@askexenow/exe-os 0.9.409 → 0.9.411

package/dist/{chunk-BIV4IHED.js → chunk-JW5NUXPN.js}

@@ -7,24 +7,26 @@ import {
 } from "./chunk-S2YTU74T.js";
 import {
   createTask
-} from "./chunk-IPBNHPTE.js";
+} from "./chunk-IC2AONBH.js";
 import {
   getActiveAgent
-} from "./chunk-OISOA6NX.js";
+} from "./chunk-GL5ZG72X.js";
 import {
   deriveTaskIdempotencyKey,
   ensureEmployeeAsync,
   isEmployeeAlive,
   isExeSession,
   logTaskDispatch,
-  resolveExeSession
-} from "./chunk-XAGIZVYI.js";
+  resolveExeSession,
+  spawnOverrideNoopNotice,
+  tmuxDispatchRefusal
+} from "./chunk-GM4UEZDE.js";
 import {
   getPaneCwdAsync
 } from "./chunk-6L4VIYLZ.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-SA66WRBT.js";
+} from "./chunk-JGBYZTWH.js";
 import {
   releaseDispatchClaim,
   tryAcquireDispatchClaim,
@@ -37,7 +39,7 @@ import {
 } from "./chunk-IVXELUEQ.js";
 import {
   getLicenseSync
-} from "./chunk-EIM7OGTD.js";
+} from "./chunk-2BOLFLAU.js";
 import {
   isValidSessionScope
 } from "./chunk-BTSWFMEH.js";
@@ -46,7 +48,7 @@ import {
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-3MDUKF3N.js";
+} from "./chunk-L5JFVK5T.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -173,19 +175,6 @@ async function sessionIncarnationId(sessionName) {
   return null;
 }
 
