@askexenow/exe-os 0.9.403 → 0.9.405

package/dist/chunk-6QBBJJK2.js

@@ -0,0 +1,52 @@
+import {
+  loadConfigSync
+} from "./chunk-MMS2HBRT.js";
+
+// src/lib/support-admin-token.ts
+function resolveSupportAdminToken(config) {
+  return process.env.ASKEXE_SUPPORT_ADMIN_TOKEN || process.env.EXE_SUPPORT_ADMIN_TOKEN || config?.support?.adminToken || config?.support?.admin_token;
+}
+function supportAdminHeaders(config) {
+  const token = resolveSupportAdminToken(config);
+  return token ? { "x-askexe-admin-token": token } : {};
+}
+var SupportAdminTransportError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SupportAdminTransportError";
+  }
+};
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function isLoopbackHost(hostname) {
+  return LOOPBACK_HOSTNAMES.has(hostname);
+}
+function assertSecureTransport(url, opts) {
+  let parsed;
+  try {
+    parsed = typeof url === "string" ? new URL(url) : url;
+  } catch {
+    throw new SupportAdminTransportError(
+      `refusing to attach ${opts.tokenName}: target is not a valid absolute URL`
+    );
+  }
+  if (parsed.protocol === "https:") return parsed;
+  if (parsed.protocol === "http:" && isLoopbackHost(parsed.hostname)) return parsed;
+  throw new SupportAdminTransportError(
+    `refusing to send ${opts.tokenName} to a non-TLS origin (${parsed.protocol}//${parsed.host}) \u2014 credentials to this endpoint must travel over https:// (loopback http:// is allowed for local dev/tests only)`
+  );
+}
+function hasSupportAdminAccess(config) {
+  try {
+    return !!resolveSupportAdminToken(config ?? loadConfigSync());
+  } catch {
+    return false;
+  }
+}
+
+export {
+  resolveSupportAdminToken,
+  supportAdminHeaders,
+  SupportAdminTransportError,
+  assertSecureTransport,
+  hasSupportAdminAccess
+};

package/dist/{chunk-7ORLQ2W6.js → chunk-6XH6ETY6.js}

@@ -4,7 +4,7 @@ import {
 import {
   isValidX25519Recipient,
   pubKeyHash
-} from "./chunk-JS6OVVXQ.js";
+} from "./chunk-DLJSC6YA.js";
 
 // src/lib/monitor-grants.ts
 import crypto from "crypto";

package/dist/{chunk-D2OFHOQI.js → chunk-76HWKZMH.js}

@@ -1,10 +1,13 @@
+import {
+  IMessageAdapter
+} from "./chunk-2SRG3B3D.js";
 import {
   createCRMWebhookHandler,
   parseTwentyWebhook
-} from "./chunk-UES7OZXR.js";
+} from "./chunk-KPCUD5A3.js";
 import {
   WhatsAppAdapter
-} from "./chunk-I7AM3MZX.js";
+} from "./chunk-JP6GZTZA.js";
 import {
   SignalAdapter
 } from "./chunk-RJT7H2KR.js";
@@ -17,9 +20,6 @@ import {
 import {
   SlackAdapter
 } from "./chunk-ORCCI2VV.js";
-import {
-  IMessageAdapter
-} from "./chunk-2SRG3B3D.js";
 import {
   BotRegistry,
   BotRuntime,
@@ -42,7 +42,7 @@ import {
   retryWithBackoff,
   routeMessage,
   validateGatewayConfig
-} from "./chunk-3YSEEVK7.js";
+} from "./chunk-NG22OOND.js";
 import {
   OllamaProvider
 } from "./chunk-FWFFZGSC.js";

