@askexenow/exe-os 0.9.384 → 0.9.389

package/dist/{chunk-VF3BZOZK.js → chunk-X7HZHKY4.js}

@@ -8,13 +8,13 @@ import {
   sanitizeSupportEndpointPath,
   sanitizeUpstreamId,
   sanitizeUpstreamPayload
-} from "./chunk-ELEGH4DX.js";
+} from "./chunk-ZUGQPYUY.js";
 import {
   isOlderThan
 } from "./chunk-YRUZK2QA.js";
 
 // src/lib/support-outbox.ts
-import { mkdirSync, readdirSync, readFileSync, writeFileSync, existsSync } from "fs";
+import { mkdirSync, readdirSync, readFileSync, writeFileSync, existsSync, unlinkSync } from "fs";
 import { createHash } from "crypto";
 import path from "path";
 import os from "os";
@@ -246,6 +246,7 @@ function buildSupportPayload(kind, file, filePath, content) {
   if (kind === "bug") {
     const titleMatch2 = cleanContent.match(/^#\s*(.+)$/m);
     const severityMatch = cleanContent.match(/^severity:\s*(.+)$/m);
+    const isGated = extractField(cleanContent, "gate_version") !== void 0;
     return {
       id,
       title: titleMatch2?.[1]?.trim() ?? file,
@@ -256,6 +257,8 @@ function buildSupportPayload(kind, file, filePath, content) {
       reproduction_steps: linesFromSection(extractSection(cleanContent, "Reproduction steps")),
       expected: extractSection(cleanContent, "Expected behavior") ?? extractField(cleanContent, "expected"),
       actual: extractSection(cleanContent, "Actual behavior") ?? extractField(cleanContent, "actual"),
+      observed_kind: extractField(extractSection(cleanContent, "Evidence") ?? "", "observed_kind"),
+      evidence_pointer: extractField(extractSection(cleanContent, "Evidence") ?? "", "evidence_pointer"),
       workaround: extractSection(cleanContent, "Workaround"),
       // Bug 4b8b47fd (P0-1): `markdown: content` (the entire raw, uncapped
       // report body) and `report_path: filePath` (an absolute path leaking the
@@ -267,7 +270,8 @@ function buildSupportPayload(kind, file, filePath, content) {
       project_name: extractField(cleanContent, "project_name") ?? extractField(cleanContent, "project"),
       agent_id: extractField(cleanContent, "filed_by"),
       agent_role: "outbox-flusher",
-      report_file: path.basename(filePath)
+      report_file: path.basename(filePath),
+      ...isGated ? {} : { legacy_ungated: true }
     };
   }
   const titleMatch = cleanContent.match(/^#\s*Feature Request\s*[—–-]\s*(.+)$/m);
@@ -289,6 +293,37 @@ function buildSupportPayload(kind, file, filePath, content) {
     agent_role: "outbox-flusher"
   };
 }
+var OUTBOX_OBSERVED_KINDS = /* @__PURE__ */ new Set(["failing_test", "command_output", "log_excerpt", "screenshot", "live_probe"]);
+function validateBugFilingGate(payload) {
+  const missing = [];