-// src/lib/tmux-dispatch-gate.ts
-var TMUX_DISPATCH_RETIRED_MESSAGE = "tmux dispatch is retired; dispatch a named subagent: Agent(subagent_type='<name>') \u2014 worktree isolation for code, brief it with a file fence and the guardrails, and persist its result into the task checklist row + memory before you finish. task(action='create') stays a durable checklist row for tracking and never launches compute.";
-var TMUX_DISPATCH_ESCAPE_HATCH = "EXE_ALLOW_TMUX_DISPATCH";
-function isTmuxDispatchAllowed(env = process.env) {
-  return env[TMUX_DISPATCH_ESCAPE_HATCH] === "1";
-}
-function tmuxDispatchRefusal(toolName) {
-  return `${toolName}: ${TMUX_DISPATCH_RETIRED_MESSAGE} Nothing was created or dispatched.`;
-}
-function spawnOverrideNoopNotice(fields) {
-  return `Ignored ${fields.join(", ")} \u2014 ${TMUX_DISPATCH_RETIRED_MESSAGE} Set a subagent's model per employee with set_agent_config, or per dispatch with the Agent tool's own model argument.`;
-}
-
 // src/mcp/tools/create-task.ts
 var ProjectScopeCheckFailedError = class extends Error {
   constructor(message, options) {
@@ -704,7 +693,7 @@ function registerCreateTask(server, deps = {}) {
     async ({ execution_mode, title, assigned_to, project_name, priority, complexity, context, blocked_by, parent_task_id, reviewer, budget_tokens, budget_fallback_model, spawn_runtime, spawn_model, spawn_worktree, idempotency_key, idempotency_window, session_scope, work_ref, group_id, override_claim_reason }) => {
       const executionMode = execution_mode ?? "checklist";
       const isDurableTmuxDispatch = executionMode === "durable_tmux";
-      if (isDurableTmuxDispatch && !isTmuxDispatchAllowed()) {
+      if (isDurableTmuxDispatch) {
         return {
           isError: true,
           content: [{ type: "text", text: tmuxDispatchRefusal("create_task") }]
@@ -891,7 +880,7 @@ Idempotent no-op (existing task unchanged; no execution side effects)`
       let claimWarning = "";
       const claimRefRaw = (work_ref ?? "").trim();
       try {
-        const { findConflicts, findConflictsInText, describeConflict, normalizeTarget } = await import("./work-claims-OAICQBWO.js");
+        const { findConflicts, findConflictsInText, describeConflict, normalizeTarget } = await import("./work-claims-5CFMZTML.js");
         const conflicts = claimRefRaw ? await findConflicts(
           [normalizeTarget({ kind: "work_ref", value: claimRefRaw })],
           callerRoot
@@ -958,7 +947,7 @@ Nothing was created or dispatched. Either pick different work, or \u2014 if that
         });
         if (claimRefRaw) {
           try {
-            const { acquireClaim } = await import("./work-claims-OAICQBWO.js");
+            const { acquireClaim } = await import("./work-claims-5CFMZTML.js");
             const acquired = await acquireClaim({
               targets: [{ kind: "work_ref", value: claimRefRaw }],
               holderSession: callerRoot,
@@ -1154,7 +1143,7 @@ Note: ${spawnOverrideNoopNotice(ignoredSpawnOverrides)}`;
       }
       if (claimRefRaw) {
         try {
-          const { acquireClaim } = await import("./work-claims-OAICQBWO.js");
+          const { acquireClaim } = await import("./work-claims-5CFMZTML.js");
           const acquired = await acquireClaim({
             targets: [{ kind: "work_ref", value: claimRefRaw }],
             holderSession: callerRoot,
@@ -1207,7 +1196,7 @@ Claimed ${claimRefRaw} for session ${callerRoot} (claim_group ${acquired.claimGr
           session_scope: sessionScope,
           created_at: (/* @__PURE__ */ new Date()).toISOString()
         }), "utf-8");
-        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-73VEJT7Q.js");
+        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-2Z2BMMA5.js");
         recordOE({
           eventType: "signal.created",
           source: "create-task.mcp",
@@ -1240,7 +1229,7 @@ Claimed ${claimRefRaw} for session ${callerRoot} (claim_group ${acquired.claimGr
             let projectConflictOpts = {};
             try {
               const { getClient } = await import("./lib/database.js");
-              const { sessionScopeFilter } = await import("./task-scope-AMR3Z3DJ.js");
+              const { sessionScopeFilter } = await import("./task-scope-NLKUVCP5.js");
               const client = getClient();
               const scope = sessionScopeFilter(task.sessionScope || callerRoot || exeSession || null);
               const existing = await client.execute({
@@ -1536,8 +1525,6 @@ Do NOT call create_task again \u2014 that duplicates the row. Re-dispatch the EX
 }
 
 export {
-  isTmuxDispatchAllowed,
-  tmuxDispatchRefusal,
   ProjectScopeCheckFailedError,
   isSafeProjectName,
   findProjectChildDir,