package/dist/{chunk-S5XIAI7Q.js → chunk-7UXI2DMI.js}

@@ -1,21 +1,21 @@
+import {
+  isCrdtSyncEnabled
+} from "./chunk-NXBLILKG.js";
 import {
   compress,
   decompress
 } from "./chunk-NEHOQ3P2.js";
-import {
-  isCrdtSyncEnabled
-} from "./chunk-D43SJR5H.js";
 import {
   orgMembershipsPath,
   orgModeActive
-} from "./chunk-QEEOPPL6.js";
+} from "./chunk-4XFVEIPV.js";
 import {
   activeRecipientPubKeys,
   grantsPath,
   isGrantsMacPrimed,
   primeGrantsMacKey,
   warnActiveMonitoringOnce
-} from "./chunk-7ORLQ2W6.js";
+} from "./chunk-6XH6ETY6.js";
 import {
   assertGateAndGrantsColocated
 } from "./chunk-NPXIS2RY.js";
@@ -25,28 +25,28 @@ import {
 import {
   GHOST_BEHAVIOR_SQL,
   isGhostBehaviorRow
-} from "./chunk-UITMGMHM.js";
+} from "./chunk-L3L4KCBJ.js";
 import {
   isTransientDaemonTransportError,
   retryOnDaemonTransportError
-} from "./chunk-W5BFPFVY.js";
+} from "./chunk-ZD5TZZXU.js";
 import {
   decryptSyncBlob,
   decryptSyncBlobDetailed,
   encryptSyncBlob,
   initSyncCrypto,
   isSyncCryptoInitialized
-} from "./chunk-PW4IOFYT.js";
+} from "./chunk-OV5RG5UT.js";
 import {
   getClient,
   isGenuineCorruptionError,
   loadEmployees,
   registerBinSymlinks,
   saveEmployees
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 import {
   loadDeviceId
-} from "./chunk-3EZ7A7HL.js";
+} from "./chunk-OAYFVKNM.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -72,7 +72,7 @@ var _lastSealOrgMode = null;
 async function getSyncCipher() {
   if (_resolved) return _resolved;
   if (!orgModeActive()) {
-    const mod = await import("./founder-monitor-envelope-EVNV3BYO.js");
+    const mod = await import("./founder-monitor-envelope-56PUEATO.js");
     _monitoredWriter = mod.encryptMonitoredSyncBlob;
     _founderModuleLinked = true;
   }
@@ -1283,7 +1283,7 @@ async function cloudSync(config, options) {
           })
         };
         if (shouldUseCrdtMergeForCloudSync()) {
-          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-GDCZHVKE.js");
+          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-ZLD5EI2T.js");
           initCrdtDoc();
           importExistingMemories(
             pullResult.records.map((rec) => ({
@@ -1844,7 +1844,7 @@ async function cloudSync(config, options) {
     const artifactResult = { pushed: 0, frozen: false, remaining: 0 };
     if (!shouldSkip("artifacts")) {
       try {
-        const { flushArtifactBackups } = await import("./artifact-backup-TTERTDB4.js");
+        const { flushArtifactBackups } = await import("./artifact-backup-GYNBR2I6.js");
         const flushed = await flushArtifactBackups(cloudArtifactTransport(config));
         artifactResult.pushed = flushed.pushed;
         artifactResult.frozen = flushed.frozen;

package/dist/{chunk-DGUAAY5I.js → chunk-A2TRWGTX.js}

@@ -1,15 +1,15 @@
 import {
   derivePartnerSealIdentityFromMaster
-} from "./chunk-CW2IXFLH.js";
+} from "./chunk-QILKDHJ7.js";
 import {
   derivePartnerSignIdentityFromMaster,
   displayFingerprint,
   ed25519PrivateKeyFromSeed,
   ed25519PublicKeyFromRaw
-} from "./chunk-BFZ5PYWN.js";
+} from "./chunk-B42HMZSQ.js";
 import {
   getMasterKey
-} from "./chunk-FO7PVURG.js";
+} from "./chunk-ZHHGFNTZ.js";
 
 // src/lib/org-key-epoch.ts
 import crypto, { sign as edSign, verify as edVerify } from "crypto";

package/dist/{chunk-DBRQDUQZ.js → chunk-A5TICGUL.js}

@@ -1,12 +1,12 @@
 import {
   sessionScopeFilter
-} from "./chunk-NPPAHWZC.js";
+} from "./chunk-56XINHPT.js";
 import {
   leaseExpiryIso
 } from "./chunk-E23LNUWJ.js";
 import {
   getProjectName
-} from "./chunk-5ZU62OI3.js";
+} from "./chunk-SD5PWIUP.js";
 
