@askexenow/exe-os 0.9.384 → 0.9.389

package/dist/{chunk-JA3Y5TV6.js → chunk-GDLB6BPM.js}

@@ -2,7 +2,7 @@ import {
   grantsRegistryStatus,
   listGrants,
   revokeGrant
-} from "./chunk-HU3VD4MQ.js";
+} from "./chunk-2Q2GGYBX.js";
 import {
   resolveExeDataDir
 } from "./chunk-NPXIS2RY.js";
@@ -23,27 +23,58 @@ var ORG_MODE_ANCHOR_FILENAME = ".exe-os-install-state";
 var _anchorSeen = false;
 var _keychainChecked = false;
 var _keychainResult = false;
-var _macDefaultKeychainProbe = null;
-function macDefaultKeychainExists() {
-  if (_macDefaultKeychainProbe !== null) return _macDefaultKeychainProbe;
+var _keychainRetryAt = 0;
+var KEYCHAIN_RETRY_DELAY_MS = 3e4;
+function isExpiry(err) {
+  const e = err;
+  if (!e) return false;
+  return e.code === "ETIMEDOUT" || e.signal === "SIGTERM" || e.signal === "SIGKILL";
+}
+var _notedExpiry = false;
+function noteExpiryOnce(what) {
+  if (_notedExpiry) return;
+  _notedExpiry = true;
+  process.stderr.write(
+    `[exe-os] keychain probe (${what}) did not complete within its budget \u2014 recorded as UNKNOWN, not as "absent". It will be asked again after a retry delay.
+`
+  );
+}
+function runKeychainProbe(cmd, args, input) {
   try {
-    const out = execFileSync("security", ["default-keychain"], {
+    const stdout = execFileSync(cmd, args, {
       encoding: "utf-8",
       timeout: 5e3,
-      stdio: ["pipe", "pipe", "ignore"]
-    }).trim();
-    _macDefaultKeychainProbe = out.length > 0;
-  } catch {
-    _macDefaultKeychainProbe = false;
+      stdio: ["pipe", "pipe", "ignore"],
+      ...input === void 0 ? {} : { input }
+    });
+    return { status: "ok", stdout: (stdout ?? "").toString().trim() };
+  } catch (err) {
+    if (isExpiry(err)) {
+      noteExpiryOnce(`${cmd} ${args[0] ?? ""}`.trim());
+      return { status: "unknown", why: "probe expired before it could answer" };
+    }
+    return { status: "absent" };
   }
-  return _macDefaultKeychainProbe;
 }
-function nativeKeychainAllowed() {
-  if (process.env.EXE_OS_DISABLE_NATIVE_KEYCHAIN === "1") return false;
-  if (process.env.EXE_IS_DAEMON === "1") return false;
-  if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return false;
-  if (process.platform === "darwin" && !macDefaultKeychainExists()) return false;
-  return true;
+var _macDefaultKeychainProbe = null;
+function macDefaultKeychainState() {
+  if (_macDefaultKeychainProbe !== null) return _macDefaultKeychainProbe ? "present" : "absent";
+  const res = runKeychainProbe("security", ["default-keychain"]);
+  if (res.status === "unknown") return "unknown";
+  const present = res.status === "ok" && res.stdout.length > 0;
+  _macDefaultKeychainProbe = present;
+  return present ? "present" : "absent";
+}
+function nativeKeychainState() {
+  if (process.env.EXE_OS_DISABLE_NATIVE_KEYCHAIN === "1") return "denied";
+  if (process.env.EXE_IS_DAEMON === "1") return "denied";
+  if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return "denied";
+  if (process.platform === "darwin") {
+    const state = macDefaultKeychainState();
+    if (state === "absent") return "denied";
+    if (state === "unknown") return "unknown";
+  }
+  return "allowed";
 }
 function anchorFilePath() {
   return path.join(os.homedir(), ORG_MODE_ANCHOR_FILENAME);
@@ -57,58 +88,57 @@ function repairAnchorPermissions(p) {
 }
 function keychainHasAnchor() {
   if (_keychainChecked) return _keychainResult;
-  _keychainResult = keychainGet() === ANCHOR_VALUE;
+  if (performance.now() < _keychainRetryAt) return "unknown";
+  const probe = keychainGet();
+  if (probe.status === "unknown") {
+    _keychainRetryAt = performance.now() + KEYCHAIN_RETRY_DELAY_MS;
+    return "unknown";
+  }
+  _keychainRetryAt = 0;
+  _keychainResult = probe.status === "ok" && probe.stdout === ANCHOR_VALUE;
   _keychainChecked = true;
   return _keychainResult;
 }
 var _probeCount = 0;
 function keychainGet() {
   _probeCount++;
-  if (!nativeKeychainAllowed()) return null;
-  try {
-    if (process.platform === "darwin") {
-      return execFileSync(