package/dist/{chunk-NFNM64A7.js → chunk-K2HIXAIF.js}

@@ -2,11 +2,13 @@ import {
   buildFtsMatch,
   buildFtsMatchWithModifiers,
   extractFtsModifiers,
-  tokenizeForFts
-} from "./chunk-VMHZSZQJ.js";
+  ftsQueryTokenInRecord,
+  tokenizeForFts,
+  tokenizeForFtsTokenMatch
+} from "./chunk-3ARSKDHC.js";
 import {
   filterWikiRecallResults
-} from "./chunk-33PG3KNY.js";
+} from "./chunk-6NRZLVK3.js";
 import {
   attachDocumentMetadata,
   buildRawVisibilityFilter,
@@ -16,7 +18,7 @@ import {
   buildVisibilityTierFilter,
   buildWikiScopeFilter,
   searchMemories
-} from "./chunk-APVU4Q5B.js";
+} from "./chunk-LSHUX7P4.js";
 import {
   blobToVector
 } from "./chunk-OTVEIJUQ.js";
@@ -27,7 +29,7 @@ import {
 import {
   isExeMcpTool,
   stripExeMcpPrefix
-} from "./chunk-HYZV25LY.js";
+} from "./chunk-67IVG6CB.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
@@ -35,7 +37,7 @@ import {
   getClient,
   isFtsShadowCorruptionMessage,
   repairFtsTable
-} from "./chunk-3MDUKF3N.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/lib/memory-reads.ts
 import crypto from "crypto";
@@ -597,7 +599,7 @@ async function hybridSearch(queryText, agentId, options) {
   let rerankerAvailable = false;
   if (process.env.EXE_IS_DAEMON === "1") {
     try {
-      const { isRerankerAvailable } = await import("./reranker-W7WCJH6Y.js");
+      const { isRerankerAvailable } = await import("./reranker-LQ6OPJOI.js");
       rerankerAvailable = isRerankerAvailable();
     } catch {
     }
@@ -637,7 +639,7 @@ ${hydeDoc}`;
   if (config.fileGrepEnabled === true && !process.env.VITEST && !onFailOpenHotPath) {
     try {
       if (process.env.EXE_IS_DAEMON !== "1") {
-        const { getProjectName } = await import("./project-name-337ERIAX.js");
+        const { getProjectName } = await import("./project-name-PGJGUEJY.js");
         const projectRoot = process.cwd();
         const projectName = getProjectName(projectRoot);
         if (projectName && projectName !== "tmp") {
@@ -680,7 +682,7 @@ ${hydeDoc}`;
     runGraphArm(graphSearch(effectiveQuery, agentId, fetchOptions, Math.min(fetchLimit, 20))),
     includeStructuredCards ? (async () => {
       try {
-        const { searchMemoryCards } = await import("./memory-cards-AT3QCCWU.js");
+        const { searchMemoryCards } = await import("./memory-cards-O377ETAM.js");
         return await searchMemoryCards(effectiveQuery, agentId, fetchOptions);
       } catch {
         return [];
@@ -689,7 +691,7 @@ ${hydeDoc}`;
     // Reflection insights: patterns, contradictions, summaries across sessions
     includeStructuredCards ? (async () => {
       try {
-        const { searchReflections } = await import("./memory-reflection-N6NSYW6S.js");
+        const { searchReflections } = await import("./memory-reflection-EXNHRZL7.js");
         const insights = await searchReflections(effectiveQuery, agentId, 5, fetchOptions);
         return insights.map((ins) => ({
           id: ins.id,
@@ -801,7 +803,7 @@ ${hydeDoc}`;
   let entityBoostRan = false;
   if (merged.length > 0) {
     try {
-      const { applyEntityBoost } = await import("./entity-boost-TK43XT24.js");
+      const { applyEntityBoost } = await import("./entity-boost-OMFA5QCG.js");
       const boosted = await applyEntityBoost(merged, effectiveQuery, getClient());
       merged = boosted.results;
       graphContextMap = boosted.graphContext;
@@ -828,7 +830,7 @@ ${hydeDoc}`;
     try {
       let rerankedRecords;
       if (graphContextMap.size > 0) {
-        const { rerankWithContext } = await import("./reranker-W7WCJH6Y.js");
+        const { rerankWithContext } = await import("./reranker-LQ6OPJOI.js");
         const candidates = merged.map((m) => ({
           text: m.raw_text,
           context: graphContextMap.get(m.id)
@@ -836,7 +838,7 @@ ${hydeDoc}`;
         const scored = await rerankWithContext(effectiveQuery, candidates, rerankReturnLimit);
         rerankedRecords = scored.map((s) => merged[s.index]);
       } else {
-        const { rerank } = await import("./reranker-W7WCJH6Y.js");
+        const { rerank } = await import("./reranker-LQ6OPJOI.js");
         rerankedRecords = await rerank(effectiveQuery, merged, rerankReturnLimit);
       }
       if (rerankedRecords.length > 0) {
@@ -1080,11 +1082,13 @@ function isCapturedSearchCall(record) {
 }
 function demoteOffTopicResults(results, queryText) {
   if (results.length < 2) return results;
-  const tokens = tokenizeForFts(queryText, { minLen: 2, maxTerms: 16 });
+  const tokens = Array.from(new Set(
+    tokenizeForFts(queryText, { minLen: 2, maxTerms: 16 }).flatMap((t) => tokenizeForFtsTokenMatch(t)).filter((t) => t.length >= 2)
+  ));
   if (tokens.length === 0) return results;
   const hasQueryToken = (text) => {
-    const lower = text.toLowerCase();
-    return tokens.some((t) => lower.includes(t));
+    const recordTokens = tokenizeForFtsTokenMatch(text);
+    return tokens.some((t) => ftsQueryTokenInRecord(recordTokens, t));
   };
   const SEARCH_CALL_CAPTURE_RE = /memory\s*\(\s*action\s*[:=]?\s*["']?(recall|search)\b/i;
   const bandOf = (record) => {
@@ -1293,7 +1297,7 @@ async function lightweightSearch(queryText, agentId, options) {
   }
   if (results.length >= 2) {
     try {
-      const { recordCoActivations } = await import("./co-activation-2ZRANV3Q.js");
+      const { recordCoActivations } = await import("./co-activation-SRE6DIRX.js");
       const ids = results.slice(0, 10).map((r) => r.id);
       void recordCoActivations(ids).catch((e) => {
         try {
@@ -1309,7 +1313,7 @@ async function lightweightSearch(queryText, agentId, options) {
   }
   if (options?.includeStructuredCards !== true) return results;
   try {
-    const { searchMemoryCards } = await import("./memory-cards-AT3QCCWU.js");
+    const { searchMemoryCards } = await import("./memory-cards-O377ETAM.js");
     const cardResults = await searchMemoryCards(queryText, agentId, options);
     if (cardResults.length > 0) {
       return rrfMergeMulti([results, cardResults], limit, RRF_K, [1, 0.85]);

