@askexenow/exe-os 0.8.53 → 0.8.55

package/dist/bin/exe-boot.js

@@ -1271,6 +1271,103 @@ var init_database = __esm({
   }
 });
 
+// src/lib/platform-procedures.ts
+var PLATFORM_PROCEDURES, PLATFORM_PROCEDURE_TITLES;
+var init_platform_procedures = __esm({
+  "src/lib/platform-procedures.ts"() {
+    "use strict";
+    PLATFORM_PROCEDURES = [
+      // --- Foundation: what is exe-os ---
+      {
+        title: "What is exe-os \u2014 the operating model every agent must understand",
+        domain: "architecture",
+        priority: "p0",
+        content: "Exe OS is an AI employee operating system. A founder runs 5-10 AI agents as a real org: COO (exe), CTO (yoshi), CMO (mari), engineers (tom), content (sasha). Each agent has identity, expertise, and experience layers \u2014 persistent memory that makes them better over time. All data is local-first, E2EE, owned by the user. The MCP server is the ONLY data interface \u2014 never access the DB directly."
+      },
+      {
+        title: "Mode 1 \u2014 how exe-os runs inside Claude Code",
+        domain: "architecture",
+        priority: "p0",
+        content: "Mode 1: exe-os runs AS hooks + MCP + skills inside Claude Code. The founder opens CC, runs /exe to boot the COO. exe manages employees in tmux sessions. Each exeN is a separate CC window/project. Employees (yoshi, tom, mari) run in their own tmux panes via create_task auto-spawn. The founder talks to exe; exe orchestrates the team. CC is the shell, exe-os is the brain."
+      },
+      {
+        title: "Sessions explained \u2014 what exeN means and how projects work",
+        domain: "architecture",
+        priority: "p0",
+        content: "Each exeN (exe1, exe2, exe3) is an isolated project session. exe1 might be exe-os development, exe2 might be exe-wiki. Each session spawns its own employees: exe1\u2192yoshi-exe1\u2192tom-exe1. Sessions share the same memory DB but tasks are scoped to the session that created them. A founder can run multiple projects simultaneously. Sessions never interfere with each other."
+      },
+      // --- Hierarchy and dispatch ---
+      {
+        title: "Chain of command \u2014 who talks to whom",
+        domain: "workflow",
+        priority: "p0",
+        content: "Founder \u2192 exe (COO) \u2192 yoshi (CTO) / mari (CMO). Yoshi \u2192 tom (engineer). Mari \u2192 sasha (content). Never skip levels: exe never assigns directly to tom. Tom never reports directly to exe. If you need cross-team info, use ask_team_memory \u2014 don't read other agents' task folders. Each level owns dispatch downward and review upward."
+      },
+      {
+        title: "Single dispatch path \u2014 create_task only",
+        domain: "workflow",
+        priority: "p0",
+        content: "create_task is the ONLY way to dispatch work to another agent. No direct ensureEmployee calls, no manual tmux spawns, no send_message for actionable work. create_task \u2192 system auto-spawns \u2192 session correctly named. ONE PATH. No backdoors. No exceptions."
+      },
+      // --- Session isolation ---
+      {
+        title: "Session scoping \u2014 stay in your exe boundary",
+        domain: "security",
+        priority: "p0",
+        content: "Session scoping is mandatory. Managers dispatch to workers within their own exe session ONLY. exe1\u2192yoshi-exe1\u2192tom-exe1. exe2\u2192yoshi-exe2\u2192tom2-exe2. Cross-session dispatch is blocked by the system. Verify session names before dispatch. Tasks are scoped to the creating exe session."