-        "security",
-        ["find-generic-password", "-s", SERVICE, "-a", ANCHOR_ACCOUNT, "-w"],
-        { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "ignore"] }
-      ).trim();
-    }
-    if (process.platform === "linux") {
-      return execFileSync(
-        "secret-tool",
-        ["lookup", "service", SERVICE, "account", ANCHOR_ACCOUNT],
-        { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "ignore"] }
-      ).trim();
-    }
-  } catch {
+  const allowed = nativeKeychainState();
+  if (allowed === "denied") return { status: "absent" };
+  if (allowed === "unknown") return { status: "unknown", why: "keychain availability unknown" };
+  if (process.platform === "darwin") {
+    return runKeychainProbe(
+      "security",
+      ["find-generic-password", "-s", SERVICE, "-a", ANCHOR_ACCOUNT, "-w"]
+    );
+  }
+  if (process.platform === "linux") {
+    return runKeychainProbe("secret-tool", ["lookup", "service", SERVICE, "account", ANCHOR_ACCOUNT]);
   }
-  return null;
+  return { status: "absent" };
 }
 function keychainSet() {
-  if (!nativeKeychainAllowed()) return false;
-  try {
-    if (process.platform === "darwin") {
-      execFileSync(
-        "security",
-        ["add-generic-password", "-U", "-s", SERVICE, "-a", ANCHOR_ACCOUNT, "-w", ANCHOR_VALUE],
-        { timeout: 5e3, stdio: ["pipe", "ignore", "ignore"] }
-      );
-      return true;
-    }
-    if (process.platform === "linux") {
-      execFileSync(
-        "secret-tool",
-        ["store", "--label", "exe-os org mode", "service", SERVICE, "account", ANCHOR_ACCOUNT],
-        { input: ANCHOR_VALUE, timeout: 5e3, stdio: ["pipe", "ignore", "ignore"] }
-      );
-      return true;
-    }
-  } catch {
+  const allowed = nativeKeychainState();
+  if (allowed === "denied") return "failed";
+  if (allowed === "unknown") return "unknown";
+  if (process.platform === "darwin") {
+    const res = runKeychainProbe(
+      "security",
+      ["add-generic-password", "-U", "-s", SERVICE, "-a", ANCHOR_ACCOUNT, "-w", ANCHOR_VALUE]
+    );
+    return res.status === "ok" ? "ok" : res.status === "unknown" ? "unknown" : "failed";
+  }
+  if (process.platform === "linux") {
+    const res = runKeychainProbe(
+      "secret-tool",
+      ["store", "--label", "exe-os org mode", "service", SERVICE, "account", ANCHOR_ACCOUNT],
+      ANCHOR_VALUE
+    );
+    return res.status === "ok" ? "ok" : res.status === "unknown" ? "unknown" : "failed";
   }
-  return false;
+  return "failed";
 }
 function keychainClear() {
-  if (!nativeKeychainAllowed()) return;
+  if (nativeKeychainState() !== "allowed") return;
   try {
     if (process.platform === "darwin") {
       execFileSync("security", ["delete-generic-password", "-s", SERVICE, "-a", ANCHOR_ACCOUNT], {
@@ -124,25 +154,33 @@ function keychainClear() {
   } catch {
   }
 }
-function orgModeAnchorPresent() {
-  if (_anchorSeen) return true;
+function orgModeAnchorState() {
+  if (_anchorSeen) return "present";
   const fp = anchorFilePath();
   if (existsSync(fp)) {
     repairAnchorPermissions(fp);
     _anchorSeen = true;
-    return true;
+    return "present";
   }
-  if (keychainHasAnchor()) {
+  const kc = keychainHasAnchor();
+  if (kc === true) {
     _anchorSeen = true;
-    return true;
+    return "present";
   }
-  return false;
+  return kc === "unknown" ? "unknown" : "absent";
+}
+function orgModeAnchorPresent() {
+  return orgModeAnchorState() === "present";
 }
 function writeOrgModeAnchor() {
   _anchorSeen = true;
-  const keychainOk = keychainSet();
-  _keychainChecked = keychainOk;
-  _keychainResult = keychainOk;
+  const setResult = keychainSet();
+  const keychainOk = setResult === "ok";
+  if (setResult !== "unknown") {
+    _keychainRetryAt = 0;
+    _keychainChecked = keychainOk;
+    _keychainResult = keychainOk;
+  }
   try {
     writeFileSync(
       anchorFilePath(),
@@ -164,6 +202,7 @@ function clearOrgModeAnchor() {
   _anchorSeen = false;
   _keychainChecked = true;
   _keychainResult = false;
+  _keychainRetryAt = 0;
 }
 
