@askexenow/exe-os 0.9.102 → 0.9.104

package/dist/bin/cli.js

@@ -4339,9 +4339,79 @@ __export(database_exports, {
   isInitialized: () => isInitialized,
   setExternalClient: () => setExternalClient
 });
-import { chmodSync as chmodSync3 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync13, statSync as statSync3, copyFileSync as copyFileSync2, unlinkSync as unlinkSync4, openSync as openSync2, closeSync as closeSync2, mkdirSync as mkdirSync6 } from "fs";
 import { createClient } from "@libsql/client";
+import { homedir } from "os";
+import { join } from "path";
+function logCatchDebug(context, err) {
+  if (_debugDb) {
+    process.stderr.write(
+      `[database] ${context}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+function acquireDbLock() {
+  mkdirSync6(join(homedir(), ".exe-os"), { recursive: true });
+  try {
+    _lockFd = openSync2(DB_LOCK_PATH, "wx");
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "EEXIST") {
+      try {
+        const lockStat = statSync3(DB_LOCK_PATH);
+        if (Date.now() - lockStat.mtimeMs > 6e4) {
+          unlinkSync4(DB_LOCK_PATH);
+          _lockFd = openSync2(DB_LOCK_PATH, "wx");
+          return;
+        }
+      } catch (e) {
+        logCatchDebug("stale lock check", e);
+      }
+      process.stderr.write(
+        "[database] WARN: Another process holds db.lock \u2014 waiting briefly then proceeding.\n"
+      );
+      return;
+    }
+    throw err;
+  }
+}
+function releaseDbLock() {
+  if (_lockFd !== null) {
+    try {
+      closeSync2(_lockFd);
+    } catch (e) {
+      logCatchDebug("lock close", e);
+    }
+    _lockFd = null;
+  }
+  try {
+    unlinkSync4(DB_LOCK_PATH);
+  } catch (e) {
+    logCatchDebug("lock unlink", e);
+  }
+}
 async function initDatabase(config) {
+  acquireDbLock();
+  if (existsSync13(config.dbPath)) {
+    const dbStat = statSync3(config.dbPath);
+    if (dbStat.size === 0) {
+      const walPath = config.dbPath + "-wal";
+      if (existsSync13(walPath) && statSync3(walPath).size > 0) {
+        const backupPath = config.dbPath + ".zeroed-" + Date.now();
+        copyFileSync2(config.dbPath, backupPath);
+        unlinkSync4(config.dbPath);
+        process.stderr.write(
+          `[database] CRITICAL: DB was 0 bytes. Moved to ${backupPath}, attempting WAL recovery.
+`
+        );
+      } else {
+        process.stderr.write(
+          `[database] CRITICAL: DB is 0 bytes and no WAL available for recovery. Data may be lost. Check backups at ${config.dbPath}.bak
+`
+        );
+      }
+    }
+  }
   if (_walCheckpointTimer) {
     clearInterval(_walCheckpointTimer);
     _walCheckpointTimer = null;
@@ -4368,10 +4438,8 @@ async function initDatabase(config) {
   _client = createClient(opts);
   _resilientClient = wrapWithRetry(_client);
   _adapterClient = _resilientClient;
-  _client.execute("PRAGMA busy_timeout = 30000").catch(() => {
-  });
-  _client.execute("PRAGMA journal_mode = WAL").catch(() => {
-  });
+  await _client.execute("PRAGMA busy_timeout = 30000");
+  await _client.execute("PRAGMA journal_mode = WAL");
   if (_walCheckpointTimer) clearInterval(_walCheckpointTimer);
   _walCheckpointTimer = setInterval(() => {
     _client?.execute("PRAGMA wal_checkpoint(PASSIVE)").catch(() => {
@@ -4386,11 +4454,16 @@ async function initDatabase(config) {
     for (const suffix of ["-wal", "-shm"]) {
       try {
         chmodSync3(config.dbPath + suffix, 384);
-      } catch {
+      } catch (chmodErr) {
+        process.stderr.write(`[database] chmod ${suffix} failed: ${chmodErr instanceof Error ? chmodErr.message : String(chmodErr)}
+`);
       }
     }
-  } catch {
+  } catch (chmodErr) {
+    process.stderr.write(`[database] chmod db failed: ${chmodErr instanceof Error ? chmodErr.message : String(chmodErr)}
+`);
   }
+  releaseDbLock();
 }
 function isInitialized() {
   return _adapterClient !== null || _client !== null;
@@ -4445,7 +4518,8 @@ async function ensureSchema() {
   await client.execute("PRAGMA wal_autocheckpoint = 1000");
   try {
     await client.execute("PRAGMA libsql_vector_search_ef = 128");
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS memories (
@@ -4510,6 +4584,23 @@ async function ensureSchema() {
       INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
     END;
   `);
+  try {
+    await client.execute("SELECT COUNT(*) FROM memories_fts LIMIT 1");
+  } catch (ftsErr) {
+    process.stderr.write(
+      `[database] WARN: memories_fts corrupted (${ftsErr instanceof Error ? ftsErr.message : String(ftsErr)}) \u2014 rebuilding FTS index.
+`
+    );
+    try {
+      await client.execute("INSERT INTO memories_fts(memories_fts) VALUES('rebuild')");
+      process.stderr.write("[database] FTS index rebuilt successfully.\n");
+    } catch (rebuildErr) {
+      process.stderr.write(
+        `[database] ERROR: FTS rebuild failed: ${rebuildErr instanceof Error ? rebuildErr.message : String(rebuildErr)}
+`
+      );
+    }
+  }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS sync_meta (
       key   TEXT PRIMARY KEY,
@@ -4568,35 +4659,40 @@ async function ensureSchema() {
         });
       }
     }
-  } catch {
+  } catch (seedErr) {
+    logCatchDebug("behavior seed", seedErr);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE behaviors ADD COLUMN priority TEXT DEFAULT 'p1'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE behaviors ADD COLUMN vector F32_BLOB(${EMBEDDING_DIM})`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN blocked_by TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN parent_task_id TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
@@ -4605,98 +4701,112 @@ async function ensureSchema() {
               WHERE parent_task_id IS NOT NULL`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `UPDATE tasks SET status = 'done' WHERE status = 'completed'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN reviewer TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN context TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN result TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN assigned_tmux TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN checkpoint TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN checkpoint_count INTEGER NOT NULL DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN complexity TEXT NOT NULL DEFAULT 'standard'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN session_scope TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN task_id TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN author_device_id TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS consolidations (
@@ -4801,14 +4911,16 @@ async function ensureSchema() {
       sql: `ALTER TABLE notifications ADD COLUMN session_scope TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE messages ADD COLUMN session_scope TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE INDEX IF NOT EXISTS idx_notifications_agent_scope_read
@@ -4834,7 +4946,8 @@ async function ensureSchema() {
       sql: `UPDATE tasks SET project_name = 'exe-os' WHERE project_name = 'worker'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS trajectories (
@@ -4858,7 +4971,8 @@ async function ensureSchema() {
   `);
   try {
     await client.execute("ALTER TABLE trajectories ADD COLUMN skill_id TEXT");
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS consolidations (
@@ -4895,63 +5009,72 @@ async function ensureSchema() {
       sql: `ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN deleted_at TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN confidence REAL DEFAULT 0.7`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN last_accessed TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `UPDATE memories SET last_accessed = timestamp WHERE last_accessed IS NULL`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN graph_extracted INTEGER DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   for (const col of [
     "ALTER TABLE memories ADD COLUMN content_hash TEXT",
@@ -4959,14 +5082,16 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_content_hash ON memories(content_hash, agent_id)`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute(
@@ -4974,7 +5099,8 @@ async function ensureSchema() {
          ON memories(content_hash, agent_id, project_name, memory_type)
          WHERE content_hash IS NOT NULL`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS entities (
@@ -5050,7 +5176,8 @@ async function ensureSchema() {
   `);
   try {
     await client.execute("INSERT INTO entities_fts(entities_fts) VALUES('rebuild')");
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS entity_aliases (
@@ -5065,14 +5192,16 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_status ON memories(status)`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS identity (
@@ -5171,7 +5300,8 @@ async function ensureSchema() {
         sql: `ALTER TABLE memories ADD COLUMN ${column}`,
         args: []
       });
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   for (const col of [
@@ -5180,7 +5310,8 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   await client.executeMultiple(`
@@ -5365,56 +5496,64 @@ async function ensureSchema() {
         args: []
       });
     }
-  } catch {
+  } catch (e) {
+    logCatchDebug("session_agent_map backfill", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE session_agent_map ADD COLUMN cache_cold_count INTEGER NOT NULL DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN budget_tokens INTEGER`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN budget_fallback_model TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN tokens_used INTEGER DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN tokens_warned_at INTEGER`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN spawn_runtime TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN spawn_model TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE VIRTUAL TABLE IF NOT EXISTS conversations_fts USING fts5(
@@ -5613,13 +5752,15 @@ async function ensureSchema() {
       sql: `ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_tier ON memories(tier)`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
@@ -5630,20 +5771,23 @@ async function ensureSchema() {
       sql: `UPDATE memories SET tier = 2 WHERE tool_name IN ('store_memory', 'manual') AND importance >= 5 AND tier = 3`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN supersedes_id TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_supersedes ON memories(supersedes_id) WHERE supersedes_id IS NOT NULL`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   for (const col of [
     "ALTER TABLE tasks ADD COLUMN checkpoint TEXT",
@@ -5651,7 +5795,8 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   try {
@@ -5659,13 +5804,15 @@ async function ensureSchema() {
       sql: `ALTER TABLE memories ADD COLUMN draft INTEGER DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_draft ON memories(draft) WHERE draft = 1`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   for (const col of [
     "ALTER TABLE memories ADD COLUMN valid_from TEXT",
@@ -5673,7 +5820,8 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   try {
@@ -5681,27 +5829,31 @@ async function ensureSchema() {
       sql: `UPDATE memories SET valid_from = timestamp WHERE valid_from IS NULL`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN memory_type TEXT DEFAULT 'raw'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_type ON memories(memory_type)`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN trajectory TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   for (const col of [
     "ALTER TABLE memories ADD COLUMN intent TEXT",
@@ -5722,7 +5874,8 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   try {
@@ -5730,14 +5883,16 @@ async function ensureSchema() {
       sql: `ALTER TABLE memories ADD COLUMN procedure_for TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `UPDATE tasks SET status = 'closed' WHERE status = 'done' AND result IS NOT NULL`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
 }
 async function disposeDatabase() {
@@ -5748,7 +5903,8 @@ async function disposeDatabase() {
   if (_client) {
     try {
       await _client.execute("PRAGMA wal_checkpoint(PASSIVE)");
-    } catch {
+    } catch (e) {
+      logCatchDebug("WAL checkpoint", e);
     }
   }
   if (_daemonClient) {
@@ -5764,8 +5920,9 @@ async function disposeDatabase() {
     _client = null;
     _resilientClient = null;
   }
+  releaseDbLock();
 }
-var _client, _resilientClient, _walCheckpointTimer, _daemonClient, _adapterClient, initTurso, SOFT_DELETE_RETENTION_DAYS, disposeTurso;
+var _debugDb, _client, _resilientClient, _walCheckpointTimer, _daemonClient, _adapterClient, _lockFd, DB_LOCK_PATH, initTurso, SOFT_DELETE_RETENTION_DAYS, disposeTurso;
 var init_database = __esm({
   "src/lib/database.ts"() {
     "use strict";
@@ -5773,11 +5930,14 @@ var init_database = __esm({
     init_employees();
     init_database_adapter();
     init_memory();
+    _debugDb = process.env.EXE_DEBUG === "1";
     _client = null;
     _resilientClient = null;
     _walCheckpointTimer = null;
     _daemonClient = null;
     _adapterClient = null;
+    _lockFd = null;
+    DB_LOCK_PATH = join(homedir(), ".exe-os", "db.lock");
     initTurso = initDatabase;
     SOFT_DELETE_RETENTION_DAYS = 7;
     disposeTurso = disposeDatabase;
@@ -5929,7 +6089,7 @@ __export(license_exports, {
   stopLicenseRevalidation: () => stopLicenseRevalidation,
   validateLicense: () => validateLicense
 });
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync8, existsSync as existsSync13, mkdirSync as mkdirSync6 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync8, existsSync as existsSync14, mkdirSync as mkdirSync7 } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
 import { createRequire as createRequire2 } from "module";
 import { pathToFileURL as pathToFileURL2 } from "url";
@@ -5947,34 +6107,34 @@ async function fetchRetry(url, init) {
 function loadDeviceId() {
   const deviceJsonPath = path13.join(EXE_AI_DIR, "device.json");
   try {
-    if (existsSync13(deviceJsonPath)) {
+    if (existsSync14(deviceJsonPath)) {
       const data = JSON.parse(readFileSync10(deviceJsonPath, "utf8"));
       if (data.deviceId) return data.deviceId;
     }
   } catch {
   }
   try {
-    if (existsSync13(DEVICE_ID_PATH)) {
+    if (existsSync14(DEVICE_ID_PATH)) {
       const id2 = readFileSync10(DEVICE_ID_PATH, "utf8").trim();
       if (id2) return id2;
     }
   } catch {
   }
   const id = randomUUID2();
-  mkdirSync6(EXE_AI_DIR, { recursive: true });
+  mkdirSync7(EXE_AI_DIR, { recursive: true });
   writeFileSync8(DEVICE_ID_PATH, id, "utf8");
   return id;
 }
 function loadLicense() {
   try {
-    if (!existsSync13(LICENSE_PATH)) return null;
+    if (!existsSync14(LICENSE_PATH)) return null;
     return readFileSync10(LICENSE_PATH, "utf8").trim();
   } catch {
     return null;
   }
 }
 function saveLicense(apiKey) {
-  mkdirSync6(EXE_AI_DIR, { recursive: true });
+  mkdirSync7(EXE_AI_DIR, { recursive: true });
   writeFileSync8(LICENSE_PATH, apiKey.trim(), { encoding: "utf8", mode: 384 });
 }
 async function verifyLicenseJwt(token) {
@@ -6001,7 +6161,7 @@ async function verifyLicenseJwt(token) {
 }
 async function getCachedLicense() {
   try {
-    if (!existsSync13(CACHE_PATH)) return null;
+    if (!existsSync14(CACHE_PATH)) return null;
     const raw = JSON.parse(readFileSync10(CACHE_PATH, "utf8"));
     if (!raw.token || typeof raw.token !== "string") return null;
     return await verifyLicenseJwt(raw.token);
@@ -6011,7 +6171,7 @@ async function getCachedLicense() {
 }
 function readCachedLicenseToken() {
   try {
-    if (!existsSync13(CACHE_PATH)) return null;
+    if (!existsSync14(CACHE_PATH)) return null;
     const raw = JSON.parse(readFileSync10(CACHE_PATH, "utf8"));
     return typeof raw.token === "string" ? raw.token : null;
   } catch {
@@ -6055,7 +6215,7 @@ function loadPrismaForLicense() {
   const dbUrl = process.env.DATABASE_URL;
   if (!dbUrl) {
     const exeDbRoot = process.env.EXE_DB_ROOT ?? path13.join(os11.homedir(), "exe-db");
-    if (!existsSync13(path13.join(exeDbRoot, "package.json"))) {
+    if (!existsSync14(path13.join(exeDbRoot, "package.json"))) {
       _prismaFailed = true;
       return null;
     }
@@ -6159,7 +6319,7 @@ async function validateLicense(apiKey, deviceId) {
   const cached = await getCachedLicense();
   if (cached) return cached;
   try {
-    if (existsSync13(CACHE_PATH)) {
+    if (existsSync14(CACHE_PATH)) {
       const raw = JSON.parse(readFileSync10(CACHE_PATH, "utf8"));
       if (raw.pgLicense && raw.ts && Date.now() - raw.ts < 7 * 24 * 60 * 60 * 1e3) {
         return raw.pgLicense;
@@ -6173,8 +6333,8 @@ async function validateLicense(apiKey, deviceId) {
 }
 function getCacheAgeMs() {
   try {
-    const { statSync: statSync9 } = __require("fs");
-    const s = statSync9(CACHE_PATH);
