@askexenow/exe-os 0.9.396 → 0.9.398

package/dist/{chunk-45R4367S.js → chunk-ULBPH7SD.js}

@@ -1,6 +1,6 @@
 import {
   getGlobalProceduresBlock
-} from "./chunk-X5FCZYWK.js";
+} from "./chunk-ULORKGXX.js";
 import {
   writePlatformReferenceFile
 } from "./chunk-IZWMWJZT.js";

package/dist/{chunk-X5FCZYWK.js → chunk-ULORKGXX.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-IZWMWJZT.js";
 import {
   fastDbInit
-} from "./chunk-NRR6VAG2.js";
+} from "./chunk-A65MJS3O.js";
 import {
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/lib/global-procedures.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-D2ZII4AG.js → chunk-UMXUJTSQ.js}

@@ -4,10 +4,10 @@ import {
 import {
   reserveVersions,
   vectorToBlob
-} from "./chunk-V4JWFJZR.js";
+} from "./chunk-B7T7I5BK.js";
 import {
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/lib/documents.ts
 import crypto from "crypto";
@@ -85,7 +85,7 @@ async function resolveWorkspace(slug_or_id, name, ownerAgentId) {
   }
   if (owner) {
     try {
-      const { grantWikiAccess } = await import("./wiki-acl-PKJLSR6U.js");
+      const { grantWikiAccess } = await import("./wiki-acl-J564J7MH.js");
       await grantWikiAccess(owner, id, "admin", owner);
     } catch {
     }
@@ -111,7 +111,7 @@ async function resolveDefaultWorkspaceId(cwd) {
   const client = getClient();
   let projectName;
   try {
-    const { getProjectName } = await import("./project-name-5D6ZQNAY.js");
+    const { getProjectName } = await import("./project-name-2TTGTGEQ.js");
     projectName = getProjectName(cwd);
   } catch {
     return null;
@@ -230,7 +230,7 @@ async function ingestDocument(input) {
   }
   let ingestingIdentity = null;
   try {
-    const { getActiveAgent } = await import("./active-agent-7OKWCTDR.js");
+    const { getActiveAgent } = await import("./active-agent-5DC75ZP3.js");
     ingestingIdentity = getActiveAgent().agentId || null;
   } catch {
   }
@@ -308,7 +308,7 @@ async function ingestDocument(input) {
   await client.batch([documentStmt, ...chunkStmts], "write");
   const embedded = vectors.filter((v) => v !== null).length;
   const originalTexts = input.chunks.map((c) => c.text);
-  import("./doc-graph-extractor-VVSMYOR3.js").then(
+  import("./doc-graph-extractor-N4ROA5Y6.js").then(
     ({ extractAndStoreDocumentGraph }) => extractAndStoreDocumentGraph(documentId, originalTexts)
   ).catch((err) => {
     process.stderr.write(

