@askexenow/exe-os 0.9.397 → 0.9.398

package/dist/{chunk-ABDYYZSP.js → chunk-GER43BIE.js}

@@ -1809,6 +1809,27 @@ function expandEnvReferences(token, homeDir, env) {
   if (out === "~" || out.startsWith("~/")) out = home + out.slice(1);
   return out;
 }
+var KNOWN_SAFE_PATH_ROOT_SUBSTITUTION = /^\$\(\s*npm\s+root\s+(?:-g|--global)\s*\)$/;
+function npmRootGSubstitutionMayBePolluted(fullCommand, env) {
+  if (env.npm_config_prefix || env.NPM_CONFIG_PREFIX || env.PREFIX) return true;
+  if (/\b(?:npm_config_prefix|NPM_CONFIG_PREFIX|PREFIX)\s*=/.test(fullCommand)) return true;
+  if (/\bnpm\s+config\b/i.test(fullCommand)) return true;
+  if (/\bln\b/.test(fullCommand)) return true;
+  return false;
+}
+function isTrustedNodeBootArgument(argument, homeDir, env) {
+  const expanded = expandEnvReferences(argument, homeDir, env);
+  if (fstringIsOpaque(expanded)) return false;
+  const substitutions = expanded.match(/\$\([^)]*\)|`[^`]*`/g) ?? [];
+  if (substitutions.length !== 1) return false;
+  const substitution = substitutions[0];
+  if (!KNOWN_SAFE_PATH_ROOT_SUBSTITUTION.test(substitution)) return false;
+  if (expanded.indexOf(substitution) !== 0) return false;
+  const rest = expanded.slice(substitution.length);
+  if (/\$\{|\$[^A-Za-z_\s)]/.test(rest)) return false;
+  if (rest.split("/").some((seg) => seg === "..")) return false;
+  return true;
+}
 function isUnverifiablePathToken(expanded) {
   if (fstringIsOpaque(expanded)) return true;
   if (!UNRESOLVABLE_EXPANSION.test(expanded)) return false;
@@ -1818,6 +1839,15 @@ function isUnverifiablePathToken(expanded) {
 function inAuditDir(resolved, auditDir, ledgerFile) {
   return resolved === ledgerFile || resolved === auditDir || resolved.startsWith(auditDir + path2.sep);
 }
+function findBracketClassEnd(component, start) {
+  return component.indexOf("]", component[start] === "]" ? start + 1 : start);
+}
+function hasAmbiguousPosixClassIntroducer(chars) {
+  for (let i = 0; i < chars.length; i++) {
+    if (chars[i] === "[" && /[:.=]/.test(chars[i + 1] ?? "")) return true;
+  }
+  return false;
+}
 function globComponentPattern(component) {
   let pattern = "";
   for (let i = 0; i < component.length; i++) {
@@ -1828,11 +1858,16 @@ function globComponentPattern(component) {
       let start = i + 1;
       const negated = component[start] === "!" || component[start] === "^";
       if (negated) start++;
-      const end = component.indexOf("]", component[start] === "]" ? start + 1 : start);
-      if (end < 0) throw new Error("Unverified glob character class");
+      const end = findBracketClassEnd(component, start);
+      if (end < 0) {
+        pattern += "\\[";
+        continue;
+      }
       const chars = component.slice(start, end);
-      if (chars.includes("[") || chars.includes("\\")) throw new Error("Unverified glob character class");
-      pattern += `[${negated ? "^" : ""}${chars.replace(/[\]^]/g, "\\$&")}]`;
+      if (chars.includes("\\") || hasAmbiguousPosixClassIntroducer(chars)) {
+        throw new Error("Unverified glob character class");
+      }
+      pattern += `[${negated ? "^" : ""}${chars.replace(/[\]^\\]/g, "\\$&")}]`;
       i = end;
     } else pattern += char.replace(/[.+^${}()|\\\]]/g, "\\$&");
   }
@@ -1893,7 +1928,16 @@ function segmentAuditVerdict(text, auditDir, ledgerFile, rawLedgerPath, rawAudit
   if (mentions(text) || mentions(expandEnvReferences(text, homeDir, env))) return "yes";
   let unverified = false;
   for (const frag of text.split(/\s+/)) {
-    if (isUnverifiablePathToken(expandEnvReferences(frag, homeDir, env))) unverified = true;
+    const expandedFrag = expandEnvReferences(frag, homeDir, env);
+    if (isUnverifiablePathToken(expandedFrag)) {
+      unverified = true;
+      continue;
+    }
+    if (!/[*?\[]/.test(expandedFrag)) continue;
+    if (UNRESOLVABLE_EXPANSION.test(expandedFrag)) continue;
+    const verdict = globAuditVerdict(expandedFrag.replace(/\/+\*+\/?$/, ""), cwd, auditDir, ledgerFile);
+    if (verdict === "yes") return "yes";
+    if (verdict === "unverified") unverified = true;