 // src/lib/org-membership.ts
@@ -259,11 +298,20 @@ function establishOrgMode(orgIds = []) {
     const cp = configPath();
     let cfg = {};
     if (existsSync2(cp)) {
+      let parsed;
       try {
-        const parsed = JSON.parse(readFileSync2(cp, "utf8"));
-        if (typeof parsed === "object" && parsed !== null) cfg = parsed;
-      } catch {
+        parsed = JSON.parse(readFileSync2(cp, "utf8"));
+      } catch (err) {
+        throw new Error(
+          `the config at ${cp} exists but could not be read (${err instanceof Error ? err.message : String(err)}); refusing to rewrite it from an empty object`
+        );
+      }
+      if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new Error(
+          `the config at ${cp} did not parse to a JSON object; refusing to rewrite it from an empty object`
+        );
       }
+      cfg = parsed;
     }
     if (cfg.org_mode_established !== true) {
       cfg.org_mode_established = true;
@@ -281,12 +329,20 @@ var QUARANTINE_DONE_KEY = "grants_quarantined_at";
 function readMarker() {
   const mp = markerPath();
   if (!existsSync2(mp)) return {};
+  let parsed;
   try {
-    const parsed = JSON.parse(readFileSync2(mp, "utf8"));
-    return typeof parsed === "object" && parsed !== null ? parsed : {};
-  } catch {
-    return {};
+    parsed = JSON.parse(readFileSync2(mp, "utf8"));
+  } catch (err) {
+    throw new Error(
+      `the org-mode marker at ${mp} exists but could not be read (${err instanceof Error ? err.message : String(err)}); refusing to treat it as empty, because every caller writes this value back and would drop the org ids it holds`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(
+      `the org-mode marker at ${mp} did not parse to a JSON object; refusing to treat it as empty`
+    );
   }
+  return parsed;
 }
 function recordQuarantineDone() {
   try {
@@ -297,7 +353,18 @@ function recordQuarantineDone() {
   }
 }
 function ensureGrantsQuarantined() {
-  if (typeof readMarker()[QUARANTINE_DONE_KEY] === "string") {
+  let doneAt;
+  try {
+    doneAt = readMarker()[QUARANTINE_DONE_KEY];
+  } catch (err) {
+    _quarantinePending = true;
+    warnQuarantineDeferredOnce(
+      `[exe-os] \u26A0 org mode: the quarantine-completion record could not be read (${err instanceof Error ? err.message : String(err)}) \u2014 quarantine deferred and will retry. Grants are inert meanwhile (the monitoring writer refuses to run in org mode).
+`
+    );
+    return;
+  }
+  if (typeof doneAt === "string") {
     _quarantinePending = false;
     return;
   }

