@askexenow/exe-os 0.9.409 → 0.9.411

package/dist/{chunk-NVM3SKJ4.js → chunk-4CN3EE6U.js}

@@ -38,21 +38,21 @@ var PLATFORM_PROCEDURES = [
     title: "Platform reference \u2014 read on demand, not injected",
     domain: "operations",
     priority: "p1",
-    content: "Reference-heavy platform docs are NOT injected into every session (token budget). Read them on demand from ~/.exe-os/reference/platform-reference.md (auto-written at COO boot), which covers: the full MCP tool reference (all domains + key actions); how to update exe-os (channels, CLI vs stack, `exe-os update`); the first-install setup wizard + license activation; cognition features (dreaming, reflexes, baselines, hot-path summary); and platform capabilities (watchdog, diagnostics, graph extraction, discovery hooks, cloud reminders). For LIVE MCP tool discovery use diagnostics(action='tool_search'); for update status use diagnostics(action='check_update'). Also in the reference file: production-readiness audit methodology; license plan refresh. When a task needs these details, read the file or recall \u2014 never guess update/setup steps."
+    content: "Reference-heavy platform docs are NOT injected into every session (token budget). Read them on demand from ~/.exe-os/reference/platform-reference.md (auto-written at COO boot): full MCP tool reference (domains + actions); exe-os update channels/CLI/stack; first-install wizard + license activation; cognition features (dreaming, reflexes, baselines, hot-path summary); platform capabilities (watchdog, diagnostics, graph extraction, discovery hooks, cloud reminders); production-readiness audit methodology; license plan refresh. Live tool discovery: diagnostics(action='tool_search'); update status: diagnostics(action='check_update'). Read the file or recall \u2014 never guess update/setup steps."
   },
   // --- Project boundary ---
   {
     title: "Stay in your repo \u2014 never cd into other projects",
     domain: "workflow",
     priority: "p0",
-    content: "NEVER cd into another repo or project directory. Your working directory (cwd) is your project boundary. When a user says 'commit all' or 'push all', that means all changes IN THIS REPO, not across the machine. If you see uncommitted changes in another repo via memory or task recall, ignore them \u2014 that's another agent's responsibility. Running `cd /path/to/other-repo && git commit` from your session is a project boundary violation. If cross-repo work is needed, dispatch a named subagent whose brief fences it to that repo, or hand the work to the coordinator session that owns the project."
+    content: "NEVER cd into another repo or project directory \u2014 your working directory (cwd) is your project boundary. 'Commit all' or 'push all' means all changes IN THIS REPO, not across the machine. If you see uncommitted changes in another repo via memory or task recall, ignore them \u2014 that's another agent's responsibility. Running `cd /path/to/other-repo && git commit` from your session is a boundary violation. For cross-repo work, dispatch a named subagent fenced to that repo, or hand it to the coordinator session that owns the project."
   },
   // --- Hierarchy and dispatch ---
   {
     title: "Chain of command \u2014 who talks to whom",
     domain: "workflow",
     priority: "p0",
-    content: "Founder -> coordinator (the executive agent, internally routed as 'COO') -> CTO/CMO/GMs. CTO -> engineers. CMO -> content production. GM -> specialists within their project scope. Never skip levels: the coordinator does not bypass managers for specialist work. Specialists report to their manager. If you need cross-team info, use ask_team_memory \u2014 don't read other agents' task folders. Each level owns dispatch downward and review upward."
+    content: "Founder -> coordinator ('COO' slot) -> CTO/CMO/GMs -> specialists \u2014 for review/expertise, NOT dispatch: dispatch is FLAT, only the coordinator spawns subagents. A manager never dispatches further (nested-spawn guard blocks it): decompose, do your share, return findings plus ready-to-dispatch briefs for the coordinator. Managers review, report upward. Cross-team: ask_team_memory, not folders."
   },
   {
     title: "Orchestration phase guidance \u2014 recommend, never trap",
@@ -70,25 +70,31 @@ var PLATFORM_PROCEDURES = [
     title: "Named dispatch \u2014 'give this to X' means a subagent wearing X's identity",
     domain: "workflow",
     priority: "p0",
-    content: "When the founder assigns work to a roster employee by name ('give this to X'), the coordinator dispatches a NATIVE SUBAGENT wearing that employee's identity: Agent(subagent_type='<name>') loads the generated identity definition (~/.claude/agents/<name>.md \u2014 identity + preset model/effort), worktree isolation for code work, and the employee's expertise applies. Hooks capture everything; attribution is granted ONLY through the spawn ledger (the session's own recorded dispatch \u2014 never the payload's claim), so the employee's three-layer cognition accrues from work actually delegated to them. Multiple subagents may wear the same identity concurrently; their experiences merge into one agent brain. The orchestrator remains the single deciding context: it briefs, reviews, verifies, and lands. This semantic applies to every coordinator on every runtime (Claude Code, Codex, OpenCode)."
+    content: "When the founder assigns work to a roster employee by name ('give this to X'), the coordinator dispatches a NATIVE SUBAGENT wearing that employee's identity: Agent(subagent_type='<name>') loads the generated identity definition (~/.claude/agents/<name>.md \u2014 identity + preset model/effort), worktree isolation for code work, and the employee's expertise applies. Hooks capture everything; attribution is granted ONLY through the spawn ledger \u2014 the session's own recorded dispatch, never the payload's claim \u2014 so the employee's three-layer cognition accrues only from work actually delegated to them. Multiple subagents may wear the same identity concurrently; their experiences merge into one agent brain. The orchestrator stays the single deciding context: it briefs, reviews, verifies, lands. Applies on every runtime (Claude Code, Codex, OpenCode)."
