@askexenow/exe-os 0.8.80 → 0.8.82

package/dist/hooks/summary-worker.js

@@ -73,7 +73,7 @@ function wrapWithRetry(client) {
         return (sql) => retryOnBusy(() => target.execute(sql), "execute");
       }
       if (prop === "batch") {
-        return (stmts) => retryOnBusy(() => target.batch(stmts), "batch");
+        return (stmts, mode) => retryOnBusy(() => target.batch(stmts, mode), "batch");
       }
       return Reflect.get(target, prop, receiver);
     }
@@ -89,6 +89,345 @@ var init_db_retry = __esm({
   }
 });
 
+// src/lib/config.ts
+var config_exports = {};
+__export(config_exports, {
+  CONFIG_MIGRATIONS: () => CONFIG_MIGRATIONS,
+  CONFIG_PATH: () => CONFIG_PATH,
+  CURRENT_CONFIG_VERSION: () => CURRENT_CONFIG_VERSION,
+  DB_PATH: () => DB_PATH,
+  EXE_AI_DIR: () => EXE_AI_DIR,
+  LEGACY_LANCE_PATH: () => LEGACY_LANCE_PATH,
+  MODELS_DIR: () => MODELS_DIR,
+  loadConfig: () => loadConfig,
+  loadConfigFrom: () => loadConfigFrom,
+  loadConfigSync: () => loadConfigSync,
+  migrateConfig: () => migrateConfig,
+  saveConfig: () => saveConfig
+});
+import { readFile, writeFile, mkdir, chmod } from "fs/promises";
+import { readFileSync, existsSync, renameSync } from "fs";
+import path from "path";
+import os from "os";
+function resolveDataDir() {
+  if (process.env.EXE_OS_DIR) return process.env.EXE_OS_DIR;
+  if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
+  const newDir = path.join(os.homedir(), ".exe-os");
+  const legacyDir = path.join(os.homedir(), ".exe-mem");
+  if (!existsSync(newDir) && existsSync(legacyDir)) {
+    try {
+      renameSync(legacyDir, newDir);
+      process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
+`);
+    } catch {
+      return legacyDir;
+    }
+  }
+  return newDir;
+}
+function migrateLegacyConfig(raw) {
+  if ("r2" in raw) {
+    process.stderr.write(
+      "[exe-os] Warning: config.json contains deprecated 'r2' field from v1.0. R2 sync has been replaced in v1.1. The 'r2' field will be ignored.\n"
+    );
+    delete raw.r2;
+  }
+  if ("syncIntervalMs" in raw) {
+    delete raw.syncIntervalMs;
+  }
+  return raw;
+}
+function migrateConfig(raw) {
+  const fromVersion = typeof raw.config_version === "number" ? raw.config_version : 0;
+  let currentVersion = fromVersion;
+  let migrated = false;
+  if (currentVersion > CURRENT_CONFIG_VERSION) {
+    return { config: raw, migrated: false, fromVersion };
+  }
+  for (const migration of CONFIG_MIGRATIONS) {
+    if (currentVersion === migration.from && migration.to <= CURRENT_CONFIG_VERSION) {
+      raw = migration.migrate(raw);
+      currentVersion = migration.to;
+      migrated = true;
+    }
+  }
+  return { config: raw, migrated, fromVersion };
+}
+function normalizeScalingRoadmap(raw) {
+  const defaultAuto = DEFAULT_CONFIG.scalingRoadmap.rerankerAutoTrigger;
+  const userRoadmap = raw.scalingRoadmap ?? {};
+  const userAuto = userRoadmap.rerankerAutoTrigger ?? {};
+  if (userAuto.enabled === void 0 && raw.rerankerEnabled !== void 0) {
+    userAuto.enabled = raw.rerankerEnabled;
+  }
+  raw.scalingRoadmap = {
+    ...userRoadmap,
+    rerankerAutoTrigger: { ...defaultAuto, ...userAuto }
+  };
+}
+function normalizeSessionLifecycle(raw) {
+  const defaultSL = DEFAULT_CONFIG.sessionLifecycle;
+  const userSL = raw.sessionLifecycle ?? {};
+  raw.sessionLifecycle = { ...defaultSL, ...userSL };
+}
+function normalizeAutoUpdate(raw) {
+  const defaultAU = DEFAULT_CONFIG.autoUpdate;
+  const userAU = raw.autoUpdate ?? {};
+  raw.autoUpdate = { ...defaultAU, ...userAU };
+}
+async function loadConfig() {
+  const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
+  await mkdir(dir, { recursive: true });
+  const configPath = path.join(dir, "config.json");
+  if (!existsSync(configPath)) {
+    return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
+  }
+  const raw = await readFile(configPath, "utf-8");
+  try {
+    let parsed = JSON.parse(raw);
+    parsed = migrateLegacyConfig(parsed);
+    const { config: migratedCfg, migrated, fromVersion } = migrateConfig(parsed);
+    if (migrated) {
+      process.stderr.write(`[exe-os] Config migrated from v${fromVersion} to v${migratedCfg.config_version}
+`);
+      try {
+        await writeFile(configPath, JSON.stringify(migratedCfg, null, 2) + "\n");
+      } catch {
+      }
+    }
+    normalizeScalingRoadmap(migratedCfg);
+    normalizeSessionLifecycle(migratedCfg);
+    normalizeAutoUpdate(migratedCfg);
+    const config = { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
+    if (config.dbPath.startsWith("~")) {
+      config.dbPath = config.dbPath.replace(/^~/, os.homedir());
+    }
+    return config;
+  } catch {
+    return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
+  }
+}
+function loadConfigSync() {
+  const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
+  const configPath = path.join(dir, "config.json");
+  if (!existsSync(configPath)) {
+    return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
+  }
+  try {
+    const raw = readFileSync(configPath, "utf-8");
+    let parsed = JSON.parse(raw);
+    parsed = migrateLegacyConfig(parsed);
+    const { config: migratedCfg } = migrateConfig(parsed);
+    normalizeScalingRoadmap(migratedCfg);
+    normalizeSessionLifecycle(migratedCfg);
+    normalizeAutoUpdate(migratedCfg);
+    return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
+  } catch {
+    return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
+  }
+}
+async function saveConfig(config) {
+  const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
+  await mkdir(dir, { recursive: true });
+  const configPath = path.join(dir, "config.json");
+  await writeFile(configPath, JSON.stringify(config, null, 2) + "\n");
+  if (config.cloud?.apiKey) {
+    await chmod(configPath, 384);
+  }
+}
+async function loadConfigFrom(configPath) {
+  const raw = await readFile(configPath, "utf-8");
+  try {
+    let parsed = JSON.parse(raw);
+    parsed = migrateLegacyConfig(parsed);
+    const { config: migratedCfg } = migrateConfig(parsed);
+    normalizeScalingRoadmap(migratedCfg);
+    normalizeSessionLifecycle(migratedCfg);
+    normalizeAutoUpdate(migratedCfg);
+    return { ...DEFAULT_CONFIG, ...migratedCfg };
+  } catch {
+    return { ...DEFAULT_CONFIG };
+  }
+}
+var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CONFIG_VERSION, DEFAULT_CONFIG, CONFIG_MIGRATIONS;
+var init_config = __esm({
+  "src/lib/config.ts"() {
+    "use strict";
+    EXE_AI_DIR = resolveDataDir();
+    DB_PATH = path.join(EXE_AI_DIR, "memories.db");
+    MODELS_DIR = path.join(EXE_AI_DIR, "models");
+    CONFIG_PATH = path.join(EXE_AI_DIR, "config.json");
+    LEGACY_LANCE_PATH = path.join(EXE_AI_DIR, "local.lance");
+    CURRENT_CONFIG_VERSION = 1;
+    DEFAULT_CONFIG = {
+      config_version: CURRENT_CONFIG_VERSION,
+      dbPath: DB_PATH,