+  const reproSteps = (Array.isArray(payload.reproduction_steps) ? payload.reproduction_steps : []).filter((s) => typeof s === "string" && s.trim() && s.trim() !== "Not provided");
+  if (reproSteps.length === 0) missing.push("reproduction_steps");
+  const expected = typeof payload.expected === "string" ? payload.expected.trim() : "";
+  if (!expected || expected === "Not provided") missing.push("expected");
+  const actual = typeof payload.actual === "string" ? payload.actual.trim() : "";
+  if (!actual || actual === "Not provided") missing.push("actual");
+  const observedKind = typeof payload.observed_kind === "string" ? payload.observed_kind : "";
+  if (!observedKind || observedKind === "Not provided" || !OUTBOX_OBSERVED_KINDS.has(observedKind)) {
+    missing.push("observed_kind");
+  }
+  const evidencePointer = typeof payload.evidence_pointer === "string" ? payload.evidence_pointer.trim() : "";
+  if (!evidencePointer || evidencePointer === "Not provided") missing.push("evidence_pointer");
+  return missing;
+}
+function rejectQueuedFile(dir, file, content, reasons) {
+  try {
+    const rejectedDir = path.join(dir, "rejected");
+    mkdirSync(rejectedDir, { recursive: true });
+    const reasonHeader = `upstream_rejected: true
+rejected_at: ${(/* @__PURE__ */ new Date()).toISOString()}
+rejected_reason: missing/invalid evidence field(s): ${reasons.join(", ")}
+
+`;
+    writeFileSync(path.join(rejectedDir, file), reasonHeader + content, "utf-8");
+    unlinkSync(path.join(dir, file));
+  } catch {
+  }
+}
 function shouldBackoff() {
   if (consecutiveFailures === 0) return false;
   const backoffMs = Math.min(Math.pow(2, consecutiveFailures), MAX_BACKOFF_S) * 1e3;
@@ -360,6 +395,14 @@ ${SKIPPED_MARKER}
       continue;
     }
     const payload = buildSupportPayload(kind, file, filePath, content);
+    if (kind === "bug" && !payload.legacy_ungated) {
+      const gateFailures = validateBugFilingGate(payload);
+      if (gateFailures.length > 0) {
+        rejectQueuedFile(dir, file, content, gateFailures);
+        errors++;
+        continue;
+      }
+    }
     const dedupeHash = payloadDedupeHash(kind, payload);
     payload.idempotency_key = dedupeHash;
     if (sentContentHashes.has(dedupeHash)) {
@@ -401,6 +444,10 @@ ${DUPLICATE_MARKER}: ${dedupeHash}
         sentContentHashes.add(dedupeHash);
         onNetworkSuccess();
         sent++;
+      } else if (kind === "bug" && isDeterministicRejection(resp.status)) {
+        const serverErrorText = await resp.text().catch(() => `HTTP ${resp.status}`);
+        rejectQueuedFile(dir, file, content, [`server rejected (HTTP ${resp.status}): ${serverErrorText}`]);
+        errors++;
       } else {
         onNetworkFailure();
         errors++;