   },
   {
     title: "Dispatch Ladder \u2014 two rungs, and subagents are the only dispatch",
     domain: "workflow",
     priority: "p0",
-    content: "TWO rungs \u2014 stop at the first that fits. (1) Do it yourself: trivial, in-scope work in main context. (2) Named subagent \u2014 Agent(subagent_type='<employee>') on Claude Code (Codex spawned agents / OpenCode sessions are the equivalent on those runtimes), with git worktree isolation for any code work. This is the ONLY delegation path: roster-employee work, bounded well-specified work, parallel research, isolated fixes, verbose throwaway exploration. Cap 2-3 concurrent under load; merge or clean up subagent worktrees before finishing. MANDATORY: persist subagent results/lessons into the task checklist row + memory BEFORE completing \u2014 subagent output must never die in a context window. There is no third rung: task(action='create') is a DURABLE CHECKLIST ROW for tracking and never launches compute, and background employee sessions are retired."
+    content: "TWO rungs \u2014 stop at the first that fits. (1) Do it yourself: trivial, in-scope work in main context. (2) Named subagent \u2014 Agent(subagent_type='<employee>') on Claude Code (Codex spawned agents / OpenCode sessions are the equivalent on those runtimes), with git worktree isolation for code work. This is the ONLY delegation path: roster-employee work, bounded well-specified work, parallel research, isolated fixes, verbose throwaway exploration. Cap 2-3 concurrent under load; merge or clean up subagent worktrees before finishing. MANDATORY: persist subagent results/lessons into the task checklist row + memory before completing \u2014 subagent output must never die in a context window. There is no third rung: task(action='create') is a DURABLE CHECKLIST ROW for tracking and never launches compute; background employee sessions are retired."
   },
   {
     title: "Subagent guardrails \u2014 fence scope, isolate Codex, never stash",
     domain: "workflow",
     priority: "p0",
-    content: "When delegating to subagents: (1) FENCE SCOPE \u2014 a subagent with MCP access must be explicitly forbidden from touching other agents' tasks, reviews, or folders; give it only its own brief. (2) Codex-runtime subagents ALWAYS run in an isolated git worktree \u2014 they auto-commit and cross file fences despite instructions. (3) NEVER run git stash \u2014 the stash stack is shared repo-wide across ALL worktrees; concurrent agents silently pop each other's uncommitted work. Use git diff > patch, a scratch commit, or a separate worktree instead. (4) A subagent NEVER delegates further by starting background sessions: it does the work, or reports back. (5) Its result is not delivered until YOU have persisted it into the task checklist row + memory. Brief every subagent you dispatch with these rules \u2014 the brief is the only scope it has."
+    content: "When delegating to subagents: (1) FENCE SCOPE \u2014 a subagent with MCP access must be explicitly forbidden from touching other agents' tasks, reviews, or folders; give it only its own brief. (2) Codex-runtime subagents ALWAYS run in an isolated git worktree \u2014 they auto-commit and cross file fences despite instructions. (3) NEVER run git stash \u2014 the stash stack is shared repo-wide across ALL worktrees; concurrent agents silently pop each other's uncommitted work; use git diff > patch, a scratch commit, or a separate worktree instead. (4) a subagent never delegates further by starting background sessions \u2014 it does the work or reports back. (5) its result isn't delivered until YOU persist it into the task checklist row + memory. Brief every subagent with these rules \u2014 the brief is its only scope."
   },
   {
     title: "Right-size the model \u2014 match model cost to task difficulty",
     domain: "workflow",
     priority: "p1",
-    content: "Tokens are money \u2014 pick the model per task. Mechanical/bounded work (renames, config edits, boilerplate, well-specified fixes) -> cheaper model and/or lower reasoning effort. Adversarial verification, hard design, security review, debugging unknowns -> strong model; never verify a strong model's work with a weaker one. Set the per-employee default via set_agent_config (it is baked into the generated agent definition, so Agent(subagent_type='<name>') inherits it); override per dispatch with the Agent tool's own model argument. Audit spend with config(action='agent_spend')."
+    content: "Tokens are money \u2014 pick the model per dispatch; there is no default model to lean on. Mechanical/bounded work (renames, config edits, boilerplate, well-specified fixes) -> cheaper model and/or lower reasoning effort. Adversarial verification, hard design, security review, debugging unknowns -> strong model; never verify a strong model's work with a weaker one. set_agent_config persists a per-employee baseline Agent(subagent_type) inherits, but override it per dispatch with the Agent tool's own model arg. Audit spend with config(action='agent_spend')."
+  },
+  {
+    title: "Subagent context economy \u2014 spawn fresh, don't resume big agents",
+    domain: "workflow",
+    priority: "p0",