   }
   for (const tok of tokenizeShell(text).tokens) {
     const stripped = tok.replace(/\/+\*+\/?$/, "");
@@ -1987,6 +2031,159 @@ function segmentAuditVerdict(text, auditDir, ledgerFile, rawLedgerPath, rawAudit
   }
   return unverified ? "unverified" : "no";
 }
+function segmentHasOnlyAllowlistedRedirects(segment) {
+  const n = segment.length;
+  let i = 0;
+  let inSingle = false;
+  let inDouble = false;
+  const readWord = (start) => {
+    let cur = "";
+    let j = start;
+    let single = false;
+    let double = false;
+    while (j < n) {
+      const ch = segment[j];
+      const next = segment[j + 1];
+      if (single) {
+        if (ch === "'") {
+          single = false;
+          j++;
+          continue;
+        }
+        cur += ch;
+        j++;
+        continue;
+      }
+      if (double) {
+        if (ch === '"') {
+          double = false;
+          j++;
+          continue;
+        }
+        if (ch === "\\" && (next === "$" || next === "`" || next === '"' || next === "\\")) {
+          cur += next;
+          j += 2;
+          continue;
+        }
+        cur += ch;
+        j++;
+        continue;
+      }
+      if (ch === "'") {
+        single = true;
+        j++;
+        continue;
+      }
+      if (ch === '"') {
+        double = true;
+        j++;
+        continue;
+      }
+      if (/\s/.test(ch)) break;
+      if (ch === ";" || ch === "|" || ch === "&" || ch === "<" || ch === ">" || ch === "(" || ch === ")") break;
+      if (ch === "\\" && next !== void 0) {
+        cur += next;
+        j += 2;
+        continue;
+      }
+      cur += ch;
+      j++;
+    }
+    return { word: cur, end: j, ambiguous: single || double };
+  };
+  while (i < n) {
+    const ch = segment[i];
+    const next = segment[i + 1];
+    if (inSingle) {
+      if (ch === "'") inSingle = false;
+      i++;
+      continue;
+    }
+    if (inDouble) {
+      if (ch === "\\" && (next === "$" || next === "`" || next === '"' || next === "\\")) {
+        i += 2;
+        continue;
+      }
+      if (ch === '"') {
+        inDouble = false;
+        i++;
+        continue;
+      }
+      i++;
+      continue;
+    }
+    if (ch === "'") {
+      inSingle = true;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      inDouble = true;
+      i++;
+      continue;
+    }
+    if (ch === "\\" && next !== void 0) {
+      i += 2;
+      continue;
+    }
+    let opStart = i;
+    let fdDigits = "";
+    if (/[0-9]/.test(ch)) {
+      let k2 = i;
+      while (k2 < n && /[0-9]/.test(segment[k2])) k2++;
+      if (segment[k2] === "<" || segment[k2] === ">") {
+        opStart = k2;
+        fdDigits = segment.slice(i, k2);
+      }
+    }
+    let opText = "";
+    if (segment.startsWith("<<<", opStart)) opText = "<<<";
+    else if (segment.startsWith("<<", opStart)) opText = "<<";
+    else if (segment.startsWith("<>", opStart)) opText = "<>";
+    else if (segment[opStart] === "<") opText = "<";
+    else if (segment.startsWith("&>>", opStart)) opText = "&>>";
+    else if (segment.startsWith("&>", opStart)) opText = "&>";
+    else if (segment.startsWith(">>", opStart)) opText = ">>";
+    else if (segment[opStart] === ">") opText = ">";
+    if (opText === "") {
+      i++;
+      continue;
+    }
+    const isHeredoc = opText === "<<" || opText === "<<<";
+    let k = opStart + opText.length;
+    while (k < n && /[ \t]/.test(segment[k])) k++;
+    if (segment[k] === "&" && /[0-9-]/.test(segment[k + 1] ?? "")) {
+      const dupTo = segment[k + 1];
+      const isAllowedDup = opText === ">" && fdDigits === "2" && dupTo === "1" || // 2>&1
+      opText === ">" && fdDigits === "1" && dupTo === "2" || // 1>&2
+      opText === ">" && fdDigits === "" && dupTo === "2";
+      if (!isAllowedDup) return false;
+      i = k + 2;
+      continue;
+    }
+    if (isHeredoc) {
+      const from = segment[k] === "-" ? k + 1 : k;
+      const { end: end2, ambiguous: ambiguous2 } = readWord(from);
+      if (ambiguous2) return false;
+      i = Math.max(end2, opStart + opText.length);