+    const { statSync: statSync10 } = __require("fs");
+    const s = statSync10(CACHE_PATH);
     return Date.now() - s.mtimeMs;
   } catch {
     return Infinity;
@@ -6185,7 +6345,7 @@ async function checkLicense() {
   if (!key) {
     try {
       const configPath = path13.join(EXE_AI_DIR, "config.json");
-      if (existsSync13(configPath)) {
+      if (existsSync14(configPath)) {
         const raw = JSON.parse(readFileSync10(configPath, "utf8"));
         const cloud = raw.cloud;
         if (cloud?.apiKey) {
@@ -6397,9 +6557,9 @@ __export(crdt_sync_exports, {
   rebuildFromDb: () => rebuildFromDb
 });
 import * as Y from "yjs";
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync9, existsSync as existsSync14, mkdirSync as mkdirSync7, unlinkSync as unlinkSync4 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync9, existsSync as existsSync15, mkdirSync as mkdirSync8, unlinkSync as unlinkSync5 } from "fs";
 import path14 from "path";
-import { homedir } from "os";
+import { homedir as homedir2 } from "os";
 function getStatePath() {
   return _statePathOverride ?? DEFAULT_STATE_PATH;
 }
@@ -6410,14 +6570,14 @@ function initCrdtDoc() {
   if (doc) return doc;
   doc = new Y.Doc();
   const sp = getStatePath();
-  if (existsSync14(sp)) {
+  if (existsSync15(sp)) {
     try {
       const state = readFileSync11(sp);
       Y.applyUpdate(doc, new Uint8Array(state));
     } catch {
       console.warn("[crdt-sync] WARN: corrupted state file, rebuilding from DB");
       try {
-        unlinkSync4(sp);
+        unlinkSync5(sp);
       } catch {
       }
       rebuildFromDb().catch((err) => {
@@ -6555,7 +6715,7 @@ function persistState() {
   try {
     const sp = getStatePath();
     const dir = path14.dirname(sp);
-    if (!existsSync14(dir)) mkdirSync7(dir, { recursive: true });
+    if (!existsSync15(dir)) mkdirSync8(dir, { recursive: true });
     const state = Y.encodeStateAsUpdate(doc);
     writeFileSync9(sp, Buffer.from(state));
   } catch {
@@ -6598,7 +6758,7 @@ var DEFAULT_STATE_PATH, _statePathOverride, doc;
 var init_crdt_sync = __esm({
   "src/lib/crdt-sync.ts"() {
     "use strict";
-    DEFAULT_STATE_PATH = path14.join(homedir(), ".exe-os", "crdt-state.bin");
+    DEFAULT_STATE_PATH = path14.join(homedir2(), ".exe-os", "crdt-state.bin");
     _statePathOverride = null;
     doc = null;
   }
@@ -6630,42 +6790,42 @@ __export(db_backup_exports, {
   listBackups: () => listBackups,
   rotateBackups: () => rotateBackups
 });
-import { copyFileSync as copyFileSync2, existsSync as existsSync15, mkdirSync as mkdirSync8, readdirSync, unlinkSync as unlinkSync5, statSync as statSync3 } from "fs";
+import { copyFileSync as copyFileSync3, existsSync as existsSync16, mkdirSync as mkdirSync9, readdirSync, unlinkSync as unlinkSync6, statSync as statSync4 } from "fs";
 import path15 from "path";
 function findActiveDb() {
   for (const name of DB_NAMES) {
     const p = path15.join(EXE_AI_DIR, name);
-    if (existsSync15(p)) return p;
+    if (existsSync16(p)) return p;
   }
   return null;
 }
 function createBackup(reason = "manual") {
   const dbPath = findActiveDb();
   if (!dbPath) return null;
-  mkdirSync8(BACKUP_DIR, { recursive: true });
+  mkdirSync9(BACKUP_DIR, { recursive: true });
   const dbName = path15.basename(dbPath, ".db");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const backupName = `${dbName}-${reason}-${timestamp}.db`;
   const backupPath = path15.join(BACKUP_DIR, backupName);
-  copyFileSync2(dbPath, backupPath);
+  copyFileSync3(dbPath, backupPath);
   const walPath = dbPath + "-wal";
-  if (existsSync15(walPath)) {
+  if (existsSync16(walPath)) {
     try {
-      copyFileSync2(walPath, backupPath + "-wal");
+      copyFileSync3(walPath, backupPath + "-wal");
     } catch {
     }
   }
   const shmPath = dbPath + "-shm";
-  if (existsSync15(shmPath)) {
+  if (existsSync16(shmPath)) {
     try {
-      copyFileSync2(shmPath, backupPath + "-shm");
+      copyFileSync3(shmPath, backupPath + "-shm");
     } catch {
     }
   }
   return backupPath;
 }
 function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
-  if (!existsSync15(BACKUP_DIR)) return 0;
+  if (!existsSync16(BACKUP_DIR)) return 0;
   const cutoff = Date.now() - keepDays * 24 * 60 * 60 * 1e3;
   let deleted = 0;
   try {
@@ -6674,9 +6834,9 @@ function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
       if (!file.endsWith(".db") && !file.endsWith(".db-wal") && !file.endsWith(".db-shm")) continue;
       const filePath = path15.join(BACKUP_DIR, file);
       try {
-        const stat2 = statSync3(filePath);
+        const stat2 = statSync4(filePath);
         if (stat2.mtimeMs < cutoff) {
-          unlinkSync5(filePath);
+          unlinkSync6(filePath);
           deleted++;
         }
       } catch {
@@ -6687,12 +6847,12 @@ function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
   return deleted;
 }
 function listBackups() {
-  if (!existsSync15(BACKUP_DIR)) return [];
+  if (!existsSync16(BACKUP_DIR)) return [];
   try {
     const files = readdirSync(BACKUP_DIR).filter((f) => f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm"));
     return files.map((name) => {
       const p = path15.join(BACKUP_DIR, name);
-      const stat2 = statSync3(p);
+      const stat2 = statSync4(p);
       return { path: p, name, size: stat2.size, date: stat2.mtime };
     }).sort((a, b) => b.date.getTime() - a.date.getTime());
   } catch {
@@ -6758,16 +6918,16 @@ __export(cloud_sync_exports, {
   pushToPostgres: () => pushToPostgres,
   recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync10, existsSync as existsSync16, readdirSync as readdirSync2, mkdirSync as mkdirSync9, appendFileSync, unlinkSync as unlinkSync6, openSync as openSync2, closeSync as closeSync2, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync10, existsSync as existsSync17, readdirSync as readdirSync2, mkdirSync as mkdirSync10, appendFileSync, unlinkSync as unlinkSync7, openSync as openSync3, closeSync as closeSync3, statSync as statSync5 } from "fs";
 import crypto4 from "crypto";
 import path16 from "path";
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 function sqlSafe(v) {
   return v === void 0 ? null : v;
 }
 function logError(msg) {
   try {
-    const logPath = path16.join(homedir2(), ".exe-os", "workers.log");
+    const logPath = path16.join(homedir3(), ".exe-os", "workers.log");
     appendFileSync(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
@@ -6782,7 +6942,7 @@ function loadPgClient() {
   let cloudPostgresUrl;
   let configEnabled = false;
   try {
-    if (existsSync16(configPath)) {
+    if (existsSync17(configPath)) {
       const cfg = JSON.parse(readFileSync12(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
       configEnabled = cfg.cloud?.syncToPostgres === true;
@@ -6810,9 +6970,9 @@ function loadPgClient() {
         if (!Ctor) throw new Error(`No PrismaClient at ${explicitPath}`);
         return new Ctor();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path16.join(homedir2(), "exe-db");
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path16.join(homedir3(), "exe-db");
       const packagePath = path16.join(exeDbRoot, "package.json");
-      if (existsSync16(packagePath)) {
+      if (existsSync17(packagePath)) {
         const req = createRequire3(packagePath);
         const entry = req.resolve("@prisma/client");
         const mod = await import(pathToFileURL3(entry).href);
@@ -6873,8 +7033,8 @@ async function pushToPostgres(records) {
 }
 async function withRosterLock(fn) {
   try {
-    const fd = openSync2(ROSTER_LOCK_PATH, "wx");
-    closeSync2(fd);
+    const fd = openSync3(ROSTER_LOCK_PATH, "wx");
+    closeSync3(fd);
     writeFileSync10(ROSTER_LOCK_PATH, String(Date.now()));
   } catch (err) {
     if (err.code === "EEXIST") {
@@ -6883,9 +7043,9 @@ async function withRosterLock(fn) {
         if (Date.now() - ts2 < LOCK_STALE_MS) {
           throw new Error("Roster merge already in progress \u2014 another sync is running");
         }
-        unlinkSync6(ROSTER_LOCK_PATH);
-        const fd = openSync2(ROSTER_LOCK_PATH, "wx");
-        closeSync2(fd);
+        unlinkSync7(ROSTER_LOCK_PATH);
+        const fd = openSync3(ROSTER_LOCK_PATH, "wx");
+        closeSync3(fd);
         writeFileSync10(ROSTER_LOCK_PATH, String(Date.now()));
       } catch (retryErr) {
         if (retryErr instanceof Error && retryErr.message.includes("already in progress")) throw retryErr;
@@ -6899,7 +7059,7 @@ async function withRosterLock(fn) {
     return await fn();
   } finally {
     try {
-      unlinkSync6(ROSTER_LOCK_PATH);
+      unlinkSync7(ROSTER_LOCK_PATH);
     } catch {
     }
   }
@@ -7333,7 +7493,7 @@ async function cloudSync(config) {
     const employees = await loadEmployees();
     rosterResult.employees = employees.length;
     const idDir = path16.join(EXE_AI_DIR, "identity");
-    if (existsSync16(idDir)) {
+    if (existsSync17(idDir)) {
       rosterResult.identities = readdirSync2(idDir).filter((f) => f.endsWith(".md")).length;
     }
   } catch {
@@ -7343,7 +7503,7 @@ async function cloudSync(config) {
     const { getLatestBackup: getLatestBackup2 } = await Promise.resolve().then(() => (init_db_backup(), db_backup_exports));
     const latestBackup = getLatestBackup2();
     if (latestBackup) {
-      const backupSize = statSync4(latestBackup).size;
+      const backupSize = statSync5(latestBackup).size;
       const MAX_CLOUD_BACKUP_BYTES = 50 * 1024 * 1024;
       if (backupSize <= MAX_CLOUD_BACKUP_BYTES) {
         const backupData = readFileSync12(latestBackup);
@@ -7394,7 +7554,7 @@ async function cloudSync(config) {
 function recordRosterDeletion(name) {
   let deletions = [];
   try {
-    if (existsSync16(ROSTER_DELETIONS_PATH)) {
+    if (existsSync17(ROSTER_DELETIONS_PATH)) {
       deletions = JSON.parse(readFileSync12(ROSTER_DELETIONS_PATH, "utf-8"));
     }
   } catch {
@@ -7404,7 +7564,7 @@ function recordRosterDeletion(name) {
 }
 function consumeRosterDeletions() {
   try {
-    if (!existsSync16(ROSTER_DELETIONS_PATH)) return [];
+    if (!existsSync17(ROSTER_DELETIONS_PATH)) return [];
     const deletions = JSON.parse(readFileSync12(ROSTER_DELETIONS_PATH, "utf-8"));
     writeFileSync10(ROSTER_DELETIONS_PATH, "[]");
     return deletions;
@@ -7417,14 +7577,14 @@ function buildRosterBlob(paths) {
   const identityDir = paths?.identityDir ?? path16.join(EXE_AI_DIR, "identity");
   const configPath = paths?.configPath ?? path16.join(EXE_AI_DIR, "config.json");
   let roster = [];
-  if (existsSync16(rosterPath)) {
+  if (existsSync17(rosterPath)) {
     try {
       roster = JSON.parse(readFileSync12(rosterPath, "utf-8"));
     } catch {
     }
   }
   const identities = {};
-  if (existsSync16(identityDir)) {
+  if (existsSync17(identityDir)) {
     for (const file of readdirSync2(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
         identities[file] = readFileSync12(path16.join(identityDir, file), "utf-8");
@@ -7433,7 +7593,7 @@ function buildRosterBlob(paths) {
     }
   }
   let config;
-  if (existsSync16(configPath)) {
+  if (existsSync17(configPath)) {
     try {
       config = JSON.parse(readFileSync12(configPath, "utf-8"));
     } catch {
@@ -7441,7 +7601,7 @@ function buildRosterBlob(paths) {
   }
   let agentConfig;
   const agentConfigPath = path16.join(EXE_AI_DIR, "agent-config.json");
-  if (existsSync16(agentConfigPath)) {
+  if (existsSync17(agentConfigPath)) {
     try {
       agentConfig = JSON.parse(readFileSync12(agentConfigPath, "utf-8"));
     } catch {
@@ -7521,7 +7681,7 @@ async function cloudPullRoster(config) {
 function mergeConfig(remoteConfig, configPath) {
   const cfgPath = configPath ?? path16.join(EXE_AI_DIR, "config.json");
   let local = {};
-  if (existsSync16(cfgPath)) {
+  if (existsSync17(cfgPath)) {
     try {
       local = JSON.parse(readFileSync12(cfgPath, "utf-8"));
     } catch {
@@ -7557,11 +7717,11 @@ async function mergeRosterFromRemote(remote, paths) {
       ) ?? lookupKey;
       const remoteIdentity = remote.identities[matchedKey];
       if (remoteIdentity) {
-        if (!existsSync16(identityDir)) mkdirSync9(identityDir, { recursive: true });
+        if (!existsSync17(identityDir)) mkdirSync10(identityDir, { recursive: true });
         const idPath = path16.join(identityDir, `${remoteEmp.name}.md`);
         let localIdentity = null;
         try {
-          localIdentity = existsSync16(idPath) ? readFileSync12(idPath, "utf-8") : null;
+          localIdentity = existsSync17(idPath) ? readFileSync12(idPath, "utf-8") : null;
         } catch {
         }
         if (localIdentity !== remoteIdentity) {
@@ -7593,7 +7753,7 @@ async function mergeRosterFromRemote(remote, paths) {
       try {
         const agentConfigPath = path16.join(EXE_AI_DIR, "agent-config.json");
         let local = {};
-        if (existsSync16(agentConfigPath)) {
+        if (existsSync17(agentConfigPath)) {
           try {
             local = JSON.parse(readFileSync12(agentConfigPath, "utf-8"));
           } catch {
@@ -8028,14 +8188,14 @@ async function cloudPullDocuments(config) {
 }
 async function cloudPushCodeContext(config) {
   assertSecureEndpoint(config.endpoint);
-  if (!existsSync16(CODE_CONTEXT_DIR)) return 0;
+  if (!existsSync17(CODE_CONTEXT_DIR)) return 0;
   const files = readdirSync2(CODE_CONTEXT_DIR).filter(
     (f) => f.endsWith(".json") && !f.endsWith(".vectors.json") && !f.startsWith(".")
   );
   if (files.length === 0) return 0;
   const metaPath = path16.join(CODE_CONTEXT_DIR, ".sync-meta.json");
   let syncMeta = {};
-  if (existsSync16(metaPath)) {
+  if (existsSync17(metaPath)) {
     try {
       syncMeta = JSON.parse(readFileSync12(metaPath, "utf-8"));
     } catch {
@@ -8045,7 +8205,7 @@ async function cloudPushCodeContext(config) {
   for (const file of files) {
     const filePath = path16.join(CODE_CONTEXT_DIR, file);
     try {
-      const stat2 = statSync4(filePath);
+      const stat2 = statSync5(filePath);
       const lastPushed = syncMeta[file] ?? 0;
       if (stat2.mtimeMs <= lastPushed) continue;
       const content = readFileSync12(filePath, "utf-8");
@@ -8090,7 +8250,7 @@ async function cloudPullCodeContext(config) {
     if (!resp.ok) return 0;
     const data = await resp.json();
     if (!data.indexes || data.indexes.length === 0) return 0;
-    mkdirSync9(CODE_CONTEXT_DIR, { recursive: true });
+    mkdirSync10(CODE_CONTEXT_DIR, { recursive: true });
     let pulled = 0;
     for (const { key, blob } of data.indexes) {
       try {
@@ -8098,7 +8258,7 @@ async function cloudPullCodeContext(config) {
         const localPath = path16.join(CODE_CONTEXT_DIR, key);
         const compressed = decryptSyncBlob(blob);
         const content = decompress(compressed).toString("utf8");
-        if (!existsSync16(localPath)) {
+        if (!existsSync17(localPath)) {
           writeFileSync10(localPath, content, "utf-8");
           pulled++;
         } else {
@@ -8408,18 +8568,54 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path17 from "path";
-import { existsSync as existsSync17, mkdirSync as mkdirSync10, readdirSync as readdirSync3, renameSync as renameSync3, statSync as statSync5 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync11, readdirSync as readdirSync3, renameSync as renameSync3, statSync as statSync6 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
-  if (!existsSync17(SHARDS_DIR)) {
-    mkdirSync10(SHARDS_DIR, { recursive: true });
+  _keyValidated = false;
+  _keyValidationPromise = null;
+  if (!existsSync18(SHARDS_DIR)) {
+    mkdirSync11(SHARDS_DIR, { recursive: true });
+  }
+  const existingShards = readdirSync3(SHARDS_DIR).filter((f) => f.endsWith(".db"));
+  if (existingShards.length === 0) {
+    _keyValidated = true;
   }
   _shardingEnabled = true;
   if (_evictionTimer) clearInterval(_evictionTimer);
   _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
   _evictionTimer.unref();
 }
+async function validateEncryptionKey() {
+  if (_keyValidated) return true;
+  if (!_encryptionKey) return false;
+  const existingShards = readdirSync3(SHARDS_DIR).filter((f) => f.endsWith(".db"));
+  if (existingShards.length === 0) {
+    _keyValidated = true;
+    return true;
+  }
+  for (const shardFile of existingShards.slice(0, 3)) {
+    const dbPath = path17.join(SHARDS_DIR, shardFile);
+    const testClient = createClient2({ url: `file:${dbPath}`, encryptionKey: _encryptionKey });
+    try {
+      await testClient.execute("SELECT COUNT(*) FROM sqlite_schema");
+      testClient.close();
+      _keyValidated = true;
+      return true;
+    } catch {
+      try {
+        testClient.close();
+      } catch {
+      }
+    }
+  }
+  process.stderr.write(
+    `[shard-manager] WARNING: encryption key cannot read any existing shards (${existingShards.length} found). New shard creation disabled to prevent stranded files. Run /exe-doctor to audit.
