@askexenow/exe-os 0.9.403 → 0.9.405

package/dist/{chunk-S5NTWEDW.js → chunk-LGTGY32U.js}

@@ -1,13 +1,13 @@
 import {
   buildSystemStateMemoryTypeExclusion
-} from "./chunk-W5RKBGDL.js";
+} from "./chunk-MXEEMTCV.js";
 import {
   sessionScopeFilter
-} from "./chunk-NPPAHWZC.js";
+} from "./chunk-56XINHPT.js";
 import {
   getClient,
   getIdentity
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 import {
   getEmotionalBaseline
 } from "./chunk-WAAGVFFN.js";
@@ -646,7 +646,7 @@ var DreamingEngine = class {
     }
     let overdueProspective = [];
     try {
-      const { getOverdueProspective, completeProspective } = await import("./prospective-memory-EKUKPMNN.js");
+      const { getOverdueProspective, completeProspective } = await import("./prospective-memory-KDW7MLF6.js");
       const overdue = await getOverdueProspective(agentId);
       overdueProspective = overdue.map((o) => ({
         id: o.id,

package/dist/{chunk-N4FE3XCP.js → chunk-LRRPSQ25.js}

@@ -19,7 +19,7 @@ import {
 } from "./chunk-RT57D7C4.js";
 import {
   loadLicense
-} from "./chunk-3EZ7A7HL.js";
+} from "./chunk-OAYFVKNM.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync as spawnSync2 } from "child_process";

package/dist/{chunk-PTRXEJVT.js → chunk-LZGYRZAP.js}

@@ -1,13 +1,13 @@
 import {
   deactivateBehavior
-} from "./chunk-UITMGMHM.js";
+} from "./chunk-L3L4KCBJ.js";
 import {
   getActiveAgent
-} from "./chunk-DG62HNWK.js";
+} from "./chunk-LCC7SS6F.js";
 import {
   canCoordinate,
   getClient
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 
 // src/mcp/tools/deactivate-behavior.ts
 import { z } from "zod";
@@ -24,7 +24,7 @@ function registerDeactivateBehavior(server) {
     async ({ behavior_id }) => {
       const caller = getActiveAgent();
       try {
-        const { StewardGate } = await import("./steward-gate-HW7XVOXA.js");
+        const { StewardGate } = await import("./steward-gate-AICO7WO2.js");
         const steward = new StewardGate();
         const gateDecision = await steward.checkAuthority(caller.agentId || "unknown", "deactivate_behavior", behavior_id);
         if (!gateDecision.allowed) {

package/dist/{chunk-65MRCM5B.js → chunk-LZX43KPR.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-R2URBZJ5.js → chunk-MKO45WBR.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 
 // src/lib/orchestration-events.ts
 import crypto from "crypto";

package/dist/{chunk-XUICFN7R.js → chunk-MMQH7AM7.js}

@@ -1,10 +1,10 @@
 import {
   embed
-} from "./chunk-2DV3TKOH.js";
+} from "./chunk-Q3GMM6I7.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-W5RKBGDL.js";
+} from "./chunk-MXEEMTCV.js";
 import {
   SUPPORT_PRODUCTS,
   isWellFormedCommit,

package/dist/{chunk-UFB3PDAU.js → chunk-MRQIIVHK.js}

@@ -1,6 +1,6 @@
 import {
   getGlobalProceduresBlock
-} from "./chunk-OWA6WN44.js";
+} from "./chunk-YROE2BJ6.js";
 import {
   writePlatformReferenceFile
 } from "./chunk-IZWMWJZT.js";