+      },
+      {
+        title: "Session isolation \u2014 never touch another session's work",
+        domain: "workflow",
+        priority: "p0",
+        content: `Sessions are isolated. exeN owns ONLY tasks it dispatched. (1) Never close/update/cancel tasks from another exe session. (2) Never review work from a different session \u2014 report "belongs to exeN" and skip. (3) Ignore other sessions' items in list_tasks results. (4) Employees inherit session: yoshi-exe1 works ONLY on exe1 tasks. Cross-session work is a system violation.`
+      },
+      // --- Engineering: session scoping in code ---
+      {
+        title: "Three-dimensional scoping \u2014 session, project, role \u2014 enforced in every query",
+        domain: "architecture",
+        priority: "p0",
+        content: "Every DB query, notification, review count, and task operation MUST be scoped on 3 dimensions: (1) Session \u2014 filter by session_scope matching current exeN. (2) Project \u2014 filter by project_name. (3) Role \u2014 agents only see data at their hierarchy level. When writing ANY function that touches tasks, reviews, messages, or notifications: always accept a sessionScope parameter and pass it to the SQL WHERE clause. Unscoped queries are bugs. Test by running 2+ exe sessions simultaneously."
+      },
+      // --- Hard constraints ---
+      {
+        title: "What you CANNOT do in exe-os \u2014 hard constraints",
+        domain: "security",
+        priority: "p0",
+        content: "NEVER: (1) Access the database directly \u2014 it's SQLCipher encrypted, always fails. Use MCP tools only. (2) Manually spawn tmux sessions \u2014 create_task handles it. (3) Run git checkout main \u2014 agents work in worktrees. (4) Modify another agent's in-progress task. (5) Push to remote \u2014 exe reviews and pushes. (6) Skip update_task(done) \u2014 it's the ONLY way your work gets reviewed. (7) Run git init."
+      },
+      // --- Operations ---
+      {
+        title: "Managers must supervise deployed workers",
+        domain: "workflow",
+        priority: "p0",
+        content: `Every manager (COO/CTO/CMO) who dispatches work to a worker MUST actively monitor them. Check tmux capture-pane every 10 minutes. Verify they're working, not stuck. If idle at prompt with in_progress task \u2192 send intercom. If stuck \u2192 unblock or escalate. "Standing by" without checking is negligence.`
+      },
+      {
+        title: "COO boot health check \u2014 memory, cloud sync, daemon on every launch",
+        domain: "workflow",
+        priority: "p0",
+        content: "On every /exe boot, COO MUST check system health BEFORE other work: (1) daemon \u2014 is exed PID alive, (2) cloud sync \u2014 grep workers.log for recent cloud-sync errors, (3) memory count \u2014 total in DB, (4) sync delta \u2014 local vs cloud storage_bytes. Report as 4-line status table. If ANY check fails, surface to founder immediately. Do not proceed to tasks until health confirmed."
+      },
+      {
+        title: "exe-build-adv mandatory for 3+ files",
+        domain: "workflow",
+        priority: "p0",
+        content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
+      },
+      {
+        title: "Desktop and TUI are the same product",
+        domain: "architecture",
+        priority: "p0",
+        content: "Desktop and TUI are the SAME product in different renderers. Same data contracts, same interactions, same acceptance criteria. Desktop tab specs in ARCHITECTURE.md ARE the TUI specs. When building TUI, cross-reference Desktop spec. Different tab names, identical behavior. Never treat them as separate products."
