@askexenow/exe-os 0.8.32 → 0.8.36

package/dist/hooks/pre-tool-use.js

@@ -203,12 +203,58 @@ var init_config = __esm({
   }
 });
 
-// src/types/memory.ts
-var EMBEDDING_DIM;
-var init_memory = __esm({
-  "src/types/memory.ts"() {
+// src/lib/db-retry.ts
+function isBusyError(err) {
+  if (err instanceof Error) {
+    const msg = err.message.toLowerCase();
+    return msg.includes("sqlite_busy") || msg.includes("database is locked");
+  }
+  return false;
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function retryOnBusy(fn, label) {
+  let lastError;
+  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastError = err;
+      if (!isBusyError(err) || attempt === MAX_RETRIES) {
+        throw err;
+      }
+      const backoff = BASE_DELAY_MS * Math.pow(2, attempt);
+      const jitter = Math.floor(Math.random() * MAX_JITTER_MS);
+      process.stderr.write(
+        `[exe-os] SQLITE_BUSY ${label} retry ${attempt + 1}/${MAX_RETRIES} \u2014 waiting ${backoff + jitter}ms
+`
+      );
+      await delay(backoff + jitter);
+    }
+  }
+  throw lastError;
+}
+function wrapWithRetry(client) {
+  return new Proxy(client, {
+    get(target, prop, receiver) {
+      if (prop === "execute") {
+        return (sql) => retryOnBusy(() => target.execute(sql), "execute");
+      }
+      if (prop === "batch") {
+        return (stmts) => retryOnBusy(() => target.batch(stmts), "batch");
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+}
+var MAX_RETRIES, BASE_DELAY_MS, MAX_JITTER_MS;
+var init_db_retry = __esm({
+  "src/lib/db-retry.ts"() {
     "use strict";
-    EMBEDDING_DIM = 1024;
+    MAX_RETRIES = 3;
+    BASE_DELAY_MS = 200;
+    MAX_JITTER_MS = 300;
   }
 });
 
@@ -219,6 +265,7 @@ __export(database_exports, {
   disposeTurso: () => disposeTurso,
   ensureSchema: () => ensureSchema,
   getClient: () => getClient,
+  getRawClient: () => getRawClient,
   initDatabase: () => initDatabase,
   initTurso: () => initTurso,
   isInitialized: () => isInitialized
@@ -228,6 +275,7 @@ async function initDatabase(config) {
   if (_client) {
     _client.close();
     _client = null;
+    _resilientClient = null;
   }
   const opts = {
     url: `file:${config.dbPath}`
@@ -236,20 +284,27 @@ async function initDatabase(config) {
     opts.encryptionKey = config.encryptionKey;
   }
   _client = createClient(opts);
+  _resilientClient = wrapWithRetry(_client);
 }
 function isInitialized() {
   return _client !== null;
 }
 function getClient() {
+  if (!_resilientClient) {
+    throw new Error("Database client not initialized. Call initDatabase() first.");
+  }
+  return _resilientClient;
+}
+function getRawClient() {
   if (!_client) {
     throw new Error("Database client not initialized. Call initDatabase() first.");
   }
   return _client;
 }
 async function ensureSchema() {
-  const client = getClient();
+  const client = getRawClient();
   await client.execute("PRAGMA journal_mode = WAL");
-  await client.execute("PRAGMA busy_timeout = 5000");
+  await client.execute("PRAGMA busy_timeout = 30000");
   try {
     await client.execute("PRAGMA libsql_vector_search_ef = 128");
   } catch {
@@ -1042,28 +1097,344 @@ async function disposeDatabase() {
   if (_client) {
     _client.close();
     _client = null;
+    _resilientClient = null;
   }
 }
-var _client, initTurso, disposeTurso;
+var _client, _resilientClient, initTurso, disposeTurso;
 var init_database = __esm({
   "src/lib/database.ts"() {
     "use strict";
+    init_db_retry();
     _client = null;