package/dist/{chunk-W5RKBGDL.js → chunk-MXEEMTCV.js}

@@ -1,6 +1,6 @@
 import {
   WORK_STATE_HEARTBEAT_TOOL
-} from "./chunk-MLVN7D6V.js";
+} from "./chunk-KVZB65B5.js";
 import {
   extractKeywords,
   keywordsToString
@@ -11,7 +11,7 @@ import {
 import {
   findScopedDuplicate,
   governMemoryRecord
-} from "./chunk-HTAWJ7LY.js";
+} from "./chunk-4RFLBGOW.js";
 import {
   orgBus
 } from "./chunk-MP2AFCGL.js";
@@ -22,12 +22,12 @@ import {
   initPostgresOnlyDatabase,
   initTurso,
   isDaemonRoutingActive
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 import {
   buildMemoryInsert,
   persistMemoryBatch,
   readMemoryWriteOutcome
-} from "./chunk-ODWRXWVB.js";
+} from "./chunk-BU4NQU5R.js";
 import {
   memoryWriteScope,
   sameMemoryWriteScope
@@ -43,7 +43,7 @@ import {
 } from "./chunk-C7GHNJPW.js";
 import {
   getMasterKey
-} from "./chunk-FO7PVURG.js";
+} from "./chunk-ZHHGFNTZ.js";
 import {
   loadConfig
 } from "./chunk-MMS2HBRT.js";
@@ -93,7 +93,7 @@ function recordShardFailure(project, error) {
       `[store] Shard circuit OPEN for "${project}" after ${state.failures} consecutive failures. Will retry in ${SHARD_CB_COOLDOWN_MS / 6e4}min. Last error: ${error}
 `
     );
-    void import("./orchestration-events-QVAWYGLB.js").then(({ recordOrchestrationEventBestEffort }) => {
+    void import("./orchestration-events-CV72DYKD.js").then(({ recordOrchestrationEventBestEffort }) => {
       recordOrchestrationEventBestEffort({
         eventType: "shard.circuit_open",
         source: "store.recordShardFailure",
@@ -185,7 +185,7 @@ async function initStore(options) {
   if (!options?.lightweight) {
     try {
       if (process.env.EXE_DISABLE_SHARDING !== "1") {
-        const { initShardManager } = await import("./shard-manager-KUKX5RSA.js");
+        const { initShardManager } = await import("./shard-manager-TKAQSRYN.js");
         initShardManager(hexKey);
       }
     } catch (e) {
@@ -198,7 +198,7 @@ async function initStore(options) {
     );
     _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
     try {
-      const { loadGlobalProcedures } = await import("./global-procedures-U6R2CF3U.js");
+      const { loadGlobalProcedures } = await import("./global-procedures-NJ7UXIBT.js");
       await loadGlobalProcedures();
     } catch (e) {
       logStoreWarn("catch", e);
@@ -319,7 +319,7 @@ async function writeMemory(record) {
     founder_id: record.founder_id ?? null
   };
   try {
-    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-DDX3WRP2.js");
+    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-WL4GVB6K.js");
     const poisonResult = await checkMemoryPoisoning({
       memoryId: dbRow.id,
       vector: Array.isArray(dbRow.vector) ? dbRow.vector : void 0,
@@ -378,19 +378,19 @@ async function flushPendingBatch() {