+      continue;
+    }
+    const { word, end, ambiguous } = readWord(k);
+    if (ambiguous) return false;
+    const isNullTargetShape = opText === ">" && (fdDigits === "" || fdDigits === "1" || fdDigits === "2") || opText === "&>" || opText === "<" && fdDigits === "";
+    if (!isNullTargetShape || word !== "/dev/null") return false;
+    i = Math.max(end, opStart + opText.length);
+  }
+  return !(inSingle || inDouble);
+}
+function isTrustedNodeBootLine(seg, homeDir, env, npmRootGSubstitutionPolluted) {
+  if (npmRootGSubstitutionPolluted) return false;
+  if (!/^\s*node\s+"\$\(npm root (?:-g|--global)\)\/[A-Za-z0-9@._\/-]+"(?:\s+--[a-z][a-z-]*)*\s*$/.test(seg)) return false;
+  const tokens = tokenizeShell(seg).tokens;
+  if (tokens.length < 2 || tokens[0] !== "node") return false;
+  if (!tokens.slice(2).every((t) => /^--[a-z][a-z-]*$/.test(t))) return false;
+  return isTrustedNodeBootArgument(tokens[1], homeDir, env);
+}
 function hasLiveCommandOrProcessSubstitution(text) {
   let state = "none";
   for (let i = 0; i < text.length; i++) {
@@ -2052,11 +2249,27 @@ function commandMutatesLedger(command, ledgerPath, homeDir, cwd, env, depth = 0)
   });
   return commandMutatesLedgerForSegments(quoteAwareSegments, command, ledgerPath, homeDir, cwd, env, depth) || commandMutatesLedgerForSegments(naiveSegments, command, ledgerPath, homeDir, cwd, env, depth);
 }
-function commandMutatesLedgerForSegments(segments, command, ledgerPath, homeDir, cwd, env, depth) {
+function rejoinSplitFdDuplications(segments) {
+  const rejoined = [];
+  for (let i = 0; i < segments.length; i++) {
+    const seg = segments[i];
+    const next = segments[i + 1];
+    if (next !== void 0 && /[0-9]?[<>]$/.test(seg.trimEnd()) && /^[0-9-]+$/.test(next.trim())) {
+      rejoined.push(`${seg}&${next}`);
+      i++;
+      continue;
+    }
+    rejoined.push(seg);
+  }
+  return rejoined;
+}
+function commandMutatesLedgerForSegments(rawSegments, command, ledgerPath, homeDir, cwd, env, depth) {
+  const segments = rejoinSplitFdDuplications(rawSegments);
   const rawLedgerPath = path2.resolve(ledgerPath);
   const rawAuditDir = path2.dirname(rawLedgerPath);
   const auditDir = realResolve(cwd, rawAuditDir) ?? rawAuditDir;
   const ledgerFile = realResolve(cwd, rawLedgerPath) ?? rawLedgerPath;
+  const npmRootGSubstitutionPolluted = npmRootGSubstitutionMayBePolluted(command, env);
   const verdictOf = (text, directory = cwd) => segmentAuditVerdict(text, auditDir, ledgerFile, rawLedgerPath, rawAuditDir, homeDir, directory, env);
   if (segments.length === 0) return verdictOf(command) !== "no";
   let accountedFor = false;
@@ -2069,6 +2282,10 @@ function commandMutatesLedgerForSegments(segments, command, ledgerPath, homeDir,
       if (scriptIndex < 0) continue;
       if (unknownDirectory || [...directories].some((directory) => commandMutatesLedger(tokens[scriptIndex], ledgerPath, homeDir, directory, env, depth + 1))) return true;
     }
+    if (isTrustedNodeBootLine(seg, homeDir, env, npmRootGSubstitutionPolluted)) {
+      accountedFor = true;
+      continue;
+    }
     const changesDirectory = ["cd", "pushd", "popd"].includes(tokens[0] ?? "");
     if (changesDirectory && /\$\(|`/.test(seg)) return true;
     if (changesDirectory && !/[<>]/.test(seg)) {
@@ -2089,7 +2306,7 @@ function commandMutatesLedgerForSegments(segments, command, ledgerPath, homeDir,
     const verdict = verdicts.includes("yes") ? "yes" : unknownDirectory || verdicts.includes("unverified") ? "unverified" : "no";
     if (verdict === "no") continue;
     accountedFor = true;
-    if (!/[<>]/.test(seg) && !hasLiveCommandOrProcessSubstitution(seg) && [...directories].every((directory) => LEDGER_READ_ONLY_PROGRAMS.has(segmentProgram(seg, directory)))) continue;
+    if (segmentHasOnlyAllowlistedRedirects(seg) && !hasLiveCommandOrProcessSubstitution(seg) && [...directories].every((directory) => LEDGER_READ_ONLY_PROGRAMS.has(segmentProgram(seg, directory)))) continue;
     return true;
   }
   return !accountedFor && verdictOf(command) === "yes";

