@askexenow/exe-os 0.8.36 → 0.8.38

package/dist/bin/cli.js

@@ -621,6 +621,10 @@ async function mergeHooks(packageRoot, homeDir = os3.homedir()) {
   if (!settings.hooks) {
     settings.hooks = {};
   }
+  if (settings.hooks && typeof settings.hooks !== "object") {
+    console.warn("[exe-os] Unexpected hooks schema in settings.json \u2014 skipping hook installation");
+    return { added: 0, skipped: 0 };
+  }
   const hooksToRegister = [
     {
       event: "PostToolUse",
@@ -783,6 +787,11 @@ async function mergeHooks(packageRoot, homeDir = os3.homedir()) {
     if (!settings.hooks[event]) {
       settings.hooks[event] = [];
     }
+    if (!Array.isArray(settings.hooks[event])) {
+      console.warn(`[exe-os] Hook event "${event}" has unexpected structure \u2014 skipping`);
+      skipped++;
+      continue;
+    }
     const existing = settings.hooks[event];
     const correctCommand = group.hooks[0]?.command ?? "";
     const alreadyCorrect = existing.some(
@@ -807,26 +816,56 @@ async function mergeHooks(packageRoot, homeDir = os3.homedir()) {
     permissions.allow = [];
   }
   const toolNames = [
+    // Core memory
     "store_memory",
     "recall_my_memory",
+    "commit_to_long_term_memory",
+    "consolidate_memories",
+    "ask_team_memory",
+    "get_session_context",
+    // Tasks
     "create_task",
     "list_tasks",
     "get_task",
     "update_task",
     "close_task",
+    "checkpoint_task",
+    // Behaviors
     "store_behavior",
     "deactivate_behavior",
-    "send_message",
+    "list_behaviors",
+    // Identity
     "get_identity",
     "update_identity",
-    "ask_team_memory",
-    "get_session_context",
+    // Messaging
+    "send_message",
+    "acknowledge_messages",
+    "send_whatsapp",
+    "query_conversations",
+    // Reminders + triggers
     "create_reminder",
     "complete_reminder",
     "list_reminders",
-    "list_behaviors",
+    "create_trigger",
+    "list_triggers",
+    // GraphRAG
     "query_relationships",
-    "commit_to_long_term_memory"
+    "merge_entities",
+    // Documents + wiki
+    "ingest_document",
+    "list_documents",
+    "purge_document",
+    "rerank_documents",
+    "set_document_importance",
+    "create_wiki_page",
+    "update_wiki_page",
+    "get_wiki_page",
+    "list_wiki_pages",
+    // System
+    "load_skill",
+    "apply_starter_pack",
+    "resume_employee",
+    "deploy_client"
   ];
   const allowList = permissions.allow;
   for (const tool of expandDualPrefixTools(toolNames)) {
@@ -2024,7 +2063,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path6 from "path";
-import { existsSync as existsSync6, mkdirSync as mkdirSync2 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readdirSync } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -2063,8 +2102,7 @@ function shardExists(projectName) {
 }
 function listShards() {
   if (!existsSync6(SHARDS_DIR)) return [];
-  const { readdirSync: readdirSync4 } = __require("fs");
-  return readdirSync4(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
+  return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
   await client.execute("PRAGMA journal_mode = WAL");
@@ -2329,7 +2367,8 @@ async function writeMemory(record) {
     has_error: record.has_error ? 1 : 0,
     raw_text: record.raw_text,
     vector: record.vector,
-    version: _nextVersion++,
+    version: 0,
+    // Placeholder — assigned atomically at flush time
     task_id: record.task_id ?? null,
     importance: record.importance ?? 5,
     status: record.status ?? "active",
@@ -2346,6 +2385,12 @@ async function writeMemory(record) {
     supersedes_id: record.supersedes_id ?? null
   };
   _pendingRecords.push(dbRow);
+  const MAX_PENDING = 1e3;
+  if (_pendingRecords.length > MAX_PENDING) {
+    const dropped = _pendingRecords.length - MAX_PENDING;
+    _pendingRecords = _pendingRecords.slice(-MAX_PENDING);
+    console.warn(`[store] Dropped ${dropped} oldest pending records (overflow)`);
+  }
   if (_flushTimer === null) {
     _flushTimer = setInterval(() => {
       void flushBatch();
@@ -2363,6 +2408,13 @@ async function flushBatch() {
   _flushing = true;
   try {
     const batch = _pendingRecords.slice(0);
+    const client = getClient();
+    const vResult = await client.execute("SELECT MAX(version) as max_v FROM memories");
+    let baseVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
+    for (const row of batch) {
+      row.version = baseVersion++;
+    }
+    _nextVersion = baseVersion;
     const buildStmt = (row) => {
       const hasVector = row.vector !== null;
       const taskId = row.task_id ?? null;
@@ -3309,65 +3361,72 @@ async function backfillConversations(options) {
   process.stderr.write(`[backfill-conversations] Found ${files.length} JSONL files to process
 `);
   process.env.EXE_EMBED_PRIORITY = "low";
-  for (const file of files) {
-    stats.filesScanned++;
-    if (existingPaths.has(file)) {
-      stats.skippedDedup++;
-      continue;
-    }
-    const conv = await parseConversation(file);
-    if (conv.totalMessages < MIN_MESSAGES) {
-      stats.skippedTooShort++;
-      continue;
-    }
-    const summary = buildSummary(conv);
-    if (options.dryRun) {
-      process.stdout.write(`
+  const BATCH_SIZE = 50;
+  const MAX_DEDUP_SIZE = 5e4;
+  for (let batchStart = 0; batchStart < files.length; batchStart += BATCH_SIZE) {
+    const batch = files.slice(batchStart, batchStart + BATCH_SIZE);
+    for (const file of batch) {
+      stats.filesScanned++;
+      if (existingPaths.size < MAX_DEDUP_SIZE && existingPaths.has(file)) {
+        stats.skippedDedup++;
+        continue;
+      }
+      const conv = await parseConversation(file);
+      if (conv.totalMessages < MIN_MESSAGES) {
+        stats.skippedTooShort++;
+        continue;
+      }
+      const summary = buildSummary(conv);
+      if (options.dryRun) {
+        process.stdout.write(`
 \u2500\u2500\u2500 ${file} \u2500\u2500\u2500
 `);
-      process.stdout.write(`Project: ${conv.projectName} | Messages: ${conv.totalMessages}`);
-      process.stdout.write(` | Tools: ${Object.keys(conv.toolCounts).length}`);
-      process.stdout.write(` | Files: ${conv.filesTouched.size}
+        process.stdout.write(`Project: ${conv.projectName} | Messages: ${conv.totalMessages}`);
+        process.stdout.write(` | Tools: ${Object.keys(conv.toolCounts).length}`);
+        process.stdout.write(` | Files: ${conv.filesTouched.size}
 `);
-      const firstPrompt = conv.userMessages[0];
-      if (firstPrompt) {
-        process.stdout.write(`First prompt: ${firstPrompt.slice(0, 120)}
+        const firstPrompt = conv.userMessages[0];
+        if (firstPrompt) {
+          process.stdout.write(`First prompt: ${firstPrompt.slice(0, 120)}
 `);
+        }
+        stats.conversationsStored++;
+        continue;
+      }
+      let vector = null;
+      if (daemonConnected) {
+        try {
+          vector = await embedViaClient(summary, "low");
+          if (!vector) stats.embedFailed++;
+        } catch {
+          stats.embedFailed++;
+        }
+      }
+      await writeMemory({
+        id: crypto2.randomUUID(),
+        agent_id: conv.agentId,
+        agent_role: conv.agentId === "exe" ? "COO" : "specialist",
+        session_id: conv.sessionId,
+        timestamp: conv.startTime ?? (/* @__PURE__ */ new Date()).toISOString(),
+        tool_name: TOOL_NAME,
+        project_name: conv.projectName,
+        has_error: conv.errorCount > 0,
+        raw_text: summary,
+        vector,
+        source_path: file,
+        source_type: "conversation"
+      });
+      if (existingPaths.size < MAX_DEDUP_SIZE) {
+        existingPaths.add(file);
       }
       stats.conversationsStored++;
-      continue;
-    }
-    let vector = null;
-    if (daemonConnected) {
-      try {
-        vector = await embedViaClient(summary, "low");
-        if (!vector) stats.embedFailed++;
-      } catch {
-        stats.embedFailed++;
-      }
-    }
-    await writeMemory({
-      id: crypto2.randomUUID(),
-      agent_id: conv.agentId,
-      agent_role: conv.agentId === "exe" ? "COO" : "specialist",
-      session_id: conv.sessionId,
-      timestamp: conv.startTime ?? (/* @__PURE__ */ new Date()).toISOString(),
-      tool_name: TOOL_NAME,
-      project_name: conv.projectName,
-      has_error: conv.errorCount > 0,
-      raw_text: summary,
-      vector,
-      source_path: file,
-      source_type: "conversation"
-    });
-    existingPaths.add(file);
-    stats.conversationsStored++;
-    if (stats.filesScanned % 50 === 0) {
-      process.stderr.write(
-        `[backfill-conversations] Progress: ${stats.filesScanned}/${files.length} files, ${stats.conversationsStored} stored
+      if (stats.filesScanned % 50 === 0) {
+        process.stderr.write(
+          `[backfill-conversations] Progress: ${stats.filesScanned}/${files.length} files, ${stats.conversationsStored} stored
 `
-      );
-      await flushBatch();
+        );
+        await flushBatch();
+      }
     }
   }
   if (!options.dryRun) {