+    content: "Resuming a subagent re-processes its ENTIRE prior context; the prompt cache is cold after any pause, so resuming a 500k-token agent to fix one line costs ~500k tokens. (1) For any follow-up \u2014 review fixes, a conflict, a small tweak \u2014 spawn a FRESH subagent with a tight brief: PR/branch, the review/report file path, and the exact items; facts live in files and the task row, not an agent's memory. (2) resume only when its context is small (<~150k tokens) AND the follow-up is about its own work within ~1 hour. (3) retire an agent once its chunk merges \u2014 never a standing helper. (4) choose the model per task \u2014 no default dispatch model. (5) cap concurrency at ~3 \u2014 usage-limit mass terminations force every agent to restart and re-read its context. (6) brief reviewers to write findings to a file, so fixers read the file, not the reviewer's transcript."
   },
   {
     title: "Fetch and scope-check before dispatching fix work",
@@ -101,20 +107,20 @@ var PLATFORM_PROCEDURES = [
     title: "Session isolation \u2014 scoping, boundaries, and enforcement",
     domain: "security",
     priority: "p0",
-    content: "SCOPING: Managers dispatch only within their own coordinator session. A subagent has no session of its own \u2014 it inherits the dispatching coordinator's session_scope, so its work is scoped exactly where the dispatcher's is. Cross-session dispatch is system-blocked. Tasks are scoped to the creating session. BOUNDARIES: (1) Never close/update/cancel tasks from another session. (2) Never review work from a different session \u2014 report it belongs elsewhere and skip. (3) Ignore other sessions' items in list_tasks. (4) A subagent works ONLY on the task it was briefed with, inside its dispatcher's scope. Cross-session work is a system violation. ENFORCEMENT: Every DB query, notification, and task operation MUST filter on 3 dimensions: (1) session_scope matching current coordinator session, (2) project_name, (3) role hierarchy level. Any function touching tasks/reviews/messages/notifications must accept sessionScope and pass it to SQL WHERE. Unscoped queries are bugs. Test with 2+ coordinator sessions simultaneously."
+    content: "SCOPING: Managers dispatch only within their own coordinator session. A subagent has no session of its own \u2014 it inherits the dispatching coordinator's session_scope, so its work is scoped exactly where the dispatcher's is. Cross-session dispatch is system-blocked; tasks are scoped to the creating session. BOUNDARIES: (1) never close/update/cancel tasks from another session; (2) never review work from a different session \u2014 report it belongs elsewhere and skip; (3) ignore other sessions' items in list_tasks; (4) a subagent works ONLY on the task it was briefed with, inside its dispatcher's scope \u2014 cross-session work is a violation. ENFORCEMENT: every DB query, notification, and task operation MUST filter on session_scope, project_name, and role hierarchy level. Any function touching tasks/reviews/messages/notifications must accept sessionScope and pass it to SQL WHERE \u2014 unscoped queries are bugs. Test with 2+ coordinator sessions simultaneously."
   },
   // --- Hard constraints ---
   {
     title: "What you CANNOT do in exe-os \u2014 hard constraints",
     domain: "security",
     priority: "p0",
-    content: "NEVER: (1) Access the database directly \u2014 it's SQLCipher encrypted, always fails. Use MCP tools only. (2) Start background agent sessions by hand (terminal multiplexers, headless CLI launches, nohup) \u2014 delegation is Agent(subagent_type='<name>') and nothing else. (3) Run git checkout main \u2014 agents work in worktrees. (4) Modify another agent's in-progress task. (5) Push to remote \u2014 the COO reviews and pushes. (6) Skip update_task(done) \u2014 it's the ONLY way your work gets reviewed. (7) Run git init."
+    content: "NEVER: (1) access the database directly \u2014 SQLCipher encrypted, always fails; use MCP tools only. (2) start background agent sessions by hand (terminal multiplexers, headless CLI launches, nohup) \u2014 delegation is Agent(subagent_type='<name>') and nothing else. (3) run git checkout main \u2014 agents work in worktrees. (4) modify another agent's in-progress task. (5) push to remote \u2014 the COO reviews and pushes. (6) skip update_task(done) \u2014 it's the ONLY way your work gets reviewed. (7) run git init."
   },
   {
     title: "Destructive operations \u2014 mandatory reviewer gate",
     domain: "security",
     priority: "p0",
-    content: "Before ANY destructive operation (delete, remove, overwrite, drop, reset, force-push, truncate): (1) Have your full task spec accessible \u2014 if you cannot read it, STOP and report to reviewer. (2) Confirm with reviewer (assigned_by or COO) before executing. (3) If task spec explicitly authorizes it, proceed but log it. Violation = immediate task failure. Applies to ALL agents regardless of role. DATA STORES: volume rm/prune, down -v, rm on data paths and DROP/TRUNCATE are mechanically refused without a verified restore proof (`exe-os restore-proof record`). No --force, no exemption."
+    content: "Before ANY destructive operation (delete, remove, overwrite, drop, reset, force-push, truncate): (1) have your full task spec accessible \u2014 if you cannot read it, STOP and report to reviewer; (2) confirm with reviewer (assigned_by or COO) before executing; (3) if the task spec explicitly authorizes it, proceed but log it. Violation = immediate task failure, for ALL agents regardless of role. DATA STORES: volume rm/prune, down -v, rm on data paths, and DROP/TRUNCATE are mechanically refused without a verified restore proof (`exe-os restore-proof record`) \u2014 no --force, no exemption."
   },
   // --- Support ---
   {
@@ -154,7 +160,7 @@ var PLATFORM_PROCEDURES = [
     title: "What the platform provides vs what you customize",
     domain: "architecture",
     priority: "p0",