package/dist/{chunk-F5ZRHLG5.js → chunk-KEDZRQI3.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-ZD5TZZXU.js";
 import {
   vectorToSqlLiteral
-} from "./chunk-APVU4Q5B.js";
+} from "./chunk-LSHUX7P4.js";
 import {
   blobToVector
 } from "./chunk-OTVEIJUQ.js";
 import {
   getClient,
   sanitizeBehaviorContent
-} from "./chunk-3MDUKF3N.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/lib/behaviors.ts
 import crypto from "crypto";

package/dist/{chunk-QPMKVSHU.js → chunk-KN5GAVCG.js}

@@ -1,10 +1,10 @@
 import {
   registerScopedQueryChokepoint,
   scopedQueryChokepointStatus
-} from "./chunk-DACRR362.js";
+} from "./chunk-XQ7BIVLI.js";
 import {
   getClient
-} from "./chunk-3MDUKF3N.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/lib/org-scoped-rows.ts
 var SCOPED_QUERY_MAX_LIMIT = 200;

package/dist/{chunk-3MDUKF3N.js → chunk-L5JFVK5T.js}

@@ -7,14 +7,14 @@ import {
 import {
   listBackups,
   preBackupCheckpoint
-} from "./chunk-YUAOQJVV.js";
+} from "./chunk-SINIRUYZ.js";
 import {
   MEMORY_PROJECTION_OUTBOX_INDEX_SQL,
   MEMORY_PROJECTION_OUTBOX_TABLE_SQL,
   MEMORY_PROJECTION_OUTBOX_UNIQUE_INDEX_SQL,
   PROJECTION_CHECKPOINT_TABLE_SQL,
   ensureMemoryWriteIndex
-} from "./chunk-OE7TAEOG.js";
+} from "./chunk-6777GNWI.js";
 import {
   recordDbOpen
 } from "./chunk-5YEUPUV4.js";
@@ -1515,7 +1515,7 @@ async function migrateReflectionDedup(client) {
     "ALTER TABLE memory_reflections ADD COLUMN dedup_key TEXT",
     "migration add memory_reflections.dedup_key"
   );
-  const { reflectionDedupKey } = await import("./memory-reflection-N6NSYW6S.js");
+  const { reflectionDedupKey } = await import("./memory-reflection-EXNHRZL7.js");
   const keyForRow = (row) => {
     let sources = [];
     try {
@@ -2573,7 +2573,7 @@ async function sweepExpiredSoftDeletedMemories(client, options = {}) {
   const purgeArchived = archDays !== void 0;
   const BATCH_SIZE = 2e3;
   const MAX_BATCHES = 500;
-  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-GBA5E3QC.js");
+  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-UWOTK4AQ.js");
   const softCutoff = `-${softDays} days`;
   const selectArgsBase = [softCutoff];
   let predicate = `status = 'deleted' AND COALESCE(deleted_at, timestamp) < datetime('now', ?)`;
@@ -5014,6 +5014,7 @@ export {
   recordTriggerFire,
   disposeTurso,
   disposeDatabase,
+  IDENTITY_DIR,
   IdentityWriteError,
   identityPath,
   getIdentity,

