@askexenow/exe-os 0.9.69 → 0.9.71

package/dist/bin/cli.js

@@ -2391,12 +2391,12 @@ function enforceBackgroundJobGuardrails(options = {}) {
   const jobs = readJobsRaw();
   const actions = [];
   let changed = false;
-  const ts = now();
+  const ts2 = now();
   for (const job of jobs) {
     if (job.status !== "running") continue;
     if (!isAlive(job.pid)) {
       job.status = "stale";
-      job.updatedAt = ts;
+      job.updatedAt = ts2;
       actions.push({ jobId: job.id, name: job.name, pid: job.pid, action: "marked-stale" });
       changed = true;
       continue;
@@ -2404,7 +2404,7 @@ function enforceBackgroundJobGuardrails(options = {}) {
     const heartbeatAge = Date.now() - Date.parse(job.lastHeartbeatAt || job.updatedAt || job.startedAt);
     if (Number.isFinite(heartbeatAge) && heartbeatAge > staleAfter) {
       job.status = "stale";
-      job.updatedAt = ts;
+      job.updatedAt = ts2;
       actions.push({ jobId: job.id, name: job.name, pid: job.pid, action: "marked-stale" });
       changed = true;
       continue;
@@ -2420,7 +2420,7 @@ function enforceBackgroundJobGuardrails(options = {}) {
         } catch {
         }
         job.status = "cancelled";
-        job.updatedAt = ts;
+        job.updatedAt = ts2;
         job.progressLabel = `Cancelled by heat guardrail after sustained high CPU (${cpu.toFixed(1)}%).`;
         releaseJobLock(job.type);
         actions.push({ jobId: job.id, name: job.name, pid: job.pid, action: "cancelled-hot", cpuPercent: cpu, heatStrikes: job.heatStrikes });
@@ -2432,7 +2432,7 @@ function enforceBackgroundJobGuardrails(options = {}) {
     }
     if (cpu >= reniceAt) {
       renicePid(job.pid, 15);
-      job.updatedAt = ts;
+      job.updatedAt = ts2;
       job.progressLabel = `Throttled by heat guardrail (${cpu.toFixed(1)}% CPU).`;
       actions.push({ jobId: job.id, name: job.name, pid: job.pid, action: "reniced", cpuPercent: cpu, heatStrikes: job.heatStrikes });
       changed = true;
@@ -2600,7 +2600,7 @@ async function tryKeytar() {
 }
 function deriveMachineKey() {
   try {
-    const crypto14 = __require("crypto");
+    const crypto15 = __require("crypto");
     const material = [
       os8.hostname(),
       os8.userInfo().username,
@@ -2609,23 +2609,23 @@ function deriveMachineKey() {
       // Machine ID on Linux (stable across reboots)
       process.platform === "linux" ? readMachineId() : ""
     ].join("|");
-    return crypto14.createHash("sha256").update(material).digest();
+    return crypto15.createHash("sha256").update(material).digest();
   } catch {
     return null;
   }
 }
 function readMachineId() {
   try {
-    const { readFileSync: readFileSync35 } = __require("fs");
-    return readFileSync35("/etc/machine-id", "utf-8").trim();
+    const { readFileSync: readFileSync36 } = __require("fs");
+    return readFileSync36("/etc/machine-id", "utf-8").trim();
   } catch {
     return "";
   }
 }
 function encryptWithMachineKey(plaintext, machineKey) {
-  const crypto14 = __require("crypto");
-  const iv = crypto14.randomBytes(12);
-  const cipher = crypto14.createCipheriv("aes-256-gcm", machineKey, iv);
+  const crypto15 = __require("crypto");
+  const iv = crypto15.randomBytes(12);
+  const cipher = crypto15.createCipheriv("aes-256-gcm", machineKey, iv);
   let encrypted = cipher.update(plaintext, "utf-8", "base64");
   encrypted += cipher.final("base64");
   const authTag = cipher.getAuthTag().toString("base64");
@@ -2634,13 +2634,13 @@ function encryptWithMachineKey(plaintext, machineKey) {
 function decryptWithMachineKey(encrypted, machineKey) {
   if (!encrypted.startsWith(ENCRYPTED_PREFIX)) return null;
   try {
-    const crypto14 = __require("crypto");
+    const crypto15 = __require("crypto");
     const parts = encrypted.slice(ENCRYPTED_PREFIX.length).split(":");
     if (parts.length !== 3) return null;
     const [ivB64, tagB64, cipherB64] = parts;
     const iv = Buffer.from(ivB64, "base64");
     const authTag = Buffer.from(tagB64, "base64");
-    const decipher = crypto14.createDecipheriv("aes-256-gcm", machineKey, iv);
+    const decipher = crypto15.createDecipheriv("aes-256-gcm", machineKey, iv);
     decipher.setAuthTag(authTag);
     let decrypted = decipher.update(cipherB64, "base64", "utf-8");
     decrypted += decipher.final("utf-8");
@@ -5043,6 +5043,33 @@ async function ensureSchema() {
     CREATE INDEX IF NOT EXISTS idx_chat_history_session
       ON chat_history(session_id, id);
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS session_events (
+      id            TEXT PRIMARY KEY,
+      agent_id      TEXT NOT NULL,
+      agent_role    TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      session_scope TEXT,
+      project_name  TEXT NOT NULL,
+      event_index   INTEGER NOT NULL,
+      event_type    TEXT NOT NULL,
+      tool_name     TEXT,
+      tool_use_id   TEXT,
+      content       TEXT NOT NULL,
+      payload_json  TEXT,
+      has_error     INTEGER NOT NULL DEFAULT 0,
+      created_at    TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_agent_time
+      ON session_events(agent_id, created_at DESC);
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_session_index
+      ON session_events(session_id, event_index);
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_scope_agent_time
+      ON session_events(session_scope, agent_id, created_at DESC);
+  `);
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS workspaces (
       id              TEXT PRIMARY KEY,
@@ -6044,8 +6071,8 @@ async function validateLicense(apiKey, deviceId) {
 }
 function getCacheAgeMs() {
   try {
-    const { statSync: statSync7 } = __require("fs");
-    const s = statSync7(CACHE_PATH);
+    const { statSync: statSync8 } = __require("fs");
+    const s = statSync8(CACHE_PATH);
     return Date.now() - s.mtimeMs;
   } catch {
     return Infinity;
@@ -6732,8 +6759,8 @@ async function withRosterLock(fn) {
   } catch (err) {
     if (err.code === "EEXIST") {
       try {
-        const ts = parseInt(readFileSync12(ROSTER_LOCK_PATH, "utf-8"), 10);
-        if (Date.now() - ts < LOCK_STALE_MS) {
+        const ts2 = parseInt(readFileSync12(ROSTER_LOCK_PATH, "utf-8"), 10);
+        if (Date.now() - ts2 < LOCK_STALE_MS) {
           throw new Error("Roster merge already in progress \u2014 another sync is running");
         }
         unlinkSync6(ROSTER_LOCK_PATH);
@@ -8657,6 +8684,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",
@@ -11085,10 +11118,10 @@ async function parseConversation(filePath) {
     if (entry.cwd && typeof entry.cwd === "string") {
       conv.cwd = entry.cwd;
     }
-    const ts = entry.timestamp;
-    if (ts) {
-      if (!conv.startTime || ts < conv.startTime) conv.startTime = ts;
-      if (!conv.endTime || ts > conv.endTime) conv.endTime = ts;
+    const ts2 = entry.timestamp;
+    if (ts2) {
+      if (!conv.startTime || ts2 < conv.startTime) conv.startTime = ts2;
+      if (!conv.endTime || ts2 > conv.endTime) conv.endTime = ts2;
     }
     const entryType = entry.type;
     if (entryType === "user") {
@@ -11774,9 +11807,9 @@ Unclassified: ${unclassified}
 }
 async function exportBatches(options) {
   const fs8 = await import("fs");
-  const path54 = await import("path");
+  const path55 = await import("path");
   const client = getClient();
-  const outDir = path54.join(process.cwd(), "exe/output/classifications/input");
+  const outDir = path55.join(process.cwd(), "exe/output/classifications/input");
   fs8.mkdirSync(outDir, { recursive: true });
   const countResult = await client.execute({
     sql: "SELECT COUNT(*) as cnt FROM memories WHERE intent IS NULL AND outcome IS NULL AND domain IS NULL",
@@ -11800,7 +11833,7 @@ async function exportBatches(options) {
       const text = String(row.text || "").replace(/\n/g, " ");
       return JSON.stringify({ id: row.id, text });
     });
-    const batchFile = path54.join(outDir, `batch-${String(batchNum).padStart(4, "0")}.jsonl`);
+    const batchFile = path55.join(outDir, `batch-${String(batchNum).padStart(4, "0")}.jsonl`);
     fs8.writeFileSync(batchFile, lines.join("\n") + "\n");
     exported += batch.rows.length;
     offset += options.batchSize;
@@ -11816,7 +11849,7 @@ async function exportBatches(options) {
 }
 async function importClassifications(importDir) {
   const fs8 = await import("fs");
-  const path54 = await import("path");
+  const path55 = await import("path");
   const client = getClient();
   const files = fs8.readdirSync(importDir).filter((f) => f.endsWith(".jsonl")).sort();
   process.stderr.write(`[backfill-metadata] Found ${files.length} JSONL files to import from ${importDir}
@@ -11824,7 +11857,7 @@ async function importClassifications(importDir) {
   let imported = 0;
   let invalid = 0;
   for (const file of files) {
-    const lines = fs8.readFileSync(path54.join(importDir, file), "utf-8").split("\n").filter(Boolean);
+    const lines = fs8.readFileSync(path55.join(importDir, file), "utf-8").split("\n").filter(Boolean);
     for (const line of lines) {
       try {
         const rec = JSON.parse(line);
@@ -14462,10 +14495,10 @@ async function disposeEmbedder() {
 async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync40 } = await import("fs");
-  const path54 = await import("path");
-  const modelPath = path54.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync40(modelPath)) {
+  const { existsSync: existsSync41 } = await import("fs");
+  const path55 = await import("path");
+  const modelPath = path55.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync41(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -17279,10 +17312,7 @@ async function renameEmployee(oldName, newName, opts = {}) {
     const newIdentityPath = path35.join(identityDir, `${newName}.md`);
     if (existsSync29(oldIdentityPath)) {
       const content = readFileSync24(oldIdentityPath, "utf-8");
-      const updatedContent = content.replace(
-        /^(agent_id:\s*)\S+/m,
-        `$1${newName}`
-      );
+      const updatedContent = rewriteRenamedEmployeeContent(content, rosterOldName, newName);
       renameSync6(oldIdentityPath, newIdentityPath);
       writeFileSync21(newIdentityPath, updatedContent, "utf-8");
       rollbackStack.push({
@@ -17299,7 +17329,9 @@ async function renameEmployee(oldName, newName, opts = {}) {
     const newAgentPath = path35.join(agentsDir, `${newName}.md`);
     if (existsSync29(oldAgentPath)) {
       const agentContent = readFileSync24(oldAgentPath, "utf-8");
+      const updatedAgentContent = rewriteRenamedEmployeeContent(agentContent, rosterOldName, newName);
       renameSync6(oldAgentPath, newAgentPath);
+      writeFileSync21(newAgentPath, updatedAgentContent, "utf-8");
       rollbackStack.push({
         description: "restore agent file",
         undo: () => {
@@ -17372,6 +17404,10 @@ async function renameEmployee(oldName, newName, opts = {}) {
     return { success: false, error: err instanceof Error ? err.message : String(err) };
   }
 }
+function rewriteRenamedEmployeeContent(content, oldName, newName) {
+  const withAgentId = content.replace(/^(agent_id:\s*)\S+/m, `$1${newName}`);
+  return personalizePrompt(withAgentId, oldName, newName);
+}
 function findExeBin2() {
   try {
     return execSync12(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
@@ -18295,8 +18331,8 @@ async function validateModel(log) {
     log("Skipping in-memory model validation (low memory \u2014 will validate on first use).");
     const modelPath = path38.join(MODELS_DIR, LOCAL_FILENAME);
     if (existsSync32(modelPath)) {
-      const { statSync: statSync7 } = await import("fs");
-      const size = statSync7(modelPath).size;
+      const { statSync: statSync8 } = await import("fs");
+      const size = statSync8(modelPath).size;
       if (size > 300 * 1e6) {
         log(`Model file verified (${(size / 1e6).toFixed(0)} MB).`);
         return;
@@ -19500,6 +19536,101 @@ function createStackUpdatePlan(manifest, envRaw, targetVersion) {
     breakingChanges: release.breakingChanges ?? []
   };
 }
+function validatePinnedGhcrImage(image, label) {
+  const trimmed = image.trim().replace(/^['"]|['"]$/g, "");
+  if (!trimmed) return `${label} is empty`;
+  if (trimmed.includes("${")) return null;
+  if (!trimmed.startsWith("ghcr.io/askexe/") && !trimmed.startsWith("registry.askexe.com/askexe/")) return `${label} must use ghcr.io/askexe/* or registry.askexe.com/askexe/*, got ${trimmed}`;
+  if (/:latest(?:$|[\s#])/.test(trimmed)) return `${label} must not use :latest (${trimmed})`;
+  if (!ASKEXE_GHCR_IMAGE.test(trimmed)) return `${label} must be pinned with an explicit tag or sha256 digest from ghcr.io/askexe or registry.askexe.com/askexe, got ${trimmed}`;
+  return null;
+}
+function validateComposeImageLiteral(image, label) {
+  const trimmed = image.trim().replace(/^['"]|['"]$/g, "");
+  if (!trimmed) return `${label} is empty`;
+  if (trimmed.startsWith("ghcr.io/askexe/") || trimmed.startsWith("registry.askexe.com/askexe/")) return validatePinnedGhcrImage(trimmed, label);
+  if (/^(postgres|pgvector\/pgvector|clickhouse\/clickhouse-server|redis|nginx|postgrest\/postgrest|supabase\/gotrue):[^:]+$/i.test(trimmed)) return null;
+  return `${label} uses unsupported non-AskExe image ${trimmed}; customer app images must come from pinned ghcr.io/askexe images`;
+}
+function collectProductionDeployGateIssues(plan, envRaw, composeRaw) {
+  const issues = [];
+  const env = parseEnv(envRaw);
+  for (const [serviceName, service] of Object.entries(plan.release.services)) {
+    const manifestIssue = validatePinnedGhcrImage(service.image, `manifest ${plan.targetVersion}.${serviceName}.image`);
+    if (manifestIssue) issues.push({ kind: "manifest-image", message: manifestIssue });
+    const envImage = env.get(service.env);
+    if (envImage) {
+      const envIssue = validatePinnedGhcrImage(envImage, `env ${service.env}`);
+      if (envIssue) issues.push({ kind: "env-image", message: envIssue });
+    }
+  }
+  const lines = composeRaw.split(/\r?\n/);
+  lines.forEach((line, index) => {
+    if (/^\s*build\s*:/.test(line)) {
+      issues.push({ kind: "compose-build", message: `compose line ${index + 1} contains build:, production deploys must pull images` });
+    }
+    const imageMatch = line.match(/^\s*image\s*:\s*(.+?)\s*(?:#.*)?$/);
+    if (imageMatch) {
+      const image = imageMatch[1].trim();
+      if (image.includes("${")) {
+        const fallback = image.match(/:-([^}]+)}/)?.[1];
+        if (fallback) {
+          const composeIssue = validateComposeImageLiteral(fallback, `compose image fallback on line ${index + 1}`);
+          if (composeIssue) issues.push({ kind: "compose-image", message: composeIssue });
+        }
+      } else {
+        const composeIssue = validateComposeImageLiteral(image, `compose image on line ${index + 1}`);
+        if (composeIssue) issues.push({ kind: "compose-image", message: composeIssue });
+      }
+    }
+  });
+  return issues;
+}
+function assertDeploymentScopeAllowed(plan, persona = "customer") {
+  if (persona === "askexe-control-plane") return;
+  const blocked = Object.entries(plan.release.services).filter(([, service]) => service.deploymentScope === "askexe-control-plane").map(([name]) => name);
+  if (blocked.length > 0) {
+    throw new Error(
+      `Customer deployment manifest includes AskExe control-plane service(s): ${blocked.join(", ")}. Customer VPSs may deploy customer services and optional agents only.`
+    );
+  }
+}
+function assertProductionDeployGate(plan, envRaw, composeRaw, options = {}) {
+  const issues = collectProductionDeployGateIssues(plan, envRaw, composeRaw);
+  if (issues.length === 0) return;
+  if (options.breakGlassReason?.trim()) {
+    writeBreakGlassAudit(plan, issues, options);
+    return;
+  }
+  const details = issues.map((issue) => `- [${issue.kind}] ${issue.message}`).join("\n");
+  throw new Error(
+    `Production deploy gate failed. Exe OS deploys must use pinned ghcr.io/askexe or registry.askexe.com/askexe images and must not build from source on the VPS.
