@askexenow/exe-os 0.8.83 → 0.8.85

package/dist/bin/exe-call.js

@@ -107,6 +107,7 @@ __export(employees_exports, {
   DEFAULT_COORDINATOR_TEMPLATE_NAME: () => DEFAULT_COORDINATOR_TEMPLATE_NAME,
   EMPLOYEES_PATH: () => EMPLOYEES_PATH,
   addEmployee: () => addEmployee,
+  baseAgentName: () => baseAgentName,
   canCoordinate: () => canCoordinate,
   getCoordinatorEmployee: () => getCoordinatorEmployee,
   getCoordinatorName: () => getCoordinatorName,
@@ -203,6 +204,14 @@ function hasRole(agentName, role) {
   const emp = getEmployee(employees, agentName);
   return emp ? emp.role.toLowerCase() === role.toLowerCase() : false;
 }
+function baseAgentName(name, employees) {
+  const match = name.match(/^([a-zA-Z]+)\d+$/);
+  if (!match) return name;
+  const base = match[1];
+  const roster = employees ?? loadEmployeesSync();
+  if (getEmployee(roster, base)) return base;
+  return name;
+}
 function isMultiInstance(agentName, employees) {
   const roster = employees ?? loadEmployeesSync();
   const emp = getEmployee(roster, agentName);
@@ -1080,6 +1089,7 @@ import { realpathSync } from "fs";
 import { fileURLToPath } from "url";
 function isMainModule(importMetaUrl) {
   if (process.argv[1] == null) return false;
+  if (process.argv[1].includes("mcp/server")) return false;
   try {
     const scriptPath = realpathSync(process.argv[1]);
     const modulePath = realpathSync(fileURLToPath(importMetaUrl));

package/dist/bin/exe-cloud.js

@@ -46,12 +46,20 @@ async function getMasterKey() {
   }
   const keyPath = getKeyPath();
   if (!existsSync(keyPath)) {
+    process.stderr.write(
+      `[keychain] Key not found at ${keyPath} (HOME=${os.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
+`
+    );
     return null;
   }
   try {
     const content = await readFile(keyPath, "utf-8");
     return Buffer.from(content.trim(), "base64");
-  } catch {
+  } catch (err) {
+    process.stderr.write(
+      `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
     return null;
   }
 }
@@ -720,6 +728,19 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
   }
 });
 
+// src/lib/crdt-sync.ts
+import * as Y from "yjs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import path5 from "path";
+import { homedir } from "os";
+var DEFAULT_STATE_PATH;
+var init_crdt_sync = __esm({
+  "src/lib/crdt-sync.ts"() {
+    "use strict";
+    DEFAULT_STATE_PATH = path5.join(homedir(), ".exe-os", "crdt-state.bin");
+  }
+});
+
 // src/bin/exe-cloud.ts
 init_keychain();
 init_config();
@@ -745,6 +766,7 @@ import { realpathSync } from "fs";
 import { fileURLToPath } from "url";
 function isMainModule(importMetaUrl) {
   if (process.argv[1] == null) return false;
+  if (process.argv[1].includes("mcp/server")) return false;
   try {
     const scriptPath = realpathSync(process.argv[1]);
     const modulePath = realpathSync(fileURLToPath(importMetaUrl));
@@ -756,10 +778,10 @@ function isMainModule(importMetaUrl) {
 
 // src/lib/cloud-sync.ts
 init_database();
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync5, readdirSync, mkdirSync as mkdirSync2, appendFileSync, unlinkSync as unlinkSync2, openSync, closeSync } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync6, readdirSync, mkdirSync as mkdirSync3, appendFileSync, unlinkSync as unlinkSync3, openSync, closeSync } from "fs";
 import crypto3 from "crypto";
-import path5 from "path";
-import { homedir } from "os";
+import path6 from "path";
+import { homedir as homedir2 } from "os";
 