@@ -3425,6 +3484,7 @@ __export(employee_templates_exports, {
   buildCustomEmployeePrompt: () => buildCustomEmployeePrompt,
   getSessionPrompt: () => getSessionPrompt,
   getTemplate: () => getTemplate,
+  getTemplateByRole: () => getTemplateByRole,
   personalizePrompt: () => personalizePrompt,
   renderClientCOOTemplate: () => renderClientCOOTemplate
 });
@@ -3440,6 +3500,10 @@ function buildCustomEmployeePrompt(name, role) {
 function getTemplate(name) {
   return TEMPLATES[name];
 }
+function getTemplateByRole(role) {
+  const lower = role.toLowerCase();
+  return Object.values(TEMPLATES).find((t) => t.role.toLowerCase() === lower);
+}
 function personalizePrompt(prompt, templateName, actualName) {
   if (templateName === actualName) return prompt;
   const escaped = templateName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -4224,48 +4288,67 @@ async function downloadModel(opts) {
   const tmpPath = destPath + ".tmp";
   await mkdir5(destDir, { recursive: true });
   if (existsSync9(destPath)) {
-    const hash2 = await fileHash(destPath);
-    if (hash2 === EXPECTED_SHA256) {
+    const hash = await fileHash(destPath);
+    if (hash === EXPECTED_SHA256) {
       return destPath;
     }
   }
-  if (existsSync9(tmpPath)) unlinkSync3(tmpPath);
-  const response = await fetchFn(GGUF_URL, { redirect: "follow" });
-  if (!response.ok || !response.body) {
-    throw new Error(`Download failed: HTTP ${response.status}`);
-  }
-  const contentLength = Number(response.headers.get("content-length") ?? EXPECTED_SIZE);
+  const MAX_RETRIES2 = 3;
+  const DOWNLOAD_TIMEOUT_MS = 3e5;
+  let lastErr;
   let downloaded = 0;
-  const hash = createHash("sha256");
-  const fileStream = createWriteStream(tmpPath);
-  const reader = response.body.getReader();
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      if (!fileStream.write(value)) {
-        await new Promise((resolve) => fileStream.once("drain", resolve));
+  for (let attempt = 1; attempt <= MAX_RETRIES2; attempt++) {
+    try {
+      if (existsSync9(tmpPath)) unlinkSync3(tmpPath);
+      const response = await fetchFn(GGUF_URL, {
+        redirect: "follow",
+        signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
+      });
+      if (!response.ok || !response.body) {
+        throw new Error(`Download failed: HTTP ${response.status}`);
+      }
+      const contentLength = Number(response.headers.get("content-length") ?? EXPECTED_SIZE);
+      const hash = createHash("sha256");
+      const fileStream = createWriteStream(tmpPath);
+      const reader = response.body.getReader();
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          if (!fileStream.write(value)) {
+            await new Promise((resolve) => fileStream.once("drain", resolve));
+          }
+          hash.update(value);
+          downloaded += value.byteLength;
+          onProgress?.(downloaded, contentLength);
+        }
+      } finally {
+        fileStream.end();
+        await new Promise((resolve, reject) => {
+          fileStream.on("finish", resolve);
+          fileStream.on("error", reject);
+        });
+      }
+      const actualHash = hash.digest("hex");
+      if (actualHash !== EXPECTED_SHA256) {
+        unlinkSync3(tmpPath);
+        throw new Error(
+          `SHA256 mismatch: expected ${EXPECTED_SHA256}, got ${actualHash}`
+        );
+      }
+      renameSync3(tmpPath, destPath);
+      return destPath;
+    } catch (err) {
+      lastErr = err instanceof Error ? err : new Error(String(err));
+      if (attempt < MAX_RETRIES2) {
+        process.stderr.write(`
+Download attempt ${attempt} failed, retrying...
+`);
+        if (existsSync9(tmpPath)) unlinkSync3(tmpPath);
       }
-      hash.update(value);
-      downloaded += value.byteLength;
-      onProgress?.(downloaded, contentLength);
     }
-  } finally {
-    fileStream.end();
-    await new Promise((resolve, reject) => {
-      fileStream.on("finish", resolve);
-      fileStream.on("error", reject);
-    });
   }
-  const actualHash = hash.digest("hex");
-  if (actualHash !== EXPECTED_SHA256) {
-    unlinkSync3(tmpPath);
-    throw new Error(
-      `SHA256 mismatch: expected ${EXPECTED_SHA256}, got ${actualHash}`
-    );
-  }
-  renameSync3(tmpPath, destPath);
-  return destPath;
+  throw lastErr;
 }
 async function fileHash(filePath) {
   return new Promise((resolve, reject) => {
@@ -4368,6 +4451,8 @@ __export(license_exports, {
   loadLicense: () => loadLicense,
   mirrorLicenseKey: () => mirrorLicenseKey,
   saveLicense: () => saveLicense,
+  startLicenseRevalidation: () => startLicenseRevalidation,
+  stopLicenseRevalidation: () => stopLicenseRevalidation,
   validateLicense: () => validateLicense
 });
 import { readFileSync as readFileSync6, writeFileSync as writeFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync3 } from "fs";
@@ -4492,14 +4577,23 @@ async function validateLicense(apiKey, deviceId) {
   } catch {
     const cached = await getCachedLicense();
     if (cached) return cached;
-    return FREE_LICENSE;
+    return { ...FREE_LICENSE, valid: false, error: "offline" };
+  }
+}
+function getCacheAgeMs() {
+  try {
+    const { statSync: statSync2 } = __require("fs");
+    const s = statSync2(CACHE_PATH);
+    return Date.now() - s.mtimeMs;
+  } catch {
+    return Infinity;
   }
 }
 async function checkLicense() {
   const key = loadLicense();
   if (!key) return FREE_LICENSE;
   const cached = await getCachedLicense();
-  if (cached) return cached;
+  if (cached && getCacheAgeMs() < CACHE_MAX_AGE_MS) return cached;
   const deviceId = loadDeviceId();
   return validateLicense(key, deviceId);
 }
@@ -4620,7 +4714,28 @@ async function assertVpsLicense(opts) {
     `License validation unreachable for more than ${graceDays} days. Restore network connectivity to https://askexe.com/cloud and retry. This VPS image refuses to boot after the offline grace window.`
   );
 }
-var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, API_BASE, LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG, PLAN_LIMITS, FREE_LICENSE;
+function startLicenseRevalidation(intervalMs = 36e5) {
+  if (_revalTimer) return;
+  _revalTimer = setInterval(async () => {
+    try {
+      const license = await checkLicense();
+      if (!license.valid) {
+        process.stderr.write("[exe-os] License expired or invalid \u2014 features may be restricted\n");
+      }
+    } catch {
+    }
+  }, intervalMs);
+  if (_revalTimer && typeof _revalTimer === "object" && "unref" in _revalTimer) {
+    _revalTimer.unref();
+  }
+}
+function stopLicenseRevalidation() {
+  if (_revalTimer) {
+    clearInterval(_revalTimer);
+    _revalTimer = null;
+  }
+}
+var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, API_BASE, LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG, PLAN_LIMITS, FREE_LICENSE, CACHE_MAX_AGE_MS, _revalTimer;
 var init_license = __esm({
   "src/lib/license.ts"() {
     "use strict";
@@ -4650,6 +4765,8 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
       employeeLimit: 1,
       memoryLimit: 5e3
     };
+    CACHE_MAX_AGE_MS = 36e5;
+    _revalTimer = null;
   }
 });
 
@@ -4663,7 +4780,7 @@ __export(identity_exports, {
   updateIdentity: () => updateIdentity
 });
 import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
-import { readdirSync } from "fs";
+import { readdirSync as readdirSync2 } from "fs";
 import path12 from "path";
 import { createHash as createHash2 } from "crypto";
 function ensureDir() {
@@ -4745,7 +4862,7 @@ async function updateIdentity(agentId, content, updatedBy) {
 }
 function listIdentities() {
   ensureDir();
-  const files = readdirSync(IDENTITY_DIR).filter((f) => f.endsWith(".md"));
+  const files = readdirSync2(IDENTITY_DIR).filter((f) => f.endsWith(".md"));
   const results = [];
   for (const file of files) {
     const agentId = file.replace(".md", "");
@@ -4792,6 +4909,7 @@ var init_identity = __esm({
 var identity_templates_exports = {};
 __export(identity_templates_exports, {
   IDENTITY_TEMPLATES: () => IDENTITY_TEMPLATES,
+  PLAN_MODE_COMPAT: () => PLAN_MODE_COMPAT,
   POST_WORK_CHECKLIST: () => POST_WORK_CHECKLIST,
   getTemplate: () => getTemplate2,
   getTemplateForTitle: () => getTemplateForTitle
@@ -4811,10 +4929,18 @@ function getTemplateForTitle(title) {
   if (t.includes("review") || t.includes("audit") || t.includes("qa")) return IDENTITY_TEMPLATES["staff-code-reviewer"];
   return null;
 }
-var POST_WORK_CHECKLIST, IDENTITY_TEMPLATES;
+var PLAN_MODE_COMPAT, POST_WORK_CHECKLIST, IDENTITY_TEMPLATES;
 var init_identity_templates = __esm({
   "src/lib/identity-templates.ts"() {
     "use strict";
+    PLAN_MODE_COMPAT = `
+## Plan Mode Compatibility
+If tool execution is unavailable (e.g., CC plan mode), switch to planning:
+- Reason about the task and create a written plan
+- Document what tools you would call and with what parameters
+- Output structured text that can be acted on when tools become available
+Do not repeatedly attempt tool calls that fail \u2014 switch to planning mode.