+    _resilientClient = null;
     initTurso = initDatabase;
     disposeTurso = disposeDatabase;
   }
 });
 
-// src/lib/keychain.ts
-import { readFile as readFile2, writeFile as writeFile2, unlink, mkdir as mkdir2, chmod } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
+// src/lib/employees.ts
+var employees_exports = {};
+__export(employees_exports, {
+  EMPLOYEES_PATH: () => EMPLOYEES_PATH,
+  addEmployee: () => addEmployee,
+  getEmployee: () => getEmployee,
+  getEmployeeByRole: () => getEmployeeByRole,
+  getEmployeeNamesByRole: () => getEmployeeNamesByRole,
+  hasRole: () => hasRole,
+  isMultiInstance: () => isMultiInstance,
+  loadEmployees: () => loadEmployees,
+  loadEmployeesSync: () => loadEmployeesSync,
+  registerBinSymlinks: () => registerBinSymlinks,
+  saveEmployees: () => saveEmployees,
+  validateEmployeeName: () => validateEmployeeName
+});
+import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { existsSync as existsSync2, symlinkSync, readlinkSync, readFileSync as readFileSync3 } from "fs";
+import { execSync as execSync3 } from "child_process";
 import path3 from "path";
+function validateEmployeeName(name) {
+  if (!name) {
+    return { valid: false, error: "Name is required" };
+  }
+  if (name.length > 32) {
+    return { valid: false, error: "Name must be 32 characters or fewer" };
+  }
+  if (!/^[a-z][a-z0-9]*$/.test(name)) {
+    return {
+      valid: false,
+      error: "Name must start with a letter and contain only lowercase alphanumeric characters"
+    };
+  }
+  return { valid: true };
+}
+async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
+  if (!existsSync2(employeesPath)) {
+    return [];
+  }
+  const raw = await readFile2(employeesPath, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return [];
+  }
+}
+async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
+  await mkdir2(path3.dirname(employeesPath), { recursive: true });
+  await writeFile2(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
+}
+function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
+  if (!existsSync2(employeesPath)) return [];
+  try {
+    return JSON.parse(readFileSync3(employeesPath, "utf-8"));
+  } catch {
+    return [];
+  }
+}
+function getEmployee(employees, name) {
+  return employees.find((e) => e.name.toLowerCase() === name.toLowerCase());
+}
+function getEmployeeByRole(employees, role) {
+  const lower = role.toLowerCase();
+  return employees.find((e) => e.role.toLowerCase() === lower);
+}
+function getEmployeeNamesByRole(employees, role) {
+  const lower = role.toLowerCase();
+  return employees.filter((e) => e.role.toLowerCase() === lower).map((e) => e.name);
+}
+function hasRole(agentName, role) {
+  const employees = loadEmployeesSync();
+  const emp = getEmployee(employees, agentName);
+  return emp ? emp.role.toLowerCase() === role.toLowerCase() : false;
+}
+function isMultiInstance(agentName, employees) {
+  const roster = employees ?? loadEmployeesSync();
+  const emp = getEmployee(roster, agentName);
+  if (!emp) return false;
+  return MULTI_INSTANCE_ROLES.has(emp.role.toLowerCase());
+}
+function addEmployee(employees, employee) {
+  const normalized = { ...employee, name: employee.name.toLowerCase() };
+  if (employees.some((e) => e.name.toLowerCase() === normalized.name)) {
+    throw new Error(`Employee '${normalized.name}' already exists`);
+  }
+  return [...employees, normalized];
+}
+function registerBinSymlinks(name) {
+  const created = [];
+  const skipped = [];