   }
   if (eligibleBatch.length > 0) {
     try {
-      const { insertMemoryCardsForBatch } = await import("./memory-cards-UEZ2KEJP.js");
+      const { insertMemoryCardsForBatch } = await import("./memory-cards-DR6VSUXF.js");
       await insertMemoryCardsForBatch(eligibleBatch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { insertOntologyForBatch } = await import("./agentic-ontology-6JNGXKZS.js");
+      const { insertOntologyForBatch } = await import("./agentic-ontology-7G44A5LE.js");
       await insertOntologyForBatch(eligibleBatch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { extractGraphForBatch } = await import("./memory-graph-extractor-TGMPLDCD.js");
+      const { extractGraphForBatch } = await import("./memory-graph-extractor-T4IT4I65.js");
       await extractGraphForBatch(eligibleBatch);
     } catch (e) {
       logStoreWarn("catch", e);
@@ -398,7 +398,7 @@ async function flushPendingBatch() {
   }
   _lastFlushShardFailures = [];
   try {
-    const { isShardingEnabled, getReadyShardClient } = await import("./shard-manager-KUKX5RSA.js");
+    const { isShardingEnabled, getReadyShardClient } = await import("./shard-manager-TKAQSRYN.js");
     if (process.env.EXE_DISABLE_SHARDING !== "1" && isShardingEnabled()) {
       const byProject = /* @__PURE__ */ new Map();
       let skippedUnknown = 0;
@@ -577,7 +577,7 @@ async function searchMemories(queryVector, agentId, options) {
   let client;
   let isMainDb = true;
   try {
-    const { isShardingEnabled, shardExists, getReadyShardClient } = await import("./shard-manager-KUKX5RSA.js");
+    const { isShardingEnabled, shardExists, getReadyShardClient } = await import("./shard-manager-TKAQSRYN.js");
     if (!options?.strictSessionScope && isShardingEnabled() && options?.projectName && shardExists(options.projectName)) {
       client = await getReadyShardClient(options.projectName);
       isMainDb = false;
@@ -616,7 +616,7 @@ async function searchMemories(queryVector, agentId, options) {
     args.push(activeEmbeddingModel);
   }
   try {
-    const { founderScopeFilter } = await import("./founder-context-Y55QMPQJ.js");
+    const { founderScopeFilter } = await import("./founder-context-3QW7IIRX.js");
     const founderFilter = founderScopeFilter(options?.founderId);
     sql += founderFilter.sql;
     args.push(...founderFilter.args.filter((a) => a !== null));
@@ -700,7 +700,7 @@ async function searchMemories(queryVector, agentId, options) {
     source_type: row.source_type ?? null,
     strength: row.strength ?? 1
   }));
-  const { filterWikiRecallResults } = await import("./wiki-acl-ZBVZXADA.js");
+  const { filterWikiRecallResults } = await import("./wiki-acl-B5CI5FVD.js");
   return filterWikiRecallResults(mapped, agentId);
 }
 async function attachDocumentMetadata(records) {