-    content: "FIVE LAYERS \u2014 know when to use each: (1) Platform procedures: how exe-os works, shipped to ALL customers via npm. Never put org-specific rules here. (2) Company procedures: org workflow rules in DB, injected after platform. For internal gates, checklists, policies. (3) Identity (exe.md): permanent role definition \u2014 who you are, what you own. For rules that must NEVER be forgotten. (4) Behaviors: corrections and patterns (Layer 2). For 'do X' / 'never do Y' \u2014 per agent per project, deactivatable. (5) Memory: facts, decisions, context (Layer 3). For what happened and what was decided. Platform layer is REPLACED on npm update (expected). All customer layers (2-5) are PRESERVED \u2014 company procedures, identities, behaviors, memory, config.json are NEVER touched by updates. Schema migrations are additive only. The ~/exe/ workspace, roster, and symlinks are also preserved."
+    content: "FIVE LAYERS \u2014 know when to use each: (1) Platform procedures: how exe-os works, shipped to ALL customers via npm; never put org-specific rules here. (2) Company procedures: org workflow rules in DB, injected after platform \u2014 gates, checklists, policies. (3) Identity (exe.md): permanent role definition \u2014 who you are, what you own; rules that must NEVER be forgotten. (4) Behaviors: corrections and patterns (Layer 2) \u2014 'do X'/'never do Y', per agent per project, deactivatable. (5) Memory: facts, decisions, context (Layer 3) \u2014 what happened and what was decided. Platform layer is REPLACED on npm update (expected); customer layers (2-5) are NEVER touched by updates \u2014 company procedures, identities, behaviors, memory, config.json are preserved. Schema migrations are additive only; the ~/exe/ workspace, roster, and symlinks persist too."
   },
   // --- Behavior hygiene ---
   {
@@ -174,7 +180,7 @@ var PLATFORM_PROCEDURES = [
     title: "Never defer \u2014 fix it now or assign it now",
     domain: "operations",
     priority: "p0",
-    content: "NEVER defer work \u2014 no 'later', 'next sprint', or 'not urgent'. Every defer is a broken promise: deferred items pile up, get forgotten, block other work, and erode trust. Find a bug mid-task: fix it now, then resume. Outside your scope: create_task so someone fixes it NOW. If it truly cannot be done (missing credentials, external human action, third-party block), name the blocker and who must act. The only acceptable reason not to fix something is 'physically impossible right now' \u2014 never 'not urgent'."
+    content: "NEVER defer work \u2014 no 'later', 'next sprint', or 'not urgent'. Every defer is a broken promise: deferred items pile up, get forgotten, and erode trust. Find a bug mid-task: fix it now, then resume. Outside your scope: give the coordinator a ready brief now \u2014 task(action='create') is a tracking row, it launches nothing; coordinator dispatches. If truly impossible (missing credentials, external human action, third-party block), name the blocker and who must act. The only acceptable reason not to fix something is 'physically impossible right now' \u2014 never 'not urgent'."
   },
   // --- Observability ---
   // --- Operations ---
@@ -182,13 +188,13 @@ var PLATFORM_PROCEDURES = [
     title: "Managers own the subagents they dispatch \u2014 brief, receive, verify",
     domain: "workflow",
     priority: "p0",
-    content: `Every manager (COO/CTO/CMO) who dispatches a subagent OWNS it end to end. A subagent runs inside your context: you get its result back, so supervision is not polling \u2014 it is (1) briefing it well enough to succeed (scope fence, file list, acceptance criteria, guardrails), (2) reading the result when it returns rather than trusting its summary, (3) persisting the result into the task checklist row + memory, and (4) re-dispatching with a corrected brief when it came back wrong. While it runs you may work on something else, but you may NOT finish your own turn with a dispatched subagent's result unread. "Standing by" while results sit unread is negligence.`
+    content: `Every manager (COO/CTO/CMO) who dispatches a subagent OWNS it end to end. A subagent runs inside your context, so supervision is not polling \u2014 it is (1) briefing it well enough to succeed (scope fence, file list, acceptance criteria, guardrails); (2) reading the result when it returns rather than trusting its summary; (3) persisting the result into the task checklist row + memory; (4) re-dispatching with a corrected brief when it came back wrong. You may work on something else while it runs, but you may NOT finish your own turn with a dispatched subagent's result unread \u2014 "standing by" while results sit unread is negligence.`
   },
   {
     title: "Coordinator verification \u2014 verify signals, triangulate absence",
     domain: "workflow",
     priority: "p0",
-    content: "Never act on a self-reported claim without independent verification. 'Task done' -> read the deliverable (git diff, exe/output/, the task row) and run the verification yourself. A subagent's closing summary is a claim, not evidence: check the diff it says it made and the test it says it ran. Before reporting absence ('no tasks', 'no work was done', 'agent is idle'), triangulate at least three sources: task DB across ALL statuses with project_name='all', output artifacts in exe/output/, and team memory. A null result from one query is the limit of your filter, not a fact about reality. If verification contradicts a detailed claim, double-check your verification before accusing the agent."
+    content: "Never act on a self-reported claim without independent verification. 'Task done' -> read the deliverable (git diff, exe/output/, the task row) and run the verification yourself \u2014 a subagent's closing summary is a claim, not evidence: check the diff it says it made and the test it says it ran. Before reporting absence ('no tasks', 'no work was done', 'agent is idle'), triangulate at least three sources: task DB across ALL statuses with project_name='all', output artifacts in exe/output/, and team memory. A null result from one query is the limit of your filter, not a fact about reality. If verification contradicts a detailed claim, double-check your verification first."