+  const errors = [];
+  let exeBinPath;
+  try {
+    exeBinPath = execSync3("which exe", { encoding: "utf-8" }).trim();
+  } catch {
+    errors.push("Could not find 'exe' in PATH");
+    return { created, skipped, errors };
+  }
+  const binDir = path3.dirname(exeBinPath);
+  let target;
+  try {
+    target = readlinkSync(exeBinPath);
+  } catch {
+    errors.push("Could not read 'exe' symlink");
+    return { created, skipped, errors };
+  }
+  for (const suffix of ["", "-opencode"]) {
+    const linkName = `${name}${suffix}`;
+    const linkPath = path3.join(binDir, linkName);
+    if (existsSync2(linkPath)) {
+      skipped.push(linkName);
+      continue;
+    }
+    try {
+      symlinkSync(target, linkPath);
+      created.push(linkName);
+    } catch (err) {
+      errors.push(`${linkName}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return { created, skipped, errors };
+}
+var EMPLOYEES_PATH, MULTI_INSTANCE_ROLES;
+var init_employees = __esm({
+  "src/lib/employees.ts"() {
+    "use strict";
+    init_config();
+    EMPLOYEES_PATH = path3.join(EXE_AI_DIR, "exe-employees.json");
+    MULTI_INSTANCE_ROLES = /* @__PURE__ */ new Set(["principal engineer", "content production specialist", "staff code reviewer"]);
+  }
+});
+
+// src/lib/yoshi-delegation-gate.ts
+var yoshi_delegation_gate_exports = {};
+__export(yoshi_delegation_gate_exports, {
+  GATED_AGENT: () => GATED_AGENT,
+  GATED_ROLE: () => GATED_ROLE,
+  GATE_BLOCK_MESSAGE: () => GATE_BLOCK_MESSAGE,
+  classifyPath: () => classifyPath,
+  evaluateDelegationGate: () => evaluateDelegationGate,
+  hasRecentTomDispatch: () => hasRecentTomDispatch,
+  hasValidScratchpadEscape: () => hasValidScratchpadEscape,
+  scratchpadPath: () => scratchpadPath
+});
+import os2 from "os";
+import path4 from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync4, statSync } from "fs";
+function resolveGatedAgent() {
+  try {
+    const employees = loadEmployeesSync();
+    const cto = getEmployeeByRole(employees, GATED_ROLE);
+    return cto?.name ?? "yoshi";
+  } catch {
+    return "yoshi";
+  }
+}
+function toWorkspaceRelative(filePath, cwd = process.cwd()) {
+  const normalized = path4.normalize(filePath);
+  if (normalized.startsWith(cwd + path4.sep)) {
+    return normalized.slice(cwd.length + 1);
+  }
+  if (path4.isAbsolute(normalized)) {
+    return path4.basename(normalized);
+  }
+  return normalized;
+}
+function isDockerfile(basename) {
+  return basename === BLOCKED_DOCKERFILE_PREFIX || basename.startsWith(`${BLOCKED_DOCKERFILE_PREFIX}.`);
+}
+function classifyPath(filePath, cwd) {
+  const rel = toWorkspaceRelative(filePath, cwd);
+  const basename = path4.basename(rel);
+  const ext = path4.extname(rel).toLowerCase();
+  if (ext === ".md") {
+    for (const prefix of EXEMPT_MD_DIR_PREFIXES) {
+      if (rel.startsWith(prefix)) return "exempt";
+    }
+    if (!BLOCKED_PATH_PREFIXES.some((p) => rel.startsWith(p))) {
+      return "exempt";
+    }
+  }
+  if (BLOCKED_FILENAMES.includes(basename)) return "code";
+  if (isDockerfile(basename)) return "code";
+  if (BLOCKED_EXTENSIONS.includes(ext)) return "code";
+  if (BLOCKED_PATH_PREFIXES.some((p) => rel.startsWith(p))) return "code";
+  return "exempt";
+}
+async function hasRecentTomDispatch(now = Date.now()) {
+  try {
+    const client = getClient();
+    const engineers = loadEmployeesSync().filter(
+      (e) => e.role.toLowerCase() === "principal engineer"
+    );
+    const engineerNames = engineers.map((e) => e.name);