package/dist/{chunk-XYB7GHGV.js → chunk-GOQ5EE67.js}

@@ -1,7 +1,7 @@
 import {
   getIdentity,
   loadEmployeesSync
-} from "./chunk-GAUMGWSQ.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/lib/drift-probes.ts
 var DRIFT_THRESHOLD = 80;

package/dist/{chunk-I3MPYHFM.js → chunk-HRLCAV2S.js}

@@ -1,12 +1,12 @@
 import {
   storeBehavior
-} from "./chunk-HNVYH2WE.js";
+} from "./chunk-Q7YT7RGZ.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-VGMACSEV.js";
 import {
   getClient
-} from "./chunk-GAUMGWSQ.js";
+} from "./chunk-UYU25KCR.js";
 import {
   loadConfig
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-ZBUUFS5G.js → chunk-HWZZNUJJ.js}

@@ -4,7 +4,7 @@ import {
 import {
   flushBatch,
   writeMemory
-} from "./chunk-P4C3BX2L.js";
+} from "./chunk-B7T7I5BK.js";
 import {
   SUPPORT_PRODUCTS,
   isWellFormedCommit,

package/dist/{chunk-5UC27XF6.js → chunk-I3OXYKU7.js}

@@ -1,12 +1,12 @@
 import {
   sessionScopeFilter
-} from "./chunk-Y2DTTZCV.js";
+} from "./chunk-7QYXNSKT.js";
 import {
   leaseExpiryIso
 } from "./chunk-E23LNUWJ.js";
 import {
   getProjectName
-} from "./chunk-ROQ6R3FV.js";
+} from "./chunk-SQE2PHXK.js";
 
 // src/lib/subagent-observability.ts
 var MAX_RESULT_DIGEST_CHARS = 200;

package/dist/{chunk-AMSNTFS4.js → chunk-IACMGMGW.js}

@@ -1,6 +1,6 @@
 import {
   isManagementRole
-} from "./chunk-GAUMGWSQ.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/lib/transcript-sidechain.ts
 import { readFileSync } from "fs";

package/dist/{chunk-MKHUI5UB.js → chunk-ICAGVBZ4.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-T4IDLAZM.js";
 import {
   getProjectName
-} from "./chunk-ROQ6R3FV.js";
+} from "./chunk-SQE2PHXK.js";
 