+`;
     POST_WORK_CHECKLIST = `
 5. Check for pending reviews (list_tasks status='needs_review' where you are reviewer) \u2014 reviews are work, process before new tasks
 6. Check for blocked tasks (list_tasks status='blocked') \u2014 can you unblock it? Do it now. Can't? Escalate to exe immediately.
@@ -4894,7 +5020,7 @@ Never say "I have no memories" without first searching broadly. Your memory may
 - **update_identity** \u2014 rewrite any agent's identity when role/responsibilities change (exe/founder only)
 - **get_identity** \u2014 read any agent's identity for coordination
 - **send_message** \u2014 direct intercom to employees
-
+${PLAN_MODE_COMPAT}
 ## Completion Workflow
 
 1. Read the task file and verify the deliverable matches the brief
@@ -4965,7 +5091,7 @@ You are \${agent_id}. CTO. You hold deep context on the entire codebase, archite
 - **store_behavior** \u2014 record corrections for engineers (p0 = always injected)
 - **get_identity** \u2014 read any agent's identity for review context
 - **query_relationships** \u2014 GraphRAG entity connections for architecture analysis
-
+${PLAN_MODE_COMPAT}
 ## Completion Workflow
 
 1. Read ARCHITECTURE.md before starting work on any repo
@@ -5032,7 +5158,7 @@ You are \${agent_id}. CMO. You hold deep context on design, branding, storytelli
 - **update_task** \u2014 mark tasks done with result summary
 - **store_memory** \u2014 report completions with brand alignment notes, SEO considerations
 - **get_identity** \u2014 read team identities for brand-consistent communication
-
+${PLAN_MODE_COMPAT}
 ## Completion Workflow
 
 1. Read the task file and understand the brief \u2014 tone, format, channel requirements
@@ -5099,7 +5225,7 @@ You are a principal engineer. You write production-grade code with zero shortcut
 - **recall_my_memory** \u2014 check past work, patterns, gotchas in this project
 - **store_memory** \u2014 report completions for org visibility
 - **ask_team_memory** \u2014 pull context from colleagues when specs reference their work
-
+${PLAN_MODE_COMPAT}
 ## Completion Workflow
 
 1. Read ARCHITECTURE.md if it exists \u2014 understand architecture before changing anything
@@ -5159,7 +5285,7 @@ You are the content production specialist. You turn scripts and creative briefs
 - **update_task** \u2014 mark tasks done with result summary
 - **recall_my_memory** \u2014 check past work: which models worked, which prompts produced good results
 - **store_memory** \u2014 report completions with production decisions for future reference
-
+${PLAN_MODE_COMPAT}
 ## Completion Workflow
 
 1. Read the task file \u2014 understand the brief, check budget constraints
@@ -5231,7 +5357,7 @@ You are the AI Product Lead \u2014 the competitive intelligence engine. You stud
 - **update_task** \u2014 mark tasks done with analysis results
 - **store_memory** \u2014 persist competitive analyses, evaluations, recommendations
 - **create_task** \u2014 when a feature is worth building, spec it for the CTO
-
+${PLAN_MODE_COMPAT}
 ## Completion Workflow
 
 1. Read the task \u2014 understand what capability is needed
@@ -5294,7 +5420,7 @@ You are \${agent_id}. Staff Code Reviewer and System Auditor. Last line of defen
 - **store_behavior** \u2014 record new patterns
 - **update_task** \u2014 mark reviews done with structured findings
 - **create_task** \u2014 assign fixes to the CTO
-
+${PLAN_MODE_COMPAT}
 ## Completion Workflow
 
 1. Read the task brief and understand the audit scope
@@ -5316,10 +5442,27 @@ __export(setup_wizard_exports, {
   validateModel: () => validateModel
 });
 import crypto3 from "crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4 } from "fs";
 import os4 from "os";
 import path13 from "path";
 import { createInterface as createInterface2 } from "readline";
+function loadSetupState() {
+  try {
+    return JSON.parse(readFileSync8(SETUP_STATE_PATH, "utf8"));
+  } catch {
+    return { completedSteps: [], startedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  }
+}
+function saveSetupState(state) {
+  mkdirSync5(path13.dirname(SETUP_STATE_PATH), { recursive: true });
+  writeFileSync4(SETUP_STATE_PATH, JSON.stringify(state, null, 2));
+}
+function clearSetupState() {
+  try {
+    unlinkSync4(SETUP_STATE_PATH);
+  } catch {
+  }
+}
 function ask(rl, prompt) {
   return new Promise((resolve) => {
     const doAsk = () => {
@@ -5359,88 +5502,122 @@ async function runSetupWizard(opts = {}) {
       rl.close();
       return;
     }
+    const state = loadSetupState();
+    if (state.completedSteps.length > 0) {
+      log(`Resuming setup from step ${Math.max(...state.completedSteps) + 1}...`);
+    }
     if (existsSync12(LEGACY_LANCE_PATH)) {
       log("\u26A0 Found v1.0 LanceDB at ~/.exe-os/local.lance");
       log("  v1.1 uses libSQL (SQLite). Your existing memories are not automatically migrated.");
       log("  The old directory will not be modified or deleted.");
       log("");
     }
-    const existingKey = await getMasterKey();
-    if (existingKey) {
-      log("Encryption key already exists \u2014 skipping generation.");
+    if (!state.completedSteps.includes(1)) {
+      const existingKey = await getMasterKey();
+      if (existingKey) {
+        log("Encryption key already exists \u2014 skipping generation.");
+      } else {
+        log("Generating 256-bit encryption key...");
+        const key = crypto3.randomBytes(32);
+        await setMasterKey(key);
+        log("Encryption key generated and stored securely.");
+      }
+      state.completedSteps.push(1);
+      saveSetupState(state);
     } else {
-      log("Generating 256-bit encryption key...");
-      const key = crypto3.randomBytes(32);
-      await setMasterKey(key);
-      log("Encryption key generated and stored securely.");
+      log("Step 1 already complete \u2014 skipping.");
     }
     log("");
-    log("Exe Cloud: your memories are end-to-end encrypted, compressed, and");
-    log("backed up on Exe Cloud. Free for all plans. We can't read your data \u2014");
-    log("only your encryption key can decrypt it.");
     let cloudConfig;
-    try {
-      const { loadDeviceId: loadDeviceId2 } = await Promise.resolve().then(() => (init_license(), license_exports));
-      const deviceId = loadDeviceId2();
-      const res = await fetch("https://askexe.com/cloud/auth/auto-provision", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ deviceId }),
-        signal: AbortSignal.timeout(1e4)
-      });
-      if (res.ok) {
-        const data = await res.json();
-        if (data.apiKey) {
-          cloudConfig = { apiKey: data.apiKey, endpoint: "https://askexe.com/cloud" };
-          const { saveLicense: saveLicense3, mirrorLicenseKey: mirrorLicenseKey3 } = await Promise.resolve().then(() => (init_license(), license_exports));
-          saveLicense3(data.apiKey);
-          mirrorLicenseKey3(data.apiKey);
-          log("Cloud sync activated automatically.");
+    if (!state.completedSteps.includes(2)) {
+      log("Exe Cloud: your memories are end-to-end encrypted, compressed, and");
+      log("backed up on Exe Cloud. Free for all plans. We can't read your data \u2014");
+      log("only your encryption key can decrypt it.");
+      try {
+        const { loadDeviceId: loadDeviceId2 } = await Promise.resolve().then(() => (init_license(), license_exports));
+        const deviceId = loadDeviceId2();
+        const res = await fetch("https://askexe.com/cloud/auth/auto-provision", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ deviceId }),
+          signal: AbortSignal.timeout(1e4)
+        });
+        if (res.ok) {
+          const data = await res.json();
+          if (data.apiKey) {
+            cloudConfig = { apiKey: data.apiKey, endpoint: "https://askexe.com/cloud" };
+            const { saveLicense: saveLicense3, mirrorLicenseKey: mirrorLicenseKey3 } = await Promise.resolve().then(() => (init_license(), license_exports));
+            saveLicense3(data.apiKey);
+            mirrorLicenseKey3(data.apiKey);