package/dist/{chunk-7INEFMVU.js → chunk-UNFHKOTF.js}

@@ -175,25 +175,47 @@ function evaluateRestartBreaker(prev, now, bootClass, windowMs = RESTART_BREAKER
   };
 }
 function loadStateEntries(deps) {
+  let raw;
   try {
-    if (!deps.exists(deps.statePath)) return [];
-    const parsed = JSON.parse(deps.read(deps.statePath));
+    if (!deps.exists(deps.statePath)) return { entries: [], readable: true };
+    raw = deps.read(deps.statePath);
+  } catch (err) {
+    process.stderr.write(
+      `[exed] Restart-breaker state file unreadable \u2014 FAILING OPEN for this boot (treating as empty, will not trip) but PRESERVING the file on disk so the crash window is not erased: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return { entries: [], readable: false };
+  }
+  try {
+    const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed.restarts)) throw new Error("restarts is not an array");
-    return parsed.restarts.map((e) => {
+    const entries = parsed.restarts.map((e) => {
       if (typeof e === "number" && Number.isFinite(e)) return { t: e, c: "x" };
       if (e && typeof e.t === "number") {
-        const raw = e.c;
-        const c = raw === "s" ? "s" : raw === "r" ? "r" : "x";
+        const raw2 = e.c;
+        const c = raw2 === "s" ? "s" : raw2 === "r" ? "r" : "x";
         return { t: e.t, c };
       }
       return null;
     }).filter((e) => e !== null);
+    return { entries, readable: true };
   } catch (err) {
-    process.stderr.write(
-      `[exed] Restart-breaker state file unreadable \u2014 FAILING OPEN (treating as empty, will not trip): ${err instanceof Error ? err.message : String(err)}
+    const quarantinePath = `${deps.statePath}.corrupt-${deps.now()}`;
+    try {
+      deps.write(quarantinePath, raw);
+      deps.remove(deps.statePath);
+      process.stderr.write(
+        `[exed] Restart-breaker state file was malformed JSON \u2014 quarantined corrupt bytes to ${quarantinePath} and reset restart tracking to a fresh empty state so crash tracking resumes: ${err instanceof Error ? err.message : String(err)}
 `
-    );
-    return [];
+      );
+      return { entries: [], readable: true };
+    } catch (quarantineErr) {
+      process.stderr.write(
+        `[exed] Restart-breaker state file malformed AND could not be quarantined \u2014 FAILING OPEN for this boot (treating as empty, will not trip), original file left in place: ${quarantineErr instanceof Error ? quarantineErr.message : String(quarantineErr)}
+`
+      );
+      return { entries: [], readable: false };
+    }
   }
 }
 function readLastExit(deps) {
@@ -220,7 +242,8 @@ function readLastExit(deps) {
 function recordDaemonRestart(deps = REAL_DEPS, gap, priorRestartIntent) {
   const lastExit = readLastExit(deps);
   const now = deps.now();
-  const prevEntries = loadStateEntries(deps);
+  const prevState = loadStateEntries(deps);
+  const prevEntries = prevState.entries;
   const priorCrashesInWindow = prevEntries.filter(
     (e) => e.c === "x" && now - e.t < RESTART_BREAKER_WINDOW_MS
   ).length;
@@ -239,9 +262,15 @@ function recordDaemonRestart(deps = REAL_DEPS, gap, priorRestartIntent) {
     RESTART_BREAKER_THRESHOLD,
     recoverable
   );
-  try {
-    deps.write(deps.statePath, JSON.stringify({ restarts: ev.entries }));
-  } catch {
+  if (prevState.readable) {
+    try {
+      deps.write(deps.statePath, JSON.stringify({ restarts: ev.entries }));
+    } catch {
+    }
+  } else {
+    process.stderr.write(
+      "[exed] Restart-breaker state NOT persisted this boot \u2014 the existing file could not be read and overwriting it would erase the crash window the breaker trips on.\n"
+    );
   }
   const decision = {
     trip: ev.trip,
@@ -320,11 +349,11 @@ function selfHealStormAlertPath() {
 }
 function crashBootsInWindow(deps = REAL_DEPS, windowMs = RESTART_BREAKER_WINDOW_MS) {
   const now = deps.now();
-  return loadStateEntries(deps).filter((e) => e.c === "x" && now - e.t < windowMs).length;
+  return loadStateEntries(deps).entries.filter((e) => e.c === "x" && now - e.t < windowMs).length;
 }
 function restartBootsInWindow(deps = REAL_DEPS, windowMs = RESTART_BREAKER_WINDOW_MS) {
   const now = deps.now();
-  return loadStateEntries(deps).filter((e) => now - e.t < windowMs).length;
+  return loadStateEntries(deps).entries.filter((e) => now - e.t < windowMs).length;
 }
 function writeBreakerAlert(decision, lastExit, deps = REAL_DEPS) {
   const windowMin = Math.round(RESTART_BREAKER_WINDOW_MS / 6e4);

package/dist/{chunk-7WDLUCHN.js → chunk-UOZBM4LO.js}

@@ -1,15 +1,15 @@
 import {
   getActiveAgent
-} from "./chunk-RPOIKNJZ.js";
+} from "./chunk-LGP67CBT.js";
 import {
   listTasks
-} from "./chunk-V4RIHICU.js";
+} from "./chunk-7QYXNSKT.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/mcp/tools/list-tasks.ts
 import { z } from "zod";

