@askexenow/exe-os 0.9.69 → 0.9.70

package/dist/bin/scan-tasks.js

@@ -7912,6 +7912,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",

package/dist/bin/setup.js

@@ -6411,6 +6411,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",

package/dist/bin/shard-migrate.js

@@ -3353,6 +3353,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",

package/dist/bin/stack-update.js

@@ -150,6 +150,102 @@ function createStackUpdatePlan(manifest, envRaw, targetVersion) {
     breakingChanges: release.breakingChanges ?? []
   };
 }
+var ASKEXE_GHCR_IMAGE = /^(?:ghcr\.io\/askexe|registry\.askexe\.com\/askexe)\/[a-z0-9._/-]+(?::[^:@$/{]+|@sha256:[a-f0-9]{64})$/i;
+function validatePinnedGhcrImage(image, label) {
+  const trimmed = image.trim().replace(/^['"]|['"]$/g, "");
+  if (!trimmed) return `${label} is empty`;
+  if (trimmed.includes("${")) return null;
+  if (!trimmed.startsWith("ghcr.io/askexe/") && !trimmed.startsWith("registry.askexe.com/askexe/")) return `${label} must use ghcr.io/askexe/* or registry.askexe.com/askexe/*, got ${trimmed}`;
+  if (/:latest(?:$|[\s#])/.test(trimmed)) return `${label} must not use :latest (${trimmed})`;
+  if (!ASKEXE_GHCR_IMAGE.test(trimmed)) return `${label} must be pinned with an explicit tag or sha256 digest from ghcr.io/askexe or registry.askexe.com/askexe, got ${trimmed}`;
+  return null;
+}
+function validateComposeImageLiteral(image, label) {
+  const trimmed = image.trim().replace(/^['"]|['"]$/g, "");
+  if (!trimmed) return `${label} is empty`;
+  if (trimmed.startsWith("ghcr.io/askexe/") || trimmed.startsWith("registry.askexe.com/askexe/")) return validatePinnedGhcrImage(trimmed, label);
+  if (/^(postgres|pgvector\/pgvector|clickhouse\/clickhouse-server|redis|nginx|postgrest\/postgrest|supabase\/gotrue):[^:]+$/i.test(trimmed)) return null;
+  return `${label} uses unsupported non-AskExe image ${trimmed}; customer app images must come from pinned ghcr.io/askexe images`;
+}
+function collectProductionDeployGateIssues(plan, envRaw, composeRaw) {
+  const issues = [];
+  const env = parseEnv(envRaw);
+  for (const [serviceName, service] of Object.entries(plan.release.services)) {
+    const manifestIssue = validatePinnedGhcrImage(service.image, `manifest ${plan.targetVersion}.${serviceName}.image`);
+    if (manifestIssue) issues.push({ kind: "manifest-image", message: manifestIssue });
+    const envImage = env.get(service.env);
+    if (envImage) {
+      const envIssue = validatePinnedGhcrImage(envImage, `env ${service.env}`);
+      if (envIssue) issues.push({ kind: "env-image", message: envIssue });
+    }
+  }
+  const lines = composeRaw.split(/\r?\n/);
+  lines.forEach((line, index) => {
+    if (/^\s*build\s*:/.test(line)) {
+      issues.push({ kind: "compose-build", message: `compose line ${index + 1} contains build:, production deploys must pull images` });
+    }
+    const imageMatch = line.match(/^\s*image\s*:\s*(.+?)\s*(?:#.*)?$/);
+    if (imageMatch) {
+      const image = imageMatch[1].trim();
+      if (image.includes("${")) {
+        const fallback = image.match(/:-([^}]+)}/)?.[1];
+        if (fallback) {
+          const composeIssue = validateComposeImageLiteral(fallback, `compose image fallback on line ${index + 1}`);
+          if (composeIssue) issues.push({ kind: "compose-image", message: composeIssue });
+        }
+      } else {
+        const composeIssue = validateComposeImageLiteral(image, `compose image on line ${index + 1}`);
+        if (composeIssue) issues.push({ kind: "compose-image", message: composeIssue });
+      }
+    }
+  });
+  return issues;
+}
+function assertDeploymentScopeAllowed(plan, persona = "customer") {
+  if (persona === "askexe-control-plane") return;
+  const blocked = Object.entries(plan.release.services).filter(([, service]) => service.deploymentScope === "askexe-control-plane").map(([name]) => name);
+  if (blocked.length > 0) {
+    throw new Error(
+      `Customer deployment manifest includes AskExe control-plane service(s): ${blocked.join(", ")}. Customer VPSs may deploy customer services and optional agents only.`
+    );
+  }
+}
+function assertProductionDeployGate(plan, envRaw, composeRaw, options = {}) {
+  const issues = collectProductionDeployGateIssues(plan, envRaw, composeRaw);
+  if (issues.length === 0) return;
+  if (options.breakGlassReason?.trim()) {
+    writeBreakGlassAudit(plan, issues, options);
+    return;
+  }
+  const details = issues.map((issue) => `- [${issue.kind}] ${issue.message}`).join("\n");
+  throw new Error(
+    `Production deploy gate failed. Exe OS deploys must use pinned ghcr.io/askexe or registry.askexe.com/askexe images and must not build from source on the VPS.
+${details}
+Emergency override requires --break-glass <reason> and writes an audit file.`
+  );
+}
+function writeBreakGlassAudit(plan, issues, options) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const stamp = now().toISOString().replace(/[:.]/g, "-");
+  const defaultDir = existsSync("exe/output") ? "exe/output" : path.dirname(options.envFile ?? ".");