+            log("Cloud sync activated automatically.");
+          }
         }
+      } catch {
+        log("Cloud sync will activate when online.");
       }
-    } catch {
-      log("Cloud sync will activate when online.");
+      state.completedSteps.push(2);
+      saveSetupState(state);
+    } else {
+      log("Step 2 already complete \u2014 skipping.");
     }
     log("");
-    if (!skipModel) {
-      log("Note: jina-embeddings-v5-text-small is licensed CC-BY-NC-4.0 (non-commercial)");
-      log("");
-      await downloadModel({
-        destDir: MODELS_DIR,
-        onProgress: (downloaded, total) => {
-          const pct = (downloaded / total * 100).toFixed(1);
-          const dlMB = (downloaded / 1e6).toFixed(0);
-          const totalMB = (total / 1e6).toFixed(0);
-          process.stderr.write(`\rDownloading model: ${pct}% (${dlMB}/${totalMB} MB)`);
-        }
-      });
-      process.stderr.write("\n");
-      log("Model downloaded and verified.");
+    if (!state.completedSteps.includes(3)) {
+      if (!skipModel) {
+        log("Note: jina-embeddings-v5-text-small is licensed CC-BY-NC-4.0 (non-commercial)");
+        log("");
+        await downloadModel({
+          destDir: MODELS_DIR,
+          onProgress: (downloaded, total) => {
+            const pct = (downloaded / total * 100).toFixed(1);
+            const dlMB = (downloaded / 1e6).toFixed(0);
+            const totalMB = (total / 1e6).toFixed(0);
+            process.stderr.write(`\rDownloading model: ${pct}% (${dlMB}/${totalMB} MB)`);
+          }
+        });
+        process.stderr.write("\n");
+        log("Model downloaded and verified.");
+      }
+      state.completedSteps.push(3);
+      saveSetupState(state);
+    } else {
+      log("Step 3 already complete \u2014 skipping.");
     }
-    if (!skipModel && !skipModelValidation) {
-      await validateModel(log);
+    if (!state.completedSteps.includes(4)) {
+      if (!skipModel && !skipModelValidation) {
+        await validateModel(log);
+      }
+      state.completedSteps.push(4);
+      saveSetupState(state);
+    } else {
+      log("Step 4 already complete \u2014 skipping.");
     }
     const config = await loadConfig();
-    if (cloudConfig) {
-      config.cloud = cloudConfig;
-    }
-    await saveConfig(config);
-    log("");
-    try {
-      const claudeJsonPath = path13.join(os4.homedir(), ".claude.json");
-      let claudeJson = {};
+    if (!state.completedSteps.includes(5)) {
+      if (cloudConfig) {
+        config.cloud = cloudConfig;
+      }
+      await saveConfig(config);
+      log("");
       try {
-        claudeJson = JSON.parse(readFileSync8(claudeJsonPath, "utf8"));
+        const claudeJsonPath = path13.join(os4.homedir(), ".claude.json");
+        let claudeJson = {};
+        try {
+          claudeJson = JSON.parse(readFileSync8(claudeJsonPath, "utf8"));
+        } catch {
+        }
+        if (!claudeJson.projects) claudeJson.projects = {};
+        const projects = claudeJson.projects;
+        for (const dir of [process.cwd(), os4.homedir()]) {
+          if (!projects[dir]) projects[dir] = {};
+          projects[dir].hasTrustDialogAccepted = true;
+        }
+        writeFileSync4(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
       } catch {
       }
-      if (!claudeJson.projects) claudeJson.projects = {};
-      const projects = claudeJson.projects;
-      for (const dir of [process.cwd(), os4.homedir()]) {
-        if (!projects[dir]) projects[dir] = {};
-        projects[dir].hasTrustDialogAccepted = true;
-      }
-      writeFileSync4(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
-    } catch {
+      state.completedSteps.push(5);
+      saveSetupState(state);
+    } else {
+      log("Step 5 already complete \u2014 skipping.");
     }
     const {
       loadEmployees: loadEmployees2,
@@ -5449,7 +5626,7 @@ async function runSetupWizard(opts = {}) {
       registerBinSymlinks: registerBinSymlinks2,
       EMPLOYEES_PATH: EMPLOYEES_PATH2
     } = await Promise.resolve().then(() => (init_employees(), employees_exports));
-    const { getTemplate: getEmployeeTemplate } = await Promise.resolve().then(() => (init_employee_templates(), employee_templates_exports));
+    const { getTemplateByRole: getTemplateByRole2 } = await Promise.resolve().then(() => (init_employee_templates(), employee_templates_exports));
     const { identityPath: identityPath2 } = await Promise.resolve().then(() => (init_identity(), identity_exports));
     const { getTemplate: getIdentityTemplate } = await Promise.resolve().then(() => (init_identity_templates(), identity_templates_exports));
     const {
@@ -5459,152 +5636,178 @@ async function runSetupWizard(opts = {}) {
       validateLicense: validateLicense2
     } = await Promise.resolve().then(() => (init_license(), license_exports));
     const createdEmployees = [];
-    log("=== Your Team ===");
-    log("");
-    log("Every install starts with a COO \u2014 your right-hand operator.");
-    log("They hold the big picture: priorities, progress, and blockers.");
-    log("You talk to them. They coordinate everyone else.");
-    log("");
-    const cooNameInput = await ask(rl, "Name your COO (default: exe): ");
-    const cooName = (cooNameInput || "exe").toLowerCase();
-    let employees = await loadEmployees2(EMPLOYEES_PATH2).catch(() => []);
-    if (!employees.some((e) => e.name === cooName)) {
-      const { DEFAULT_EXE: DEFAULT_EXE2, personalizePrompt: personalizePrompt2 } = await Promise.resolve().then(() => (init_employee_templates(), employee_templates_exports));
-      const cooEmployee = {
-        name: cooName,
-        role: "COO",
-        systemPrompt: personalizePrompt2(DEFAULT_EXE2.systemPrompt, "exe", cooName),
-        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        templateName: "exe",
-        templateVersion: 1
-      };
-      employees = addEmployee2(employees, cooEmployee);
-      await saveEmployees2(employees, EMPLOYEES_PATH2);
-    }
-    const cooIdentityContent = getIdentityTemplate("coo");
-    if (cooIdentityContent) {
-      const cooIdPath = identityPath2(cooName);
-      mkdirSync5(path13.dirname(cooIdPath), { recursive: true });
-      const replaced = cooIdentityContent.replace(/agent_id:\s*exe/g, `agent_id: ${cooName}`).replace(/\$\{agent_id\}/g, cooName);
-      writeFileSync4(cooIdPath, replaced, "utf-8");
-    }
-    registerBinSymlinks2(cooName);
-    createdEmployees.push({ name: cooName, role: "COO" });
-    log("");
-    log("=== Meet Your Specialists ===");
-    log("");
-    log("Your COO coordinates specialists. Here's who you can hire:");
-    log("");
-    log("  CTO (default: yoshi)");
-    log("  Your head of engineering. Architecture, code reviews, tech decisions.");
-    log("  Manages your projects and delegates to engineers when there's parallel work.");
-    log("");
-    log("  CMO (default: mari)");
-    log("  Design, brand, content, SEO. Builds your visual identity, writes");
-    log("  your copy, and gets you found online. Delegates to content specialists.");
-    log("");
-    log("Why separate roles instead of one AI that does everything?");
-    log("");
-    log("Memory saturates. One agent juggling architecture decisions AND landing page");
-    log("copy AND CI/CD AND social media loses context on all of them. Competing");
-    log("priorities \u2014 should I fix the auth bug or write the blog post? When you split");
-    log("responsibilities, each specialist stays sharp because they stay focused.");
-    log("Your COO connects them so nothing falls through the cracks.");
-    log("");
-    log("This is how real companies scale \u2014 you're just doing it with AI");
-    log("instead of headcount.");
-    log("");
-    await ask(rl, "Press Enter to continue. ");
-    let license;
-    try {
-      license = await checkLicense2();
-    } catch {
-      license = { valid: true, plan: "free", email: "", expiresAt: null, deviceLimit: 1, employeeLimit: 2, memoryLimit: 1e3 };