+      modelFile: "jina-embeddings-v5-small-q4_k_m.gguf",
+      embeddingDim: 1024,
+      batchSize: 20,
+      flushIntervalMs: 1e4,
+      autoIngestion: true,
+      autoRetrieval: true,
+      searchMode: "hybrid",
+      hookSearchMode: "hybrid",
+      fileGrepEnabled: true,
+      splashEffect: true,
+      consolidationEnabled: true,
+      consolidationIntervalMs: 6 * 60 * 60 * 1e3,
+      consolidationModel: "claude-haiku-4-5-20251001",
+      consolidationMaxCallsPerRun: 20,
+      selfQueryRouter: true,
+      selfQueryModel: "claude-haiku-4-5-20251001",
+      rerankerEnabled: true,
+      scalingRoadmap: {
+        rerankerAutoTrigger: {
+          enabled: true,
+          broadQueryMinCardinality: 5e4,
+          fetchTopK: 150,
+          returnTopK: 5
+        }
+      },
+      graphRagEnabled: true,
+      wikiEnabled: false,
+      wikiUrl: "",
+      wikiApiKey: "",
+      wikiSyncIntervalMs: 30 * 60 * 1e3,
+      wikiWorkspaceMapping: {},
+      wikiAutoUpdate: true,
+      wikiAutoUpdateThreshold: 0.5,
+      wikiAutoUpdateCreateNew: true,
+      skillLearning: true,
+      skillThreshold: 3,
+      skillModel: "claude-haiku-4-5-20251001",
+      exeHeartbeat: {
+        enabled: true,
+        intervalSeconds: 60,
+        staleInProgressThresholdHours: 2
+      },
+      sessionLifecycle: {
+        idleKillEnabled: true,
+        idleKillTicksRequired: 3,
+        idleKillIntercomAckWindowMs: 1e4,
+        maxAutoInstances: 10
+      },
+      autoUpdate: {
+        checkOnBoot: true,
+        autoInstall: false,
+        checkIntervalMs: 24 * 60 * 60 * 1e3
+      }
+    };
+    CONFIG_MIGRATIONS = [
+      {
+        from: 0,
+        to: 1,
+        migrate: (cfg) => {
+          cfg.config_version = 1;
+          return cfg;
+        }
+      }
+    ];
+  }
+});
+
+// src/lib/employees.ts
+import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { existsSync as existsSync2, symlinkSync, readlinkSync, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
+import { execSync } from "child_process";
+import path2 from "path";
+import os2 from "os";
+function normalizeRole(role) {
+  return (role ?? "").trim().toLowerCase();
+}
+function isCoordinatorRole(role) {
+  return normalizeRole(role) === normalizeRole(COORDINATOR_ROLE);
+}
+function getCoordinatorEmployee(employees) {
+  return employees.find((e) => isCoordinatorRole(e.role));
+}
+function getCoordinatorName(employees = loadEmployeesSync()) {
+  return getCoordinatorEmployee(employees)?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME;
+}
+function isCoordinatorName(agentName, employees = loadEmployeesSync()) {
+  if (!agentName) return false;
+  return agentName.toLowerCase() === getCoordinatorName(employees).toLowerCase();
+}
+function canCoordinate(agentName, agentRole, employees = loadEmployeesSync()) {
+  return agentName === "default" || isCoordinatorRole(agentRole) || isCoordinatorName(agentName, employees);
+}
+async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
+  if (!existsSync2(employeesPath)) {
+    return [];
+  }
+  const raw = await readFile2(employeesPath, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return [];
+  }
+}
+async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
+  await mkdir2(path2.dirname(employeesPath), { recursive: true });
+  await writeFile2(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
+}
+function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
+  if (!existsSync2(employeesPath)) return [];
+  try {
+    return JSON.parse(readFileSync2(employeesPath, "utf-8"));
+  } catch {
+    return [];
+  }
+}
+function findExeBin() {
+  try {
+    return execSync(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
+  } catch {
+    return null;
+  }
+}
+function registerBinSymlinks(name) {
+  const created = [];
+  const skipped = [];
+  const errors = [];
+  const exeBinPath = findExeBin();
+  if (!exeBinPath) {
+    errors.push("Could not find 'exe-os' in PATH");
+    return { created, skipped, errors };
+  }
+  const binDir = path2.dirname(exeBinPath);
+  let target;
+  try {
+    target = readlinkSync(exeBinPath);
+  } catch {
+    errors.push("Could not read 'exe' symlink");
+    return { created, skipped, errors };
+  }
+  for (const suffix of ["", "-opencode"]) {
+    const linkName = `${name}${suffix}`;
+    const linkPath = path2.join(binDir, linkName);
+    if (existsSync2(linkPath)) {
+      skipped.push(linkName);
+      continue;
+    }
+    try {
+      symlinkSync(target, linkPath);
+      created.push(linkName);
+    } catch (err) {
+      errors.push(`${linkName}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return { created, skipped, errors };
+}
+var EMPLOYEES_PATH, DEFAULT_COORDINATOR_TEMPLATE_NAME, COORDINATOR_ROLE;
+var init_employees = __esm({
+  "src/lib/employees.ts"() {
+    "use strict";
+    init_config();
+    EMPLOYEES_PATH = path2.join(EXE_AI_DIR, "exe-employees.json");
+    DEFAULT_COORDINATOR_TEMPLATE_NAME = "exe";
+    COORDINATOR_ROLE = "COO";
+  }
+});
+
 // src/lib/database.ts
 var database_exports = {};
 __export(database_exports, {
@@ -236,22 +575,24 @@ async function ensureSchema() {
       ON behaviors(agent_id, active);
   `);
   try {
+    const coordinatorName = getCoordinatorName();
     const existing = await client.execute({
-      sql: "SELECT COUNT(*) as cnt FROM behaviors WHERE agent_id = 'exe'",
-      args: []
+      sql: "SELECT COUNT(*) as cnt FROM behaviors WHERE agent_id = ?",
+      args: [coordinatorName]
     });
     if (Number(existing.rows[0]?.cnt) === 0) {
-      await client.executeMultiple(`
-        INSERT INTO behaviors (id, agent_id, project_name, domain, content, active, created_at, updated_at)
-        VALUES
-          (hex(randomblob(16)), 'exe', NULL, 'workflow', 'Don''t ask "keep going?" \u2014 just keep executing phases/plans autonomously', 1, '2026-03-25T00:00:00Z', '2026-03-25T00:00:00Z');
-        INSERT INTO behaviors (id, agent_id, project_name, domain, content, active, created_at, updated_at)
-        VALUES
-          (hex(randomblob(16)), 'exe', NULL, 'tool-use', 'Always use create_task MCP tool, never write .md files directly for task creation', 1, '2026-03-25T00:00:00Z', '2026-03-25T00:00:00Z');
-        INSERT INTO behaviors (id, agent_id, project_name, domain, content, active, created_at, updated_at)
-        VALUES
-          (hex(randomblob(16)), 'exe', NULL, 'workflow', 'Auto-start reviewing when idle and reviews are pending \u2014 never ask founder for permission', 1, '2026-03-25T00:00:00Z', '2026-03-25T00:00:00Z');
-      `);
+      const seededAt = "2026-03-25T00:00:00Z";
+      for (const [domain, content] of [
+        ["workflow", `Don't ask "keep going?" \u2014 just keep executing phases/plans autonomously`],
+        ["tool-use", "Always use create_task MCP tool, never write .md files directly for task creation"],