+    if (engineerNames.length === 0) return false;
+    const placeholders = engineerNames.map(() => "?").join(",");
+    const result = await client.execute({
+      sql: `SELECT MAX(created_at) AS last_dispatch
+            FROM tasks
+            WHERE assigned_by = ? AND assigned_to IN (${placeholders})`,
+      args: [GATED_AGENT, ...engineerNames]
+    });
+    const raw = result.rows[0]?.last_dispatch;
+    if (raw === null || raw === void 0) return false;
+    const parsed = Date.parse(String(raw));
+    if (Number.isNaN(parsed)) return false;
+    return now - parsed <= RECENT_DISPATCH_WINDOW_MS;
+  } catch {
+    return false;
+  }
+}
+function scratchpadPath(sessionId, homeDir = os2.homedir()) {
+  return path4.join(
+    homeDir,
+    ".exe-os",
+    "session-cache",
+    `yoshi-scratchpad-${sessionId}.txt`
+  );
+}
+function hasValidScratchpadEscape(sessionId, now = Date.now(), homeDir = os2.homedir()) {
+  const filePath = scratchpadPath(sessionId, homeDir);
+  if (!existsSync3(filePath)) return false;
+  try {
+    const stat = statSync(filePath);
+    if (now - stat.mtimeMs > SCRATCHPAD_MAX_AGE_MS) return false;
+    const body = readFileSync4(filePath, "utf-8");
+    return SCRATCHPAD_ESCAPE_PATTERN.test(body);
+  } catch {
+    return false;
+  }
+}
+async function evaluateDelegationGate(opts) {
+  if (opts.agentId !== GATED_AGENT) {
+    return { outcome: "allow", reason: "agent_not_gated" };
+  }
+  if (!/^(Write|Edit)$/.test(opts.toolName)) {
+    return { outcome: "allow", reason: "tool_not_gated" };
+  }
+  if (classifyPath(opts.filePath, opts.cwd) === "exempt") {
+    return { outcome: "allow", reason: "exempt_path" };
+  }
+  if (await hasRecentTomDispatch(opts.now)) {
+    return { outcome: "allow", reason: "recent_tom_dispatch" };
+  }
+  if (hasValidScratchpadEscape(opts.sessionId, opts.now, opts.homeDir)) {
+    return { outcome: "allow", reason: "scratchpad_escape" };
+  }
+  return { outcome: "block", reason: "no_delegation_no_escape" };
+}
+var GATED_ROLE, GATED_AGENT, BLOCKED_PATH_PREFIXES, BLOCKED_FILENAMES, BLOCKED_DOCKERFILE_PREFIX, BLOCKED_EXTENSIONS, EXEMPT_MD_DIR_PREFIXES, RECENT_DISPATCH_WINDOW_MS, SCRATCHPAD_MAX_AGE_MS, SCRATCHPAD_ESCAPE_PATTERN, GATE_BLOCK_MESSAGE;
+var init_yoshi_delegation_gate = __esm({
+  "src/lib/yoshi-delegation-gate.ts"() {
+    "use strict";
+    init_database();
+    init_employees();
+    GATED_ROLE = "CTO";
+    GATED_AGENT = resolveGatedAgent();
+    BLOCKED_PATH_PREFIXES = [
+      "src/",
+      "tests/",
+      "scripts/",
+      "bin/",
+      ".github/workflows/",
+      ".claude/skills/"
+    ];
+    BLOCKED_FILENAMES = [
+      "package.json",
+      "tsconfig.json",
+      "docker-compose.yml"
+    ];
+    BLOCKED_DOCKERFILE_PREFIX = "Dockerfile";
+    BLOCKED_EXTENSIONS = [
+      ".ts",
+      ".js",
+      ".tsx",
+      ".jsx",
+      ".rs",
+      ".py",
+      ".go",
+      ".sh",
+      ".yaml",
+      ".yml",
+      ".prisma",
+      ".sql"
+    ];
+    EXEMPT_MD_DIR_PREFIXES = [
+      ".planning/",
+      "exe/output/",
+      "exe/yoshi/",
+      "exe/tom/",
+      "exe/",
+      "docs/"
+    ];
+    RECENT_DISPATCH_WINDOW_MS = 5 * 60 * 1e3;
+    SCRATCHPAD_MAX_AGE_MS = 10 * 60 * 1e3;
+    SCRATCHPAD_ESCAPE_PATTERN = /^TOM-CAPABLE:\s*NO\s*—\s*reason:\s*\S+/m;
+    GATE_BLOCK_MESSAGE = [
+      "\u26A0\uFE0F DELEGATE CHECK: this edit looks implementable by Tom.",
+      "Dispatch create_task now OR mark TOM-CAPABLE: NO with reason.",
+      "No code until decided."