 // src/lib/crypto.ts
 import crypto2 from "crypto";
@@ -770,9 +792,10 @@ import { brotliCompressSync, brotliDecompressSync, constants } from "zlib";
 // src/lib/cloud-sync.ts
 init_license();
 init_config();
+init_crdt_sync();
 init_employees();
 var LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
-var ROSTER_LOCK_PATH = path5.join(EXE_AI_DIR, "roster-merge.lock");
+var ROSTER_LOCK_PATH = path6.join(EXE_AI_DIR, "roster-merge.lock");
 function assertSecureEndpoint(endpoint) {
   if (endpoint.startsWith("https://")) return;
   if (endpoint.startsWith("http://")) {
@@ -787,7 +810,7 @@ function assertSecureEndpoint(endpoint) {
     );
   }
 }
-var ROSTER_DELETIONS_PATH = path5.join(EXE_AI_DIR, "roster-deletions.json");
+var ROSTER_DELETIONS_PATH = path6.join(EXE_AI_DIR, "roster-deletions.json");
 
 // src/bin/exe-cloud.ts
 var BAR = "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550";

package/dist/bin/exe-dispatch.js

@@ -628,6 +628,12 @@ function getClient() {
   if (!_resilientClient) {
     throw new Error("Database client not initialized. Call initDatabase() first.");
   }
+  if (process.env.EXE_IS_DAEMON === "1") {
+    return _resilientClient;
+  }
+  if (_daemonClient && _daemonClient._isDaemonActive()) {
+    return _daemonClient;
+  }
   return _resilientClient;
 }
 function getRawClient() {
@@ -1116,6 +1122,12 @@ async function ensureSchema() {
     } catch {
     }
   }
+  try {
+    await client.execute(
+      `CREATE INDEX IF NOT EXISTS idx_memories_content_hash ON memories(content_hash, agent_id)`
+    );
+  } catch {
+  }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS entities (
       id TEXT PRIMARY KEY,
@@ -1168,7 +1180,30 @@ async function ensureSchema() {
       entity_id TEXT NOT NULL,
       PRIMARY KEY (hyperedge_id, entity_id)
     );
+
+    CREATE VIRTUAL TABLE IF NOT EXISTS entities_fts USING fts5(
+      name,
+      content=entities,
+      content_rowid=rowid
+    );
+
+    CREATE TRIGGER IF NOT EXISTS entities_fts_ai AFTER INSERT ON entities BEGIN
+      INSERT INTO entities_fts(rowid, name) VALUES (new.rowid, new.name);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS entities_fts_ad AFTER DELETE ON entities BEGIN
+      INSERT INTO entities_fts(entities_fts, rowid, name) VALUES('delete', old.rowid, old.name);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS entities_fts_au AFTER UPDATE ON entities BEGIN
+      INSERT INTO entities_fts(entities_fts, rowid, name) VALUES('delete', old.rowid, old.name);
+      INSERT INTO entities_fts(rowid, name) VALUES (new.rowid, new.name);
+    END;
   `);
+  try {
+    await client.execute("INSERT INTO entities_fts(entities_fts) VALUES('rebuild')");
+  } catch {
+  }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS entity_aliases (
       alias TEXT NOT NULL PRIMARY KEY,
@@ -1349,6 +1384,33 @@ async function ensureSchema() {
     CREATE INDEX IF NOT EXISTS idx_conversations_channel
       ON conversations(channel_id);
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS session_agent_map (
+      session_uuid TEXT PRIMARY KEY,
+      agent_id TEXT NOT NULL,
+      session_name TEXT,
+      task_id TEXT,
+      project_name TEXT,
+      started_at TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_session_agent_map_agent
+      ON session_agent_map(agent_id);
+  `);
+  try {
+    const mapCount = await client.execute({ sql: `SELECT COUNT(*) as cnt FROM session_agent_map`, args: [] });
+    if (Number(mapCount.rows[0]?.cnt ?? 0) === 0) {
+      await client.execute({
+        sql: `INSERT OR IGNORE INTO session_agent_map (session_uuid, agent_id, session_name, started_at)
+              SELECT session_id, agent_id, '', MIN(timestamp)
