@askexenow/exe-os 0.9.405 → 0.9.407

package/dist/{chunk-AZIJQ6IM.js → chunk-G3ABALZ7.js}

@@ -1,13 +1,13 @@
 import {
   orgMembershipsPath,
   readActiveOrgMemberships
-} from "./chunk-4XFVEIPV.js";
+} from "./chunk-MLIRYXZ2.js";
 import {
   resolveExeDataDir
 } from "./chunk-NPXIS2RY.js";
 
 // src/lib/org-departure.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync, statSync, writeFileSync as writeFileSync3 } from "fs";
 import os2 from "os";
 import path3 from "path";
 
@@ -175,6 +175,16 @@ function resolveTargetOrgId(explicit) {
 }
 
 // src/lib/org-departure.ts
+function classifyPathPresence(p) {
+  try {
+    statSync(p);
+    return "present";
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return "absent";
+    return "inconclusive";
+  }
+}
 var EXE_DIR2 = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path3.join(os2.homedir(), ".exe-os");
 var PER_ORG_STATE_DIRS = [
   {
@@ -198,7 +208,13 @@ function orgSegment(orgId) {
 }
 function readMembershipsFile() {
   const p = orgMembershipsPath();
-  if (!existsSync3(p)) return { version: 1, memberships: [] };
+  const presence = classifyPathPresence(p);
+  if (presence === "absent") return { version: 1, memberships: [] };
+  if (presence === "inconclusive") {
+    throw new Error(
+      `the local membership record at ${p} could not be verified (permission or I/O error); its existence is unknown, so it is being treated as possibly-present rather than absent`
+    );
+  }
   try {
     const parsed = JSON.parse(readFileSync3(p, "utf-8"));
     if (!Array.isArray(parsed?.memberships)) return { version: 1, memberships: [] };
@@ -216,7 +232,16 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
   const orgId = orgIdRaw.trim().toLowerCase();
   const notes = [];
   const failures = [];
-  const file = readMembershipsFile();
+  forgetSeatReportingOrgId(orgId);
+  let file;
+  try {
+    file = readMembershipsFile();
+  } catch (err) {
+    failures.push(
+      `the local membership record for ${orgId} could not be verified (${err instanceof Error ? err.message : String(err)}). Nothing was changed; the file may exist and be unreadable rather than absent.`
+    );
+    file = { version: 1, memberships: [] };
+  }
   let changed = false;
   for (const m of file.memberships) {
     if (typeof m.org_id === "string" && m.org_id.toLowerCase() === orgId && m.status !== "revoked") {
@@ -236,11 +261,16 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
   }
   let consentCleared = false;
   const consentStatePath = path3.join(EXE_DIR2, "org-consent", orgSegment(orgId), "consent-state.json");
-  if (!existsSync3(consentStatePath)) {
+  const consentPresence = classifyPathPresence(consentStatePath);
+  if (consentPresence === "absent") {
     consentCleared = true;
     notes.push(`No standing consent policies existed for ${orgId}; there was nothing to disarm.`);
+  } else if (consentPresence === "inconclusive") {
+    failures.push(
+      `could not determine whether standing consent policies exist for ${orgId} (permission or I/O error checking ${consentStatePath}). Treating this as NOT cleared \u2014 they may still be armed. Re-run the departure once the file is readable.`
+    );
   } else try {
-    const { clearStandingPolicies } = await import("./org-consent-policy-QQYN2HFH.js");
+    const { clearStandingPolicies } = await import("./org-consent-policy-OP5L627O.js");
     await clearStandingPolicies(orgId);
     consentCleared = true;
   } catch (err) {
@@ -259,7 +289,7 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
   }
   let pollerStopped = false;
   try {
-    const { stopOrgPartnerPollerFor } = await import("./org-partner-runtime-MBP7JUAM.js");
+    const { stopOrgPartnerPollerFor } = await import("./org-partner-runtime-H6MROHM7.js");