package/dist/{chunk-FBZ32BD4.js → chunk-LBSCOP25.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-3MDUKF3N.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/lib/skill-usage.ts
 async function recordBehaviorsConsulted(behaviorIds) {

package/dist/{chunk-K7DAE2HO.js → chunk-LLZUL7M2.js}

@@ -2,7 +2,7 @@ import {
   grantsRegistryStatus,
   listGrants,
   revokeGrant
-} from "./chunk-TCV3WA5I.js";
+} from "./chunk-VAHQOIQY.js";
 import {
   resolveExeDataDir
 } from "./chunk-NPXIS2RY.js";
@@ -169,9 +169,6 @@ function orgModeAnchorState() {
   }
   return kc === "unknown" ? "unknown" : "absent";
 }
-function orgModeAnchorPresent() {
-  return orgModeAnchorState() === "present";
-}
 function writeOrgModeAnchor() {
   _anchorSeen = true;
   const setResult = keychainSet();
@@ -458,12 +455,21 @@ function stickyLatchPresent() {
     return true;
   }
 }
+var _warnedAnchorUnreadable = false;
+function warnAnchorUnreadableOnce() {
+  if (_warnedAnchorUnreadable) return;
+  _warnedAnchorUnreadable = true;
+  process.stderr.write(
+    "[exe-os] \u26A0 the out-of-data-dir org-mode anchor could not be read \u2014 treating this install as org-mode until it can be (fail closed: the founder-monitor writer stays unusable). No latch was written; this clears itself once the anchor is readable again.\n"
+  );
+}
 function orgModeActive() {
   if (_latchedOrgMode) {
     if (_quarantinePending) ensureGrantsQuarantined();
     return true;
   }
-  if (orgModeAnchorPresent()) {
+  const anchor = orgModeAnchorState();
+  if (anchor === "present") {
     _latchedOrgMode = true;
     ensureGrantsQuarantined();
     return true;
@@ -475,7 +481,13 @@ function orgModeActive() {
     return true;
   }
   const membershipsPresence = classifyPathPresence(orgMembershipsPath());
-  if (membershipsPresence === "absent") return false;
+  if (membershipsPresence === "absent") {
+    if (anchor === "unknown") {
+      warnAnchorUnreadableOnce();
+      return true;
+    }
+    return false;
+  }
   if (membershipsPresence === "inconclusive") {
     process.stderr.write(
       `[exe-os] \u26A0 org-memberships file at ${orgMembershipsPath()} could not be checked (permission or I/O error) \u2014 treating install as org-mode (fail closed: ambiguity resolves toward org mode)
@@ -539,6 +551,7 @@ function warnQuarantineDeferredOnce(msg) {
 function _resetOrgModeLatchForTest() {
   _quarantinePending = false;
   _warnedQuarantineDeferred = false;
+  _warnedAnchorUnreadable = false;
   _latchedOrgMode = false;
 }
 