package/dist/{chunk-LFBLQE2P.js → chunk-XCAKYVKI.js}

@@ -4,7 +4,7 @@ import {
   getGitRootAsync,
   isWorktreeDirty,
   isWorktreeDirtyAsync
-} from "./chunk-JDDM6C57.js";
+} from "./chunk-3X74IQBU.js";
 
 // src/lib/worktree-sweep.ts
 import { execFile } from "child_process";

package/dist/{chunk-UXN4BICC.js → chunk-XMX5J52Z.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-GL47M7NY.js";
+} from "./chunk-3UD3OF3X.js";
 import {
   loadConfig
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-6YDY6ZTD.js → chunk-XTCXGWTV.js}

@@ -8,7 +8,7 @@ import {
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-TNS63ATU.js";
+} from "./chunk-FWRPDSO3.js";
 import {
   EXE_AI_DIR,
   loadConfig
@@ -121,9 +121,14 @@ async function runTest(project) {
     severity: "p3",
     summary: "Synthetic exe-os support intake smoke test. Safe to close.",
     customer_impact: "No customer impact; diagnostic only.",
-    reproduction_steps: ["Run exe-os support test"],
+    reproduction_steps: ["Run `exe-os support test`"],
     expected: "The report reaches AskExe support intake and can be triaged.",
     actual: "Smoke test submitted by exe-os support test.",
+    // Satisfies the server-side filing gate (PR #1437 P1-1) with genuine
+    // evidence rather than a special-cased bypass: this record's own creation
+    // IS the command output being declared.
+    observed_kind: "command_output",
+    evidence_pointer: "exe-os support test CLI run, local report at " + path.basename(reportPath),
     package_version: `@askexenow/exe-os@${version}`,
     project_name: project,
     agent_id: "support-test",
@@ -282,7 +287,7 @@ function nextForPostFailure(status) {
   return "Run `exe-os support health`; if it passes, send this output to AskExe.";
 }
 async function runFlush(json) {
-  const { flushSupportOutbox } = await import("./support-outbox-KNI3FR3G.js");
+  const { flushSupportOutbox } = await import("./support-outbox-2TG2UV6J.js");
   const result = await flushSupportOutbox({ maxPerFlush: 10, userInitiated: true });
   if (json) {
     console.log(JSON.stringify(result, null, 2));
@@ -305,7 +310,7 @@ async function runFlush(json) {
   console.log("");
 }
 async function runStatus(json) {
-  const { getOutboxStatus } = await import("./support-outbox-KNI3FR3G.js");
+  const { getOutboxStatus } = await import("./support-outbox-2TG2UV6J.js");
   const status = await getOutboxStatus();
   if (json) {
     console.log(JSON.stringify(status, null, 2));

package/dist/{chunk-XUZK23V7.js → chunk-XW2FW6LS.js}

@@ -1,14 +1,14 @@
 import {
   deactivateBehavior,
   listBehaviors
-} from "./chunk-S26CV7BE.js";
+} from "./chunk-YA5LK6KB.js";
 import {
   IdentityConflictError,
   IdentityLockError,
   getIdentity,
   mutateIdentity,
   withIdentityLock
-} from "./chunk-GL47M7NY.js";
+} from "./chunk-3UD3OF3X.js";
 
 // src/lib/behavior-promotion.ts
 var PROMOTED_SECTION_HEADING = "## Promoted lessons (permanent \u2014 promoted from behaviours)";

package/dist/{chunk-CH7BUBP3.js → chunk-XWVHUDEK.js}

@@ -2,19 +2,19 @@ import {
   InviteError,
   resolveAuth,
   resolveEndpoint
-} from "./chunk-E3ZM32LF.js";
+} from "./chunk-P22VFGFK.js";
 import {
   asOrgBillablePlan
 } from "./chunk-X2X3IGZU.js";
 import {
   resolvePartnerIdentities
-} from "./chunk-VOVFUKEB.js";
+} from "./chunk-AIB2EWO2.js";
 import {
   orgKeyFingerprintDisplay
-} from "./chunk-ZAEUEDTN.js";
+} from "./chunk-ZD6FZ3WL.js";
 import {
   ed25519PrivateKeyFromSeed
-} from "./chunk-DMUOTCDN.js";
+} from "./chunk-E5CKRHIZ.js";
 
 // src/lib/org-key-admin.ts
 import { sign } from "crypto";
@@ -262,6 +262,7 @@ async function issueSeatInvite(input) {
     seatRef: requireField(body, "seat_ref", what),
     isAdmin: body.is_admin === true,
     inviteToken: requireField(body, "invite_token", what),
+    claimPassphrase: requireField(body, "claim_passphrase", what),
     expiresAt: requireField(body, "expires_at", what),
     fingerprint: orgKeyFingerprintDisplay(signFp),
     signFp,

package/dist/{chunk-S26CV7BE.js → chunk-YA5LK6KB.js}

@@ -4,16 +4,39 @@ import {
 } from "./chunk-EIOGV75A.js";
 import {
   vectorToSqlLiteral
-} from "./chunk-UOPCVFVR.js";
+} from "./chunk-5RK75SWH.js";
 import {
   blobToVector
 } from "./chunk-OTVEIJUQ.js";
 import {
-  getClient
-} from "./chunk-GL47M7NY.js";
+  getClient,
+  sanitizeBehaviorContent
+} from "./chunk-3UD3OF3X.js";
 