+${details}
+Emergency override requires --break-glass <reason> and writes an audit file.`
+  );
+}
+function writeBreakGlassAudit(plan, issues, options) {
+  const now2 = options.now ?? (() => /* @__PURE__ */ new Date());
+  const stamp = now2().toISOString().replace(/[:.]/g, "-");
+  const defaultDir = existsSync34("exe/output") ? "exe/output" : path41.dirname(options.envFile ?? ".");
+  const auditFile = options.breakGlassAuditFile ?? path41.join(defaultDir, `stack-update-break-glass-${stamp}.md`);
+  mkdirSync23(path41.dirname(auditFile), { recursive: true });
+  const body = [
+    `# Stack Update Break-Glass Audit \u2014 ${now2().toISOString()}`,
+    "",
+    `Target version: ${plan.targetVersion}`,
+    `Reason: ${options.breakGlassReason?.trim()}`,
+    "",
+    "## Gate failures overridden",
+    ...issues.map((issue) => `- [${issue.kind}] ${issue.message}`),
+    "",
+    "## Required follow-up",
+    "Return this deployment to the standard pinned GHCR image path immediately after the emergency is resolved.",
+    ""
+  ].join("\n");
+  writeFileSync24(auditFile, body, { mode: 384 });
+  console.warn(`[stack-update] BREAK-GLASS deploy override recorded: ${auditFile}`);
+}
 function assertBreakingChangesAllowed(plan, allowedIds) {
   const required = plan.breakingChanges.filter((c) => c.requiresConfirmation !== false);
   const missing = required.filter((c) => !allowedIds.includes(c.id));
@@ -19522,6 +19653,15 @@ async function runStackUpdate(options) {
   const envRaw = readFileSync28(options.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, options.targetVersion);
   assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
+  assertDeploymentScopeAllowed(plan, options.deploymentPersona ?? "customer");
+  const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
+  const composeRaw = readFileSync28(options.composeFile, "utf8");
+  assertProductionDeployGate(plan, plannedEnvRaw, composeRaw, {
+    breakGlassReason: options.breakGlassReason,
+    breakGlassAuditFile: options.breakGlassAuditFile,
+    now: now2,
+    envFile: options.envFile
+  });
   const lockFile = options.lockFile ?? path41.join(path41.dirname(options.envFile), ".exe-stack-lock.json");
   const previousVersion = readCurrentStackVersion(lockFile);
   if (options.dryRun || plan.changes.length === 0) {
@@ -19693,9 +19833,11 @@ function loadDefaultPublicKey() {
   }
   return void 0;
 }
+var ASKEXE_GHCR_IMAGE;
 var init_stack_update = __esm({
   "src/lib/stack-update.ts"() {
     "use strict";
+    ASKEXE_GHCR_IMAGE = /^(?:ghcr\.io\/askexe|registry\.askexe\.com\/askexe)\/[a-z0-9._/-]+(?::[^:@$/{]+|@sha256:[a-f0-9]{64})$/i;
   }
 });
 
@@ -19720,6 +19862,7 @@ function parseArgs4(args2) {
     dryRun: false,
     check: false,
     rollback: false,
+    deploymentPersona: process.env.EXE_STACK_DEPLOYMENT_PERSONA === "askexe-control-plane" ? "askexe-control-plane" : "customer",
     yes: false,
     allowedBreakingChangeIds: []
   };
@@ -19750,6 +19893,18 @@ function parseArgs4(args2) {
     else if (arg === "--license-key") opts.licenseKey = next();
     else if (arg.startsWith("--license-key=")) opts.licenseKey = arg.split("=").slice(1).join("=");
     else if (arg === "--rollback") opts.rollback = true;
+    else if (arg === "--deployment-persona") {
+      const value = next();
+      if (value !== "customer" && value !== "askexe-control-plane") throw new Error(`Invalid --deployment-persona: ${value}`);
+      opts.deploymentPersona = value;
+    } else if (arg.startsWith("--deployment-persona=")) {
+      const value = arg.split("=").slice(1).join("=");
+      if (value !== "customer" && value !== "askexe-control-plane") throw new Error(`Invalid --deployment-persona: ${value}`);
+      opts.deploymentPersona = value;
+    } else if (arg === "--break-glass") opts.breakGlassReason = next();
+    else if (arg.startsWith("--break-glass=")) opts.breakGlassReason = arg.split("=").slice(1).join("=");
+    else if (arg === "--break-glass-audit-file") opts.breakGlassAuditFile = next();
+    else if (arg.startsWith("--break-glass-audit-file=")) opts.breakGlassAuditFile = arg.split("=").slice(1).join("=");
     else if (arg === "--dry-run") opts.dryRun = true;
     else if (arg === "--check") opts.check = true;
     else if (arg === "--yes" || arg === "-y") opts.yes = true;
@@ -19787,6 +19942,9 @@ Options:
   --device-id <id>           Device ID to include in deploy audit
   --license-key <key>        License key to include in deploy audit
   --rollback                 Restore latest backed-up .env and restart stack
+  --deployment-persona <customer|askexe-control-plane>  Scope gate (default: customer)
+  --break-glass <reason>      Emergency override for production deploy gate; writes audit file
+  --break-glass-audit-file <path>  Audit file path for --break-glass
   --allow-breaking <ids>     Confirm breaking changes, comma-separated
   -y, --yes                  Non-interactive confirmation
 `);
@@ -19826,6 +19984,13 @@ async function main6() {
   const manifest = await loadStackManifest(opts.manifestRef, void 0, opts.manifestPublicKey, opts.manifestAuthToken);
   const envRaw = readFileSync29(opts.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, opts.targetVersion);
+  assertDeploymentScopeAllowed(plan, opts.deploymentPersona);
+  const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
+  assertProductionDeployGate(plan, plannedEnvRaw, readFileSync29(opts.composeFile, "utf8"), {
+    breakGlassReason: opts.breakGlassReason,
+    breakGlassAuditFile: opts.breakGlassAuditFile,
+    envFile: opts.envFile
+  });
   console.log(`Exe OS stack target: ${plan.targetVersion}`);
   console.log(`Manifest: ${opts.manifestRef}`);
   console.log(`Compose:  ${opts.composeFile}`);
@@ -19858,6 +20023,210 @@ var init_stack_update2 = __esm({
   }
 });
 
+// src/lib/registry-proxy.ts
+import { createServer } from "http";
+import { Readable } from "stream";
+function parsePullTokens(raw) {
+  return (raw ?? "").split(/[\n,]/).map((s) => s.trim()).filter(Boolean);
+}
+function registryProxyOptionsFromEnv(env = process.env) {
+  const upstreamToken = env.EXE_REGISTRY_PROXY_UPSTREAM_TOKEN || env.GHCR_TOKEN || "";
+  const pullTokens = parsePullTokens(env.EXE_REGISTRY_PROXY_PULL_TOKENS);
+  return {
+    port: Number(env.EXE_REGISTRY_PROXY_PORT || 3201),
+    host: env.EXE_REGISTRY_PROXY_HOST || "0.0.0.0",
+    upstream: env.EXE_REGISTRY_PROXY_UPSTREAM || "https://ghcr.io",
+    upstreamUsername: env.EXE_REGISTRY_PROXY_UPSTREAM_USERNAME || env.GHCR_USERNAME || "askexe",
+    upstreamToken,
+    pullTokens,
+    allowedNamespace: env.EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE || "askexe"
+  };
+}
+function assertRegistryProxyConfig(options) {
+  if (!options.upstreamToken) throw new Error("EXE_REGISTRY_PROXY_UPSTREAM_TOKEN or GHCR_TOKEN is required");
+  if (options.pullTokens.length === 0) throw new Error("EXE_REGISTRY_PROXY_PULL_TOKENS is required");
+  if (!options.allowedNamespace || !/^[a-z0-9._-]+$/i.test(options.allowedNamespace)) {
+    throw new Error("EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE must be a registry-safe namespace");
+  }
+}
+function timingSafeIncludes(values, candidate) {
+  return values.some((value) => value === candidate);
+}
+function parseBasicAuth(header) {
+  if (!header?.startsWith("Basic ")) return null;
+  try {
+    const decoded = Buffer.from(header.slice("Basic ".length), "base64").toString("utf8");
+    const idx = decoded.indexOf(":");
+    if (idx < 0) return null;
+    return { username: decoded.slice(0, idx), password: decoded.slice(idx + 1) };
+  } catch {
+    return null;
+  }
+}
+function unauthorized(res) {
+  res.writeHead(401, {
+    "www-authenticate": 'Basic realm="AskExe Registry Proxy"',
+    "content-type": "application/json"
+  });
+  res.end(JSON.stringify({ error: "registry proxy authentication required" }));
+}
+function isAllowedPath(pathname, namespace) {
+  if (pathname === "/health") return true;
+  if (pathname === "/v2/" || pathname === "/v2") return true;
+  const prefix = `/v2/${namespace}/`;
+  if (!pathname.startsWith(prefix)) return false;
+  if (pathname.includes("..") || /%2f/i.test(pathname)) return false;
+  return true;
+}
+function parseBearerChallenge(header) {
+  if (!header?.toLowerCase().startsWith("bearer ")) return null;
+  const raw = header.slice("Bearer ".length);
+  const params = new URLSearchParams();
+  for (const part of raw.match(/(?:[^,"]+|"[^"]*")+/g) ?? []) {
+    const idx = part.indexOf("=");
+    if (idx < 0) continue;
+    const key = part.slice(0, idx).trim();
+    const value = part.slice(idx + 1).trim().replace(/^"|"$/g, "");
+    params.set(key, value);
+  }
+  const realm = params.get("realm");
+  if (!realm) return null;
+  params.delete("realm");
+  return { realm, params };
+}
+async function fetchUpstreamWithRegistryAuth(url, init, upstreamBasicAuth) {
+  const firstHeaders = new Headers(init.headers);
+  firstHeaders.set("authorization", `Basic ${upstreamBasicAuth}`);
+  const first = await fetch(url, { ...init, headers: firstHeaders });
+  if (first.status !== 401) return first;
+  const challenge = parseBearerChallenge(first.headers.get("www-authenticate"));
+  if (!challenge) return first;
+  const tokenUrl = new URL(challenge.realm);
+  for (const [key, value] of challenge.params.entries()) tokenUrl.searchParams.set(key, value);
+  const tokenRes = await fetch(tokenUrl, { headers: { authorization: `Basic ${upstreamBasicAuth}` } });
+  if (!tokenRes.ok) return first;
+  const tokenJson = await tokenRes.json();
+  const token = tokenJson.token ?? tokenJson.access_token;
+  if (!token) return first;
+  const retryHeaders = new Headers(init.headers);
+  retryHeaders.set("authorization", `Bearer ${token}`);
+  return fetch(url, { ...init, headers: retryHeaders });
+}
+function copyResponseHeaders(from, to) {
+  for (const [key, value] of from.entries()) {
+    const lower = key.toLowerCase();
+    if (["connection", "keep-alive", "transfer-encoding", "content-encoding"].includes(lower)) continue;
+    to.setHeader(key, value);
+  }
+}
+function createRegistryProxyServer(options) {
+  assertRegistryProxyConfig(options);
+  const upstream = new URL(options.upstream ?? "https://ghcr.io");
+  const namespace = options.allowedNamespace ?? "askexe";
+  const upstreamAuth = Buffer.from(`${options.upstreamUsername ?? "askexe"}:${options.upstreamToken}`).toString("base64");
+  return createServer(async (req, res) => {
+    const requestUrl = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+    if (requestUrl.pathname === "/health") {
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ ok: true, service: "exe-registry-proxy", upstream: upstream.origin, namespace }));
+      return;
+    }
+    if (!isAllowedPath(requestUrl.pathname, namespace)) {
+      res.writeHead(404, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: "registry path not allowed" }));
+      return;
+    }
+    const auth = parseBasicAuth(req.headers.authorization);
+    if (!auth || !timingSafeIncludes(options.pullTokens, auth.password)) {
+      unauthorized(res);
+      return;
+    }
+    const upstreamUrl = new URL(requestUrl.pathname + requestUrl.search, upstream.origin);
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(req.headers)) {
+      if (!value) continue;
+      const lower = key.toLowerCase();
+      if (["host", "connection", "authorization", "content-length"].includes(lower)) continue;
+      headers.set(key, Array.isArray(value) ? value.join(",") : value);
+    }
+    headers.set("authorization", `Basic ${upstreamAuth}`);
+    try {
+      const upstreamRes = await fetchUpstreamWithRegistryAuth(upstreamUrl, {
+        method: req.method,
+        headers,
+        body: req.method === "GET" || req.method === "HEAD" ? void 0 : req,
+        // Required by undici when streaming request bodies.