package/dist/{chunk-PCFYNK7V.js → chunk-LQGLGSBY.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-4MK6LOD6.js";
 import {
   sessionScopeFilter
-} from "./chunk-XAGIZVYI.js";
+} from "./chunk-GM4UEZDE.js";
 import {
   isWithin
 } from "./chunk-YRUZK2QA.js";
@@ -297,7 +297,7 @@ async function sweepTasks(projectName, options = {}) {
     }
     if (!dryRun) {
       try {
-        const { updateTaskStatus } = await import("./tasks-crud-2GHKIZOM.js");
+        const { updateTaskStatus } = await import("./tasks-crud-NQDPLHNZ.js");
         await updateTaskStatus({
           taskId: task.id,
           status: "needs_review",

package/dist/{chunk-APVU4Q5B.js → chunk-LSHUX7P4.js}

@@ -1,6 +1,6 @@
 import {
   WORK_STATE_HEARTBEAT_TOOL
-} from "./chunk-64UAHPXA.js";
+} from "./chunk-MOBZTIJQ.js";
 import {
   extractKeywords,
   keywordsToString
@@ -11,7 +11,7 @@ import {
 import {
   findScopedDuplicate,
   governMemoryRecord
-} from "./chunk-PKM456D2.js";
+} from "./chunk-FYSKQPTE.js";
 import {
   orgBus
 } from "./chunk-MP2AFCGL.js";
@@ -22,12 +22,12 @@ import {
   initPostgresOnlyDatabase,
   initTurso,
   isDaemonRoutingActive
-} from "./chunk-3MDUKF3N.js";
+} from "./chunk-L5JFVK5T.js";
 import {
   buildMemoryInsert,
   persistMemoryBatch,
   readMemoryWriteOutcome
-} from "./chunk-OE7TAEOG.js";
+} from "./chunk-6777GNWI.js";
 import {
   memoryWriteScope,
   sameMemoryWriteScope
@@ -43,7 +43,7 @@ import {
 } from "./chunk-C7GHNJPW.js";
 import {
   getMasterKey
-} from "./chunk-KIJRAZWR.js";
+} from "./chunk-4J77TCTX.js";
 import {
   loadConfig
 } from "./chunk-MMS2HBRT.js";
@@ -93,7 +93,7 @@ function recordShardFailure(project, error) {
       `[store] Shard circuit OPEN for "${project}" after ${state.failures} consecutive failures. Will retry in ${SHARD_CB_COOLDOWN_MS / 6e4}min. Last error: ${error}
 `
     );
-    void import("./orchestration-events-73VEJT7Q.js").then(({ recordOrchestrationEventBestEffort }) => {
+    void import("./orchestration-events-2Z2BMMA5.js").then(({ recordOrchestrationEventBestEffort }) => {
       recordOrchestrationEventBestEffort({
         eventType: "shard.circuit_open",
         source: "store.recordShardFailure",
@@ -185,7 +185,7 @@ async function initStore(options) {
   if (!options?.lightweight) {
     try {
       if (process.env.EXE_DISABLE_SHARDING !== "1") {
-        const { initShardManager } = await import("./shard-manager-LRPAAQA4.js");
+        const { initShardManager } = await import("./shard-manager-FH5JZRSE.js");
         initShardManager(hexKey);
       }
     } catch (e) {
@@ -198,7 +198,7 @@ async function initStore(options) {
     );
     _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
     try {
-      const { loadGlobalProcedures } = await import("./global-procedures-T3RKI4QX.js");
+      const { loadGlobalProcedures } = await import("./global-procedures-PYNE2BQG.js");
       await loadGlobalProcedures();
     } catch (e) {
       logStoreWarn("catch", e);
@@ -319,7 +319,7 @@ async function writeMemory(record) {
     founder_id: record.founder_id ?? null
   };
   try {
-    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-TS4WNW4S.js");
+    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-Y5TTKGOP.js");
     const poisonResult = await checkMemoryPoisoning({
       memoryId: dbRow.id,
       vector: Array.isArray(dbRow.vector) ? dbRow.vector : void 0,
@@ -378,19 +378,19 @@ async function flushPendingBatch() {
   }
   if (eligibleBatch.length > 0) {
     try {
-      const { insertMemoryCardsForBatch } = await import("./memory-cards-AT3QCCWU.js");
+      const { insertMemoryCardsForBatch } = await import("./memory-cards-O377ETAM.js");
       await insertMemoryCardsForBatch(eligibleBatch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { insertOntologyForBatch } = await import("./agentic-ontology-6RS7A7KP.js");
+      const { insertOntologyForBatch } = await import("./agentic-ontology-RA6CMND6.js");
       await insertOntologyForBatch(eligibleBatch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { extractGraphForBatch } = await import("./memory-graph-extractor-B43UWGV5.js");
+      const { extractGraphForBatch } = await import("./memory-graph-extractor-4KJCCUOP.js");
       await extractGraphForBatch(eligibleBatch);
     } catch (e) {
       logStoreWarn("catch", e);
@@ -398,7 +398,7 @@ async function flushPendingBatch() {
   }
   _lastFlushShardFailures = [];
   try {
-    const { isShardingEnabled, getReadyShardClient } = await import("./shard-manager-LRPAAQA4.js");
+    const { isShardingEnabled, getReadyShardClient } = await import("./shard-manager-FH5JZRSE.js");
     if (process.env.EXE_DISABLE_SHARDING !== "1" && isShardingEnabled()) {
       const byProject = /* @__PURE__ */ new Map();
       let skippedUnknown = 0;
@@ -577,7 +577,7 @@ async function searchMemories(queryVector, agentId, options) {
   let client;
   let isMainDb = true;
   try {
-    const { isShardingEnabled, shardExists, getReadyShardClient } = await import("./shard-manager-LRPAAQA4.js");
+    const { isShardingEnabled, shardExists, getReadyShardClient } = await import("./shard-manager-FH5JZRSE.js");
     if (!options?.strictSessionScope && isShardingEnabled() && options?.projectName && shardExists(options.projectName)) {
       client = await getReadyShardClient(options.projectName);
       isMainDb = false;
@@ -616,7 +616,7 @@ async function searchMemories(queryVector, agentId, options) {
     args.push(activeEmbeddingModel);
   }
   try {
-    const { founderScopeFilter } = await import("./founder-context-QIXDZIJX.js");
+    const { founderScopeFilter } = await import("./founder-context-3X4QUWKD.js");
     const founderFilter = founderScopeFilter(options?.founderId);
     sql += founderFilter.sql;
     args.push(...founderFilter.args.filter((a) => a !== null));
@@ -700,7 +700,7 @@ async function searchMemories(queryVector, agentId, options) {
     source_type: row.source_type ?? null,
     strength: row.strength ?? 1
   }));
-  const { filterWikiRecallResults } = await import("./wiki-acl-N754BC2W.js");
+  const { filterWikiRecallResults } = await import("./wiki-acl-M7BTQJBZ.js");
   return filterWikiRecallResults(mapped, agentId);
 }
 async function attachDocumentMetadata(records) {