+      }
+    ];
+    PLATFORM_PROCEDURE_TITLES = new Set(
+      PLATFORM_PROCEDURES.map((p) => p.title)
+    );
+  }
+});
+
 // src/lib/global-procedures.ts
 var global_procedures_exports = {};
 __export(global_procedures_exports, {
@@ -1286,22 +1383,25 @@ async function loadGlobalProcedures() {
     sql: "SELECT * FROM global_procedures WHERE active = 1 ORDER BY priority ASC, created_at ASC",
     args: []
   });
-  const procedures = result.rows;
-  if (procedures.length > 0) {
-    _cache = procedures.map((p) => `### ${p.title}
+  const allRows = result.rows;
+  const customerOnly = allRows.filter((p) => !PLATFORM_PROCEDURE_TITLES.has(p.title));
+  if (customerOnly.length > 0) {
+    _customerCache = customerOnly.map((p) => `### ${p.title}
 ${p.content}`).join("\n\n");
   } else {
-    _cache = "";
+    _customerCache = "";
   }
   _cacheLoaded = true;
-  return procedures;
+  return customerOnly;
 }
 function getGlobalProceduresBlock() {
-  if (!_cacheLoaded) return "";
-  if (!_cache) return "";
+  const sections = [];
+  if (_platformCache) sections.push(_platformCache);
+  if (_cacheLoaded && _customerCache) sections.push(_customerCache);
+  if (sections.length === 0) return "";
   return `## Organization-Wide Procedures (MANDATORY \u2014 supersedes all other rules)
 
-${_cache}
+${sections.join("\n\n")}
 `;
 }
 async function storeGlobalProcedure(input) {
@@ -1326,13 +1426,16 @@ async function deactivateGlobalProcedure(id) {
   await loadGlobalProcedures();
   return result.rowsAffected > 0;
 }
-var _cache, _cacheLoaded;
+var _customerCache, _cacheLoaded, _platformCache;
 var init_global_procedures = __esm({
   "src/lib/global-procedures.ts"() {
     "use strict";
     init_database();
-    _cache = "";
+    init_platform_procedures();
+    _customerCache = "";
     _cacheLoaded = false;
+    _platformCache = PLATFORM_PROCEDURES.map((p) => `### ${p.title}
+${p.content}`).join("\n\n");
   }
 });
 
@@ -3329,16 +3432,32 @@ var init_tasks_crud = __esm({
 // src/lib/tasks-review.ts
 import path12 from "path";
 import { existsSync as existsSync11, readdirSync as readdirSync4, unlinkSync as unlinkSync3 } from "fs";
-async function countPendingReviews() {
+async function countPendingReviews(sessionScope) {
   const client = getClient();
+  if (sessionScope) {
+    const result2 = await client.execute({
+      sql: "SELECT COUNT(*) as cnt FROM tasks WHERE status = 'needs_review' AND (session_scope = ? OR session_scope IS NULL)",
+      args: [sessionScope]
+    });
+    return Number(result2.rows[0]?.cnt) || 0;
+  }
   const result = await client.execute({
     sql: "SELECT COUNT(*) as cnt FROM tasks WHERE status = 'needs_review'",
     args: []
   });
   return Number(result.rows[0]?.cnt) || 0;
 }
-async function countNewPendingReviewsSince(sinceIso) {
+async function countNewPendingReviewsSince(sinceIso, sessionScope) {
   const client = getClient();
+  if (sessionScope) {
+    const result2 = await client.execute({
+      sql: `SELECT COUNT(*) as cnt FROM tasks
+            WHERE status = 'needs_review' AND updated_at > ?
+              AND (session_scope = ? OR session_scope IS NULL)`,
+      args: [sinceIso, sessionScope]
+    });
+    return Number(result2.rows[0]?.cnt) || 0;
+  }
   const result = await client.execute({
     sql: `SELECT COUNT(*) as cnt FROM tasks
           WHERE status = 'needs_review' AND updated_at > ?`,
@@ -5325,6 +5444,64 @@ var init_task_scanner = __esm({
   }
 });
 
+// src/lib/worker-gate.ts
+var worker_gate_exports = {};
+__export(worker_gate_exports, {
+  MAX_CONCURRENT_WORKERS: () => MAX_CONCURRENT_WORKERS,
+  cleanupWorkerPid: () => cleanupWorkerPid,
+  registerWorkerPid: () => registerWorkerPid,
+  tryAcquireWorkerSlot: () => tryAcquireWorkerSlot