   },
   {
     title: "COO boot health check \u2014 trust the boot script, verify on request",
@@ -206,7 +212,7 @@ var PLATFORM_PROCEDURES = [
     title: "Structured handoffs \u2014 record work on the task row, not in a message",
     domain: "communication",
     priority: "p1",
-    content: "Task work is handed off through the DB, never through a message: update_task(done) carries the structured result (files_changed, commits, decisions, blockers, assertions_resolved) and is what the reviewer reads. A subagent's result is handed off by the dispatcher persisting it into that task row + memory before finishing. send_message is for human-directed notes between coordinator sessions (FYI, a question, a heads-up) and is fire-and-forget \u2014 NEVER use it to assign, deliver, or accept actionable work."
+    content: "Task work is handed off through the DB, never through a message: update_task(done) carries the structured result (files_changed, commits, decisions, blockers, assertions_resolved) and is what the reviewer reads. A subagent's result is handed off by the dispatcher persisting it into that task row + memory before finishing. send_message is for human-directed notes between coordinator sessions (FYI, a question, a heads-up) and is fire-and-forget \u2014 NEVER use it to assign, deliver, or accept work."
   },
   {
     title: "Assertions and estimation \u2014 mandatory confidence tracking on every task",
@@ -218,7 +224,7 @@ var PLATFORM_PROCEDURES = [
     title: "Verify your own fix \u2014 NEVER ask the user to test for you",
     domain: "workflow",
     priority: "p0",
-    content: "When you claim a bug is fixed, YOU must prove it works. NEVER say 'try it now' or 'go test it'. Run the actual verification yourself: curl the endpoint, use playwright to click the button, run the test suite, check the logs. If you cannot verify it yourself, say 'I cannot verify this \u2014 here is what I changed and why, but I need you to test because [specific reason].' Saying 'fixed' without evidence is a lie. If you said 'fixed' and the user reports it's not fixed, your next assertion on the same bug MUST have confidence \u2264 0.5. After 3 wrong attempts on the same bug, stop and reassess from scratch \u2014 your mental model is wrong. Every failed fix attempt must be logged as a resolved assertion with outcome='incorrect' and why_wrong filled in. This builds the record of what was tried, what failed, and why \u2014 so the next attempt doesn't repeat the same mistake."
+    content: "When you claim a bug is fixed, YOU must prove it \u2014 never say 'try it now' or 'go test it'. Run the actual verification yourself: curl the endpoint, use playwright, run the test suite, check the logs. If you cannot verify it yourself, say 'I cannot verify this \u2014 here is what I changed and why, but I need you to test because [specific reason].' Saying 'fixed' without evidence is a lie. If the user reports it's not fixed, your next assertion on the same bug MUST have confidence \u2264 0.5; after 3 wrong attempts, stop and reassess from scratch \u2014 your mental model is wrong. Log every failed attempt as a resolved assertion with outcome='incorrect' and why_wrong filled in, so the next attempt doesn't repeat the same mistake."
   },
   {
     title: "Confidence decay \u2014 lower confidence after each wrong assertion on the same problem",
@@ -230,7 +236,7 @@ var PLATFORM_PROCEDURES = [
     title: "No monitoring loops \u2014 pull the queue on every prompt instead",
     domain: "workflow",
     priority: "p1",
-    content: "There is nothing to poll: subagents return their results to the dispatching context, so a timer that watches other sessions has no job. Do NOT run /loop (or any self-scheduled monitoring loop) for orchestration \u2014 it has no MCP health check, no cycle mutex and no timeout, so an MCP disconnect freezes the session permanently. Instead: check task(action='list', status='needs_review') and blocked tasks on every prompt, and dispatch the next subagent yourself. A genuine recurring job (a nightly report, a CI sweep) belongs in config(action='create_trigger'), not in a chat loop."
+    content: "There is nothing to poll: subagents return results to the dispatching context, so a timer watching other sessions has no job. Do NOT run /loop (or any self-scheduled monitoring loop) for orchestration \u2014 it has no MCP health check, no cycle mutex, and no timeout, so an MCP disconnect freezes the session permanently. Instead: check task(action='list', status='needs_review') and blocked tasks on every prompt, and dispatch the next subagent yourself. A genuine recurring job (a nightly report, a CI sweep) belongs in config(action='create_trigger'), not a chat loop."
   },
   {
     title: "exe-build-adv mandatory for 3+ files",
@@ -242,7 +248,7 @@ var PLATFORM_PROCEDURES = [
     title: "Code context + graph first \u2014 MANDATORY before codebase exploration",
     domain: "workflow",
     priority: "p0",
-    content: "Before broad repo exploration, agents MUST use code_context and graph MCP tools instead of manual grep/read. code_context: action=search (multi-language code/doc search), action=trace (symbol imports/dependents), action=blast_radius (impact analysis), action=index/stats (refresh/check index). graph: action=query_relationships, action=hot_entities, action=entity_neighbors, action=stats. NEVER brute-force grep without checking code_context first. CLI parity: exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable memory \u2014 promote only validated decisions/lessons."
+    content: "Before broad repo exploration, use code_context and graph MCP tools instead of manual grep/read. code_context: search (multi-language code/doc), trace (symbol imports/dependents), blast_radius (impact analysis), index/stats (refresh/check). graph: query_relationships, hot_entities, entity_neighbors, stats. NEVER brute-force grep without checking code_context first. CLI parity: exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable memory \u2014 promote only validated decisions/lessons."