package/dist/{chunk-GRAMRMWS.js → chunk-M6AX64J2.js}

@@ -1,10 +1,10 @@
 import {
   getCurrentSessionScope,
   strictSessionScopeFilter
-} from "./chunk-XAGIZVYI.js";
+} from "./chunk-GM4UEZDE.js";
 import {
   getProjectName
-} from "./chunk-4Q7H3TO7.js";
+} from "./chunk-TVWYMOZ4.js";
 
 // src/lib/session-events.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-52Z435PH.js → chunk-M6SUJLNP.js}

@@ -1,9 +1,11 @@
 import {
-  extractSemanticText
-} from "./chunk-5N34MMKS.js";
+  extractSemanticText,
+  isSecretRedactedCapture,
+  redactCommandLineSecrets
+} from "./chunk-6APOLYIZ.js";
 import {
   detectError
-} from "./chunk-G2M7WQ2M.js";
+} from "./chunk-CBC3JCIF.js";
 import {
   contextualizeCapture
 } from "./chunk-5MOYSU5A.js";
@@ -12,10 +14,10 @@ import {
 } from "./chunk-BYP3DOUU.js";
 import {
   resolveExeSession
-} from "./chunk-XAGIZVYI.js";
+} from "./chunk-GM4UEZDE.js";
 import {
   getProjectName
-} from "./chunk-4Q7H3TO7.js";
+} from "./chunk-TVWYMOZ4.js";
 