     pollerStopped = await stopOrgPartnerPollerFor(orgId);
   } catch (err) {
     failures.push(
@@ -268,7 +298,7 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
   }
   let seqFloor = 0;
   try {
-    const { preserveOutboundSeqFloor } = await import("./task-request-inbox-CJF4XNSY.js");
+    const { preserveOutboundSeqFloor } = await import("./task-request-inbox-4TOOJ6IR.js");
     seqFloor = preserveOutboundSeqFloor(orgId);
     if (seqFloor > 0) {
       notes.push(
@@ -284,7 +314,14 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
   for (const { root, store, why } of PER_ORG_STATE_DIRS) {
     const dir = path3.join(root, orgSegment(orgId));
     try {
-      if (!existsSync3(dir)) continue;
+      const presence = classifyPathPresence(dir);
+      if (presence === "absent") continue;
+      if (presence === "inconclusive") {
+        failures.push(
+          `${store} state for ${orgId} could not be checked (permission or I/O error on ${dir}); leaving it in place rather than guessing: ${why}.`
+        );
+        continue;
+      }
       rmSync(dir, { recursive: true, force: true });
       purged.push(store);
     } catch (err) {
@@ -301,11 +338,21 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
       `the local adminship note for ${orgId} was NOT removed (${err instanceof Error ? err.message : String(err)}).`
     );
   }
-  const remaining = readMembershipsFile().memberships.filter((m) => m.status !== "revoked").map((m) => String(m.org_id));
+  let remaining;
+  let remainingVerified = true;
+  try {
+    remaining = readMembershipsFile().memberships.filter((m) => m.status !== "revoked").map((m) => String(m.org_id));
+  } catch (err) {
+    remainingVerified = false;
+    failures.push(
+      `remaining memberships could not be verified (${err instanceof Error ? err.message : String(err)}). Falling back to the membership state already read at the start of this departure, which may not reflect a concurrent change.`
+    );
+    remaining = file.memberships.filter((m) => m.status !== "revoked").map((m) => String(m.org_id));
+  }
   notes.push(
     "Your Partner, your keys, and your memory are untouched and stay on this machine. You continue on the personal FREE tier at no cost \u2014 leaving an organization never requires you to buy a plan to keep what is yours."
   );
-  if (remaining.length === 0) {
+  if (remainingVerified && remaining.length === 0) {
     notes.push(
       "This install now belongs to no organization. It keeps working as a personal Partner; org-mode protections stay latched (clearing them is a separate, deliberate action)."
     );
@@ -329,8 +376,26 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
     notes
   };
 }
+var _lastKnownSeatReportingOrgIds;
+function forgetSeatReportingOrgId(orgId) {
+  if (_lastKnownSeatReportingOrgIds === void 0) return;
+  const lower = orgId.toLowerCase();
+  _lastKnownSeatReportingOrgIds = _lastKnownSeatReportingOrgIds.filter(
+    (id) => id.toLowerCase() !== lower
+  );
+}
 function seatReportingOrgIds() {
-  return readMembershipsFile().memberships.filter((m) => m.status === "active").map((m) => String(m.org_id).toLowerCase());
+  let ids;
+  try {
+    ids = readMembershipsFile().memberships.filter((m) => m.status === "active").map((m) => String(m.org_id).toLowerCase());
+  } catch (err) {
+    process.stderr.write(
+      `[exe-os] \u26A0 could not verify org memberships for seat reporting (${err instanceof Error ? err.message : String(err)}); ` + (_lastKnownSeatReportingOrgIds === void 0 ? "no prior confirmed read exists, so reporting none this tick" : `continuing to report the last confirmed set (${_lastKnownSeatReportingOrgIds.length} org(s))`) + "\n"
+    );
+    return _lastKnownSeatReportingOrgIds ?? [];
+  }
+  _lastKnownSeatReportingOrgIds = ids;
+  return ids;
 }
 