-    }
-    if (license.plan === "free") {
-      log("Your plan: Free \u2014 1 employee (your COO)");
+    let cooName = "exe";
+    if (!state.completedSteps.includes(6)) {
+      log("=== Your Team ===");
       log("");
-      log("The CTO and CMO are available on Solopreneur ($97/mo) \u2014 full engineering");
-      log("and marketing team, unlimited tasks, priority support.");
-      log("Get your key at https://askexe.com, then paste it here.");
+      log("Every install starts with a COO \u2014 your right-hand operator.");
+      log("They hold the big picture: priorities, progress, and blockers.");
+      log("You talk to them. They coordinate everyone else.");
       log("");
-      const licenseInput = await ask(rl, "License key (or press Enter to skip): ");
-      if (licenseInput.startsWith("exe_sk_")) {
-        saveLicense2(licenseInput);
-        mirrorLicenseKey2(licenseInput);
-        try {
-          license = await validateLicense2(licenseInput);
-        } catch {
-          log("Couldn't reach the license server \u2014 your key has been saved.");
-          log("Run exe-os --activate <key> anytime to finish activation.");
-        }
-      } else if (!licenseInput) {
-        log("You can activate anytime with: exe-os --activate <key>");
-      } else {
-        log("That doesn't look like a license key (should start with exe_sk_).");
-        log("You can activate anytime with: exe-os --activate <key>");
-      }
+      const cooNameInput = await ask(rl, "Name your COO (default: exe): ");
+      cooName = (cooNameInput || "exe").toLowerCase();
+      let employees = await loadEmployees2(EMPLOYEES_PATH2).catch(() => []);
+      if (!employees.some((e) => e.name === cooName)) {
+        const { DEFAULT_EXE: DEFAULT_EXE2, personalizePrompt: personalizePrompt2 } = await Promise.resolve().then(() => (init_employee_templates(), employee_templates_exports));
+        const cooEmployee = {
+          name: cooName,
+          role: "COO",
+          systemPrompt: personalizePrompt2(DEFAULT_EXE2.systemPrompt, "exe", cooName),
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          templateName: "exe",
+          templateVersion: 1
+        };
+        employees = addEmployee2(employees, cooEmployee);
+        await saveEmployees2(employees, EMPLOYEES_PATH2);
+      }
+      const cooIdentityContent = getIdentityTemplate("coo");
+      if (cooIdentityContent) {
+        const cooIdPath = identityPath2(cooName);
+        mkdirSync5(path13.dirname(cooIdPath), { recursive: true });
+        const replaced = cooIdentityContent.replace(/agent_id:\s*exe/g, `agent_id: ${cooName}`).replace(/\$\{agent_id\}/g, cooName);
+        writeFileSync4(cooIdPath, replaced, "utf-8");
+      }
+      registerBinSymlinks2(cooName);
+      createdEmployees.push({ name: cooName, role: "COO" });
+      state.completedSteps.push(6);
+      saveSetupState(state);
+    } else {
+      log("Step 6 already complete \u2014 skipping.");
+      const roster = await loadEmployees2(EMPLOYEES_PATH2).catch(() => []);
+      const existingCoo = roster.find((e) => e.role === "COO");
+      if (existingCoo) cooName = existingCoo.name;
     }
-    if (license.plan !== "free") {
-      const planName = license.plan === "pro" ? "Solopreneur" : license.plan.charAt(0).toUpperCase() + license.plan.slice(1);
-      log(`Your plan: ${planName} (up to ${license.employeeLimit} employees)`);
+    log("");
+    if (!state.completedSteps.includes(7)) {
+      log("=== Meet Your Specialists ===");
       log("");
-      const createCto = await ask(rl, "Create your CTO? (Y/n): ");
-      if (createCto.toLowerCase() !== "n") {
-        const ctoNameInput = await ask(rl, "Name your CTO (default: yoshi): ");
-        const ctoName = (ctoNameInput || "yoshi").toLowerCase();
-        if (!employees.some((e) => e.name === ctoName)) {
-          const ctoTemplate = getEmployeeTemplate("yoshi");
-          const { personalizePrompt: personalizeCto } = await Promise.resolve().then(() => (init_employee_templates(), employee_templates_exports));
-          const ctoEmployee = {
-            name: ctoName,
-            role: "CTO",
-            systemPrompt: personalizeCto(ctoTemplate?.systemPrompt ?? "", "yoshi", ctoName),
-            createdAt: (/* @__PURE__ */ new Date()).toISOString()
-          };
-          employees = addEmployee2(employees, ctoEmployee);
-          await saveEmployees2(employees, EMPLOYEES_PATH2);
-        }
-        const ctoIdentityContent = getIdentityTemplate("cto");
-        if (ctoIdentityContent) {
-          const ctoIdPath = identityPath2(ctoName);
-          mkdirSync5(path13.dirname(ctoIdPath), { recursive: true });
-          const replaced = ctoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${ctoName}`).replace(/\$\{agent_id\}/g, ctoName);
-          writeFileSync4(ctoIdPath, replaced, "utf-8");
-        }
-        registerBinSymlinks2(ctoName);
-        createdEmployees.push({ name: ctoName, role: "CTO" });
-        log(`Created ${ctoName} (CTO)`);
-      }
-      const createCmo = await ask(rl, "Create your CMO? (Y/n): ");
-      if (createCmo.toLowerCase() !== "n") {
-        const cmoNameInput = await ask(rl, "Name your CMO (default: mari): ");
-        const cmoName = (cmoNameInput || "mari").toLowerCase();
-        if (!employees.some((e) => e.name === cmoName)) {
-          const cmoTemplate = getEmployeeTemplate("mari");
-          const { personalizePrompt: personalizeCmo } = await Promise.resolve().then(() => (init_employee_templates(), employee_templates_exports));
-          const cmoEmployee = {
-            name: cmoName,
-            role: "CMO",
-            systemPrompt: personalizeCmo(cmoTemplate?.systemPrompt ?? "", "mari", cmoName),
-            createdAt: (/* @__PURE__ */ new Date()).toISOString()
-          };
-          employees = addEmployee2(employees, cmoEmployee);
-          await saveEmployees2(employees, EMPLOYEES_PATH2);
-        }
-        const cmoIdentityContent = getIdentityTemplate("cmo");
-        if (cmoIdentityContent) {
-          const cmoIdPath = identityPath2(cmoName);
-          mkdirSync5(path13.dirname(cmoIdPath), { recursive: true });
-          const replaced = cmoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${cmoName}`).replace(/\$\{agent_id\}/g, cmoName);
-          writeFileSync4(cmoIdPath, replaced, "utf-8");
+      log("Your COO coordinates specialists. Here's who you can hire:");
+      log("");
+      log("  CTO (default: yoshi)");
+      log("  Your head of engineering. Architecture, code reviews, tech decisions.");
+      log("  Manages your projects and delegates to engineers when there's parallel work.");
+      log("");
+      log("  CMO (default: mari)");
+      log("  Design, brand, content, SEO. Builds your visual identity, writes");
+      log("  your copy, and gets you found online. Delegates to content specialists.");
+      log("");
+      log("Why separate roles instead of one AI that does everything?");
+      log("");
+      log("Memory saturates. One agent juggling architecture decisions AND landing page");
+      log("copy AND CI/CD AND social media loses context on all of them. Competing");
+      log("priorities \u2014 should I fix the auth bug or write the blog post? When you split");
+      log("responsibilities, each specialist stays sharp because they stay focused.");
+      log("Your COO connects them so nothing falls through the cracks.");
+      log("");
+      log("This is how real companies scale \u2014 you're just doing it with AI");
+      log("instead of headcount.");
+      log("");
+      await ask(rl, "Press Enter to continue. ");
+      state.completedSteps.push(7);
+      saveSetupState(state);
+    } else {
+      log("Step 7 already complete \u2014 skipping.");
+    }
+    if (!state.completedSteps.includes(8)) {
+      let employees = await loadEmployees2(EMPLOYEES_PATH2).catch(() => []);
+      let license;