 // src/lib/subagent-observability.ts
 var MAX_RESULT_DIGEST_CHARS = 200;

package/dist/{chunk-6K32YPMC.js → chunk-A5YNPQBD.js}

@@ -5,26 +5,26 @@ import {
   behaviorTruncationNotice,
   fetchInjectableBehaviors,
   selectInjectedBehaviors
-} from "./chunk-GQE6GEDA.js";
+} from "./chunk-APOS4EIO.js";
 import {
   countActiveBehaviors,
   listBehaviors
-} from "./chunk-UITMGMHM.js";
+} from "./chunk-L3L4KCBJ.js";
 import {
   lightweightSearch
-} from "./chunk-PBWXFPM2.js";
+} from "./chunk-NSJUD5BW.js";
 import {
   getCurrentSessionScope
-} from "./chunk-NPPAHWZC.js";
+} from "./chunk-56XINHPT.js";
+import {
+  getProjectName
+} from "./chunk-SD5PWIUP.js";
 import {
   getSessionKey
 } from "./chunk-CVYC6DUW.js";
-import {
-  getProjectName
-} from "./chunk-5ZU62OI3.js";
 import {
   getClient
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 
 // src/lib/session-summary.ts
 var MAX_CHARS = 800;
@@ -341,7 +341,7 @@ async function activeBehaviorBrief(agentId, projectName) {
   const text = renderBehaviorSection(rendered, counts);
   if (rendered.length > 0) {
     try {
-      const { recordBehaviorsConsulted } = await import("./skill-usage-KHQTFZQK.js");
+      const { recordBehaviorsConsulted } = await import("./skill-usage-YDCLNH63.js");
       void recordBehaviorsConsulted(rendered.map((b) => b.id));
     } catch {
     }

package/dist/{chunk-Z2NFL2OI.js → chunk-AAAJKHJM.js}

@@ -3,25 +3,25 @@ import {
 } from "./chunk-W4H2MZAS.js";
 import {
   resolvePartnerIdentities
-} from "./chunk-KGCMJ35Y.js";
+} from "./chunk-HC7GQZLN.js";
 import {
   OrgKeyPinConflictError,
   orgKeyPinConfirmation,
   pinOrgKey,
   readOrgKeyPin
-} from "./chunk-D7KYFEV2.js";
+} from "./chunk-QEGSRMGV.js";
 import {
   displayFingerprint,
   ed25519PrivateKeyFromSeed,
   signKeyFingerprint
-} from "./chunk-BFZ5PYWN.js";
+} from "./chunk-B42HMZSQ.js";
 import {
   establishOrgMode,
   upsertOrgMembership
-} from "./chunk-QEEOPPL6.js";
+} from "./chunk-4XFVEIPV.js";
 import {
   isValidX25519Recipient
-} from "./chunk-JS6OVVXQ.js";
+} from "./chunk-DLJSC6YA.js";
 
 // src/lib/org-join.ts
 import { createHash, sign } from "crypto";

package/dist/{chunk-GQE6GEDA.js → chunk-APOS4EIO.js}

@@ -1,9 +1,9 @@
 import {
   listBehaviors
-} from "./chunk-UITMGMHM.js";
+} from "./chunk-L3L4KCBJ.js";
 import {
   incrementSkillUsage
-} from "./chunk-YBTBVSU5.js";
+} from "./chunk-PQVIARTA.js";
 
 // src/lib/behavior-injection.ts
 import { appendFile } from "fs/promises";
@@ -349,7 +349,7 @@ async function injectBehaviors(opts) {
       `[behavior-injection] ${opts.assignedTo} <- ${selected.length}/${behaviors.length} behaviour(s) for "${opts.title.slice(0, 60)}": ` + selected.map((s) => `${s.behavior.id.slice(0, 8)}(${s.score.toFixed(2)})`).join(" ") + "\n"
     );
     await incrementSkillUsage(selected.map((s) => s.behavior));
-    const { recordBehaviorsConsulted } = await import("./skill-usage-KHQTFZQK.js");
+    const { recordBehaviorsConsulted } = await import("./skill-usage-YDCLNH63.js");
     await recordBehaviorsConsulted(selected.map((s) => s.behavior.id));
     return selected;
   } catch (err) {