package/dist/{chunk-M7X2HTAE.js → chunk-N4JBGOHA.js}

@@ -1,13 +1,23 @@
+import {
+  collectDistinctHookRoots,
+  compareAllHookRoots,
+  compareRuntimeIdentity,
+  formatRuntimeDriftWarning,
+  readBuildIdentity
+} from "./chunk-C4IHTLDE.js";
 import {
   checkCpuStealSync
 } from "./chunk-SSC7EKY2.js";
+import {
+  computeDegradations
+} from "./chunk-DQUGV7TQ.js";
 import {
   inventoryLocalSecretResidue,
   redactResiduePathForDisplay
 } from "./chunk-PYS43F2X.js";
 import {
-  computeDegradations
-} from "./chunk-FCIJBJTL.js";
+  auditRegisteredHookLiveness
+} from "./chunk-ZPPPHVSU.js";
 import {
   NO_DB_INTEGRITY_EVENTS
 } from "./chunk-5TAJDCZY.js";
@@ -18,25 +28,26 @@ import {
 } from "./chunk-CBPNZFSU.js";
 import {
   DAEMON_DRIFT_FAIL_THRESHOLD,
+  checkoutRootFromScript,
   measureDaemonDrift,
   resolveRunningDaemonScript
-} from "./chunk-PMVVUIHH.js";
+} from "./chunk-GSOKSUBB.js";
 import {
   readMcpHttpEvents,
   summarizeMcpTransport
 } from "./chunk-ZM6EZAVY.js";
-import {
-  mcpHttpPort
-} from "./chunk-5XEU5LCN.js";
 import {
   redactSecrets
 } from "./chunk-T4IDLAZM.js";
+import {
+  mcpHttpPort
+} from "./chunk-ID3KTUXS.js";
 import {
   isWithin
 } from "./chunk-YRUZK2QA.js";
 import {
   inspectKeyCustodySync
-} from "./chunk-FO7PVURG.js";
+} from "./chunk-ZHHGFNTZ.js";
 import {
   checkSingleGotrueInstance
 } from "./chunk-FTZET5YX.js";
@@ -301,6 +312,48 @@ function checkDaemonDrift(pkgRoot, opts) {
     detail: `Daemon build is ${result.behind} commits behind origin/main (HEAD ${result.head.slice(0, 8)})${via}${ahead} \u2014 within the \u2264${DAEMON_DRIFT_FAIL_THRESHOLD} tolerance for normal merge\u2192deploy lag.`
   }];
 }
+function formatDriftCheck(name, result) {
+  if (result.status === "unknown" && result.unverified) {
+    return {
+      name,
+      pass: true,
+      detail: `\u26A0\uFE0F UNVERIFIED: version ${result.running?.version} matches, but the build commit is unstamped on at least one side \u2014 cannot confirm this is the same build`
+    };
+  }
+  if (result.status === "unknown") {
+    return { name, pass: true, detail: `not measured: ${result.reason}` };
+  }
+  if (result.status === "drift") {
+    return { name, pass: false, detail: formatRuntimeDriftWarning(result) ?? "drift detected" };
+  }
+  const r = result.running;
+  return {
+    name,
+    pass: true,
+    detail: r ? `matches installed package (${r.version}${r.commit !== "unknown" ? `, ${r.commit}` : ""})` : "matches installed package"
+  };
+}
+function checkRuntimeDrift(pkgRoot, opts) {
+  const installed = readBuildIdentity(pkgRoot);
+  if (!installed) {
+    return [{
+      name: "exed/runtime-drift",
+      pass: false,
+      detail: `UNKNOWN \u2014 could not read installed package.json at ${pkgRoot}`
+    }];
+  }
+  const hookReport = auditRegisteredHookLiveness({ home: opts?.home });
+  const hookRoots = collectDistinctHookRoots(hookReport.probes);
+  const hookResults = compareAllHookRoots(hookRoots, installed);
+  const hookChecks = hookResults.map(
+    (result, i) => formatDriftCheck(hookResults.length === 1 ? "exed/runtime-drift-hooks" : `exed/runtime-drift-hooks[${i + 1}]`, result)
+  );
+  const daemonScript = resolveRunningDaemonScript(opts?.pidFile ?? path2.join(EXE_AI_DIR, "exed.pid"));
+  const daemonRoot = daemonScript ? checkoutRootFromScript(daemonScript) : null;
+  const daemonRunning = daemonRoot ? readBuildIdentity(daemonRoot) : null;
+  const daemonResult = compareRuntimeIdentity("daemon", daemonRunning, installed);
+  return [...hookChecks, formatDriftCheck("exed/runtime-drift-daemon", daemonResult)];
+}
 function checkTaskSystem(pkgRoot) {
   const results = [];
   const scannerPath = path2.join(pkgRoot, "dist", "bin", "scan-tasks.js");
@@ -861,6 +914,7 @@ function runHealthCheck() {
     ...checkBuildIntegrity(pkgRoot),
     ...checkEmbedPipeline(pkgRoot),
     ...checkDaemonDrift(pkgRoot),
+    ...checkRuntimeDrift(pkgRoot),
     ...checkTaskSystem(pkgRoot),
     ...checkWorkerSpawning(pkgRoot),
     ...checkMcpTransport(),
@@ -901,6 +955,7 @@ export {
   compareSemver2 as compareSemver,
   detectAutoupdaterVar2 as detectAutoupdaterVar,
   checkDaemonDrift,
+  checkRuntimeDrift,
   checkMcpTransport,
   checkClaudeCodeInstall,
   checkCpuSteal,

package/dist/{chunk-3YSEEVK7.js → chunk-NG22OOND.js}

@@ -2,10 +2,10 @@ import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-5JR52IYQ.js";
+} from "./chunk-DEQJVVAU.js";
 import {
   ingest
-} from "./chunk-AXIZC2RH.js";
+} from "./chunk-QADGKJAC.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";