 // src/lib/behaviors.ts
 import crypto from "crypto";
+var BEHAVIOR_P0_HARD_CAP = (() => {
+  const raw = Number(process.env.EXE_BEHAVIOR_P0_CAP);
+  return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : 15;
+})();
+var USAGE_TRACKING_COLUMNS = ["consulted_count", "applied_count", "last_consulted_at", "last_applied_at"];
+var MISSING_USAGE_COLUMN_RE = new RegExp(
+  `no such column:\\s*(?:\\w+\\.)?(?:${USAGE_TRACKING_COLUMNS.join("|")})\\b`,
+  "i"
+);
+function isMissingUsageColumnError(err) {
+  const msg = err instanceof Error ? err.message : String(err ?? "");
+  return MISSING_USAGE_COLUMN_RE.test(msg);
+}
+async function executeTolerantOfMissingUsageColumns(client, sql, args) {
+  try {
+    return await client.execute({ sql, args });
+  } catch (err) {
+    if (!isMissingUsageColumnError(err)) throw err;
+    const fallbackSql = sql.replace(/\bconsulted_count\b/g, "0 AS consulted_count").replace(/\bapplied_count\b/g, "0 AS applied_count").replace(/\blast_consulted_at\b/g, "NULL AS last_consulted_at").replace(/\blast_applied_at\b/g, "NULL AS last_applied_at");
+    return await client.execute({ sql: fallbackSql, args });
+  }
+}
 var GHOST_BEHAVIOR_SQL = "(id IS NULL OR trim(coalesce(content, '')) = '' OR (content = '(empty)' AND coalesce(agent_id, '') = 'unknown'))";
 function isGhostBehaviorRow(row) {
   const id = row.id;
@@ -28,10 +51,6 @@ var BEHAVIOR_CONTENT_MAX_LENGTH = 500;
 function behaviorContentOverCapMessage(actualLength) {
   return `Behavior content is ${actualLength} characters; the maximum is ${BEHAVIOR_CONTENT_MAX_LENGTH}. Behaviors are injected verbatim into agent context at boot \u2014 split this into separate, single-sentence behaviors.`;
 }
-var TOOL_FRAMING_TAG_RE = /<\/?(?:invoke|parameter|content|function_calls)\b[^>]*>/gi;
-function sanitizeBehaviorContent(content) {
-  return content.replace(TOOL_FRAMING_TAG_RE, " ").replace(/\s{2,}/g, " ").trim();
-}
 function formatReflexContent(trigger, action) {
   return `\u26A1 REFLEX: When ${trigger} \u2192 ${action}. Decide whether to act.`;
 }
@@ -66,6 +85,23 @@ async function storeBehavior(opts) {
       "[behaviors] Refusing to store a behavior with empty agent_id (ghost-row guard)."
     );
   }
+  const resolvedPriority = opts.priority ?? "p1";
+  const capMode = opts.onP0CapExceeded ?? "throw";
+  if (resolvedPriority === "p0") {
+    const existingP0 = await countActiveBehaviors(trimmedAgent, opts.projectName);
+    if (existingP0.p0 >= BEHAVIOR_P0_HARD_CAP) {
+      const detail = `"${trimmedAgent}" already has ${existingP0.p0} active p0 behaviors, at the configured cap of ${BEHAVIOR_P0_HARD_CAP} (env EXE_BEHAVIOR_P0_CAP). p0 behaviors are ALWAYS injected in full, so this cap exists to stop the always-injected block from growing without bound.`;
+      if (capMode === "throw") {
+        throw new Error(
+          `[behaviors] Refusing to store: ${detail} Consolidate an existing p0 rule into this one, demote one to p1 (behavior(action='store', priority='p1', ...) after deactivating the old row), or promote a long-stable one into identity with behavior(action='promote') to free a slot.`
+        );
+      }
+      process.stderr.write(
+        `[behaviors] \u26A0\uFE0F P0 CAP EXCEEDED (store-and-flag): ${detail} Storing anyway \u2014 this p0 rule will be injected, but the wall is now ${existingP0.p0 + 1} deep. Run behavior(action='list', priority='p0') and consolidate/demote/promote to bring it back under the cap.
+`
+      );
+    }
+  }
   try {
     const { loadEmployeesSync, baseAgentName } = await import("./lib/employees.js");
     const roster = loadEmployeesSync();
@@ -406,11 +442,12 @@ async function reactivateBehavior(id) {
 }
 