+              FROM memories
+              WHERE session_id IS NOT NULL AND session_id != '' AND agent_id IS NOT NULL AND agent_id != ''
+              GROUP BY session_id, agent_id`,
+        args: []
+      });
+    }
+  } catch {
+  }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN budget_tokens INTEGER`,
@@ -1482,8 +1544,30 @@ async function ensureSchema() {
     });
   } catch {
   }
+  for (const col of [
+    "ALTER TABLE memories ADD COLUMN intent TEXT",
+    "ALTER TABLE memories ADD COLUMN outcome TEXT",
+    "ALTER TABLE memories ADD COLUMN domain TEXT",
+    "ALTER TABLE memories ADD COLUMN referenced_entities TEXT",
+    "ALTER TABLE memories ADD COLUMN retrieval_count INTEGER DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN chain_position TEXT",
+    "ALTER TABLE memories ADD COLUMN review_status TEXT",
+    "ALTER TABLE memories ADD COLUMN context_window_pct INTEGER",
+    "ALTER TABLE memories ADD COLUMN file_paths TEXT",
+    "ALTER TABLE memories ADD COLUMN commit_hash TEXT",
+    "ALTER TABLE memories ADD COLUMN duration_ms INTEGER",
+    "ALTER TABLE memories ADD COLUMN token_cost REAL",
+    "ALTER TABLE memories ADD COLUMN audience TEXT",
+    "ALTER TABLE memories ADD COLUMN language_type TEXT",
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+  ]) {
+    try {
+      await client.execute(col);
+    } catch {
+    }
+  }
 }
-var _client, _resilientClient, initTurso;
+var _client, _resilientClient, _daemonClient, initTurso;
 var init_database = __esm({
   "src/lib/database.ts"() {
     "use strict";
@@ -1491,6 +1575,7 @@ var init_database = __esm({
     init_employees();
     _client = null;
     _resilientClient = null;
+    _daemonClient = null;
     initTurso = initDatabase;
   }
 });
@@ -1764,6 +1849,7 @@ var init_state_bus = __esm({
 // src/lib/tasks-crud.ts
 import crypto3 from "crypto";
 import path8 from "path";
+import os6 from "os";
 import { execSync as execSync4 } from "child_process";
 import { mkdir as mkdir3, writeFile as writeFile3, appendFile } from "fs/promises";
 import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
@@ -1807,6 +1893,35 @@ function extractParentFromContext(contextBody) {
 function slugify(title) {
   return title.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
+function buildKeywordIndex() {
+  const idx = /* @__PURE__ */ new Map();
+  for (const [role, keywords] of Object.entries(LANE_KEYWORDS)) {
+    for (const kw of keywords) {
+      const existing = idx.get(kw) ?? [];
+      existing.push(role);
+      idx.set(kw, existing);
+    }
+  }
+  return idx;
+}
+function checkLaneAffinity(title, context, assigneeName) {
+  const employees = loadEmployeesSync();
+  const employee = employees.find((e) => e.name === assigneeName);
+  if (!employee) return void 0;
+  const assigneeRole = employee.role;
+  const text = `${title} ${context}`.toLowerCase();
+  const matchedRoles = /* @__PURE__ */ new Set();
+  for (const [keyword, roles] of KEYWORD_INDEX) {
+    if (text.includes(keyword)) {
+      for (const role of roles) matchedRoles.add(role);
+    }
+  }
+  if (matchedRoles.size === 0) return void 0;
+  if (matchedRoles.has(assigneeRole)) return void 0;
+  if (assigneeRole === "COO") return void 0;
+  const expectedRoles = Array.from(matchedRoles).join(" or ");
+  return `\u26A0\uFE0F Lane mismatch: task content suggests ${expectedRoles}, but assigned to ${assigneeName} (${assigneeRole}).`;
+}
 async function resolveTask(client, identifier, scopeSession) {
   const scope = sessionScopeFilter(scopeSession);
   let result2 = await client.execute({
@@ -1856,7 +1971,14 @@ async function createTaskCore(input) {
   const id = crypto3.randomUUID();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const slug = slugify(input.title);