 export {

package/dist/{chunk-AAAJKHJM.js → chunk-G4MVORCE.js}

@@ -3,25 +3,25 @@ import {
 } from "./chunk-W4H2MZAS.js";
 import {
   resolvePartnerIdentities
-} from "./chunk-HC7GQZLN.js";
+} from "./chunk-6GBGKSNQ.js";
 import {
   OrgKeyPinConflictError,
   orgKeyPinConfirmation,
   pinOrgKey,
   readOrgKeyPin
-} from "./chunk-QEGSRMGV.js";
+} from "./chunk-52JOFQOK.js";
 import {
   displayFingerprint,
   ed25519PrivateKeyFromSeed,
   signKeyFingerprint
-} from "./chunk-B42HMZSQ.js";
+} from "./chunk-ERIXGUSV.js";
 import {
   establishOrgMode,
   upsertOrgMembership
-} from "./chunk-4XFVEIPV.js";
+} from "./chunk-MLIRYXZ2.js";
 import {
   isValidX25519Recipient
-} from "./chunk-DLJSC6YA.js";
+} from "./chunk-QJTG3DN7.js";
 
 // src/lib/org-join.ts
 import { createHash, sign } from "crypto";

package/dist/{chunk-Y3CXCRCP.js → chunk-G66AOAYN.js}

@@ -4,7 +4,7 @@ import {
   getGitRootAsync,
   isWorktreeDirty,
   isWorktreeDirtyAsync
-} from "./chunk-SI7JLNKV.js";
+} from "./chunk-TLELTVAN.js";
 
 // src/lib/worktree-sweep.ts
 import { execFile } from "child_process";

package/dist/{chunk-YGE6OCHC.js → chunk-G6D6U2EY.js}

@@ -1,12 +1,12 @@
 import {
   shutdownCli
-} from "./chunk-2KH6MZL5.js";
+} from "./chunk-HEEKYE6D.js";
 import {
   fastDbInit
-} from "./chunk-2MRQBGTY.js";
+} from "./chunk-7QIEF6OZ.js";
 import {
   sessionScopeFilter
-} from "./chunk-56XINHPT.js";
+} from "./chunk-7VSPHUIB.js";
 import {
   formatStatusAll,
   formatStatusDeep,
@@ -17,7 +17,7 @@ import {
   getClient,
   isCoordinatorRole,
   loadEmployees
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-HPDR3EL7.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";

package/dist/{chunk-QADGKJAC.js → chunk-GRIGIKC4.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-HPDR3EL7.js";
 
 // src/lib/pipeline-router.ts
 import crypto from "crypto";
@@ -140,8 +140,8 @@ Agent response: ${agentResponse}` : ""
 }
 async function sinkEntityExtraction(msg, agentResponse, agentName) {
   try {
-    const { extractFromConversation } = await import("./conversation-entity-extractor-4PIYOIG5.js");
-    const { storeExtraction } = await import("./graph-rag-4HCOSELM.js");
+    const { extractFromConversation } = await import("./conversation-entity-extractor-J2UZGFG3.js");
+    const { storeExtraction } = await import("./graph-rag-2W26GEGZ.js");
     if ((msg.text?.length ?? 0) < 20) return false;
     if (msg.isHistorical) return false;
     const extraction = await extractFromConversation(msg, agentResponse, agentName);

package/dist/{chunk-3OFIIUGD.js → chunk-GVVWEBTD.js}

@@ -1,10 +1,10 @@
 import {
   withScopedReadWindow
-} from "./chunk-DPS33ERV.js";
+} from "./chunk-KZSBPAEJ.js";
 import {
   requireOrgPartnerBinding,
   resolvePartnerIdentities
-} from "./chunk-HC7GQZLN.js";
+} from "./chunk-6GBGKSNQ.js";
 import {
   allocateOutboundSeq,
   approveBriefManually,
@@ -22,7 +22,7 @@ import {
   sealMailboxEnvelope,
   unrecordedText,
   verifyManifest
-} from "./chunk-6JZPYITB.js";
+} from "./chunk-TRZXFWRO.js";
 import {
   queueMailboxDeposit
 } from "./chunk-3FGBBJYM.js";