+});
+import { readdirSync as readdirSync6, writeFileSync as writeFileSync7, unlinkSync as unlinkSync6, mkdirSync as mkdirSync8 } from "fs";
+import path18 from "path";
+function tryAcquireWorkerSlot() {
+  try {
+    mkdirSync8(WORKER_PID_DIR, { recursive: true });
+    const files = readdirSync6(WORKER_PID_DIR);
+    let alive = 0;
+    for (const f of files) {
+      if (!f.endsWith(".pid")) continue;
+      const dashIdx = f.lastIndexOf("-");
+      const pid = parseInt(f.slice(dashIdx + 1).replace(".pid", ""), 10);
+      if (isNaN(pid)) continue;
+      try {
+        process.kill(pid, 0);
+        alive++;
+      } catch {
+        try {
+          unlinkSync6(path18.join(WORKER_PID_DIR, f));
+        } catch {
+        }
+      }
+    }
+    return alive < MAX_CONCURRENT_WORKERS;
+  } catch {
+    return true;
+  }
+}
+function registerWorkerPid(pid) {
+  try {
+    mkdirSync8(WORKER_PID_DIR, { recursive: true });
+    writeFileSync7(path18.join(WORKER_PID_DIR, `worker-${pid}.pid`), String(pid));
+  } catch {
+  }
+}
+function cleanupWorkerPid() {
+  try {
+    unlinkSync6(path18.join(WORKER_PID_DIR, `worker-${process.pid}.pid`));
+  } catch {
+  }
+}
+var WORKER_PID_DIR, MAX_CONCURRENT_WORKERS;
+var init_worker_gate = __esm({
+  "src/lib/worker-gate.ts"() {
+    "use strict";
+    init_config();
+    WORKER_PID_DIR = path18.join(EXE_AI_DIR, "worker-pids");
+    MAX_CONCURRENT_WORKERS = 3;
+  }
+});
+
 // src/lib/crypto.ts
 var crypto_exports = {};
 __export(crypto_exports, {
@@ -5432,13 +5609,13 @@ __export(cloud_sync_exports, {
   mergeRosterFromRemote: () => mergeRosterFromRemote,
   recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync7, existsSync as existsSync14, readdirSync as readdirSync6, mkdirSync as mkdirSync8, appendFileSync as appendFileSync2, unlinkSync as unlinkSync6, openSync, closeSync } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync8, existsSync as existsSync14, readdirSync as readdirSync7, mkdirSync as mkdirSync9, appendFileSync as appendFileSync2, unlinkSync as unlinkSync7, openSync, closeSync } from "fs";
 import crypto8 from "crypto";
-import path18 from "path";
+import path19 from "path";
 import { homedir } from "os";
 function logError(msg) {
   try {
-    const logPath = path18.join(homedir(), ".exe-os", "workers.log");
+    const logPath = path19.join(homedir(), ".exe-os", "workers.log");
     appendFileSync2(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
@@ -5448,7 +5625,7 @@ async function withRosterLock(fn) {
   try {
     const fd = openSync(ROSTER_LOCK_PATH, "wx");
     closeSync(fd);
-    writeFileSync7(ROSTER_LOCK_PATH, String(Date.now()));
+    writeFileSync8(ROSTER_LOCK_PATH, String(Date.now()));
   } catch (err) {
     if (err.code === "EEXIST") {
       try {
@@ -5456,10 +5633,10 @@ async function withRosterLock(fn) {
         if (Date.now() - ts < LOCK_STALE_MS) {
           throw new Error("Roster merge already in progress \u2014 another sync is running");
         }
-        unlinkSync6(ROSTER_LOCK_PATH);
+        unlinkSync7(ROSTER_LOCK_PATH);
         const fd = openSync(ROSTER_LOCK_PATH, "wx");
         closeSync(fd);
-        writeFileSync7(ROSTER_LOCK_PATH, String(Date.now()));
+        writeFileSync8(ROSTER_LOCK_PATH, String(Date.now()));
       } catch (retryErr) {
         if (retryErr instanceof Error && retryErr.message.includes("already in progress")) throw retryErr;
         throw new Error("Roster merge already in progress \u2014 another sync is running");
@@ -5472,7 +5649,7 @@ async function withRosterLock(fn) {
     return await fn();
   } finally {
     try {
-      unlinkSync6(ROSTER_LOCK_PATH);
+      unlinkSync7(ROSTER_LOCK_PATH);
     } catch {
     }
   }