+        duplex: "half"
+      }, upstreamAuth);
+      res.statusCode = upstreamRes.status;
+      res.statusMessage = upstreamRes.statusText;
+      copyResponseHeaders(upstreamRes.headers, res);
+      if (!upstreamRes.body || req.method === "HEAD") {
+        res.end();
+        return;
+      }
+      Readable.fromWeb(upstreamRes.body).pipe(res);
+    } catch (err) {
+      res.writeHead(502, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: "upstream registry proxy failed", detail: err instanceof Error ? err.message : String(err) }));
+    }
+  });
+}
+async function runRegistryProxy(options = registryProxyOptionsFromEnv()) {
+  const server = createRegistryProxyServer(options);
+  await new Promise((resolve) => server.listen(options.port, options.host, resolve));
+  console.log(`exe-registry-proxy listening on ${options.host ?? "0.0.0.0"}:${options.port}`);
+  console.log(`proxying /v2/${options.allowedNamespace ?? "askexe"}/* -> ${options.upstream ?? "https://ghcr.io"}`);
+}
+var init_registry_proxy = __esm({
+  "src/lib/registry-proxy.ts"() {
+    "use strict";
+  }
+});
+
+// src/bin/registry-proxy.ts
+var registry_proxy_exports = {};
+__export(registry_proxy_exports, {
+  main: () => main7
+});
+function printHelp2() {
+  console.log(`exe-os registry-proxy \u2014 authenticated pull-through proxy for AskExe customer images
+
+Environment:
+  EXE_REGISTRY_PROXY_PORT=3201
+  EXE_REGISTRY_PROXY_HOST=0.0.0.0
+  EXE_REGISTRY_PROXY_UPSTREAM=https://ghcr.io
+  EXE_REGISTRY_PROXY_UPSTREAM_USERNAME=<github-user>
+  EXE_REGISTRY_PROXY_UPSTREAM_TOKEN=<askexe-ghcr-read-token>
+  EXE_REGISTRY_PROXY_PULL_TOKENS=<customer-token-1,customer-token-2>
+  EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE=askexe
+
+Docker image shape for clients:
+  registry.askexe.com/askexe/exed:v0.9.3
+  registry.askexe.com/askexe/exe-crm:v0.9.3
+`);
+}
+async function main7(args2 = process.argv.slice(2)) {
+  if (args2.includes("--help") || args2.includes("-h")) {
+    printHelp2();
+    return;
+  }
+  await runRegistryProxy(registryProxyOptionsFromEnv());
+}
+var init_registry_proxy2 = __esm({
+  "src/bin/registry-proxy.ts"() {
+    "use strict";
+    init_is_main();
+    init_registry_proxy();
+    if (isMainModule(import.meta.url)) {
+      main7().catch((err) => {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      });
+    }
+  }
+});
+
 // node_modules/es-toolkit/dist/function/debounce.mjs
 function debounce(func, debounceMs, { signal, edges } = {}) {
   let pendingThis = void 0;
@@ -24216,8 +24585,8 @@ var init_ErrorOverview = __esm({
     "use strict";
     init_Box();
     init_Text();
-    cleanupPath = (path54) => {
-      return path54?.replace(`file://${cwd()}/`, "");
+    cleanupPath = (path55) => {
+      return path55?.replace(`file://${cwd()}/`, "");
     };
     stackUtils = new StackUtils({
       cwd: cwd(),
@@ -26625,11 +26994,11 @@ function Footer() {
       } catch {
       }
       try {
-        const { existsSync: existsSync40 } = await import("fs");
+        const { existsSync: existsSync41 } = await import("fs");
         const { join } = await import("path");
         const home = process.env.HOME ?? "";
         const pidPath = join(home, ".exe-os", "exed.pid");
-        setDaemon(existsSync40(pidPath) ? "running" : "stopped");
+        setDaemon(existsSync41(pidPath) ? "running" : "stopped");
       } catch {
         setDaemon("unknown");
       }
@@ -29413,15 +29782,15 @@ function CommandCenterView({
         const { createPermissionsFromPreset: createPermissionsFromPreset2, EMPLOYEE_PERMISSIONS: EMPLOYEE_PERMISSIONS2 } = await Promise.resolve().then(() => (init_permissions(), permissions_exports));
         const { getPresetByRole: getPresetByRole2 } = await Promise.resolve().then(() => (init_permission_presets(), permission_presets_exports));
         const { createDefaultHooks: createDefaultHooks2 } = await Promise.resolve().then(() => (init_hooks(), hooks_exports));
-        const { readFileSync: readFileSync35, existsSync: existsSync40 } = await import("fs");
+        const { readFileSync: readFileSync36, existsSync: existsSync41 } = await import("fs");
         const { join } = await import("path");
         const { homedir: homedir8 } = await import("os");
         const configPath = join(homedir8(), ".exe-os", "config.json");
         let failoverChain = ["anthropic", "opencode", "gemini", "openai"];
         let providerConfigs = {};
-        if (existsSync40(configPath)) {
+        if (existsSync41(configPath)) {
           try {
-            const raw = JSON.parse(readFileSync35(configPath, "utf8"));
+            const raw = JSON.parse(readFileSync36(configPath, "utf8"));
             if (Array.isArray(raw.failoverChain)) failoverChain = raw.failoverChain;
             if (raw.providers && typeof raw.providers === "object") {
               providerConfigs = raw.providers;
@@ -29482,7 +29851,7 @@ function CommandCenterView({
           const markerDir = join(homedir8(), ".exe-os", "session-cache");
           const agentFiles = (await import("fs")).readdirSync(markerDir).filter((f) => f.startsWith("active-agent-"));
           for (const f of agentFiles) {
-            const data = JSON.parse(readFileSync35(join(markerDir, f), "utf8"));
+            const data = JSON.parse(readFileSync36(join(markerDir, f), "utf8"));
             if (data.agentRole) {
               agentRole = data.agentRole;
               break;
@@ -29665,7 +30034,7 @@ function CommandCenterView({
         const { listSessions: listSessions2 } = await Promise.resolve().then(() => (init_session_registry(), session_registry_exports));
         const { listTmuxSessions: listTmuxSessions2, inTmux: inTmux2 } = await Promise.resolve().then(() => (init_tmux_status(), tmux_status_exports));
         const { loadEmployees: loadEmployees2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
-        const { existsSync: existsSync40 } = await import("fs");
+        const { existsSync: existsSync41 } = await import("fs");
         const { join } = await import("path");
         const client = getClient2();
         if (!client) {
@@ -29736,7 +30105,7 @@ function CommandCenterView({
           }
           const memoryCount = memoryCounts.get(name) ?? 0;
           const openTaskCount = openTaskCounts.get(name) ?? 0;
-          const hasGit = projectDir ? existsSync40(join(projectDir, ".git")) : false;
+          const hasGit = projectDir ? existsSync41(join(projectDir, ".git")) : false;
           const type = hasGit ? "code" : memoryCount > 0 ? "code" : "automation";
           projectList.push({
             projectName: name,
@@ -29761,7 +30130,7 @@ function CommandCenterView({
         setHealth((h) => ({ ...h, memories: Number(totalResult.rows[0]?.cnt ?? 0) }));
         try {
           const pidPath = join(process.env.HOME ?? "", ".exe-os", "exed.pid");
-          setHealth((h) => ({ ...h, daemon: existsSync40(pidPath) ? "running" : "stopped" }));
+          setHealth((h) => ({ ...h, daemon: existsSync41(pidPath) ? "running" : "stopped" }));
         } catch {
         }
         const activityResult = await client.execute(
@@ -31884,12 +32253,12 @@ async function loadGatewayConfig() {
     state.running = false;
   }
   try {
-    const { existsSync: existsSync40, readFileSync: readFileSync35 } = await import("fs");
+    const { existsSync: existsSync41, readFileSync: readFileSync36 } = await import("fs");
     const { join } = await import("path");
     const home = process.env.HOME ?? "";
     const configPath = join(home, ".exe-os", "gateway.json");
-    if (existsSync40(configPath)) {
-      const raw = JSON.parse(readFileSync35(configPath, "utf8"));
+    if (existsSync41(configPath)) {
+      const raw = JSON.parse(readFileSync36(configPath, "utf8"));
       state.port = raw.port ?? 3100;
       state.gatewayUrl = raw.gatewayUrl ?? "";
       if (raw.adapters) {
@@ -32487,12 +32856,12 @@ function TeamView({ onBack, onViewSessions }) {
         setMembers(teamData);
         setDbError(null);
         try {
-          const { existsSync: existsSync40, readFileSync: readFileSync35 } = await import("fs");
+          const { existsSync: existsSync41, readFileSync: readFileSync36 } = await import("fs");
           const { join } = await import("path");
           const home = process.env.HOME ?? "";
           const gatewayConfig = join(home, ".exe-os", "gateway.json");
-          if (existsSync40(gatewayConfig)) {
-            const raw = JSON.parse(readFileSync35(gatewayConfig, "utf8"));
+          if (existsSync41(gatewayConfig)) {
+            const raw = JSON.parse(readFileSync36(gatewayConfig, "utf8"));
             if (raw.agents && raw.agents.length > 0) {
               setExternals(raw.agents.map((a) => ({
                 name: a.name,
@@ -32672,8 +33041,8 @@ __export(wiki_client_exports, {
   listDocuments: () => listDocuments,
   listWorkspaces: () => listWorkspaces
 });
-async function wikiFetch(config, path54, method = "GET", body) {
-  const url = `${config.baseUrl}/api/v1${path54}`;
+async function wikiFetch(config, path55, method = "GET", body) {
+  const url = `${config.baseUrl}/api/v1${path55}`;
   const headers = {
     Authorization: `Bearer ${config.apiKey}`,
     "Content-Type": "application/json"
@@ -32706,7 +33075,7 @@ async function wikiFetch(config, path54, method = "GET", body) {
       }
     }
     if (!response.ok) {
-      throw new Error(`Wiki API ${method} ${path54}: ${response.status} ${response.statusText}`);
+      throw new Error(`Wiki API ${method} ${path55}: ${response.status} ${response.statusText}`);
     }
     return response.json();
   } finally {
@@ -33300,12 +33669,12 @@ function SettingsView({ onBack }) {
     }
     setProviders(providerList);
     try {
-      const { existsSync: existsSync40 } = await import("fs");
+      const { existsSync: existsSync41 } = await import("fs");
       const { join } = await import("path");
       const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
       const cfg = await loadConfig2();
       const home = process.env.HOME ?? "";
-      const hasKey = existsSync40(join(home, ".exe-os", "master.key"));
+      const hasKey = existsSync41(join(home, ".exe-os", "master.key"));
       if (cfg.cloud) {
         setCloud({
           configured: true,
@@ -33318,22 +33687,22 @@ function SettingsView({ onBack }) {
       const pidPath = join(home, ".exe-os", "exed.pid");
       let daemon = "unknown";
       try {
-        daemon = existsSync40(pidPath) ? "running" : "stopped";
+        daemon = existsSync41(pidPath) ? "running" : "stopped";
       } catch {
       }
       let version = "unknown";
       try {
-        const { readFileSync: readFileSync35 } = await import("fs");
+        const { readFileSync: readFileSync36 } = await import("fs");
         const { createRequire: createRequire3 } = await import("module");
         const require2 = createRequire3(import.meta.url);
         const pkgPath = require2.resolve("@askexenow/exe-os/package.json");
-        const pkg = JSON.parse(readFileSync35(pkgPath, "utf8"));
+        const pkg = JSON.parse(readFileSync36(pkgPath, "utf8"));
         version = pkg.version;
       } catch {
         try {