-  const taskFile = input.taskFile ?? `exe/${input.assignedTo}/${slug}.md`;
+  let earlySessionScope = null;
+  try {
+    const { resolveExeSession: resolveExeSession2 } = await Promise.resolve().then(() => (init_tmux_routing(), tmux_routing_exports));
+    earlySessionScope = resolveExeSession2();
+  } catch {
+  }
+  const scope = earlySessionScope ?? "default";
+  const taskFile = input.taskFile ?? `tasks/${scope}/${input.assignedTo}/${slug}.md`;
   let blockedById = null;
   const initialStatus = input.blockedBy ? "blocked" : "open";
   if (input.blockedBy) {
@@ -1896,6 +2018,13 @@ async function createTaskCore(input) {
   if (dupCheck.rows.length > 0) {
     warning = `similar active task already exists (${String(dupCheck.rows[0].id)}). Created new task anyway.`;
   }
+  if (!process.env.DISABLE_LANE_AFFINITY) {
+    const laneWarning = checkLaneAffinity(input.title, input.context, input.assignedTo);
+    if (laneWarning) {
+      warning = warning ? `${warning}
+${laneWarning}` : laneWarning;
+    }
+  }
   if (input.baseDir) {
     try {
       await mkdir3(path8.join(input.baseDir, "exe", "output"), { recursive: true });
@@ -1906,12 +2035,7 @@ async function createTaskCore(input) {
     }
   }
   const complexity = input.complexity ?? "standard";
-  let sessionScope = null;
-  try {
-    const { resolveExeSession: resolveExeSession2 } = await Promise.resolve().then(() => (init_tmux_routing(), tmux_routing_exports));
-    sessionScope = resolveExeSession2();
-  } catch {
-  }
+  const sessionScope = earlySessionScope;
   await client.execute({
     sql: `INSERT INTO tasks (id, title, assigned_to, assigned_by, project_name, priority, status, task_file, blocked_by, parent_task_id, reviewer, context, complexity, budget_tokens, budget_fallback_model, tokens_used, tokens_warned_at, session_scope, created_at, updated_at)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
@@ -1938,6 +2062,39 @@ async function createTaskCore(input) {
       now
     ]
   });
+  if (input.baseDir) {
+    try {
+      const EXE_OS_DIR = path8.join(os6.homedir(), ".exe-os");
+      const mdPath = path8.join(EXE_OS_DIR, taskFile);
+      const mdDir = path8.dirname(mdPath);
+      if (!existsSync8(mdDir)) await mkdir3(mdDir, { recursive: true });
+      const reviewer = input.reviewer ?? input.assignedBy;
+      const mdContent = `# ${input.title}
+
+**ID:** ${id}
+**Status:** ${initialStatus}
+**Priority:** ${input.priority}
+**Assigned by:** ${input.assignedBy}
+**Assigned to:** ${input.assignedTo}
+**Project:** ${input.projectName}
+**Created:** ${now.split("T")[0]}${parentTaskId ? `
+**Parent task:** ${parentTaskId}` : ""}
+**Reviewer:** ${reviewer}
+
+## Context
+
+${input.context}
+
+## MANDATORY: When done
+
+You MUST call update_task with status "done" and a result summary when finished.
+If you skip this, your reviewer will not know you're done and your work won't be reviewed.
+Do NOT let a failed commit or any error prevent you from calling update_task(done).
+`;
+      await writeFile3(mdPath, mdContent, "utf-8");
+    } catch {
+    }
+  }
   return {
     id,
     title: input.title,
@@ -2130,7 +2287,7 @@ ${input.result}` : `\u26A0\uFE0F ${warning}`;
           return { row, taskFile, now, taskId };
         }
       }
-      if (curStatus === "in_progress" && input.callerAgentId && (input.callerAgentId === assignedBy || input.callerAgentId === "exe")) {
+      if (curStatus === "in_progress" && input.callerAgentId && (input.callerAgentId === assignedBy || isCoordinatorName(input.callerAgentId))) {
         process.stderr.write(
           `[tasks] Assigner override: ${input.callerAgentId} reclaiming ${taskId}