 export {
+  BEHAVIOR_P0_HARD_CAP,
+  executeTolerantOfMissingUsageColumns,
   GHOST_BEHAVIOR_SQL,
   isGhostBehaviorRow,
   BEHAVIOR_CONTENT_MAX_LENGTH,
   behaviorContentOverCapMessage,
-  sanitizeBehaviorContent,
   formatReflexContent,
   isReflexBehavior,
   storeReflexBehavior,

package/dist/{chunk-ELCRJGCH.js → chunk-YMRQIENV.js}

@@ -1,10 +1,10 @@
 import {
   behaviorTruncationNotice
-} from "./chunk-4AAMFWJT.js";
+} from "./chunk-OHZSTZXN.js";
 import {
   countActiveBehaviors,
   listBehaviors
-} from "./chunk-S26CV7BE.js";
+} from "./chunk-YA5LK6KB.js";
 import {
   loadConfigSync
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-QNZ4562V.js → chunk-Z3LXWCB7.js}

@@ -22,7 +22,7 @@ var OrgOriginProvenanceError = class extends Error {
 async function mintOrgOriginStamp(input) {
   if (!input.orgId) throw new OrgOriginProvenanceError("An org-origin stamp requires a non-empty org_id (\xA71.5)");
   if (!input.requestId) throw new OrgOriginProvenanceError("An org-origin stamp requires a request id");
-  const { getTaskRequest } = await import("./task-request-inbox-QBZVU66E.js");
+  const { getTaskRequest } = await import("./task-request-inbox-PKJCYKJV.js");
   const req = getTaskRequest(input.orgId, input.requestId);
   if (!req) {
     throw new OrgOriginProvenanceError(

package/dist/{chunk-EYMFVITZ.js → chunk-Z7I6NQMA.js}

@@ -1,10 +1,10 @@
 import {
   PLATFORM_PROCEDURES,
   PLATFORM_PROCEDURE_TITLES
-} from "./chunk-BQEZPRUC.js";
+} from "./chunk-IZWMWJZT.js";
 import {
   getClient
-} from "./chunk-GL47M7NY.js";
+} from "./chunk-3UD3OF3X.js";
 
 // src/lib/global-procedures.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-6BJCDWSM.js → chunk-ZB4FS2EG.js}

@@ -1,6 +1,6 @@
 import {
   loadEmployees
-} from "./chunk-GL47M7NY.js";
+} from "./chunk-3UD3OF3X.js";
 
 // src/lib/agent-symlinks.ts
 import os from "os";

package/dist/{chunk-ZAEUEDTN.js → chunk-ZD6FZ3WL.js}

@@ -1,6 +1,6 @@
 import {
   signKeyFingerprint
-} from "./chunk-DMUOTCDN.js";
+} from "./chunk-E5CKRHIZ.js";
 import {
   resolveExeDataDir
 } from "./chunk-NPXIS2RY.js";

package/dist/{chunk-FEU6QEEL.js → chunk-ZM6EZAVY.js}

@@ -351,6 +351,7 @@ function recordMcpHttpEvent(event) {
 }
 
 export {
+  readPackageVersion,
   inferMcpRuntime,
   getMcpToolFamily,
   readMcpHttpEvents,

package/dist/{chunk-2KY7WZZF.js → chunk-ZPA4R2UI.js}

@@ -1,6 +1,6 @@
 import {
   EMBEDDING_DIM
-} from "./chunk-FXU7JOXK.js";
+} from "./chunk-C7GHNJPW.js";
 