package/dist/{chunk-N4JBGOHA.js → chunk-HBOSSJWS.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-SSC7EKY2.js";
 import {
   computeDegradations
-} from "./chunk-DQUGV7TQ.js";
+} from "./chunk-3AOPBH5S.js";
 import {
   inventoryLocalSecretResidue,
   redactResiduePathForDisplay
@@ -41,13 +41,13 @@ import {
 } from "./chunk-T4IDLAZM.js";
 import {
   mcpHttpPort
-} from "./chunk-ID3KTUXS.js";
+} from "./chunk-342ZBEDI.js";
 import {
   isWithin
 } from "./chunk-YRUZK2QA.js";
 import {
   inspectKeyCustodySync
-} from "./chunk-ZHHGFNTZ.js";
+} from "./chunk-NF7JS7XW.js";
 import {
   checkSingleGotrueInstance
 } from "./chunk-FTZET5YX.js";

package/dist/{chunk-YNBQSYY5.js → chunk-HJ2DJJIK.js}

@@ -10,10 +10,18 @@ import {
   LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS,
   manifestEntryForCommand
 } from "./chunk-KM6XSFHP.js";
+import {
+  inspectManagedShim,
+  isDirOnPath,
+  nodeVersionAt,
+  probeLoginShellNode,
+  readBinEntries,
+  resolveLoginPath
+} from "./chunk-XMUG7XDN.js";
 import {
   formatDegradations,
   getRetrievalHealth
-} from "./chunk-DQUGV7TQ.js";
+} from "./chunk-3AOPBH5S.js";
 import {
   cleanupLocalSecretResidue,
   inventoryLocalSecretResidue,
@@ -31,7 +39,7 @@ import {
 import {
   offloadReadIfMain,
   repairFtsTable
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-HPDR3EL7.js";
 