+      try {
+        license = await checkLicense2();
+      } catch {
+        license = { valid: true, plan: "free", email: "", expiresAt: null, deviceLimit: 1, employeeLimit: 2, memoryLimit: 1e3 };
+      }
+      if (license.plan === "free") {
+        log("Your plan: Free \u2014 1 employee (your COO)");
+        log("");
+        log("The CTO and CMO are available on Solopreneur ($97/mo) \u2014 full engineering");
+        log("and marketing team, unlimited tasks, priority support.");
+        log("Get your key at https://askexe.com, then paste it here.");
+        log("");
+        const licenseInput = await ask(rl, "License key (or press Enter to skip): ");
+        if (licenseInput.startsWith("exe_sk_")) {
+          saveLicense2(licenseInput);
+          mirrorLicenseKey2(licenseInput);
+          try {
+            license = await validateLicense2(licenseInput);
+          } catch {
+            log("Couldn't reach the license server \u2014 your key has been saved.");
+            log("Run exe-os --activate <key> anytime to finish activation.");
+          }
+        } else if (!licenseInput) {
+          log("You can activate anytime with: exe-os --activate <key>");
+        } else {
+          log("That doesn't look like a license key (should start with exe_sk_).");
+          log("You can activate anytime with: exe-os --activate <key>");
+        }
+      }
+      if (license.plan !== "free") {
+        const planName = license.plan === "pro" ? "Solopreneur" : license.plan.charAt(0).toUpperCase() + license.plan.slice(1);
+        log(`Your plan: ${planName} (up to ${license.employeeLimit} employees)`);
+        log("");
+        const createCto = await ask(rl, "Create your CTO? (Y/n): ");
+        if (createCto.toLowerCase() !== "n") {
+          const ctoTemplate = getTemplateByRole2("CTO");
+          const ctoDefault = ctoTemplate?.name ?? "cto";
+          const ctoNameInput = await ask(rl, `Name your CTO (default: ${ctoDefault}): `);
+          const ctoName = (ctoNameInput || ctoDefault).toLowerCase();
+          if (!employees.some((e) => e.name === ctoName)) {
+            const { personalizePrompt: personalizeCto } = await Promise.resolve().then(() => (init_employee_templates(), employee_templates_exports));
+            const ctoEmployee = {
+              name: ctoName,
+              role: "CTO",
+              systemPrompt: personalizeCto(ctoTemplate?.systemPrompt ?? "", ctoDefault, ctoName),
+              createdAt: (/* @__PURE__ */ new Date()).toISOString()
+            };
+            employees = addEmployee2(employees, ctoEmployee);
+            await saveEmployees2(employees, EMPLOYEES_PATH2);
+          }
+          const ctoIdentityContent = getIdentityTemplate("cto");
+          if (ctoIdentityContent) {
+            const ctoIdPath = identityPath2(ctoName);
+            mkdirSync5(path13.dirname(ctoIdPath), { recursive: true });
+            const replaced = ctoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${ctoName}`).replace(/\$\{agent_id\}/g, ctoName);
+            writeFileSync4(ctoIdPath, replaced, "utf-8");
+          }
+          registerBinSymlinks2(ctoName);
+          createdEmployees.push({ name: ctoName, role: "CTO" });
+          log(`Created ${ctoName} (CTO)`);
+        }
+        const createCmo = await ask(rl, "Create your CMO? (Y/n): ");
+        if (createCmo.toLowerCase() !== "n") {
+          const cmoTemplate = getTemplateByRole2("CMO");
+          const cmoDefault = cmoTemplate?.name ?? "cmo";
+          const cmoNameInput = await ask(rl, `Name your CMO (default: ${cmoDefault}): `);
+          const cmoName = (cmoNameInput || cmoDefault).toLowerCase();
+          if (!employees.some((e) => e.name === cmoName)) {
+            const { personalizePrompt: personalizeCmo } = await Promise.resolve().then(() => (init_employee_templates(), employee_templates_exports));
+            const cmoEmployee = {
+              name: cmoName,
+              role: "CMO",
+              systemPrompt: personalizeCmo(cmoTemplate?.systemPrompt ?? "", cmoDefault, cmoName),
+              createdAt: (/* @__PURE__ */ new Date()).toISOString()
+            };
+            employees = addEmployee2(employees, cmoEmployee);
+            await saveEmployees2(employees, EMPLOYEES_PATH2);
+          }
+          const cmoIdentityContent = getIdentityTemplate("cmo");
+          if (cmoIdentityContent) {
+            const cmoIdPath = identityPath2(cmoName);
+            mkdirSync5(path13.dirname(cmoIdPath), { recursive: true });
+            const replaced = cmoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${cmoName}`).replace(/\$\{agent_id\}/g, cmoName);
+            writeFileSync4(cmoIdPath, replaced, "utf-8");
+          }
+          registerBinSymlinks2(cmoName);
+          createdEmployees.push({ name: cmoName, role: "CMO" });
+          log(`Created ${cmoName} (CMO)`);
         }
-        registerBinSymlinks2(cmoName);
-        createdEmployees.push({ name: cmoName, role: "CMO" });
-        log(`Created ${cmoName} (CMO)`);
+        log("");
       }
-      log("");
+      state.completedSteps.push(8);
+      saveSetupState(state);
+    } else {
+      log("Step 8 already complete \u2014 skipping.");
     }
+    clearSetupState();
     log("=== Two Ways to Work ===");
     log("");
     log("  1. Claude Code mode");
@@ -5641,12 +5844,14 @@ async function runSetupWizard(opts = {}) {
     rl.close();
   }
 }
+var SETUP_STATE_PATH;
 var init_setup_wizard = __esm({
   "src/lib/setup-wizard.ts"() {
     "use strict";
     init_config();
     init_keychain();
     init_model_downloader();
+    SETUP_STATE_PATH = path13.join(os4.homedir(), ".exe-os", "setup-state.json");
   }
 });
 
@@ -16316,8 +16521,8 @@ import path23 from "path";
 import os8 from "os";
 import {
   readFileSync as readFileSync13,
-  readdirSync as readdirSync2,
-  unlinkSync as unlinkSync4,
+  readdirSync as readdirSync3,
+  unlinkSync as unlinkSync5,
   existsSync as existsSync17,
   rmdirSync
 } from "fs";
@@ -16799,7 +17004,7 @@ var init_tasks_crud = __esm({
 
 // src/lib/tasks-review.ts
 import path25 from "path";
-import { existsSync as existsSync19, readdirSync as readdirSync3, unlinkSync as unlinkSync5 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync4, unlinkSync as unlinkSync6 } from "fs";
 async function countPendingReviews() {
   const client = getClient();
   const result = await client.execute({
@@ -16921,9 +17126,9 @@ async function cleanupReviewFile(row, taskFile, _baseDir) {
   try {
     const cacheDir = path25.join(EXE_AI_DIR, "session-cache");
     if (existsSync19(cacheDir)) {
-      for (const f of readdirSync3(cacheDir)) {
+      for (const f of readdirSync4(cacheDir)) {
         if (f.startsWith("review-notified-")) {
-          unlinkSync5(path25.join(cacheDir, f));
+          unlinkSync6(path25.join(cacheDir, f));
         }
       }
     }
@@ -17524,7 +17729,7 @@ __export(tasks_exports, {
   writeCheckpoint: () => writeCheckpoint
 });
 import path28 from "path";
-import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync8, unlinkSync as unlinkSync6 } from "fs";
+import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync8, unlinkSync as unlinkSync7 } from "fs";
 async function createTask(input) {
   const result = await createTaskCore(input);
   if (!input.skipDispatch && result.status !== "blocked" && !process.env.VITEST) {
@@ -17550,7 +17755,7 @@ async function updateTask(input) {
       writeFileSync7(cachePath, JSON.stringify({ taskId, title: String(row.title) }));
     } else if (input.status === "done" || input.status === "blocked" || input.status === "cancelled") {
       try {
-        unlinkSync6(cachePath);
+        unlinkSync7(cachePath);
       } catch {
       }
     }
@@ -17943,6 +18148,7 @@ var init_capacity_monitor = __esm({
 // src/lib/tmux-routing.ts
 var tmux_routing_exports = {};
 __export(tmux_routing_exports, {
+  acquireSpawnLock: () => acquireSpawnLock2,
   employeeSessionName: () => employeeSessionName,
