@askexenow/exe-os 0.9.85 → 0.9.87

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (86) hide show
  1. package/dist/bin/agentic-ontology-backfill.js +50 -14
  2. package/dist/bin/agentic-reflection-backfill.js +50 -14
  3. package/dist/bin/agentic-semantic-label.js +50 -14
  4. package/dist/bin/backfill-conversations.js +50 -14
  5. package/dist/bin/backfill-responses.js +50 -14
  6. package/dist/bin/backfill-vectors.js +50 -14
  7. package/dist/bin/bulk-sync-postgres.js +50 -14
  8. package/dist/bin/cleanup-stale-review-tasks.js +53 -17
  9. package/dist/bin/cli.js +339 -81
  10. package/dist/bin/exe-agent.js +18 -0
  11. package/dist/bin/exe-assign.js +50 -14
  12. package/dist/bin/exe-boot.js +75 -39
  13. package/dist/bin/exe-call.js +18 -0
  14. package/dist/bin/exe-cloud.js +40 -4
  15. package/dist/bin/exe-dispatch.js +61 -25
  16. package/dist/bin/exe-doctor.js +40 -4
  17. package/dist/bin/exe-export-behaviors.js +50 -14
  18. package/dist/bin/exe-forget.js +50 -14
  19. package/dist/bin/exe-gateway.js +65 -29
  20. package/dist/bin/exe-heartbeat.js +55 -19
  21. package/dist/bin/exe-kill.js +54 -18
  22. package/dist/bin/exe-launch-agent.js +58 -22
  23. package/dist/bin/exe-new-employee.js +33 -2
  24. package/dist/bin/exe-pending-messages.js +53 -17
  25. package/dist/bin/exe-pending-notifications.js +53 -17
  26. package/dist/bin/exe-pending-reviews.js +55 -19
  27. package/dist/bin/exe-rename.js +52 -16
  28. package/dist/bin/exe-review.js +50 -14
  29. package/dist/bin/exe-search.js +58 -22
  30. package/dist/bin/exe-session-cleanup.js +85 -44
  31. package/dist/bin/exe-start-codex.js +57 -21
  32. package/dist/bin/exe-start-opencode.js +55 -19
  33. package/dist/bin/exe-status.js +62 -26
  34. package/dist/bin/exe-team.js +50 -14
  35. package/dist/bin/git-sweep.js +63 -27
  36. package/dist/bin/graph-backfill.js +50 -14
  37. package/dist/bin/graph-export.js +50 -14
  38. package/dist/bin/install.js +9 -0
  39. package/dist/bin/intercom-check.js +67 -31
  40. package/dist/bin/scan-tasks.js +63 -27
  41. package/dist/bin/setup.js +53 -13
  42. package/dist/bin/shard-migrate.js +50 -14
  43. package/dist/bin/stack-update.js +59 -2
  44. package/dist/bin/update.js +1 -1
  45. package/dist/gateway/index.js +65 -29
  46. package/dist/hooks/bug-report-worker.js +65 -29
  47. package/dist/hooks/codex-stop-task-finalizer.js +59 -23
  48. package/dist/hooks/commit-complete.js +64 -28
  49. package/dist/hooks/error-recall.js +62 -26
  50. package/dist/hooks/ingest-worker.js +4 -4
  51. package/dist/hooks/ingest.js +56 -20
  52. package/dist/hooks/instructions-loaded.js +50 -14
  53. package/dist/hooks/notification.js +50 -14
  54. package/dist/hooks/post-compact.js +50 -14
  55. package/dist/hooks/post-tool-combined.js +63 -27
  56. package/dist/hooks/pre-compact.js +61 -25
  57. package/dist/hooks/pre-tool-use.js +58 -22
  58. package/dist/hooks/prompt-submit.js +78 -42
  59. package/dist/hooks/session-end.js +66 -30
  60. package/dist/hooks/session-start.js +68 -32
  61. package/dist/hooks/stop.js +53 -17
  62. package/dist/hooks/subagent-stop.js +50 -14
  63. package/dist/hooks/summary-worker.js +55 -19
  64. package/dist/index.js +61 -25
  65. package/dist/lib/cloud-sync.js +32 -14
  66. package/dist/lib/database.js +22 -4
  67. package/dist/lib/db-daemon-client.js +16 -4
  68. package/dist/lib/db.js +22 -4
  69. package/dist/lib/device-registry.js +22 -4
  70. package/dist/lib/embedder.js +16 -4
  71. package/dist/lib/employee-templates.js +18 -0
  72. package/dist/lib/exe-daemon-client.js +16 -4
  73. package/dist/lib/exe-daemon.js +874 -232
  74. package/dist/lib/hybrid-search.js +58 -22
  75. package/dist/lib/identity-templates.js +6 -2
  76. package/dist/lib/schedules.js +53 -17
  77. package/dist/lib/skill-learning.js +16 -4
  78. package/dist/lib/store.js +50 -14
  79. package/dist/lib/tasks.js +16 -4
  80. package/dist/lib/tmux-routing.js +18 -6
  81. package/dist/mcp/server.js +809 -200
  82. package/dist/mcp/tools/create-task.js +24 -8
  83. package/dist/mcp/tools/update-task.js +18 -6
  84. package/dist/runtime/index.js +61 -25
  85. package/dist/tui/App.js +91 -55
  86. package/package.json +1 -1
@@ -1702,7 +1702,7 @@ var init_daemon_auth = __esm({
1702
1702
  // src/lib/exe-daemon-client.ts
1703
1703
  import net from "net";
1704
1704
  import os4 from "os";
1705
- import { spawn } from "child_process";
1705
+ import { spawn, execSync as execSync2 } from "child_process";
1706
1706
  import { randomUUID } from "crypto";
1707
1707
  import { existsSync as existsSync6, unlinkSync as unlinkSync2, readFileSync as readFileSync5, openSync, closeSync, statSync } from "fs";
