@askexenow/exe-os 0.9.111 → 0.9.113

package/dist/bin/exe-start-opencode.js

@@ -395,11 +395,168 @@ var init_config = __esm({
   }
 });
 
+// src/lib/runtime-table.ts
+var RUNTIME_TABLE, DEFAULT_RUNTIME;
+var init_runtime_table = __esm({
+  "src/lib/runtime-table.ts"() {
+    "use strict";
+    RUNTIME_TABLE = {
+      codex: {
+        binary: "codex",
+        launchMode: "interactive",
+        autoApproveFlag: "--dangerously-bypass-approvals-and-sandbox",
+        inlineFlag: "--no-alt-screen",
+        apiKeyEnv: "OPENAI_API_KEY",
+        defaultModel: "gpt-5.5"
+      },
+      opencode: {
+        binary: "opencode",
+        launchMode: "exec",
+        autoApproveFlag: "--dangerously-skip-permissions",
+        inlineFlag: "",
+        apiKeyEnv: "ANTHROPIC_API_KEY",
+        defaultModel: "anthropic/claude-sonnet-4-6"
+      }
+    };
+    DEFAULT_RUNTIME = "claude";
+  }
+});
+
+// src/lib/agent-config.ts
+var agent_config_exports = {};
+__export(agent_config_exports, {
+  AGENT_CONFIG_PATH: () => AGENT_CONFIG_PATH,
+  DEFAULT_MODELS: () => DEFAULT_MODELS,
+  KNOWN_RUNTIMES: () => KNOWN_RUNTIMES,
+  RUNTIME_LABELS: () => RUNTIME_LABELS,
+  clearAgentRuntime: () => clearAgentRuntime,
+  getAgentRuntime: () => getAgentRuntime,
+  loadAgentConfig: () => loadAgentConfig,
+  saveAgentConfig: () => saveAgentConfig,
+  setAgentMcps: () => setAgentMcps,
+  setAgentRuntime: () => setAgentRuntime
+});
+import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync3 } from "fs";
+import path2 from "path";
+function loadAgentConfig() {
+  if (!existsSync3(AGENT_CONFIG_PATH)) return {};
+  try {
+    return JSON.parse(readFileSync2(AGENT_CONFIG_PATH, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function saveAgentConfig(config) {
+  const dir = path2.dirname(AGENT_CONFIG_PATH);
+  ensurePrivateDirSync(dir);
+  writeFileSync(AGENT_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  enforcePrivateFileSync(AGENT_CONFIG_PATH);
+}
+function getAgentRuntime(agentId) {
+  const config = loadAgentConfig();
+  const entry = config[agentId];
+  if (entry) return entry;
+  const orgDefault = config["default"];
+  if (orgDefault) return orgDefault;
+  return { runtime: DEFAULT_RUNTIME, model: DEFAULT_MODELS[DEFAULT_RUNTIME] };
+}
+function setAgentRuntime(agentId, runtime, model, reasoning_effort, mcps) {
+  const knownModels = KNOWN_RUNTIMES[runtime];
+  if (!knownModels) {
+    return {
+      ok: false,
+      error: `Unknown runtime "${runtime}". Valid: ${Object.keys(KNOWN_RUNTIMES).join(", ")}`
+    };
+  }
+  if (!knownModels.includes(model)) {
+    return {
+      ok: false,
+      error: `Unknown model "${model}" for runtime "${runtime}". Valid: ${knownModels.join(", ")}`
+    };
+  }
+  const config = loadAgentConfig();
+  const existing = config[agentId];
+  const entry = { runtime, model };
+  if (reasoning_effort) entry.reasoning_effort = reasoning_effort;
+  if (mcps !== void 0) {
+    entry.mcps = mcps.includes("exe-os") ? mcps : ["exe-os", ...mcps];
+  } else if (existing?.mcps) {
+    entry.mcps = existing.mcps;
+  }
+  config[agentId] = entry;
+  saveAgentConfig(config);
+  return { ok: true };
+}
+function setAgentMcps(agentId, mcps) {
+  const config = loadAgentConfig();
+  const existing = config[agentId] ?? getAgentRuntime(agentId);
+  existing.mcps = mcps.includes("exe-os") ? mcps : ["exe-os", ...mcps];
+  config[agentId] = existing;
+  saveAgentConfig(config);