package/dist/{chunk-WEW4TRBL.js → chunk-UPGKO5UD.js}

@@ -212,7 +212,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-H3YXPL7Z.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-5LT2U7IP.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/{chunk-JKUCAMV4.js → chunk-UQDCXE5D.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/lib/skill-refinement.ts
 import crypto from "crypto";

package/dist/{chunk-DXQIIZQC.js → chunk-UYU25KCR.js}

@@ -4,20 +4,20 @@ import {
 import {
   assertValidDbPath
 } from "./chunk-TKDITWDN.js";
+import {
+  listBackups,
+  preBackupCheckpoint
+} from "./chunk-2CGKFJ3Q.js";
 import {
   MEMORY_PROJECTION_OUTBOX_INDEX_SQL,
   MEMORY_PROJECTION_OUTBOX_TABLE_SQL,
   MEMORY_PROJECTION_OUTBOX_UNIQUE_INDEX_SQL,
   PROJECTION_CHECKPOINT_TABLE_SQL,
   ensureMemoryWriteIndex
-} from "./chunk-EHDAWQ5P.js";
+} from "./chunk-L5TOPOTW.js";
 import {
   recordDbOpen
 } from "./chunk-5YEUPUV4.js";
-import {
-  listBackups,
-  preBackupCheckpoint
-} from "./chunk-BKKZN3DJ.js";
 import {
   isPostgresBackendEnabled
 } from "./chunk-YYB5PMTK.js";
@@ -1515,7 +1515,7 @@ async function migrateReflectionDedup(client) {
     "ALTER TABLE memory_reflections ADD COLUMN dedup_key TEXT",
     "migration add memory_reflections.dedup_key"
   );
-  const { reflectionDedupKey } = await import("./memory-reflection-VXFXG55L.js");
+  const { reflectionDedupKey } = await import("./memory-reflection-3TX3U2RP.js");
   const keyForRow = (row) => {
     let sources = [];
     try {
@@ -2035,7 +2035,7 @@ async function _attemptBackupRestore(config) {
 `
       );
       try {
-        const { recordDbRestoreEvent } = await import("./db-restore-events-XYL6CGPC.js");
+        const { recordDbRestoreEvent } = await import("./db-restore-events-R5S7XTHX.js");
         recordDbRestoreEvent({
           kind: "auto-restore",
           restoredFrom: backup.name,
@@ -2078,7 +2078,7 @@ async function _attemptBackupRestore(config) {
 `
   );
   try {
-    const { recordDbRestoreEvent } = await import("./db-restore-events-XYL6CGPC.js");
+    const { recordDbRestoreEvent } = await import("./db-restore-events-R5S7XTHX.js");
     recordDbRestoreEvent({
       kind: "restore-failed",
       quarantinePath: corruptPath,
@@ -2337,7 +2337,7 @@ async function initDatabase(config) {
 `
         );
         try {
-          const { recordDbRestoreEvent } = await import("./db-restore-events-XYL6CGPC.js");
+          const { recordDbRestoreEvent } = await import("./db-restore-events-R5S7XTHX.js");
           recordDbRestoreEvent({
             kind: "wal-recovery",
             quarantinePath: backupPath,
@@ -2351,7 +2351,7 @@ async function initDatabase(config) {
 `
         );
         try {
-          const { recordDbRestoreEvent } = await import("./db-restore-events-XYL6CGPC.js");
+          const { recordDbRestoreEvent } = await import("./db-restore-events-R5S7XTHX.js");
           recordDbRestoreEvent({
             kind: "zeroed-no-wal",
             detail: "DB was 0 bytes at startup with no WAL available \u2014 data may be lost"
@@ -2573,7 +2573,7 @@ async function sweepExpiredSoftDeletedMemories(client, options = {}) {
   const purgeArchived = archDays !== void 0;
   const BATCH_SIZE = 2e3;
   const MAX_BATCHES = 500;
-  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-YZNY6Z3H.js");
+  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-5AMI2SXI.js");
   const softCutoff = `-${softDays} days`;
   const selectArgsBase = [softCutoff];
   let predicate = `status = 'deleted' AND COALESCE(deleted_at, timestamp) < datetime('now', ?)`;
@@ -2959,7 +2959,7 @@ async function ensureSchema() {
     }
   }
   try {
-    const { checkAndRepairFtsIndexOnce } = await import("./fts-integrity-PHCKKOBC.js");
+    const { checkAndRepairFtsIndexOnce } = await import("./fts-integrity-PL7TKYTM.js");
     await checkAndRepairFtsIndexOnce(client);
   } catch (ftsErr) {
     process.stderr.write(