1708
1708
  import path6 from "path";
@@ -1732,6 +1732,14 @@ function handleData(chunk) {
1732
1732
  }
1733
1733
  }
1734
1734
  }
1735
+ function isZombie(pid) {
1736
+ try {
1737
+ const state = execSync2(`ps -p ${pid} -o state=`, { encoding: "utf8", timeout: 2e3 }).trim();
1738
+ return state.startsWith("Z");
1739
+ } catch {
1740
+ return false;
1741
+ }
1742
+ }
1735
1743
  function cleanupStaleFiles() {
1736
1744
  if (existsSync6(PID_PATH)) {
1737
1745
  try {
@@ -1739,7 +1747,11 @@ function cleanupStaleFiles() {
1739
1747
  if (pid > 0) {
1740
1748
  try {
1741
1749
  process.kill(pid, 0);
1742
- return;
1750
+ if (!isZombie(pid)) {
1751
+ return;
1752
+ }
1753
+ process.stderr.write(`[exed-client] PID ${pid} is a zombie \u2014 cleaning up stale files
1754
+ `);
1743
1755
  } catch {
1744
1756
  }
1745
1757
  }
@@ -1767,8 +1779,8 @@ function findPackageRoot() {
1767
1779
  function getAvailableMemoryGB() {
1768
1780
  if (process.platform === "darwin") {
1769
1781
  try {
1770
- const { execSync: execSync8 } = __require("child_process");
1771
- const vmstat = execSync8("vm_stat", { encoding: "utf8" });
1782
+ const { execSync: execSync9 } = __require("child_process");
1783
+ const vmstat = execSync9("vm_stat", { encoding: "utf8" });
1772
1784
  const pageSize = 16384;
1773
1785
  const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
1774
1786
  const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -3703,6 +3715,12 @@ async function disposeDatabase() {
3703
3715
  clearInterval(_walCheckpointTimer);
3704
3716
  _walCheckpointTimer = null;
3705
3717
  }
3718
+ if (_client) {
3719
+ try {
3720
+ await _client.execute("PRAGMA wal_checkpoint(PASSIVE)");
3721
+ } catch {
3722
+ }
3723
+ }
3706
3724
  if (_daemonClient) {
3707
3725
  _daemonClient.close();
3708
3726
  _daemonClient = null;
@@ -3807,7 +3825,7 @@ var init_embedder = __esm({
3807
3825
  // src/lib/keychain.ts
3808
3826
  import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
3809
3827
  import { existsSync as existsSync7, statSync as statSync2 } from "fs";
3810
- import { execSync as execSync2 } from "child_process";
3828
+ import { execSync as execSync3 } from "child_process";
3811
3829
  import path7 from "path";
3812
3830
  import os5 from "os";
3813
3831
  function getKeyDir() {
@@ -3824,13 +3842,13 @@ function linuxSecretAvailable() {
3824
3842
  if (process.platform !== "linux") return false;
3825
3843
  if (linuxSecretAvailability !== null) return linuxSecretAvailability;
3826
3844
  try {
3827
- execSync2("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
3845
+ execSync3("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
3828
3846
  } catch {
3829
3847
  linuxSecretAvailability = false;
3830
3848
  return false;
3831
3849
  }
3832
3850
  try {
3833
- execSync2("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
3851
+ execSync3("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
3834
3852
  linuxSecretAvailability = true;
3835
3853
  } catch {
3836
3854
  linuxSecretAvailability = false;
@@ -3854,7 +3872,7 @@ function macKeychainGet(service = SERVICE) {
3854
3872
  if (!nativeKeychainAllowed()) return null;
3855
3873
  if (process.platform !== "darwin") return null;
3856
3874
  try {
3857
- return execSync2(
3875
+ return execSync3(
3858
3876
  `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
3859
3877
  { encoding: "utf-8", timeout: 5e3 }
3860
3878
  ).trim();
@@ -3867,13 +3885,13 @@ function macKeychainSet(value, service = SERVICE) {
3867
3885
  if (process.platform !== "darwin") return false;
3868
3886
  try {
3869
3887
  try {
3870
- execSync2(
3888
+ execSync3(
3871
3889
  `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
3872
3890
  { timeout: 5e3 }
3873
3891
  );
3874
3892
  } catch {
3875
3893
  }
3876
- execSync2(
3894
+ execSync3(
3877
3895
  `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
3878
3896
  { timeout: 5e3 }
3879
3897
  );
@@ -3886,7 +3904,7 @@ function macKeychainDelete(service = SERVICE) {
3886
3904
  if (!nativeKeychainAllowed()) return false;
3887
3905
  if (process.platform !== "darwin") return false;
3888
3906
  try {
3889
- execSync2(
3907
+ execSync3(
3890
3908
  `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
3891
3909
  { timeout: 5e3 }
3892
3910
  );
@@ -3898,7 +3916,7 @@ function macKeychainDelete(service = SERVICE) {
3898
3916
  function linuxSecretGet(service = SERVICE) {
3899
3917
  if (!linuxSecretAvailable()) return null;
3900
3918
  try {
3901
- return execSync2(
3919
+ return execSync3(
3902
3920
  `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
3903
3921
  { encoding: "utf-8", timeout: 5e3 }
3904
3922
  ).trim();