package/dist/{chunk-IGJMS7C5.js → chunk-GOVGG7HU.js}

@@ -1,10 +1,10 @@
 import {
   registerScopedQueryChokepoint,
   scopedQueryChokepointStatus
-} from "./chunk-YLFCH3VA.js";
+} from "./chunk-FDWI3T6I.js";
 import {
   getClient
-} from "./chunk-GL47M7NY.js";
+} from "./chunk-3UD3OF3X.js";
 
 // src/lib/org-scoped-rows.ts
 var SCOPED_QUERY_MAX_LIMIT = 200;

package/dist/{chunk-MB47DRF5.js → chunk-GP7CTIUK.js}

@@ -1,10 +1,10 @@
 import {
   getCurrentSessionScope,
   strictSessionScopeFilter
-} from "./chunk-7UHZBVP3.js";
+} from "./chunk-QDVLVLXP.js";
 import {
   getProjectName
-} from "./chunk-UX2EO653.js";
+} from "./chunk-ZZWFZ46U.js";
 
 // src/lib/session-events.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-L5EPGGDP.js → chunk-GWAN2BDB.js}

@@ -6,7 +6,7 @@ import {
 import {
   DEFAULT_RUNTIME,
   RUNTIME_TABLE
-} from "./chunk-WNBZJSQT.js";
+} from "./chunk-3VW5ZP2F.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -93,10 +93,10 @@ var RUNTIME_LABELS = {
 var DEFAULT_MODELS = {
   // Bug ac1f9c80: claude-sonnet-4 was RETIRED 2026-06-15. It was the fallback
   // default here, so any agent without an explicit config booted onto a dead
-  // model and idled forever. Default now points at the live claude-sonnet-4.6.
-  claude: "claude-sonnet-4.6",
+  // model and idled forever. Default now points at the live claude-sonnet-5.
+  claude: "claude-sonnet-5",
   codex: CODEX_DEFAULT_MODEL,
-  opencode: RUNTIME_TABLE.opencode?.defaultModel ?? "anthropic/claude-sonnet-4-6"
+  opencode: RUNTIME_TABLE.opencode?.defaultModel ?? "anthropic/claude-sonnet-5"
 };
 function loadAgentConfig() {
   if (!existsSync(AGENT_CONFIG_PATH)) return {};

package/dist/{chunk-YRQ26MNP.js → chunk-H3YF7X4J.js}

@@ -1,11 +1,11 @@
 import {
   ingest
-} from "./chunk-RZN2LEAK.js";
+} from "./chunk-SQA7XCYI.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-L3VUW5M4.js";
+} from "./chunk-TQS2YHLB.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";
@@ -1300,13 +1300,20 @@ function buildExecAssistantTools() {
     {
       name: "create_reminder",
       description: "Create a reminder.",
+      // Bug f80e50b5: these names MUST match the tool this advertisement names.
+      // The MCP tool `create_reminder` (src/mcp/tools/create-reminder.ts) takes
+      // `text` / `due_date` / `daily_push`. This block previously advertised
+      // `content` / `due_at`, which exist nowhere on the receiving side — so an
+      // executor forwarding these arguments would drop both the reminder body
+      // and its due date. Pinned by tests/gateway/bot-tool-contract.test.ts.
       input_schema: {
         type: "object",
         properties: {
-          content: { type: "string", description: "Reminder content" },
-          due_at: { type: "string", description: "ISO 8601 due date" }
+          text: { type: "string", description: "What to remind about" },
+          due_date: { type: "string", description: "Optional due date \u2014 ISO date (2026-04-01), or omit for persistent" },
+          daily_push: { type: "string", description: 'Optional daily push schedule \u2014 JSON {"hours":[9,18]} (0\u201323, founder timezone)' }
         },
-        required: ["content"]
+        required: ["text"]
       }
     },
     {