   },
   {
     title: "Commit discipline \u2014 commit after every completed track, never batch",
@@ -267,7 +273,7 @@ var PLATFORM_PROCEDURES = [
     title: "Task lifecycle \u2014 the golden path every agent follows",
     domain: "workflow",
     priority: "p0",
-    content: "Tasks are durable, session-scoped CHECKLIST records \u2014 they track work, they never dispatch it. Execution is always the current context or a named subagent it launches (see the Dispatch Ladder). Task lifecycle: open -> in_progress (you start) -> done (update_task when finished) -> needs_review -> closed (COO only via close_task). The DB row is the delivery: a subagent's result is not delivered until it is written there. If you finish a task, self-chain: check for the next task immediately (step 7). Never wait to be nudged. Never say 'standing by.'"
+    content: "Tasks are durable, session-scoped CHECKLIST records \u2014 they track work, never dispatch it. Execution is always the current context or a named subagent it launches (see the Dispatch Ladder). Task lifecycle: open -> in_progress (you start) -> done (update_task when finished) -> needs_review -> closed (COO only via close_task). The DB row is the delivery: a subagent's result isn't delivered until it's written there. If you finish a task, self-chain: check for the next task immediately. Never wait to be nudged. Never say 'standing by.'"
   },
   {
     title: "Review chain \u2014 managers must actively pull completed work, never wait for nudges",
@@ -279,7 +285,7 @@ var PLATFORM_PROCEDURES = [
     title: "The DB is the source of truth \u2014 a nudge is never delivery",
     domain: "architecture",
     priority: "p0",
-    content: "Tasks live in the DB. Any nudge that reaches you out of band (a message, a hook notice, a daemon ping) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work \u2014 so it is a speedup, never delivery, and acting on one without re-reading the task row is how agents work from stale instructions. The UserPromptSubmit hook checks the DB for new tasks on every prompt; your operating procedures step 7 says check for next work. If you have no tasks, you found them all."
+    content: "Tasks live in the DB. Any nudge that reaches you out of band (a message, a hook notice, a daemon ping) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work \u2014 so it's a speedup, never delivery; acting on one without re-reading the task row means working from stale instructions. The UserPromptSubmit hook checks the DB for new tasks on every prompt; your operating procedures step 7 says check for next work. If you have no tasks, you found them all."
   },
   // --- Encryption key + cloud sync ---
   {
@@ -300,7 +306,7 @@ var PLATFORM_PROCEDURES = [
     title: "Engineering discipline \u2014 lazy ladder, surgical diffs, named failure modes",
     domain: "engineering",
     priority: "p0",
-    content: "Three rules for ALL coding work. 1. LAZY LADDER (before writing code): Stop at the first rung that works \u2014 (a) Does this need to exist? (YAGNI) (b) Already in the codebase? (search with code_context/grep) (c) stdlib or language built-in? (d) Native platform feature? (Node APIs, OS builtins) (e) Already handled by an installed dependency? (f) One-liner? (inline it, no new function/file) (g) Only then: write minimum-viable code. No scaffolding, no future-proofing. For new dependencies: justify in PR. Every dep is permanent maintenance + supply-chain surface. Prefer stdlib > existing dep > new dep. 2. SURGICAL DIFF: Diff as small as the task allows. Do NOT reformat code you didn't change. Do NOT rename/refactor outside task scope. Do NOT add 'while I\\'m here' improvements \u2014 file a separate task. Every changed line must be justifiable by the task brief. 3. NAMED FAILURE MODES (shared review vocabulary): KITCHEN SINK \u2014 added more than the task asked for. WRONG ABSTRACTION \u2014 generic solution for a specific problem; wait for the third instance. OPTIMISTIC PATH \u2014 only handled the happy path, missing error handling/edge cases. RUNAWAY REFACTOR \u2014 started fixing one thing, ended up restructuring a module. PHANTOM DEPENDENCY \u2014 added a dep that stdlib or an existing dep already covers. NULL PATCH \u2014 change has no observable effect; diagnosis was likely wrong."
+    content: "Three rules for ALL coding work. 1. LAZY LADDER (before writing code): stop at the first rung that works \u2014 (a) need this to exist? (YAGNI) (b) Already in the codebase? (code_context/grep) (c) stdlib/built-in? (d) native platform feature? (Node/OS builtins) (e) already handled by an installed dep? (f) one-liner? (inline, no new fn/file) (g) only then: write minimum-viable code, no scaffolding or future-proofing. New deps: justify in PR \u2014 permanent maintenance + supply-chain surface; prefer stdlib > existing dep > new dep. 2. SURGICAL DIFF: diff as small as the task allows. Do NOT reformat code you didn't change, rename/refactor outside scope, or add 'while I\\'m here' improvements \u2014 file a separate task. Every changed line must be justifiable by the brief. 3. NAMED FAILURE MODES (shared review vocabulary): KITCHEN SINK \u2014 added more than asked. WRONG ABSTRACTION \u2014 generic solution for a specific problem; wait for the third instance. OPTIMISTIC PATH \u2014 only the happy path, missing error handling/edge cases. RUNAWAY REFACTOR \u2014 started fixing one thing, ended up restructuring a module. PHANTOM DEPENDENCY \u2014 added a dep stdlib or an existing dep already covers. NULL PATCH \u2014 change has no observable effect; diagnosis was likely wrong."
   },
   // --- MCP operations & forensics surface ---
   {