@@ -3909,7 +3927,7 @@ function linuxSecretGet(service = SERVICE) {
3909
3927
  function linuxSecretSet(value, service = SERVICE) {
3910
3928
  if (!linuxSecretAvailable()) return false;
3911
3929
  try {
3912
- execSync2(
3930
+ execSync3(
3913
3931
  `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
3914
3932
  { timeout: 5e3 }
3915
3933
  );
@@ -3922,7 +3940,7 @@ function linuxSecretDelete(service = SERVICE) {
3922
3940
  if (!nativeKeychainAllowed()) return false;
3923
3941
  if (process.platform !== "linux") return false;
3924
3942
  try {
3925
- execSync2(
3943
+ execSync3(
3926
3944
  `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
3927
3945
  { timeout: 5e3 }
3928
3946
  );
@@ -4804,6 +4822,24 @@ var init_platform_procedures = __esm({
4804
4822
  priority: "p0",
4805
4823
  content: "When an agent encounters a suspected Exe OS bug, update breakage, MCP/tool failure, installer issue, memory/orchestration defect, or customer-local patch need, it MUST use create_bug_report. Do this before or alongside any local workaround so the report reaches AskExe support directly via the customer's license. Do NOT ask the founder for permission to file a required bug report. If create_bug_report is deferred/lazy-loaded, load it and call it. If it is unavailable in the live MCP surface, report 'create_bug_report unavailable in this session' and save a local report in exe/output \u2014 never claim the tool does not exist unless the live MCP surface was checked. If upstream delivery fails, call support_test (MCP) and include its result in the local report so AskExe can distinguish customer setup, license provisioning, and server intake issues; only ask the founder to run `exe-os support test` if MCP is disconnected/unavailable. Classify first: upstream_bug = reproducible exe-os/platform defect; customer_customization = identity, behavior, procedure, config, branding, workflow preference that belongs in customer-owned layers; emergency_hotfix = temporary local patch. For upstream bugs/emergency hotfixes include version, repro steps, expected/actual, files changed, workaround, and local diff summary. Avoid permanent platform-code patches unless founder approves; if a hotfix is unavoidable, document it in the bug report and re-check after npm update."
4806
4824
  },
4825
+ {
4826
+ title: "Bug report status check \u2014 surface available fixes on boot",
4827
+ domain: "support",
4828
+ priority: "p1",
4829
+ content: "Once per session (COO boot only, never repeat), call list_my_bug_reports to check if any previously filed bug reports have been fixed by AskExe. If any report has status 'fixed' with a fixed_version, surface it to the founder immediately: '\u{1F527} N bug fix(es) available \u2014 run exe-os update to get version X.Y.Z'. This is a one-time check at boot, not a recurring poll. If no reports exist or none are fixed, skip silently. If the MCP tool is unavailable or the network call fails, skip silently \u2014 this is informational, not blocking."
4830
+ },
4831
+ {
4832
+ title: "Feature request triage \u2014 upstream feature vs local customization",
4833
+ domain: "support",
4834
+ priority: "p0",
4835
+ content: "When an agent or founder identifies a desired capability that exe-os does not yet provide, the COO (or equivalent coordinator) must decide: is this a local customization (identity, behavior, procedure, config, branding, workflow preference that can be configured in customer-owned layers) or an upstream feature request (a platform capability that requires changes to exe-os code, shipped via npm update)? Local customizations: implement immediately using store_behavior, update_identity, company_procedure, or config changes. Upstream features: use create_feature_request to submit to AskExe. Include use case, business impact, and current workaround. Do NOT ask the founder for permission to file a feature request \u2014 file it proactively when the need is clear."
4836
+ },
4837
+ {
4838
+ title: "Feature request status check \u2014 surface shipped features on boot",
4839
+ domain: "support",
4840
+ priority: "p1",
4841
+ content: "Once per session (COO boot only, never repeat), call list_my_feature_requests to check if any previously filed feature requests have been shipped by AskExe. If any request has status 'shipped' with a shipped_version, surface it to the founder immediately: '\u{1F680} N feature(s) shipped \u2014 run exe-os update to get version X.Y.Z'. This is a one-time check at boot, not a recurring poll. If no requests exist or none are shipped, skip silently. If the MCP tool is unavailable or the network call fails, skip silently \u2014 this is informational, not blocking."