@@ -5772,22 +5949,22 @@ function recordRosterDeletion(name) {
   } catch {
   }
   if (!deletions.includes(name)) deletions.push(name);
-  writeFileSync7(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
+  writeFileSync8(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
 }
 function consumeRosterDeletions() {
   try {
     if (!existsSync14(ROSTER_DELETIONS_PATH)) return [];
     const deletions = JSON.parse(readFileSync12(ROSTER_DELETIONS_PATH, "utf-8"));
-    writeFileSync7(ROSTER_DELETIONS_PATH, "[]");
+    writeFileSync8(ROSTER_DELETIONS_PATH, "[]");
     return deletions;
   } catch {
     return [];
   }
 }
 function buildRosterBlob(paths) {
-  const rosterPath = paths?.rosterPath ?? path18.join(EXE_AI_DIR, "exe-employees.json");
-  const identityDir = paths?.identityDir ?? path18.join(EXE_AI_DIR, "identity");
-  const configPath = paths?.configPath ?? path18.join(EXE_AI_DIR, "config.json");
+  const rosterPath = paths?.rosterPath ?? path19.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path19.join(EXE_AI_DIR, "identity");
+  const configPath = paths?.configPath ?? path19.join(EXE_AI_DIR, "config.json");
   let roster = [];
   if (existsSync14(rosterPath)) {
     try {
@@ -5797,9 +5974,9 @@ function buildRosterBlob(paths) {
   }
   const identities = {};
   if (existsSync14(identityDir)) {
-    for (const file of readdirSync6(identityDir).filter((f) => f.endsWith(".md"))) {
+    for (const file of readdirSync7(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
-        identities[file] = readFileSync12(path18.join(identityDir, file), "utf-8");
+        identities[file] = readFileSync12(path19.join(identityDir, file), "utf-8");
       } catch {
       }
     }
@@ -5883,7 +6060,7 @@ async function cloudPullRoster(config) {
   }
 }
 function mergeConfig(remoteConfig, configPath) {
-  const cfgPath = configPath ?? path18.join(EXE_AI_DIR, "config.json");
+  const cfgPath = configPath ?? path19.join(EXE_AI_DIR, "config.json");
   let local = {};
   if (existsSync14(cfgPath)) {
     try {
@@ -5892,14 +6069,14 @@ function mergeConfig(remoteConfig, configPath) {
     }
   }
   const merged = { ...remoteConfig, ...local };
-  const dir = path18.dirname(cfgPath);
-  if (!existsSync14(dir)) mkdirSync8(dir, { recursive: true });
-  writeFileSync7(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
+  const dir = path19.dirname(cfgPath);
+  if (!existsSync14(dir)) mkdirSync9(dir, { recursive: true });
+  writeFileSync8(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
 }
 async function mergeRosterFromRemote(remote, paths) {
   return withRosterLock(async () => {
     const rosterPath = paths?.rosterPath ?? void 0;
-    const identityDir = paths?.identityDir ?? path18.join(EXE_AI_DIR, "identity");
+    const identityDir = paths?.identityDir ?? path19.join(EXE_AI_DIR, "identity");
     const localEmployees = await loadEmployees(rosterPath);
     const localNames = new Set(localEmployees.map((e) => e.name));
     let added = 0;
@@ -5909,10 +6086,10 @@ async function mergeRosterFromRemote(remote, paths) {
       localNames.add(remoteEmp.name);
       added++;
       if (remote.identities[`${remoteEmp.name}.md`]) {
-        if (!existsSync14(identityDir)) mkdirSync8(identityDir, { recursive: true });
-        const idPath = path18.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync14(identityDir)) mkdirSync9(identityDir, { recursive: true });
+        const idPath = path19.join(identityDir, `${remoteEmp.name}.md`);
         if (!existsSync14(idPath)) {
-          writeFileSync7(idPath, remote.identities[`${remoteEmp.name}.md`], "utf-8");
+          writeFileSync8(idPath, remote.identities[`${remoteEmp.name}.md`], "utf-8");
         }
       }
       try {