package/dist/{chunk-KIJRAZWR.js → chunk-4J77TCTX.js}

@@ -703,7 +703,7 @@ function parseRetiredMasterKeys(raw) {
 }
 async function retiredKeyShardUsage(hexKeys) {
   try {
-    const { countShardsPerKey } = await import("./shard-manager-LRPAAQA4.js");
+    const { countShardsPerKey } = await import("./shard-manager-FH5JZRSE.js");
     return await countShardsPerKey(hexKeys);
   } catch {
     return null;

package/dist/{chunk-NHQWPKX7.js → chunk-54STF27U.js}

@@ -140,7 +140,7 @@ async function assertManifestSignature(manifest, publicKeyPem) {
       "manifest carries no `signature`. Fleets that enforce EXE_STACK_PUBLIC_KEY reject unsigned manifests, so publishing one would ship a release no host can install. Re-sign with the custodied key: node scripts/sign-stack-manifest.mjs deploy/stack-manifests/v0.9.json"
     );
   }
-  const { verifyStackManifestSignature } = await import("./stack-update-C5YKHE7A.js");
+  const { verifyStackManifestSignature } = await import("./stack-update-XXDRKGGR.js");
   try {
     verifyStackManifestSignature(manifest, publicKeyPem);
   } catch (err) {
@@ -1008,7 +1008,7 @@ async function runRegistryProxy(options = registryProxyOptionsFromEnv()) {
   await new Promise((resolve) => server.listen(options.port, options.host, resolve));
   console.log(`exe-registry-proxy listening on ${options.host ?? "0.0.0.0"}:${options.port}`);
   console.log(`proxying /v2/${options.allowedNamespace ?? "askexe"}/* -> ${options.upstream ?? "https://ghcr.io"}`);
-  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-PUQV3HSZ.js");
+  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-FDEDT4AC.js");
   const syncConfig = licenseSyncConfigFromEnv();
   if (syncConfig) {
     startLicenseSyncScheduler(syncConfig);

package/dist/{chunk-Q4GS5VW7.js → chunk-5BWDUUMH.js}

@@ -1,21 +1,21 @@
 import {
   cleanupCardsForMemories,
   cleanupGraphLinksForMemories
-} from "./chunk-XGPBHKU3.js";
+} from "./chunk-HTFM7ZDD.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-VGMACSEV.js";
 import {
   buildSystemStateExclusionFilter,
   vectorToBlob
-} from "./chunk-APVU4Q5B.js";
+} from "./chunk-LSHUX7P4.js";
 import {
   extractKeywords,
   keywordsToString
 } from "./chunk-CHCA3ZM2.js";
 import {
   isCoordinatorName
-} from "./chunk-3MDUKF3N.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/lib/consolidation.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-VYKXRSHU.js → chunk-5ZMNFSHV.js}

@@ -1,6 +1,6 @@
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-SA66WRBT.js";
+} from "./chunk-JGBYZTWH.js";
 
 // src/lib/worktree.ts
 import { execFile, execFileSync, execSync } from "child_process";

package/dist/{chunk-HNGAM3U4.js → chunk-657I6PUF.js}

@@ -1,16 +1,16 @@
 import {
   extractMemoryGraph
-} from "./chunk-LVEMYNYH.js";
+} from "./chunk-RHHEYC6H.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-APVU4Q5B.js";
+} from "./chunk-LSHUX7P4.js";
 import {
   extractKeywords
 } from "./chunk-CHCA3ZM2.js";
 import {
   getActiveAgent
-} from "./chunk-OISOA6NX.js";
+} from "./chunk-GL5ZG72X.js";
 
 // src/mcp/tools/import-conversations.ts
 import { z } from "zod";

package/dist/{chunk-OE7TAEOG.js → chunk-6777GNWI.js}

@@ -265,7 +265,7 @@ async function persistMemoryBatch(client, rows) {
   }
   const hygieneIds = inserted.filter((row) => row.supersedes_id).map((row) => row.id);
   if (hygieneIds.length > 0) {
-    const { scheduleSupersessionHygiene } = await import("./memory-maintenance-WDLL3ZX3.js");
+    const { scheduleSupersessionHygiene } = await import("./memory-maintenance-RR5UPRW3.js");
     scheduleSupersessionHygiene(hygieneIds);
   }
   return { outcomes, inserted };

package/dist/{chunk-HYZV25LY.js → chunk-67IVG6CB.js}

@@ -15,20 +15,10 @@ function stripExeMcpPrefix(toolName) {
   }
   return toolName;
 }
-function expandDualPrefixTools(shortNames) {
-  const out = [];
-  for (const name of shortNames) {
-    for (const prefix of MCP_TOOL_PREFIXES) {
-      out.push(prefix + name);
-    }
-  }
-  return out;
-}
 
 export {
   MCP_PRIMARY_KEY,
   MCP_LEGACY_KEY,
   isExeMcpTool,
-  stripExeMcpPrefix,
-  expandDualPrefixTools
+  stripExeMcpPrefix
 };

package/dist/{chunk-5N34MMKS.js → chunk-6APOLYIZ.js}

@@ -4,7 +4,7 @@ import {
 import {
   isExeMcpTool,
   stripExeMcpPrefix
-} from "./chunk-HYZV25LY.js";
+} from "./chunk-67IVG6CB.js";
 