package/dist/{chunk-PBWXFPM2.js → chunk-NSJUD5BW.js}

@@ -1,12 +1,12 @@
-import {
-  filterWikiRecallResults
-} from "./chunk-BXYHVTTI.js";
 import {
   buildFtsMatch,
   buildFtsMatchWithModifiers,
   extractFtsModifiers,
   tokenizeForFts
 } from "./chunk-VMHZSZQJ.js";
+import {
+  filterWikiRecallResults
+} from "./chunk-DJKUA73M.js";
 import {
   attachDocumentMetadata,
   buildRawVisibilityFilter,
@@ -16,7 +16,7 @@ import {
   buildVisibilityTierFilter,
   buildWikiScopeFilter,
   searchMemories
-} from "./chunk-W5RKBGDL.js";
+} from "./chunk-MXEEMTCV.js";
 import {
   blobToVector
 } from "./chunk-OTVEIJUQ.js";
@@ -35,7 +35,7 @@ import {
   getClient,
   isFtsShadowCorruptionMessage,
   repairFtsTable
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 
 // src/lib/memory-reads.ts
 import crypto from "crypto";
@@ -597,7 +597,7 @@ async function hybridSearch(queryText, agentId, options) {
   let rerankerAvailable = false;
   if (process.env.EXE_IS_DAEMON === "1") {
     try {
-      const { isRerankerAvailable } = await import("./reranker-5SXUQWBY.js");
+      const { isRerankerAvailable } = await import("./reranker-YBVXW2ZZ.js");
       rerankerAvailable = isRerankerAvailable();
     } catch {
     }
@@ -637,7 +637,7 @@ ${hydeDoc}`;
   if (config.fileGrepEnabled === true && !process.env.VITEST && !onFailOpenHotPath) {
     try {
       if (process.env.EXE_IS_DAEMON !== "1") {
-        const { getProjectName } = await import("./project-name-5UPYPNUV.js");
+        const { getProjectName } = await import("./project-name-FUSV5KYR.js");
         const projectRoot = process.cwd();
         const projectName = getProjectName(projectRoot);
         if (projectName && projectName !== "tmp") {
@@ -680,7 +680,7 @@ ${hydeDoc}`;
     runGraphArm(graphSearch(effectiveQuery, agentId, fetchOptions, Math.min(fetchLimit, 20))),
     includeStructuredCards ? (async () => {
       try {
-        const { searchMemoryCards } = await import("./memory-cards-UEZ2KEJP.js");
+        const { searchMemoryCards } = await import("./memory-cards-DR6VSUXF.js");
         return await searchMemoryCards(effectiveQuery, agentId, fetchOptions);
       } catch {
         return [];
@@ -689,7 +689,7 @@ ${hydeDoc}`;
     // Reflection insights: patterns, contradictions, summaries across sessions
     includeStructuredCards ? (async () => {
       try {
-        const { searchReflections } = await import("./memory-reflection-KXFTP5YS.js");
+        const { searchReflections } = await import("./memory-reflection-SR657DTL.js");
         const insights = await searchReflections(effectiveQuery, agentId, 5, fetchOptions);
         return insights.map((ins) => ({
           id: ins.id,
@@ -801,7 +801,7 @@ ${hydeDoc}`;
   let entityBoostRan = false;
   if (merged.length > 0) {
     try {
-      const { applyEntityBoost } = await import("./entity-boost-JJKKTYHK.js");
+      const { applyEntityBoost } = await import("./entity-boost-EIE76PER.js");
       const boosted = await applyEntityBoost(merged, effectiveQuery, getClient());
       merged = boosted.results;
       graphContextMap = boosted.graphContext;
@@ -828,7 +828,7 @@ ${hydeDoc}`;
     try {
       let rerankedRecords;
       if (graphContextMap.size > 0) {
-        const { rerankWithContext } = await import("./reranker-5SXUQWBY.js");
+        const { rerankWithContext } = await import("./reranker-YBVXW2ZZ.js");
         const candidates = merged.map((m) => ({
           text: m.raw_text,
           context: graphContextMap.get(m.id)
@@ -836,7 +836,7 @@ ${hydeDoc}`;
         const scored = await rerankWithContext(effectiveQuery, candidates, rerankReturnLimit);
         rerankedRecords = scored.map((s) => merged[s.index]);
       } else {
-        const { rerank } = await import("./reranker-5SXUQWBY.js");
+        const { rerank } = await import("./reranker-YBVXW2ZZ.js");
         rerankedRecords = await rerank(effectiveQuery, merged, rerankReturnLimit);
       }
       if (rerankedRecords.length > 0) {
@@ -1293,7 +1293,7 @@ async function lightweightSearch(queryText, agentId, options) {
   }
   if (results.length >= 2) {
     try {
-      const { recordCoActivations } = await import("./co-activation-PL5FSIAX.js");
+      const { recordCoActivations } = await import("./co-activation-DGPZOQNM.js");
       const ids = results.slice(0, 10).map((r) => r.id);
       void recordCoActivations(ids).catch((e) => {
         try {
@@ -1309,7 +1309,7 @@ async function lightweightSearch(queryText, agentId, options) {
   }
   if (options?.includeStructuredCards !== true) return results;
   try {
-    const { searchMemoryCards } = await import("./memory-cards-UEZ2KEJP.js");
+    const { searchMemoryCards } = await import("./memory-cards-DR6VSUXF.js");
     const cardResults = await searchMemoryCards(queryText, agentId, options);
     if (cardResults.length > 0) {
       return rrfMergeMulti([results, cardResults], limit, RRF_K, [1, 0.85]);