 // src/lib/tool-capability-index.ts
 var ALWAYS_ON = /* @__PURE__ */ new Set([

package/dist/chunk-ZPPPHVSU.js

@@ -0,0 +1,285 @@
+// src/lib/hook-registration-liveness.ts
+import { accessSync, constants, existsSync, readFileSync, statSync } from "fs";
+import os from "os";
+import path2 from "path";
+
+// src/lib/hook-path-stability.ts
+import path from "path";
+var TRANSIENT_RULES = [
+  {
+    segments: ["_npx"],
+    reason: "npm's per-invocation `npx` cache \u2014 npm prunes it, `npm cache clean` wipes it, and the directory hash changes with the invocation spec"
+  },
+  {
+    segments: ["_cacache"],
+    reason: "npm's content-addressable package cache \u2014 evicted by `npm cache clean` and by npm's own pruning"
+  },
+  { segments: [".npm-cache"], reason: "an npm cache directory" },
+  { segments: [".cache", "npm"], reason: "an npm cache directory" },
+  { segments: [".cache", "yarn"], reason: "a yarn cache directory" },
+  { segments: [".yarn", "berry", "cache"], reason: "a yarn berry cache directory" },
+  { segments: [".yarn", "unplugged"], reason: "yarn's unplugged package cache \u2014 regenerated on install" },
+  { segments: [".yarn", "$$virtual"], reason: "yarn's virtual package tree \u2014 synthesised per install" },
+  { segments: [".pnpm-store"], reason: "the pnpm content-addressable store \u2014 pruned by `pnpm store prune`" },
+  { segments: [".cache", "pnpm"], reason: "a pnpm cache directory" },
+  { segments: [".bun", "install", "cache"], reason: "bun's install cache" },
+  { segments: [".deno", "npm"], reason: "deno's npm package cache" }
+];
+function segmentsOf(p) {
+  const normalized = path.resolve(p);
+  const caseFolds = process.platform === "darwin" || process.platform === "win32";
+  return normalized.split(/[\\/]+/).filter(Boolean).map((s) => caseFolds ? s.toLowerCase() : s);
+}
+function matchesRule(segments, rule) {
+  const caseFolds = process.platform === "darwin" || process.platform === "win32";
+  const want = rule.segments.map((s) => caseFolds ? s.toLowerCase() : s);
+  for (let i = 0; i + want.length <= segments.length; i++) {
+    let hit = true;
+    for (let j = 0; j < want.length; j++) {
+      if (segments[i + j] !== want[j]) {
+        hit = false;
+        break;
+      }
+    }
+    if (hit) return true;
+  }
+  return false;
+}
+function classifyInstallPath(p, env = process.env) {
+  const segments = segmentsOf(p);
+  for (const rule of TRANSIENT_RULES) {
+    if (matchesRule(segments, rule)) {
+      return {
+        transient: true,
+        marker: rule.segments.join(path.sep),
+        reason: rule.reason
+      };
+    }
+  }
+  const configured = env.npm_config_cache ?? env.NPM_CONFIG_CACHE;
+  if (configured && configured.trim()) {
+    const cacheSegments = segmentsOf(configured.trim());
+    if (cacheSegments.length > 0 && cacheSegments.every((seg, i) => segments[i] === seg) && segments.length > cacheSegments.length) {
+      return {
+        transient: true,
+        marker: configured.trim(),
+        reason: "the directory npm_config_cache points at \u2014 package-manager cache, pruned without warning"
+      };
+    }
+  }
+  return { transient: false };
+}
+function assertStableHookPath(hookPath, contextLabel = "hook") {
+  const verdict = classifyInstallPath(hookPath);
+  if (!verdict.transient) return;
+  throw new Error(
+    `[exe-os] REFUSING to register ${contextLabel} under a transient package cache: ${hookPath}
+  ${verdict.marker} is ${verdict.reason}.