 // src/lib/content-extractor.ts
 import { readFileSync } from "fs";
@@ -40,9 +40,47 @@ function extractSemanticText(toolName, toolInput, toolResponse) {
         extracted = extractDefault(toolName, toolInput, toolResponse);
       }
   }
-  const sanitized = redactSecrets(extracted).text;
+  const sanitized = redactSecrets(redactCommandLineSecrets(extracted).text).text;
   return sanitized.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])/g, "\uFFFD").replace(/(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "\uFFFD");
 }
+var SEGMENT = String.raw`(?:[^"'\\\s;|&<>()]|\\[\s\S]|"(?:[^"\\]|\\[\s\S])*"|'(?:[^'\\]|\\[\s\S])*')`;
+var QUOTED_OR_BARE_VALUE = String.raw`(?:(?:\\)?(?<q>["'])(?!\[REDACTED:)(?<val>(?:[^"'\\]|\\[\s\S]|(?!\k<q>)["'])*)(?:\\)?\k<q>` + SEGMENT + String.raw`*|(?!\[REDACTED:)(?<bare>[^\s"'\\;|&<>()]` + SEGMENT + String.raw`*))`;
+var KEYCHAIN_CONTEXT_RE = /\bsecurity\b[^;|&\n]*\badd-(?:generic|internet)-password\b/i;
+var KEYCHAIN_FLAG_VALUE_RE = new RegExp(
+  String.raw`(?<lead>^|[\s;|&])(?<flag>-[wp])(?<sep>\s+|=)` + QUOTED_OR_BARE_VALUE,
+  "gi"
+);
+var SECRET_FLAG_RE = new RegExp(
+  String.raw`(?<lead>^|[\s"\\])(?<flag>--(?:[a-z0-9][a-z0-9_-]{0,48})?(?:key|token|secret|passwd|password|pwd))(?<sep>=|\s+)` + QUOTED_OR_BARE_VALUE,
+  "gi"
+);
+var AUTH_HEADER_RE = /(?<lead>^|[\s"\\])(?<head>authorization\s*:\s*)(?<scheme>(?:bearer|basic|digest|token)\s+)?(?:\\)?["']?(?!\[REDACTED:)[^\s"'\\]{4,}/gi;
+function redactCommandLineSecrets(input) {
+  let text = input;
+  let redactedCount = 0;
+  const apply = (re, marker) => {
+    text = text.replace(re, (...args) => {
+      const groups = args.find(
+        (a) => typeof a === "object" && a !== null
+      );
+      redactedCount++;
+      const lead = groups?.lead ?? "";
+      if (groups?.head !== void 0) {
+        return `${lead}${groups.head}${groups.scheme ?? ""}[REDACTED:${marker}]`;
+      }
+      const flagPrefix = `${lead}${groups?.flag ?? ""}${groups?.sep ?? ""}`;
+      if (groups?.q) return `${flagPrefix}${groups.q}[REDACTED:${marker}]${groups.q}`;
+      return `${flagPrefix}[REDACTED:${marker}]`;
+    });
+  };
+  if (KEYCHAIN_CONTEXT_RE.test(text)) apply(KEYCHAIN_FLAG_VALUE_RE, "keychain_secret");
+  apply(SECRET_FLAG_RE, "flag_secret");
+  apply(AUTH_HEADER_RE, "authorization_header");
+  return { text, redactedCount };
+}
+function isSecretRedactedCapture(text) {
+  return typeof text === "string" && text.includes("[REDACTED:");
+}
 function findContainingChunk(filePath, snippet) {
   try {
     const ext = filePath.split(".").pop()?.toLowerCase();
@@ -201,5 +239,7 @@ function extractResponseText(response) {
 }
 
 export {
-  extractSemanticText
+  extractSemanticText,
+  redactCommandLineSecrets,
+  isSecretRedactedCapture
 };

package/dist/{chunk-TBYWOHTE.js → chunk-6BD6JYR2.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-TKDITWDN.js";
 import {
   ensureMemoryWriteIndex
-} from "./chunk-OE7TAEOG.js";
+} from "./chunk-6777GNWI.js";
 import {
   recordDbOpen
 } from "./chunk-5YEUPUV4.js";

package/dist/{chunk-JJYAETCO.js → chunk-6DMURUBY.js}

@@ -1,7 +1,7 @@
 import {
   orgMembershipsPath,
   readActiveOrgMemberships
-} from "./chunk-K7DAE2HO.js";
+} from "./chunk-LLZUL7M2.js";
 import {
   resolveExeDataDir
 } from "./chunk-NPXIS2RY.js";
@@ -270,7 +270,7 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
       `could not determine whether standing consent policies exist for ${orgId} (permission or I/O error checking ${consentStatePath}). Treating this as NOT cleared \u2014 they may still be armed. Re-run the departure once the file is readable.`
     );
   } else try {
-    const { clearStandingPolicies } = await import("./org-consent-policy-MSVSRI53.js");
+    const { clearStandingPolicies } = await import("./org-consent-policy-X43UGTHI.js");
     await clearStandingPolicies(orgId);
     consentCleared = true;
   } catch (err) {
@@ -289,7 +289,7 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
   }
   let pollerStopped = false;
   try {
-    const { stopOrgPartnerPollerFor } = await import("./org-partner-runtime-GN4GFWI2.js");
+    const { stopOrgPartnerPollerFor } = await import("./org-partner-runtime-UI35IHUC.js");
     pollerStopped = await stopOrgPartnerPollerFor(orgId);
   } catch (err) {
     failures.push(
@@ -298,7 +298,7 @@ async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
   }
   let seqFloor = 0;
   try {
-    const { preserveOutboundSeqFloor } = await import("./task-request-inbox-AY3C6DND.js");
+    const { preserveOutboundSeqFloor } = await import("./task-request-inbox-2TN4ZUH2.js");
     seqFloor = preserveOutboundSeqFloor(orgId);
     if (seqFloor > 0) {
       notes.push(