+    ].join("\n");
+  }
+});
+
+// src/types/memory.ts
+var EMBEDDING_DIM;
+var init_memory = __esm({
+  "src/types/memory.ts"() {
+    "use strict";
+    EMBEDDING_DIM = 1024;
+  }
+});
+
+// src/lib/keychain.ts
+import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod } from "fs/promises";
+import { existsSync as existsSync4 } from "fs";
+import path5 from "path";
 import crypto from "crypto";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path3.join(process.env.HOME ?? "/tmp", ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path5.join(process.env.HOME ?? "/tmp", ".exe-os");
 }
 function getKeyPath() {
-  return path3.join(getKeyDir(), "master.key");
+  return path5.join(getKeyDir(), "master.key");
 }
 async function tryKeytar() {
   try {
@@ -1084,11 +1455,11 @@ async function getMasterKey() {
     }
   }
   const keyPath = getKeyPath();
-  if (!existsSync2(keyPath)) {
+  if (!existsSync4(keyPath)) {
     return null;
   }
   try {
-    const content = await readFile2(keyPath, "utf-8");
+    const content = await readFile3(keyPath, "utf-8");
     return Buffer.from(content.trim(), "base64");
   } catch {
     return null;
@@ -1116,12 +1487,12 @@ __export(shard_manager_exports, {
   listShards: () => listShards,
   shardExists: () => shardExists
 });
-import path4 from "path";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
+import path6 from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
-  if (!existsSync3(SHARDS_DIR)) {
+  if (!existsSync5(SHARDS_DIR)) {
     mkdirSync2(SHARDS_DIR, { recursive: true });
   }
   _shardingEnabled = true;
@@ -1142,7 +1513,7 @@ function getShardClient(projectName) {
   }
   const cached = _shards.get(safeName);
   if (cached) return cached;
-  const dbPath = path4.join(SHARDS_DIR, `${safeName}.db`);
+  const dbPath = path6.join(SHARDS_DIR, `${safeName}.db`);
   const client = createClient2({
     url: `file:${dbPath}`,
     encryptionKey: _encryptionKey
@@ -1152,16 +1523,16 @@ function getShardClient(projectName) {
 }
 function shardExists(projectName) {
   const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return existsSync3(path4.join(SHARDS_DIR, `${safeName}.db`));
+  return existsSync5(path6.join(SHARDS_DIR, `${safeName}.db`));
 }
 function listShards() {
-  if (!existsSync3(SHARDS_DIR)) return [];
+  if (!existsSync5(SHARDS_DIR)) return [];
   const { readdirSync: readdirSync2 } = __require("fs");
   return readdirSync2(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
   await client.execute("PRAGMA journal_mode = WAL");
-  await client.execute("PRAGMA busy_timeout = 5000");
+  await client.execute("PRAGMA busy_timeout = 30000");
   try {
     await client.execute("PRAGMA libsql_vector_search_ef = 128");
   } catch {
@@ -1338,7 +1709,7 @@ var init_shard_manager = __esm({
   "src/lib/shard-manager.ts"() {
     "use strict";
     init_config();
-    SHARDS_DIR = path4.join(EXE_AI_DIR, "shards");
+    SHARDS_DIR = path6.join(EXE_AI_DIR, "shards");
     _shards = /* @__PURE__ */ new Map();
     _encryptionKey = null;
     _shardingEnabled = false;
@@ -1780,160 +2151,6 @@ var init_store = __esm({
   }
 });
 
-// src/lib/yoshi-delegation-gate.ts
-var yoshi_delegation_gate_exports = {};
-__export(yoshi_delegation_gate_exports, {
-  GATED_AGENT: () => GATED_AGENT,
-  GATE_BLOCK_MESSAGE: () => GATE_BLOCK_MESSAGE,
-  classifyPath: () => classifyPath,