+`
+  );
+  _shardingEnabled = false;
+  return false;
+}
 function isShardingEnabled() {
   return _shardingEnabled;
 }
@@ -8453,13 +8649,13 @@ function getShardClient(projectName) {
 }
 function shardExists(projectName) {
   const safeName = safeShardName(projectName);
-  return existsSync17(path17.join(SHARDS_DIR, `${safeName}.db`));
+  return existsSync18(path17.join(SHARDS_DIR, `${safeName}.db`));
 }
 function safeShardName(projectName) {
   return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function listShards() {
-  if (!existsSync17(SHARDS_DIR)) return [];
+  if (!existsSync18(SHARDS_DIR)) return [];
   return readdirSync3(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function auditShardHealth(options = {}) {
@@ -8472,7 +8668,7 @@ async function auditShardHealth(options = {}) {
   const shards = [];
   for (const name of names) {
     const dbPath = path17.join(SHARDS_DIR, `${name}.db`);
-    const stat2 = statSync5(dbPath);
+    const stat2 = statSync6(dbPath);
     const item = {
       name,
       path: dbPath,
@@ -8712,6 +8908,17 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
+  if (!_keyValidated) {
+    if (!_keyValidationPromise) {
+      _keyValidationPromise = validateEncryptionKey();
+    }
+    const valid = await _keyValidationPromise;
+    if (!valid) {
+      throw new Error(
+        `Shard creation blocked: encryption key mismatch with existing shards. Run /exe-doctor to audit.`
+      );
+    }
+  }
   const safeName = safeShardName(projectName);
   let client = getShardClient(projectName);
   try {
@@ -8724,8 +8931,8 @@ async function getReadyShardClient(projectName) {
     _shards.delete(safeName);
     _shardLastAccess.delete(safeName);
     const dbPath = path17.join(SHARDS_DIR, `${safeName}.db`);
-    if (existsSync17(dbPath)) {
-      const stat2 = statSync5(dbPath);
+    if (existsSync18(dbPath)) {
+      const stat2 = statSync6(dbPath);
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
       const archivedPath = path17.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
       renameSync3(dbPath, archivedPath);
@@ -8790,7 +8997,7 @@ function disposeShards() {
   _shardingEnabled = false;
   _encryptionKey = null;
 }
-var SHARDS_DIR, SHARD_IDLE_MS, MAX_OPEN_SHARDS, EVICTION_INTERVAL_MS, _shards, _shardLastAccess, _evictionTimer, _encryptionKey, _shardingEnabled;
+var SHARDS_DIR, SHARD_IDLE_MS, MAX_OPEN_SHARDS, EVICTION_INTERVAL_MS, _shards, _shardLastAccess, _evictionTimer, _encryptionKey, _shardingEnabled, _keyValidated, _keyValidationPromise;
 var init_shard_manager = __esm({
   "src/lib/shard-manager.ts"() {
     "use strict";
@@ -8804,6 +9011,8 @@ var init_shard_manager = __esm({
     _evictionTimer = null;
     _encryptionKey = null;
     _shardingEnabled = false;
+    _keyValidated = false;
+    _keyValidationPromise = null;
   }
 });
 
@@ -8999,6 +9208,18 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "create_task is dispatch + delivery. Task lifecycle: open \u2192 in_progress (you start) \u2192 done (update_task when finished) \u2192 needs_review (reviewer nudged) \u2192 closed (COO only via close_task). DB is the reliable delivery \u2014 intercom is just a speedup nudge. If you finish a task, self-chain: check for next task immediately (step 7). Never wait for a nudge. Never say 'standing by.'"
       },
+      {
+        title: "Review chain \u2014 managers must actively pull completed work, never wait for nudges",
+        domain: "workflow",
+        priority: "p0",
+        content: "When you dispatch work, you OWN the review. Check list_tasks(status='needs_review') on EVERY prompt \u2014 don't wait for intercom nudges (they're unreliable). When a task shows needs_review: (1) read the deliverable (git diff in worktree, exe/output/ files, or task result summary), (2) verify it works (tsc, build, run), (3) close_task if good or create a fix task if not. Reviews sitting >30 minutes is a pipeline stall. The whole chain: worker calls update_task(done) \u2192 system flags needs_review \u2192 manager pulls and verifies \u2192 close_task \u2192 COO reviews manager's work \u2192 merge to main. Every level actively pulls \u2014 nobody waits."
+      },
+      {
+        title: "Bug fix lifecycle \u2014 triage upstream after every verified fix so customers see the status",
+        domain: "workflow",
+        priority: "p0",
+        content: "When a bug from support(action='list_bugs') is fixed and verified, the reviewer MUST triage it upstream: support(action='triage_bug', id='<bug-id>', notes='<what was fixed>', fixed_version='<version>', linked_commit='<hash>'). This closes the bug in the customer's view \u2014 their COO checks list_my_bugs and sees status change from open \u2192 closed with the fix version. Without triage, customers see 'open' forever even after the fix ships. Same for feature requests: support(action='triage_feature', ..., shipped_version='<version>'). Triage is part of the review gate \u2014 a fix is not done until the upstream report is closed."
+      },
       {
         title: "Intercom is a speedup, not delivery \u2014 DB is the source of truth",
         domain: "architecture",
@@ -9596,6 +9817,20 @@ __export(store_exports, {
   vectorToBlob: () => vectorToBlob,
   writeMemory: () => writeMemory
 });
+function logStoreDebug(context, err) {
+  if (_debugStore) {
+    process.stderr.write(
+      `[store] ${context}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+function logStoreWarn(context, err) {
+  process.stderr.write(
+    `[store] WARN ${context}: ${err instanceof Error ? err.message : String(err)}
+`
+  );
+}
 function isBusyError2(err) {
   if (err instanceof Error) {
     const msg = err.message.toLowerCase();
@@ -9650,13 +9885,15 @@ async function initStore(options) {
   try {
     const { initDaemonClient: initDaemonClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await initDaemonClient2();
-  } catch {
+  } catch (e) {
+    logStoreWarn("catch", e);
   }
   if (!options?.lightweight) {
     try {
       const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
       initShardManager2(hexKey);
-    } catch {
+    } catch (e) {
+      logStoreWarn("catch", e);
     }
     const client = getClient();
     const vResult = await retryOnBusy2(
@@ -9667,7 +9904,8 @@ async function initStore(options) {
     try {
       const { loadGlobalProcedures: loadGlobalProcedures2 } = await Promise.resolve().then(() => (init_global_procedures(), global_procedures_exports));
       await loadGlobalProcedures2();
-    } catch {
+    } catch (e) {
+      logStoreWarn("catch", e);
     }
   }
 }
@@ -9727,7 +9965,8 @@ async function writeMemory(record) {
       memoryType
     });
     if (existing) return;
-  } catch {
+  } catch (e) {
+    logStoreWarn("catch", e);
   }
   const dbRow = {
     id: record.id,
@@ -9928,12 +10167,14 @@ async function flushBatch() {
     try {
       const { insertMemoryCardsForBatch: insertMemoryCardsForBatch2 } = await Promise.resolve().then(() => (init_memory_cards(), memory_cards_exports));
       await insertMemoryCardsForBatch2(batch);
-    } catch {
+    } catch (e) {
+      logStoreWarn("catch", e);
     }
     try {
       const { insertOntologyForBatch: insertOntologyForBatch2 } = await Promise.resolve().then(() => (init_agentic_ontology(), agentic_ontology_exports));
       await insertOntologyForBatch2(batch);
-    } catch {
+    } catch (e) {
+      logStoreWarn("catch", e);
     }
     schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
     _pendingRecords.splice(0, batch.length);
@@ -9972,7 +10213,8 @@ ${err.stack.split("\n").slice(1, 3).join("\n")}` : ""}` : String(err);
           }
         }
       }
-    } catch {
+    } catch (e) {
+      logStoreWarn("catch", e);
     }
     return batch.length;
   } finally {
@@ -10014,7 +10256,8 @@ async function searchMemories(queryVector, agentId, options) {
     } else {
       client = getClient();
     }
-  } catch {
+  } catch (e) {
+    logStoreDebug("shard routing fallback", e);
     client = getClient();
   }
   const limit = options?.limit ?? 10;
@@ -10130,7 +10373,8 @@ async function attachDocumentMetadata(records) {
       if (!record.document_id) continue;
       record.document_metadata = byId.get(record.document_id) ?? null;
     }
-  } catch {
+  } catch (e) {
+    logStoreWarn("catch", e);
   }
   return records;
 }
@@ -10191,11 +10435,12 @@ async function getMemoryCardinality(agentId) {
       args: [agentId]
     });
     return Number(result.rows[0]?.cnt) || 0;
-  } catch {
+  } catch (e) {
+    logStoreWarn("getMemoryCardinality", e);
     return 0;
   }
 }
-var INIT_MAX_RETRIES, INIT_RETRY_DELAY_MS, _pendingRecords, _batchSize, _flushIntervalMs, _flushTimer, _flushing, _nextVersion;
+var _debugStore, INIT_MAX_RETRIES, INIT_RETRY_DELAY_MS, _pendingRecords, _batchSize, _flushIntervalMs, _flushTimer, _flushing, _nextVersion;
 var init_store = __esm({
   "src/lib/store.ts"() {
     "use strict";
@@ -10205,6 +10450,7 @@ var init_store = __esm({
     init_config();
     init_state_bus();
     init_memory_write_governor();
+    _debugStore = process.env.EXE_DEBUG === "1";
     INIT_MAX_RETRIES = 3;
     INIT_RETRY_DELAY_MS = 1e3;
     _pendingRecords = [];
@@ -10223,14 +10469,14 @@ __export(key_backup_status_exports, {
   keyBackupMarkerPath: () => keyBackupMarkerPath,
   markKeyBackupConfirmed: () => markKeyBackupConfirmed
 });
-import { existsSync as existsSync18, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync12, readFileSync as readFileSync13, writeFileSync as writeFileSync11 } from "fs";
 import path18 from "path";
 function keyBackupMarkerPath() {
   return path18.join(EXE_AI_DIR, "key-backup-confirmed.json");
 }
 function getKeyBackupStatus() {
   const marker = keyBackupMarkerPath();
-  if (!existsSync18(marker)) return { exists: false };
+  if (!existsSync19(marker)) return { exists: false };
   try {
     const parsed = JSON.parse(readFileSync13(marker, "utf8"));
     return {
@@ -10243,7 +10489,7 @@ function getKeyBackupStatus() {
   }
 }
 function markKeyBackupConfirmed(source) {
-  mkdirSync11(EXE_AI_DIR, { recursive: true, mode: 448 });
+  mkdirSync12(EXE_AI_DIR, { recursive: true, mode: 448 });
   writeFileSync11(
     keyBackupMarkerPath(),
     JSON.stringify({ confirmedAt: (/* @__PURE__ */ new Date()).toISOString(), source }, null, 2) + "\n",
@@ -10709,7 +10955,7 @@ __export(exe_key_exports, {
 });
 import crypto5 from "crypto";
 import { createInterface as createInterface2 } from "readline";
-import { existsSync as existsSync19, statSync as statSync6, mkdirSync as mkdirSync12, copyFileSync as copyFileSync3, renameSync as renameSync4, rmSync, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync20, statSync as statSync7, mkdirSync as mkdirSync13, copyFileSync as copyFileSync4, renameSync as renameSync4, rmSync, writeFileSync as writeFileSync12 } from "fs";
 import path19 from "path";
 import os12 from "os";
 import { execSync as execSync5 } from "child_process";
@@ -10742,7 +10988,7 @@ function dbSidecarPaths(dbPath) {
 }
 function daemonStatus() {
   const pidPath = path19.join(dataDir(), "exed.pid");
-  if (!existsSync19(pidPath)) return { pid: null, alive: false };
+  if (!existsSync20(pidPath)) return { pid: null, alive: false };
   const pid = execSync5(`cat ${JSON.stringify(pidPath)}`, { encoding: "utf8" }).trim();
   if (!pid) return { pid: null, alive: false };
   try {
@@ -10801,8 +11047,8 @@ async function preflight() {
   console.log("\u2713 Memory encryption key found");
   const config = await loadConfig();
   const dbPath = expandHome(config.dbPath);
-  if (!existsSync19(dbPath)) throw new Error(`DB not found at ${dbPath}`);
-  const dbSize = statSync6(dbPath).size;
+  if (!existsSync20(dbPath)) throw new Error(`DB not found at ${dbPath}`);
+  const dbSize = statSync7(dbPath).size;
   console.log(`\u2713 DB exists: ${dbPath} (${humanBytes(dbSize)})`);
   await initDatabase({ dbPath: config.dbPath, encryptionKey: key.toString("hex") });
   const client = getClient();
@@ -10923,9 +11169,9 @@ async function rotateWizard(argv) {
   }
   const rotationId = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const baseDir = path19.join(dataDir(), "key-rotation", rotationId);
-  mkdirSync12(baseDir, { recursive: true, mode: 448 });
+  mkdirSync13(baseDir, { recursive: true, mode: 448 });
   const backupDir = path19.join(baseDir, "pre-rotation-encrypted-backup");
-  mkdirSync12(backupDir, { recursive: true, mode: 448 });
+  mkdirSync13(backupDir, { recursive: true, mode: 448 });
   const newDbPath = path19.join(baseDir, "new-memories.db");
   const newKey = crypto5.randomBytes(32);
   const newKeyTempPath = path19.join(baseDir, "NEW_KEY_DO_NOT_SHARE.base64");
@@ -10938,7 +11184,7 @@ async function rotateWizard(argv) {
   const dbDir = path19.dirname(pf.dbPath);
   for (const name of ["memories.db", "memories.db-wal", "memories.db-shm"]) {
     const src = path19.join(dbDir, name);
-    if (existsSync19(src)) copyFileSync3(src, path19.join(backupDir, name));
+    if (existsSync20(src)) copyFileSync4(src, path19.join(backupDir, name));
   }
   console.log("Creating fresh encrypted DB with new key...");
   await initDatabase({ dbPath: newDbPath, encryptionKey: newKey.toString("hex") });
@@ -10976,9 +11222,9 @@ async function rotateWizard(argv) {
   console.log("Swapping DB files...");
   for (const name of ["memories.db", "memories.db-wal", "memories.db-shm"]) {
     const current = path19.join(dbDir, name);
-    if (existsSync19(current)) renameSync4(current, path19.join(backupDir, `moved-${name}`));
+    if (existsSync20(current)) renameSync4(current, path19.join(backupDir, `moved-${name}`));
   }
-  copyFileSync3(newDbPath, pf.dbPath);
+  copyFileSync4(newDbPath, pf.dbPath);
   rmSync(path19.join(dbDir, "memories.db-wal"), { force: true });
   rmSync(path19.join(dbDir, "memories.db-shm"), { force: true });
   console.log("Installing new key into OS keychain...");
@@ -11111,7 +11357,7 @@ async function acceptRotationWizard(argv) {
     console.error("Configure cloud first, or use `exe-os cloud` if this is a new device setup.");
     return 1;
   }
-  const existingDbFiles = dbSidecarPaths(dbPath).filter(existsSync19);
+  const existingDbFiles = dbSidecarPaths(dbPath).filter(existsSync20);
   if (existingDbFiles.length > 0) {
     console.log(`Existing DB files: ${existingDbFiles.map((p) => path19.basename(p)).join(", ")}`);
   } else {
@@ -11145,7 +11391,7 @@ async function acceptRotationWizard(argv) {
   const acceptId = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const baseDir = path19.join(dataDir(), "key-acceptance", acceptId);
   const backupDir = path19.join(baseDir, "pre-acceptance-encrypted-db");
-  mkdirSync12(backupDir, { recursive: true, mode: 448 });
+  mkdirSync13(backupDir, { recursive: true, mode: 448 });
   if (existingKey) {
     writeFileSync12(path19.join(baseDir, "OLD_KEY_BACKUP_DELETE_AFTER_VERIFICATION.base64"), `${existingKey.toString("base64")}
 `, { mode: 384 });
@@ -11156,7 +11402,7 @@ async function acceptRotationWizard(argv) {
     for (const file of dbSidecarPaths(dbPath)) {
       rmSync(file, { force: true });
       const backup = path19.join(backupDir, path19.basename(file));
-      if (existsSync19(backup)) copyFileSync3(backup, file);
+      if (existsSync20(backup)) copyFileSync4(backup, file);
     }
   };
   console.log(`Acceptance workspace: ${baseDir}`);
@@ -11165,11 +11411,11 @@ async function acceptRotationWizard(argv) {
   await disposeDatabase();
   console.log("Backing up/moving old local DB files...");
   const dbDir = path19.dirname(dbPath);
-  mkdirSync12(dbDir, { recursive: true, mode: 448 });
+  mkdirSync13(dbDir, { recursive: true, mode: 448 });
   for (const file of dbSidecarPaths(dbPath)) {
-    if (!existsSync19(file)) continue;
+    if (!existsSync20(file)) continue;
     const dest = path19.join(backupDir, path19.basename(file));
-    copyFileSync3(file, dest);
+    copyFileSync4(file, dest);
     renameSync4(file, path19.join(backupDir, `moved-${path19.basename(file)}`));
     console.log(`\u2713 moved ${path19.basename(file)}`);
   }
@@ -11261,7 +11507,7 @@ __export(exe_support_exports, {
   runHealth: () => runHealth,
   runTest: () => runTest
 });
-import { mkdirSync as mkdirSync13, readFileSync as readFileSync14, unlinkSync as unlinkSync7, writeFileSync as writeFileSync13 } from "fs";
+import { mkdirSync as mkdirSync14, readFileSync as readFileSync14, unlinkSync as unlinkSync8, writeFileSync as writeFileSync13 } from "fs";
 import path20 from "path";
 import { randomUUID as randomUUID4 } from "crypto";
 async function main4(argv = process.argv.slice(2)) {
@@ -11407,9 +11653,9 @@ function checkLocalWrite() {
   const dir = path20.join(EXE_AI_DIR, "bug-reports");
   const testPath = path20.join(dir, ".support-write-test");
   try {
-    mkdirSync13(dir, { recursive: true, mode: 448 });
+    mkdirSync14(dir, { recursive: true, mode: 448 });
     writeFileSync13(testPath, "ok\n", { mode: 384 });
-    unlinkSync7(testPath);
+    unlinkSync8(testPath);
     return { check: "local_bug_report_dir_writable", level: "pass", detail: dir };
   } catch (err) {
     return {
@@ -11422,7 +11668,7 @@ function checkLocalWrite() {
 }
 function writeLocalTestReport(id, project, version) {
   const dir = path20.join(EXE_AI_DIR, "bug-reports");
-  mkdirSync13(dir, { recursive: true, mode: 448 });
+  mkdirSync14(dir, { recursive: true, mode: 448 });