 // src/lib/post-tool-memory.ts
 var NON_INGESTIBLE_TOOLS = /* @__PURE__ */ new Set([

package/dist/{chunk-DOMITJOC.js → chunk-IDFOZ6YH.js}

@@ -15,7 +15,7 @@ import {
 import {
   getMasterKey,
   setMasterKey
-} from "./chunk-O22YLZXQ.js";
+} from "./chunk-ZFJ2KQNY.js";
 import {
   WINDOWS_UNSUPPORTED_EXIT,
   isWSL,

package/dist/{chunk-AFYSK7BX.js → chunk-J54BOM4G.js}

@@ -1,12 +1,12 @@
 import {
   sendMessage
-} from "./chunk-JI7TFGJY.js";
+} from "./chunk-OSLT3VAE.js";
 import {
   getActiveAgent
-} from "./chunk-C44UWID5.js";
+} from "./chunk-LGP67CBT.js";
 import {
   resolveExeSession
-} from "./chunk-Y2DTTZCV.js";
+} from "./chunk-7QYXNSKT.js";
 import {
   getDispatcherSession
 } from "./chunk-PCV52RYM.js";
@@ -16,7 +16,7 @@ import {
 import {
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-GAUMGWSQ.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/mcp/tools/send-message.ts
 import { z } from "zod";

package/dist/{chunk-YYPHTYOV.js → chunk-JDRIUUMY.js}

@@ -1,16 +1,16 @@
 import {
   extractMemoryGraph
-} from "./chunk-2DDXCN4A.js";
+} from "./chunk-QJI5LPRJ.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-P4C3BX2L.js";
+} from "./chunk-B7T7I5BK.js";
 import {
   extractKeywords
 } from "./chunk-CHCA3ZM2.js";
 import {
   getActiveAgent
-} from "./chunk-C44UWID5.js";
+} from "./chunk-LGP67CBT.js";
 
 // src/mcp/tools/import-conversations.ts
 import { z } from "zod";

package/dist/{chunk-AUZ4VPKO.js → chunk-JK5XB7Z5.js}

@@ -1,7 +1,7 @@
 import {
   checkLicense,
   loadLicense
-} from "./chunk-GTW56AUB.js";
+} from "./chunk-VX7I5XT6.js";
 
 // src/lib/license-gate.ts
 var _cachedLicense = null;