4842
+ },
4807
4843
  // --- Operations ---
4808
4844
  {
4809
4845
  title: "Managers must supervise deployed workers",
@@ -7274,7 +7310,7 @@ var init_session_registry = __esm({
7274
7310
  });
7275
7311
 
7276
7312
  // src/lib/session-key.ts
7277
- import { execSync as execSync3 } from "child_process";
7313
+ import { execSync as execSync4 } from "child_process";
7278
7314
  function normalizeCommand(command) {
7279
7315
  const trimmed = command.trim().toLowerCase();
7280
7316
  const parts = trimmed.split(/[\\/]/);
@@ -7293,7 +7329,7 @@ function resolveRuntimeProcess() {
7293
7329
  let pid = process.ppid;
7294
7330
  for (let i = 0; i < 10; i++) {
7295
7331
  try {
7296
- const info = execSync3(`ps -p ${pid} -o ppid=,comm=`, {
7332
+ const info = execSync4(`ps -p ${pid} -o ppid=,comm=`, {
7297
7333
  encoding: "utf8",
7298
7334
  timeout: 2e3
7299
7335
  }).trim();
@@ -7459,14 +7495,14 @@ var init_transport = __esm({
7459
7495
  });
7460
7496
 
7461
7497
  // src/lib/cc-agent-support.ts
7462
- import { execSync as execSync4 } from "child_process";
7498
+ import { execSync as execSync5 } from "child_process";
7463
7499
  function _resetCcAgentSupportCache() {
7464
7500
  _cachedSupport = null;
7465
7501
  }
7466
7502
  function claudeSupportsAgentFlag() {
7467
7503
  if (_cachedSupport !== null) return _cachedSupport;
7468
7504
  try {
7469
- const helpOutput = execSync4("claude --help 2>&1", {
7505
+ const helpOutput = execSync5("claude --help 2>&1", {
7470
7506
  encoding: "utf-8",
7471
7507
  timeout: 5e3
7472
7508
  });
@@ -7950,7 +7986,7 @@ var init_session_kill_telemetry = __esm({
7950
7986
  });
7951
7987
 
7952
7988
  // src/lib/project-name.ts
7953
- import { execSync as execSync5 } from "child_process";
7989
+ import { execSync as execSync6 } from "child_process";
7954
7990
  import path16 from "path";
7955
7991
  function getProjectName(cwd) {
7956
7992
  const dir = cwd ?? process.cwd();
@@ -7958,7 +7994,7 @@ function getProjectName(cwd) {
7958
7994
  try {
7959
7995
  let repoRoot;
7960
7996
  try {
7961
- const gitCommonDir = execSync5("git rev-parse --path-format=absolute --git-common-dir", {
7997
+ const gitCommonDir = execSync6("git rev-parse --path-format=absolute --git-common-dir", {
7962
7998
  cwd: dir,
7963
7999
  encoding: "utf8",
7964
8000
  timeout: 2e3,
@@ -7966,7 +8002,7 @@ function getProjectName(cwd) {
7966
8002
  }).trim();
7967
8003
  repoRoot = path16.dirname(gitCommonDir);
7968
8004
  } catch {
7969
- repoRoot = execSync5("git rev-parse --show-toplevel", {
8005
+ repoRoot = execSync6("git rev-parse --show-toplevel", {
7970
8006
  cwd: dir,
7971
8007
  encoding: "utf8",
7972
8008
  timeout: 2e3,
@@ -8057,7 +8093,7 @@ var init_session_scope = __esm({
8057
8093
  import crypto6 from "crypto";
8058
8094
  import path17 from "path";
8059
8095
  import os12 from "os";
8060
- import { execSync as execSync6 } from "child_process";
8096
+ import { execSync as execSync7 } from "child_process";
8061
8097
  import { mkdir as mkdir4, writeFile as writeFile4, appendFile } from "fs/promises";
8062
8098
  import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
8063
8099
  async function writeCheckpoint(input) {
@@ -8402,14 +8438,14 @@ function isTmuxSessionAlive(identifier) {
8402
8438
  if (!identifier || identifier === "unknown") return true;
8403
8439
  try {
8404
8440
  if (identifier.startsWith("%")) {
8405
- const output = execSync6("tmux list-panes -a -F '#{pane_id}'", {
8441
+ const output = execSync7("tmux list-panes -a -F '#{pane_id}'", {
8406
8442
  timeout: 2e3,
8407
8443
  encoding: "utf8",
8408
8444
  stdio: ["pipe", "pipe", "pipe"]
8409
8445
  });
8410
8446
  return output.split("\n").some((l) => l.trim() === identifier);
8411
8447
  } else {
8412
- execSync6(`tmux has-session -t ${JSON.stringify(identifier)}`, {
8448
+ execSync7(`tmux has-session -t ${JSON.stringify(identifier)}`, {
8413
8449
  timeout: 2e3,
8414
8450
  stdio: ["pipe", "pipe", "pipe"]
8415
8451
  });
@@ -8418,7 +8454,7 @@ function isTmuxSessionAlive(identifier) {
8418
8454
  } catch {
8419
8455
  if (identifier.startsWith("%")) return true;
8420
8456
  try {
8421
- execSync6("tmux list-sessions", {
8457
+ execSync7("tmux list-sessions", {
8422
8458
  timeout: 2e3,
8423
8459
  stdio: ["pipe", "pipe", "pipe"]
8424
8460
  });
@@ -8433,12 +8469,12 @@ function checkStaleCompletion(taskContext, taskCreatedAt) {
8433
8469
  if (!DELEGATION_KEYWORDS.test(taskContext)) return null;
8434