+  const auditFile = options.breakGlassAuditFile ?? path.join(defaultDir, `stack-update-break-glass-${stamp}.md`);
+  mkdirSync(path.dirname(auditFile), { recursive: true });
+  const body = [
+    `# Stack Update Break-Glass Audit \u2014 ${now().toISOString()}`,
+    "",
+    `Target version: ${plan.targetVersion}`,
+    `Reason: ${options.breakGlassReason?.trim()}`,
+    "",
+    "## Gate failures overridden",
+    ...issues.map((issue) => `- [${issue.kind}] ${issue.message}`),
+    "",
+    "## Required follow-up",
+    "Return this deployment to the standard pinned GHCR image path immediately after the emergency is resolved.",
+    ""
+  ].join("\n");
+  writeFileSync(auditFile, body, { mode: 384 });
+  console.warn(`[stack-update] BREAK-GLASS deploy override recorded: ${auditFile}`);
+}
 function assertBreakingChangesAllowed(plan, allowedIds) {
   const required = plan.breakingChanges.filter((c) => c.requiresConfirmation !== false);
   const missing = required.filter((c) => !allowedIds.includes(c.id));
@@ -172,6 +268,15 @@ async function runStackUpdate(options) {
   const envRaw = readFileSync(options.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, options.targetVersion);
   assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
+  assertDeploymentScopeAllowed(plan, options.deploymentPersona ?? "customer");
+  const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
+  const composeRaw = readFileSync(options.composeFile, "utf8");
+  assertProductionDeployGate(plan, plannedEnvRaw, composeRaw, {
+    breakGlassReason: options.breakGlassReason,
+    breakGlassAuditFile: options.breakGlassAuditFile,
+    now,
+    envFile: options.envFile
+  });
   const lockFile = options.lockFile ?? path.join(path.dirname(options.envFile), ".exe-stack-lock.json");
   const previousVersion = readCurrentStackVersion(lockFile);
   if (options.dryRun || plan.changes.length === 0) {
@@ -360,6 +465,7 @@ function parseArgs(args) {
     dryRun: false,
     check: false,
     rollback: false,
+    deploymentPersona: process.env.EXE_STACK_DEPLOYMENT_PERSONA === "askexe-control-plane" ? "askexe-control-plane" : "customer",
     yes: false,
     allowedBreakingChangeIds: []
   };
@@ -390,6 +496,18 @@ function parseArgs(args) {
     else if (arg === "--license-key") opts.licenseKey = next();
     else if (arg.startsWith("--license-key=")) opts.licenseKey = arg.split("=").slice(1).join("=");
     else if (arg === "--rollback") opts.rollback = true;
+    else if (arg === "--deployment-persona") {
+      const value = next();
+      if (value !== "customer" && value !== "askexe-control-plane") throw new Error(`Invalid --deployment-persona: ${value}`);
+      opts.deploymentPersona = value;
+    } else if (arg.startsWith("--deployment-persona=")) {
+      const value = arg.split("=").slice(1).join("=");
+      if (value !== "customer" && value !== "askexe-control-plane") throw new Error(`Invalid --deployment-persona: ${value}`);
+      opts.deploymentPersona = value;
+    } else if (arg === "--break-glass") opts.breakGlassReason = next();
+    else if (arg.startsWith("--break-glass=")) opts.breakGlassReason = arg.split("=").slice(1).join("=");
+    else if (arg === "--break-glass-audit-file") opts.breakGlassAuditFile = next();
+    else if (arg.startsWith("--break-glass-audit-file=")) opts.breakGlassAuditFile = arg.split("=").slice(1).join("=");
     else if (arg === "--dry-run") opts.dryRun = true;
     else if (arg === "--check") opts.check = true;
     else if (arg === "--yes" || arg === "-y") opts.yes = true;
@@ -427,6 +545,9 @@ Options:
   --device-id <id>           Device ID to include in deploy audit
   --license-key <key>        License key to include in deploy audit
   --rollback                 Restore latest backed-up .env and restart stack
+  --deployment-persona <customer|askexe-control-plane>  Scope gate (default: customer)
+  --break-glass <reason>      Emergency override for production deploy gate; writes audit file
+  --break-glass-audit-file <path>  Audit file path for --break-glass
   --allow-breaking <ids>     Confirm breaking changes, comma-separated
   -y, --yes                  Non-interactive confirmation
 `);
@@ -466,6 +587,13 @@ async function main() {
   const manifest = await loadStackManifest(opts.manifestRef, void 0, opts.manifestPublicKey, opts.manifestAuthToken);
   const envRaw = readFileSync2(opts.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, opts.targetVersion);
+  assertDeploymentScopeAllowed(plan, opts.deploymentPersona);
+  const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
+  assertProductionDeployGate(plan, plannedEnvRaw, readFileSync2(opts.composeFile, "utf8"), {
+    breakGlassReason: opts.breakGlassReason,
+    breakGlassAuditFile: opts.breakGlassAuditFile,
+    envFile: opts.envFile
+  });
   console.log(`Exe OS stack target: ${plan.targetVersion}`);
   console.log(`Manifest: ${opts.manifestRef}`);
   console.log(`Compose:  ${opts.composeFile}`);