-  evaluateDelegationGate: () => evaluateDelegationGate,
-  hasRecentTomDispatch: () => hasRecentTomDispatch,
-  hasValidScratchpadEscape: () => hasValidScratchpadEscape,
-  scratchpadPath: () => scratchpadPath
-});
-import os2 from "os";
-import path5 from "path";
-import { existsSync as existsSync4, readFileSync as readFileSync3, statSync } from "fs";
-function toWorkspaceRelative(filePath, cwd = process.cwd()) {
-  const normalized = path5.normalize(filePath);
-  if (normalized.startsWith(cwd + path5.sep)) {
-    return normalized.slice(cwd.length + 1);
-  }
-  if (path5.isAbsolute(normalized)) {
-    return path5.basename(normalized);
-  }
-  return normalized;
-}
-function isDockerfile(basename) {
-  return basename === BLOCKED_DOCKERFILE_PREFIX || basename.startsWith(`${BLOCKED_DOCKERFILE_PREFIX}.`);
-}
-function classifyPath(filePath, cwd) {
-  const rel = toWorkspaceRelative(filePath, cwd);
-  const basename = path5.basename(rel);
-  const ext = path5.extname(rel).toLowerCase();
-  if (ext === ".md") {
-    for (const prefix of EXEMPT_MD_DIR_PREFIXES) {
-      if (rel.startsWith(prefix)) return "exempt";
-    }
-    if (!BLOCKED_PATH_PREFIXES.some((p) => rel.startsWith(p))) {
-      return "exempt";
-    }
-  }
-  if (BLOCKED_FILENAMES.includes(basename)) return "code";
-  if (isDockerfile(basename)) return "code";
-  if (BLOCKED_EXTENSIONS.includes(ext)) return "code";
-  if (BLOCKED_PATH_PREFIXES.some((p) => rel.startsWith(p))) return "code";
-  return "exempt";
-}
-async function hasRecentTomDispatch(now = Date.now()) {
-  try {
-    const client = getClient();
-    const result = await client.execute({
-      sql: `SELECT MAX(created_at) AS last_dispatch
-            FROM tasks
-            WHERE assigned_by = ? AND assigned_to = 'tom'`,
-      args: [GATED_AGENT]
-    });
-    const raw = result.rows[0]?.last_dispatch;
-    if (raw === null || raw === void 0) return false;
-    const parsed = Date.parse(String(raw));
-    if (Number.isNaN(parsed)) return false;
-    return now - parsed <= RECENT_DISPATCH_WINDOW_MS;
-  } catch {
-    return false;
-  }
-}
-function scratchpadPath(sessionId, homeDir = os2.homedir()) {
-  return path5.join(
-    homeDir,
-    ".exe-os",
-    "session-cache",
-    `yoshi-scratchpad-${sessionId}.txt`
-  );
-}
-function hasValidScratchpadEscape(sessionId, now = Date.now(), homeDir = os2.homedir()) {
-  const filePath = scratchpadPath(sessionId, homeDir);
-  if (!existsSync4(filePath)) return false;
-  try {
-    const stat = statSync(filePath);
-    if (now - stat.mtimeMs > SCRATCHPAD_MAX_AGE_MS) return false;
-    const body = readFileSync3(filePath, "utf-8");
-    return SCRATCHPAD_ESCAPE_PATTERN.test(body);
-  } catch {
-    return false;
-  }
-}
-async function evaluateDelegationGate(opts) {
-  if (opts.agentId !== GATED_AGENT) {
-    return { outcome: "allow", reason: "agent_not_gated" };
-  }
-  if (!/^(Write|Edit)$/.test(opts.toolName)) {
-    return { outcome: "allow", reason: "tool_not_gated" };
-  }
-  if (classifyPath(opts.filePath, opts.cwd) === "exempt") {
-    return { outcome: "allow", reason: "exempt_path" };
-  }
-  if (await hasRecentTomDispatch(opts.now)) {
-    return { outcome: "allow", reason: "recent_tom_dispatch" };
-  }
-  if (hasValidScratchpadEscape(opts.sessionId, opts.now, opts.homeDir)) {
-    return { outcome: "allow", reason: "scratchpad_escape" };
-  }