8470
  try {
8435
8471
  const since = new Date(taskCreatedAt).toISOString();
8436
- const branch = execSync6(
8472
+ const branch = execSync7(
8437
8473
  "git rev-parse --abbrev-ref HEAD 2>/dev/null",
8438
8474
  { encoding: "utf8", timeout: 3e3 }
8439
8475
  ).trim();
8440
8476
  const branchArg = branch && branch !== "HEAD" ? branch : "";
8441
- const commitCount = execSync6(
8477
+ const commitCount = execSync7(
8442
8478
  `git log --oneline --since="${since}" ${branchArg} 2>/dev/null | wc -l`,
8443
8479
  { encoding: "utf8", timeout: 5e3 }
8444
8480
  ).trim();
@@ -9969,7 +10005,7 @@ __export(tmux_routing_exports, {
9969
10005
  spawnEmployee: () => spawnEmployee,
9970
10006
  verifyPaneAtCapacity: () => verifyPaneAtCapacity
9971
10007
  });
9972
- import { execFileSync as execFileSync2, execSync as execSync7 } from "child_process";
10008
+ import { execFileSync as execFileSync2, execSync as execSync8 } from "child_process";
9973
10009
  import { readFileSync as readFileSync13, writeFileSync as writeFileSync8, mkdirSync as mkdirSync9, existsSync as existsSync17, appendFileSync, readdirSync as readdirSync4 } from "fs";
9974
10010
  import path21 from "path";
9975
10011
  import os13 from "os";
@@ -10690,7 +10726,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
10690
10726
  let booted = false;
10691
10727
  for (let i = 0; i < 30; i++) {
10692
10728
  try {
10693
- execSync7("sleep 0.5");
10729
+ execSync8("sleep 0.5");
10694
10730
  } catch {
10695
10731
  }
10696
10732
  try {
@@ -1402,7 +1402,7 @@ __export(exe_daemon_client_exports, {
1402
1402
  });
1403
1403
  import net from "net";
1404
1404
  import os4 from "os";
1405
- import { spawn } from "child_process";
1405
+ import { spawn, execSync as execSync2 } from "child_process";
1406
1406
  import { randomUUID } from "crypto";
1407
1407
  import { existsSync as existsSync6, unlinkSync as unlinkSync2, readFileSync as readFileSync5, openSync, closeSync, statSync } from "fs";
1408
1408
  import path6 from "path";
@@ -1432,6 +1432,14 @@ function handleData(chunk) {
1432
1432
  }
1433
1433
  }
1434
1434
  }
1435
+ function isZombie(pid) {
1436
+ try {
1437
+ const state = execSync2(`ps -p ${pid} -o state=`, { encoding: "utf8", timeout: 2e3 }).trim();
1438
+ return state.startsWith("Z");
1439
+ } catch {
1440
+ return false;
1441
+ }
1442
+ }
1435
1443
  function cleanupStaleFiles() {
1436
1444
  if (existsSync6(PID_PATH)) {
1437
1445
  try {
@@ -1439,7 +1447,11 @@ function cleanupStaleFiles() {
1439
1447
  if (pid > 0) {
1440
1448
  try {
1441
1449
  process.kill(pid, 0);
1442
- return;
1450
+ if (!isZombie(pid)) {
1451
+ return;
1452
+ }
1453
+ process.stderr.write(`[exed-client] PID ${pid} is a zombie \u2014 cleaning up stale files
1454
+ `);
1443
1455
  } catch {
1444
1456
  }
1445
1457
  }
@@ -1467,8 +1479,8 @@ function findPackageRoot() {
1467
1479
  function getAvailableMemoryGB() {
1468
1480
  if (process.platform === "darwin") {
1469
1481
  try {
1470
- const { execSync: execSync8 } = __require("child_process");
1471
- const vmstat = execSync8("vm_stat", { encoding: "utf8" });
1482
+ const { execSync: execSync9 } = __require("child_process");
1483
+ const vmstat = execSync9("vm_stat", { encoding: "utf8" });
1472
1484
  const pageSize = 16384;
1473
1485
  const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
1474
1486
  const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -3458,6 +3470,12 @@ async function disposeDatabase() {
3458
3470
  clearInterval(_walCheckpointTimer);
3459
3471
  _walCheckpointTimer = null;
3460
3472
  }
3473
+ if (_client) {
3474
+ try {
3475
+ await _client.execute("PRAGMA wal_checkpoint(PASSIVE)");
3476
+ } catch {
3477
+ }
3478
+ }
3461
3479
  if (_daemonClient) {
3462
3480
  _daemonClient.close();
3463
3481
  _daemonClient = null;
@@ -3494,7 +3512,7 @@ var init_database = __esm({
3494
3512
  // src/lib/keychain.ts
3495
3513
  import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
3496
3514
  import { existsSync as existsSync7, statSync as statSync2 } from "fs";
3497
- import { execSync as execSync2 } from "child_process";
3515
+ import { execSync as execSync3 } from "child_process";
3498
3516
  import path7 from "path";
3499
3517
  import os5 from "os";
3500
3518
  function getKeyDir() {
@@ -3511,13 +3529,13 @@ function linuxSecretAvailable() {
3511
3529
  if (process.platform !== "linux") return false;
3512
3530
  if (linuxSecretAvailability !== null) return linuxSecretAvailability;