 // src/bin/exe-doctor.ts
 import os from "os";
@@ -680,7 +688,7 @@ function auditHookOwnership() {
 }
 async function auditShards() {
   try {
-    const { auditShardHealth } = await import("./shard-manager-TKAQSRYN.js");
+    const { auditShardHealth } = await import("./shard-manager-TJ323N7P.js");
     const report = await auditShardHealth();
     return {
       total: report.total,
@@ -781,6 +789,77 @@ function auditGlobalBin(opts) {
   const missing = expected.filter((name) => !exists(path.join(binDir, name)));
   return { checked: true, binDir, targetPresent, expected, missing, reinstallCommand };
 }
+function findExeOsPackageRoot(moduleFile, opts) {
+  const exists = opts?.existsFn ?? existsSync;
+  const read = opts?.readFn ?? ((p) => readFileSync(p, "utf-8"));
+  let dir = path.dirname(moduleFile);
+  const root = path.parse(dir).root;
+  while (dir !== root) {
+    const pkgPath = path.join(dir, "package.json");
+    if (exists(pkgPath)) {
+      try {
+        const pkg = JSON.parse(read(pkgPath));
+        if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
+      } catch {
+      }
+    }
+    dir = path.dirname(dir);
+  }
+  return null;
+}
+async function auditManagedShims(opts) {
+  const moduleFile = opts?.moduleFile ?? fileURLToPath(import.meta.url);
+  const homeDir = opts?.homeDir ?? os.homedir();
+  const env = opts?.env ?? process.env;
+  const exists = opts?.existsFn ?? existsSync;
+  const binDir = path.join(homeDir, ".local", "bin");
+  const packageRoot = opts?.packageRoot !== void 0 ? opts.packageRoot : findExeOsPackageRoot(moduleFile, { existsFn: exists });
+  const expected = packageRoot ? readBinEntries(packageRoot).map((e) => e.name) : [];
+  const loginPath = await resolveLoginPath(env);
+  const onLoginPath = loginPath.unknown || !loginPath.path ? "unknown" : isDirOnPath(binDir, loginPath.path) ? "yes" : "no";
+  const checks = expected.map((name) => inspectManagedShim(binDir, name, exists));
+  const missing = checks.filter((c) => !c.present).map((c) => c.name);
+  const invalid = checks.filter((c) => c.present && c.managed && (!c.nodeExists || !c.entryExists)).map((c) => ({ name: c.name, nodeExists: c.nodeExists, entryExists: c.entryExists }));
+  const validCount = checks.filter((c) => c.present && c.managed && c.nodeExists && c.entryExists).length;
+  const unmanagedCount = checks.filter((c) => c.present && !c.managed).length;
+  return { checked: expected.length > 0, binDir, onLoginPath, expected, missing, invalid, unmanagedCount, validCount };
+}
+async function auditLoginShellNode(opts) {
+  const probe = await (opts?.probe ?? probeLoginShellNode)();
+  const versionOf = opts?.versionOf ?? nodeVersionAt;
+  const installedNodePath = opts?.installedNodePath ?? null;
+  const installedNodeVersion = installedNodePath ? versionOf(installedNodePath) : null;
+  if (probe.unknown) {
+    return {
+      status: "warn",
+      detail: "Could not determine what a login shell resolves ($SHELL unset, the probe errored, or it timed out).",
+      loginNodePath: null,
+      loginNodeVersion: null,
+      installedNodePath,
+      installedNodeVersion
+    };
+  }
+  const loginNodeVersion = probe.loginNodePath ? versionOf(probe.loginNodePath) : null;
+  if (!probe.loginExePath) {
+    const installedLabel = installedNodeVersion ? installedNodeVersion.replace(/^v/, "") : "<installed-version>";
+    return {
+      status: "fail",
+      detail: `exe-launch-agent is not reachable from a login shell (login shell uses ${loginNodeVersion ?? probe.loginNodePath ?? "an unresolved Node"}${installedNodeVersion ? `, exe-os installed under ${installedNodeVersion}` : ""}) \u2192 run \`nvm alias default ${installedLabel}\` or reinstall with \`npm i -g @askexenow/exe-os\`.`,
+      loginNodePath: probe.loginNodePath,
+      loginNodeVersion,
+      installedNodePath,
+      installedNodeVersion
+    };
+  }
+  return {
+    status: "pass",
+    detail: "exe-launch-agent is reachable from a login shell.",
+    loginNodePath: probe.loginNodePath,
+    loginNodeVersion,
+    installedNodePath,
+    installedNodeVersion
+  };
+}
 async function runAudit(client, flags) {
   const runConflicts = flags.conflicts || process.env.EXE_AUDIT_CONFLICTS === "1";
   const [stats, nullVectors, duplicates, bloated, fts, orphanedProjects, shards, keyHealth, localSecretResidue, outbox, cpuSteal, postinstallFailure, globalBin] = await Promise.all([
@@ -823,13 +902,16 @@ async function runAudit(client, flags) {
   const hookHealth = auditHookHealth();
   const hookOwnership = auditHookOwnership();
   const hookLiveness = auditRegisteredHookLiveness();
+  const shimHealth = await auditManagedShims();
+  const installedNodePath = inspectManagedShim(shimHealth.binDir, "exe-launch-agent").nodeBin;
+  const loginShellNode = await auditLoginShellNode({ installedNodePath });
   let retrievalHealth;
   try {
     retrievalHealth = await getRetrievalHealth();
   } catch {
     retrievalHealth = void 0;
   }