+        ["workflow", "Auto-start reviewing when idle and reviews are pending \u2014 never ask founder for permission"]
+      ]) {
+        await client.execute({
+          sql: `INSERT INTO behaviors (id, agent_id, project_name, domain, content, active, created_at, updated_at)
+                VALUES (hex(randomblob(16)), ?, NULL, ?, ?, 1, ?, ?)`,
+          args: [coordinatorName, domain, content, seededAt, seededAt]
+        });
+      }
     }
   } catch {
   }
@@ -943,6 +1284,39 @@ async function ensureSchema() {
     } catch {
     }
   }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE memories ADD COLUMN draft INTEGER DEFAULT 0`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute(
+      `CREATE INDEX IF NOT EXISTS idx_memories_draft ON memories(draft) WHERE draft = 1`
+    );
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE memories ADD COLUMN memory_type TEXT DEFAULT 'raw'`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute(
+      `CREATE INDEX IF NOT EXISTS idx_memories_type ON memories(memory_type)`
+    );
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE memories ADD COLUMN trajectory TEXT`,
+      args: []
+    });
+  } catch {
+  }
 }
 async function disposeDatabase() {
   if (_client) {
@@ -956,6 +1330,7 @@ var init_database = __esm({
   "src/lib/database.ts"() {
     "use strict";
     init_db_retry();
+    init_employees();
     _client = null;
     _resilientClient = null;
     initTurso = initDatabase;
@@ -972,15 +1347,15 @@ __export(keychain_exports, {
   importMnemonic: () => importMnemonic,
   setMasterKey: () => setMasterKey
 });
-import { readFile, writeFile, unlink, mkdir, chmod } from "fs/promises";
-import { existsSync } from "fs";
-import path from "path";
-import os from "os";
+import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
+import { existsSync as existsSync3 } from "fs";
+import path3 from "path";
+import os3 from "os";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path3.join(os3.homedir(), ".exe-os");
 }
 function getKeyPath() {
-  return path.join(getKeyDir(), "master.key");
+  return path3.join(getKeyDir(), "master.key");
 }
 async function tryKeytar() {
   try {
@@ -1001,11 +1376,11 @@ async function getMasterKey() {
     }
   }
   const keyPath = getKeyPath();
-  if (!existsSync(keyPath)) {
+  if (!existsSync3(keyPath)) {
     return null;
   }
   try {
-    const content = await readFile(keyPath, "utf-8");
+    const content = await readFile3(keyPath, "utf-8");
     return Buffer.from(content.trim(), "base64");
   } catch {
     return null;
@@ -1018,311 +1393,63 @@ async function setMasterKey(key) {
     try {
       await keytar.setPassword(SERVICE, ACCOUNT, b64);
       return;
-    } catch {
-    }
-  }
-  const dir = getKeyDir();
-  await mkdir(dir, { recursive: true });
-  const keyPath = getKeyPath();
-  await writeFile(keyPath, b64 + "\n", "utf-8");
-  await chmod(keyPath, 384);
-}
-async function deleteMasterKey() {
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      await keytar.deletePassword(SERVICE, ACCOUNT);
-    } catch {
-    }
-  }
-  const keyPath = getKeyPath();
-  if (existsSync(keyPath)) {
-    await unlink(keyPath);
-  }
-}
-async function loadBip39() {
-  try {
-    return await import("bip39");
-  } catch {
-    throw new Error(
-      "bip39 package not found. Run: npm install -g bip39\nOr reinstall exe-os: npm install -g @askexenow/exe-os"
-    );
-  }
-}
-async function exportMnemonic(key) {
-  if (key.length !== 32) {
-    throw new Error(`Key must be 32 bytes, got ${key.length}`);
-  }
-  const { entropyToMnemonic } = await loadBip39();
-  return entropyToMnemonic(key.toString("hex"));
-}
-async function importMnemonic(mnemonic) {
-  const trimmed = mnemonic.trim();
-  const words = trimmed.split(/\s+/);
-  if (words.length !== 24) {
-    throw new Error(`Expected 24 words, got ${words.length}`);
-  }
-  const { validateMnemonic, mnemonicToEntropy } = await loadBip39();
-  if (!validateMnemonic(trimmed)) {
-    throw new Error("Invalid mnemonic \u2014 check for typos or missing words");
-  }
-  const entropy = mnemonicToEntropy(trimmed);
-  return Buffer.from(entropy, "hex");
-}
-var SERVICE, ACCOUNT;
-var init_keychain = __esm({
-  "src/lib/keychain.ts"() {
-    "use strict";
-    SERVICE = "exe-mem";
-    ACCOUNT = "master-key";
-  }
-});
-
-// src/lib/config.ts
-var config_exports = {};
-__export(config_exports, {
-  CONFIG_MIGRATIONS: () => CONFIG_MIGRATIONS,
-  CONFIG_PATH: () => CONFIG_PATH,
-  COO_AGENT_NAME: () => COO_AGENT_NAME,
-  CURRENT_CONFIG_VERSION: () => CURRENT_CONFIG_VERSION,
-  DB_PATH: () => DB_PATH,
-  EXE_AI_DIR: () => EXE_AI_DIR,
-  LEGACY_LANCE_PATH: () => LEGACY_LANCE_PATH,
-  MODELS_DIR: () => MODELS_DIR,
-  loadConfig: () => loadConfig,
-  loadConfigFrom: () => loadConfigFrom,
-  loadConfigSync: () => loadConfigSync,
-  migrateConfig: () => migrateConfig,
-  saveConfig: () => saveConfig
-});
-import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
-import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
-import path2 from "path";
-import os2 from "os";
-function resolveDataDir() {
-  if (process.env.EXE_OS_DIR) return process.env.EXE_OS_DIR;
-  if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
-  const newDir = path2.join(os2.homedir(), ".exe-os");
-  const legacyDir = path2.join(os2.homedir(), ".exe-mem");
-  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
-    try {
-      renameSync(legacyDir, newDir);
-      process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
-`);
-    } catch {
-      return legacyDir;
-    }
-  }
-  return newDir;
-}
-function migrateLegacyConfig(raw) {
-  if ("r2" in raw) {
-    process.stderr.write(
-      "[exe-os] Warning: config.json contains deprecated 'r2' field from v1.0. R2 sync has been replaced in v1.1. The 'r2' field will be ignored.\n"
-    );
-    delete raw.r2;
-  }
-  if ("syncIntervalMs" in raw) {
-    delete raw.syncIntervalMs;
-  }
-  return raw;
-}
-function migrateConfig(raw) {
-  const fromVersion = typeof raw.config_version === "number" ? raw.config_version : 0;
-  let currentVersion = fromVersion;
-  let migrated = false;
-  if (currentVersion > CURRENT_CONFIG_VERSION) {
-    return { config: raw, migrated: false, fromVersion };
-  }
-  for (const migration of CONFIG_MIGRATIONS) {
-    if (currentVersion === migration.from && migration.to <= CURRENT_CONFIG_VERSION) {
-      raw = migration.migrate(raw);
-      currentVersion = migration.to;
-      migrated = true;
-    }
-  }
-  return { config: raw, migrated, fromVersion };
-}
-function normalizeScalingRoadmap(raw) {
-  const defaultAuto = DEFAULT_CONFIG.scalingRoadmap.rerankerAutoTrigger;
-  const userRoadmap = raw.scalingRoadmap ?? {};
-  const userAuto = userRoadmap.rerankerAutoTrigger ?? {};