-          const { readFileSync: readFileSync35 } = await import("fs");
+          const { readFileSync: readFileSync36 } = await import("fs");
           const { join: joinPath } = await import("path");
-          const pkg = JSON.parse(readFileSync35(joinPath(process.cwd(), "package.json"), "utf8"));
+          const pkg = JSON.parse(readFileSync36(joinPath(process.cwd(), "package.json"), "utf8"));
           version = pkg.version;
         } catch {
         }
@@ -33941,6 +34310,662 @@ Unhandled rejection: ${reason}
   }
 });
 
+// src/lib/code-chunker.ts
+import ts from "typescript";
+function languageForFile(filePath) {
+  const base = filePath.split(/[\\/]/).pop()?.toLowerCase() ?? "";
+  if (["dockerfile", "makefile", "rakefile", "gemfile"].includes(base)) return base;
+  const ext = base.includes(".") ? base.split(".").pop() : void 0;
+  return ext ? LANGUAGE_BY_EXTENSION[ext] : void 0;
+}
+function chunkSourceFile(source, fileName = "file.ts") {
+  const language = languageForFile(fileName);
+  if (language === "typescript" || language === "javascript") {
+    return chunkTypeScriptLike(source, fileName);
+  }
+  return chunkGenericSource(source, fileName, language);
+}
+function chunkTypeScriptLike(source, fileName) {
+  const sourceFile = ts.createSourceFile(
+    fileName,
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    fileName.endsWith(".tsx") || fileName.endsWith(".jsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS
+  );
+  const chunks = [];
+  const lines = source.split("\n");
+  const importLines = [];
+  function getLineNumber(pos) {
+    return sourceFile.getLineAndCharacterOfPosition(pos).line + 1;
+  }
+  function getLeadingComment(node) {
+    const fullText = sourceFile.getFullText();
+    const ranges = ts.getLeadingCommentRanges(fullText, node.getFullStart());
+    if (!ranges || ranges.length === 0) return void 0;
+    return ranges.map((r) => fullText.slice(r.pos, r.end)).join("\n");
+  }
+  function getNodeText(node) {
+    return node.getText(sourceFile);
+  }
+  function getName(node) {
+    if (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node)) {
+      return node.name?.getText(sourceFile) ?? "(anonymous)";
+    }
+    if (ts.isClassDeclaration(node)) return node.name?.getText(sourceFile) ?? "(anonymous class)";
+    if (ts.isInterfaceDeclaration(node)) return node.name.getText(sourceFile);
+    if (ts.isTypeAliasDeclaration(node)) return node.name.getText(sourceFile);
+    if (ts.isEnumDeclaration(node)) return node.name.getText(sourceFile);
+    if (ts.isVariableStatement(node)) return node.declarationList.declarations.map((d) => d.name.getText(sourceFile)).join(", ");
+    if (ts.isExportAssignment(node)) return "default export";
+    return "(unknown)";
+  }
+  function visitTopLevel(node) {
+    if (ts.isImportDeclaration(node)) {
+      importLines.push({ start: getLineNumber(node.getStart(sourceFile)), end: getLineNumber(node.getEnd()) });
+      return;
+    }
+    if (ts.isFunctionDeclaration(node)) {
+      chunks.push({ kind: "function", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
+      return;
+    }
+    if (ts.isClassDeclaration(node)) {
+      chunks.push({ kind: "class", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
+      return;
+    }
+    if (ts.isInterfaceDeclaration(node) || ts.isTypeAliasDeclaration(node) || ts.isEnumDeclaration(node)) {
+      chunks.push({ kind: "type", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
+      return;
+    }
+    if (ts.isVariableStatement(node)) {
+      const isFnLike = node.declarationList.declarations.some((d) => d.initializer && (ts.isArrowFunction(d.initializer) || ts.isFunctionExpression(d.initializer)));
+      chunks.push({ kind: isFnLike ? "function" : "variable", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
+      return;
+    }
+    if (ts.isExportAssignment(node)) {
+      chunks.push({ kind: "export", name: "default export", text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
+      return;
+    }
+    if (ts.isExpressionStatement(node)) {
+      const text = getNodeText(node);
+      if (text.length > 10) chunks.push({ kind: "other", name: text.slice(0, 40).replace(/\n/g, " "), text, startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()) });
+    }
+  }
+  sourceFile.statements.forEach(visitTopLevel);
+  if (importLines.length > 0) {
+    const startLine = importLines[0].start;
+    const endLine = importLines[importLines.length - 1].end;
+    chunks.unshift({ kind: "import", name: `${importLines.length} imports`, text: lines.slice(startLine - 1, endLine).join("\n"), startLine, endLine });
+  }
+  chunks.sort((a, b) => a.startLine - b.startLine);
+  return chunks.length > 0 ? chunks : chunkByWindows(source, 80);
+}
+function chunkGenericSource(source, _fileName, language) {
+  const lines = source.split("\n");
+  if (source.trim().length === 0) return [];
+  if (language && TEXT_LIKE_LANGUAGES.has(language)) return chunkTextLike(lines, language);
+  const chunks = [];
+  const patterns = [
+    { kind: "function", regex: /^\s*(?:async\s+)?def\s+([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "class", regex: /^\s*class\s+([A-Za-z_][\w]*)\b/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*(?:pub\s+)?fn\s+([A-Za-z_][\w]*)\s*[<(]/, name: (m) => m[1] },
+    { kind: "class", regex: /^\s*(?:pub\s+)?(?:struct|enum|trait)\s+([A-Za-z_][\w]*)\b/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*func\s+(?:\([^)]*\)\s*)?([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*(?:public|private|protected|static|final|suspend|fun|override|open|internal|export|async|func|function|subroutine)\s+.*?([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*function\s+([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "type", regex: /^\s*(?:interface|type|enum|record|data\s+class|case\s+class|contract|library)\s+([A-Za-z_][\w]*)\b/, name: (m) => m[1] },
+    { kind: "section", regex: /^\s{0,3}#{1,6}\s+(.+)$/, name: (m) => m[1].trim() }
+  ];
+  const starts = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    for (const pattern of patterns) {
+      const match = line.match(pattern.regex);
+      if (match) {
+        starts.push({ line: i + 1, kind: pattern.kind, name: pattern.name(match) });
+        break;
+      }
+    }
+  }
+  if (starts.length === 0) return chunkByWindows(source, 80);
+  for (let i = 0; i < starts.length; i++) {
+    const start = starts[i];
+    const next = starts[i + 1]?.line ?? lines.length + 1;
+    const endLine = Math.max(start.line, next - 1);
+    chunks.push({
+      kind: start.kind,
+      name: start.name,
+      text: lines.slice(start.line - 1, endLine).join("\n"),
+      startLine: start.line,
+      endLine
+    });
+  }
+  return chunks;
+}
+function chunkTextLike(lines, language) {
+  if (language === "markdown" || language === "mdx") {
+    const starts = lines.map((line, i) => ({ line, i })).filter(({ line }) => /^\s{0,3}#{1,6}\s+/.test(line));
+    if (starts.length > 0) {
+      return starts.map((start, idx) => {
+        const end = starts[idx + 1]?.i ?? lines.length;
+        const title = start.line.replace(/^\s{0,3}#{1,6}\s+/, "").trim();
+        return { kind: "section", name: title, text: lines.slice(start.i, end).join("\n"), startLine: start.i + 1, endLine: end };
+      });
+    }
+  }
+  return chunkByWindows(lines.join("\n"), 80);
+}
+function chunkByWindows(source, windowLines) {
+  const lines = source.split("\n");
+  const chunks = [];
+  for (let i = 0; i < lines.length; i += windowLines) {
+    const end = Math.min(lines.length, i + windowLines);
+    const text = lines.slice(i, end).join("\n");
+    if (text.trim()) chunks.push({ kind: "other", name: `lines ${i + 1}-${end}`, text, startLine: i + 1, endLine: end });
+  }
+  return chunks;
+}
+function summarizeChunk(chunk, filePath) {
+  const location = `${filePath}:${chunk.startLine}-${chunk.endLine}`;
+  const comment = chunk.comment ? chunk.comment.replace(/\/\*\*|\*\/|\*\s?/g, "").trim().split("\n")[0] : "";
+  switch (chunk.kind) {
+    case "function":
+      return `Function ${chunk.name} in ${location}${comment ? ` \u2014 ${comment}` : ""}`;
+    case "class":
+      return `Class ${chunk.name} in ${location}${comment ? ` \u2014 ${comment}` : ""}`;
+    case "type":
+      return `Type ${chunk.name} in ${location}`;
+    case "import":
+      return `Imports (${chunk.name}) in ${filePath}`;
+    case "variable":
+      return `Variable ${chunk.name} in ${location}`;
+    case "export":
+      return `Default export in ${location}`;
+    case "section":
+      return `Section ${chunk.name} in ${location}`;
+    default:
+      return `${chunk.kind} in ${location}`;
+  }
+}
+function isChunkable(filePath) {
+  return Boolean(languageForFile(filePath));
+}
+var LANGUAGE_BY_EXTENSION, TEXT_LIKE_LANGUAGES;
+var init_code_chunker = __esm({
+  "src/lib/code-chunker.ts"() {
+    "use strict";
+    LANGUAGE_BY_EXTENSION = {
+      c: "c",
+      cc: "cpp",
+      cpp: "cpp",
+      cxx: "cpp",
+      h: "c",
+      hh: "cpp",
+      hpp: "cpp",
+      cs: "csharp",
+      css: "css",
+      scss: "scss",
+      f: "fortran",
+      f90: "fortran",
+      f95: "fortran",
+      go: "go",
+      html: "html",
+      htm: "html",
+      java: "java",
+      js: "javascript",
+      jsx: "javascript",
+      json: "json",
+      kt: "kotlin",
+      kts: "kotlin",
+      lua: "lua",
+      md: "markdown",
+      mdx: "mdx",
+      pas: "pascal",
+      php: "php",
+      py: "python",
+      r: "r",
+      rb: "ruby",
+      rs: "rust",
+      scala: "scala",
+      sc: "scala",
+      sol: "solidity",
+      sql: "sql",
+      svelte: "svelte",
+      swift: "swift",
+      toml: "toml",
+      ts: "typescript",
+      tsx: "typescript",
+      vue: "vue",
+      xml: "xml",
+      yaml: "yaml",
+      yml: "yaml",
+      sh: "shell",
+      bash: "shell",
+      zsh: "shell"
+    };
+    TEXT_LIKE_LANGUAGES = /* @__PURE__ */ new Set(["json", "markdown", "mdx", "toml", "yaml", "xml", "html", "css", "scss", "sql"]);
+  }
+});
+
+// src/lib/code-context-index.ts
+var code_context_index_exports = {};
+__export(code_context_index_exports, {
+  analyzeBlastRadius: () => analyzeBlastRadius,
+  buildCodeContextIndex: () => buildCodeContextIndex,
+  getCodeContextIndexPath: () => getCodeContextIndexPath,
+  getCodeContextStats: () => getCodeContextStats,
+  loadOrBuildCodeContextIndex: () => loadOrBuildCodeContextIndex,
+  searchCodeContext: () => searchCodeContext,
+  traceCodeSymbol: () => traceCodeSymbol
+});
+import crypto14 from "crypto";
+import path50 from "path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync24, readFileSync as readFileSync31, readdirSync as readdirSync11, statSync as statSync7, writeFileSync as writeFileSync25 } from "fs";
+import { spawnSync } from "child_process";
+function normalizeProjectRoot(projectRoot) {
+  return path50.resolve(projectRoot || process.cwd());
+}
+function hashText(text) {
+  return crypto14.createHash("sha256").update(text).digest("hex");
+}
+function indexDir() {
+  const dir = path50.join(EXE_AI_DIR, "code-context");
+  mkdirSync24(dir, { recursive: true });
+  return dir;
+}
+function getCodeContextIndexPath(projectRoot) {