3513
3531
  try {
3514
- execSync2("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
3532
+ execSync3("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
3515
3533
  } catch {
3516
3534
  linuxSecretAvailability = false;
3517
3535
  return false;
3518
3536
  }
3519
3537
  try {
3520
- execSync2("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
3538
+ execSync3("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
3521
3539
  linuxSecretAvailability = true;
3522
3540
  } catch {
3523
3541
  linuxSecretAvailability = false;
@@ -3541,7 +3559,7 @@ function macKeychainGet(service = SERVICE) {
3541
3559
  if (!nativeKeychainAllowed()) return null;
3542
3560
  if (process.platform !== "darwin") return null;
3543
3561
  try {
3544
- return execSync2(
3562
+ return execSync3(
3545
3563
  `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
3546
3564
  { encoding: "utf-8", timeout: 5e3 }
3547
3565
  ).trim();
@@ -3554,13 +3572,13 @@ function macKeychainSet(value, service = SERVICE) {
3554
3572
  if (process.platform !== "darwin") return false;
3555
3573
  try {
3556
3574
  try {
3557
- execSync2(
3575
+ execSync3(
3558
3576
  `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
3559
3577
  { timeout: 5e3 }
3560
3578
  );
3561
3579
  } catch {
3562
3580
  }
3563
- execSync2(
3581
+ execSync3(
3564
3582
  `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
3565
3583
  { timeout: 5e3 }
3566
3584
  );
@@ -3573,7 +3591,7 @@ function macKeychainDelete(service = SERVICE) {
3573
3591
  if (!nativeKeychainAllowed()) return false;
3574
3592
  if (process.platform !== "darwin") return false;
3575
3593
  try {
3576
- execSync2(
3594
+ execSync3(
3577
3595
  `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
3578
3596
  { timeout: 5e3 }
3579
3597
  );
@@ -3585,7 +3603,7 @@ function macKeychainDelete(service = SERVICE) {
3585
3603
  function linuxSecretGet(service = SERVICE) {
3586
3604
  if (!linuxSecretAvailable()) return null;
3587
3605
  try {
3588
- return execSync2(
3606
+ return execSync3(
3589
3607
  `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
3590
3608
  { encoding: "utf-8", timeout: 5e3 }
3591
3609
  ).trim();
@@ -3596,7 +3614,7 @@ function linuxSecretGet(service = SERVICE) {
3596
3614
  function linuxSecretSet(value, service = SERVICE) {
3597
3615
  if (!linuxSecretAvailable()) return false;
3598
3616
  try {
3599
- execSync2(
3617
+ execSync3(
3600
3618
  `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
3601
3619
  { timeout: 5e3 }
3602
3620
  );
@@ -3609,7 +3627,7 @@ function linuxSecretDelete(service = SERVICE) {
3609
3627
  if (!nativeKeychainAllowed()) return false;
3610
3628
  if (process.platform !== "linux") return false;
3611
3629
  try {
3612
- execSync2(
3630
+ execSync3(
3613
3631
  `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
3614
3632
  { timeout: 5e3 }
3615
3633
  );
@@ -4546,6 +4564,24 @@ var init_platform_procedures = __esm({
4546
4564
  priority: "p0",
4547
4565
  content: "When an agent encounters a suspected Exe OS bug, update breakage, MCP/tool failure, installer issue, memory/orchestration defect, or customer-local patch need, it MUST use create_bug_report. Do this before or alongside any local workaround so the report reaches AskExe support directly via the customer's license. Do NOT ask the founder for permission to file a required bug report. If create_bug_report is deferred/lazy-loaded, load it and call it. If it is unavailable in the live MCP surface, report 'create_bug_report unavailable in this session' and save a local report in exe/output \u2014 never claim the tool does not exist unless the live MCP surface was checked. If upstream delivery fails, call support_test (MCP) and include its result in the local report so AskExe can distinguish customer setup, license provisioning, and server intake issues; only ask the founder to run `exe-os support test` if MCP is disconnected/unavailable. Classify first: upstream_bug = reproducible exe-os/platform defect; customer_customization = identity, behavior, procedure, config, branding, workflow preference that belongs in customer-owned layers; emergency_hotfix = temporary local patch. For upstream bugs/emergency hotfixes include version, repro steps, expected/actual, files changed, workaround, and local diff summary. Avoid permanent platform-code patches unless founder approves; if a hotfix is unavoidable, document it in the bug report and re-check after npm update."