   ensureEmployee: () => ensureEmployee,
   extractRootExe: () => extractRootExe,
@@ -17957,6 +18163,7 @@ __export(tmux_routing_exports, {
   notifyParentExe: () => notifyParentExe,
   parseParentExe: () => parseParentExe,
   registerParentExe: () => registerParentExe,
+  releaseSpawnLock: () => releaseSpawnLock2,
   resolveExeSession: () => resolveExeSession,
   sendIntercom: () => sendIntercom,
   spawnEmployee: () => spawnEmployee,
@@ -17967,6 +18174,42 @@ import { readFileSync as readFileSync15, writeFileSync as writeFileSync8, mkdirS
 import path29 from "path";
 import os9 from "os";
 import { fileURLToPath as fileURLToPath4 } from "url";
+import { unlinkSync as unlinkSync8 } from "fs";
+function spawnLockPath(sessionName) {
+  return path29.join(SPAWN_LOCK_DIR, `${sessionName}.lock`);
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function acquireSpawnLock2(sessionName) {
+  if (!existsSync20(SPAWN_LOCK_DIR)) {
+    mkdirSync9(SPAWN_LOCK_DIR, { recursive: true });
+  }
+  const lockFile = spawnLockPath(sessionName);
+  if (existsSync20(lockFile)) {
+    try {
+      const lock = JSON.parse(readFileSync15(lockFile, "utf8"));
+      const age = Date.now() - lock.timestamp;
+      if (isProcessAlive(lock.pid) && age < 6e4) {
+        return false;
+      }
+    } catch {
+    }
+  }
+  writeFileSync8(lockFile, JSON.stringify({ pid: process.pid, timestamp: Date.now() }));
+  return true;
+}
+function releaseSpawnLock2(sessionName) {
+  try {
+    unlinkSync8(spawnLockPath(sessionName));
+  } catch {
+  }
+}
 function resolveBehaviorsExporterScript() {
   try {
     const thisFile = fileURLToPath4(import.meta.url);
@@ -18065,10 +18308,10 @@ function isEmployeeAlive(sessionName) {
 }
 function findFreeInstance(employeeName, exeSession, maxInstances = 10, isAlive = isEmployeeAlive) {
   const base = employeeSessionName(employeeName, exeSession);
-  if (!isAlive(base)) return 0;
+  if (!isAlive(base) && acquireSpawnLock2(base)) return 0;
   for (let i = 2; i <= maxInstances; i++) {
     const candidate = employeeSessionName(employeeName, exeSession, i);
-    if (!isAlive(candidate)) return i;
+    if (!isAlive(candidate) && acquireSpawnLock2(candidate)) return i;
   }
   return null;
 }
@@ -18432,6 +18675,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
     command: spawnCommand
   });
   if (spawnResult.error) {
+    releaseSpawnLock2(sessionName);
     return { sessionName, error: `tmux new-session failed: ${spawnResult.error}` };
   }
   transport.pipeLog(sessionName, logFile);
@@ -18469,6 +18713,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
     }
   }
   if (!booted) {
+    releaseSpawnLock2(sessionName);
     return { sessionName, error: `${useExeAgent ? "exe-agent" : "claude"} did not boot within 15s` };
   }
   if (!useExeAgent) {
@@ -18485,9 +18730,10 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
     pid: 0,
     registeredAt: (/* @__PURE__ */ new Date()).toISOString()
   });
+  releaseSpawnLock2(sessionName);
   return { sessionName };
 }
-var SESSION_CACHE, BEHAVIORS_EXPORT_TIMEOUT_MS, VERIFY_PANE_LINES, INTERCOM_DEBOUNCE_MS, INTERCOM_LOG2, DEBOUNCE_FILE, DEBOUNCE_CLEANUP_AGE_MS, BUSY_PATTERN;
+var SPAWN_LOCK_DIR, SESSION_CACHE, BEHAVIORS_EXPORT_TIMEOUT_MS, VERIFY_PANE_LINES, INTERCOM_DEBOUNCE_MS, INTERCOM_LOG2, DEBOUNCE_FILE, DEBOUNCE_CLEANUP_AGE_MS, BUSY_PATTERN;
 var init_tmux_routing = __esm({
   "src/lib/tmux-routing.ts"() {
     "use strict";
@@ -18499,6 +18745,7 @@ var init_tmux_routing = __esm({
     init_provider_table();
     init_intercom_queue();
     init_plan_limits();
+    SPAWN_LOCK_DIR = path29.join(os9.homedir(), ".exe-os", "spawn-locks");
     SESSION_CACHE = path29.join(os9.homedir(), ".exe-os", "session-cache");
     BEHAVIORS_EXPORT_TIMEOUT_MS = 1e4;
     VERIFY_PANE_LINES = 200;
@@ -21747,7 +21994,7 @@ var init_update = __esm({
 });
 
 // src/bin/cli.ts
-import { existsSync as existsSync21, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync17, writeFileSync as writeFileSync9, readdirSync as readdirSync5, rmSync } from "fs";
 import path31 from "path";
 import os10 from "os";
 var args = process.argv.slice(2);
@@ -21779,7 +22026,7 @@ if (args.includes("--global")) {
       await runClaudeCheck();
       break;
     case "uninstall":
-      await runClaudeUninstall();
+      await runClaudeUninstall(args.slice(2));
       break;
     default:
       await runClaudeInstall();
@@ -21827,7 +22074,14 @@ async function runClaudeCheck() {
   const claudeJsonPath = path31.join(os10.homedir(), ".claude.json");
   let ok = true;
   if (existsSync21(settingsPath)) {
-    const settings = JSON.parse(readFileSync17(settingsPath, "utf8"));
+    let settings;
+    try {
+      settings = JSON.parse(readFileSync17(settingsPath, "utf8"));
+    } catch {
+      console.log("\x1B[31m\u2717\x1B[0m settings.json is malformed (invalid JSON)");
+      ok = false;
+      settings = {};
+    }
     const hasHooks = settings.hooks && Object.keys(settings.hooks).some((k) => {
       const groups = settings.hooks[k];
       return Array.isArray(groups) && groups.some((g) => {
@@ -21849,7 +22103,14 @@ async function runClaudeCheck() {
     ok = false;
   }
   if (existsSync21(claudeJsonPath)) {
-    const claudeJson = JSON.parse(readFileSync17(claudeJsonPath, "utf8"));
+    let claudeJson;
+    try {
+      claudeJson = JSON.parse(readFileSync17(claudeJsonPath, "utf8"));
+    } catch {
+      console.log("\x1B[31m\u2717\x1B[0m claude.json is malformed (invalid JSON)");
+      ok = false;
+      claudeJson = {};
+    }
     const hasMcp = claudeJson.mcpServers && (claudeJson.mcpServers["exe-mem"] || claudeJson.mcpServers["exe-os"]);
     if (hasMcp) {
       console.log("\x1B[32m\u2713\x1B[0m MCP server configured in claude.json");
@@ -21863,11 +22124,11 @@ async function runClaudeCheck() {
     console.log("\x1B[31m\u2717\x1B[0m claude.json not found");
     ok = false;
   }
-  const commandsDir = path31.join(claudeDir, "commands");
-  if (existsSync21(commandsDir)) {
-    console.log("\x1B[32m\u2713\x1B[0m Slash commands directory exists");
+  const skillsDir = path31.join(claudeDir, "skills");
+  if (existsSync21(skillsDir)) {
+    console.log("\x1B[32m\u2713\x1B[0m Slash skills directory exists");
   } else {
-    console.log("\x1B[31m\u2717\x1B[0m Slash commands directory missing");
+    console.log("\x1B[31m\u2717\x1B[0m Slash skills directory missing");
     ok = false;
   }
   if (!ok) {
@@ -21877,13 +22138,29 @@ async function runClaudeCheck() {
     console.log("\nAll checks passed.");
   }
 }
-async function runClaudeUninstall() {
-  const claudeDir = path31.join(os10.homedir(), ".claude");
+async function runClaudeUninstall(flags = []) {
+  const dryRun = flags.includes("--dry-run");
+  const purge = flags.includes("--purge");
+  const homeDir = os10.homedir();
+  const claudeDir = path31.join(homeDir, ".claude");
   const settingsPath = path31.join(claudeDir, "settings.json");
-  const claudeJsonPath = path31.join(os10.homedir(), ".claude.json");
+  const claudeJsonPath = path31.join(homeDir, ".claude.json");
+  const exeOsDir = path31.join(homeDir, ".exe-os");
   let removed = 0;
+  const log = (msg) => console.log(dryRun ? `[dry-run] ${msg}` : msg);
+  let settings = {};
   if (existsSync21(settingsPath)) {
-    const settings = JSON.parse(readFileSync17(settingsPath, "utf8"));
+    try {
+      settings = JSON.parse(readFileSync17(settingsPath, "utf8"));
+    } catch {
+      console.error("Your ~/.claude/settings.json appears malformed.");
+      if (purge) {
+        console.error("Skipping settings cleanup (--purge).");
+      } else {
+        console.error("Try running: exe-os claude install");
+        process.exit(1);
+      }
+    }
     if (settings.hooks) {
       for (const key of Object.keys(settings.hooks)) {
         const groups = settings.hooks[key];
@@ -21903,9 +22180,19 @@ async function runClaudeUninstall() {
           delete settings.hooks[key];
         }
       }