package/dist/{chunk-KDRYMX6M.js → chunk-JWA3Y6PE.js}

@@ -7,10 +7,10 @@ import {
 } from "./chunk-S2YTU74T.js";
 import {
   createTask
-} from "./chunk-7KMFHVKB.js";
+} from "./chunk-4VD4CIHX.js";
 import {
   getActiveAgent
-} from "./chunk-C44UWID5.js";
+} from "./chunk-LGP67CBT.js";
 import {
   deriveTaskIdempotencyKey,
   ensureEmployeeAsync,
@@ -18,13 +18,13 @@ import {
   isExeSession,
   logTaskDispatch,
   resolveExeSession
-} from "./chunk-Y2DTTZCV.js";
+} from "./chunk-7QYXNSKT.js";
 import {
   getPaneCwdAsync
 } from "./chunk-6L4VIYLZ.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-2YESHX5N.js";
+} from "./chunk-C3CRGIS4.js";
 import {
   releaseDispatchClaim,
   tryAcquireDispatchClaim,
@@ -37,7 +37,7 @@ import {
 } from "./chunk-GWAN2BDB.js";
 import {
   getLicenseSync
-} from "./chunk-QRWGGJAA.js";
+} from "./chunk-3HV3TRBB.js";
 import {
   isValidSessionScope
 } from "./chunk-BTSWFMEH.js";
@@ -46,7 +46,7 @@ import {
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-GAUMGWSQ.js";
+} from "./chunk-UYU25KCR.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -891,7 +891,7 @@ Idempotent no-op (existing task unchanged; no execution side effects)`
       let claimWarning = "";
       const claimRefRaw = (work_ref ?? "").trim();
       try {
-        const { findConflicts, findConflictsInText, describeConflict, normalizeTarget } = await import("./work-claims-O2WSV3EK.js");
+        const { findConflicts, findConflictsInText, describeConflict, normalizeTarget } = await import("./work-claims-AURJKQOJ.js");
         const conflicts = claimRefRaw ? await findConflicts(
           [normalizeTarget({ kind: "work_ref", value: claimRefRaw })],
           callerRoot
@@ -958,7 +958,7 @@ Nothing was created or dispatched. Either pick different work, or \u2014 if that
         });
         if (claimRefRaw) {
           try {
-            const { acquireClaim } = await import("./work-claims-O2WSV3EK.js");
+            const { acquireClaim } = await import("./work-claims-AURJKQOJ.js");
             const acquired = await acquireClaim({
               targets: [{ kind: "work_ref", value: claimRefRaw }],
               holderSession: callerRoot,
@@ -1154,7 +1154,7 @@ Note: ${spawnOverrideNoopNotice(ignoredSpawnOverrides)}`;
       }
       if (claimRefRaw) {
         try {
-          const { acquireClaim } = await import("./work-claims-O2WSV3EK.js");
+          const { acquireClaim } = await import("./work-claims-AURJKQOJ.js");
           const acquired = await acquireClaim({
             targets: [{ kind: "work_ref", value: claimRefRaw }],
             holderSession: callerRoot,
@@ -1207,7 +1207,7 @@ Claimed ${claimRefRaw} for session ${callerRoot} (claim_group ${acquired.claimGr
           session_scope: sessionScope,
           created_at: (/* @__PURE__ */ new Date()).toISOString()
         }), "utf-8");
-        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-UWSAFL25.js");
+        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-J6MGN7BL.js");
         recordOE({
           eventType: "signal.created",
           source: "create-task.mcp",
@@ -1240,7 +1240,7 @@ Claimed ${claimRefRaw} for session ${callerRoot} (claim_group ${acquired.claimGr
             let projectConflictOpts = {};
             try {
               const { getClient } = await import("./lib/database.js");
-              const { sessionScopeFilter } = await import("./task-scope-NF7JKUD7.js");
+              const { sessionScopeFilter } = await import("./task-scope-Q4GALTXQ.js");
               const client = getClient();
               const scope = sessionScopeFilter(task.sessionScope || callerRoot || exeSession || null);
               const existing = await client.execute({

package/dist/{chunk-4MFPPHG4.js → chunk-KUJODN4N.js}

@@ -4,7 +4,7 @@ import {
 import {
   isValidX25519Recipient,
   pubKeyHash
-} from "./chunk-F6OV7JP2.js";
+} from "./chunk-NQG5CD3V.js";
 
 // src/lib/monitor-grants.ts
 import crypto from "crypto";

package/dist/{chunk-JO7ZJTFL.js → chunk-L5TOPOTW.js}

@@ -265,7 +265,7 @@ async function persistMemoryBatch(client, rows) {
   }
   const hygieneIds = inserted.filter((row) => row.supersedes_id).map((row) => row.id);
   if (hygieneIds.length > 0) {
-    const { scheduleSupersessionHygiene } = await import("./memory-maintenance-42VRD746.js");
+    const { scheduleSupersessionHygiene } = await import("./memory-maintenance-BF6DEY23.js");
     scheduleSupersessionHygiene(hygieneIds);
   }
   return { outcomes, inserted };

package/dist/{chunk-C44UWID5.js → chunk-LGP67CBT.js}

@@ -14,7 +14,7 @@ import {
   getEmployee,
   isCoordinatorRole,
   loadEmployeesSync
-} from "./chunk-GAUMGWSQ.js";
+} from "./chunk-UYU25KCR.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-GGSXOKK6.js → chunk-LHNMKY7N.js}