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const filePath = path20.join(dir, `${date}-support-intake-test-${id.slice(0, 8)}.md`);
   writeFileSync13(filePath, `# TEST \u2014 ${project} support intake
@@ -11641,10 +11887,10 @@ import { createReadStream } from "fs";
 import { readdir as readdir2, stat } from "fs/promises";
 import path21 from "path";
 import { createInterface as createInterface3 } from "readline";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 import { parseArgs } from "util";
 async function findJsonlFiles(sinceDate, projectFilter) {
-  const projectsDir = path21.join(homedir3(), ".claude", "projects");
+  const projectsDir = path21.join(homedir4(), ".claude", "projects");
   const files = [];
   async function walk(dir, depth = 0) {
     if (depth > MAX_WALK_DEPTH) return;
@@ -11689,7 +11935,7 @@ async function findJsonlFiles(sinceDate, projectFilter) {
   return files;
 }
 function decodeProjectDir(dirName) {
-  const homeEncoded = homedir3().replaceAll("/", "-");
+  const homeEncoded = homedir4().replaceAll("/", "-");
   if (dirName.startsWith(homeEncoded + "-")) {
     return dirName.slice(homeEncoded.length + 1);
   }
@@ -11697,7 +11943,7 @@ function decodeProjectDir(dirName) {
   return dirName;
 }
 function projectNameFromPath(filePath) {
-  const projectsDir = path21.join(homedir3(), ".claude", "projects");
+  const projectsDir = path21.join(homedir4(), ".claude", "projects");
   const relative = path21.relative(projectsDir, filePath);
   const projectDir = relative.split(path21.sep)[0] ?? "unknown";
   return decodeProjectDir(projectDir);
@@ -12611,13 +12857,13 @@ __export(identity_exports, {
   listIdentities: () => listIdentities,
   updateIdentity: () => updateIdentity
 });
-import { existsSync as existsSync20, mkdirSync as mkdirSync14, readFileSync as readFileSync15, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync15, readFileSync as readFileSync15, writeFileSync as writeFileSync14 } from "fs";
 import { readdirSync as readdirSync4 } from "fs";
 import path22 from "path";
 import { createHash as createHash5 } from "crypto";
 function ensureDir() {
-  if (!existsSync20(IDENTITY_DIR2)) {
-    mkdirSync14(IDENTITY_DIR2, { recursive: true });
+  if (!existsSync21(IDENTITY_DIR2)) {
+    mkdirSync15(IDENTITY_DIR2, { recursive: true });
   }
 }
 function identityPath(agentId) {
@@ -12665,7 +12911,7 @@ function contentHash(content) {
 }
 function getIdentity(agentId) {
   const filePath = identityPath(agentId);
-  if (!existsSync20(filePath)) return null;
+  if (!existsSync21(filePath)) return null;
   const raw = readFileSync15(filePath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(raw);
   return {
@@ -12744,7 +12990,7 @@ var init_identity = __esm({
 
 // src/lib/orchestration-package.ts
 import { randomUUID as randomUUID5 } from "crypto";
-import { copyFileSync as copyFileSync4, existsSync as existsSync21, mkdirSync as mkdirSync15, readFileSync as readFileSync16, writeFileSync as writeFileSync15 } from "fs";
+import { copyFileSync as copyFileSync5, existsSync as existsSync22, mkdirSync as mkdirSync16, readFileSync as readFileSync16, writeFileSync as writeFileSync15 } from "fs";
 import os13 from "os";
 import path23 from "path";
 function ensureObject(value, label) {
@@ -12812,7 +13058,7 @@ function getBackupPath() {
 }
 function readRosterFile() {
   const rosterPath = getRosterPath();
-  if (!existsSync21(rosterPath)) return [];
+  if (!existsSync22(rosterPath)) return [];
   const raw = readFileSync16(rosterPath, "utf-8");
   const parsed = JSON.parse(raw);
   if (!Array.isArray(parsed)) {
@@ -12825,15 +13071,15 @@ function writeRosterFile(roster) {
     throw new Error("Refusing to write empty roster \u2014 this would delete all employees");
   }
   const rosterPath = getRosterPath();
-  mkdirSync15(path23.dirname(rosterPath), { recursive: true });
-  if (existsSync21(rosterPath)) {
+  mkdirSync16(path23.dirname(rosterPath), { recursive: true });
+  if (existsSync22(rosterPath)) {
     const currentRoster = readRosterFile();
     if (roster.length < currentRoster.length) {
       throw new Error(
         `Refusing to write roster with ${roster.length} entries \u2014 current roster has ${currentRoster.length}. Import would delete ${currentRoster.length - roster.length} employee(s). Use merge strategy instead, or add the missing entries to the package.`
       );
     }
-    copyFileSync4(rosterPath, getBackupPath());
+    copyFileSync5(rosterPath, getBackupPath());
   }
   writeFileSync15(rosterPath, `${JSON.stringify(roster, null, 2)}
 `, "utf-8");
@@ -13102,7 +13348,7 @@ var exe_export_exports = {};
 __export(exe_export_exports, {
   runExeExport: () => runExeExport
 });
-import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync16 } from "fs";
+import { mkdirSync as mkdirSync17, writeFileSync as writeFileSync16 } from "fs";
 import path24 from "path";
 function printUsage() {
   process.stdout.write("Usage: exe-os export --output <path>\n");
@@ -13124,7 +13370,7 @@ async function runExeExport(argv = process.argv.slice(2)) {
   await initStore();
   try {
     const pkg = await exportOrchestration("cli");
-    mkdirSync16(path24.dirname(outputPath), { recursive: true });
+    mkdirSync17(path24.dirname(outputPath), { recursive: true });
     writeFileSync16(outputPath, `${JSON.stringify(pkg, null, 2)}
 `, "utf-8");
     process.stdout.write(
@@ -13225,14 +13471,14 @@ __export(session_registry_exports, {
   refreshSessionProject: () => refreshSessionProject,
   registerSession: () => registerSession
 });
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync17, mkdirSync as mkdirSync17, existsSync as existsSync22 } from "fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync17, mkdirSync as mkdirSync18, existsSync as existsSync23 } from "fs";
 import { execSync as execSync6 } from "child_process";
 import path25 from "path";
 import os14 from "os";
 function registerSession(entry) {
   const dir = path25.dirname(REGISTRY_PATH);
-  if (!existsSync22(dir)) {
-    mkdirSync17(dir, { recursive: true });
+  if (!existsSync23(dir)) {
+    mkdirSync18(dir, { recursive: true });
   }
   const sessions = listSessions();
   const idx = sessions.findIndex((s) => s.windowName === entry.windowName);
@@ -13540,16 +13786,16 @@ __export(intercom_queue_exports, {
   queueIntercom: () => queueIntercom,
   readQueue: () => readQueue
 });
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync18, renameSync as renameSync5, existsSync as existsSync23, mkdirSync as mkdirSync18 } from "fs";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync18, renameSync as renameSync5, existsSync as existsSync24, mkdirSync as mkdirSync19 } from "fs";
 import path26 from "path";
 import os15 from "os";
 function ensureDir2() {
   const dir = path26.dirname(QUEUE_PATH);
-  if (!existsSync23(dir)) mkdirSync18(dir, { recursive: true });
+  if (!existsSync24(dir)) mkdirSync19(dir, { recursive: true });
 }
 function readQueue() {
   try {
-    if (!existsSync23(QUEUE_PATH)) return [];
+    if (!existsSync24(QUEUE_PATH)) return [];
     return JSON.parse(readFileSync19(QUEUE_PATH, "utf8"));
   } catch {
     return [];
@@ -13658,11 +13904,11 @@ var init_intercom_queue = __esm({
 });
 
 // src/lib/plan-limits.ts
-import { readFileSync as readFileSync20, existsSync as existsSync24 } from "fs";
+import { readFileSync as readFileSync20, existsSync as existsSync25 } from "fs";
 import path27 from "path";
 function getLicenseSync() {
   try {
-    if (!existsSync24(CACHE_PATH2)) return freeLicense();
+    if (!existsSync25(CACHE_PATH2)) return freeLicense();
     const raw = JSON.parse(readFileSync20(CACHE_PATH2, "utf8"));
     if (!raw.token || typeof raw.token !== "string") return freeLicense();
     const parts = raw.token.split(".");
@@ -13701,7 +13947,7 @@ function assertEmployeeLimitSync(rosterPath) {
   const filePath = rosterPath ?? EMPLOYEES_PATH;
   let count = 0;
   try {
-    if (existsSync24(filePath)) {
+    if (existsSync25(filePath)) {
       const raw = readFileSync20(filePath, "utf8");
       const employees = JSON.parse(raw);
       count = Array.isArray(employees) ? employees.length : 0;
@@ -13781,8 +14027,8 @@ import os16 from "os";
 import {
   readFileSync as readFileSync21,
   readdirSync as readdirSync5,
-  unlinkSync as unlinkSync8,
-  existsSync as existsSync25,
+  unlinkSync as unlinkSync9,
+  existsSync as existsSync26,
   rmdirSync
 } from "fs";
 async function writeNotification(notification) {
@@ -13991,7 +14237,7 @@ import path30 from "path";
 import os17 from "os";
 import { execSync as execSync10 } from "child_process";
 import { mkdir as mkdir5, writeFile as writeFile5, appendFile } from "fs/promises";
-import { existsSync as existsSync26, readFileSync as readFileSync22 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync22 } from "fs";
 async function writeCheckpoint(input) {
   const client = getClient();
   const row = await resolveTask(client, input.taskId);
@@ -14232,7 +14478,7 @@ ${scopeMismatchWarning}` : scopeMismatchWarning;
       const EXE_OS_DIR = path30.join(os17.homedir(), ".exe-os");
       const mdPath = path30.join(EXE_OS_DIR, taskFile);
       const mdDir = path30.dirname(mdPath);
-      if (!existsSync26(mdDir)) await mkdir5(mdDir, { recursive: true });
+      if (!existsSync27(mdDir)) await mkdir5(mdDir, { recursive: true });
       const reviewer = input.reviewer ?? input.assignedBy;
       const mdContent = `# ${input.title}
 
@@ -14538,7 +14784,7 @@ async function deleteTaskCore(taskId, _baseDir) {
 async function ensureArchitectureDoc(baseDir, projectName) {
   const archPath = path30.join(baseDir, "exe", "ARCHITECTURE.md");
   try {
-    if (existsSync26(archPath)) return;
+    if (existsSync27(archPath)) return;
     const template = [
       `# ${projectName} \u2014 System Architecture`,
       "",
@@ -14573,7 +14819,7 @@ async function ensureArchitectureDoc(baseDir, projectName) {
 async function ensureGitignoreExe(baseDir) {
   const gitignorePath = path30.join(baseDir, ".gitignore");
   try {
-    if (existsSync26(gitignorePath)) {
+    if (existsSync27(gitignorePath)) {
       const content = readFileSync22(gitignorePath, "utf-8");
       if (/^\/?exe\/?$/m.test(content)) return;
       await appendFile(gitignorePath, "\n# Employee task assignments (private)\n/exe/\n");
@@ -14618,7 +14864,7 @@ __export(tasks_review_exports, {
   listPendingReviews: () => listPendingReviews
 });
 import path31 from "path";
-import { existsSync as existsSync27, readdirSync as readdirSync6, unlinkSync as unlinkSync9 } from "fs";
+import { existsSync as existsSync28, readdirSync as readdirSync6, unlinkSync as unlinkSync10 } from "fs";
 function formatAge(isoTimestamp) {
   if (!isoTimestamp) return "";
   const ms = Date.now() - new Date(isoTimestamp).getTime();
@@ -14888,10 +15134,10 @@ async function cleanupReviewFile(row, taskFile, _baseDir) {
   }
   try {
     const cacheDir = path31.join(EXE_AI_DIR, "session-cache");
-    if (existsSync27(cacheDir)) {
+    if (existsSync28(cacheDir)) {
       for (const f of readdirSync6(cacheDir)) {
         if (f.startsWith("review-notified-")) {
-          unlinkSync9(path31.join(cacheDir, f));
+          unlinkSync10(path31.join(cacheDir, f));
         }
       }
     }
@@ -15114,10 +15360,10 @@ async function disposeEmbedder() {
 async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync43 } = await import("fs");
+  const { existsSync: existsSync44 } = await import("fs");
   const path58 = await import("path");
   const modelPath = path58.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync43(modelPath)) {
+  if (!existsSync44(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -15484,7 +15730,7 @@ __export(tasks_exports, {
   writeCheckpoint: () => writeCheckpoint
 });
 import path33 from "path";
-import { writeFileSync as writeFileSync19, mkdirSync as mkdirSync19, unlinkSync as unlinkSync10 } from "fs";
+import { writeFileSync as writeFileSync19, mkdirSync as mkdirSync20, unlinkSync as unlinkSync11 } from "fs";
 async function createTask(input) {
   const result = await createTaskCore(input);
   if (!input.skipDispatch && result.status !== "blocked" && !process.env.VITEST) {
@@ -15506,11 +15752,11 @@ async function updateTask(input) {
     const cacheDir = path33.join(EXE_AI_DIR, "session-cache");
     const cachePath = path33.join(cacheDir, `current-task-${agent}.json`);
     if (input.status === "in_progress") {
-      mkdirSync19(cacheDir, { recursive: true });
+      mkdirSync20(cacheDir, { recursive: true });
       writeFileSync19(cachePath, JSON.stringify({ taskId, title: String(row.title) }));
     } else if (input.status === "done" || input.status === "blocked" || input.status === "cancelled" || input.status === "closed") {
       try {
-        unlinkSync10(cachePath);
+        unlinkSync11(cachePath);
       } catch {
       }
     }
@@ -15978,11 +16224,11 @@ __export(tmux_routing_exports, {
   verifyPaneAtCapacity: () => verifyPaneAtCapacity
 });
 import { execFileSync as execFileSync3, execSync as execSync11 } from "child_process";
-import { readFileSync as readFileSync23, writeFileSync as writeFileSync20, mkdirSync as mkdirSync20, existsSync as existsSync28, appendFileSync as appendFileSync2, readdirSync as readdirSync7 } from "fs";
+import { readFileSync as readFileSync23, writeFileSync as writeFileSync20, mkdirSync as mkdirSync21, existsSync as existsSync29, appendFileSync as appendFileSync2, readdirSync as readdirSync7 } from "fs";
 import path34 from "path";
 import os18 from "os";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { unlinkSync as unlinkSync11 } from "fs";
+import { unlinkSync as unlinkSync12 } from "fs";
 function spawnLockPath(sessionName) {
   return path34.join(SPAWN_LOCK_DIR, `${sessionName}.lock`);
 }
@@ -15995,11 +16241,11 @@ function isProcessAlive(pid) {
   }
 }
 function acquireSpawnLock2(sessionName) {
-  if (!existsSync28(SPAWN_LOCK_DIR)) {
-    mkdirSync20(SPAWN_LOCK_DIR, { recursive: true });
+  if (!existsSync29(SPAWN_LOCK_DIR)) {
+    mkdirSync21(SPAWN_LOCK_DIR, { recursive: true });
   }
   const lockFile = spawnLockPath(sessionName);
-  if (existsSync28(lockFile)) {
+  if (existsSync29(lockFile)) {
     try {
       const lock = JSON.parse(readFileSync23(lockFile, "utf8"));
       const age = Date.now() - lock.timestamp;
@@ -16014,7 +16260,7 @@ function acquireSpawnLock2(sessionName) {
 }
 function releaseSpawnLock2(sessionName) {
   try {
-    unlinkSync11(spawnLockPath(sessionName));
+    unlinkSync12(spawnLockPath(sessionName));
   } catch {
   }
 }
@@ -16027,7 +16273,7 @@ function resolveBehaviorsExporterScript() {
       "bin",
       "exe-export-behaviors.js"
     );
-    return existsSync28(scriptPath) ? scriptPath : null;
+    return existsSync29(scriptPath) ? scriptPath : null;
   } catch {
     return null;
   }
@@ -16093,8 +16339,8 @@ function extractRootExe(name) {
   return parts.length > 0 ? parts[parts.length - 1] : null;
 }
 function registerParentExe(sessionKey, parentExe, dispatchedBy) {
-  if (!existsSync28(SESSION_CACHE)) {
-    mkdirSync20(SESSION_CACHE, { recursive: true });
+  if (!existsSync29(SESSION_CACHE)) {
+    mkdirSync21(SESSION_CACHE, { recursive: true });
   }
   const rootExe = extractRootExe(parentExe) ?? parentExe;
   const filePath = path34.join(SESSION_CACHE, `parent-exe-${sessionKey}.json`);
@@ -16124,11 +16370,13 @@ function getDispatchedBy(sessionKey) {
   }
 }
 function resolveExeSession() {
-  if (process.env.EXE_SESSION_NAME) {
-    return extractRootExe(process.env.EXE_SESSION_NAME) ?? process.env.EXE_SESSION_NAME;
-  }
   const mySession = getMySession();
-  if (!mySession) return null;
+  if (!mySession) {
+    if (process.env.EXE_SESSION_NAME) {
+      return extractRootExe(process.env.EXE_SESSION_NAME) ?? process.env.EXE_SESSION_NAME;
+    }
+    return null;
+  }
   const fromSessionName = extractRootExe(mySession);
   let candidate = null;
   try {
@@ -16223,7 +16471,7 @@ async function verifyPaneAtCapacity(sessionName) {
 }
 function readDebounceState() {
   try {
-    if (!existsSync28(DEBOUNCE_FILE)) return {};
+    if (!existsSync29(DEBOUNCE_FILE)) return {};
     const raw = JSON.parse(readFileSync23(DEBOUNCE_FILE, "utf8"));
     const state = {};
     for (const [key, val] of Object.entries(raw)) {
@@ -16240,7 +16488,7 @@ function readDebounceState() {
 }
 function writeDebounceState(state) {
   try {
-    if (!existsSync28(SESSION_CACHE)) mkdirSync20(SESSION_CACHE, { recursive: true });
+    if (!existsSync29(SESSION_CACHE)) mkdirSync21(SESSION_CACHE, { recursive: true });
     writeFileSync20(DEBOUNCE_FILE, JSON.stringify(state));
   } catch {
   }
@@ -16341,7 +16589,7 @@ function sendIntercom(targetSession) {
         const rawAgent = targetSession.split("-")[0] ?? targetSession;
         const agent = baseAgentName(rawAgent);
         const markerPath = path34.join(SESSION_CACHE, `current-task-${agent}.json`);
-        if (existsSync28(markerPath)) {
+        if (existsSync29(markerPath)) {
           logIntercom(`SKIP \u2192 ${targetSession} (has in_progress task marker + not idle \u2014 will auto-chain)`);
           return "debounced";
         }
@@ -16352,7 +16600,7 @@ function sendIntercom(targetSession) {
       const rawAgent = targetSession.split("-")[0] ?? targetSession;
       const agent = baseAgentName(rawAgent);
       const taskDir = path34.join(process.cwd(), "exe", agent);