package/dist/{chunk-V7NXFHZM.js → chunk-UZZSM36C.js}

@@ -2,7 +2,7 @@ import {
   deleteKeychainSecret,
   getKeychainSecret,
   setKeychainSecret
-} from "./chunk-5AGOX2XD.js";
+} from "./chunk-ZFJ2KQNY.js";
 
 // src/lib/consent-passphrase.ts
 import crypto from "crypto";

package/dist/{chunk-6Q3M7KZE.js → chunk-V5C7NLBF.js}

@@ -14,10 +14,10 @@ import {
 import {
   buildClaudeHttpMcpEntry,
   buildClaudeStdioProxyMcpEntry
-} from "./chunk-5UUHXDX6.js";
+} from "./chunk-C4OMBSRB.js";
 import {
   ensureAllAgentSymlinks
-} from "./chunk-BJ3ZQAIL.js";
+} from "./chunk-DTUQGAD4.js";
 import {
   MCP_LEGACY_KEY,
   MCP_PRIMARY_KEY
@@ -977,7 +977,7 @@ async function runInstaller(homeDir) {
     );
   }
   try {
-    const { generateAgentDefs, summarizeAgentDefResults } = await import("./agent-defs-generator-PZJGE6PL.js");
+    const { generateAgentDefs, summarizeAgentDefResults } = await import("./agent-defs-generator-TBR4P3XR.js");
     const defResults = generateAgentDefs({ homeDir: resolvedHome });
     process.stderr.write(`Agent definitions: ${summarizeAgentDefResults(defResults)}
 `);

package/dist/{chunk-YQJC5ETC.js → chunk-V6EIR7QO.js}

@@ -1,10 +1,10 @@
 import {
   registerScopedQueryChokepoint,
   scopedQueryChokepointStatus
-} from "./chunk-HHNGQIP3.js";
+} from "./chunk-DUPQMNK6.js";
 import {
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/lib/org-scoped-rows.ts
 var SCOPED_QUERY_MAX_LIMIT = 200;

package/dist/{chunk-XFF6SPWG.js → chunk-VFVF3FHG.js}

@@ -10,7 +10,7 @@ import {
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-6VMVQ3G7.js";
+} from "./chunk-VX7I5XT6.js";
 import {
   loadConfig
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-F5VP7K3C.js → chunk-VRTBRPRO.js}

@@ -4,7 +4,7 @@ import {
   getGitRootAsync,
   isWorktreeDirty,
   isWorktreeDirtyAsync
-} from "./chunk-UW5KXM4D.js";
+} from "./chunk-RCMXCNMC.js";
 