-  if (userAuto.enabled === void 0 && raw.rerankerEnabled !== void 0) {
-    userAuto.enabled = raw.rerankerEnabled;
-  }
-  raw.scalingRoadmap = {
-    ...userRoadmap,
-    rerankerAutoTrigger: { ...defaultAuto, ...userAuto }
-  };
-}
-function normalizeSessionLifecycle(raw) {
-  const defaultSL = DEFAULT_CONFIG.sessionLifecycle;
-  const userSL = raw.sessionLifecycle ?? {};
-  raw.sessionLifecycle = { ...defaultSL, ...userSL };
-}
-function normalizeAutoUpdate(raw) {
-  const defaultAU = DEFAULT_CONFIG.autoUpdate;
-  const userAU = raw.autoUpdate ?? {};
-  raw.autoUpdate = { ...defaultAU, ...userAU };
-}
-async function loadConfig() {
-  const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir2(dir, { recursive: true });
-  const configPath = path2.join(dir, "config.json");
-  if (!existsSync2(configPath)) {
-    return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
-  }
-  const raw = await readFile2(configPath, "utf-8");
-  try {
-    let parsed = JSON.parse(raw);
-    parsed = migrateLegacyConfig(parsed);
-    const { config: migratedCfg, migrated, fromVersion } = migrateConfig(parsed);
-    if (migrated) {
-      process.stderr.write(`[exe-os] Config migrated from v${fromVersion} to v${migratedCfg.config_version}
-`);
-      try {
-        await writeFile2(configPath, JSON.stringify(migratedCfg, null, 2) + "\n");
-      } catch {
-      }
-    }
-    normalizeScalingRoadmap(migratedCfg);
-    normalizeSessionLifecycle(migratedCfg);
-    normalizeAutoUpdate(migratedCfg);
-    const config = { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db"), ...migratedCfg };
-    if (config.dbPath.startsWith("~")) {
-      config.dbPath = config.dbPath.replace(/^~/, os2.homedir());
+    } catch {
     }
-    return config;
-  } catch {
-    return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
   }
+  const dir = getKeyDir();
+  await mkdir3(dir, { recursive: true });
+  const keyPath = getKeyPath();
+  await writeFile3(keyPath, b64 + "\n", "utf-8");
+  await chmod2(keyPath, 384);
 }
-function loadConfigSync() {
-  const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  const configPath = path2.join(dir, "config.json");
-  if (!existsSync2(configPath)) {
-    return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
+async function deleteMasterKey() {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      await keytar.deletePassword(SERVICE, ACCOUNT);
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (existsSync3(keyPath)) {
+    await unlink(keyPath);
   }
+}
+async function loadBip39() {
   try {
-    const raw = readFileSync(configPath, "utf-8");
-    let parsed = JSON.parse(raw);
-    parsed = migrateLegacyConfig(parsed);
-    const { config: migratedCfg } = migrateConfig(parsed);
-    normalizeScalingRoadmap(migratedCfg);
-    normalizeSessionLifecycle(migratedCfg);
-    normalizeAutoUpdate(migratedCfg);
-    return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db"), ...migratedCfg };
+    return await import("bip39");
   } catch {
-    return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
+    throw new Error(
+      "bip39 package not found. Run: npm install -g bip39\nOr reinstall exe-os: npm install -g @askexenow/exe-os"
+    );
   }
 }
-async function saveConfig(config) {
-  const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir2(dir, { recursive: true });
-  const configPath = path2.join(dir, "config.json");
-  await writeFile2(configPath, JSON.stringify(config, null, 2) + "\n");
-  if (config.cloud?.apiKey) {
-    await chmod2(configPath, 384);
+async function exportMnemonic(key) {
+  if (key.length !== 32) {
+    throw new Error(`Key must be 32 bytes, got ${key.length}`);
   }
+  const { entropyToMnemonic } = await loadBip39();
+  return entropyToMnemonic(key.toString("hex"));
 }
-async function loadConfigFrom(configPath) {
-  const raw = await readFile2(configPath, "utf-8");
-  try {
-    let parsed = JSON.parse(raw);
-    parsed = migrateLegacyConfig(parsed);
-    const { config: migratedCfg } = migrateConfig(parsed);
-    normalizeScalingRoadmap(migratedCfg);
-    normalizeSessionLifecycle(migratedCfg);
-    normalizeAutoUpdate(migratedCfg);
-    return { ...DEFAULT_CONFIG, ...migratedCfg };
-  } catch {
-    return { ...DEFAULT_CONFIG };
+async function importMnemonic(mnemonic) {
+  const trimmed = mnemonic.trim();
+  const words = trimmed.split(/\s+/);
+  if (words.length !== 24) {
+    throw new Error(`Expected 24 words, got ${words.length}`);
+  }
+  const { validateMnemonic, mnemonicToEntropy } = await loadBip39();
+  if (!validateMnemonic(trimmed)) {
+    throw new Error("Invalid mnemonic \u2014 check for typos or missing words");
   }
+  const entropy = mnemonicToEntropy(trimmed);
+  return Buffer.from(entropy, "hex");
 }
-var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, COO_AGENT_NAME, LEGACY_LANCE_PATH, CURRENT_CONFIG_VERSION, DEFAULT_CONFIG, CONFIG_MIGRATIONS;
-var init_config = __esm({
-  "src/lib/config.ts"() {
+var SERVICE, ACCOUNT;
+var init_keychain = __esm({
+  "src/lib/keychain.ts"() {
     "use strict";
-    EXE_AI_DIR = resolveDataDir();
-    DB_PATH = path2.join(EXE_AI_DIR, "memories.db");
-    MODELS_DIR = path2.join(EXE_AI_DIR, "models");
-    CONFIG_PATH = path2.join(EXE_AI_DIR, "config.json");
-    COO_AGENT_NAME = "exe";
-    LEGACY_LANCE_PATH = path2.join(EXE_AI_DIR, "local.lance");
-    CURRENT_CONFIG_VERSION = 1;
-    DEFAULT_CONFIG = {
-      config_version: CURRENT_CONFIG_VERSION,
-      dbPath: DB_PATH,
-      modelFile: "jina-embeddings-v5-small-q4_k_m.gguf",
-      embeddingDim: 1024,
-      batchSize: 20,
-      flushIntervalMs: 1e4,
-      autoIngestion: true,
-      autoRetrieval: true,
-      searchMode: "hybrid",
-      hookSearchMode: "hybrid",
-      fileGrepEnabled: true,
-      splashEffect: true,
-      consolidationEnabled: true,
-      consolidationIntervalMs: 6 * 60 * 60 * 1e3,
-      consolidationModel: "claude-haiku-4-5-20251001",
-      consolidationMaxCallsPerRun: 20,
-      selfQueryRouter: true,
-      selfQueryModel: "claude-haiku-4-5-20251001",
-      rerankerEnabled: true,
-      scalingRoadmap: {
-        rerankerAutoTrigger: {
-          enabled: true,
-          broadQueryMinCardinality: 5e4,
-          fetchTopK: 150,
-          returnTopK: 5
-        }
-      },
-      graphRagEnabled: true,
-      wikiEnabled: false,
-      wikiUrl: "",
-      wikiApiKey: "",
-      wikiSyncIntervalMs: 30 * 60 * 1e3,
-      wikiWorkspaceMapping: {
-        exe: "Executive",
-        yoshi: "Engineering",
-        mari: "Marketing",
-        tom: "Engineering",
-        sasha: "Production"
-      },
-      wikiAutoUpdate: true,
-      wikiAutoUpdateThreshold: 0.5,
-      wikiAutoUpdateCreateNew: true,
-      skillLearning: true,
-      skillThreshold: 3,
-      skillModel: "claude-haiku-4-5-20251001",
-      exeHeartbeat: {
-        enabled: true,