4548
4566
  },
4567
+ {
4568
+ title: "Bug report status check \u2014 surface available fixes on boot",
4569
+ domain: "support",
4570
+ priority: "p1",
4571
+ content: "Once per session (COO boot only, never repeat), call list_my_bug_reports to check if any previously filed bug reports have been fixed by AskExe. If any report has status 'fixed' with a fixed_version, surface it to the founder immediately: '\u{1F527} N bug fix(es) available \u2014 run exe-os update to get version X.Y.Z'. This is a one-time check at boot, not a recurring poll. If no reports exist or none are fixed, skip silently. If the MCP tool is unavailable or the network call fails, skip silently \u2014 this is informational, not blocking."
4572
+ },
4573
+ {
4574
+ title: "Feature request triage \u2014 upstream feature vs local customization",
4575
+ domain: "support",
4576
+ priority: "p0",
4577
+ content: "When an agent or founder identifies a desired capability that exe-os does not yet provide, the COO (or equivalent coordinator) must decide: is this a local customization (identity, behavior, procedure, config, branding, workflow preference that can be configured in customer-owned layers) or an upstream feature request (a platform capability that requires changes to exe-os code, shipped via npm update)? Local customizations: implement immediately using store_behavior, update_identity, company_procedure, or config changes. Upstream features: use create_feature_request to submit to AskExe. Include use case, business impact, and current workaround. Do NOT ask the founder for permission to file a feature request \u2014 file it proactively when the need is clear."
4578
+ },
4579
+ {
4580
+ title: "Feature request status check \u2014 surface shipped features on boot",
4581
+ domain: "support",
4582
+ priority: "p1",
4583
+ content: "Once per session (COO boot only, never repeat), call list_my_feature_requests to check if any previously filed feature requests have been shipped by AskExe. If any request has status 'shipped' with a shipped_version, surface it to the founder immediately: '\u{1F680} N feature(s) shipped \u2014 run exe-os update to get version X.Y.Z'. This is a one-time check at boot, not a recurring poll. If no requests exist or none are shipped, skip silently. If the MCP tool is unavailable or the network call fails, skip silently \u2014 this is informational, not blocking."
4584
+ },
4549
4585
  // --- Operations ---
4550
4586
  {
4551
4587
  title: "Managers must supervise deployed workers",
@@ -5820,7 +5856,7 @@ var init_session_registry = __esm({
5820
5856
  });
5821
5857
 
5822
5858
  // src/lib/session-key.ts
5823
- import { execSync as execSync3 } from "child_process";
5859
+ import { execSync as execSync4 } from "child_process";
5824
5860
  function normalizeCommand(command) {
5825
5861
  const trimmed = command.trim().toLowerCase();
5826
5862
  const parts = trimmed.split(/[\\/]/);
@@ -5839,7 +5875,7 @@ function resolveRuntimeProcess() {
5839
5875
  let pid = process.ppid;
5840
5876
  for (let i = 0; i < 10; i++) {
5841
5877
  try {
5842
- const info = execSync3(`ps -p ${pid} -o ppid=,comm=`, {
5878
+ const info = execSync4(`ps -p ${pid} -o ppid=,comm=`, {
5843
5879
  encoding: "utf8",
5844
5880
  timeout: 2e3
5845
5881
  }).trim();
@@ -6005,14 +6041,14 @@ var init_transport = __esm({
6005
6041
  });
6006
6042
 
6007
6043
  // src/lib/cc-agent-support.ts
6008
- import { execSync as execSync4 } from "child_process";
6044
+ import { execSync as execSync5 } from "child_process";
6009
6045
  function _resetCcAgentSupportCache() {
6010
6046
  _cachedSupport = null;
6011
6047
  }
6012
6048
  function claudeSupportsAgentFlag() {
6013
6049
  if (_cachedSupport !== null) return _cachedSupport;
6014
6050
  try {
6015
- const helpOutput = execSync4("claude --help 2>&1", {
6051
+ const helpOutput = execSync5("claude --help 2>&1", {
6016
6052
  encoding: "utf-8",
6017
6053
  timeout: 5e3
6018
6054
  });
@@ -7023,7 +7059,7 @@ __export(tmux_routing_exports, {
7023
7059
  spawnEmployee: () => spawnEmployee,
7024
7060
  verifyPaneAtCapacity: () => verifyPaneAtCapacity
7025
7061
  });
7026