 `
@@ -2242,12 +2399,22 @@ async function ensureGitignoreExe(baseDir) {
   } catch {
   }
 }
-var DELEGATION_KEYWORDS, TASK_ALREADY_CLAIMED_PREFIX;
+var LANE_KEYWORDS, KEYWORD_INDEX, DELEGATION_KEYWORDS, TASK_ALREADY_CLAIMED_PREFIX;
 var init_tasks_crud = __esm({
   "src/lib/tasks-crud.ts"() {
     "use strict";
     init_database();
     init_task_scope();
+    init_employees();
+    LANE_KEYWORDS = {
+      CMO: ["sales", "script", "pitch", "offer", "copy", "objection", "brand", "content", "seo", "marketing", "newsletter", "carousel", "social", "campaign"],
+      CTO: ["spec", "architecture", "migration", "schema", "database", "design doc", "adr", "security audit", "tech stack"],
+      "Principal Engineer": ["implement", "build", "fix", "commit", "refactor", "bug", "feature", "wire", "integration"],
+      "Staff Code Reviewer": ["critique", "verdict", "review", "audit", "code quality"],
+      "Content Production Specialist": ["render", "video", "image", "b-roll", "remotion", "animation", "thumbnail"],
+      "AI Product Lead": ["competitive", "analysis", "benchmark", "compare", "scout", "evaluate", "poc"]
+    };
+    KEYWORD_INDEX = buildKeywordIndex();
     DELEGATION_KEYWORDS = /parallel|delegate|wave|worktree|multi-instance/i;
     TASK_ALREADY_CLAIMED_PREFIX = "TASK_ALREADY_CLAIMED";
   }
@@ -2277,7 +2444,7 @@ async function countNewPendingReviewsSince(sinceIso, sessionScope) {
     const result3 = await client.execute({
       sql: `SELECT COUNT(*) as cnt FROM tasks
             WHERE status = 'needs_review' AND updated_at > ?
-              AND (session_scope = ? OR session_scope IS NULL)`,
+              AND session_scope = ?`,
       args: [sinceIso, sessionScope]
     });
     return Number(result3.rows[0]?.cnt) || 0;
@@ -2295,7 +2462,7 @@ async function listPendingReviews(limit, sessionScope) {
     const result3 = await client.execute({
       sql: `SELECT title, assigned_to, project_name FROM tasks
             WHERE status = 'needs_review'
-              AND (session_scope = ? OR session_scope IS NULL)
+              AND session_scope = ?
             ORDER BY priority ASC, created_at DESC LIMIT ?`,
       args: [sessionScope, limit]
     });
@@ -2416,14 +2583,14 @@ async function cleanupReviewFile(row, taskFile, _baseDir) {
       if (parts.length >= 3 && parts[0] === "review") {
         const agent = parts[1];
         const slug = parts.slice(2).join("-");
-        const originalTaskFile = `exe/${agent}/${slug}.md`;
+        const legacyTaskFile = `exe/${agent}/${slug}.md`;
         const result2 = await client.execute({
-          sql: "UPDATE tasks SET status = 'done', updated_at = ? WHERE task_file = ? AND status = 'needs_review'",
-          args: [now, originalTaskFile]
+          sql: "UPDATE tasks SET status = 'done', updated_at = ? WHERE (task_file = ? OR task_file LIKE ?) AND status = 'needs_review'",
+          args: [now, legacyTaskFile, `tasks/%/${agent}/${slug}.md`]
         });
         if (result2.rowsAffected > 0) {
           process.stderr.write(
-            `[review-cleanup] Cascaded original task to done (legacy path): ${originalTaskFile}
+            `[review-cleanup] Cascaded original task to done: ${agent}/${slug}.md
 `
           );
         }
@@ -2605,7 +2772,7 @@ function findSessionForProject(projectName) {
   const sessions = listSessions();
   for (const s of sessions) {
     const proj = s.projectDir.split("/").filter(Boolean).pop();
-    if (proj === projectName && (s.agentId === "exe" || isCoordinatorName(s.agentId))) return s;
+    if (proj === projectName && isCoordinatorName(s.agentId)) return s;
   }
   return null;
 }
@@ -2651,7 +2818,7 @@ var init_session_scope = __esm({
 