+  const root = normalizeProjectRoot(projectRoot);
+  const rootHash = hashText(root).slice(0, 16);
+  return path50.join(indexDir(), `${rootHash}.json`);
+}
+function currentBranch(projectRoot) {
+  const result = spawnSync("git", ["branch", "--show-current"], { cwd: projectRoot, encoding: "utf8", timeout: 2e3 });
+  const branch = result.status === 0 ? result.stdout.trim() : "";
+  return branch || "detached-or-unknown";
+}
+function shouldIgnore(relPath) {
+  const parts = relPath.split(/[\\/]/);
+  return parts.some((part) => IGNORE_SEGMENTS.has(part));
+}
+function listRecursive(projectRoot, dir = projectRoot, out = []) {
+  for (const entry of readdirSync11(dir, { withFileTypes: true })) {
+    const abs = path50.join(dir, entry.name);
+    const rel = path50.relative(projectRoot, abs).replaceAll(path50.sep, "/");
+    if (shouldIgnore(rel)) continue;
+    if (entry.isDirectory()) listRecursive(projectRoot, abs, out);
+    else if (entry.isFile()) out.push(rel);
+  }
+  return out;
+}
+function listCodeFiles(projectRoot, maxFiles) {
+  const git = spawnSync("git", ["ls-files"], { cwd: projectRoot, encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024 * 16 });
+  let files = [];
+  if (git.status === 0 && git.stdout.trim()) {
+    files = git.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+  } else {
+    const rg = spawnSync("rg", ["--files"], { cwd: projectRoot, encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024 * 16 });
+    files = rg.status === 0 && rg.stdout.trim() ? rg.stdout.split("\n").map((s) => s.trim()).filter(Boolean) : listRecursive(projectRoot);
+  }
+  return files.map((file) => file.replaceAll(path50.sep, "/")).filter((file) => isChunkable(file) && !shouldIgnore(file)).slice(0, maxFiles).sort();
+}
+function parseImportPaths(importText) {
+  const paths = [];
+  const patterns = [/from\s+["']([^"']+)["']/g, /^import\s+["']([^"']+)["']/gm, /require\(["']([^"']+)["']\)/g, /use\s+([A-Za-z0-9_:]+)::/g, /#include\s+[<"]([^>"]+)[>"]/g];
+  for (const regex of patterns) {
+    let match;
+    while ((match = regex.exec(importText)) !== null) if (!paths.includes(match[1])) paths.push(match[1]);
+  }
+  return paths;
+}
+function resolveImport(fromFile, importPath, allFiles) {
+  if (!importPath.startsWith(".")) return null;
+  const base = path50.posix.normalize(path50.posix.join(path50.posix.dirname(fromFile.replaceAll(path50.sep, "/")), importPath));
+  const withoutKnownExt = base.replace(/\.(?:[a-z0-9]+)$/i, "");
+  const candidates = [base];
+  for (const ext of ["ts", "tsx", "js", "jsx", "py", "rs", "go", "java", "cs", "cpp", "c", "rb", "php", "swift", "kt", "scala", "sql", "md", "json", "yaml", "yml"]) {
+    candidates.push(`${withoutKnownExt}.${ext}`, `${base}.${ext}`);
+  }
+  for (const indexName of ["index.ts", "index.tsx", "index.js", "mod.rs", "__init__.py"]) candidates.push(path50.posix.join(base, indexName));
+  return candidates.find((candidate) => allFiles.has(candidate)) ?? null;
+}
+function symbolId(filePath, chunk) {
+  return hashText(`${filePath}:${chunk.kind}:${chunk.name}:${chunk.startLine}:${chunk.endLine}`).slice(0, 24);
+}
+function loadIndex(projectRoot) {
+  const file = getCodeContextIndexPath(projectRoot);
+  if (!existsSync36(file)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync31(file, "utf8"));
+    if (parsed.version !== INDEX_VERSION || parsed.projectRoot !== projectRoot) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function saveIndex(index) {
+  writeFileSync25(getCodeContextIndexPath(index.projectRoot), JSON.stringify(index, null, 2));
+}
+function buildFileRecord(projectRoot, relPath, allFiles, previous) {
+  const absPath = path50.join(projectRoot, relPath);
+  let stat2;
+  try {
+    stat2 = statSync7(absPath);
+  } catch {
+    return { record: null, reused: false };
+  }
+  if (!stat2.isFile()) return { record: null, reused: false };
+  const language = languageForFile(relPath);
+  if (!language || !isChunkable(relPath)) return { record: null, reused: false };
+  const source = readFileSync31(absPath, "utf8");
+  const hash = hashText(source);
+  if (previous && previous.hash === hash && previous.mtimeMs === stat2.mtimeMs && previous.size === stat2.size && previous.language === language) {
+    return { record: previous, reused: true };
+  }
+  const chunks = chunkSourceFile(source, relPath);
+  const imports = chunks.filter((chunk) => chunk.kind === "import").flatMap((chunk) => parseImportPaths(chunk.text));
+  const resolvedImports = imports.map((importPath) => resolveImport(relPath, importPath, allFiles)).filter((file) => Boolean(file));
+  const symbols = chunks.filter((chunk) => chunk.name !== "(unknown)").map((chunk) => ({
+    id: symbolId(relPath, chunk),
+    name: chunk.name,
+    kind: chunk.kind,
+    filePath: relPath,
+    language,
+    startLine: chunk.startLine,
+    endLine: chunk.endLine,
+    summary: summarizeChunk(chunk, relPath),
+    text: chunk.text.slice(0, 8e3),
+    comment: chunk.comment
+  }));
+  return { record: { path: relPath, absPath, language, hash, mtimeMs: stat2.mtimeMs, size: stat2.size, imports, resolvedImports, symbols }, reused: false };
+}
+function buildCodeContextIndex(options = {}) {
+  const projectRoot = normalizeProjectRoot(options.projectRoot);
+  const maxFiles = options.maxFiles ?? DEFAULT_MAX_FILES;
+  const branch = currentBranch(projectRoot);
+  const previous = options.force ? null : loadIndex(projectRoot);
+  const files = listCodeFiles(projectRoot, maxFiles);
+  const allFiles = new Set(files.map((file) => file.replaceAll(path50.sep, "/")));
+  const fileRecords = {};
+  let rebuiltFiles = 0;
+  let reusedFiles = 0;
+  let skippedFiles = 0;
+  for (const rel of files) {
+    const normalized = rel.replaceAll(path50.sep, "/");
+    const { record, reused } = buildFileRecord(projectRoot, normalized, allFiles, previous?.files[normalized]);
+    if (record) {
+      fileRecords[normalized] = record;
+      if (reused) reusedFiles++;
+      else rebuiltFiles++;
+    } else skippedFiles++;
+  }
+  const languageBreakdown = {};
+  for (const file of Object.values(fileRecords)) languageBreakdown[file.language] = (languageBreakdown[file.language] ?? 0) + 1;
+  const index = {
+    version: INDEX_VERSION,
+    projectRoot,
+    rootHash: hashText(projectRoot).slice(0, 16),
+    branch,
+    indexedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    stats: { filesSeen: files.length, filesIndexed: Object.keys(fileRecords).length, rebuiltFiles, reusedFiles, skippedFiles, languageBreakdown },
+    files: fileRecords
+  };
+  saveIndex(index);
+  return index;
+}
+function loadOrBuildCodeContextIndex(options = {}) {
+  const projectRoot = normalizeProjectRoot(options.projectRoot);
+  if (!options.force) {
+    const loaded = loadIndex(projectRoot);
+    if (loaded) {
+      const currentFiles = listCodeFiles(projectRoot, options.maxFiles ?? DEFAULT_MAX_FILES);
+      const unchanged = currentFiles.every((rel) => {
+        const normalized = rel.replaceAll(path50.sep, "/");
+        const existing = loaded.files[normalized];
+        if (!existing) return false;
+        try {
+          const stat2 = statSync7(path50.join(projectRoot, normalized));
+          return stat2.mtimeMs === existing.mtimeMs && stat2.size === existing.size;
+        } catch {
+          return false;
+        }
+      });
+      if (unchanged && Object.keys(loaded.files).length === currentFiles.length) return loaded;
+    }
+  }
+  return buildCodeContextIndex(options);
+}
+function normalizeLanguage(language) {
+  return language.toLowerCase().replace(/^c\+\+$/, "cpp").replace(/^c#$/, "csharp").replace(/^js$/, "javascript").replace(/^ts$/, "typescript");
+}
+function tokenize2(query) {
+  const raw = query.toLowerCase().replace(/([a-z])([A-Z])/g, "$1 $2").split(/[^a-z0-9_.$/-]+/).map((s) => s.trim()).filter((s) => s.length >= 2);
+  const expanded = /* @__PURE__ */ new Set();
+  for (const term of raw) {
+    expanded.add(term);
+    for (const part of term.split(/[_.$/-]+/)) if (part.length >= 2) expanded.add(part);
+    const dashed = term.replace(/[_.$/]+/g, "-");
+    if (dashed.length >= 2) expanded.add(dashed);
+    if (!term.includes("-")) expanded.add(`${term}s`);
+    if (term.endsWith("s") && term.length > 3) expanded.add(term.slice(0, -1));
+  }
+  return [...expanded];
+}
+function ngrams(terms) {
+  const grams = [...terms];
+  for (let i = 0; i < terms.length - 1; i++) grams.push(`${terms[i]} ${terms[i + 1]}`);
+  return grams;
+}
+function globToRegex(pattern) {
+  let out = "";
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i];
+    const next = pattern[i + 1];
+    if (ch === "*" && next === "*") {
+      out += ".*";
+      i++;
+      continue;
+    }
+    if (ch === "*") {
+      out += "[^/]*";
+      continue;
+    }
+    if (".+^${}()|[]\\".includes(ch)) out += `\\${ch}`;
+    else out += ch;
+  }
+  return new RegExp(`^${out}$`);
+}
+function matchesPath(filePath, patterns) {
+  if (!patterns || patterns.length === 0) return true;
+  const normalized = filePath.replaceAll(path50.sep, "/");
+  return patterns.some((pattern) => {
+    const p = pattern.replaceAll(path50.sep, "/").replace(/^\.\//, "");
+    return normalized === p || normalized.startsWith(`${p}/`) || normalized.endsWith(p) || globToRegex(p).test(normalized);
+  });
+}
+function scoreSymbol(symbol, terms) {
+  const grams = ngrams(terms);
+  const haystacks = {
+    name: symbol.name.toLowerCase(),
+    path: symbol.filePath.toLowerCase(),
+    language: symbol.language.toLowerCase(),
+    summary: symbol.summary.toLowerCase(),
+    text: symbol.text.toLowerCase()
+  };
+  let score = 0;
+  const matches = [];
+  for (const term of terms) {
+    if (haystacks.name === term) {
+      score += 100;
+      matches.push(`name=${term}`);
+      continue;
+    }
+    if (haystacks.name.includes(term)) {
+      score += 45;
+      matches.push(`name~${term}`);
+    }
+    if (haystacks.path.includes(term)) {
+      score += 18;
+      matches.push(`path~${term}`);
+    }
+    if (haystacks.language === term) {
+      score += 18;
+      matches.push(`language=${term}`);
+    }
+    if (haystacks.summary.includes(term)) {
+      score += 16;
+      matches.push(`summary~${term}`);
+    }
+    if (haystacks.text.includes(term)) {
+      score += 5;
+      matches.push(`text~${term}`);
+    }
+  }
+  for (const gram of grams.filter((g) => g.includes(" "))) {
+    if (haystacks.text.includes(gram) || haystacks.summary.includes(gram)) {
+      score += 20;
+      matches.push(`phrase~${gram}`);
+    }
+  }
+  const uniqueMatches = new Set(matches.map((m) => m.replace(/^[^=~]+[=~]/, ""))).size;
+  score += uniqueMatches * 3;
+  return { score, matches };
+}
+function filteredFiles(index, options = {}) {
+  const languages = options.languages?.map(normalizeLanguage).filter(Boolean);
+  return Object.values(index.files).filter((file) => {
+    if (languages && languages.length > 0 && !languages.includes(normalizeLanguage(file.language))) return false;
+    return matchesPath(file.path, options.paths);
+  });
+}
+function searchCodeContext(query, options = {}) {
+  const terms = tokenize2(query);
+  if (terms.length === 0) return [];