-  return { outcome: "block", reason: "no_delegation_no_escape" };
-}
-var GATED_AGENT, BLOCKED_PATH_PREFIXES, BLOCKED_FILENAMES, BLOCKED_DOCKERFILE_PREFIX, BLOCKED_EXTENSIONS, EXEMPT_MD_DIR_PREFIXES, RECENT_DISPATCH_WINDOW_MS, SCRATCHPAD_MAX_AGE_MS, SCRATCHPAD_ESCAPE_PATTERN, GATE_BLOCK_MESSAGE;
-var init_yoshi_delegation_gate = __esm({
-  "src/lib/yoshi-delegation-gate.ts"() {
-    "use strict";
-    init_database();
-    GATED_AGENT = "yoshi";
-    BLOCKED_PATH_PREFIXES = [
-      "src/",
-      "tests/",
-      "scripts/",
-      "bin/",
-      ".github/workflows/",
-      ".claude/skills/"
-    ];
-    BLOCKED_FILENAMES = [
-      "package.json",
-      "tsconfig.json",
-      "docker-compose.yml"
-    ];
-    BLOCKED_DOCKERFILE_PREFIX = "Dockerfile";
-    BLOCKED_EXTENSIONS = [
-      ".ts",
-      ".js",
-      ".tsx",
-      ".jsx",
-      ".rs",
-      ".py",
-      ".go",
-      ".sh",
-      ".yaml",
-      ".yml",
-      ".prisma",
-      ".sql"
-    ];
-    EXEMPT_MD_DIR_PREFIXES = [
-      ".planning/",
-      "exe/output/",
-      "exe/yoshi/",
-      "exe/tom/",
-      "exe/",
-      "docs/"
-    ];
-    RECENT_DISPATCH_WINDOW_MS = 5 * 60 * 1e3;
-    SCRATCHPAD_MAX_AGE_MS = 10 * 60 * 1e3;
-    SCRATCHPAD_ESCAPE_PATTERN = /^TOM-CAPABLE:\s*NO\s*—\s*reason:\s*\S+/m;
-    GATE_BLOCK_MESSAGE = [
-      "\u26A0\uFE0F DELEGATE CHECK: this edit looks implementable by Tom.",
-      "Dispatch create_task now OR mark TOM-CAPABLE: NO with reason.",
-      "No code until decided."
-    ].join("\n");
-  }
-});
-
 // src/lib/review-gate.ts
 var review_gate_exports = {};
 __export(review_gate_exports, {
@@ -1943,12 +2160,12 @@ __export(review_gate_exports, {
   checkTestCoverage: () => checkTestCoverage,
   runReviewGate: () => runReviewGate
 });
-import { execSync as execSync3 } from "child_process";
-import { existsSync as existsSync5 } from "fs";
+import { execSync as execSync4 } from "child_process";
+import { existsSync as existsSync6 } from "fs";
 function checkCommitsExist(taskCreatedAt) {
   try {
     const since = new Date(taskCreatedAt).toISOString();
-    const output = execSync3(
+    const output = execSync4(
       `git log --oneline --since="${since}" --no-merges 2>/dev/null`,
       { encoding: "utf8", timeout: 5e3 }
     ).trim();
@@ -1965,7 +2182,7 @@ function checkLayerBoundaries(taskCreatedAt) {
   const violations = [];
   try {
     const since = new Date(taskCreatedAt).toISOString();
-    const filesOutput = execSync3(
+    const filesOutput = execSync4(
       `git log --since="${since}" --no-merges --name-only --pretty=format: 2>/dev/null`,
       { encoding: "utf8", timeout: 5e3 }
     ).trim();
@@ -1974,7 +2191,7 @@ function checkLayerBoundaries(taskCreatedAt) {
     const libFiles = changedFiles.filter((f) => f.startsWith("src/lib/"));
     for (const file of libFiles) {
       try {
-        const grepResult = execSync3(
+        const grepResult = execSync4(
           `grep -nE "from ['"]\\.\\./(adapters|tui|runtime)/" "${file}" 2>/dev/null`,
           { encoding: "utf8", timeout: 3e3 }
         ).trim();
@@ -1994,7 +2211,7 @@ function checkTestCoverage(taskCreatedAt) {
   const warnings = [];
   try {
     const since = new Date(taskCreatedAt).toISOString();
-    const output = execSync3(
+    const output = execSync4(
       `git log --since="${since}" --no-merges --diff-filter=A --name-only --pretty=format: 2>/dev/null`,