 // src/lib/tasks-notify.ts
 async function dispatchTaskToEmployee(input) {
-  if (input.assignedTo === "exe" || isCoordinatorName(input.assignedTo)) return { dispatched: "skipped" };
+  if (isCoordinatorName(input.assignedTo)) return { dispatched: "skipped" };
   let crossProject = false;
   if (input.projectName) {
     try {
@@ -3130,7 +3297,7 @@ async function updateTask(input) {
   }
   const isTerminal = input.status === "done" || input.status === "needs_review";
   if (isTerminal) {
-    const isCoordinator = String(row.assigned_to) === "exe" || isCoordinatorName(String(row.assigned_to));
+    const isCoordinator = isCoordinatorName(String(row.assigned_to));
     if (!isCoordinator) {
       notifyTaskDone();
     }
@@ -3155,7 +3322,7 @@ async function updateTask(input) {
       }
     }
   }
-  if (input.status === "done" && String(row.assigned_to) !== "exe" && !isCoordinatorName(String(row.assigned_to)) && !process.env.VITEST) {
+  if (input.status === "done" && !isCoordinatorName(String(row.assigned_to)) && !process.env.VITEST) {
     Promise.resolve().then(() => (init_skill_learning(), skill_learning_exports)).then(
       ({ captureAndLearn: captureAndLearn2 }) => captureAndLearn2({
         taskId,
@@ -3171,7 +3338,7 @@ async function updateTask(input) {
     });
   }
   let nextTask;
-  if (isTerminal && String(row.assigned_to) !== "exe" && !isCoordinatorName(String(row.assigned_to))) {
+  if (isTerminal && !isCoordinatorName(String(row.assigned_to))) {
     try {
       nextTask = await findNextTask(String(row.assigned_to));
     } catch {
@@ -3539,7 +3706,7 @@ __export(tmux_routing_exports, {
 import { execFileSync as execFileSync2, execSync as execSync6 } from "child_process";
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, existsSync as existsSync10, appendFileSync } from "fs";
 import path13 from "path";
-import os6 from "os";
+import os7 from "os";
 import { fileURLToPath } from "url";
 import { unlinkSync as unlinkSync5 } from "fs";
 function spawnLockPath(sessionName) {
@@ -3863,7 +4030,7 @@ function notifyParentExe(sessionKey) {
   return true;
 }
 function ensureEmployee(employeeName2, exeSession2, projectDir2, opts) {
-  if (employeeName2 === "exe" || isCoordinatorName(employeeName2)) {
+  if (isCoordinatorName(employeeName2)) {
     return { status: "failed", sessionName: "", error: "The COO is not a dispatchable employee" };
   }
   try {
@@ -3935,7 +4102,7 @@ function spawnEmployee(employeeName2, exeSession2, projectDir2, opts) {
   const transport = getTransport();
   const sessionName = employeeSessionName(employeeName2, exeSession2, opts?.instance);
   const instanceLabel = opts?.instance != null && opts.instance > 0 ? `${employeeName2}${opts.instance}` : employeeName2;
-  const logDir = path13.join(os6.homedir(), ".exe-os", "session-logs");
+  const logDir = path13.join(os7.homedir(), ".exe-os", "session-logs");
   const logFile = path13.join(logDir, `${instanceLabel}-${Date.now()}.log`);
   if (!existsSync10(logDir)) {
     mkdirSync5(logDir, { recursive: true });
@@ -3951,7 +4118,7 @@ function spawnEmployee(employeeName2, exeSession2, projectDir2, opts) {
   } catch {
   }
   try {
-    const claudeJsonPath = path13.join(os6.homedir(), ".claude.json");
+    const claudeJsonPath = path13.join(os7.homedir(), ".claude.json");
     let claudeJson = {};
     try {
       claudeJson = JSON.parse(readFileSync9(claudeJsonPath, "utf8"));