@@ -6026,9 +6203,17 @@ async function cloudPullGlobalProcedures(config) {
   if (!remoteProcs || remoteProcs.length === 0) return { pulled: 0 };
   const client = getClient();
   const stmts = remoteProcs.map((p) => ({
-    sql: `INSERT OR IGNORE INTO global_procedures
+    sql: `INSERT INTO global_procedures
           (id, title, content, priority, domain, active, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(id) DO UPDATE SET
+            title = excluded.title,
+            content = excluded.content,
+            priority = excluded.priority,
+            domain = excluded.domain,
+            active = excluded.active,
+            updated_at = excluded.updated_at
+          WHERE excluded.updated_at > global_procedures.updated_at`,
     args: [
       p.id ?? null,
       p.title ?? null,
@@ -6364,9 +6549,9 @@ var init_cloud_sync = __esm({
     LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
     FETCH_TIMEOUT_MS = 3e4;
     PUSH_BATCH_SIZE = 5e3;
-    ROSTER_LOCK_PATH = path18.join(EXE_AI_DIR, "roster-merge.lock");
+    ROSTER_LOCK_PATH = path19.join(EXE_AI_DIR, "roster-merge.lock");
     LOCK_STALE_MS = 3e4;
-    ROSTER_DELETIONS_PATH = path18.join(EXE_AI_DIR, "roster-deletions.json");
+    ROSTER_DELETIONS_PATH = path19.join(EXE_AI_DIR, "roster-deletions.json");
   }
 });
 
@@ -6548,9 +6733,9 @@ var init_schedules = __esm({
 
 // src/bin/exe-boot.ts
 init_employees();
-import path19 from "path";
+import path20 from "path";
 import { mkdir as mkdir5, writeFile as writeFile6 } from "fs/promises";
-import { existsSync as existsSync15, readFileSync as readFileSync13, readdirSync as readdirSync7, unlinkSync as unlinkSync7 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync13, readdirSync as readdirSync8, unlinkSync as unlinkSync8 } from "fs";
 import os7 from "os";
 
 // src/lib/employee-templates.ts
@@ -7138,18 +7323,18 @@ async function boot(options) {
     } catch {
     }
     try {
-      const { readdirSync: readdirSync8, readFileSync: readFs } = await import("fs");
+      const { readdirSync: readdirSync9, readFileSync: readFs } = await import("fs");
       const { STATUS_RE: STATUS_RE2, PRIORITY_RE: PRIORITY_RE2, TITLE_RE: TITLE_RE2 } = await Promise.resolve().then(() => (init_task_scanner(), task_scanner_exports));
       const { getProjectName: getProjectName2 } = await Promise.resolve().then(() => (init_project_name(), project_name_exports));
       const exeDir = "exe";
-      const entries = readdirSync8(exeDir, { withFileTypes: true });
+      const entries = readdirSync9(exeDir, { withFileTypes: true });
       const employeeDirs = entries.filter((e) => e.isDirectory() && !["output", "research"].includes(e.name));
       for (const dir of employeeDirs) {
         const employee = dir.name;
-        const taskDir = path19.join(exeDir, employee);
+        const taskDir = path20.join(exeDir, employee);
         let files;
         try {
-          files = readdirSync8(taskDir).filter((f) => f.endsWith(".md"));
+          files = readdirSync9(taskDir).filter((f) => f.endsWith(".md"));
         } catch {
           continue;
         }
@@ -7157,7 +7342,7 @@ async function boot(options) {
           const taskFilePath = `exe/${employee}/${file}`;
           let content;
           try {
-            content = readFs(path19.join(taskDir, file), "utf8");
+            content = readFs(path20.join(taskDir, file), "utf8");
           } catch {
             continue;
           }
@@ -7241,12 +7426,12 @@ async function boot(options) {
     } catch {
     }
     try {
-      const exeExeDir = path19.join(process.cwd(), "exe", "exe");
+      const exeExeDir = path20.join(process.cwd(), "exe", "exe");
       if (existsSync15(exeExeDir)) {