-        intervalSeconds: 60,
-        staleInProgressThresholdHours: 2
-      },
-      sessionLifecycle: {
-        idleKillEnabled: true,
-        idleKillTicksRequired: 3,
-        idleKillIntercomAckWindowMs: 1e4,
-        maxAutoInstances: 10
-      },
-      autoUpdate: {
-        checkOnBoot: true,
-        autoInstall: false,
-        checkIntervalMs: 24 * 60 * 60 * 1e3
-      }
-    };
-    CONFIG_MIGRATIONS = [
-      {
-        from: 0,
-        to: 1,
-        migrate: (cfg) => {
-          cfg.config_version = 1;
-          return cfg;
-        }
-      }
-    ];
+    SERVICE = "exe-mem";
+    ACCOUNT = "master-key";
   }
 });
 
@@ -1394,12 +1521,12 @@ __export(shard_manager_exports, {
   listShards: () => listShards,
   shardExists: () => shardExists
 });
-import path3 from "path";
-import { existsSync as existsSync3, mkdirSync, readdirSync } from "fs";
+import path4 from "path";
+import { existsSync as existsSync4, mkdirSync, readdirSync } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
-  if (!existsSync3(SHARDS_DIR)) {
+  if (!existsSync4(SHARDS_DIR)) {
     mkdirSync(SHARDS_DIR, { recursive: true });
   }
   _shardingEnabled = true;
@@ -1420,7 +1547,7 @@ function getShardClient(projectName) {
   }
   const cached = _shards.get(safeName);
   if (cached) return cached;
-  const dbPath = path3.join(SHARDS_DIR, `${safeName}.db`);
+  const dbPath = path4.join(SHARDS_DIR, `${safeName}.db`);
   const client = createClient2({
     url: `file:${dbPath}`,
     encryptionKey: _encryptionKey
@@ -1430,10 +1557,10 @@ function getShardClient(projectName) {
 }
 function shardExists(projectName) {
   const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return existsSync3(path3.join(SHARDS_DIR, `${safeName}.db`));
+  return existsSync4(path4.join(SHARDS_DIR, `${safeName}.db`));
 }
 function listShards() {
-  if (!existsSync3(SHARDS_DIR)) return [];
+  if (!existsSync4(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
@@ -1503,7 +1630,11 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN source_path TEXT",
     "ALTER TABLE memories ADD COLUMN source_type TEXT DEFAULT 'text'",
     "ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3",
-    "ALTER TABLE memories ADD COLUMN supersedes_id TEXT"
+    "ALTER TABLE memories ADD COLUMN supersedes_id TEXT",
+    // MS-11: draft staging, MS-6a: memory_type, MS-7: trajectory
+    "ALTER TABLE memories ADD COLUMN draft INTEGER DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN memory_type TEXT DEFAULT 'raw'",
+    "ALTER TABLE memories ADD COLUMN trajectory TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -1615,7 +1746,7 @@ var init_shard_manager = __esm({
   "src/lib/shard-manager.ts"() {
     "use strict";
     init_config();
-    SHARDS_DIR = path3.join(EXE_AI_DIR, "shards");
+    SHARDS_DIR = path4.join(EXE_AI_DIR, "shards");
     _shards = /* @__PURE__ */ new Map();
     _encryptionKey = null;
     _shardingEnabled = false;
@@ -1633,26 +1764,26 @@ var init_platform_procedures = __esm({
         title: "What is exe-os \u2014 the operating model every agent must understand",
         domain: "architecture",
         priority: "p0",
-        content: "Exe OS is an AI employee operating system. A founder runs 5-10 AI agents as a real org: COO (exe), CTO (yoshi), CMO (mari), engineers (tom), content (sasha). Each agent has identity, expertise, and experience layers \u2014 persistent memory that makes them better over time. All data is local-first, E2EE, owned by the user. The MCP server is the ONLY data interface \u2014 never access the DB directly."
+        content: "Exe OS is an AI employee operating system. A founder runs 5-10 AI agents as a real org: COO, CTO, CMO, engineers, and content production specialists. Each agent has identity, expertise, and experience layers \u2014 persistent memory that makes them better over time. All data is local-first, E2EE, owned by the user. The MCP server is the ONLY data interface \u2014 never access the DB directly."
       },
       {
         title: "Mode 1 \u2014 how exe-os runs inside Claude Code",
         domain: "architecture",
         priority: "p0",
-        content: "Mode 1: exe-os runs AS hooks + MCP + skills inside Claude Code. The founder opens CC, runs /exe to boot the COO. exe manages employees in tmux sessions. Each exeN is a separate CC window/project. Employees (yoshi, tom, mari) run in their own tmux panes via create_task auto-spawn. The founder talks to exe; exe orchestrates the team. CC is the shell, exe-os is the brain."
+        content: "Mode 1: exe-os runs AS hooks + MCP + skills inside Claude Code. The founder opens CC and boots the COO. The COO manages employees in tmux sessions. Each coordinator session is a separate CC window/project. Employees run in their own tmux panes via create_task auto-spawn. The founder talks to the COO; the COO orchestrates the team. CC is the shell, exe-os is the brain."
       },
       {
-        title: "Sessions explained \u2014 what exeN means and how projects work",
+        title: "Sessions explained \u2014 coordinator session names and projects",
         domain: "architecture",
         priority: "p0",
-        content: "Each exeN (exe1, exe2, exe3) is an isolated project session. exe1 might be exe-os development, exe2 might be exe-wiki. Each session spawns its own employees: exe1\u2192yoshi-exe1\u2192tom-exe1. Sessions share the same memory DB but tasks are scoped to the session that created them. A founder can run multiple projects simultaneously. Sessions never interfere with each other."
+        content: "Each coordinator session is an isolated project session. One might be exe-os development, another might be exe-wiki. Each session spawns its own employees using {employee}-{coordinatorSession}. Sessions share the same memory DB but tasks are scoped to the session that created them. A founder can run multiple projects simultaneously. Sessions never interfere with each other."
       },
       // --- Hierarchy and dispatch ---
       {
         title: "Chain of command \u2014 who talks to whom",
         domain: "workflow",
         priority: "p0",
-        content: "Founder \u2192 exe (COO) \u2192 yoshi (CTO) / mari (CMO). Yoshi \u2192 tom (engineer). Mari \u2192 sasha (content). Never skip levels: exe never assigns directly to tom. Tom never reports directly to exe. If you need cross-team info, use ask_team_memory \u2014 don't read other agents' task folders. Each level owns dispatch downward and review upward."
+        content: "Founder -> COO -> CTO/CMO. CTO -> engineers. CMO -> content production. Never skip levels: the COO does not bypass managers for specialist work. Specialists report to their manager. If you need cross-team info, use ask_team_memory \u2014 don't read other agents' task folders. Each level owns dispatch downward and review upward."