-      const { writeFileSync: writeFileSync9 } = await import("fs");
-      writeFileSync9(settingsPath, JSON.stringify(settings, null, 2) + "\n");
-      console.log("Removed exe-os hooks from settings.json");
+      let permCount = 0;
+      if (Array.isArray(settings.permissions?.allow)) {
+        const before = settings.permissions.allow.length;
+        settings.permissions.allow = settings.permissions.allow.filter(
+          (p) => !p.startsWith("mcp__exe-mem__") && !p.startsWith("mcp__exe-os__")
+        );
+        permCount = before - settings.permissions.allow.length;
+      }
+      if (!dryRun) {
+        writeFileSync9(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+      }
+      log("\u2713 Removed exe-os hooks from settings.json");
+      if (permCount > 0) log(`\u2713 Removed ${permCount} MCP permission entries`);
       removed++;
     }
   }
@@ -21915,25 +22202,154 @@ async function runClaudeUninstall() {
       let removedMcp = false;
       for (const key of ["exe-mem", "exe-os"]) {
         if (claudeJson.mcpServers[key]) {
-          delete claudeJson.mcpServers[key];
+          if (!dryRun) delete claudeJson.mcpServers[key];
           removedMcp = true;
         }
       }
       if (removedMcp) {
-        const { writeFileSync: writeFileSync9 } = await import("fs");
-        writeFileSync9(
-          claudeJsonPath,
-          JSON.stringify(claudeJson, null, 2) + "\n"
-        );
-        console.log("Removed exe-os MCP server from claude.json");
+        if (!dryRun) {
+          writeFileSync9(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
+        }
+        log("\u2713 Removed exe-os MCP server from claude.json");
         removed++;
       }
     }
   }
+  const skillsDir = path31.join(claudeDir, "skills");
+  if (existsSync21(skillsDir)) {
+    let skillCount = 0;
+    try {
+      const entries = readdirSync5(skillsDir);
+      for (const entry of entries) {
+        if (entry.startsWith("exe")) {
+          const fullPath = path31.join(skillsDir, entry);
+          if (!dryRun) rmSync(fullPath, { recursive: true, force: true });
+          skillCount++;
+        }
+      }
+    } catch {
+    }
+    if (skillCount > 0) {
+      log(`\u2713 Removed ${skillCount} skill directories`);
+      removed++;
+    }
+  }
+  const claudeMdPath = path31.join(claudeDir, "CLAUDE.md");
+  if (existsSync21(claudeMdPath)) {
+    const content = readFileSync17(claudeMdPath, "utf8");
+    const startMarker = "<!-- exe-os:orchestration-start -->";
+    const endMarker = "<!-- exe-os:orchestration-end -->";
+    const startIdx = content.indexOf(startMarker);
+    const endIdx = content.indexOf(endMarker);
+    if (startIdx !== -1 && endIdx !== -1) {
+      const cleaned = (content.slice(0, startIdx) + content.slice(endIdx + endMarker.length)).replace(/\n{3,}/g, "\n\n").trim() + "\n";
+      if (!dryRun) writeFileSync9(claudeMdPath, cleaned);
+      log("\u2713 Removed orchestration block from CLAUDE.md");
+      removed++;
+    }
+  }
+  const agentsDir = path31.join(claudeDir, "agents");
+  if (existsSync21(agentsDir)) {
+    let agentCount = 0;
+    try {
+      const entries = readdirSync5(agentsDir).filter((f) => f.endsWith(".md"));
+      let knownNames = /* @__PURE__ */ new Set();
+      const rosterPath = path31.join(exeOsDir, "exe-employees.json");
+      if (existsSync21(rosterPath)) {
+        try {
+          const roster = JSON.parse(readFileSync17(rosterPath, "utf8"));
+          knownNames = new Set(roster.map((e) => e.name));
+        } catch {
+        }
+      }
+      for (const entry of entries) {
+        const name = entry.replace(/\.md$/, "");
+        if (knownNames.has(name)) {
+          if (!dryRun) rmSync(path31.join(agentsDir, entry), { force: true });
+          agentCount++;
+        }
+      }
+    } catch {
+    }
+    if (agentCount > 0) {
+      log(`\u2713 Removed ${agentCount} agent identity files`);
+      removed++;
+    }
+  }
+  const projectsDir = path31.join(claudeDir, "projects");
+  if (existsSync21(projectsDir)) {
+    let projectCount = 0;
+    try {
+      const projects = readdirSync5(projectsDir);
+      for (const proj of projects) {
+        const projSettings = path31.join(projectsDir, proj, "settings.json");
+        if (!existsSync21(projSettings)) continue;
+        try {
+          const pSettings = JSON.parse(readFileSync17(projSettings, "utf8"));
+          let changed = false;
+          if (Array.isArray(pSettings.permissions?.allow)) {
+            const before = pSettings.permissions.allow.length;
+            pSettings.permissions.allow = pSettings.permissions.allow.filter(
+              (p) => !p.startsWith("mcp__exe-mem__") && !p.startsWith("mcp__exe-os__")
+            );
+            if (pSettings.permissions.allow.length < before) changed = true;
+          }
+          if (changed && !dryRun) {
+            writeFileSync9(projSettings, JSON.stringify(pSettings, null, 2) + "\n");
+          }
+          if (changed) projectCount++;
+        } catch {
+        }
+      }
+    } catch {
+    }
+    if (projectCount > 0) {
+      log(`\u2713 Cleaned exe-os entries from ${projectCount} project settings`);
+      removed++;
+    }
+  }
+  try {
+    const { execSync: execSync13 } = await import("child_process");
+    const exeBinPath = execSync13("which exe", { encoding: "utf-8" }).trim();
+    const binDir = path31.dirname(exeBinPath);
+    let symlinkCount = 0;
+    const rosterPath = path31.join(exeOsDir, "exe-employees.json");
+    if (existsSync21(rosterPath)) {
+      const roster = JSON.parse(readFileSync17(rosterPath, "utf8"));
+      for (const emp of roster) {
+        if (emp.name === "exe") continue;
+        for (const suffix of ["", "-opencode"]) {
+          const linkPath = path31.join(binDir, `${emp.name}${suffix}`);
+          if (existsSync21(linkPath)) {
+            if (!dryRun) rmSync(linkPath, { force: true });
+            symlinkCount++;
+          }
+        }
+      }
+    }
+    if (symlinkCount > 0) {
+      log(`\u2713 Removed ${symlinkCount} employee symlinks`);
+      removed++;
+    }
+  } catch {
+  }
+  if (purge && existsSync21(exeOsDir)) {
+    if (!dryRun) {
+      process.stdout.write("\x1B[33m\u26A0 This will delete all memories, identities, and agent data.\x1B[0m\n");
+      process.stdout.write("  Removing ~/.exe-os...\n");
+      rmSync(exeOsDir, { recursive: true, force: true });
+    }
+    log("\u2713 Purged ~/.exe-os data directory");
+    removed++;
+  }
   if (removed === 0) {
     console.log("Nothing to remove \u2014 exe-os was not installed.");
   } else {
-    console.log("Done. Run \x1B[36mexe-os claude install\x1B[0m to reinstall.");
+    if (dryRun) {
+      console.log("\nDry run complete. Re-run without --dry-run to apply.");
+    } else {
+      console.log("\nDone. Run \x1B[36mexe-os claude install\x1B[0m to reinstall.");
+    }
   }
 }
 async function checkForUpdateOnBoot() {
@@ -21971,13 +22387,16 @@ async function runActivate(key) {
   mirrorLicenseKey2(key);
   try {
     const license = await validateLicense2(key);
-    if (!license.valid) {
+    if (!license.valid && license.error === "offline") {
+      console.log("\u26A0 Activated in offline mode \u2014 will verify when connected");
+    } else if (!license.valid) {
       process.stderr.write(`License invalid: ${license.plan || "unknown"}
 `);
       process.exit(1);
+    } else {
+      const planLabel = license.plan === "pro" ? "Solopreneur" : license.plan.charAt(0).toUpperCase() + license.plan.slice(1);
+      console.log(`Plan activated: ${planLabel}`);
     }
-    const planLabel = license.plan === "pro" ? "Solopreneur" : license.plan.charAt(0).toUpperCase() + license.plan.slice(1);
-    console.log(`Plan activated: ${planLabel}`);
     const rl = createInterface4({ input: process.stdin, output: process.stdout });
     const ask2 = (prompt) => new Promise((resolve) => rl.question(prompt, (a) => resolve(a.trim())));
     let employees = await loadEmployees2();