+  const index = loadOrBuildCodeContextIndex({ projectRoot: options.projectRoot, force: options.force || options.refreshIndex, maxFiles: options.maxFiles });
+  const results = [];
+  for (const file of filteredFiles(index, options)) {
+    for (const symbol of file.symbols) {
+      const scored = scoreSymbol(symbol, terms);
+      if (scored.score > 0) {
+        results.push({
+          symbol,
+          score: scored.score,
+          matches: scored.matches,
+          filePath: symbol.filePath,
+          language: symbol.language,
+          content: symbol.text,
+          startLine: symbol.startLine,
+          endLine: symbol.endLine
+        });
+      }
+    }
+  }
+  const offset = Math.max(0, options.offset ?? 0);
+  const limit = options.limit ?? 20;
+  return results.sort((a, b) => b.score - a.score || a.filePath.localeCompare(b.filePath)).slice(offset, offset + limit);
+}
+function dependentsMap(index) {
+  const map = /* @__PURE__ */ new Map();
+  for (const file of Object.values(index.files)) {
+    for (const dep of file.resolvedImports) {
+      if (!map.has(dep)) map.set(dep, /* @__PURE__ */ new Set());
+      map.get(dep).add(file.path);
+    }
+  }
+  return map;
+}
+function findSymbols(index, symbolName, limit = 20) {
+  const q = symbolName.toLowerCase();
+  const exact = [];
+  const fuzzy = [];
+  for (const file of Object.values(index.files)) {
+    for (const symbol of file.symbols) {
+      if (symbol.name.toLowerCase() === q) exact.push(symbol);
+      else if (symbol.name.toLowerCase().includes(q) || symbol.summary.toLowerCase().includes(q)) fuzzy.push(symbol);
+    }
+  }
+  return [...exact, ...fuzzy].slice(0, limit);
+}
+function traceCodeSymbol(symbolName, options = {}) {
+  const index = loadOrBuildCodeContextIndex(options);
+  const matches = findSymbols(index, symbolName, options.limit ?? 20);
+  const dependents = dependentsMap(index);
+  return { query: symbolName, matches, definitions: matches.map((symbol) => {
+    const file = index.files[symbol.filePath];
+    return { symbol, imports: file.resolvedImports, dependents: [...dependents.get(symbol.filePath) ?? /* @__PURE__ */ new Set()].sort(), relatedSymbols: file.symbols.filter((s) => s.id !== symbol.id).slice(0, 20) };
+  }) };
+}
+function resolveTargetFile(index, input) {
+  if (input.filePath) {
+    const normalized = input.filePath.replaceAll(path50.sep, "/").replace(/^\.\//, "");
+    if (index.files[normalized]) return { filePath: normalized, target: normalized };
+    const suffix = Object.keys(index.files).find((file) => file.endsWith(normalized));
+    if (suffix) return { filePath: suffix, target: input.filePath };
+  }
+  if (input.symbol) {
+    const match = findSymbols(index, input.symbol, 1)[0];
+    if (match) return { filePath: match.filePath, target: input.symbol };
+  }
+  return null;
+}
+function analyzeBlastRadius(input) {
+  const index = loadOrBuildCodeContextIndex({ projectRoot: input.projectRoot, force: input.force });
+  const target = resolveTargetFile(index, { filePath: input.filePath, symbol: input.symbol });
+  if (!target) return null;
+  const dependents = dependentsMap(index);
+  const maxDepth = input.depth ?? 2;
+  const impacted = /* @__PURE__ */ new Map();
+  const queue = [{ filePath: target.filePath, distance: 0 }];
+  impacted.set(target.filePath, { distance: 0, reason: "target" });
+  while (queue.length > 0) {
+    const item = queue.shift();
+    if (item.distance >= maxDepth) continue;
+    for (const dep of dependents.get(item.filePath) ?? []) {
+      if (!impacted.has(dep)) {
+        impacted.set(dep, { distance: item.distance + 1, reason: `imports ${item.filePath}` });
+        queue.push({ filePath: dep, distance: item.distance + 1 });
+      }
+    }
+  }
+  const targetBase = path50.basename(target.filePath).replace(/\.[^.]+$/, "").toLowerCase();
+  const symbolLower = input.symbol?.toLowerCase();
+  const tests = Object.keys(index.files).filter((file) => {
+    const lower = file.toLowerCase();
+    return (lower.includes("test") || lower.includes("spec")) && (lower.includes(targetBase) || (symbolLower ? index.files[file].symbols.some((s) => s.text.toLowerCase().includes(symbolLower)) : false));
+  });
+  for (const test of tests) if (!impacted.has(test)) impacted.set(test, { distance: 1, reason: "related test/spec" });
+  const impactedFiles = [...impacted.entries()].map(([filePath, value]) => ({ filePath, distance: value.distance, reason: value.reason })).sort((a, b) => a.distance - b.distance || a.filePath.localeCompare(b.filePath));
+  const nonTestImpacted = impactedFiles.filter((f) => !f.filePath.match(/(test|spec)\./i)).length;
+  return { target: target.target, targetFile: target.filePath, impactedFiles, tests, symbolsInTarget: index.files[target.filePath]?.symbols ?? [], riskLevel: nonTestImpacted >= 8 ? "high" : nonTestImpacted >= 4 ? "medium" : "low" };
+}
+function getCodeContextStats(options = {}) {
+  const index = loadOrBuildCodeContextIndex(options);
+  return {
+    projectRoot: index.projectRoot,
+    branch: index.branch,
+    indexedAt: index.indexedAt,
+    indexAgeMs: Math.max(0, Date.now() - Date.parse(index.indexedAt)),
+    files: Object.keys(index.files).length,
+    symbols: Object.values(index.files).reduce((sum, file) => sum + file.symbols.length, 0),
+    imports: Object.values(index.files).reduce((sum, file) => sum + file.resolvedImports.length, 0),
+    languageBreakdown: index.stats.languageBreakdown,
+    rebuiltFiles: index.stats.rebuiltFiles,
+    reusedFiles: index.stats.reusedFiles,
+    skippedFiles: index.stats.skippedFiles,
+    indexPath: getCodeContextIndexPath(index.projectRoot)
+  };
+}
+var INDEX_VERSION, DEFAULT_MAX_FILES, IGNORE_SEGMENTS;
+var init_code_context_index = __esm({
+  "src/lib/code-context-index.ts"() {
+    "use strict";
+    init_config();
+    init_code_chunker();
+    INDEX_VERSION = 2;
+    DEFAULT_MAX_FILES = 5e3;
+    IGNORE_SEGMENTS = /* @__PURE__ */ new Set(["node_modules", "dist", ".git", "coverage", ".worktrees", ".next", "build", "target", "vendor"]);
+  }
+});
+
 // src/adapters/opencode/plugin-template.ts
 var PLUGIN_TEMPLATE;
 var init_plugin_template = __esm({
@@ -34134,16 +35159,16 @@ __export(installer_exports2, {
   verifyOpenCodeHooks: () => verifyOpenCodeHooks
 });
 import { readFile as readFile7, writeFile as writeFile8, mkdir as mkdir8 } from "fs/promises";
-import { existsSync as existsSync36, readFileSync as readFileSync31 } from "fs";
-import path50 from "path";
+import { existsSync as existsSync37, readFileSync as readFileSync32 } from "fs";
+import path51 from "path";
 import os22 from "os";
 async function registerOpenCodeMcp(packageRoot, homeDir = os22.homedir()) {
   void packageRoot;
-  const configDir = path50.join(homeDir, ".config", "opencode");
-  const configPath = path50.join(configDir, "opencode.json");
+  const configDir = path51.join(homeDir, ".config", "opencode");
+  const configPath = path51.join(configDir, "opencode.json");
   await mkdir8(configDir, { recursive: true });
   let config = {};
-  if (existsSync36(configPath)) {
+  if (existsSync37(configPath)) {
     try {
       config = JSON.parse(await readFile7(configPath, "utf-8"));
     } catch {
@@ -34171,14 +35196,14 @@ async function registerOpenCodeMcp(packageRoot, homeDir = os22.homedir()) {
   return true;
 }
 async function installOpenCodePlugin(packageRoot, homeDir = os22.homedir()) {
-  const pluginDir = path50.join(homeDir, ".config", "opencode", "plugins");
-  const pluginPath = path50.join(pluginDir, "exe-os.mjs");
+  const pluginDir = path51.join(homeDir, ".config", "opencode", "plugins");
+  const pluginPath = path51.join(pluginDir, "exe-os.mjs");
   await mkdir8(pluginDir, { recursive: true });
   const pluginContent = PLUGIN_TEMPLATE.replace(
     /__PACKAGE_ROOT__/g,
     packageRoot.replace(/\\/g, "\\\\")
   );
-  if (existsSync36(pluginPath)) {
+  if (existsSync37(pluginPath)) {
     const existing = await readFile7(pluginPath, "utf-8");
     if (existing === pluginContent) {
       return false;
@@ -34188,18 +35213,18 @@ async function installOpenCodePlugin(packageRoot, homeDir = os22.homedir()) {
   return true;
 }
 function verifyOpenCodeHooks(homeDir = os22.homedir()) {
-  const configPath = path50.join(homeDir, ".config", "opencode", "opencode.json");
-  const pluginPath = path50.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
-  if (!existsSync36(configPath)) return false;
+  const configPath = path51.join(homeDir, ".config", "opencode", "opencode.json");
+  const pluginPath = path51.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
+  if (!existsSync37(configPath)) return false;
   try {
-    const config = JSON.parse(readFileSync31(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync32(configPath, "utf-8"));
     if (!config.mcp?.["exe-os"]?.enabled) return false;
   } catch {
     return false;
   }
-  if (!existsSync36(pluginPath)) return false;
+  if (!existsSync37(pluginPath)) return false;
   try {
-    const plugin = readFileSync31(pluginPath, "utf-8");
+    const plugin = readFileSync32(pluginPath, "utf-8");
     if (!plugin.includes(EXE_HOOK_FILES.postToolCombined)) return false;
     if (textHasLegacySplitPostToolHook(plugin)) return false;
   } catch {
@@ -34241,19 +35266,19 @@ __export(installer_exports3, {
   verifyCodexHooks: () => verifyCodexHooks
 });
 import { readFile as readFile8, writeFile as writeFile9, mkdir as mkdir9 } from "fs/promises";
-import { existsSync as existsSync37, readFileSync as readFileSync32 } from "fs";
-import path51 from "path";
+import { existsSync as existsSync38, readFileSync as readFileSync33 } from "fs";
+import path52 from "path";
 import os23 from "os";
 async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
-  const codexDir = path51.join(homeDir, ".codex");
-  const hooksPath = path51.join(codexDir, "hooks.json");
-  const logsDir = path51.join(homeDir, ".exe-os", "logs");
-  const hookLogPath = path51.join(logsDir, "hooks.log");
+  const codexDir = path52.join(homeDir, ".codex");
+  const hooksPath = path52.join(codexDir, "hooks.json");
+  const logsDir = path52.join(homeDir, ".exe-os", "logs");
+  const hookLogPath = path52.join(logsDir, "hooks.log");
   const logSuffix = ` 2>> "${hookLogPath}"`;
   await mkdir9(codexDir, { recursive: true });
   await mkdir9(logsDir, { recursive: true });
   let hooksJson = {};
-  if (existsSync37(hooksPath)) {
+  if (existsSync38(hooksPath)) {
     try {
       hooksJson = JSON.parse(await readFile8(hooksPath, "utf-8"));
     } catch {
@@ -34273,7 +35298,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
             // Combined hook: runs ingest + error-recall in one Node process.
             // Eliminates a cold-start cycle per tool call (~3-6s savings on Codex).
             type: "command",
-            command: `node "${path51.join(packageRoot, "dist", "hooks", "post-tool-combined.js")}"${logSuffix}`
+            command: `node "${path52.join(packageRoot, "dist", "hooks", "post-tool-combined.js")}"${logSuffix}`
           }
         ]
       },
@@ -34287,7 +35312,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
             // Single hook: prompt-submit handles memory retrieval + entity boost.