-      if (existsSync28(taskDir)) {
+      if (existsSync29(taskDir)) {
         const files = readdirSync7(taskDir).filter(
           (f) => f.endsWith(".md") && f !== "DONE.txt"
         );
@@ -16513,15 +16761,15 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   const instanceLabel = opts?.instance != null && opts.instance > 0 ? `${employeeName}${opts.instance}` : employeeName;
   const logDir = path34.join(os18.homedir(), ".exe-os", "session-logs");
   const logFile = path34.join(logDir, `${instanceLabel}-${Date.now()}.log`);
-  if (!existsSync28(logDir)) {
-    mkdirSync20(logDir, { recursive: true });
+  if (!existsSync29(logDir)) {
+    mkdirSync21(logDir, { recursive: true });
   }
   transport.kill(sessionName);
   let cleanupSuffix = "";
   try {
     const thisFile = fileURLToPath4(import.meta.url);
     const cleanupScript = path34.join(path34.dirname(thisFile), "..", "bin", "exe-session-cleanup.js");
-    if (existsSync28(cleanupScript)) {
+    if (existsSync29(cleanupScript)) {
       cleanupSuffix = `; ${process.execPath} "${cleanupScript}" "${employeeName}" "${exeSession}"`;
     }
   } catch {
@@ -16576,7 +16824,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
     if (changed) {
       perms.allow = allow;
       settings.permissions = perms;
-      mkdirSync20(projSettingsDir, { recursive: true });
+      mkdirSync21(projSettingsDir, { recursive: true });
       writeFileSync20(settingsPath, JSON.stringify(settings, null, 2) + "\n");
     }
   } catch {
@@ -16614,7 +16862,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
 `
         );
       }
-    } else if (existsSync28(identityPath2)) {
+    } else if (existsSync29(identityPath2)) {
       identityFlag = ` --append-system-prompt-file ${identityPath2}`;
       legacyFallbackWarned = true;
     }
@@ -16636,7 +16884,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   let sessionContextFlag = "";
   try {
     const ctxDir = path34.join(os18.homedir(), ".exe-os", "session-cache");
-    mkdirSync20(ctxDir, { recursive: true });
+    mkdirSync21(ctxDir, { recursive: true });
     const ctxFile = path34.join(ctxDir, `session-context-${sessionName}.md`);
     const ctxContent = [
       `## Session Context`,
@@ -17113,7 +17361,7 @@ __export(active_agent_exports, {
   resolveActiveAgentFromTmuxSession: () => resolveActiveAgentFromTmuxSession,
   writeActiveAgent: () => writeActiveAgent
 });
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync21, mkdirSync as mkdirSync21, unlinkSync as unlinkSync12, readdirSync as readdirSync8 } from "fs";
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync21, mkdirSync as mkdirSync22, unlinkSync as unlinkSync13, readdirSync as readdirSync8 } from "fs";
 import { execSync as execSync12 } from "child_process";
 import path35 from "path";
 function isNameWithOptionalInstance(candidate, baseName) {
@@ -17163,7 +17411,7 @@ function getMarkerPath() {
 }
 function writeActiveAgent(agentId, agentRole) {
   try {
-    mkdirSync21(CACHE_DIR, { recursive: true });
+    mkdirSync22(CACHE_DIR, { recursive: true });
     writeFileSync21(
       getMarkerPath(),
       JSON.stringify({ agentId, agentRole, startedAt: (/* @__PURE__ */ new Date()).toISOString() })
@@ -17173,7 +17421,7 @@ function writeActiveAgent(agentId, agentRole) {
 }
 function clearActiveAgent() {
   try {
-    unlinkSync12(getMarkerPath());
+    unlinkSync13(getMarkerPath());
   } catch {
   }
 }
@@ -17189,7 +17437,7 @@ function getActiveAgent() {
         const age = Date.now() - new Date(data.startedAt).getTime();
         if (age > STALE_MS) {
           try {
-            unlinkSync12(markerPath);
+            unlinkSync13(markerPath);
           } catch {
           }
         } else {
@@ -17237,7 +17485,7 @@ function getAllActiveAgents() {
           const age = Date.now() - new Date(data.startedAt).getTime();
           if (age > STALE_MS) {
             try {
-              unlinkSync12(path35.join(CACHE_DIR, file));
+              unlinkSync13(path35.join(CACHE_DIR, file));
             } catch {
             }
             continue;
@@ -17260,11 +17508,11 @@ function getAllActiveAgents() {
 function cleanupSessionMarkers() {
   const key = getSessionKey();
   try {
-    unlinkSync12(path35.join(CACHE_DIR, `active-agent-${key}.json`));
+    unlinkSync13(path35.join(CACHE_DIR, `active-agent-${key}.json`));
   } catch {
   }
   try {
-    unlinkSync12(path35.join(CACHE_DIR, "active-agent-undefined.json"));
+    unlinkSync13(path35.join(CACHE_DIR, "active-agent-undefined.json"));
   } catch {
   }
 }
@@ -17932,14 +18180,14 @@ __export(exe_rename_exports, {
   main: () => main6,
   renameEmployee: () => renameEmployee
 });
-import { readFileSync as readFileSync25, writeFileSync as writeFileSync22, renameSync as renameSync6, unlinkSync as unlinkSync13, existsSync as existsSync29 } from "fs";
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync22, renameSync as renameSync6, unlinkSync as unlinkSync14, existsSync as existsSync30 } from "fs";
 import { execSync as execSync13 } from "child_process";
 import path36 from "path";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir5 } from "os";
 async function renameEmployee(oldName, newName, opts = {}) {
-  const rosterPath = opts.rosterPath ?? path36.join(homedir4(), ".exe-os", "exe-employees.json");
-  const identityDir = opts.identityDir ?? path36.join(homedir4(), ".exe-os", "identity");
-  const agentsDir = opts.agentsDir ?? path36.join(homedir4(), ".claude", "agents");
+  const rosterPath = opts.rosterPath ?? path36.join(homedir5(), ".exe-os", "exe-employees.json");
+  const identityDir = opts.identityDir ?? path36.join(homedir5(), ".exe-os", "identity");
+  const agentsDir = opts.agentsDir ?? path36.join(homedir5(), ".claude", "agents");
   const validation = validateEmployeeName(newName);
   if (!validation.valid) {
     return { success: false, error: validation.error };
@@ -17974,7 +18222,7 @@ async function renameEmployee(oldName, newName, opts = {}) {
     });
     const oldIdentityPath = path36.join(identityDir, `${rosterOldName}.md`);
     const newIdentityPath = path36.join(identityDir, `${newName}.md`);
-    if (existsSync29(oldIdentityPath)) {
+    if (existsSync30(oldIdentityPath)) {
       const content = readFileSync25(oldIdentityPath, "utf-8");
       const updatedContent = rewriteRenamedEmployeeContent(content, rosterOldName, newName);
       renameSync6(oldIdentityPath, newIdentityPath);
@@ -17982,7 +18230,7 @@ async function renameEmployee(oldName, newName, opts = {}) {
       rollbackStack.push({
         description: "restore identity file",
         undo: () => {
-          if (existsSync29(newIdentityPath)) {
+          if (existsSync30(newIdentityPath)) {
             writeFileSync22(newIdentityPath, content, "utf-8");
             renameSync6(newIdentityPath, oldIdentityPath);
           }
@@ -17991,7 +18239,7 @@ async function renameEmployee(oldName, newName, opts = {}) {
     }
     const oldAgentPath = path36.join(agentsDir, `${rosterOldName}.md`);
     const newAgentPath = path36.join(agentsDir, `${newName}.md`);
-    if (existsSync29(oldAgentPath)) {
+    if (existsSync30(oldAgentPath)) {
       const agentContent = readFileSync25(oldAgentPath, "utf-8");
       const updatedAgentContent = rewriteRenamedEmployeeContent(agentContent, rosterOldName, newName);
       renameSync6(oldAgentPath, newAgentPath);
@@ -17999,7 +18247,7 @@ async function renameEmployee(oldName, newName, opts = {}) {
       rollbackStack.push({
         description: "restore agent file",
         undo: () => {
-          if (existsSync29(newAgentPath)) {
+          if (existsSync30(newAgentPath)) {
             renameSync6(newAgentPath, oldAgentPath);
             writeFileSync22(oldAgentPath, agentContent, "utf-8");
           }
@@ -18086,9 +18334,9 @@ function removeOldSymlinks(name) {
     const binDir = path36.dirname(exeBinPath);
     for (const suffix of ["", "-opencode"]) {
       const linkPath = path36.join(binDir, `${name}${suffix}`);
-      if (existsSync29(linkPath)) {
+      if (existsSync30(linkPath)) {
         try {
-          unlinkSync13(linkPath);
+          unlinkSync14(linkPath);
         } catch {
         }
       }
@@ -18546,7 +18794,7 @@ var init_exe_drift = __esm({
 });
 
 // src/lib/mcp-transport-health.ts
-import { appendFileSync as appendFileSync3, closeSync as closeSync3, existsSync as existsSync30, mkdirSync as mkdirSync22, openSync as openSync3, readFileSync as readFileSync26, readSync, statSync as statSync7, writeFileSync as writeFileSync23 } from "fs";
+import { appendFileSync as appendFileSync3, closeSync as closeSync4, existsSync as existsSync31, mkdirSync as mkdirSync23, openSync as openSync4, readFileSync as readFileSync26, readSync, statSync as statSync8, writeFileSync as writeFileSync23 } from "fs";
 import path37 from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 function parsePositiveInt(value, fallback) {
@@ -18555,9 +18803,9 @@ function parsePositiveInt(value, fallback) {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
 }
 function readTailText(filePath, maxBytes) {
-  const stats = statSync7(filePath);
+  const stats = statSync8(filePath);
   if (stats.size <= maxBytes) return readFileSync26(filePath, "utf8");
-  const fd = openSync3(filePath, "r");
+  const fd = openSync4(filePath, "r");
   try {
     const buffer = Buffer.allocUnsafe(maxBytes);
     readSync(fd, buffer, 0, maxBytes, stats.size - maxBytes);
@@ -18565,7 +18813,7 @@ function readTailText(filePath, maxBytes) {
     const firstNewline = text.indexOf("\n");
     return firstNewline >= 0 ? text.slice(firstNewline + 1) : text;
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
 function readPackageVersion2() {
@@ -18573,7 +18821,7 @@ function readPackageVersion2() {
   const { root } = path37.parse(dir);
   while (dir !== root) {
     const pkgPath = path37.join(dir, "package.json");
-    if (existsSync30(pkgPath)) {
+    if (existsSync31(pkgPath)) {
       try {
         const parsed = JSON.parse(readFileSync26(pkgPath, "utf8"));
         return parsed.version ?? "unknown";
@@ -18597,7 +18845,7 @@ function parseMcpHttpEventLines(raw, limit = 200) {
   return events;
 }
 function readMcpHttpEvents(limit = 200) {
-  if (!existsSync30(MCP_HTTP_EVENTS_PATH)) return [];
+  if (!existsSync31(MCP_HTTP_EVENTS_PATH)) return [];
   const raw = readTailText(MCP_HTTP_EVENTS_PATH, EVENT_READ_BYTES);
   return parseMcpHttpEventLines(raw, limit);
 }
@@ -18666,7 +18914,7 @@ var init_mcp_transport_health = __esm({
 });
 
 // src/bin/exe-healthcheck.ts
-import { existsSync as existsSync31, readFileSync as readFileSync27, readdirSync as readdirSync9 } from "fs";
+import { existsSync as existsSync32, readFileSync as readFileSync27, readdirSync as readdirSync9 } from "fs";
 import path38 from "path";
 import { execSync as execSync14 } from "child_process";
 import { fileURLToPath as fileURLToPath6 } from "url";
@@ -18674,7 +18922,7 @@ function findPackageRoot2() {
   let dir = path38.dirname(fileURLToPath6(import.meta.url));
   const { root } = path38.parse(dir);
   while (dir !== root) {
-    if (existsSync31(path38.join(dir, "package.json"))) return dir;
+    if (existsSync32(path38.join(dir, "package.json"))) return dir;
     dir = path38.dirname(dir);
   }
   throw new Error("Cannot find package root");
@@ -18682,7 +18930,7 @@ function findPackageRoot2() {
 function checkBuildIntegrity(pkgRoot) {
   const results = [];
   const tsupConfig = path38.join(pkgRoot, "tsup.config.ts");
-  if (!existsSync31(tsupConfig)) {
+  if (!existsSync32(tsupConfig)) {
     return [{ name: "build/tsup-config", pass: false, detail: "tsup.config.ts not found" }];
   }
   const configContent = readFileSync27(tsupConfig, "utf-8");
@@ -18693,7 +18941,7 @@ function checkBuildIntegrity(pkgRoot) {
     const outputKey = match[1];
     const expectedPath = path38.join(pkgRoot, "dist", `${outputKey}.js`);
     total++;
-    if (!existsSync31(expectedPath)) {
+    if (!existsSync32(expectedPath)) {
       missing.push(`dist/${outputKey}.js`);
     }
   }
@@ -18716,7 +18964,7 @@ function checkBuildIntegrity(pkgRoot) {
 function checkEmbedPipeline(pkgRoot) {
   const results = [];
   const daemonPath = path38.join(pkgRoot, "dist", "lib", "exe-daemon.js");
-  if (!existsSync31(daemonPath)) {
+  if (!existsSync32(daemonPath)) {
     results.push({
       name: "exed/daemon-exists",
       pass: false,
@@ -18728,12 +18976,12 @@ function checkEmbedPipeline(pkgRoot) {
   const entryDirs = ["dist/hooks", "dist/bin", "dist/mcp"];
   for (const dir of entryDirs) {
     const fullDir = path38.join(pkgRoot, dir);
-    if (!existsSync31(fullDir)) continue;
+    if (!existsSync32(fullDir)) continue;
     let walkDir2 = fullDir;
     const { root } = path38.parse(walkDir2);
     let foundRoot = null;
     while (walkDir2 !== root) {
-      if (existsSync31(path38.join(walkDir2, "package.json"))) {
+      if (existsSync32(path38.join(walkDir2, "package.json"))) {
         foundRoot = walkDir2;
         break;
       }
@@ -18748,7 +18996,7 @@ function checkEmbedPipeline(pkgRoot) {
       continue;
     }
     const resolvedDaemon = path38.join(foundRoot, "dist", "lib", "exe-daemon.js");
-    const reachable = existsSync31(resolvedDaemon);
+    const reachable = existsSync32(resolvedDaemon);
     results.push({
       name: `exed/reachable-from-${dir}`,
       pass: reachable,
@@ -18760,7 +19008,7 @@ function checkEmbedPipeline(pkgRoot) {
 function checkTaskSystem(pkgRoot) {
   const results = [];
   const scannerPath = path38.join(pkgRoot, "dist", "bin", "scan-tasks.js");
-  if (!existsSync31(scannerPath)) {
+  if (!existsSync32(scannerPath)) {
     results.push({ name: "tasks/scanner", pass: false, detail: "scan-tasks.js not found" });
     return results;
   }
@@ -18783,7 +19031,7 @@ function checkTaskSystem(pkgRoot) {
 function checkWorkerSpawning(pkgRoot) {
   const results = [];
   const workerPath = path38.join(pkgRoot, "dist", "hooks", "ingest-worker.js");
-  if (!existsSync31(workerPath)) {
+  if (!existsSync32(workerPath)) {
     results.push({ name: "workers/ingest-worker", pass: false, detail: "ingest-worker.js not found" });
     return results;
   }
@@ -18798,7 +19046,7 @@ function checkWorkerSpawning(pkgRoot) {
     });
   }
   const hooksDir = path38.join(pkgRoot, "dist", "hooks");
-  if (existsSync31(hooksDir)) {
+  if (existsSync32(hooksDir)) {
     const hookFiles = readdirSync9(hooksDir).filter((f) => f.endsWith(".js") && !f.endsWith(".js.map"));
     let hooksPassed = 0;
     const hooksFailed = [];
@@ -18831,7 +19079,7 @@ function checkMcpTransport() {
   const pidPath = path38.join(EXE_AI_DIR, "exed.pid");
   const tokenPath = path38.join(EXE_AI_DIR, "exed.token");
   let daemonAlive = false;
-  if (existsSync31(pidPath)) {
+  if (existsSync32(pidPath)) {
     try {
       const pid = parseInt(readFileSync27(pidPath, "utf8").trim(), 10);
       process.kill(pid, 0);
@@ -18843,7 +19091,7 @@ function checkMcpTransport() {
   } else {
     results.push({ name: "mcp/daemon-process", pass: false, detail: "No exed.pid found; daemon is not running" });
   }
-  if (daemonAlive && existsSync31(tokenPath)) {
+  if (daemonAlive && existsSync32(tokenPath)) {
     try {
       const token = readFileSync27(tokenPath, "utf8").trim();
       const response = execSync14(
@@ -18941,7 +19189,7 @@ function checkClaudeCodeInstall() {
     "claude",
     "versions"
   );
-  if (existsSync31(versionsDir)) {
+  if (existsSync32(versionsDir)) {
     try {
       const entries = readdirSync9(versionsDir);
       if (entries.length > 0) {
@@ -19096,7 +19344,7 @@ var init_cc_doctor = __esm({
 });
 
 // src/lib/model-downloader.ts
-import { createWriteStream, createReadStream as createReadStream2, existsSync as existsSync32, unlinkSync as unlinkSync14, renameSync as renameSync7 } from "fs";
+import { createWriteStream, createReadStream as createReadStream2, existsSync as existsSync33, unlinkSync as unlinkSync15, renameSync as renameSync7 } from "fs";
 import { mkdir as mkdir6 } from "fs/promises";
 import { createHash as createHash6 } from "crypto";
 import path39 from "path";
@@ -19105,7 +19353,7 @@ async function downloadModel(opts) {
   const destPath = path39.join(destDir, LOCAL_FILENAME);
   const tmpPath = destPath + ".tmp";
   await mkdir6(destDir, { recursive: true });
-  if (existsSync32(destPath)) {
+  if (existsSync33(destPath)) {
     const hash = await fileHash(destPath);
     if (hash === EXPECTED_SHA256) {
       return destPath;
@@ -19117,7 +19365,7 @@ async function downloadModel(opts) {
   let downloaded = 0;
   for (let attempt = 1; attempt <= MAX_RETRIES4; attempt++) {
     try {
-      if (existsSync32(tmpPath)) unlinkSync14(tmpPath);
+      if (existsSync33(tmpPath)) unlinkSync15(tmpPath);
       const response = await fetchFn(GGUF_URL, {
         redirect: "follow",
         signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
@@ -19149,7 +19397,7 @@ async function downloadModel(opts) {
       }
       const actualHash = hash.digest("hex");
       if (actualHash !== EXPECTED_SHA256) {
-        unlinkSync14(tmpPath);
+        unlinkSync15(tmpPath);
         throw new Error(
           `SHA256 mismatch: expected ${EXPECTED_SHA256}, got ${actualHash}`
         );
@@ -19162,7 +19410,7 @@ async function downloadModel(opts) {
         process.stderr.write(`
 Download attempt ${attempt} failed, retrying...
