGUMENTS_BY_KIND[kind].filter((field) => !argumentArrived(input[field]));
+  if (missing.length === 0) return { ok: true };
+  return {
+    ok: false,
+    message: [
+      `Refused locally [verification_arguments_missing]: this close declared verification_kind='${kind}', but these required parameters did not arrive in the tool call:`,
+      ...missing.map((field) => `  - ${String(field)}`),
+      "",
+      "They reached the tool as undefined or empty, so this is NOT a judgement on the evidence you wrote \u2014 that value was never seen here.",
+      "If you did pass them, the argument was dropped or truncated between your client and the tool. Resend the call with those parameters present; long evidence survives better as a separate add_comment followed by a close that references it.",
+      "",
+      "Nothing was written locally and nothing was sent upstream."
+    ].join("\n")
+  };
+}
 var ATTRIBUTION_REQUIRED_HELP = [
   "Refused locally [attribution_missing]: a close carries WHO made the call, with WHAT model, at WHICH commit \u2014 and it did not resolve here, so it will not be sent unattributed for the server to refuse with an opaque 422.",
   "",
@@ -267,6 +301,8 @@ function resolveVerificationArtifact(status, input, context = {}) {
   if (!input.fix_commit && input.verification_kind !== "ops_transcript") {
     return { ok: false, message: "fix_commit is required when setting status=fixed or closed \u2014 the diff is measured, not described." };
   }
+  const arrived = assertVerificationArgumentsArrived(input.verification_kind, input);
+  if (!arrived.ok) return { ok: false, message: arrived.message };
   let probes;
   if (input.verification_kind === "ops_transcript") {
     const parsed = parseOpsProbes(input.ops_probes);

package/dist/{chunk-CL4J4757.js → chunk-QH5ZQ5SJ.js}

@@ -118,6 +118,29 @@ function getEventLoopLagMs() {
 function getEventLoopLagUpdatedAt() {
   return _eventLoopLagUpdatedAt;
 }
+var _lastStallClass = "none";
+var _lastStallAtMs = 0;
+var _lastStallLagMs = 0;
+function setLastStallClass(cls, lagMs, atMs = Date.now()) {
+  _lastStallClass = cls;
+  _lastStallLagMs = Math.max(0, Math.round(lagMs));
+  _lastStallAtMs = atMs;
+}
+function getLastStall() {
+  return { stallClass: _lastStallClass, atMs: _lastStallAtMs, lagMs: _lastStallLagMs };
+}
+function stallRemediation(cls, lagMs) {
+  switch (cls) {
+    case "starved":
+      return `Daemon is ALIVE but CPU-STARVED (last severe window ${lagMs}ms, host load above the starvation ratio). Do NOT restart it \u2014 a restart does not return the CPU and adds to the load. Shed host load and retry.`;
+    case "host_suspended":
+      return `Daemon was NOT RUNNING for the last severe window (${lagMs}ms) \u2014 the HOST was suspended (sleep). No daemon fault occurred and no restart is warranted; retry the call.`;
+    case "blocked":
+      return `Daemon is alive but its event loop was genuinely blocked on its own work (${lagMs}ms). Wait for it to drain; restart only if it persists.`;
+    default:
+      return void 0;
+  }
+}
 function isEventLoopDegraded() {
   return _eventLoopLagMs > EVENT_LOOP_DEGRADED_THRESHOLD_MS;
 }
@@ -131,5 +154,8 @@ export {
   setEventLoopLagMs,
   getEventLoopLagMs,
   getEventLoopLagUpdatedAt,
+  setLastStallClass,
+  getLastStall,
+  stallRemediation,
   isEventLoopDegraded
 };

package/dist/{chunk-UJWZYK46.js → chunk-QNZ4562V.js}

@@ -22,7 +22,7 @@ var OrgOriginProvenanceError = class extends Error {
 async function mintOrgOriginStamp(input) {
   if (!input.orgId) throw new OrgOriginProvenanceError("An org-origin stamp requires a non-empty org_id (\xA71.5)");
   if (!input.requestId) throw new OrgOriginProvenanceError("An org-origin stamp requires a request id");
-  const { getTaskRequest } = await import("./task-request-inbox-54BRRFHZ.js");
+  const { getTaskRequest } = await import("./task-request-inbox-QBZVU66E.js");
   const req = getTaskRequest(input.orgId, input.requestId);
   if (!req) {
     throw new OrgOriginProvenanceError(

package/dist/{chunk-IPHLUZ37.js → chunk-QPTSA4PP.js}

@@ -7,11 +7,11 @@ import {
 import {
   connectEmbedDaemon,
   embedBatchViaClient
-} from "./chunk-ZKJ5S23O.js";
+} from "./chunk-MFAOAIUE.js";
 import {
   EXE_AI_DIR,
   loadConfigSync
-} from "./chunk-ZIG7VPJV.js";
+} from "./chunk-MMS2HBRT.js";
 
 // src/lib/code-context-index.ts
 import crypto from "crypto";

package/dist/{chunk-O3YJTHWI.js → chunk-R5E7WNAC.js}

@@ -1,16 +1,16 @@
 import {
   extractMemoryGraph
-} from "./chunk-F7IRZU5G.js";
+} from "./chunk-P4PIZOL2.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-CO5ZVE3D.js";
+} from "./chunk-UOPCVFVR.js";
 import {
   extractKeywords
 } from "./chunk-CHCA3ZM2.js";
 import {
   getActiveAgent
-} from "./chunk-F6H7GP2O.js";
+} from "./chunk-F4BBMIPG.js";
 
 // src/mcp/tools/import-conversations.ts
 import { z } from "zod";

package/dist/{chunk-V3M4LJRA.js → chunk-RB3J2WYQ.js}

@@ -1,6 +1,6 @@
 import {
   isManagementRole
-} from "./chunk-AY2U4NZ5.js";
+} from "./chunk-GL47M7NY.js";
 
 // src/lib/transcript-sidechain.ts
 import { readFileSync } from "fs";