 // src/lib/worktree-sweep.ts
 import { execFile } from "child_process";
@@ -193,17 +193,63 @@ async function detectMainBranch(repoRoot) {
   }
   return null;
 }
-async function isBranchMerged(repoRoot, branch, into) {
+var MERGED_PR_BULK_LIMIT = 500;
+async function ghBulkPrLookup(repoRoot, mainBranch) {
   try {
-    const { stdout: merged } = await execFileAsync("git", ["branch", "--merged", into], {
+    const { stdout } = await execFileAsync(
+      "gh",
+      [
+        "pr",
+        "list",
+        "--state",
+        "merged",
+        "--base",
+        mainBranch,
+        "--json",
+        "headRefName,headRefOid,mergedAt,baseRefName",
+        "--limit",
+        String(MERGED_PR_BULK_LIMIT)
+      ],
+      { cwd: repoRoot, encoding: "utf8", timeout: GIT_TIMEOUT_MS }
+    );
+    return JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+}
+async function buildMergedPrCache(repoRoot, mainBranch, lookup = ghBulkPrLookup) {
+  const records = await lookup(repoRoot, mainBranch);
+  if (records === null) return null;
+  const cache = /* @__PURE__ */ new Map();
+  for (const record of records) {
+    if (record.baseRefName !== mainBranch) continue;
+    const existing = cache.get(record.headRefName);
+    if (!existing || (record.mergedAt ?? "") >= (existing.mergedAt ?? "")) {
+      cache.set(record.headRefName, record);
+    }
+  }
+  return cache;
+}
+async function currentBranchTip(repoRoot, branch) {
+  try {
+    const { stdout } = await execFileAsync("git", ["rev-parse", "--verify", `refs/heads/${branch}^{commit}`], {
       cwd: repoRoot,
       encoding: "utf8",
       timeout: GIT_TIMEOUT_MS
     });
-    return merged.split("\n").map((l) => l.replace(/^[*+]?\s+/, "").trim()).includes(branch);
+    return stdout.trim() || null;
   } catch {
-    return false;
+    return null;
+  }
+}
+async function getBranchLandedState(repoRoot, branch, mainBranch, prCache = null) {
+  const record = prCache?.get(branch);
+  if (!record || record.baseRefName !== mainBranch) return "unknown";
+  const tip = await currentBranchTip(repoRoot, branch);
+  if (tip && record.headRefOid === tip) {
+    return "merged";
   }
+  return "unknown";
 }
 async function hasLiveTmuxSession(agentName) {
   try {
@@ -370,6 +416,7 @@ Archived by worktree-sweep after ${DIRTY_ORPHAN_MAX_AGE_MS / 864e5}-day dirty or
 async function sweepWorktrees(options = {}) {
   const dryRun = options.dryRun ?? false;
   const repoPaths = options.repoPaths ?? discoverRepoPaths();
+  const prLookup = options.prLookup;
   const result = {
     reposScanned: 0,
     removed: [],
@@ -384,6 +431,7 @@ async function sweepWorktrees(options = {}) {
     result.reposScanned++;
     const repoName = path.basename(repoRoot);
     const mainBranch = await detectMainBranch(repoRoot);
+    const prCache = mainBranch ? await buildMergedPrCache(repoRoot, mainBranch, prLookup) : null;
     if (!dryRun) {
       await pruneWorktreeRegistry(repoRoot);
     }
@@ -460,14 +508,11 @@ async function sweepWorktrees(options = {}) {
         });
         continue;
       }
-      const isMerged = mainBranch ? await isBranchMerged(repoRoot, wt.branch, mainBranch) : false;
+      const landedState = mainBranch ? await getBranchLandedState(repoRoot, wt.branch, mainBranch, prCache) : "unknown";
+      const isMerged = landedState === "merged";
       if (dryRun) {
         result.removed.push({ repo: repoName, worktree: wtName, branch: wt.branch });
-        if (isMerged || !mainBranch) {
-          result.branchesDeleted.push({ repo: repoName, branch: wt.branch, remote: true });
-        } else {
-          result.branchesDeleted.push({ repo: repoName, branch: wt.branch, remote: false });
-        }
+        result.branchesDeleted.push({ repo: repoName, branch: wt.branch, remote: isMerged });
         continue;
       }
       const removed = await removeWorktree(repoRoot, wt.path);
@@ -480,7 +525,7 @@ async function sweepWorktrees(options = {}) {
 `);
       const localDeleted = await deleteBranch(repoRoot, wt.branch);
       let remoteDeleted = false;
-      if (localDeleted) {
+      if (localDeleted && isMerged) {
         remoteDeleted = await deleteRemoteBranch(repoRoot, wt.branch);
       }
       if (localDeleted) {
@@ -548,6 +593,8 @@ async function getWorktreeBranch(repoRoot, wtPath) {
 export {
   discoverRepoPaths,
   discoverRepoPathsAsync,
+  buildMergedPrCache,
+  getBranchLandedState,
   isWorktreePathOccupiedByCwd,
   sweepWorktrees,
   cleanupAgentWorktree