package/dist/{chunk-VLBHZ6TF.js → chunk-H6PLIFUE.js}

@@ -1,12 +1,12 @@
 import {
   sessionScopeFilter
-} from "./chunk-7UHZBVP3.js";
+} from "./chunk-QDVLVLXP.js";
 import {
   leaseExpiryIso
 } from "./chunk-E23LNUWJ.js";
 import {
   getProjectName
-} from "./chunk-UX2EO653.js";
+} from "./chunk-ZZWFZ46U.js";
 
 // src/lib/subagent-observability.ts
 var MAX_RESULT_DIGEST_CHARS = 200;

package/dist/{chunk-GSLFH4AI.js → chunk-HRNM3N4Y.js}

@@ -11,8 +11,8 @@ import {
 } from "./chunk-7OTR2OET.js";
 import {
   buildDeployStalenessBanner,
-  resolveDeployStalenessAlert
-} from "./chunk-C5HUMAA7.js";
+  resolveDeployStalenessVerdict
+} from "./chunk-B7WVYLAQ.js";
 
 // src/lib/status-brief.ts
 import pathMod from "path";
@@ -126,7 +126,7 @@ async function generateStatusBrief(employees, data, _activeAgentIds) {
   sections.push([` EXE STATUS BRIEF \u2014 ${dateStr}${sessionTag}`]);
   const degradedLines = buildDegradedBanner(data);
   if (degradedLines.length > 0) sections.push(degradedLines);
-  const staleDeployLines = buildDeployStalenessBanner(resolveDeployStalenessAlert());
+  const staleDeployLines = buildDeployStalenessBanner(resolveDeployStalenessVerdict());
   if (staleDeployLines.length > 0) sections.push(staleDeployLines);
   const orchestrationLines = buildOrchestrationPhase(data, employees);
   if (orchestrationLines.length > 0) sections.push(orchestrationLines);
@@ -424,19 +424,10 @@ function buildOrchestrationPhase(data, employees) {
 }
 function buildDispatchLadder(data) {
   const lines = [
-    "\u{1FA9C} DISPATCH \u2014 stop at the lowest rung that fits",
-    "  1 do it yourself \xB7 2 named subagent = DEFAULT (delegation + parallelism)",
-    "  3 create_task(execution_mode='durable_tmux') \u2192 tmux = LEGACY: only if the work outlives this session"
+    "\u{1FA9C} DISPATCH \u2014 stop at the lower rung that fits",
+    "  1 do it yourself \xB7 2 Agent(subagent_type='<employee>') = the ONLY delegation path",
+    "  create_task = durable checklist row for tracking \u2014 it never dispatches"
   ];
-  const liveTmuxDispatches = data.globalTasks.filter(
-    (t) => t.executionMode !== "checklist" && (t.status === "open" || t.status === "in_progress")
-  ).length;
-  const TMUX_SKEW_THRESHOLD = 4;
-  if (liveTmuxDispatches >= TMUX_SKEW_THRESHOLD) {
-    lines.push(
-      `  \u{1F7E0} ${liveTmuxDispatches} live tmux dispatches \u2014 bounded work belongs on rung 2`
-    );
-  }
   const subagentTasks = data.globalTasks.filter(
     (t) => t.status === "in_progress" && (t.subagentEventCount ?? 0) > 0
   );