package/dist/{chunk-CZ6ZC4DW.js → chunk-AQPS7W6G.js}

@@ -7,10 +7,10 @@ import {
 } from "./chunk-S2YTU74T.js";
 import {
   createTask
-} from "./chunk-S2TY4TBR.js";
+} from "./chunk-VWSJP5PY.js";
 import {
   getActiveAgent
-} from "./chunk-DG62HNWK.js";
+} from "./chunk-LCC7SS6F.js";
 import {
   deriveTaskIdempotencyKey,
   ensureEmployeeAsync,
@@ -18,13 +18,13 @@ import {
   isExeSession,
   logTaskDispatch,
   resolveExeSession
-} from "./chunk-NPPAHWZC.js";
+} from "./chunk-56XINHPT.js";
 import {
   getPaneCwdAsync
 } from "./chunk-6L4VIYLZ.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-R2URBZJ5.js";
+} from "./chunk-MKO45WBR.js";
 import {
   releaseDispatchClaim,
   tryAcquireDispatchClaim,
@@ -37,7 +37,7 @@ import {
 } from "./chunk-GWAN2BDB.js";
 import {
   getLicenseSync
-} from "./chunk-2A65MF6T.js";
+} from "./chunk-3RQHJYRK.js";
 import {
   isValidSessionScope
 } from "./chunk-BTSWFMEH.js";
@@ -46,7 +46,7 @@ import {
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -891,7 +891,7 @@ Idempotent no-op (existing task unchanged; no execution side effects)`
       let claimWarning = "";
       const claimRefRaw = (work_ref ?? "").trim();
       try {
-        const { findConflicts, findConflictsInText, describeConflict, normalizeTarget } = await import("./work-claims-WHHKVJS2.js");
+        const { findConflicts, findConflictsInText, describeConflict, normalizeTarget } = await import("./work-claims-GY7TTKUA.js");
         const conflicts = claimRefRaw ? await findConflicts(
           [normalizeTarget({ kind: "work_ref", value: claimRefRaw })],
           callerRoot
@@ -958,7 +958,7 @@ Nothing was created or dispatched. Either pick different work, or \u2014 if that
         });
         if (claimRefRaw) {
           try {
-            const { acquireClaim } = await import("./work-claims-WHHKVJS2.js");
+            const { acquireClaim } = await import("./work-claims-GY7TTKUA.js");
             const acquired = await acquireClaim({
               targets: [{ kind: "work_ref", value: claimRefRaw }],
               holderSession: callerRoot,
@@ -1154,7 +1154,7 @@ Note: ${spawnOverrideNoopNotice(ignoredSpawnOverrides)}`;
       }
       if (claimRefRaw) {
         try {
-          const { acquireClaim } = await import("./work-claims-WHHKVJS2.js");
+          const { acquireClaim } = await import("./work-claims-GY7TTKUA.js");
           const acquired = await acquireClaim({
             targets: [{ kind: "work_ref", value: claimRefRaw }],
             holderSession: callerRoot,
@@ -1207,7 +1207,7 @@ Claimed ${claimRefRaw} for session ${callerRoot} (claim_group ${acquired.claimGr
           session_scope: sessionScope,
           created_at: (/* @__PURE__ */ new Date()).toISOString()
         }), "utf-8");
-        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-QVAWYGLB.js");
+        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-CV72DYKD.js");
         recordOE({
           eventType: "signal.created",
           source: "create-task.mcp",
@@ -1240,7 +1240,7 @@ Claimed ${claimRefRaw} for session ${callerRoot} (claim_group ${acquired.claimGr
             let projectConflictOpts = {};
             try {
               const { getClient } = await import("./lib/database.js");
-              const { sessionScopeFilter } = await import("./task-scope-6GDIWCS4.js");
+              const { sessionScopeFilter } = await import("./task-scope-M3GVO3IK.js");
               const client = getClient();
               const scope = sessionScopeFilter(task.sessionScope || callerRoot || exeSession || null);
               const existing = await client.execute({

package/dist/{chunk-3XQY3YU6.js → chunk-AZIJQ6IM.js}

@@ -1,7 +1,7 @@
 import {
   orgMembershipsPath,
   readActiveOrgMemberships
-} from "./chunk-QEEOPPL6.js";
+} from "./chunk-4XFVEIPV.js";
 import {
   resolveExeDataDir
 } from "./chunk-NPXIS2RY.js";
@@ -240,7 +240,7 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
     consentCleared = true;
     notes.push(`No standing consent policies existed for ${orgId}; there was nothing to disarm.`);
   } else try {
-    const { clearStandingPolicies } = await import("./org-consent-policy-V5R2WCUF.js");
+    const { clearStandingPolicies } = await import("./org-consent-policy-QQYN2HFH.js");
     await clearStandingPolicies(orgId);
     consentCleared = true;
   } catch (err) {
@@ -259,7 +259,7 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
   }
   let pollerStopped = false;
   try {
-    const { stopOrgPartnerPollerFor } = await import("./org-partner-runtime-53YUNP6N.js");
+    const { stopOrgPartnerPollerFor } = await import("./org-partner-runtime-MBP7JUAM.js");
     pollerStopped = await stopOrgPartnerPollerFor(orgId);
   } catch (err) {
     failures.push(
@@ -268,7 +268,7 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
   }
   let seqFloor = 0;
   try {
-    const { preserveOutboundSeqFloor } = await import("./task-request-inbox-6PCUSLW6.js");
+    const { preserveOutboundSeqFloor } = await import("./task-request-inbox-CJF4XNSY.js");
     seqFloor = preserveOutboundSeqFloor(orgId);
     if (seqFloor > 0) {
       notes.push(