-  return { stats, nullVectors, duplicates, duplicateCount, bloated, fts, orphanedProjects, conflicts, hookHealth, hookOwnership, hookLiveness, shards, keyHealth, localSecretResidue, outbox, cpuSteal, postinstallFailure, globalBin, retrievalHealth };
+  return { stats, nullVectors, duplicates, duplicateCount, bloated, fts, orphanedProjects, conflicts, hookHealth, hookOwnership, hookLiveness, shards, keyHealth, localSecretResidue, outbox, cpuSteal, postinstallFailure, globalBin, shimHealth, loginShellNode, retrievalHealth };
 }
 function indicator(value, warn) {
   if (value === 0) return "\u{1F7E2}";
@@ -1006,6 +1088,26 @@ function formatReport(report, flags) {
       lines.push(`                     Reinstall to restore it: ${gb.reinstallCommand}`);
     }
   }
+  const lsn = report.loginShellNode;
+  if (lsn.status === "pass") {
+    lines.push(`\u{1F7E2} Login shell:      exe-launch-agent reachable${lsn.loginNodeVersion ? ` (${lsn.loginNodeVersion})` : ""}`);
+  } else if (lsn.status === "fail") {
+    lines.push("\u{1F534} Login shell:      exe-launch-agent NOT reachable from a fresh login shell");
+    lines.push(`                     ${lsn.detail}`);
+  } else {
+    lines.push(`\u{1F7E0} Login shell:      unknown \u2014 ${lsn.detail}`);
+  }
+  const sm = report.shimHealth;
+  if (sm.checked) {
+    if (sm.missing.length === 0 && sm.invalid.length === 0) {
+      lines.push(`\u{1F7E2} Command shims:    ${fmtNum(sm.validCount)}/${fmtNum(sm.expected.length)} valid in ${sm.binDir}${sm.onLoginPath !== "yes" ? " (not on login PATH)" : ""}`);
+    } else {
+      lines.push(`\u{1F7E0} Command shims:    ${fmtNum(sm.missing.length)} missing, ${fmtNum(sm.invalid.length)} broken in ${sm.binDir}`);
+      for (const inv of sm.invalid.slice(0, 5)) {
+        lines.push(`                     ${inv.name}: ${!inv.nodeExists ? "node missing" : ""}${!inv.nodeExists && !inv.entryExists ? "; " : ""}${!inv.entryExists ? "dist entry missing" : ""}`);
+      }
+    }
+  }
   const sh = report.shards;
   if (sh.total > 0) {
     if (sh.unreadable === 0 && sh.schemaMismatches === 0) {
@@ -1129,6 +1231,12 @@ function formatReport(report, flags) {
   if (report.globalBin.checked && report.globalBin.missing.length > 0) {
     recs.push(`Global command(s) ${report.globalBin.missing.join(", ")} are missing (likely AV/CleanMyMac quarantine \u2014 known false positive). Restore with \`${report.globalBin.reinstallCommand}\`. See SECURITY.md "Antivirus false positives".`);
   }
+  if (report.loginShellNode.status === "fail") {
+    recs.push(report.loginShellNode.detail);
+  }
+  if (report.shimHealth.checked && (report.shimHealth.missing.length > 0 || report.shimHealth.invalid.length > 0)) {
+    recs.push(`Re-run \`npm i -g @askexenow/exe-os\` to regenerate the command shims in ${report.shimHealth.binDir}.`);
+  }
   if (report.retrievalHealth) {
     for (const d of report.retrievalHealth.degradations) {
       if (d.severity === "critical" || d.severity === "warn") {
@@ -1265,7 +1373,7 @@ function shouldFixShards(shards) {
   return shards.unreadable > 0 || shards.schemaMismatches > 0;
 }
 async function fixShards(dryRun) {
-  const { auditShardHealth } = await import("./shard-manager-TKAQSRYN.js");
+  const { auditShardHealth } = await import("./shard-manager-TJ323N7P.js");
   const report = await auditShardHealth({ repair: true, dryRun });
   return {
     total: report.total,
@@ -1330,7 +1438,9 @@ function emptyAuditReport() {
     outbox: { bugReports: { total: 0, unsent: 0 }, featureRequests: { total: 0, unsent: 0 } },
     cpuSteal: { available: false, stealPercent: null, severity: "na", source: "none", message: "not checked" },
     postinstallFailure: null,
-    globalBin: { checked: false, binDir: null, targetPresent: false, expected: ["exe", "exe-os"], missing: [], reinstallCommand: "npm install -g @askexenow/exe-os" }
+    globalBin: { checked: false, binDir: null, targetPresent: false, expected: ["exe", "exe-os"], missing: [], reinstallCommand: "npm install -g @askexenow/exe-os" },
+    shimHealth: { checked: false, binDir: "", onLoginPath: "unknown", expected: [], missing: [], invalid: [], unmanagedCount: 0, validCount: 0 },
+    loginShellNode: { status: "warn", detail: "not checked", loginNodePath: null, loginNodeVersion: null, installedNodePath: null, installedNodeVersion: null }
   };
 }
 async function main(argv = process.argv.slice(2)) {
@@ -1340,7 +1450,7 @@ async function main(argv = process.argv.slice(2)) {
     console.log(formatRestartReport(restartReport));
     return emptyAuditReport();
   }
-  const { fastDbInit } = await import("./fast-db-init-NGVQV5J2.js");
+  const { fastDbInit } = await import("./fast-db-init-YFUMI4NH.js");
   const client = await fastDbInit();
   const report = await runAudit(client, flags);
   console.log(formatReport(report, flags));
@@ -1453,6 +1563,9 @@ export {
   auditCpuSteal,
   auditPostinstallFailure,
   auditGlobalBin,
+  findExeOsPackageRoot,
+  auditManagedShims,
+  auditLoginShellNode,
   runAudit,
   formatReport,
   fixNullVectors,