+  return { ok: true };
+}
+function clearAgentRuntime(agentId) {
+  const config = loadAgentConfig();
+  delete config[agentId];
+  saveAgentConfig(config);
+}
+var AGENT_CONFIG_PATH, KNOWN_RUNTIMES, RUNTIME_LABELS, DEFAULT_MODELS;
+var init_agent_config = __esm({
+  "src/lib/agent-config.ts"() {
+    "use strict";
+    init_config();
+    init_runtime_table();
+    init_secure_files();
+    AGENT_CONFIG_PATH = path2.join(EXE_AI_DIR, "agent-config.json");
+    KNOWN_RUNTIMES = {
+      claude: ["claude-opus-4.6", "claude-opus-4", "claude-sonnet-4.6", "claude-sonnet-4", "claude-haiku-4.5"],
+      codex: ["gpt-5.4", "gpt-5.5", "gpt-5.3-codex-spark", "o3", "o4-mini"],
+      opencode: ["anthropic/claude-sonnet-4-6", "openai/gpt-5.4", "google/gemini-2.5-pro", "deepseek/deepseek-r3", "minimax/minimax-m2.5"]
+    };
+    RUNTIME_LABELS = {
+      claude: "Claude Code (Anthropic)",
+      codex: "Codex (OpenAI)",
+      opencode: "OpenCode (open source)"
+    };
+    DEFAULT_MODELS = {
+      claude: "claude-opus-4.6",
+      codex: RUNTIME_TABLE.codex?.defaultModel ?? "gpt-5.4",
+      opencode: RUNTIME_TABLE.opencode?.defaultModel ?? "anthropic/claude-sonnet-4-6"
+    };
+  }
+});
+
 // src/lib/employees.ts
+var employees_exports = {};
+__export(employees_exports, {
+  COORDINATOR_ROLE: () => COORDINATOR_ROLE,
+  DEFAULT_COORDINATOR_TEMPLATE_NAME: () => DEFAULT_COORDINATOR_TEMPLATE_NAME,
+  EMPLOYEES_PATH: () => EMPLOYEES_PATH,
+  addEmployee: () => addEmployee,
+  baseAgentName: () => baseAgentName,
+  canCoordinate: () => canCoordinate,
+  getCoordinatorEmployee: () => getCoordinatorEmployee,
+  getCoordinatorName: () => getCoordinatorName,
+  getEmployee: () => getEmployee,
+  getEmployeeByRole: () => getEmployeeByRole,
+  getEmployeeNamesByRole: () => getEmployeeNamesByRole,
+  hasRole: () => hasRole,
+  hireEmployee: () => hireEmployee,
+  isCoordinatorName: () => isCoordinatorName,
+  isCoordinatorRole: () => isCoordinatorRole,
+  isMultiInstance: () => isMultiInstance,
+  loadEmployees: () => loadEmployees,
+  loadEmployeesSync: () => loadEmployeesSync,
+  normalizeRole: () => normalizeRole,
+  normalizeRosterCase: () => normalizeRosterCase,
+  registerBinSymlinks: () => registerBinSymlinks,
+  saveEmployees: () => saveEmployees,
+  validateEmployeeName: () => validateEmployeeName
+});
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { existsSync as existsSync3, symlinkSync, readlinkSync, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
+import { existsSync as existsSync4, symlinkSync, readlinkSync, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
 import { execSync } from "child_process";
-import path2 from "path";
+import path3 from "path";
 import os2 from "os";
 function normalizeRole(role) {
   return (role ?? "").trim().toLowerCase();
@@ -413,10 +570,47 @@ function getCoordinatorEmployee(employees) {
 function getCoordinatorName(employees = loadEmployeesSync()) {
   return getCoordinatorEmployee(employees)?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME;
 }
+function isCoordinatorName(agentName, employees = loadEmployeesSync()) {
+  if (!agentName) return false;
+  return agentName.toLowerCase() === getCoordinatorName(employees).toLowerCase();
+}
+function canCoordinate(agentName, agentRole, employees = loadEmployeesSync()) {
+  return agentName === "default" || isCoordinatorRole(agentRole) || isCoordinatorName(agentName, employees);
+}