@@ -3966,7 +4133,7 @@ function spawnEmployee(employeeName2, exeSession2, projectDir2, opts) {
   } catch {
   }
   try {
-    const settingsDir = path13.join(os6.homedir(), ".claude", "projects");
+    const settingsDir = path13.join(os7.homedir(), ".claude", "projects");
     const normalizedKey = (opts?.cwd ?? projectDir2).replace(/\//g, "-").replace(/^-/, "");
     const projSettingsDir = path13.join(settingsDir, normalizedKey);
     const settingsPath = path13.join(projSettingsDir, "settings.json");
@@ -4014,7 +4181,7 @@ function spawnEmployee(employeeName2, exeSession2, projectDir2, opts) {
   let legacyFallbackWarned = false;
   if (!useExeAgent && !useBinSymlink) {
     const identityPath = path13.join(
-      os6.homedir(),
+      os7.homedir(),
       ".exe-os",
       "identity",
       `${employeeName2}.md`
@@ -4044,7 +4211,7 @@ function spawnEmployee(employeeName2, exeSession2, projectDir2, opts) {
   }
   let sessionContextFlag = "";
   try {
-    const ctxDir = path13.join(os6.homedir(), ".exe-os", "session-cache");
+    const ctxDir = path13.join(os7.homedir(), ".exe-os", "session-cache");
     mkdirSync5(ctxDir, { recursive: true });
     const ctxFile = path13.join(ctxDir, `session-context-${sessionName}.md`);
     const ctxContent = [
@@ -4156,13 +4323,13 @@ var init_tmux_routing = __esm({
     init_intercom_queue();
     init_plan_limits();
     init_employees();
-    SPAWN_LOCK_DIR = path13.join(os6.homedir(), ".exe-os", "spawn-locks");
-    SESSION_CACHE = path13.join(os6.homedir(), ".exe-os", "session-cache");
+    SPAWN_LOCK_DIR = path13.join(os7.homedir(), ".exe-os", "spawn-locks");
+    SESSION_CACHE = path13.join(os7.homedir(), ".exe-os", "session-cache");
     BEHAVIORS_EXPORT_TIMEOUT_MS = 1e4;
     VALID_SESSION_NAME = /^[a-z]+\d*-[a-zA-Z0-9_]+$/;
     VERIFY_PANE_LINES = 200;
     INTERCOM_DEBOUNCE_MS = 3e4;
-    INTERCOM_LOG2 = path13.join(os6.homedir(), ".exe-os", "intercom.log");
+    INTERCOM_LOG2 = path13.join(os7.homedir(), ".exe-os", "intercom.log");
     DEBOUNCE_FILE = path13.join(SESSION_CACHE, "intercom-debounce.json");
     DEBOUNCE_CLEANUP_AGE_MS = 5 * 60 * 1e3;
     BUSY_PATTERN = /[✻✽✶✳·].*…|Running…/;
@@ -4600,17 +4767,18 @@ init_tmux_routing();
 init_tasks_crud();
 
 // src/lib/store.ts
+import { createHash } from "crypto";
 init_database();
 
 // src/lib/keychain.ts
 import { readFile as readFile4, writeFile as writeFile5, unlink, mkdir as mkdir4, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
 import path14 from "path";
-import os7 from "os";
+import os8 from "os";
 var SERVICE = "exe-mem";
 var ACCOUNT = "master-key";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path14.join(os7.homedir(), ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path14.join(os8.homedir(), ".exe-os");
 }
 function getKeyPath() {
   return path14.join(getKeyDir(), "master.key");
@@ -4635,12 +4803,20 @@ async function getMasterKey() {
   }
   const keyPath = getKeyPath();
   if (!existsSync11(keyPath)) {
+    process.stderr.write(
+      `[keychain] Key not found at ${keyPath} (HOME=${os8.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
+`
+    );
     return null;
   }
   try {
     const content = await readFile4(keyPath, "utf-8");
     return Buffer.from(content.trim(), "base64");
-  } catch {
+  } catch (err) {
+    process.stderr.write(
+      `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
     return null;
   }
 }