package/dist/{chunk-HZHOO3LB.js → chunk-NV7C4XKQ.js}

@@ -1,6 +1,6 @@
 import {
   writeMemoryViaDaemon
-} from "./chunk-3NFV2N4Y.js";
+} from "./chunk-QDMZ5DX2.js";
 
 // src/lib/auto-checkpoint.ts
 var FILE_RE = /(?:^|\s)([\w./-]+\.(?:ts|tsx|js|jsx|json|md|yml|yaml|sql|go|py|css|scss|html|sh))(?:\b|$)/g;

package/dist/{chunk-D43SJR5H.js → chunk-NXBLILKG.js}

@@ -2,7 +2,7 @@ import {
   decryptSyncBlob,
   encryptSyncBlob,
   isSyncCryptoInitialized
-} from "./chunk-PW4IOFYT.js";
+} from "./chunk-OV5RG5UT.js";
 
 // src/lib/crdt-sync.ts
 import * as Y from "yjs";

package/dist/{chunk-3EZ7A7HL.js → chunk-OAYFVKNM.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-3R7UDPVR.js";
 import {
   getDeviceInfo
-} from "./chunk-N2F4RFNP.js";
+} from "./chunk-FNEUZBKI.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-7D3WRKBG.js → chunk-OJPN3XEN.js}

@@ -1,6 +1,6 @@
 import {
   listReminders
-} from "./chunk-6KGJFFVC.js";
+} from "./chunk-3ACGTDYH.js";
 
 // src/mcp/tools/list-reminders.ts
 import { z } from "zod";

package/dist/{chunk-PW4IOFYT.js → chunk-OV5RG5UT.js}

@@ -22,7 +22,7 @@ import {
 import {
   getCachedMonitorIdentity,
   recomputeEnvelopeWrapKey
-} from "./chunk-JS6OVVXQ.js";
+} from "./chunk-DLJSC6YA.js";
 
 // src/lib/crypto.ts
 import crypto from "crypto";

package/dist/{chunk-EQGGZV7I.js → chunk-POT4YW52.js}

@@ -1,6 +1,6 @@
 import {
   DAEMON_DRIFT_FAIL_THRESHOLD
-} from "./chunk-PMVVUIHH.js";
+} from "./chunk-GSOKSUBB.js";
 import {
   isOlderThan,
   isWithin,
@@ -858,6 +858,11 @@ function buildHealth(data) {
       lines.push(`  \u{1F7E2} Daemon build: current with origin/main${ahead}`);
     }
   }
+  if (data.runtimeDriftWarnings) {
+    for (const line of data.runtimeDriftWarnings) {
+      lines.push(`  ${line}`);
+    }
+  }
   const cloudLabel = renderCloudLabel(data);
   lines.push(`  \u2601\uFE0F  Cloud: ${cloudLabel}`);
   if (data.cpuSteal && data.cpuSteal.available) {

package/dist/{chunk-YBTBVSU5.js → chunk-PQVIARTA.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 
 // src/lib/skill-refinement.ts
 import crypto from "crypto";

package/dist/{chunk-2DV3TKOH.js → chunk-Q3GMM6I7.js}

@@ -2,7 +2,7 @@ import {
   connectEmbedDaemon,
   disconnectClient,
   embedViaClient
-} from "./chunk-3GEHMT7V.js";
+} from "./chunk-WJWRQQMS.js";
 import {
   EMBEDDING_DIM
 } from "./chunk-C7GHNJPW.js";

package/dist/{chunk-AXIZC2RH.js → chunk-QADGKJAC.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-W437JXWU.js";
+} from "./chunk-YWH7XWOX.js";
 