+Hook paths are written into GLOBAL config (~/.claude/settings.json) and must outlive it. When the cache is pruned, every hook dies system-wide and \u2014 because hooks are non-blocking \u2014 does so silently (bug 3b487bce). Install exe-os to the global npm root (\`npm i -g @askexenow/exe-os\`) or to a stable location such as ~/exe-os, and run the installer from there.`
+  );
+}
+
+// src/lib/hook-registration-liveness.ts
+var EXE_HOOK_COMMAND = /[\\/]dist[\\/]hooks[\\/]/;
+function extractHookTarget(command) {
+  const script = command.match(/"([^"]+\.[cm]?js)"|(\S+\.[cm]?js)(?=\s|$)/);
+  if (script) return script[1] ?? script[2] ?? null;
+  const argv0 = command.trim().match(/^"([^"]+)"|^(\S+)/);
+  const first = argv0?.[1] ?? argv0?.[2] ?? null;
+  if (!first) return null;
+  if (/^(node|npx|bash|sh|env)$/.test(path2.basename(first))) return null;
+  return first;
+}
+var INTERPRETERS = /* @__PURE__ */ new Set(["node", "npx", "bash", "sh", "zsh", "env", "python", "python3"]);
+function isInterpreted(command, target) {
+  const argv0 = command.trim().match(/^"([^"]+)"|^(\S+)/);
+  const first = argv0?.[1] ?? argv0?.[2] ?? "";
+  if (!first) return false;
+  if (first === target || first === `"${target}"`) return false;
+  return INTERPRETERS.has(path2.basename(first));
+}
+function probeTarget(runtime, event, command) {
+  const target = extractHookTarget(command);
+  if (!target) {
+    return {
+      runtime,
+      event,
+      command,
+      target: null,
+      status: "unparsable",
+      detail: "could not determine which file this hook command runs"
+    };
+  }
+  if (!existsSync(target)) {
+    const verdict2 = classifyInstallPath(target);
+    return {
+      runtime,
+      event,
+      command,
+      target,
+      status: "missing",
+      detail: verdict2.transient ? `script does not exist \u2014 registered under ${verdict2.marker}, which is ${verdict2.reason}` : "script does not exist"
+    };
+  }
+  const needsExec = !isInterpreted(command, target);
+  try {
+    accessSync(target, needsExec ? constants.R_OK | constants.X_OK : constants.R_OK);
+  } catch {
+    return {
+      runtime,
+      event,
+      command,
+      target,
+      status: "unreadable",
+      detail: needsExec ? "exists but is not readable+executable by this user" : "exists but is not readable by this user"
+    };
+  }
+  try {
+    if (statSync(target).isDirectory()) {
+      return {
+        runtime,
+        event,
+        command,
+        target,
+        status: "missing",
+        detail: "registered path is a directory, not a script"
+      };
+    }
+  } catch (err) {
+    if (err?.code !== "ENOENT") {
+      return {
+        runtime,
+        event,
+        command,
+        target,
+        status: "unreadable",
+        detail: `cannot stat registered path: ${err?.message ?? String(err)}`
+      };
+    }
+  }
+  const verdict = classifyInstallPath(target);
+  if (verdict.transient) {
+    return {
+      runtime,
+      event,
+      command,
+      target,
+      status: "transient",
+      detail: `registered under ${verdict.marker}, which is ${verdict.reason} \u2014 present now, but guaranteed to disappear (bug 3b487bce)`
+    };
+  }
+  return { runtime, event, command, target, status: "ok", detail: "script present and loadable" };
+}
+function readHookConfig(filePath) {
+  let text;
+  try {
+    text = readFileSync(filePath, "utf-8");
+  } catch (err) {
+    if (err?.code === "ENOENT") return { kind: "absent" };
+    return { kind: "unreadable", reason: err?.message ?? String(err) };
+  }
+  try {