package/dist/{chunk-YWH7XWOX.js → chunk-HPDR3EL7.js}

@@ -7,14 +7,14 @@ import {
 import {
   listBackups,
   preBackupCheckpoint
-} from "./chunk-XIMUZQJT.js";
+} from "./chunk-6Y7TK4EA.js";
 import {
   MEMORY_PROJECTION_OUTBOX_INDEX_SQL,
   MEMORY_PROJECTION_OUTBOX_TABLE_SQL,
   MEMORY_PROJECTION_OUTBOX_UNIQUE_INDEX_SQL,
   PROJECTION_CHECKPOINT_TABLE_SQL,
   ensureMemoryWriteIndex
-} from "./chunk-BU4NQU5R.js";
+} from "./chunk-VSJ3Y26C.js";
 import {
   recordDbOpen
 } from "./chunk-5YEUPUV4.js";
@@ -1515,7 +1515,7 @@ async function migrateReflectionDedup(client) {
     "ALTER TABLE memory_reflections ADD COLUMN dedup_key TEXT",
     "migration add memory_reflections.dedup_key"
   );
-  const { reflectionDedupKey } = await import("./memory-reflection-SR657DTL.js");
+  const { reflectionDedupKey } = await import("./memory-reflection-R6TAIUOR.js");
   const keyForRow = (row) => {
     let sources = [];
     try {
@@ -2573,7 +2573,7 @@ async function sweepExpiredSoftDeletedMemories(client, options = {}) {
   const purgeArchived = archDays !== void 0;
   const BATCH_SIZE = 2e3;
   const MAX_BATCHES = 500;
-  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-4HCOSELM.js");
+  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-2W26GEGZ.js");
   const softCutoff = `-${softDays} days`;
   const selectArgsBase = [softCutoff];
   let predicate = `status = 'deleted' AND COALESCE(deleted_at, timestamp) < datetime('now', ?)`;

package/dist/{chunk-VHKJIGNR.js → chunk-IMI5ZAOA.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-HPDR3EL7.js";
 