 `);
-        if (existsSync32(tmpPath)) unlinkSync14(tmpPath);
+        if (existsSync33(tmpPath)) unlinkSync15(tmpPath);
       }
     }
   }
@@ -19739,30 +19987,30 @@ __export(session_wrappers_exports, {
   generateSessionWrappers: () => generateSessionWrappers
 });
 import {
-  existsSync as existsSync33,
+  existsSync as existsSync34,
   readFileSync as readFileSync28,
   writeFileSync as writeFileSync24,
-  mkdirSync as mkdirSync23,
+  mkdirSync as mkdirSync24,
   chmodSync as chmodSync4,
   readdirSync as readdirSync10,
-  unlinkSync as unlinkSync15
+  unlinkSync as unlinkSync16
 } from "fs";
 import { execSync as execSync15 } from "child_process";
 import path40 from "path";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 function generateSessionWrappers(packageRoot, homeDir) {
-  const home = homeDir ?? homedir5();
+  const home = homeDir ?? homedir6();
   const binDir = path40.join(home, ".exe-os", "bin");
   const rosterPath = path40.join(home, ".exe-os", "exe-employees.json");
   const shouldMirrorToGlobalBin = homeDir === void 0;
-  mkdirSync23(binDir, { recursive: true });
+  mkdirSync24(binDir, { recursive: true });
   const exeStartDst = path40.join(binDir, "exe-start");
   const candidates = [
     path40.join(packageRoot, "dist", "bin", "exe-start.sh"),
     path40.join(packageRoot, "src", "bin", "exe-start.sh")
   ];
   for (const src of candidates) {
-    if (existsSync33(src)) {
+    if (existsSync34(src)) {
       writeFileSync24(exeStartDst, readFileSync28(src));
       chmodSync4(exeStartDst, 493);
       break;
@@ -19784,7 +20032,7 @@ function generateSessionWrappers(packageRoot, homeDir) {
       try {
         const content = readFileSync28(fPath, "utf8");
         if (content.includes("exe-start")) {
-          unlinkSync15(fPath);
+          unlinkSync16(fPath);
         }
       } catch {
       }
@@ -19816,7 +20064,7 @@ exec "${exeStartDst}" "$0" "$@"
   ];
   let codexLauncher = null;
   for (const c of codexLauncherCandidates) {
-    if (existsSync33(c)) {
+    if (existsSync34(c)) {
       codexLauncher = c;
       break;
     }
@@ -19906,7 +20154,7 @@ __export(setup_wizard_exports, {
   validateModel: () => validateModel
 });
 import crypto13 from "crypto";
-import { existsSync as existsSync34, mkdirSync as mkdirSync24, readFileSync as readFileSync29, writeFileSync as writeFileSync25, unlinkSync as unlinkSync16 } from "fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync25, readFileSync as readFileSync29, writeFileSync as writeFileSync25, unlinkSync as unlinkSync17 } from "fs";
 import os19 from "os";
 import path41 from "path";
 import { createInterface as createInterface4 } from "readline";
@@ -19915,7 +20163,7 @@ function findPackageRoot3() {
   const root = path41.parse(dir).root;
   while (dir !== root) {
     const pkgPath = path41.join(dir, "package.json");
-    if (existsSync34(pkgPath)) {
+    if (existsSync35(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync29(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
@@ -19934,12 +20182,12 @@ function loadSetupState() {
   }
 }
 function saveSetupState(state) {
-  mkdirSync24(path41.dirname(SETUP_STATE_PATH), { recursive: true });
+  mkdirSync25(path41.dirname(SETUP_STATE_PATH), { recursive: true });
   writeFileSync25(SETUP_STATE_PATH, JSON.stringify(state, null, 2));
 }
 function clearSetupState() {
   try {
-    unlinkSync16(SETUP_STATE_PATH);
+    unlinkSync17(SETUP_STATE_PATH);
   } catch {
   }
 }
@@ -19986,9 +20234,9 @@ async function validateModel(log) {
     log(`System memory: ${totalGB.toFixed(0)}GB total, ${freeGB.toFixed(1)}GB free`);
     log("Skipping in-memory model validation (low memory \u2014 will validate on first use).");
     const modelPath = path41.join(MODELS_DIR, LOCAL_FILENAME);
-    if (existsSync34(modelPath)) {
-      const { statSync: statSync9 } = await import("fs");
-      const size = statSync9(modelPath).size;
+    if (existsSync35(modelPath)) {
+      const { statSync: statSync10 } = await import("fs");
+      const size = statSync10(modelPath).size;
       if (size > 300 * 1e6) {
         log(`Model file verified (${(size / 1e6).toFixed(0)} MB).`);
         return;
@@ -20081,7 +20329,7 @@ async function runSetupWizard(opts = {}) {
     if (state.completedSteps.length > 0) {
       log(`Resuming setup from step ${Math.max(...state.completedSteps) + 1}...`);
     }
-    if (existsSync34(LEGACY_LANCE_PATH)) {
+    if (existsSync35(LEGACY_LANCE_PATH)) {
       log("\u26A0 Found v1.0 LanceDB at ~/.exe-os/local.lance");
       log("  v1.1 uses libSQL (SQLite). Your existing memories are not automatically migrated.");
       log("  The old directory will not be modified or deleted.");
@@ -20298,7 +20546,7 @@ async function runSetupWizard(opts = {}) {
       const prefs = { ...existingPrefs };
       log("=== Config Defaults ===");
       log("");
-      const ghosttyDetected = existsSync34(path41.join(os19.homedir(), ".config", "ghostty")) || existsSync34(path41.join(os19.homedir(), "Library", "Application Support", "com.mitchellh.ghostty"));
+      const ghosttyDetected = existsSync35(path41.join(os19.homedir(), ".config", "ghostty")) || existsSync35(path41.join(os19.homedir(), "Library", "Application Support", "com.mitchellh.ghostty"));
       if (ghosttyDetected) {
         const ghosttyAnswer = await ask3(rl, "Detected Ghostty terminal. Use exe-os Ghostty defaults? (Y/n) ");
         prefs.ghostty = ghosttyAnswer.toLowerCase() !== "n";
@@ -20345,7 +20593,7 @@ async function runSetupWizard(opts = {}) {
       let missingIdentities = [];
       for (const emp of roster) {
         const idPath = identityPath2(emp.name);
-        if (!existsSync34(idPath)) {
+        if (!existsSync35(idPath)) {
           missingIdentities.push(emp.name);
         }
       }
@@ -20377,7 +20625,7 @@ async function runSetupWizard(opts = {}) {
           }
           missingIdentities = [];
           for (const emp of roster) {
-            if (!existsSync34(identityPath2(emp.name))) {
+            if (!existsSync35(identityPath2(emp.name))) {
               missingIdentities.push(emp.name);
             }
           }
@@ -20436,7 +20684,7 @@ async function runSetupWizard(opts = {}) {
       const cooIdentityContent = getIdentityTemplate("coo");
       if (cooIdentityContent) {
         const cooIdPath = identityPath2(cooName);
-        mkdirSync24(path41.dirname(cooIdPath), { recursive: true });
+        mkdirSync25(path41.dirname(cooIdPath), { recursive: true });
         const replaced = cooIdentityContent.replace(/agent_id:\s*exe/g, `agent_id: ${cooName}`).replace(/\$\{agent_id\}/g, cooName);
         writeFileSync25(cooIdPath, replaced, "utf-8");
       }
@@ -20554,7 +20802,7 @@ async function runSetupWizard(opts = {}) {
         const ctoIdentityContent = getIdentityTemplate("cto");
         if (ctoIdentityContent) {
           const ctoIdPath = identityPath2(ctoName);
-          mkdirSync24(path41.dirname(ctoIdPath), { recursive: true });
+          mkdirSync25(path41.dirname(ctoIdPath), { recursive: true });
           const replaced = ctoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${ctoName}`).replace(/\$\{agent_id\}/g, ctoName);
           writeFileSync25(ctoIdPath, replaced, "utf-8");
         }
@@ -20577,7 +20825,7 @@ async function runSetupWizard(opts = {}) {
         const cmoIdentityContent = getIdentityTemplate("cmo");
         if (cmoIdentityContent) {
           const cmoIdPath = identityPath2(cmoName);
-          mkdirSync24(path41.dirname(cmoIdPath), { recursive: true });
+          mkdirSync25(path41.dirname(cmoIdPath), { recursive: true });
           const replaced = cmoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${cmoName}`).replace(/\$\{agent_id\}/g, cmoName);
           writeFileSync25(cmoIdPath, replaced, "utf-8");
         }
@@ -20690,7 +20938,7 @@ var init_setup_wizard = __esm({
 
 // src/lib/update-backup.ts
 import { copyFile, readFile as readFile6, readdir as readdir3, writeFile as writeFile7, rm as rm2, mkdir as mkdir7, cp } from "fs/promises";
-import { existsSync as existsSync35 } from "fs";
+import { existsSync as existsSync36 } from "fs";
 import path42 from "path";
 import os20 from "os";
 function resolveDataDir2() {
@@ -20715,14 +20963,14 @@ function externalBackupTargets(homeDir) {
 async function createUpdateBackup(currentVersion, dataDir2, homeDir = os20.homedir()) {
   const dir = dataDir2 ?? resolveDataDir2();
   const backupDir = path42.join(dir, BACKUP_DIR_NAME);
-  if (existsSync35(backupDir)) {
+  if (existsSync36(backupDir)) {
     await rm2(backupDir, { recursive: true, force: true });
   }
   await mkdir7(backupDir, { recursive: true });
   const backedUpFiles = [];
   for (const target of BACKUP_TARGETS) {
     const src = path42.join(dir, target.name);
-    if (!existsSync35(src)) continue;
+    if (!existsSync36(src)) continue;
     const dest = path42.join(backupDir, target.name);
     if (target.type === "file") {
       await copyFile(src, dest);
@@ -20743,7 +20991,7 @@ async function createUpdateBackup(currentVersion, dataDir2, homeDir = os20.homed
   const externalFiles = [];
   const externalDir = path42.join(backupDir, "external");
   for (const target of externalBackupTargets(homeDir)) {
-    if (!existsSync35(target.path)) continue;
+    if (!existsSync36(target.path)) continue;
     await mkdir7(externalDir, { recursive: true });
     await copyFile(target.path, path42.join(externalDir, target.name));
     externalFiles.push(target);
@@ -20764,7 +21012,7 @@ async function restoreFromBackup(dataDir2) {
   const dir = dataDir2 ?? resolveDataDir2();
   const backupDir = path42.join(dir, BACKUP_DIR_NAME);
   const manifestPath = path42.join(backupDir, "manifest.json");
-  if (!existsSync35(manifestPath)) {
+  if (!existsSync36(manifestPath)) {
     throw new Error(
       `No backup found at ${backupDir}. Nothing to restore.`
     );
@@ -20775,7 +21023,7 @@ async function restoreFromBackup(dataDir2) {
   for (const fileName of manifest.files) {
     const src = path42.join(backupDir, fileName);
     const dest = path42.join(dir, fileName);
-    if (!existsSync35(src)) continue;
+    if (!existsSync36(src)) continue;
     const stat2 = await import("fs/promises").then((m) => m.stat(src));
     if (stat2.isDirectory()) {
       await cp(src, dest, { recursive: true, force: true });
@@ -20785,7 +21033,7 @@ async function restoreFromBackup(dataDir2) {
   }
   for (const external of manifest.externalFiles ?? []) {
     const src = path42.join(backupDir, "external", external.name);
-    if (!existsSync35(src)) continue;
+    if (!existsSync36(src)) continue;
     await mkdir7(path42.dirname(external.path), { recursive: true });
     await copyFile(src, external.path);
   }
@@ -20794,7 +21042,7 @@ async function restoreFromBackup(dataDir2) {
 async function deleteBackup(dataDir2) {
   const dir = dataDir2 ?? resolveDataDir2();
   const backupDir = path42.join(dir, BACKUP_DIR_NAME);
-  if (existsSync35(backupDir)) {
+  if (existsSync36(backupDir)) {
     await rm2(backupDir, { recursive: true, force: true });
   }
 }
@@ -21077,7 +21325,7 @@ var init_update = __esm({
 // src/lib/stack-update.ts
 import { execFileSync as execFileSync4, spawnSync } from "child_process";
 import { createVerify, randomBytes as randomBytes2, verify as verifySignature } from "crypto";
-import { copyFileSync as copyFileSync5, existsSync as existsSync36, mkdirSync as mkdirSync25, readdirSync as readdirSync11, readFileSync as readFileSync31, renameSync as renameSync8, writeFileSync as writeFileSync26 } from "fs";
+import { copyFileSync as copyFileSync6, existsSync as existsSync37, mkdirSync as mkdirSync26, readdirSync as readdirSync11, readFileSync as readFileSync31, renameSync as renameSync8, writeFileSync as writeFileSync26 } from "fs";
 import http from "http";
 import https from "https";
 import path44 from "path";
@@ -21116,15 +21364,15 @@ function stableJson(value) {
 }
 function findLatestBackupEnvFile(envFile) {
   const backupDir = path44.join(path44.dirname(envFile), ".exe-stack-backups");
-  if (!existsSync36(backupDir)) return null;
+  if (!existsSync37(backupDir)) return null;
   const backups = readdirSync11(backupDir).filter((name) => name.startsWith("env-") && name.endsWith(".bak")).sort();
   const latest = backups.at(-1);
   return latest ? path44.join(backupDir, latest) : null;
 }
 async function rollbackStackUpdate(options) {
   const exec2 = options.exec ?? defaultExec;
-  const backupEnvFile = options.lockFile && existsSync36(options.lockFile) ? JSON.parse(readFileSync31(options.lockFile, "utf8")).backupEnvFile : void 0;
-  const rollbackEnv = backupEnvFile && existsSync36(backupEnvFile) ? backupEnvFile : findLatestBackupEnvFile(options.envFile);
+  const backupEnvFile = options.lockFile && existsSync37(options.lockFile) ? JSON.parse(readFileSync31(options.lockFile, "utf8")).backupEnvFile : void 0;
+  const rollbackEnv = backupEnvFile && existsSync37(backupEnvFile) ? backupEnvFile : findLatestBackupEnvFile(options.envFile);
   if (!rollbackEnv) throw new Error(`No stack backup env found beside ${options.envFile}`);
   writeFileSync26(options.envFile, readFileSync31(rollbackEnv), { mode: 384 });
   const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
@@ -21283,9 +21531,9 @@ Emergency override requires --break-glass <reason> and writes an audit file.`
 function writeBreakGlassAudit(plan, issues, options) {
   const now2 = options.now ?? (() => /* @__PURE__ */ new Date());
   const stamp = now2().toISOString().replace(/[:.]/g, "-");
-  const defaultDir = existsSync36("exe/output") ? "exe/output" : path44.dirname(options.envFile ?? ".");
+  const defaultDir = existsSync37("exe/output") ? "exe/output" : path44.dirname(options.envFile ?? ".");
   const auditFile = options.breakGlassAuditFile ?? path44.join(defaultDir, `stack-update-break-glass-${stamp}.md`);
-  mkdirSync25(path44.dirname(auditFile), { recursive: true });
+  mkdirSync26(path44.dirname(auditFile), { recursive: true });
   const body = [
     `# Stack Update Break-Glass Audit \u2014 ${now2().toISOString()}`,
     "",
@@ -21332,16 +21580,16 @@ function resolvePackageRoot2() {
     process.cwd()
   ];
   for (const c of candidates) {
-    if (existsSync36(path44.join(c, "package.json")) && existsSync36(path44.join(c, "deploy", "compose", "docker-compose.yml"))) return c;
+    if (existsSync37(path44.join(c, "package.json")) && existsSync37(path44.join(c, "deploy", "compose", "docker-compose.yml"))) return c;
   }
   return process.cwd();
 }
 function copyTemplateIfMissing(srcRel, dest, created) {
-  if (existsSync36(dest)) return;
+  if (existsSync37(dest)) return;
   const src = path44.join(resolvePackageRoot2(), srcRel);
-  if (!existsSync36(src)) throw new Error(`Missing packaged stack template: ${srcRel}. Reinstall/update exe-os and retry.`);
+  if (!existsSync37(src)) throw new Error(`Missing packaged stack template: ${srcRel}. Reinstall/update exe-os and retry.`);