package/dist/{chunk-6VMVQ3G7.js → chunk-VX7I5XT6.js}

@@ -1,9 +1,9 @@
 import {
   PLAN_LIMITS
-} from "./chunk-A7XLR3K7.js";
+} from "./chunk-3R7UDPVR.js";
 import {
   getDeviceInfo
-} from "./chunk-PKPJ62VF.js";
+} from "./chunk-ZXMOTEQE.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -44,6 +44,12 @@ oR8NJBuiITKaerulCXiSiJMX1HP0+h5dHBVfCWQfIVk5BMdsheAMaP806w==
 -----END PUBLIC KEY-----`;
 var LICENSE_PUBLIC_KEYS = [LICENSE_PUBLIC_KEY_PEM_2026_06_17, LICENSE_PUBLIC_KEY_PEM, LICENSE_PUBLIC_KEY_PEM_PREV];
 var LICENSE_JWT_ALG = "ES256";
+var MAX_OFFLINE_TRUST_DAYS = 7;
+function withinOfflineTrustWindow(payload, maxDays) {
+  const iat = payload?.iat;
+  if (typeof iat !== "number" || !Number.isFinite(iat)) return true;
+  return Date.now() < iat * 1e3 + maxDays * 24 * 60 * 60 * 1e3;
+}
 function suppliedNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
@@ -55,6 +61,15 @@ function resolveClientLimits(plan, supplied) {
     memoryLimit: suppliedNumber(supplied?.memories) ?? fallback.memories
   };
 }
+function subscriptionEndClaim(payload) {
+  if (!payload) return null;
+  for (const name of ["license_expires_at", "subscription_ends_at", "subscriptionEndsAt", "sub_exp", "current_period_end"]) {
+    const raw = payload[name];
+    if (typeof raw === "string" && raw.trim()) return raw;
+    if (typeof raw === "number" && Number.isFinite(raw)) return new Date(raw * 1e3).toISOString();
+  }
+  return null;
+}
 function limitsClaim(payload) {
   const claim = payload?.limits;
   if (!claim || typeof claim !== "object") return null;
@@ -247,7 +262,12 @@ async function verifyLicenseJwt(token) {
         valid: true,
         plan,
         email,
-        expiresAt: payload.exp ? new Date(payload.exp * 1e3).toISOString() : null,
+        // Bug f855bcbe: `exp` is this TOKEN's lifetime, not the customer's
+        // subscription. Only a claim that actually means "the subscription ends
+        // then" may fill `expiresAt`; the token's own TTL is reported as what it
+        // is, and nothing renders it as an expiry date.
+        expiresAt: subscriptionEndClaim(payload),
+        proofExpiresAt: payload.exp ? new Date(payload.exp * 1e3).toISOString() : null,
         ...limits
       };
     } catch {
@@ -262,6 +282,7 @@ async function getCachedLicense(expectedKey) {
     const raw = JSON.parse(readFileSync(CACHE_PATH, "utf8"));
     if (!raw.token || typeof raw.token !== "string") return null;
     if (!cacheVouchesForKey(raw, expectedKey)) return null;
+    if (!withinOfflineTrustWindow(readTokenClaims(raw.token), MAX_OFFLINE_TRUST_DAYS)) return null;
     return await verifyLicenseJwt(raw.token);
   } catch {
     return null;
@@ -269,15 +290,14 @@ async function getCachedLicense(expectedKey) {
 }
 async function getGraceVerifiedLicense(graceDays = 7, expectedKey) {
   try {
-    if (expectedKey) {
-      const rawCache = readCacheFile();
-      if (!rawCache || !cacheVouchesForKey(rawCache, expectedKey)) return null;
-    }
+    const rawCache = readCacheFile();
+    if (!rawCache || !cacheVouchesForKey(rawCache, expectedKey)) return null;
     const token = readCachedLicenseToken();
     if (!token) return null;