package/dist/gateway/index.js

@@ -4793,6 +4793,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",
@@ -6151,13 +6157,25 @@ var init_wiki_client = __esm({
 
 // src/lib/code-chunker.ts
 import ts from "typescript";
+function languageForFile(filePath) {
+  const base = filePath.split(/[\\/]/).pop()?.toLowerCase() ?? "";
+  if (["dockerfile", "makefile", "rakefile", "gemfile"].includes(base)) return base;
+  const ext = base.includes(".") ? base.split(".").pop() : void 0;
+  return ext ? LANGUAGE_BY_EXTENSION[ext] : void 0;
+}
 function chunkSourceFile(source, fileName = "file.ts") {
+  const language = languageForFile(fileName);
+  if (language === "typescript" || language === "javascript") {
+    return chunkTypeScriptLike(source, fileName);
+  }
+  return chunkGenericSource(source, fileName, language);
+}
+function chunkTypeScriptLike(source, fileName) {
   const sourceFile = ts.createSourceFile(
     fileName,
     source,
     ts.ScriptTarget.Latest,
     true,
-    // setParentNodes
     fileName.endsWith(".tsx") || fileName.endsWith(".jsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS
   );
   const chunks = [];
@@ -6179,153 +6197,176 @@ function chunkSourceFile(source, fileName = "file.ts") {
     if (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node)) {
       return node.name?.getText(sourceFile) ?? "(anonymous)";
     }
-    if (ts.isClassDeclaration(node)) {
-      return node.name?.getText(sourceFile) ?? "(anonymous class)";
-    }
-    if (ts.isInterfaceDeclaration(node)) {
-      return node.name.getText(sourceFile);
-    }
-    if (ts.isTypeAliasDeclaration(node)) {
-      return node.name.getText(sourceFile);
-    }
-    if (ts.isEnumDeclaration(node)) {
-      return node.name.getText(sourceFile);
-    }
-    if (ts.isVariableStatement(node)) {
-      const decls = node.declarationList.declarations;
-      return decls.map((d) => d.name.getText(sourceFile)).join(", ");
-    }
-    if (ts.isExportAssignment(node)) {
-      return "default export";
-    }
+    if (ts.isClassDeclaration(node)) return node.name?.getText(sourceFile) ?? "(anonymous class)";
+    if (ts.isInterfaceDeclaration(node)) return node.name.getText(sourceFile);
+    if (ts.isTypeAliasDeclaration(node)) return node.name.getText(sourceFile);
+    if (ts.isEnumDeclaration(node)) return node.name.getText(sourceFile);
+    if (ts.isVariableStatement(node)) return node.declarationList.declarations.map((d) => d.name.getText(sourceFile)).join(", ");
+    if (ts.isExportAssignment(node)) return "default export";
     return "(unknown)";
   }
   function visitTopLevel(node) {
     if (ts.isImportDeclaration(node)) {
-      importLines.push({
-        start: getLineNumber(node.getStart(sourceFile)),
-        end: getLineNumber(node.getEnd())
-      });
+      importLines.push({ start: getLineNumber(node.getStart(sourceFile)), end: getLineNumber(node.getEnd()) });
       return;
     }
     if (ts.isFunctionDeclaration(node)) {
-      chunks.push({
-        kind: "function",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
+      chunks.push({ kind: "function", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
       return;
     }
     if (ts.isClassDeclaration(node)) {
-      chunks.push({
-        kind: "class",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
+      chunks.push({ kind: "class", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
       return;
     }
-    if (ts.isInterfaceDeclaration(node)) {
-      chunks.push({
-        kind: "type",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
-      return;
-    }
-    if (ts.isTypeAliasDeclaration(node)) {
-      chunks.push({
-        kind: "type",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
-      return;
-    }
-    if (ts.isEnumDeclaration(node)) {
-      chunks.push({
-        kind: "type",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