- import { execFileSync as execFileSync2, execSync as execSync5 } from "child_process";
7062
+ import { execFileSync as execFileSync2, execSync as execSync6 } from "child_process";
7027
7063
  import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, existsSync as existsSync15, appendFileSync, readdirSync as readdirSync3 } from "fs";
7028
7064
  import path15 from "path";
7029
7065
  import os10 from "os";
@@ -7744,7 +7780,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
7744
7780
  let booted = false;
7745
7781
  for (let i = 0; i < 30; i++) {
7746
7782
  try {
7747
- execSync5("sleep 0.5");
7783
+ execSync6("sleep 0.5");
7748
7784
  } catch {
7749
7785
  }
7750
7786
  try {
@@ -7911,7 +7947,7 @@ var init_notifications = __esm({
7911
7947
  });
7912
7948
 
7913
7949
  // src/lib/project-name.ts
7914
- import { execSync as execSync6 } from "child_process";
7950
+ import { execSync as execSync7 } from "child_process";
7915
7951
  import path17 from "path";
7916
7952
  function getProjectName(cwd) {
7917
7953
  const dir = cwd ?? process.cwd();
@@ -7919,7 +7955,7 @@ function getProjectName(cwd) {
7919
7955
  try {
7920
7956
  let repoRoot;
7921
7957
  try {
7922
- const gitCommonDir = execSync6("git rev-parse --path-format=absolute --git-common-dir", {
7958
+ const gitCommonDir = execSync7("git rev-parse --path-format=absolute --git-common-dir", {
7923
7959
  cwd: dir,
7924
7960
  encoding: "utf8",
7925
7961
  timeout: 2e3,
@@ -7927,7 +7963,7 @@ function getProjectName(cwd) {
7927
7963
  }).trim();
7928
7964
  repoRoot = path17.dirname(gitCommonDir);
7929
7965
  } catch {
7930
- repoRoot = execSync6("git rev-parse --show-toplevel", {
7966
+ repoRoot = execSync7("git rev-parse --show-toplevel", {
7931
7967
  cwd: dir,
7932
7968
  encoding: "utf8",
7933
7969
  timeout: 2e3,
@@ -8018,7 +8054,7 @@ var init_session_scope = __esm({
8018
8054
  import crypto4 from "crypto";
8019
8055
  import path18 from "path";
8020
8056
  import os12 from "os";
8021
- import { execSync as execSync7 } from "child_process";
8057
+ import { execSync as execSync8 } from "child_process";
8022
8058
  import { mkdir as mkdir4, writeFile as writeFile4, appendFile } from "fs/promises";
8023
8059
  import { existsSync as existsSync17, readFileSync as readFileSync12 } from "fs";
8024
8060
  async function writeCheckpoint(input) {
@@ -8363,14 +8399,14 @@ function isTmuxSessionAlive(identifier) {
8363
8399
  if (!identifier || identifier === "unknown") return true;
8364
8400
  try {
8365
8401
  if (identifier.startsWith("%")) {
8366
- const output = execSync7("tmux list-panes -a -F '#{pane_id}'", {
8402
+ const output = execSync8("tmux list-panes -a -F '#{pane_id}'", {
8367
8403
  timeout: 2e3,
8368
8404
  encoding: "utf8",
8369
8405
  stdio: ["pipe", "pipe", "pipe"]
8370
8406
  });
8371
8407
  return output.split("\n").some((l) => l.trim() === identifier);
8372
8408
  } else {
8373
- execSync7(`tmux has-session -t ${JSON.stringify(identifier)}`, {
8409
+ execSync8(`tmux has-session -t ${JSON.stringify(identifier)}`, {
8374
8410
  timeout: 2e3,
8375
8411
  stdio: ["pipe", "pipe", "pipe"]
8376
8412
  });
@@ -8379,7 +8415,7 @@ function isTmuxSessionAlive(identifier) {
8379
8415
  } catch {
8380
8416
  if (identifier.startsWith("%")) return true;
8381
8417
  try {
8382
- execSync7("tmux list-sessions", {
8418
+ execSync8("tmux list-sessions", {
8383
8419
  timeout: 2e3,
8384
8420
  stdio: ["pipe", "pipe", "pipe"]
8385
8421
  });
@@ -8394,12 +8430,12 @@ function checkStaleCompletion(taskContext, taskCreatedAt) {
8394
8430
  if (!DELEGATION_KEYWORDS.test(taskContext)) return null;
8395
8431
  try {
8396
8432
  const since = new Date(taskCreatedAt).toISOString();
8397
- const branch = execSync7(
8433
+ const branch = execSync8(
8398
8434
  "git rev-parse --abbrev-ref HEAD 2>/dev/null",
8399
8435
  { encoding: "utf8", timeout: 3e3 }
8400
8436
  ).trim();
8401
8437
  const branchArg = branch && branch !== "HEAD" ? branch : "";
8402
- const commitCount = execSync7(
8438
+ const commitCount = execSync8(
8403
8439
  `git log --oneline --since="${since}" ${branchArg} 2>/dev/null | wc -l`,
8404
8440
  { encoding: "utf8", timeout: 5e3 }
8405
8441
  ).trim();