       },
       {
         title: "Single dispatch path \u2014 create_task only",
@@ -1662,30 +1793,30 @@ var init_platform_procedures = __esm({
       },
       // --- Session isolation ---
       {
-        title: "Session scoping \u2014 stay in your exe boundary",
+        title: "Session scoping \u2014 stay in your coordinator boundary",
         domain: "security",
         priority: "p0",
-        content: "Session scoping is mandatory. Managers dispatch to workers within their own exe session ONLY. exe1\u2192yoshi-exe1\u2192tom-exe1. exe2\u2192yoshi-exe2\u2192tom2-exe2. Cross-session dispatch is blocked by the system. Verify session names before dispatch. Tasks are scoped to the creating exe session."
+        content: "Session scoping is mandatory. Managers dispatch to workers within their own coordinator session ONLY. Employee sessions use {employee}-{coordinatorSession}. Cross-session dispatch is blocked by the system. Verify session names before dispatch. Tasks are scoped to the creating coordinator session."
       },
       {
         title: "Session isolation \u2014 never touch another session's work",
         domain: "workflow",
         priority: "p0",
-        content: `Sessions are isolated. exeN owns ONLY tasks it dispatched. (1) Never close/update/cancel tasks from another exe session. (2) Never review work from a different session \u2014 report "belongs to exeN" and skip. (3) Ignore other sessions' items in list_tasks results. (4) Employees inherit session: yoshi-exe1 works ONLY on exe1 tasks. Cross-session work is a system violation.`
+        content: "Sessions are isolated. A coordinator session owns ONLY tasks it dispatched. (1) Never close/update/cancel tasks from another coordinator session. (2) Never review work from a different session \u2014 report that it belongs to another session and skip. (3) Ignore other sessions' items in list_tasks results. (4) Employees inherit session: employee sessions work ONLY on their parent coordinator session's tasks. Cross-session work is a system violation."
       },
       // --- Engineering: session scoping in code ---
       {
         title: "Three-dimensional scoping \u2014 session, project, role \u2014 enforced in every query",
         domain: "architecture",
         priority: "p0",
-        content: "Every DB query, notification, review count, and task operation MUST be scoped on 3 dimensions: (1) Session \u2014 filter by session_scope matching current exeN. (2) Project \u2014 filter by project_name. (3) Role \u2014 agents only see data at their hierarchy level. When writing ANY function that touches tasks, reviews, messages, or notifications: always accept a sessionScope parameter and pass it to the SQL WHERE clause. Unscoped queries are bugs. Test by running 2+ exe sessions simultaneously."
+        content: "Every DB query, notification, review count, and task operation MUST be scoped on 3 dimensions: (1) Session \u2014 filter by session_scope matching the current coordinator session. (2) Project \u2014 filter by project_name. (3) Role \u2014 agents only see data at their hierarchy level. When writing ANY function that touches tasks, reviews, messages, or notifications: always accept a sessionScope parameter and pass it to the SQL WHERE clause. Unscoped queries are bugs. Test by running 2+ coordinator sessions simultaneously."
       },
       // --- Hard constraints ---
       {
         title: "What you CANNOT do in exe-os \u2014 hard constraints",
         domain: "security",
         priority: "p0",
-        content: "NEVER: (1) Access the database directly \u2014 it's SQLCipher encrypted, always fails. Use MCP tools only. (2) Manually spawn tmux sessions \u2014 create_task handles it. (3) Run git checkout main \u2014 agents work in worktrees. (4) Modify another agent's in-progress task. (5) Push to remote \u2014 exe reviews and pushes. (6) Skip update_task(done) \u2014 it's the ONLY way your work gets reviewed. (7) Run git init."
+        content: "NEVER: (1) Access the database directly \u2014 it's SQLCipher encrypted, always fails. Use MCP tools only. (2) Manually spawn tmux sessions \u2014 create_task handles it. (3) Run git checkout main \u2014 agents work in worktrees. (4) Modify another agent's in-progress task. (5) Push to remote \u2014 the COO reviews and pushes. (6) Skip update_task(done) \u2014 it's the ONLY way your work gets reviewed. (7) Run git init."
       },
       // --- Operations ---
       {
@@ -1805,13 +1936,13 @@ ${p.content}`).join("\n\n");
 
 // src/lib/notifications.ts
 import crypto from "crypto";
-import path4 from "path";
-import os3 from "os";
+import path5 from "path";
+import os4 from "os";
 import {
-  readFileSync as readFileSync2,
+  readFileSync as readFileSync3,
   readdirSync as readdirSync2,
-  unlinkSync,
-  existsSync as existsSync4,
+  unlinkSync as unlinkSync2,
+  existsSync as existsSync5,
   rmdirSync
 } from "fs";
 async function writeNotification(notification) {
@@ -1846,24 +1977,24 @@ var init_notifications = __esm({
 });
 
 // src/lib/session-registry.ts
-import path5 from "path";
-import os4 from "os";
+import path6 from "path";
+import os5 from "os";
 var REGISTRY_PATH;
 var init_session_registry = __esm({
   "src/lib/session-registry.ts"() {
     "use strict";
-    REGISTRY_PATH = path5.join(os4.homedir(), ".exe-os", "session-registry.json");
+    REGISTRY_PATH = path6.join(os5.homedir(), ".exe-os", "session-registry.json");
   }
 });
 
 // src/lib/session-key.ts
-import { execSync } from "child_process";
+import { execSync as execSync2 } from "child_process";
 function getSessionKey() {
   if (_cached) return _cached;
   let pid = process.ppid;
   for (let i = 0; i < 10; i++) {
     try {
-      const info = execSync(`ps -p ${pid} -o ppid=,comm=`, {
+      const info = execSync2(`ps -p ${pid} -o ppid=,comm=`, {
         encoding: "utf8",
         timeout: 2e3
       }).trim();
@@ -1999,7 +2130,7 @@ var init_transport = __esm({
 });
 
 // src/lib/cc-agent-support.ts
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 var init_cc_agent_support = __esm({
   "src/lib/cc-agent-support.ts"() {
     "use strict";
@@ -2028,86 +2159,16 @@ var init_provider_table = __esm({
 });
 
 // src/lib/intercom-queue.ts
-import { readFileSync as readFileSync3, writeFileSync, renameSync as renameSync2, existsSync as existsSync5, mkdirSync as mkdirSync2 } from "fs";
-import path6 from "path";
-import os5 from "os";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, renameSync as renameSync3, existsSync as existsSync6, mkdirSync as mkdirSync2 } from "fs";
+import path7 from "path";
+import os6 from "os";
 var QUEUE_PATH, TTL_MS, INTERCOM_LOG;
 var init_intercom_queue = __esm({
   "src/lib/intercom-queue.ts"() {
     "use strict";
-    QUEUE_PATH = path6.join(os5.homedir(), ".exe-os", "intercom-queue.json");
+    QUEUE_PATH = path7.join(os6.homedir(), ".exe-os", "intercom-queue.json");
     TTL_MS = 60 * 60 * 1e3;
-    INTERCOM_LOG = path6.join(os5.homedir(), ".exe-os", "intercom.log");
-  }
-});
-
-// src/lib/employees.ts
-import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3 } from "fs/promises";
-import { existsSync as existsSync6, symlinkSync, readlinkSync, readFileSync as readFileSync4, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
-import { execSync as execSync3 } from "child_process";
-import path7 from "path";
-import os6 from "os";
-async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync6(employeesPath)) {
-    return [];
-  }
-  const raw = await readFile3(employeesPath, "utf-8");