+    if (ts.isInterfaceDeclaration(node) || ts.isTypeAliasDeclaration(node) || ts.isEnumDeclaration(node)) {
+      chunks.push({ kind: "type", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
       return;
     }
     if (ts.isVariableStatement(node)) {
-      const decls = node.declarationList.declarations;
-      const isFnLike = decls.some(
-        (d) => d.initializer && (ts.isArrowFunction(d.initializer) || ts.isFunctionExpression(d.initializer))
-      );
-      chunks.push({
-        kind: isFnLike ? "function" : "variable",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
+      const isFnLike = node.declarationList.declarations.some((d) => d.initializer && (ts.isArrowFunction(d.initializer) || ts.isFunctionExpression(d.initializer)));
+      chunks.push({ kind: isFnLike ? "function" : "variable", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
       return;
     }
     if (ts.isExportAssignment(node)) {
-      chunks.push({
-        kind: "export",
-        name: "default export",
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
+      chunks.push({ kind: "export", name: "default export", text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
       return;
     }
     if (ts.isExpressionStatement(node)) {
       const text = getNodeText(node);
-      if (text.length > 10) {
-        chunks.push({
-          kind: "other",
-          name: text.slice(0, 40).replace(/\n/g, " "),
-          text,
-          startLine: getLineNumber(node.getStart(sourceFile)),
-          endLine: getLineNumber(node.getEnd())
-        });
-      }
-      return;
+      if (text.length > 10) chunks.push({ kind: "other", name: text.slice(0, 40).replace(/\n/g, " "), text, startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()) });
     }
   }
   sourceFile.statements.forEach(visitTopLevel);
   if (importLines.length > 0) {
     const startLine = importLines[0].start;
     const endLine = importLines[importLines.length - 1].end;
-    const importText = lines.slice(startLine - 1, endLine).join("\n");
-    chunks.unshift({
-      kind: "import",
-      name: `${importLines.length} imports`,
-      text: importText,
-      startLine,
+    chunks.unshift({ kind: "import", name: `${importLines.length} imports`, text: lines.slice(startLine - 1, endLine).join("\n"), startLine, endLine });
+  }
+  chunks.sort((a, b) => a.startLine - b.startLine);
+  return chunks.length > 0 ? chunks : chunkByWindows(source, 80);
+}
+function chunkGenericSource(source, _fileName, language) {
+  const lines = source.split("\n");
+  if (source.trim().length === 0) return [];
+  if (language && TEXT_LIKE_LANGUAGES.has(language)) return chunkTextLike(lines, language);
+  const chunks = [];
+  const patterns = [
+    { kind: "function", regex: /^\s*(?:async\s+)?def\s+([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "class", regex: /^\s*class\s+([A-Za-z_][\w]*)\b/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*(?:pub\s+)?fn\s+([A-Za-z_][\w]*)\s*[<(]/, name: (m) => m[1] },
+    { kind: "class", regex: /^\s*(?:pub\s+)?(?:struct|enum|trait)\s+([A-Za-z_][\w]*)\b/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*func\s+(?:\([^)]*\)\s*)?([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*(?:public|private|protected|static|final|suspend|fun|override|open|internal|export|async|func|function|subroutine)\s+.*?([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*function\s+([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "type", regex: /^\s*(?:interface|type|enum|record|data\s+class|case\s+class|contract|library)\s+([A-Za-z_][\w]*)\b/, name: (m) => m[1] },
+    { kind: "section", regex: /^\s{0,3}#{1,6}\s+(.+)$/, name: (m) => m[1].trim() }
+  ];
+  const starts = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    for (const pattern of patterns) {
+      const match = line.match(pattern.regex);
+      if (match) {
+        starts.push({ line: i + 1, kind: pattern.kind, name: pattern.name(match) });