-        for (const f of readdirSync7(exeExeDir)) {
+        for (const f of readdirSync8(exeExeDir)) {
           if (f.startsWith("review-") && f.endsWith(".md")) {
             try {
-              unlinkSync7(path19.join(exeExeDir, f));
+              unlinkSync8(path20.join(exeExeDir, f));
             } catch {
             }
           }
@@ -7290,12 +7475,12 @@ async function boot(options) {
           });
           const taskFile = String(r.task_file);
           try {
-            const filePath = path19.join(process.cwd(), taskFile);
+            const filePath = path20.join(process.cwd(), taskFile);
             if (existsSync15(filePath)) {
               let content = readFileSync13(filePath, "utf8");
               content = content.replace(/\*\*Status:\*\* needs_review/, "**Status:** done");
-              const { writeFileSync: writeFileSync8 } = await import("fs");
-              writeFileSync8(filePath, content);
+              const { writeFileSync: writeFileSync9 } = await import("fs");
+              writeFileSync9(filePath, content);
             }
           } catch {
           }
@@ -7755,8 +7940,8 @@ async function boot(options) {
     })()
   ]);
   try {
-    const configPath = path19.join(
-      process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path19.join(os7.homedir(), ".exe-os"),
+    const configPath = path20.join(
+      process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path20.join(os7.homedir(), ".exe-os"),
       "config.json"
     );
     if (existsSync15(configPath)) {
@@ -7766,7 +7951,7 @@ async function boot(options) {
   } catch {
   }
   try {
-    const backfillFlagPath = path19.join(EXE_AI_DIR, "session-cache", "needs-backfill");
+    const backfillFlagPath = path20.join(EXE_AI_DIR, "session-cache", "needs-backfill");
     const isBackfillNeeded = () => existsSync15(backfillFlagPath);
     const coverageResult = await client.execute({
       sql: `SELECT COUNT(*) as total,
@@ -7789,7 +7974,7 @@ async function boot(options) {
     let daemonRunning = false;
     let daemonUptime;
     let daemonRequestsServed;
-    const socketPath = path19.join(EXE_AI_DIR, "exed.sock");
+    const socketPath = path20.join(EXE_AI_DIR, "exed.sock");
     if (existsSync15(socketPath)) {
       try {
         const net = await import("net");
@@ -7832,7 +8017,7 @@ async function boot(options) {
       }
     }
     if (!daemonRunning) {
-      const pidPath = path19.join(EXE_AI_DIR, "exed.pid");
+      const pidPath = path20.join(EXE_AI_DIR, "exed.pid");
       if (existsSync15(pidPath)) {
         try {
           const pid = parseInt(readFileSync13(pidPath, "utf8").trim(), 10);
@@ -7846,10 +8031,10 @@ async function boot(options) {
     }
     if (nullCount === 0) {
       try {
-        const flagPath = path19.join(EXE_AI_DIR, "session-cache", "needs-backfill");
+        const flagPath = path20.join(EXE_AI_DIR, "session-cache", "needs-backfill");
         if (existsSync15(flagPath)) {
-          const { unlinkSync: unlinkSync8 } = await import("fs");
-          unlinkSync8(flagPath);
+          const { unlinkSync: unlinkSync9 } = await import("fs");
+          unlinkSync9(flagPath);
         }
       } catch {
       }
@@ -7866,28 +8051,34 @@ async function boot(options) {
     };
     if (nullCount > 0) {
       try {
-        const { spawn } = await import("child_process");
-        const { fileURLToPath: fileURLToPath3 } = await import("url");
-        const thisFile = fileURLToPath3(import.meta.url);
-        const backfillPath = path19.resolve(path19.dirname(thisFile), "backfill-vectors.js");
-        if (existsSync15(backfillPath)) {
-          const { openSync: openSync2, closeSync: closeSync2 } = await import("fs");