 // src/lib/post-tool-memory.ts
 var NON_INGESTIBLE_TOOLS = /* @__PURE__ */ new Set([
@@ -44,16 +46,16 @@ function buildPostToolMemoryEntry(data, agent, meta) {
   if (!shouldIngestToolResult(data)) return null;
   let rawText = extractSemanticText(data.tool_name, data.tool_input, data.tool_response);
   if (rawText.trim().length < 10) {
-    const inputPreview = redactSecrets(JSON.stringify(data.tool_input ?? "").slice(0, 500)).text;
-    const outputPreview = redactSecrets(JSON.stringify(data.tool_response ?? "").slice(0, 500)).text;
+    const inputPreview = redactSecrets(redactCommandLineSecrets(JSON.stringify(data.tool_input ?? "")).text).text.slice(0, 500);
+    const outputPreview = redactSecrets(redactCommandLineSecrets(JSON.stringify(data.tool_response ?? "")).text).text.slice(0, 500);
     rawText = `Tool call: ${data.tool_name}
 Input: ${inputPreview}
 Output: ${outputPreview}`;
   }
   if (rawText.trim().length < 10) return null;
   const hasError = detectError(data);
-  const toolInputStr = redactSecrets(JSON.stringify(data.tool_input ?? "").slice(0, 200)).text;
-  const toolOutputStr = redactSecrets(JSON.stringify(data.tool_response ?? "").slice(0, 200)).text;
+  const toolInputStr = redactSecrets(redactCommandLineSecrets(JSON.stringify(data.tool_input ?? "")).text).text.slice(0, 200);
+  const toolOutputStr = redactSecrets(redactCommandLineSecrets(JSON.stringify(data.tool_response ?? "")).text).text.slice(0, 200);
   const projectName = getProjectName(data.cwd ?? process.cwd());
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
   const contextualizedRawText = contextualizeCapture(rawText, {
@@ -63,6 +65,7 @@ Output: ${outputPreview}`;
     toolName: data.tool_name
   });
   const sessionScope = resolveExeSession() ?? void 0;
+  const secretRedactionApplied = isSecretRedactedCapture(contextualizedRawText) || isSecretRedactedCapture(toolInputStr) || isSecretRedactedCapture(toolOutputStr);
   return {
     raw_text: contextualizedRawText,
     agent_id: agent.agentId,
@@ -74,13 +77,15 @@ Output: ${outputPreview}`;
     timestamp,
     ...sessionScope ? { session_scope: sessionScope } : {},
     ...meta?.subagentAgentType ? { subagent_agent_type: meta.subagentAgentType } : {},
+    ...secretRedactionApplied ? { secret_redaction_applied: true } : {},
     trajectory: JSON.stringify({
       input: toolInputStr,
       tool: data.tool_name,
       output: toolOutputStr,
       result_type: hasError ? "error" : "success",
       // Untrusted subagent name (metadata only — never the owner).
-      ...meta?.subagentAgentType ? { subagent_agent_type: meta.subagentAgentType } : {}
+      ...meta?.subagentAgentType ? { subagent_agent_type: meta.subagentAgentType } : {},
+      ...secretRedactionApplied ? { secret_redaction_applied: true } : {}
     })
   };
 }

package/dist/{chunk-GPWXUU3L.js → chunk-MZNLQC6W.js}

@@ -1,6 +1,6 @@
 import {
   getMasterKey
-} from "./chunk-KIJRAZWR.js";
+} from "./chunk-4J77TCTX.js";
 
 // src/lib/partner-sign-identity.ts
 import crypto from "crypto";