package/dist/chunk-IG2ISRTF.js

@@ -0,0 +1,48 @@
+import {
+  getClient
+} from "./chunk-3UD3OF3X.js";
+
+// src/lib/skill-usage.ts
+async function recordBehaviorsConsulted(behaviorIds) {
+  const ids = [...new Set(behaviorIds.filter((id) => typeof id === "string" && id.length > 0))];
+  if (ids.length === 0) return;
+  try {
+    const client = getClient();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    for (const id of ids) {
+      await client.execute({
+        sql: `UPDATE behaviors SET consulted_count = coalesce(consulted_count, 0) + 1, last_consulted_at = ? WHERE id = ?`,
+        args: [now, id]
+      });
+    }
+  } catch (err) {
+    process.stderr.write(
+      `[skill-usage] Failed to record consulted: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+async function recordBehaviorApplied(behaviorId) {
+  const id = (behaviorId ?? "").trim();
+  if (!id) return false;
+  try {
+    const client = getClient();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const result = await client.execute({
+      sql: `UPDATE behaviors SET applied_count = coalesce(applied_count, 0) + 1, last_applied_at = ? WHERE id = ?`,
+      args: [now, id]
+    });
+    return (result.rowsAffected ?? 0) > 0;
+  } catch (err) {
+    process.stderr.write(
+      `[skill-usage] Failed to record applied for ${id}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return false;
+  }
+}
+
+export {
+  recordBehaviorsConsulted,
+  recordBehaviorApplied
+};

package/dist/{chunk-MWEIBVBS.js → chunk-IJCWBYA5.js}

@@ -28,7 +28,9 @@ function normalizeState(value) {
     updatedAt,
     // Optional and only present when actually set, so existing readers that
     // compare whole state objects are unaffected by the new field.
-    ...typeof raw.pendingSliceAt === "string" && raw.pendingSliceAt !== "" ? { pendingSliceAt: raw.pendingSliceAt } : {}
+    ...typeof raw.pendingSliceAt === "string" && raw.pendingSliceAt !== "" ? { pendingSliceAt: raw.pendingSliceAt } : {},
+    ...typeof raw.pullIncompleteReason === "string" && raw.pullIncompleteReason !== "" ? { pullIncompleteReason: raw.pullIncompleteReason } : {},
+    ...typeof raw.pullIncompleteMaxVersion === "number" && Number.isFinite(raw.pullIncompleteMaxVersion) ? { pullIncompleteMaxVersion: raw.pullIncompleteMaxVersion } : {}
   };
 }
 function readCloudSyncState(statePath = resolveCloudSyncStatePath()) {
@@ -114,6 +116,17 @@ function resolveCloudSyncStatus(options) {
         updatedAt: state.updatedAt
       };
     }
+    const pullIncompleteReason = state.pullIncompleteReason ?? void 0;
+    if (pullIncompleteReason) {
+      return {
+        status: "partial",
+        lastSuccessAt,
+        lastError: state.lastError ?? void 0,
+        intervalMs,
+        updatedAt: state.updatedAt,
+        pullIncompleteReason
+      };
+    }
     const lastSuccessMs = lastSuccessAt ? Date.parse(lastSuccessAt) : NaN;
     if (Number.isFinite(lastSuccessMs) && nowMs - lastSuccessMs <= intervalMs * 2) {
       return {

package/dist/{chunk-NKEFYE4R.js → chunk-IPTUKX3N.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-MFAOAIUE.js";
 import {
   EMBEDDING_DIM
-} from "./chunk-FXU7JOXK.js";
+} from "./chunk-C7GHNJPW.js";
 import {
   MODELS_DIR,
   loadConfigSync

package/dist/{chunk-RB3J2WYQ.js → chunk-IVE7H6KA.js}

@@ -1,6 +1,6 @@
 import {
   isManagementRole
-} from "./chunk-GL47M7NY.js";
+} from "./chunk-3UD3OF3X.js";
 
 // src/lib/transcript-sidechain.ts
 import { readFileSync } from "fs";

package/dist/{chunk-HA63SH5W.js → chunk-IWY2OGQG.js}

@@ -1,6 +1,6 @@
 import {
   redactSecrets
-} from "./chunk-ELEGH4DX.js";
+} from "./chunk-ZUGQPYUY.js";
 import {
   isExeMcpTool,
   stripExeMcpPrefix