       { encoding: "utf8", timeout: 5e3 }
     ).trim();
@@ -2007,10 +2224,10 @@ function checkTestCoverage(taskCreatedAt) {
       const testPath = file.replace(/^src\//, "tests/").replace(/\.ts$/, ".test.ts");
       const baseName = file.split("/").pop()?.replace(/\.ts$/, "") ?? "";
       const testDir = testPath.substring(0, testPath.lastIndexOf("/"));
-      const hasDirectTest = existsSync5(testPath);
+      const hasDirectTest = existsSync6(testPath);
       let hasRelatedTest = false;
       try {
-        const related = execSync3(
+        const related = execSync4(
           `find "${testDir}" -name "*${baseName}*" -name "*.test.ts" 2>/dev/null`,
           { encoding: "utf8", timeout: 3e3 }
         ).trim();
@@ -2061,9 +2278,9 @@ var init_review_gate = __esm({
 });
 
 // src/adapters/claude/hooks/pre-tool-use.ts
-import { existsSync as existsSync6, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
-import { execSync as execSync4 } from "child_process";
-import path6 from "path";
+import { existsSync as existsSync7, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
+import { execSync as execSync5 } from "child_process";
+import path7 from "path";
 
 // src/adapters/claude/active-agent.ts
 init_config();
@@ -2163,17 +2380,17 @@ if (!process.env.AGENT_ID) {
 var DELEGATION_TASK_THRESHOLD = 3;
 var CTO_ROLES = ["CTO", "executive"];
 var TOM_SESSION_PATTERN = /^tom.*-exe/;
-var CACHE_DIR2 = path6.join(EXE_AI_DIR, "session-cache");
+var CACHE_DIR2 = path7.join(EXE_AI_DIR, "session-cache");
 var timeout = setTimeout(() => {
   process.exit(0);
 }, 5e3);
 timeout.unref();
 function getDelegationFlagPath() {
-  return path6.join(CACHE_DIR2, `delegation-checkpoint-${getSessionKey()}.json`);
+  return path7.join(CACHE_DIR2, `delegation-checkpoint-${getSessionKey()}.json`);
 }
 function hasDelegationFired() {
   try {
-    return existsSync6(getDelegationFlagPath());
+    return existsSync7(getDelegationFlagPath());
   } catch {
     return false;
   }
@@ -2187,7 +2404,7 @@ function markDelegationFired() {
 }
 function countTomSessions() {
   try {
-    const output = execSync4("tmux list-sessions 2>/dev/null", {
+    const output = execSync5("tmux list-sessions 2>/dev/null", {
       encoding: "utf8",
       timeout: 2e3
     });
@@ -2222,7 +2439,8 @@ This write was prevented. Do NOT retry.`
         process.exit(0);
       }
     }
-    if (agent.agentId === "yoshi" && /^(Write|Edit)$/.test(data.tool_name)) {
+    const { GATED_AGENT: gatedAgent } = await Promise.resolve().then(() => (init_yoshi_delegation_gate(), yoshi_delegation_gate_exports));
+    if (agent.agentId === gatedAgent && /^(Write|Edit)$/.test(data.tool_name)) {
       const filePath = data.tool_input?.file_path ?? "";
       if (filePath) {
         try {
@@ -2284,7 +2502,8 @@ This write was prevented. Do NOT retry.`
         });
         if (taskRow.rows.length > 0) {
           const task = taskRow.rows[0];
-          if (task.assigned_to === "tom") {
+          const { hasRole: hasEngineerRole } = await Promise.resolve().then(() => (init_employees(), employees_exports));
+          if (hasEngineerRole(task.assigned_to, "Principal Engineer")) {
             const { runReviewGate: runReviewGate2 } = await Promise.resolve().then(() => (init_review_gate(), review_gate_exports));
             const gate = runReviewGate2({
               taskCreatedAt: task.created_at,