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return [];
-  }
-}
-async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
-  await mkdir3(path7.dirname(employeesPath), { recursive: true });
-  await writeFile3(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
-}
-function findExeBin() {
-  try {
-    return execSync3(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
-  } catch {
-    return null;
-  }
-}
-function registerBinSymlinks(name) {
-  const created = [];
-  const skipped = [];
-  const errors = [];
-  const exeBinPath = findExeBin();
-  if (!exeBinPath) {
-    errors.push("Could not find 'exe-os' in PATH");
-    return { created, skipped, errors };
-  }
-  const binDir = path7.dirname(exeBinPath);
-  let target;
-  try {
-    target = readlinkSync(exeBinPath);
-  } catch {
-    errors.push("Could not read 'exe' symlink");
-    return { created, skipped, errors };
-  }
-  for (const suffix of ["", "-opencode"]) {
-    const linkName = `${name}${suffix}`;
-    const linkPath = path7.join(binDir, linkName);
-    if (existsSync6(linkPath)) {
-      skipped.push(linkName);
-      continue;
-    }
-    try {
-      symlinkSync(target, linkPath);
-      created.push(linkName);
-    } catch (err) {
-      errors.push(`${linkName}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  return { created, skipped, errors };
-}
-var EMPLOYEES_PATH;
-var init_employees = __esm({
-  "src/lib/employees.ts"() {
-    "use strict";
-    init_config();
-    EMPLOYEES_PATH = path7.join(EXE_AI_DIR, "exe-employees.json");
+    INTERCOM_LOG = path7.join(os6.homedir(), ".exe-os", "intercom.log");
   }
 });
 
@@ -2632,8 +2693,10 @@ function getMySession() {
   return getTransport().getMySession();
 }
 function extractRootExe(name) {
-  const match = name.match(/(exe\d+)$/);
-  return match?.[1] ?? null;
+  if (!name) return null;
+  if (!name.includes("-")) return name;
+  const parts = name.split("-").filter(Boolean);
+  return parts.length > 0 ? parts[parts.length - 1] : null;
 }
 function getParentExe(sessionKey) {
   try {
@@ -2668,6 +2731,7 @@ var init_tmux_routing = __esm({
     init_provider_table();
     init_intercom_queue();
     init_plan_limits();
+    init_employees();
     SPAWN_LOCK_DIR = path10.join(os7.homedir(), ".exe-os", "spawn-locks");
     SESSION_CACHE = path10.join(os7.homedir(), ".exe-os", "session-cache");
     INTERCOM_LOG2 = path10.join(os7.homedir(), ".exe-os", "intercom.log");
@@ -2788,6 +2852,10 @@ function spawnDaemon() {
     stdio: ["ignore", "ignore", stderrFd],
     env: {
       ...process.env,
+      TMUX: void 0,
+      // Daemon is global — must not inherit session scope
+      TMUX_PANE: void 0,
+      // Prevents resolveExeSession() from scoping to one session
       EXE_DAEMON_SOCK: SOCKET_PATH,
       EXE_DAEMON_PID: PID_PATH
     }
@@ -3495,6 +3563,11 @@ async function cloudSync(config) {
   } catch {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
+  try {
+    const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+    await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");
+  } catch {
+  }
   try {
     await client.execute(
       "CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)"
@@ -4445,7 +4518,10 @@ async function writeMemory(record) {
     source_path: record.source_path ?? null,
     source_type: record.source_type ?? null,
     tier: record.tier ?? classifyTier(record),
-    supersedes_id: record.supersedes_id ?? null
+    supersedes_id: record.supersedes_id ?? null,
+    draft: record.draft ? 1 : 0,
+    memory_type: record.memory_type ?? "raw",
+    trajectory: record.trajectory ? JSON.stringify(record.trajectory) : null
   };
   _pendingRecords.push(dbRow);
   orgBus.emit({
@@ -4500,6 +4576,9 @@ async function flushBatch() {
       const sourceType = row.source_type ?? null;
       const tier = row.tier ?? 3;
       const supersedesId = row.supersedes_id ?? null;
+      const draft = row.draft ? 1 : 0;
+      const memoryType = row.memory_type ?? "raw";
+      const trajectory = row.trajectory ?? null;
       return {
         sql: hasVector ? `INSERT OR IGNORE INTO memories
               (id, agent_id, agent_role, session_id, timestamp,
@@ -4507,15 +4586,15 @@ async function flushBatch() {
                has_error, raw_text, vector, version, task_id, importance, status,
                confidence, last_accessed,
                workspace_id, document_id, user_id, char_offset, page_number,
-               source_path, source_type, tier, supersedes_id)
-              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, vector32(?), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)` : `INSERT OR IGNORE INTO memories
+               source_path, source_type, tier, supersedes_id, draft, memory_type, trajectory)
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, vector32(?), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)` : `INSERT OR IGNORE INTO memories
               (id, agent_id, agent_role, session_id, timestamp,
                tool_name, project_name,
                has_error, raw_text, vector, version, task_id, importance, status,
                confidence, last_accessed,
                workspace_id, document_id, user_id, char_offset, page_number,
-               source_path, source_type, tier, supersedes_id)
-              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+               source_path, source_type, tier, supersedes_id, draft, memory_type, trajectory)
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         args: hasVector ? [
           row.id,
           row.agent_id,
@@ -4541,7 +4620,10 @@ async function flushBatch() {
           sourcePath,
           sourceType,
           tier,
-          supersedesId
+          supersedesId,
+          draft,
+          memoryType,
+          trajectory
         ] : [
           row.id,
           row.agent_id,
@@ -4566,7 +4648,10 @@ async function flushBatch() {
           sourcePath,
           sourceType,
           tier,
-          supersedesId
+          supersedesId,
+          draft,
+          memoryType,
+          trajectory
         ]
       };
     };
@@ -4612,6 +4697,7 @@ function vectorToBlob(vector) {
 init_database();
 init_notifications();
 init_task_scope();
+init_employees();
 import crypto4 from "crypto";
 import { execSync as execSync4 } from "child_process";
 import { existsSync as existsSync13, mkdirSync as mkdirSync7, openSync as openSync3, closeSync as closeSync3 } from "fs";
@@ -4677,104 +4763,114 @@ async function main() {
       primaryProject = p;
     }
   }
+  let limitReached = false;
   try {
     const { assertMemoryLimit: assertMemoryLimit2 } = await Promise.resolve().then(() => (init_plan_limits(), plan_limits_exports));
     await assertMemoryLimit2();
   } catch (err) {
-    process.stderr.write(`[summary-worker] LIMIT: ${err instanceof Error ? err.message : String(err)}
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("limit") || msg.includes("upgrade")) {
+      process.stderr.write(`[summary-worker] LIMIT: ${msg}
 `);
-    process.exit(0);
-  }
-  await writeMemory({
-    id: crypto4.randomUUID(),
-    agent_id: agentId,
-    agent_role: agentRole,
-    session_id: `auto-summary-${Date.now()}`,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    tool_name: "auto-summary",
-    project_name: primaryProject,
-    has_error: false,
-    raw_text: summaryText,
-    vector: null
-  });
-  await flushBatch();
-  if (agentId !== "exe" && agentId !== "default") {
-    let totalErrors = 0;