 // src/lib/pipeline-router.ts
 import crypto from "crypto";
@@ -140,8 +140,8 @@ Agent response: ${agentResponse}` : ""
 }
 async function sinkEntityExtraction(msg, agentResponse, agentName) {
   try {
-    const { extractFromConversation } = await import("./conversation-entity-extractor-7VBM5WDP.js");
-    const { storeExtraction } = await import("./graph-rag-G4HZ6VZC.js");
+    const { extractFromConversation } = await import("./conversation-entity-extractor-4PIYOIG5.js");
+    const { storeExtraction } = await import("./graph-rag-4HCOSELM.js");
     if ((msg.text?.length ?? 0) < 20) return false;
     if (msg.isHistorical) return false;
     const extraction = await extractFromConversation(msg, agentResponse, agentName);

package/dist/{chunk-3NFV2N4Y.js → chunk-QDMZ5DX2.js}

@@ -4,7 +4,7 @@ import {
 import {
   isClientConnected,
   sendDaemonRequest
-} from "./chunk-3GEHMT7V.js";
+} from "./chunk-WJWRQQMS.js";
 
 // src/lib/memory-queue-client.ts
 async function writeMemoryViaDaemon(entry) {

package/dist/{chunk-WNO3DQ7Q.js → chunk-QEFKJLEY.js}

@@ -2,13 +2,15 @@ import {
   markSupportReportSentSync
 } from "./chunk-MMRUBN3I.js";
 import {
+  SupportAdminTransportError,
+  assertSecureTransport,
   resolveSupportAdminToken,
   supportAdminHeaders
-} from "./chunk-2XZ6X3PJ.js";
+} from "./chunk-6QBBJJK2.js";
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-3EZ7A7HL.js";
+} from "./chunk-OAYFVKNM.js";
 import {
   EXE_AI_DIR,
   loadConfig
@@ -214,8 +216,19 @@ async function maybeCloseAdmin(id, adminEndpoint, version, config) {
   if (!token) {
     return { check: "askexe_admin_autoclose", level: "warn", detail: "skipped; admin token is AskExe-only" };
   }
+  let parsed;
   try {
-    const res = await fetch(`${adminEndpoint}/${encodeURIComponent(id)}`, {
+    parsed = assertSecureTransport(`${adminEndpoint}/${encodeURIComponent(id)}`, { tokenName: "AskExe support admin token" });
+  } catch (err) {
+    return {
+      check: "askexe_admin_autoclose",
+      level: "warn",
+      detail: err instanceof SupportAdminTransportError ? err.message : "refused: insecure admin endpoint",
+      next: "Set ASKEXE_SUPPORT_ADMIN_ENDPOINT to an https:// URL."
+    };
+  }
+  try {
+    const res = await fetch(parsed, {
       method: "PATCH",
       headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
       // The smoke report is NOT a defect, so there is no fix commit and no defect

package/dist/{chunk-D7KYFEV2.js → chunk-QEGSRMGV.js}

@@ -1,6 +1,6 @@
 import {
   signKeyFingerprint
-} from "./chunk-BFZ5PYWN.js";
+} from "./chunk-B42HMZSQ.js";
 import {
   resolveExeDataDir
 } from "./chunk-NPXIS2RY.js";

package/dist/{chunk-CTKK6P7X.js → chunk-QGTP2A7P.js}

@@ -2,7 +2,7 @@ import {
   deleteKeychainSecret,
   getKeychainSecret,
   setKeychainSecret
-} from "./chunk-FO7PVURG.js";
+} from "./chunk-ZHHGFNTZ.js";
 
 // src/lib/consent-passphrase.ts
 import crypto from "crypto";