 // src/lib/token-budget.ts
 var WARN_THRESHOLD = 0.8;

package/dist/{chunk-BPNPJVYP.js → chunk-IQI5LAEK.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-7WYV32ZH.js";
+} from "./chunk-USDMXIPZ.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-A5TICGUL.js → chunk-IVX4CW6I.js}

@@ -1,12 +1,12 @@
 import {
   sessionScopeFilter
-} from "./chunk-56XINHPT.js";
+} from "./chunk-7VSPHUIB.js";
 import {
   leaseExpiryIso
 } from "./chunk-E23LNUWJ.js";
 import {
   getProjectName
-} from "./chunk-SD5PWIUP.js";
+} from "./chunk-Z5ERWCOL.js";
 
 // src/lib/subagent-observability.ts
 var MAX_RESULT_DIGEST_CHARS = 200;

package/dist/{chunk-2NNTKVDN.js → chunk-KAKURNNS.js}

@@ -1,7 +1,7 @@
 import {
   getIdentity,
   loadEmployeesSync
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-HPDR3EL7.js";
 
 // src/lib/drift-probes.ts
 var DRIFT_THRESHOLD = 80;

package/dist/{chunk-APOS4EIO.js → chunk-KP3J52RW.js}

@@ -1,9 +1,9 @@
 import {
   listBehaviors
-} from "./chunk-L3L4KCBJ.js";
+} from "./chunk-SPHPROWZ.js";
 import {
   incrementSkillUsage
-} from "./chunk-PQVIARTA.js";
+} from "./chunk-FBB2YMKB.js";
 
 // src/lib/behavior-injection.ts
 import { appendFile } from "fs/promises";
@@ -349,7 +349,7 @@ async function injectBehaviors(opts) {
       `[behavior-injection] ${opts.assignedTo} <- ${selected.length}/${behaviors.length} behaviour(s) for "${opts.title.slice(0, 60)}": ` + selected.map((s) => `${s.behavior.id.slice(0, 8)}(${s.score.toFixed(2)})`).join(" ") + "\n"
     );
     await incrementSkillUsage(selected.map((s) => s.behavior));
-    const { recordBehaviorsConsulted } = await import("./skill-usage-YDCLNH63.js");
+    const { recordBehaviorsConsulted } = await import("./skill-usage-WNCOURZY.js");
     await recordBehaviorsConsulted(selected.map((s) => s.behavior.id));
     return selected;
   } catch (err) {

package/dist/{chunk-X44QG7ES.js → chunk-KVPCFVAH.js}

@@ -1,6 +1,6 @@
 import {
   isExeSession
-} from "./chunk-56XINHPT.js";
+} from "./chunk-7VSPHUIB.js";
 import {
   loadConfigSync
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-DPS33ERV.js → chunk-KZSBPAEJ.js}

@@ -1,10 +1,10 @@
 import {
   registerScopedQueryChokepoint,
   scopedQueryChokepointStatus
-} from "./chunk-6JZPYITB.js";
+} from "./chunk-TRZXFWRO.js";
 import {
   getClient
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-HPDR3EL7.js";
 
 // src/lib/org-scoped-rows.ts
 var SCOPED_QUERY_MAX_LIMIT = 200;

package/dist/{chunk-GLMR5PRH.js → chunk-L23CONP7.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-RGPEUXOE.js";
 import {
   sessionScopeFilter
-} from "./chunk-56XINHPT.js";
+} from "./chunk-7VSPHUIB.js";
 import {
   isWithin
 } from "./chunk-YRUZK2QA.js";
@@ -297,7 +297,7 @@ async function sweepTasks(projectName, options = {}) {
     }
     if (!dryRun) {
       try {
-        const { updateTaskStatus } = await import("./tasks-crud-K55N5YNO.js");
+        const { updateTaskStatus } = await import("./tasks-crud-GBNROE5E.js");
         await updateTaskStatus({
           taskId: task.id,
           status: "needs_review",