package/dist/{chunk-BFZ5PYWN.js → chunk-B42HMZSQ.js}

@@ -1,6 +1,6 @@
 import {
   getMasterKey
-} from "./chunk-FO7PVURG.js";
+} from "./chunk-ZHHGFNTZ.js";
 
 // src/lib/partner-sign-identity.ts
 import crypto from "crypto";

package/dist/{chunk-3VNMG63S.js → chunk-B4LS4IPJ.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 import {
   loadConfigSync
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-QFQHMBLP.js → chunk-BCOGIX5I.js}

@@ -1,7 +1,8 @@
 import {
+  assertSecureTransport,
   resolveSupportAdminToken,
   supportAdminHeaders
-} from "./chunk-2XZ6X3PJ.js";
+} from "./chunk-6QBBJJK2.js";
 import {
   describeUpstreamFailure,
   sanitizeUpstreamId,
@@ -10,7 +11,7 @@ import {
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-3EZ7A7HL.js";
+} from "./chunk-OAYFVKNM.js";
 import {
   loadConfig
 } from "./chunk-MMS2HBRT.js";
@@ -35,10 +36,6 @@ async function adminEndpoint() {
   const base = process.env.ASKEXE_SUPPORT_ADMIN_ENDPOINT || support?.adminEndpoint || support?.admin_endpoint || DEFAULT_ADMIN_ENDPOINT;
   return base.replace(/\/+$/, "");
 }
-async function hasSupportAdminAccess() {
-  const config = await loadConfig();
-  return !!resolveSupportAdminToken(config);
-}
 async function adminToken() {
   const config = await loadConfig();
   const token = resolveSupportAdminToken(config);
@@ -46,11 +43,12 @@ async function adminToken() {
   return token;
 }
 async function adminRequestJson(path, init, opts) {
-  const token = await adminToken();
   const url = opts?.absolute ? path : `${await adminEndpoint()}${path}`;
+  const parsed = assertSecureTransport(url, { tokenName: "AskExe support admin token" });
+  const token = await adminToken();
   let res;
   try {
-    res = await fetch(url, {
+    res = await fetch(parsed, {
       ...init,
       headers: {
         "content-type": "application/json",
@@ -150,10 +148,7 @@ async function createAggregateBug(input) {
   const endpoint = config.support?.bugReportEndpoint || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : DEFAULT_OWNER_ENDPOINT);
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
-  const parsed = new URL(endpoint);
-  if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
-    throw new SupportBugActionError("insecure endpoint rejected");
-  }
+  const parsed = assertSecureTransport(endpoint, { tokenName: "license key / admin token" });
   const body = sanitizedUpstreamBody(
     {
       title: input.title,
@@ -190,7 +185,6 @@ async function createAggregateBug(input) {
 
 export {
   SupportBugActionError,
-  hasSupportAdminAccess,
   listBugReportsByStatus,
   triageBugToTriaged,
   addBugComment,

package/dist/{chunk-RHJUKL7R.js → chunk-BPNPJVYP.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-ED5RRYMF.js";
+} from "./chunk-7WYV32ZH.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-ODWRXWVB.js → chunk-BU4NQU5R.js}

@@ -265,7 +265,7 @@ async function persistMemoryBatch(client, rows) {
   }
   const hygieneIds = inserted.filter((row) => row.supersedes_id).map((row) => row.id);
   if (hygieneIds.length > 0) {
-    const { scheduleSupersessionHygiene } = await import("./memory-maintenance-HVCG6SVB.js");
+    const { scheduleSupersessionHygiene } = await import("./memory-maintenance-ROT5N576.js");
     scheduleSupersessionHygiene(hygieneIds);
   }
   return { outcomes, inserted };