   try {
-    mkdirSync25(path44.dirname(dest), { recursive: true });
+    mkdirSync26(path44.dirname(dest), { recursive: true });
   } catch (err) {
     if (err.code === "EACCES") {
       const dir = path44.dirname(dest);
@@ -21355,12 +21603,12 @@ Then re-run stack-update.`
     }
     throw err;
   }
-  copyFileSync5(src, dest);
+  copyFileSync6(src, dest);
   created.push(dest);
 }
 function installDockerUbuntu(exec2) {
   if (process.platform !== "linux") throw new Error("Docker auto-install is only supported on Linux. Install Docker manually, then retry.");
-  if (!existsSync36("/etc/os-release")) throw new Error("Cannot detect Linux distro; install Docker manually, then retry.");
+  if (!existsSync37("/etc/os-release")) throw new Error("Cannot detect Linux distro; install Docker manually, then retry.");
   const osRelease = readFileSync31("/etc/os-release", "utf8");
   if (!/ID=(ubuntu|debian)|ID_LIKE=.*debian/.test(osRelease)) {
     throw new Error("Docker auto-install currently supports Ubuntu/Debian only. Install Docker manually, then retry.");
@@ -21433,7 +21681,7 @@ async function pairMonitorAgent(hubUrl, licenseKey, domain, envFile) {
     if (!data.token || !data.key) {
       return { paired: false, error: "Monitor hub response missing token or key" };
     }
-    if (existsSync36(envFile)) {
+    if (existsSync37(envFile)) {
       const envRaw = readFileSync31(envFile, "utf8");
       const patched = patchEnv(envRaw, {
         MONITOR_AGENT_TOKEN: data.token,
@@ -21465,10 +21713,10 @@ function bootstrapStackHost(options) {
   copyTemplateIfMissing("deploy/compose/.env.customer.example", options.envFile, createdFiles);
   const brandingDest = path44.join(path44.dirname(options.envFile), "branding.json");
   copyTemplateIfMissing("deploy/compose/gateway.json", path44.join(path44.dirname(options.envFile), "gateway.json"), createdFiles);
-  if (!existsSync36(brandingDest)) writeFileSync26(brandingDest, JSON.stringify({ brandName: "Hygo", productName: "Hygo OS" }, null, 2) + "\n", { mode: 384 });
+  if (!existsSync37(brandingDest)) writeFileSync26(brandingDest, JSON.stringify({ brandName: "Hygo", productName: "Hygo OS" }, null, 2) + "\n", { mode: 384 });
   let envHadPlaceholders = false;
   let envRemainingPlaceholders = [];
-  if (existsSync36(options.envFile)) {
+  if (existsSync37(options.envFile)) {
     const envRaw = readFileSync31(options.envFile, "utf8");
     const hydrated = hydrateEnv(envRaw, options);
     envHadPlaceholders = hydrated.hadPlaceholders;
@@ -21481,8 +21729,8 @@ function bootstrapStackHost(options) {
   return {
     dockerInstalled,
     dockerComposeInstalled,
-    composeFileExists: existsSync36(options.composeFile),
-    envFileExists: existsSync36(options.envFile),
+    composeFileExists: existsSync37(options.composeFile),
+    envFileExists: existsSync37(options.envFile),
     envHadPlaceholders,
     envRemainingPlaceholders,
     licensePresent: !!(options.licenseKey || process.env.EXE_LICENSE_KEY || loadLicense()),
@@ -21558,7 +21806,7 @@ async function runStackUpdate(options) {
   }
   await postDeployAudit(options, "started", plan.targetVersion, previousVersion);
   const backupDir = path44.join(path44.dirname(options.envFile), ".exe-stack-backups");
-  mkdirSync25(backupDir, { recursive: true });
+  mkdirSync26(backupDir, { recursive: true });
   const stamp = now2().toISOString().replace(/[:.]/g, "-");
   const backupEnvFile = path44.join(backupDir, `env-${stamp}.bak`);
   writeFileSync26(backupEnvFile, envRaw, { mode: 384 });
@@ -21613,7 +21861,7 @@ async function fetchImageCredentials(options) {
   return await res.json();
 }
 function readCurrentStackVersion(lockFile) {
-  if (!existsSync36(lockFile)) return void 0;
+  if (!existsSync37(lockFile)) return void 0;
   try {
     const parsed = JSON.parse(readFileSync31(lockFile, "utf8"));
     return parsed.stackVersion;
@@ -21706,10 +21954,10 @@ function defaultStackPaths() {
   const cwdCompose = path44.resolve("docker-compose.yml");
   const cwdEnv = path44.resolve(".env");
   const packagedManifest = path44.join(resolvePackageRoot2(), "deploy", "stack-manifests", "v0.9.json");
-  const manifestRef = process.env.EXE_STACK_MANIFEST || (existsSync36(packagedManifest) ? packagedManifest : "https://update.askexe.com/stack-manifest.json");
+  const manifestRef = process.env.EXE_STACK_MANIFEST || (existsSync37(packagedManifest) ? packagedManifest : "https://update.askexe.com/stack-manifest.json");
   return {
-    composeFile: process.env.EXE_STACK_COMPOSE_FILE || (existsSync36(cwdCompose) ? cwdCompose : "/opt/exe-stack/docker-compose.yml"),
-    envFile: process.env.EXE_STACK_ENV_FILE || (existsSync36(cwdEnv) ? cwdEnv : "/opt/exe-stack/.env"),
+    composeFile: process.env.EXE_STACK_COMPOSE_FILE || (existsSync37(cwdCompose) ? cwdCompose : "/opt/exe-stack/docker-compose.yml"),
+    envFile: process.env.EXE_STACK_ENV_FILE || (existsSync37(cwdEnv) ? cwdEnv : "/opt/exe-stack/.env"),
     manifestRef,
     // Only call update.askexe.com if explicitly configured or if a remote manifest was requested.
     // Packaged manifests keep cold-start installs unblocked even before update-service entitlements are provisioned.
@@ -21723,7 +21971,7 @@ function defaultStackPaths() {
 }
 function loadDefaultPublicKey() {
   if (process.env.EXE_STACK_PUBLIC_KEY) return process.env.EXE_STACK_PUBLIC_KEY;
-  if (process.env.EXE_STACK_PUBLIC_KEY_FILE && existsSync36(process.env.EXE_STACK_PUBLIC_KEY_FILE)) {
+  if (process.env.EXE_STACK_PUBLIC_KEY_FILE && existsSync37(process.env.EXE_STACK_PUBLIC_KEY_FILE)) {
     return readFileSync31(process.env.EXE_STACK_PUBLIC_KEY_FILE, "utf8");
   }
   return void 0;
@@ -28997,11 +29245,11 @@ function Footer() {
       } catch {
       }
       try {
-        const { existsSync: existsSync43 } = await import("fs");
-        const { join } = await import("path");
+        const { existsSync: existsSync44 } = await import("fs");
+        const { join: join2 } = await import("path");
         const home = process.env.HOME ?? "";
-        const pidPath = join(home, ".exe-os", "exed.pid");
-        setDaemon(existsSync43(pidPath) ? "running" : "stopped");
+        const pidPath = join2(home, ".exe-os", "exed.pid");
+        setDaemon(existsSync44(pidPath) ? "running" : "stopped");
       } catch {
         setDaemon("unknown");
       }
@@ -31751,7 +31999,7 @@ var init_bash = __esm({
 import { useState as useState6, useEffect as useEffect8, useMemo as useMemo4, useCallback as useCallback4, useRef as useRef4 } from "react";
 import TextInput from "ink-text-input";
 import path51 from "path";
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 import { Fragment as Fragment2, jsx as jsx7, jsxs as jsxs5 } from "react/jsx-runtime";
 function CommandCenterView({
   onSelectProject,
@@ -31785,13 +32033,13 @@ function CommandCenterView({
         const { createPermissionsFromPreset: createPermissionsFromPreset2, EMPLOYEE_PERMISSIONS: EMPLOYEE_PERMISSIONS2 } = await Promise.resolve().then(() => (init_permissions(), permissions_exports));
         const { getPresetByRole: getPresetByRole2 } = await Promise.resolve().then(() => (init_permission_presets(), permission_presets_exports));
         const { createDefaultHooks: createDefaultHooks2 } = await Promise.resolve().then(() => (init_hooks(), hooks_exports));
-        const { readFileSync: readFileSync39, existsSync: existsSync43 } = await import("fs");
-        const { join } = await import("path");
-        const { homedir: homedir8 } = await import("os");
-        const configPath = join(homedir8(), ".exe-os", "config.json");
+        const { readFileSync: readFileSync39, existsSync: existsSync44 } = await import("fs");
+        const { join: join2 } = await import("path");
+        const { homedir: homedir9 } = await import("os");
+        const configPath = join2(homedir9(), ".exe-os", "config.json");
         let failoverChain = ["anthropic", "opencode", "gemini", "openai"];
         let providerConfigs = {};
-        if (existsSync43(configPath)) {
+        if (existsSync44(configPath)) {
           try {
             const raw = JSON.parse(readFileSync39(configPath, "utf8"));
             if (Array.isArray(raw.failoverChain)) failoverChain = raw.failoverChain;
@@ -31851,10 +32099,10 @@ function CommandCenterView({
         registry.register(BashTool2);
         let agentRole = "CTO";
         try {
-          const markerDir = join(homedir8(), ".exe-os", "session-cache");
+          const markerDir = join2(homedir9(), ".exe-os", "session-cache");
           const agentFiles = (await import("fs")).readdirSync(markerDir).filter((f) => f.startsWith("active-agent-"));
           for (const f of agentFiles) {
-            const data = JSON.parse(readFileSync39(join(markerDir, f), "utf8"));
+            const data = JSON.parse(readFileSync39(join2(markerDir, f), "utf8"));
             if (data.agentRole) {
               agentRole = data.agentRole;
               break;
@@ -31999,7 +32247,7 @@ function CommandCenterView({
       const demoEntries = DEMO_PROJECTS.map((p) => ({
         projectName: p.projectName,
         exeSession: p.exeSession,
-        projectDir: path51.join(homedir6(), p.projectName),
+        projectDir: path51.join(homedir7(), p.projectName),
         employeeCount: p.employees.length,
         activeCount: p.employees.filter((e) => e.status === "active").length,
         memoryCount: p.employees.length * 4e3,
@@ -32037,8 +32285,8 @@ function CommandCenterView({
         const { listSessions: listSessions2 } = await Promise.resolve().then(() => (init_session_registry(), session_registry_exports));
         const { listTmuxSessions: listTmuxSessions2, inTmux: inTmux2 } = await Promise.resolve().then(() => (init_tmux_status(), tmux_status_exports));
         const { loadEmployees: loadEmployees2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
-        const { existsSync: existsSync43 } = await import("fs");
-        const { join } = await import("path");
+        const { existsSync: existsSync44 } = await import("fs");
+        const { join: join2 } = await import("path");
         const client = getClient2();
         if (!client) {
           setDbError(true);
@@ -32108,7 +32356,7 @@ function CommandCenterView({
           }
           const memoryCount = memoryCounts.get(name) ?? 0;
           const openTaskCount = openTaskCounts.get(name) ?? 0;
-          const hasGit = projectDir ? existsSync43(join(projectDir, ".git")) : false;
+          const hasGit = projectDir ? existsSync44(join2(projectDir, ".git")) : false;
           const type = hasGit ? "code" : memoryCount > 0 ? "code" : "automation";
           projectList.push({
             projectName: name,
@@ -32132,8 +32380,8 @@ function CommandCenterView({
         const totalResult = await client.execute("SELECT COUNT(*) as cnt FROM memories");
         setHealth((h) => ({ ...h, memories: Number(totalResult.rows[0]?.cnt ?? 0) }));
         try {
-          const pidPath = join(process.env.HOME ?? "", ".exe-os", "exed.pid");
-          setHealth((h) => ({ ...h, daemon: existsSync43(pidPath) ? "running" : "stopped" }));
+          const pidPath = join2(process.env.HOME ?? "", ".exe-os", "exed.pid");
+          setHealth((h) => ({ ...h, daemon: existsSync44(pidPath) ? "running" : "stopped" }));
         } catch {
         }
         const activityResult = await client.execute(
@@ -33004,7 +33252,7 @@ var init_useOrchestrator = __esm({
 // src/tui/views/Sessions.tsx
 import React19, { useState as useState9, useEffect as useEffect11, useCallback as useCallback6 } from "react";
 import path52 from "path";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 import { jsx as jsx9, jsxs as jsxs7 } from "react/jsx-runtime";
 function isCoordinatorEntry(entry) {
   return entry.role.toLowerCase() === "coo" || isCoordinatorName(entry.name);
@@ -33041,7 +33289,7 @@ function SessionsView({
     if (demo) {
       setProjects(DEMO_PROJECTS.map((p) => ({
         ...p,
-        projectDir: path52.join(homedir7(), p.projectName),
+        projectDir: path52.join(homedir8(), p.projectName),
         employees: p.employees.map((e) => ({ ...e, attached: e.status === "active" }))
       })));
       return;
@@ -34256,11 +34504,11 @@ async function loadGatewayConfig() {
     state.running = false;
   }
   try {
-    const { existsSync: existsSync43, readFileSync: readFileSync39 } = await import("fs");
-    const { join } = await import("path");
+    const { existsSync: existsSync44, readFileSync: readFileSync39 } = await import("fs");
+    const { join: join2 } = await import("path");
     const home = process.env.HOME ?? "";
-    const configPath = join(home, ".exe-os", "gateway.json");
-    if (existsSync43(configPath)) {
+    const configPath = join2(home, ".exe-os", "gateway.json");
+    if (existsSync44(configPath)) {
       const raw = JSON.parse(readFileSync39(configPath, "utf8"));
       state.port = raw.port ?? 3100;
       state.gatewayUrl = raw.gatewayUrl ?? "";
@@ -34859,11 +35107,11 @@ function TeamView({ onBack, onViewSessions }) {
         setMembers(teamData);
         setDbError(null);
         try {
-          const { existsSync: existsSync43, readFileSync: readFileSync39 } = await import("fs");
-          const { join } = await import("path");
+          const { existsSync: existsSync44, readFileSync: readFileSync39 } = await import("fs");
+          const { join: join2 } = await import("path");
           const home = process.env.HOME ?? "";
-          const gatewayConfig = join(home, ".exe-os", "gateway.json");
-          if (existsSync43(gatewayConfig)) {
+          const gatewayConfig = join2(home, ".exe-os", "gateway.json");
+          if (existsSync44(gatewayConfig)) {
             const raw = JSON.parse(readFileSync39(gatewayConfig, "utf8"));
             if (raw.agents && raw.agents.length > 0) {
               setExternals(raw.agents.map((a) => ({
@@ -35672,12 +35920,12 @@ function SettingsView({ onBack }) {
     }
     setProviders(providerList);
     try {
-      const { existsSync: existsSync43 } = await import("fs");
-      const { join } = await import("path");
+      const { existsSync: existsSync44 } = await import("fs");
+      const { join: join2 } = await import("path");
       const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
       const cfg = await loadConfig2();
       const home = process.env.HOME ?? "";
-      const hasKey = existsSync43(join(home, ".exe-os", "master.key"));
+      const hasKey = existsSync44(join2(home, ".exe-os", "master.key"));
       if (cfg.cloud) {
         setCloud({
           configured: true,
@@ -35687,10 +35935,10 @@ function SettingsView({ onBack }) {
       } else {
         setCloud({ configured: false, endpoint: "", apiKey: "" });
       }
-      const pidPath = join(home, ".exe-os", "exed.pid");
+      const pidPath = join2(home, ".exe-os", "exed.pid");