             // exe-heartbeat-hook is CC-specific (intercom) — omitted on Codex.
             type: "command",
-            command: `node "${path51.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
+            command: `node "${path52.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
           }
         ]
       },
@@ -34299,7 +35324,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path51.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
+            command: `node "${path52.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
           }
         ]
       },
@@ -34312,7 +35337,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path51.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
+            command: `node "${path52.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
           }
         ]
       },
@@ -34361,10 +35386,10 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
   return { added, skipped };
 }
 function verifyCodexHooks(homeDir = os23.homedir()) {
-  const hooksPath = path51.join(homeDir, ".codex", "hooks.json");
-  if (!existsSync37(hooksPath)) return false;
+  const hooksPath = path52.join(homeDir, ".codex", "hooks.json");
+  if (!existsSync38(hooksPath)) return false;
   try {
-    const hooksJson = JSON.parse(readFileSync32(hooksPath, "utf-8"));
+    const hooksJson = JSON.parse(readFileSync33(hooksPath, "utf-8"));
     if (!hooksJson.hooks) return false;
     const required = ["PostToolUse", "UserPromptSubmit", "Stop", "PreToolUse"];
     for (const event of required) {
@@ -34396,11 +35421,11 @@ function verifyCodexHooks(homeDir = os23.homedir()) {
 async function installCodexStatusLine(homeDir = os23.homedir()) {
   const prefs = loadPreferences(homeDir);
   if (prefs.codexStatusLine === false) return "opted-out";
-  const codexDir = path51.join(homeDir, ".codex");
-  const configPath = path51.join(codexDir, "config.toml");
+  const codexDir = path52.join(homeDir, ".codex");
+  const configPath = path52.join(codexDir, "config.toml");
   await mkdir9(codexDir, { recursive: true });
   let content = "";
-  if (existsSync37(configPath)) {
+  if (existsSync38(configPath)) {
     content = await readFile8(configPath, "utf-8");
     if (/\[tui\][\s\S]*?status_line\s*=/.test(content)) {
       return "already-configured";
@@ -34452,12 +35477,12 @@ ${line}
   return { content: next, changed: next !== sectionContent };
 }
 async function registerCodexMcpServer(packageRoot, homeDir = os23.homedir()) {
-  const codexDir = path51.join(homeDir, ".codex");
-  const configPath = path51.join(codexDir, "config.toml");
+  const codexDir = path52.join(homeDir, ".codex");
+  const configPath = path52.join(codexDir, "config.toml");
   void packageRoot;
   await mkdir9(codexDir, { recursive: true });
   let content = "";
-  if (existsSync37(configPath)) {
+  if (existsSync38(configPath)) {
     content = await readFile8(configPath, "utf-8");
   }
   const sectionHeader = "[mcp_servers.exe-os]";
@@ -34482,10 +35507,10 @@ async function registerCodexMcpServer(packageRoot, homeDir = os23.homedir()) {
   return "registered";
 }
 async function ensureCodexHooksFeature(homeDir = os23.homedir()) {
-  const configPath = path51.join(homeDir, ".codex", "config.toml");
-  await mkdir9(path51.join(homeDir, ".codex"), { recursive: true });
+  const configPath = path52.join(homeDir, ".codex", "config.toml");
+  await mkdir9(path52.join(homeDir, ".codex"), { recursive: true });
   let content = "";
-  if (existsSync37(configPath)) {
+  if (existsSync38(configPath)) {
     content = await readFile8(configPath, "utf-8");
   }
   if (/\[features\][\s\S]*?codex_hooks\s*=\s*true/.test(content)) {
@@ -34560,32 +35585,32 @@ __export(mcp_diagnostics_exports, {
   diagnoseClaudeMcpConfig: () => diagnoseClaudeMcpConfig,
   formatMcpDiagnosticReport: () => formatMcpDiagnosticReport
 });
-import { existsSync as existsSync38, readFileSync as readFileSync33 } from "fs";
-import path52 from "path";
+import { existsSync as existsSync39, readFileSync as readFileSync34 } from "fs";
+import path53 from "path";
 import os24 from "os";
 function readJson(filePath) {
-  if (!existsSync38(filePath)) return null;
+  if (!existsSync39(filePath)) return null;
   try {
-    return JSON.parse(readFileSync33(filePath, "utf8"));
+    return JSON.parse(readFileSync34(filePath, "utf8"));
   } catch {
     return null;
   }
 }
 function pathApplies2(projectPath, cwd2) {
-  const project = path52.resolve(projectPath);
-  const current = path52.resolve(cwd2);
-  return current === project || current.startsWith(project + path52.sep);
+  const project = path53.resolve(projectPath);
+  const current = path53.resolve(cwd2);
+  return current === project || current.startsWith(project + path53.sep);
 }
 function findAncestorMcpJsons2(cwd2, homeDir) {
   const files = [];
-  let dir = path52.resolve(cwd2);
-  const root = path52.parse(dir).root;
-  const stop = path52.resolve(homeDir);
+  let dir = path53.resolve(cwd2);
+  const root = path53.parse(dir).root;
+  const stop = path53.resolve(homeDir);
   while (dir !== root) {
-    const candidate = path52.join(dir, ".mcp.json");
-    if (existsSync38(candidate)) files.push(candidate);
+    const candidate = path53.join(dir, ".mcp.json");
+    if (existsSync39(candidate)) files.push(candidate);
     if (dir === stop) break;
-    dir = path52.dirname(dir);
+    dir = path53.dirname(dir);
   }
   return files;
 }
@@ -34602,8 +35627,8 @@ function serverAllowedByPermissions(serverName, prefixes) {
   return prefixes.has(serverName) || prefixes.has(serverName.replace(/-/g, "_"));
 }
 function diagnoseClaudeMcpConfig(homeDir = os24.homedir(), cwd2 = process.cwd(), env = process.env) {
-  const claudeJsonPath = path52.join(homeDir, ".claude.json");
-  const settingsPath = path52.join(homeDir, ".claude", "settings.json");
+  const claudeJsonPath = path53.join(homeDir, ".claude.json");
+  const settingsPath = path53.join(homeDir, ".claude", "settings.json");
   const claudeJson = readJson(claudeJsonPath);
   const settings = readJson(settingsPath);
   const issues = [];
@@ -34723,7 +35748,7 @@ function diagnoseClaudeMcpConfig(homeDir = os24.homedir(), cwd2 = process.cwd(),
     });
   }
   return {
-    cwd: path52.resolve(cwd2),
+    cwd: path53.resolve(cwd2),
     globalServers,
     projectServers: projectServers.sort((a, b) => a.name.localeCompare(b.name)),
     mcpJsonServers: mcpJsonServers.sort((a, b) => a.name.localeCompare(b.name)),
@@ -34760,14 +35785,14 @@ var init_mcp_diagnostics = __esm({
 });
 
 // src/bin/cli.ts
-import { existsSync as existsSync39, readFileSync as readFileSync34, writeFileSync as writeFileSync25, readdirSync as readdirSync11, rmSync as rmSync2 } from "fs";
-import path53 from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync35, writeFileSync as writeFileSync26, readdirSync as readdirSync12, rmSync as rmSync2 } from "fs";
+import path54 from "path";
 import os25 from "os";
 var args = process.argv.slice(2);
 if (args.includes("--version") || args.includes("-v")) {
   try {
-    const pkgPath = path53.join(path53.dirname(new URL(import.meta.url).pathname), "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync34(pkgPath, "utf8"));
+    const pkgPath = path54.join(path54.dirname(new URL(import.meta.url).pathname), "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync35(pkgPath, "utf8"));
     console.log(pkg.version);
   } catch {
     console.log("unknown");
@@ -34842,6 +35867,8 @@ if (args.includes("--global")) {
 } else if (args[0] === "org") {
   const { main: runOrg } = await Promise.resolve().then(() => (init_exe_org(), exe_org_exports));
   await runOrg(args.slice(1));
+} else if (args[0] === "code-context") {
+  await runCodeContext(args.slice(1));
 } else if (args[0] === "jobs") {
   const { cancelBackgroundJob: cancelBackgroundJob2, formatJobs: formatJobs2, listBackgroundJobs: listBackgroundJobs2 } = await Promise.resolve().then(() => (init_background_jobs(), background_jobs_exports));
   const sub = args[1] ?? "status";
@@ -34982,16 +36009,19 @@ ID: ${result.id}`);
 } else if (args[0] === "stack-update") {
   const { runStackUpdateCli } = await Promise.resolve().then(() => (init_stack_update2(), stack_update_exports));
   await runStackUpdateCli();
+} else if (args[0] === "registry-proxy") {
+  const { main: runRegistryProxy2 } = await Promise.resolve().then(() => (init_registry_proxy2(), registry_proxy_exports));
+  await runRegistryProxy2(args.slice(1));
 } else if (args.includes("--tui") || args.includes("--demo") || args[0] === "tui") {
   checkForUpdateOnBoot().catch(() => {
   });
   await init_App2().then(() => App_exports);
 } else {
-  const claudeDir = path53.join(os25.homedir(), ".claude");
-  const settingsPath = path53.join(claudeDir, "settings.json");
-  const hasClaudeCode = existsSync39(settingsPath) && (() => {
+  const claudeDir = path54.join(os25.homedir(), ".claude");
+  const settingsPath = path54.join(claudeDir, "settings.json");
+  const hasClaudeCode = existsSync40(settingsPath) && (() => {
     try {
-      const raw = readFileSync34(settingsPath, "utf8");
+      const raw = readFileSync35(settingsPath, "utf8");
       return raw.includes("exe-os") || raw.includes("exe-mem");
     } catch {
       return false;
@@ -35001,9 +36031,9 @@ ID: ${result.id}`);
     const { DEFAULT_COORDINATOR_TEMPLATE_NAME: DEFAULT_COORDINATOR_TEMPLATE_NAME2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
     let cooName = DEFAULT_COORDINATOR_TEMPLATE_NAME2;
     try {
-      const rosterPath = path53.join(os25.homedir(), ".exe-os", "exe-employees.json");
-      if (existsSync39(rosterPath)) {
-        const roster = JSON.parse(readFileSync34(rosterPath, "utf8"));
+      const rosterPath = path54.join(os25.homedir(), ".exe-os", "exe-employees.json");
+      if (existsSync40(rosterPath)) {
+        const roster = JSON.parse(readFileSync35(rosterPath, "utf8"));
         const coo = roster.find((e) => e.role === "COO");
         if (coo) cooName = coo.name;
       }
@@ -35042,6 +36072,82 @@ cd into a project folder and run \x1B[1m${cooName}1\x1B[0m to boot your COO.