-          const workerLogPath = path19.join(EXE_AI_DIR, "workers.log");
-          let stderrFd = "ignore";
-          try {
-            stderrFd = openSync2(workerLogPath, "a");
-          } catch {
-          }
-          const child = spawn(process.execPath, [backfillPath], {
-            detached: true,
-            stdio: ["ignore", "ignore", stderrFd]
-          });
-          child.unref();
-          if (typeof stderrFd === "number") try {
-            closeSync2(stderrFd);
-          } catch {
+        const { tryAcquireWorkerSlot: tryAcquireWorkerSlot2, registerWorkerPid: registerWorkerPid2 } = await Promise.resolve().then(() => (init_worker_gate(), worker_gate_exports));
+        if (!tryAcquireWorkerSlot2()) {
+          process.stderr.write("[exe-boot] Backfill needed but worker gate full \u2014 skipping\n");
+        } else {
+          const { spawn } = await import("child_process");
+          const { fileURLToPath: fileURLToPath3 } = await import("url");
+          const thisFile = fileURLToPath3(import.meta.url);
+          const backfillPath = path20.resolve(path20.dirname(thisFile), "backfill-vectors.js");
+          if (existsSync15(backfillPath)) {
+            const { openSync: openSync2, closeSync: closeSync2 } = await import("fs");
+            const workerLogPath = path20.join(EXE_AI_DIR, "workers.log");
+            let stderrFd = "ignore";
+            try {
+              stderrFd = openSync2(workerLogPath, "a");
+            } catch {
+            }
+            const child = spawn(process.execPath, [backfillPath], {
+              detached: true,
+              stdio: ["ignore", "ignore", stderrFd]
+            });
+            child.unref();
+            if (child.pid) registerWorkerPid2(child.pid);
+            if (typeof stderrFd === "number") try {
+              closeSync2(stderrFd);
+            } catch {
+            }
+            briefData.embedding.backfillRunning = true;
           }
-          briefData.embedding.backfillRunning = true;
         }
       } catch {
       }
@@ -7900,7 +8091,7 @@ async function boot(options) {
     const criticalBinaries = ["backfill-vectors.js", "scan-tasks.js"];
     const missing = [];
     for (const bin of criticalBinaries) {
-      const binPath = path19.resolve(path19.dirname(thisFile), bin);
+      const binPath = path20.resolve(path20.dirname(thisFile), bin);
       if (!existsSync15(binPath)) {
         missing.push(`dist/bin/${bin}`);
       }
@@ -7931,7 +8122,7 @@ async function boot(options) {
     return;
   }
   const exeEmployee = employees.find((e) => e.name === "exe") ?? DEFAULT_EXE;
-  const sessionDir = path19.join(EXE_AI_DIR, "sessions", "exe");
+  const sessionDir = path20.join(EXE_AI_DIR, "sessions", "exe");
   await mkdir5(sessionDir, { recursive: true });
   const claudeMdContent = `${getSessionPrompt(exeEmployee.systemPrompt)}
 
@@ -7940,7 +8131,7 @@ async function boot(options) {
 # Status Brief
 
 ${brief}`;
-  await writeFile6(path19.join(sessionDir, "CLAUDE.md"), claudeMdContent, "utf-8");
+  await writeFile6(path20.join(sessionDir, "CLAUDE.md"), claudeMdContent, "utf-8");
   const unread = await readUnreadNotifications();
   if (unread.length > 0) {
     console.log(`\u{1F4EC} ${unread.length} unread notification${unread.length === 1 ? "" : "s"}`);
@@ -7949,8 +8140,8 @@ ${brief}`;
   await cleanupOldNotifications();
   console.log(brief);
   try {
-    const configPath2 = path19.join(
-      process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path19.join(os7.homedir(), ".exe-os"),
+    const configPath2 = path20.join(
+      process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path20.join(os7.homedir(), ".exe-os"),
       "config.json"
     );
     if (existsSync15(configPath2)) {