       let daemon = "unknown";
       try {
-        daemon = existsSync43(pidPath) ? "running" : "stopped";
+        daemon = existsSync44(pidPath) ? "running" : "stopped";
       } catch {
       }
       let version = "unknown";
@@ -36565,7 +36813,7 @@ __export(code_context_index_exports, {
 });
 import crypto14 from "crypto";
 import path53 from "path";
-import { existsSync as existsSync38, mkdirSync as mkdirSync26, readFileSync as readFileSync34, readdirSync as readdirSync12, statSync as statSync8, writeFileSync as writeFileSync27 } from "fs";
+import { existsSync as existsSync39, mkdirSync as mkdirSync27, readFileSync as readFileSync34, readdirSync as readdirSync12, statSync as statSync9, writeFileSync as writeFileSync27 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
 function vectorStorePath(projectRoot) {
   const rootHash = hashText(projectRoot).slice(0, 16);
@@ -36573,7 +36821,7 @@ function vectorStorePath(projectRoot) {
 }
 function loadVectorStore(projectRoot) {
   const file = vectorStorePath(projectRoot);
-  if (!existsSync38(file)) return null;
+  if (!existsSync39(file)) return null;
   try {
     const parsed = JSON.parse(readFileSync34(file, "utf8"));
     if (parsed.version !== VECTOR_STORE_VERSION) return null;
@@ -36646,7 +36894,7 @@ function hashText(text) {
 }
 function indexDir() {
   const dir = path53.join(EXE_AI_DIR, "code-context");
-  mkdirSync26(dir, { recursive: true });
+  mkdirSync27(dir, { recursive: true });
   return dir;
 }
 function getCodeContextIndexPath(projectRoot) {
@@ -36709,7 +36957,7 @@ function symbolId(filePath, chunk) {
 }
 function loadIndex(projectRoot) {
   const file = getCodeContextIndexPath(projectRoot);
-  if (!existsSync38(file)) return null;
+  if (!existsSync39(file)) return null;
   try {
     const parsed = JSON.parse(readFileSync34(file, "utf8"));
     if (parsed.version !== INDEX_VERSION || parsed.projectRoot !== projectRoot) return null;
@@ -36725,7 +36973,7 @@ function buildFileRecord(projectRoot, relPath, allFiles, previous) {
   const absPath = path53.join(projectRoot, relPath);
   let stat2;
   try {
-    stat2 = statSync8(absPath);
+    stat2 = statSync9(absPath);
   } catch {
     return { record: null, reused: false };
   }
@@ -36799,7 +37047,7 @@ function loadOrBuildCodeContextIndex(options = {}) {
         const existing = loaded.files[normalized];
         if (!existing) return false;
         try {
-          const stat2 = statSync8(path53.join(projectRoot, normalized));
+          const stat2 = statSync9(path53.join(projectRoot, normalized));
           return stat2.mtimeMs === existing.mtimeMs && stat2.size === existing.size;
         } catch {
           return false;
@@ -37314,7 +37562,7 @@ __export(installer_exports2, {
   verifyOpenCodeHooks: () => verifyOpenCodeHooks
 });
 import { readFile as readFile7, writeFile as writeFile8, mkdir as mkdir8 } from "fs/promises";
-import { existsSync as existsSync39, readFileSync as readFileSync35 } from "fs";
+import { existsSync as existsSync40, readFileSync as readFileSync35 } from "fs";
 import path54 from "path";
 import os22 from "os";
 async function registerOpenCodeMcp(packageRoot, homeDir = os22.homedir()) {
@@ -37323,7 +37571,7 @@ async function registerOpenCodeMcp(packageRoot, homeDir = os22.homedir()) {
   const configPath = path54.join(configDir, "opencode.json");
   await mkdir8(configDir, { recursive: true });
   let config = {};
-  if (existsSync39(configPath)) {
+  if (existsSync40(configPath)) {
     try {
       config = JSON.parse(await readFile7(configPath, "utf-8"));
     } catch {
@@ -37358,7 +37606,7 @@ async function installOpenCodePlugin(packageRoot, homeDir = os22.homedir()) {
     /__PACKAGE_ROOT__/g,
     packageRoot.replace(/\\/g, "\\\\")
   );
-  if (existsSync39(pluginPath)) {
+  if (existsSync40(pluginPath)) {
     const existing = await readFile7(pluginPath, "utf-8");
     if (existing === pluginContent) {
       return false;
@@ -37370,14 +37618,14 @@ async function installOpenCodePlugin(packageRoot, homeDir = os22.homedir()) {
 function verifyOpenCodeHooks(homeDir = os22.homedir()) {
   const configPath = path54.join(homeDir, ".config", "opencode", "opencode.json");
   const pluginPath = path54.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
-  if (!existsSync39(configPath)) return false;
+  if (!existsSync40(configPath)) return false;
   try {
     const config = JSON.parse(readFileSync35(configPath, "utf-8"));
     if (!config.mcp?.["exe-os"]?.enabled) return false;
   } catch {
     return false;
   }
-  if (!existsSync39(pluginPath)) return false;
+  if (!existsSync40(pluginPath)) return false;
   try {
     const plugin = readFileSync35(pluginPath, "utf-8");
     if (!plugin.includes(EXE_HOOK_FILES.postToolCombined)) return false;
@@ -37421,7 +37669,7 @@ __export(installer_exports3, {
   verifyCodexHooks: () => verifyCodexHooks
 });
 import { readFile as readFile8, writeFile as writeFile9, mkdir as mkdir9 } from "fs/promises";
-import { existsSync as existsSync40, readFileSync as readFileSync36 } from "fs";
+import { existsSync as existsSync41, readFileSync as readFileSync36 } from "fs";
 import path55 from "path";
 import os23 from "os";
 async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
@@ -37433,7 +37681,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
   await mkdir9(codexDir, { recursive: true });
   await mkdir9(logsDir, { recursive: true });
   let hooksJson = {};
-  if (existsSync40(hooksPath)) {
+  if (existsSync41(hooksPath)) {
     try {
       hooksJson = JSON.parse(await readFile8(hooksPath, "utf-8"));
     } catch {
@@ -37542,7 +37790,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
 }
 function verifyCodexHooks(homeDir = os23.homedir()) {
   const hooksPath = path55.join(homeDir, ".codex", "hooks.json");
-  if (!existsSync40(hooksPath)) return false;
+  if (!existsSync41(hooksPath)) return false;
   try {
     const hooksJson = JSON.parse(readFileSync36(hooksPath, "utf-8"));
     if (!hooksJson.hooks) return false;
@@ -37580,7 +37828,7 @@ async function installCodexStatusLine(homeDir = os23.homedir()) {
   const configPath = path55.join(codexDir, "config.toml");
   await mkdir9(codexDir, { recursive: true });
   let content = "";
-  if (existsSync40(configPath)) {
+  if (existsSync41(configPath)) {
     content = await readFile8(configPath, "utf-8");
     if (/\[tui\][\s\S]*?status_line\s*=/.test(content)) {
       return "already-configured";
@@ -37637,7 +37885,7 @@ async function registerCodexMcpServer(packageRoot, homeDir = os23.homedir()) {
   void packageRoot;
   await mkdir9(codexDir, { recursive: true });
   let content = "";
-  if (existsSync40(configPath)) {
+  if (existsSync41(configPath)) {
     content = await readFile8(configPath, "utf-8");
   }
   const sectionHeader = "[mcp_servers.exe-os]";
@@ -37665,7 +37913,7 @@ async function ensureCodexHooksFeature(homeDir = os23.homedir()) {
   const configPath = path55.join(homeDir, ".codex", "config.toml");
   await mkdir9(path55.join(homeDir, ".codex"), { recursive: true });
   let content = "";
-  if (existsSync40(configPath)) {
+  if (existsSync41(configPath)) {
     content = await readFile8(configPath, "utf-8");
   }
   if (/\[features\][\s\S]*?codex_hooks\s*=\s*true/.test(content)) {
@@ -37740,11 +37988,11 @@ __export(mcp_diagnostics_exports, {
   diagnoseClaudeMcpConfig: () => diagnoseClaudeMcpConfig,
   formatMcpDiagnosticReport: () => formatMcpDiagnosticReport
 });
-import { existsSync as existsSync41, readFileSync as readFileSync37 } from "fs";
+import { existsSync as existsSync42, readFileSync as readFileSync37 } from "fs";
 import path56 from "path";
 import os24 from "os";
 function readJson(filePath) {
-  if (!existsSync41(filePath)) return null;
+  if (!existsSync42(filePath)) return null;
   try {
     return JSON.parse(readFileSync37(filePath, "utf8"));
   } catch {
@@ -37763,7 +38011,7 @@ function findAncestorMcpJsons2(cwd2, homeDir) {
   const stop = path56.resolve(homeDir);
   while (dir !== root) {
     const candidate = path56.join(dir, ".mcp.json");
-    if (existsSync41(candidate)) files.push(candidate);
+    if (existsSync42(candidate)) files.push(candidate);
     if (dir === stop) break;
     dir = path56.dirname(dir);
   }
@@ -37940,7 +38188,7 @@ var init_mcp_diagnostics = __esm({
 });
 
 // src/bin/cli.ts
-import { existsSync as existsSync42, readFileSync as readFileSync38, writeFileSync as writeFileSync28, readdirSync as readdirSync13, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync43, readFileSync as readFileSync38, writeFileSync as writeFileSync28, readdirSync as readdirSync13, rmSync as rmSync2 } from "fs";
 import path57 from "path";
 import os25 from "os";
 var args = process.argv.slice(2);
@@ -38194,7 +38442,7 @@ ID: ${result.id}`);
 } else {
   const claudeDir = path57.join(os25.homedir(), ".claude");
   const settingsPath = path57.join(claudeDir, "settings.json");
-  const hasClaudeCode = existsSync42(settingsPath) && (() => {
+  const hasClaudeCode = existsSync43(settingsPath) && (() => {
     try {
       const raw = readFileSync38(settingsPath, "utf8");
       return raw.includes("exe-os") || raw.includes("exe-mem");
@@ -38207,7 +38455,7 @@ ID: ${result.id}`);
     let cooName = DEFAULT_COORDINATOR_TEMPLATE_NAME2;
     try {
       const rosterPath = path57.join(os25.homedir(), ".exe-os", "exe-employees.json");
-      if (existsSync42(rosterPath)) {
+      if (existsSync43(rosterPath)) {
         const roster = JSON.parse(readFileSync38(rosterPath, "utf8"));
         const coo = roster.find((e) => e.role === "COO");
         if (coo) cooName = coo.name;
@@ -38365,7 +38613,7 @@ async function runClaudeCheck() {
   const settingsPath = path57.join(claudeDir, "settings.json");
   const claudeJsonPath = path57.join(os25.homedir(), ".claude.json");
   let ok = true;
-  if (existsSync42(settingsPath)) {
+  if (existsSync43(settingsPath)) {
     let settings;
     try {
       settings = JSON.parse(readFileSync38(settingsPath, "utf8"));
@@ -38394,7 +38642,7 @@ async function runClaudeCheck() {
     console.log("\x1B[31m\u2717\x1B[0m settings.json not found");
     ok = false;
   }
-  if (existsSync42(claudeJsonPath)) {
+  if (existsSync43(claudeJsonPath)) {
     let claudeJson;
     try {
       claudeJson = JSON.parse(readFileSync38(claudeJsonPath, "utf8"));
@@ -38431,7 +38679,7 @@ async function runClaudeCheck() {
     console.log("\x1B[32m\u2713\x1B[0m No .mcp.json/project MCP name collisions detected");
   }
   const skillsDir = path57.join(claudeDir, "skills");
-  if (existsSync42(skillsDir)) {
+  if (existsSync43(skillsDir)) {
     console.log("\x1B[32m\u2713\x1B[0m Slash skills directory exists");
   } else {
     console.log("\x1B[31m\u2717\x1B[0m Slash skills directory missing");
@@ -38462,7 +38710,7 @@ async function runClaudeUninstall(flags = []) {
   let removed = 0;
   const log = (msg) => console.log(dryRun ? `[dry-run] ${msg}` : msg);
   let settings = {};
-  if (existsSync42(settingsPath)) {
+  if (existsSync43(settingsPath)) {
     try {
       settings = JSON.parse(readFileSync38(settingsPath, "utf8"));
     } catch {
@@ -38509,7 +38757,7 @@ async function runClaudeUninstall(flags = []) {
       removed++;
     }
   }
-  if (existsSync42(claudeJsonPath)) {
+  if (existsSync43(claudeJsonPath)) {
     const raw = readFileSync38(claudeJsonPath, "utf8");
     if (raw.length > 1e6) {
       console.error("claude.json exceeds 1 MB \u2014 skipping parse.");
@@ -38540,7 +38788,7 @@ async function runClaudeUninstall(flags = []) {
     }
   }
   const skillsDir = path57.join(claudeDir, "skills");
-  if (existsSync42(skillsDir)) {
+  if (existsSync43(skillsDir)) {
     let skillCount = 0;
     try {
       const entries = readdirSync13(skillsDir);
@@ -38559,7 +38807,7 @@ async function runClaudeUninstall(flags = []) {
     }
   }
   const claudeMdPath = path57.join(claudeDir, "CLAUDE.md");
-  if (existsSync42(claudeMdPath)) {
+  if (existsSync43(claudeMdPath)) {
     const content = readFileSync38(claudeMdPath, "utf8");
     const startMarker = "<!-- exe-os:orchestration-start -->";
     const endMarker = "<!-- exe-os:orchestration-end -->";
@@ -38573,13 +38821,13 @@ async function runClaudeUninstall(flags = []) {
     }
   }
   const agentsDir = path57.join(claudeDir, "agents");
-  if (existsSync42(agentsDir)) {
+  if (existsSync43(agentsDir)) {
     let agentCount = 0;
     try {
       const entries = readdirSync13(agentsDir).filter((f) => f.endsWith(".md"));
       let knownNames = /* @__PURE__ */ new Set();
       const rosterPath = path57.join(exeOsDir, "exe-employees.json");
-      if (existsSync42(rosterPath)) {
+      if (existsSync43(rosterPath)) {
         try {
           const roster = JSON.parse(readFileSync38(rosterPath, "utf8"));
           knownNames = new Set(roster.map((e) => e.name));
@@ -38601,13 +38849,13 @@ async function runClaudeUninstall(flags = []) {
     }
   }
   const projectsDir = path57.join(claudeDir, "projects");
-  if (existsSync42(projectsDir)) {
+  if (existsSync43(projectsDir)) {
     let projectCount = 0;
     try {
       const projects = readdirSync13(projectsDir);
       for (const proj of projects) {
         const projSettings = path57.join(projectsDir, proj, "settings.json");
-        if (!existsSync42(projSettings)) continue;
+        if (!existsSync43(projSettings)) continue;
         try {
           const pSettings = JSON.parse(readFileSync38(projSettings, "utf8"));
           let changed = false;
@@ -38646,7 +38894,7 @@ async function runClaudeUninstall(flags = []) {
     const binDir = path57.dirname(exeBinPath);
     let symlinkCount = 0;
     const rosterPath = path57.join(exeOsDir, "exe-employees.json");
-    if (existsSync42(rosterPath)) {
+    if (existsSync43(rosterPath)) {
       const roster = JSON.parse(readFileSync38(rosterPath, "utf8"));
       const { DEFAULT_COORDINATOR_TEMPLATE_NAME: DEFAULT_COORDINATOR_TEMPLATE_NAME2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
       const coordinatorName = roster.find((e) => e.role?.toLowerCase() === "coo")?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME2;
@@ -38654,7 +38902,7 @@ async function runClaudeUninstall(flags = []) {
         if (emp.name === coordinatorName) continue;
         for (const suffix of ["", "-opencode"]) {
           const linkPath = path57.join(binDir, `${emp.name}${suffix}`);
-          if (existsSync42(linkPath)) {
+          if (existsSync43(linkPath)) {
             if (!dryRun) rmSync2(linkPath, { force: true });
             symlinkCount++;
           }
@@ -38667,7 +38915,7 @@ async function runClaudeUninstall(flags = []) {
     }
   } catch {
   }
-  if (purge && existsSync42(exeOsDir)) {
+  if (purge && existsSync43(exeOsDir)) {
     if (!dryRun) {
       process.stdout.write("\x1B[33m\u26A0 This will delete all memories, identities, and agent data.\x1B[0m\n");
       process.stdout.write("  Removing ~/.exe-os...\n");