     await init_App2().then(() => App_exports);
   }
 }
+async function runCodeContext(ccArgs) {
+  const { buildCodeContextIndex: buildCodeContextIndex2, getCodeContextStats: getCodeContextStats2, searchCodeContext: searchCodeContext2 } = await Promise.resolve().then(() => (init_code_context_index(), code_context_index_exports));
+  const sub = ccArgs[0] ?? "status";
+  const projectRoot = valueAfter(ccArgs, "--project-root") ?? process.cwd();
+  if (sub === "init" || sub === "index") {
+    const force = ccArgs.includes("--force") || ccArgs.includes("--refresh");
+    const index = buildCodeContextIndex2({ projectRoot, force });
+    console.log(JSON.stringify({ projectRoot: index.projectRoot, branch: index.branch, indexedAt: index.indexedAt, files: Object.keys(index.files).length, symbols: Object.values(index.files).reduce((sum, f) => sum + f.symbols.length, 0), languageBreakdown: index.stats.languageBreakdown, rebuiltFiles: index.stats.rebuiltFiles, reusedFiles: index.stats.reusedFiles }, null, 2));
+    return;
+  }
+  if (sub === "status" || sub === "stats") {
+    console.log(JSON.stringify(getCodeContextStats2({ projectRoot }), null, 2));
+    return;
+  }
+  if (sub === "search") {
+    const query = valueAfter(ccArgs, "--query") ?? positionalSearchQuery(ccArgs.slice(1));
+    if (!query) {
+      console.error("Usage: exe-os code-context search <query> [--limit N] [--offset N] [--language python] [--path 'src/**'] [--refresh]");
+      process.exit(1);
+    }
+    const languageFilters = [...valuesAfter(ccArgs, "--language") ?? [], ...valuesAfter(ccArgs, "--languages") ?? []];
+    const pathFilters = [...valuesAfter(ccArgs, "--path") ?? [], ...valuesAfter(ccArgs, "--paths") ?? []];
+    const results = searchCodeContext2(query, {
+      projectRoot,
+      limit: numberAfter(ccArgs, "--limit") ?? 20,
+      offset: numberAfter(ccArgs, "--offset") ?? 0,
+      refreshIndex: ccArgs.includes("--refresh") || ccArgs.includes("--refresh-index"),
+      languages: languageFilters.length > 0 ? languageFilters : void 0,
+      paths: pathFilters.length > 0 ? pathFilters : void 0
+    });
+    console.log(JSON.stringify({ query, results }, null, 2));
+    return;
+  }
+  if (sub === "doctor") {
+    const stats = getCodeContextStats2({ projectRoot });
+    console.log(JSON.stringify({ ok: stats.files > 0, ...stats }, null, 2));
+    process.exit(stats.files > 0 ? 0 : 1);
+  }
+  console.error("Usage: exe-os code-context init|index|status|stats|search|doctor");
+  process.exit(1);
+}
+function positionalSearchQuery(args2) {
+  const valueFlags = /* @__PURE__ */ new Set(["--project-root", "--limit", "--offset", "--language", "--languages", "--path", "--paths", "--query"]);
+  const parts = [];
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (valueFlags.has(arg)) {
+      i++;
+      continue;
+    }
+    if (arg.startsWith("--")) continue;
+    parts.push(arg);
+  }
+  return parts.join(" ").trim();
+}
+function valueAfter(args2, flag) {
+  const i = args2.indexOf(flag);
+  if (i >= 0) return args2[i + 1];
+  const prefixed = args2.find((arg) => arg.startsWith(`${flag}=`));
+  return prefixed?.slice(flag.length + 1);
+}
+function valuesAfter(args2, flag) {
+  const values = [];
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === flag && args2[i + 1]) values.push(args2[++i]);
+    else if (arg.startsWith(`${flag}=`)) values.push(arg.slice(flag.length + 1));
+  }
+  return values.length > 0 ? values.flatMap((v) => v.split(",").map((s) => s.trim()).filter(Boolean)) : void 0;
+}
+function numberAfter(args2, flag) {
+  const value = valueAfter(args2, flag);
+  if (!value) return void 0;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
 async function runClaudeInstall() {
   const { runInstaller: runInstaller2 } = await Promise.resolve().then(() => (init_installer(), installer_exports));
   try {
@@ -35080,14 +36186,14 @@ async function runCodexInstall() {
 }
 async function runClaudeCheck() {
   const { detectMcpNameCollisions: detectMcpNameCollisions2 } = await Promise.resolve().then(() => (init_installer(), installer_exports));
-  const claudeDir = path53.join(os25.homedir(), ".claude");
-  const settingsPath = path53.join(claudeDir, "settings.json");
-  const claudeJsonPath = path53.join(os25.homedir(), ".claude.json");
+  const claudeDir = path54.join(os25.homedir(), ".claude");
+  const settingsPath = path54.join(claudeDir, "settings.json");
+  const claudeJsonPath = path54.join(os25.homedir(), ".claude.json");
   let ok = true;
-  if (existsSync39(settingsPath)) {
+  if (existsSync40(settingsPath)) {
     let settings;
     try {
-      settings = JSON.parse(readFileSync34(settingsPath, "utf8"));
+      settings = JSON.parse(readFileSync35(settingsPath, "utf8"));
     } catch {
       console.log("\x1B[31m\u2717\x1B[0m settings.json is malformed (invalid JSON)");
       ok = false;
@@ -35113,10 +36219,10 @@ async function runClaudeCheck() {
     console.log("\x1B[31m\u2717\x1B[0m settings.json not found");
     ok = false;
   }
-  if (existsSync39(claudeJsonPath)) {
+  if (existsSync40(claudeJsonPath)) {
     let claudeJson;
     try {
-      claudeJson = JSON.parse(readFileSync34(claudeJsonPath, "utf8"));
+      claudeJson = JSON.parse(readFileSync35(claudeJsonPath, "utf8"));
     } catch {
       console.log("\x1B[31m\u2717\x1B[0m claude.json is malformed (invalid JSON)");
       ok = false;
@@ -35149,8 +36255,8 @@ async function runClaudeCheck() {
   } else {
     console.log("\x1B[32m\u2713\x1B[0m No .mcp.json/project MCP name collisions detected");
   }
-  const skillsDir = path53.join(claudeDir, "skills");
-  if (existsSync39(skillsDir)) {
+  const skillsDir = path54.join(claudeDir, "skills");
+  if (existsSync40(skillsDir)) {
     console.log("\x1B[32m\u2713\x1B[0m Slash skills directory exists");
   } else {
     console.log("\x1B[31m\u2717\x1B[0m Slash skills directory missing");
@@ -35174,16 +36280,16 @@ async function runClaudeUninstall(flags = []) {
   const dryRun = flags.includes("--dry-run");
   const purge = flags.includes("--purge");
   const homeDir = os25.homedir();
-  const claudeDir = path53.join(homeDir, ".claude");
-  const settingsPath = path53.join(claudeDir, "settings.json");
-  const claudeJsonPath = path53.join(homeDir, ".claude.json");
-  const exeOsDir = path53.join(homeDir, ".exe-os");
+  const claudeDir = path54.join(homeDir, ".claude");
+  const settingsPath = path54.join(claudeDir, "settings.json");
+  const claudeJsonPath = path54.join(homeDir, ".claude.json");
+  const exeOsDir = path54.join(homeDir, ".exe-os");
   let removed = 0;
   const log = (msg) => console.log(dryRun ? `[dry-run] ${msg}` : msg);
   let settings = {};
-  if (existsSync39(settingsPath)) {
+  if (existsSync40(settingsPath)) {
     try {
-      settings = JSON.parse(readFileSync34(settingsPath, "utf8"));
+      settings = JSON.parse(readFileSync35(settingsPath, "utf8"));
     } catch {
       console.error("Your ~/.claude/settings.json appears malformed.");
       if (purge) {
@@ -35221,15 +36327,15 @@ async function runClaudeUninstall(flags = []) {
         permCount = before - settings.permissions.allow.length;
       }
       if (!dryRun) {
-        writeFileSync25(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+        writeFileSync26(settingsPath, JSON.stringify(settings, null, 2) + "\n");
       }
       log("\u2713 Removed exe-os hooks from settings.json");
       if (permCount > 0) log(`\u2713 Removed ${permCount} MCP permission entries`);
       removed++;
     }
   }
-  if (existsSync39(claudeJsonPath)) {
-    const raw = readFileSync34(claudeJsonPath, "utf8");
+  if (existsSync40(claudeJsonPath)) {
+    const raw = readFileSync35(claudeJsonPath, "utf8");
     if (raw.length > 1e6) {
       console.error("claude.json exceeds 1 MB \u2014 skipping parse.");
     } else {
@@ -35250,7 +36356,7 @@ async function runClaudeUninstall(flags = []) {
         }
         if (removedMcp) {
           if (!dryRun) {
-            writeFileSync25(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
+            writeFileSync26(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
           }
           log("\u2713 Removed exe-os MCP server from claude.json");
           removed++;
@@ -35258,14 +36364,14 @@ async function runClaudeUninstall(flags = []) {
       }
     }
   }
-  const skillsDir = path53.join(claudeDir, "skills");
-  if (existsSync39(skillsDir)) {
+  const skillsDir = path54.join(claudeDir, "skills");
+  if (existsSync40(skillsDir)) {
     let skillCount = 0;
     try {
-      const entries = readdirSync11(skillsDir);
+      const entries = readdirSync12(skillsDir);
       for (const entry of entries) {
         if (entry.startsWith("exe")) {
-          const fullPath = path53.join(skillsDir, entry);
+          const fullPath = path54.join(skillsDir, entry);
           if (!dryRun) rmSync2(fullPath, { recursive: true, force: true });
           skillCount++;
         }
@@ -35277,30 +36383,30 @@ async function runClaudeUninstall(flags = []) {
       removed++;
     }
   }
-  const claudeMdPath = path53.join(claudeDir, "CLAUDE.md");
-  if (existsSync39(claudeMdPath)) {
-    const content = readFileSync34(claudeMdPath, "utf8");
+  const claudeMdPath = path54.join(claudeDir, "CLAUDE.md");
+  if (existsSync40(claudeMdPath)) {
+    const content = readFileSync35(claudeMdPath, "utf8");
     const startMarker = "<!-- exe-os:orchestration-start -->";
     const endMarker = "<!-- exe-os:orchestration-end -->";
     const startIdx = content.indexOf(startMarker);
     const endIdx = content.indexOf(endMarker);
     if (startIdx !== -1 && endIdx !== -1) {
       const cleaned = (content.slice(0, startIdx) + content.slice(endIdx + endMarker.length)).replace(/\n{3,}/g, "\n\n").trim() + "\n";
-      if (!dryRun) writeFileSync25(claudeMdPath, cleaned);
+      if (!dryRun) writeFileSync26(claudeMdPath, cleaned);
       log("\u2713 Removed orchestration block from CLAUDE.md");
       removed++;
     }
   }
-  const agentsDir = path53.join(claudeDir, "agents");
-  if (existsSync39(agentsDir)) {
+  const agentsDir = path54.join(claudeDir, "agents");
+  if (existsSync40(agentsDir)) {
     let agentCount = 0;
     try {
-      const entries = readdirSync11(agentsDir).filter((f) => f.endsWith(".md"));
+      const entries = readdirSync12(agentsDir).filter((f) => f.endsWith(".md"));
       let knownNames = /* @__PURE__ */ new Set();
-      const rosterPath = path53.join(exeOsDir, "exe-employees.json");
-      if (existsSync39(rosterPath)) {
+      const rosterPath = path54.join(exeOsDir, "exe-employees.json");
+      if (existsSync40(rosterPath)) {
         try {
-          const roster = JSON.parse(readFileSync34(rosterPath, "utf8"));
+          const roster = JSON.parse(readFileSync35(rosterPath, "utf8"));
           knownNames = new Set(roster.map((e) => e.name));
         } catch {
         }
@@ -35308,7 +36414,7 @@ async function runClaudeUninstall(flags = []) {
       for (const entry of entries) {
         const name = entry.replace(/\.md$/, "");
         if (knownNames.has(name)) {
-          if (!dryRun) rmSync2(path53.join(agentsDir, entry), { force: true });
+          if (!dryRun) rmSync2(path54.join(agentsDir, entry), { force: true });
           agentCount++;
         }
       }
@@ -35319,16 +36425,16 @@ async function runClaudeUninstall(flags = []) {
       removed++;
     }
   }
-  const projectsDir = path53.join(claudeDir, "projects");
-  if (existsSync39(projectsDir)) {
+  const projectsDir = path54.join(claudeDir, "projects");
+  if (existsSync40(projectsDir)) {
     let projectCount = 0;
     try {
-      const projects = readdirSync11(projectsDir);
+      const projects = readdirSync12(projectsDir);
       for (const proj of projects) {
-        const projSettings = path53.join(projectsDir, proj, "settings.json");
-        if (!existsSync39(projSettings)) continue;
+        const projSettings = path54.join(projectsDir, proj, "settings.json");
+        if (!existsSync40(projSettings)) continue;
         try {
-          const pSettings = JSON.parse(readFileSync34(projSettings, "utf8"));
+          const pSettings = JSON.parse(readFileSync35(projSettings, "utf8"));
           let changed = false;
           if (Array.isArray(pSettings.permissions?.allow)) {
             const before = pSettings.permissions.allow.length;
@@ -35338,7 +36444,7 @@ async function runClaudeUninstall(flags = []) {
             if (pSettings.permissions.allow.length < before) changed = true;
           }
           if (changed && !dryRun) {
-            writeFileSync25(projSettings, JSON.stringify(pSettings, null, 2) + "\n");
+            writeFileSync26(projSettings, JSON.stringify(pSettings, null, 2) + "\n");
           }
           if (changed) projectCount++;
         } catch {
@@ -35362,18 +36468,18 @@ async function runClaudeUninstall(flags = []) {
     };
     const exeBinPath = findExeBin3();
     if (!exeBinPath) throw new Error("exe-os not found in PATH");
-    const binDir = path53.dirname(exeBinPath);
+    const binDir = path54.dirname(exeBinPath);
     let symlinkCount = 0;
-    const rosterPath = path53.join(exeOsDir, "exe-employees.json");
-    if (existsSync39(rosterPath)) {
-      const roster = JSON.parse(readFileSync34(rosterPath, "utf8"));
+    const rosterPath = path54.join(exeOsDir, "exe-employees.json");
+    if (existsSync40(rosterPath)) {
+      const roster = JSON.parse(readFileSync35(rosterPath, "utf8"));
       const { DEFAULT_COORDINATOR_TEMPLATE_NAME: DEFAULT_COORDINATOR_TEMPLATE_NAME2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
       const coordinatorName = roster.find((e) => e.role?.toLowerCase() === "coo")?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME2;
       for (const emp of roster) {
         if (emp.name === coordinatorName) continue;
         for (const suffix of ["", "-opencode"]) {
-          const linkPath = path53.join(binDir, `${emp.name}${suffix}`);
-          if (existsSync39(linkPath)) {
+          const linkPath = path54.join(binDir, `${emp.name}${suffix}`);
+          if (existsSync40(linkPath)) {
             if (!dryRun) rmSync2(linkPath, { force: true });
             symlinkCount++;
           }
@@ -35386,7 +36492,7 @@ async function runClaudeUninstall(flags = []) {
     }
   } catch {
   }
-  if (purge && existsSync39(exeOsDir)) {
+  if (purge && existsSync40(exeOsDir)) {
     if (!dryRun) {
       process.stdout.write("\x1B[33m\u26A0 This will delete all memories, identities, and agent data.\x1B[0m\n");
       process.stdout.write("  Removing ~/.exe-os...\n");
@@ -35411,7 +36517,7 @@ async function checkForUpdateOnBoot() {
     const config = await loadConfig2();
     if (!config.autoUpdate.checkOnBoot) return;
     const { checkForUpdate: checkForUpdate2 } = await Promise.resolve().then(() => (init_update(), update_exports));
-    const packageRoot = path53.resolve(
+    const packageRoot = path54.resolve(
       new URL("../..", import.meta.url).pathname
     );
     const result = checkForUpdate2(packageRoot);
@@ -35472,7 +36578,7 @@ async function runActivate(key) {
       const idTemplate = getIdentityTemplate(identityKey);
       if (idTemplate) {
         const idPath = identityPath2(name);
-        const dir = path53.dirname(idPath);
+        const dir = path54.dirname(idPath);
         if (!fs8.existsSync(dir)) fs8.mkdirSync(dir, { recursive: true });
         fs8.writeFileSync(idPath, idTemplate.replace(/^agent_id: \w+/m, `agent_id: ${name}`), "utf-8");
       }