-    for (const [, data] of projects) {
-      totalErrors += data.errors;
-    }
-    if (totalErrors >= 3) {
-      await writeNotification({
-        agentId,
-        agentRole,
-        event: "error_spike",
-        project: primaryProject,
-        summary: `${totalErrors} errors in last ${totalCalls} tool calls`
-      });
+      limitReached = true;
     } else {
-      await writeNotification({
-        agentId,
-        agentRole,
-        event: "session_summary",
-        project: primaryProject,
-        summary: `${totalCalls} tool calls (${writeCalls} writes) on ${primaryProject}`
-      });
+      process.stderr.write(`[summary-worker] plan check failed (continuing): ${msg}
+`);
     }
   }
-  try {
-    const { embed: embed2 } = await Promise.resolve().then(() => (init_embedder(), embedder_exports));
-    const vector = await embed2(summaryText);
-    const rowResult = await client.execute({
-      sql: `SELECT rowid FROM memories WHERE agent_id = ? AND tool_name = 'auto-summary'
-            ORDER BY timestamp DESC LIMIT 1`,
-      args: [agentId]
+  if (limitReached) {
+  } else {
+    await writeMemory({
+      id: crypto4.randomUUID(),
+      agent_id: agentId,
+      agent_role: agentRole,
+      session_id: `auto-summary-${Date.now()}`,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      tool_name: "auto-summary",
+      project_name: primaryProject,
+      has_error: false,
+      raw_text: summaryText,
+      vector: null
     });
-    const targetRowid = rowResult.rows[0]?.rowid;
-    if (targetRowid != null) {
-      await client.execute({
-        sql: `UPDATE memories SET vector = vector32(?) WHERE rowid = ?`,
-        args: [vectorToBlob(vector), targetRowid]
+    await flushBatch();
+    if (!canCoordinate(agentId, agentRole)) {
+      let totalErrors = 0;
+      for (const [, data] of projects) {
+        totalErrors += data.errors;
+      }
+      if (totalErrors >= 3) {
+        await writeNotification({
+          agentId,
+          agentRole,
+          event: "error_spike",
+          project: primaryProject,
+          summary: `${totalErrors} errors in last ${totalCalls} tool calls`
+        });
+      } else {
+        await writeNotification({
+          agentId,
+          agentRole,
+          event: "session_summary",
+          project: primaryProject,
+          summary: `${totalCalls} tool calls (${writeCalls} writes) on ${primaryProject}`
+        });
+      }
+    }
+    try {
+      const { embed: embed2 } = await Promise.resolve().then(() => (init_embedder(), embedder_exports));
+      const vector = await embed2(summaryText);
+      const rowResult = await client.execute({
+        sql: `SELECT rowid FROM memories WHERE agent_id = ? AND tool_name = 'auto-summary'
+            ORDER BY timestamp DESC LIMIT 1`,
+        args: [agentId]
       });
+      const targetRowid = rowResult.rows[0]?.rowid;
+      if (targetRowid != null) {
+        await client.execute({
+          sql: `UPDATE memories SET vector = vector32(?) WHERE rowid = ?`,
+          args: [vectorToBlob(vector), targetRowid]
+        });
+      }
+    } catch (err) {
+      process.stderr.write("[summary-worker] embed failed: " + (err instanceof Error ? err.message : String(err)) + "\n");
     }
-  } catch (err) {
-    process.stderr.write("[summary-worker] embed failed: " + (err instanceof Error ? err.message : String(err)) + "\n");
-  }
-  try {
-    const { EXE_AI_DIR: EXE_AI_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-    const flagPath = path14.join(EXE_AI_DIR2, "session-cache", "needs-backfill");
-    if (existsSync13(flagPath)) {
-      const { tryAcquireWorkerSlot: tryAcquireWorkerSlot2, registerWorkerPid: registerWorkerPid2 } = await Promise.resolve().then(() => (init_worker_gate(), worker_gate_exports));
-      if (!tryAcquireWorkerSlot2()) {
-        process.stderr.write("[summary-worker] Backfill needed but worker gate full \u2014 skipping\n");
-      } else {
-        const { spawn: spawn2 } = await import("child_process");
-        const { fileURLToPath: fileURLToPath3 } = await import("url");
-        const thisFile = fileURLToPath3(import.meta.url);
-        const backfillPath = path14.resolve(path14.dirname(thisFile), "backfill-vectors.js");
-        if (existsSync13(backfillPath)) {
-          const { EXE_AI_DIR: exeDir2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-          const bLogPath = path14.join(exeDir2, "workers.log");
-          mkdirSync7(path14.dirname(bLogPath), { recursive: true });
-          const bLogFd = openSync3(bLogPath, "a");
-          const child = spawn2(process.execPath, [backfillPath], {
-            detached: true,
-            stdio: ["ignore", "ignore", bLogFd]
-          });
-          child.unref();
-          if (child.pid) registerWorkerPid2(child.pid);
-          try {
-            closeSync3(bLogFd);
-          } catch {
-          }
-          process.stderr.write("[summary-worker] Spawned backfill job\n");
+    try {
+      const { EXE_AI_DIR: EXE_AI_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+      const flagPath = path14.join(EXE_AI_DIR2, "session-cache", "needs-backfill");
+      if (existsSync13(flagPath)) {
+        const { tryAcquireWorkerSlot: tryAcquireWorkerSlot2, registerWorkerPid: registerWorkerPid2 } = await Promise.resolve().then(() => (init_worker_gate(), worker_gate_exports));
+        if (!tryAcquireWorkerSlot2()) {
+          process.stderr.write("[summary-worker] Backfill needed but worker gate full \u2014 skipping\n");
         } else {
-          process.stderr.write(`[summary-worker] WARN: backfill-vectors not found at ${backfillPath}
+          const { spawn: spawn2 } = await import("child_process");
+          const { fileURLToPath: fileURLToPath3 } = await import("url");
+          const thisFile = fileURLToPath3(import.meta.url);
+          const backfillPath = path14.resolve(path14.dirname(thisFile), "backfill-vectors.js");
+          if (existsSync13(backfillPath)) {
+            const { EXE_AI_DIR: exeDir2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+            const bLogPath = path14.join(exeDir2, "workers.log");
+            mkdirSync7(path14.dirname(bLogPath), { recursive: true });
+            const bLogFd = openSync3(bLogPath, "a");
+            const child = spawn2(process.execPath, [backfillPath], {
+              detached: true,
+              stdio: ["ignore", "ignore", bLogFd]
+            });
+            child.unref();
+            if (child.pid) registerWorkerPid2(child.pid);
+            try {
+              closeSync3(bLogFd);
+            } catch {
+            }
+            process.stderr.write("[summary-worker] Spawned backfill job\n");
+          } else {
+            process.stderr.write(`[summary-worker] WARN: backfill-vectors not found at ${backfillPath}
 `);
+          }
         }
       }
+    } catch (err) {
+      process.stderr.write("[summary-worker] backfill spawn failed: " + (err instanceof Error ? err.message : String(err)) + "\n");
     }
-  } catch (err) {
-    process.stderr.write("[summary-worker] backfill spawn failed: " + (err instanceof Error ? err.message : String(err)) + "\n");
   }
   try {
     const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
@@ -4801,7 +4897,7 @@ async function main() {
 `);
     }
   }
-  if (agentId !== "exe" && agentId !== "default") {
+  if (!canCoordinate(agentId, agentRole)) {
     try {
       const swScope = sessionScopeFilter();
       const inProgressResult = await client.execute({