+    return { kind: "config", value: JSON.parse(text) };
+  } catch (err) {
+    return { kind: "unreadable", reason: err?.message ?? String(err) };
+  }
+}
+function unreadableConfigProbe(runtime, filePath, reason) {
+  return {
+    runtime,
+    event: "<registration file>",
+    command: filePath,
+    target: filePath,
+    status: "unreadable",
+    detail: `hook registration file could not be read: ${reason}`
+  };
+}
+function claudeCommands(settings) {
+  const hooks = settings?.hooks;
+  if (!hooks || typeof hooks !== "object") return [];
+  const out = [];
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      const list = group?.hooks;
+      if (!Array.isArray(list)) continue;
+      for (const hook of list) {
+        const command = hook?.command;
+        if (typeof command === "string") out.push({ event, command });
+      }
+    }
+  }
+  return out;
+}
+function codexCommands(config) {
+  const hooks = config?.hooks;
+  const source = hooks && typeof hooks === "object" ? hooks : config;
+  if (!source || typeof source !== "object") return [];
+  const out = [];
+  for (const [event, entries] of Object.entries(source)) {
+    const list = Array.isArray(entries) ? entries : [entries];
+    for (const entry of list) {
+      if (typeof entry === "string") {
+        out.push({ event, command: entry });
+        continue;
+      }
+      const nested = entry?.hooks;
+      if (Array.isArray(nested)) {
+        for (const hook of nested) {
+          const command2 = hook?.command;
+          if (typeof command2 === "string") out.push({ event, command: command2 });
+        }
+        continue;
+      }
+      const command = entry?.command;
+      if (typeof command === "string") out.push({ event, command });
+    }
+  }
+  return out;
+}
+function auditRegisteredHookLiveness(opts = {}) {
+  const home = opts.home ?? process.env.HOME ?? process.env.USERPROFILE ?? os.homedir();
+  const checkedFiles = [];
+  const probes = [];
+  const sources = [
+    ["claude", path2.join(home, ".claude", "settings.json"), claudeCommands],
+    ["codex", path2.join(home, ".codex", "hooks.json"), codexCommands]
+  ];
+  for (const [runtime, filePath, parse] of sources) {
+    const read = readHookConfig(filePath);
+    if (read.kind === "absent") continue;
+    checkedFiles.push(filePath);
+    if (read.kind === "unreadable") {
+      probes.push(unreadableConfigProbe(runtime, filePath, read.reason));
+      continue;
+    }
+    for (const { event, command } of parse(read.value)) {
+      if (!EXE_HOOK_COMMAND.test(command)) continue;
+      probes.push(probeTarget(runtime, event, command));
+    }
+  }
+  const broken = probes.filter((p) => p.status !== "ok");
+  return {
+    checkedFiles,
+    probes,
+    broken,
+    healthy: probes.length - broken.length,
+    ok: broken.length === 0
+  };
+}
+function formatHookLivenessFailure(report) {
+  if (report.ok) return "";
+  const lines = report.broken.map(
+    (p) => `  ${p.runtime}/${p.event}: ${p.status.toUpperCase()} \u2014 ${p.target ?? p.command} (${p.detail})`
+  );
+  return `${report.broken.length} of ${report.probes.length} registered exe-os hook(s) cannot run. Hooks are non-blocking, so sessions look healthy while capture, task pickup, PreToolUse enforcement gates and checkpointing are all silently dead. Re-register with the installer (\`exe-os install\`).
+${lines.join("\n")}`;
+}
+
+export {
+  classifyInstallPath,
+  assertStableHookPath,
+  extractHookTarget,
+  auditRegisteredHookLiveness,
+  formatHookLivenessFailure
+};