     const payloadB64 = token.split(".")[1];
     if (!payloadB64) return null;
     const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+    if (!withinOfflineTrustWindow(payload, graceDays)) return null;
     const expMs = (payload.exp ?? 0) * 1e3;
     if (Date.now() >= expMs + graceDays * 24 * 60 * 60 * 1e3) return null;
     let verified = null;
@@ -305,13 +325,23 @@ async function getGraceVerifiedLicense(graceDays = 7, expectedKey) {
       valid: true,
       plan,
       email: verified.sub ?? "",
-      expiresAt: verified.exp ? new Date(verified.exp * 1e3).toISOString() : null,
+      expiresAt: subscriptionEndClaim(verified),
+      proofExpiresAt: verified.exp ? new Date(verified.exp * 1e3).toISOString() : null,
       ...limits
     };
   } catch {
     return null;
   }
 }
+function readTokenClaims(token) {
+  try {
+    const payloadB64 = token.split(".")[1];
+    if (!payloadB64) return void 0;
+    return JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+  } catch {
+    return void 0;
+  }
+}
 function readCacheFile() {
   try {
     if (!existsSync(CACHE_PATH)) return null;
@@ -336,9 +366,23 @@ function licenseKeyFingerprint(apiKey) {
   return createHash("sha256").update(apiKey.trim(), "utf8").digest("hex");
 }
 function cacheVouchesForKey(raw, expectedKey) {
-  if (!expectedKey) return true;
+  const bound = expectedKey ?? licenseKeyOnDisk();
   if (typeof raw.keyFp !== "string" || !raw.keyFp) return true;
-  return raw.keyFp === licenseKeyFingerprint(expectedKey);
+  if (!bound) return false;
+  return raw.keyFp === licenseKeyFingerprint(bound);
+}
+function licenseKeyOnDisk() {
+  const key = loadLicense();
+  if (key) return key;
+  try {
+    const configPath = path.join(EXE_AI_DIR, "config.json");
+    if (!existsSync(configPath)) return null;
+    const raw = JSON.parse(readFileSync(configPath, "utf8"));
+    const mirrored = raw.cloud?.apiKey;
+    return mirrored && mirrored.trim() ? mirrored.trim() : null;
+  } catch {
+    return null;
+  }
 }
 function cacheResponse(token, apiKey) {
   try {
@@ -844,7 +888,7 @@ function isFeatureAllowed(license, feature) {
     case "wiki":
       return license.plan !== "free";
     case "unlimited_employees":
-      return license.plan === "team" || license.plan === "agency" || license.plan === "enterprise";
+      return license.employeeLimit === -1;
   }
 }
 function mirrorLicenseKey(apiKey) {

package/dist/{chunk-K3EU7B72.js → chunk-VXYXKN6Z.js}

@@ -1,23 +1,23 @@
 import {
   derivePartnerSealIdentity
-} from "./chunk-TQJMG65I.js";
+} from "./chunk-BI6SK67J.js";
 import {
   pinMismatchReason,
   pinnedOrgKeyEpochs,
   readOrgKeyPin
-} from "./chunk-VV7D7KEX.js";
+} from "./chunk-F4C3X66B.js";
 import {
   derivePartnerSignIdentity,
   displayFingerprint,
   signKeyFingerprint
-} from "./chunk-LGNDHTDP.js";
+} from "./chunk-342X5YQB.js";
 import {
   orgMembershipPresent,
   readActiveOrgMemberships
-} from "./chunk-INLY2LLN.js";
+} from "./chunk-XMQE5IBD.js";
 import {
   isValidX25519Recipient
-} from "./chunk-I4DBM5ME.js";
+} from "./chunk-NQG5CD3V.js";
 
 // src/lib/org-partner-config.ts
 function pickString(rec, ...keys) {