@@ -4,18 +4,18 @@ import {
 } from "./chunk-NEHOQ3P2.js";
 import {
   isCrdtSyncEnabled
-} from "./chunk-M65DE5CO.js";
+} from "./chunk-CTMEIRJQ.js";
 import {
   orgMembershipsPath,
   orgModeActive
-} from "./chunk-SDYIUXW7.js";
+} from "./chunk-XMQE5IBD.js";
 import {
   activeRecipientPubKeys,
   grantsPath,
   isGrantsMacPrimed,
   primeGrantsMacKey,
   warnActiveMonitoringOnce
-} from "./chunk-4MFPPHG4.js";
+} from "./chunk-KUJODN4N.js";
 import {
   assertGateAndGrantsColocated
 } from "./chunk-NPXIS2RY.js";
@@ -25,7 +25,7 @@ import {
 import {
   GHOST_BEHAVIOR_SQL,
   isGhostBehaviorRow
-} from "./chunk-HNVYH2WE.js";
+} from "./chunk-Q7YT7RGZ.js";
 import {
   isTransientDaemonTransportError,
   retryOnDaemonTransportError
@@ -36,17 +36,17 @@ import {
   encryptSyncBlob,
   initSyncCrypto,
   isSyncCryptoInitialized
-} from "./chunk-F63FRP7L.js";
+} from "./chunk-B4OZKTIS.js";
 import {
   getClient,
   isGenuineCorruptionError,
   loadEmployees,
   registerBinSymlinks,
   saveEmployees
-} from "./chunk-GAUMGWSQ.js";
+} from "./chunk-UYU25KCR.js";
 import {
   loadDeviceId
-} from "./chunk-GTW56AUB.js";
+} from "./chunk-VX7I5XT6.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -72,7 +72,7 @@ var _lastSealOrgMode = null;
 async function getSyncCipher() {
   if (_resolved) return _resolved;
   if (!orgModeActive()) {
-    const mod = await import("./founder-monitor-envelope-OYRYJZBS.js");
+    const mod = await import("./founder-monitor-envelope-KZCFNWMB.js");
     _monitoredWriter = mod.encryptMonitoredSyncBlob;
     _founderModuleLinked = true;
   }
@@ -1283,7 +1283,7 @@ async function cloudSync(config, options) {
           })
         };
         if (shouldUseCrdtMergeForCloudSync()) {
-          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-MHQ6XSMO.js");
+          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-MKLAGQ44.js");
           initCrdtDoc();
           importExistingMemories(
             pullResult.records.map((rec) => ({
@@ -1844,7 +1844,7 @@ async function cloudSync(config, options) {
     const artifactResult = { pushed: 0, frozen: false, remaining: 0 };
     if (!shouldSkip("artifacts")) {
       try {
-        const { flushArtifactBackups } = await import("./artifact-backup-FDU7UQ5Z.js");
+        const { flushArtifactBackups } = await import("./artifact-backup-VWQ6EYNO.js");
         const flushed = await flushArtifactBackups(cloudArtifactTransport(config));
         artifactResult.pushed = flushed.pushed;
         artifactResult.frozen = flushed.frozen;

package/dist/{chunk-ITV2CEFW.js → chunk-MBF7NXKP.js}

@@ -2,7 +2,7 @@ import {
   getClient,
   isCoordinatorName,
   loadEmployeesSync
-} from "./chunk-GAUMGWSQ.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/lib/steward-gate.ts
 import crypto from "crypto";

package/dist/{chunk-PSB3QGYL.js → chunk-MT3P3B2L.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-WCGNCH3Q.js";
 import {
   registerAllTools
-} from "./chunk-EZ2JLFDT.js";
+} from "./chunk-33D76SCE.js";
 
 // src/mcp/mcp-surface-hash.ts
 function computeMcpSurfaceHash() {

package/dist/{chunk-6G7CTQBF.js → chunk-MYGXI2UC.js}

@@ -1,13 +1,13 @@
 import {
   deactivateBehavior
-} from "./chunk-HNVYH2WE.js";
+} from "./chunk-Q7YT7RGZ.js";
 import {
   getActiveAgent
-} from "./chunk-C44UWID5.js";
+} from "./chunk-LGP67CBT.js";
 import {
   canCoordinate,
   getClient
-} from "./chunk-GAUMGWSQ.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/mcp/tools/deactivate-behavior.ts
 import { z } from "zod";
@@ -24,7 +24,7 @@ function registerDeactivateBehavior(server) {
     async ({ behavior_id }) => {
       const caller = getActiveAgent();
       try {
-        const { StewardGate } = await import("./steward-gate-2YQ6DOO3.js");
+        const { StewardGate } = await import("./steward-gate-BY7R6PJI.js");
         const steward = new StewardGate();
         const gateDecision = await steward.checkAuthority(caller.agentId || "unknown", "deactivate_behavior", behavior_id);
         if (!gateDecision.allowed) {