+        break;
+      }
+    }
+  }
+  if (starts.length === 0) return chunkByWindows(source, 80);
+  for (let i = 0; i < starts.length; i++) {
+    const start = starts[i];
+    const next = starts[i + 1]?.line ?? lines.length + 1;
+    const endLine = Math.max(start.line, next - 1);
+    chunks.push({
+      kind: start.kind,
+      name: start.name,
+      text: lines.slice(start.line - 1, endLine).join("\n"),
+      startLine: start.line,
       endLine
     });
   }
-  chunks.sort((a, b) => a.startLine - b.startLine);
+  return chunks;
+}
+function chunkTextLike(lines, language) {
+  if (language === "markdown" || language === "mdx") {
+    const starts = lines.map((line, i) => ({ line, i })).filter(({ line }) => /^\s{0,3}#{1,6}\s+/.test(line));
+    if (starts.length > 0) {
+      return starts.map((start, idx) => {
+        const end = starts[idx + 1]?.i ?? lines.length;
+        const title = start.line.replace(/^\s{0,3}#{1,6}\s+/, "").trim();
+        return { kind: "section", name: title, text: lines.slice(start.i, end).join("\n"), startLine: start.i + 1, endLine: end };
+      });
+    }
+  }
+  return chunkByWindows(lines.join("\n"), 80);
+}
+function chunkByWindows(source, windowLines) {
+  const lines = source.split("\n");
+  const chunks = [];
+  for (let i = 0; i < lines.length; i += windowLines) {
+    const end = Math.min(lines.length, i + windowLines);
+    const text = lines.slice(i, end).join("\n");
+    if (text.trim()) chunks.push({ kind: "other", name: `lines ${i + 1}-${end}`, text, startLine: i + 1, endLine: end });
+  }
   return chunks;
 }
 function isChunkable(filePath) {
-  const ext = filePath.split(".").pop()?.toLowerCase();
-  return ext === "ts" || ext === "tsx" || ext === "js" || ext === "jsx";
+  return Boolean(languageForFile(filePath));
 }
+var LANGUAGE_BY_EXTENSION, TEXT_LIKE_LANGUAGES;
 var init_code_chunker = __esm({
   "src/lib/code-chunker.ts"() {
     "use strict";
+    LANGUAGE_BY_EXTENSION = {
+      c: "c",
+      cc: "cpp",
+      cpp: "cpp",
+      cxx: "cpp",
+      h: "c",
+      hh: "cpp",
+      hpp: "cpp",
+      cs: "csharp",
+      css: "css",
+      scss: "scss",
+      f: "fortran",
+      f90: "fortran",
+      f95: "fortran",
+      go: "go",
+      html: "html",
+      htm: "html",
+      java: "java",
+      js: "javascript",
+      jsx: "javascript",
+      json: "json",
+      kt: "kotlin",
+      kts: "kotlin",
+      lua: "lua",
+      md: "markdown",
+      mdx: "mdx",
+      pas: "pascal",
+      php: "php",
+      py: "python",
+      r: "r",
+      rb: "ruby",
+      rs: "rust",
+      scala: "scala",
+      sc: "scala",
+      sol: "solidity",
+      sql: "sql",
+      svelte: "svelte",
+      swift: "swift",
+      toml: "toml",
+      ts: "typescript",
+      tsx: "typescript",
+      vue: "vue",
+      xml: "xml",
+      yaml: "yaml",
+      yml: "yaml",
+      sh: "shell",
+      bash: "shell",
+      zsh: "shell"
+    };
+    TEXT_LIKE_LANGUAGES = /* @__PURE__ */ new Set(["json", "markdown", "mdx", "toml", "yaml", "xml", "html", "css", "scss", "sql"]);
   }
 });
 

package/dist/hooks/bug-report-worker.js

@@ -4535,6 +4535,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",

package/dist/hooks/codex-stop-task-finalizer.js

@@ -4218,6 +4218,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",

package/dist/hooks/commit-complete.js

@@ -7906,6 +7906,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",

package/dist/hooks/error-recall.js

@@ -4126,6 +4126,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",

package/dist/hooks/ingest.js

@@ -4302,6 +4302,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",

package/dist/hooks/instructions-loaded.js

@@ -4127,6 +4127,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",

package/dist/hooks/notification.js

@@ -4127,6 +4127,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",