+function validateEmployeeName(name) {
+  if (!name) {
+    return { valid: false, error: "Name is required" };
+  }
+  if (name.length > 32) {
+    return { valid: false, error: "Name must be 32 characters or fewer" };
+  }
+  if (!/^[a-z][a-z0-9]*$/.test(name)) {
+    return {
+      valid: false,
+      error: "Name must start with a letter and contain only lowercase alphanumeric characters"
+    };
+  }
+  return { valid: true };
+}
+async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
+  if (!existsSync4(employeesPath)) {
+    return [];
+  }
+  const raw = await readFile2(employeesPath, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return [];
+  }
+}
+async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
+  await mkdir2(path3.dirname(employeesPath), { recursive: true });
+  await writeFile2(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
+}
 function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync3(employeesPath)) return [];
+  if (!existsSync4(employeesPath)) return [];
   try {
-    return JSON.parse(readFileSync2(employeesPath, "utf-8"));
+    return JSON.parse(readFileSync3(employeesPath, "utf-8"));
   } catch {
     return [];
   }
@@ -424,6 +618,19 @@ function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
 function getEmployee(employees, name) {
   return employees.find((e) => e.name.toLowerCase() === name.toLowerCase());
 }
+function getEmployeeByRole(employees, role) {
+  const lower = role.toLowerCase();
+  return employees.find((e) => e.role.toLowerCase() === lower);
+}
+function getEmployeeNamesByRole(employees, role) {
+  const lower = role.toLowerCase();
+  return employees.filter((e) => e.role.toLowerCase() === lower).map((e) => e.name);
+}
+function hasRole(agentName, role) {
+  const employees = loadEmployeesSync();
+  const emp = getEmployee(employees, agentName);
+  return emp ? emp.role.toLowerCase() === role.toLowerCase() : false;
+}
 function baseAgentName(name, employees) {
   const match = name.match(/^([a-zA-Z]+)\d+$/);
   if (!match) return name;
@@ -432,21 +639,153 @@ function baseAgentName(name, employees) {
   if (getEmployee(roster, base)) return base;
   return name;
 }
-var EMPLOYEES_PATH, DEFAULT_COORDINATOR_TEMPLATE_NAME, COORDINATOR_ROLE, IDENTITY_DIR;
+function isMultiInstance(agentName, employees) {
+  const roster = employees ?? loadEmployeesSync();
+  const emp = getEmployee(roster, agentName);
+  if (!emp) return false;
+  return MULTI_INSTANCE_ROLES.has(emp.role.toLowerCase());
+}
+function addEmployee(employees, employee) {
+  const { systemPrompt: _legacyPrompt, ...rest } = employee;
+  const normalized = { ...rest, name: employee.name.toLowerCase() };
+  if (employees.some((e) => e.name.toLowerCase() === normalized.name)) {
+    throw new Error(`Employee '${normalized.name}' already exists`);
+  }
+  return [...employees, normalized];
+}
+function appendToCoordinatorTeam(employee) {
+  const coordinator = getCoordinatorEmployee(loadEmployeesSync());
+  if (!coordinator) return;
+  const idPath = path3.join(IDENTITY_DIR, `${coordinator.name}.md`);
+  if (!existsSync4(idPath)) return;
+  const content = readFileSync3(idPath, "utf-8");
+  if (content.includes(`**${capitalize(employee.name)}`)) return;
+  const teamMatch = content.match(TEAM_SECTION_RE);
+  if (!teamMatch || teamMatch.index === void 0) return;
+  const afterTeam = content.slice(teamMatch.index + teamMatch[0].length);
+  const nextHeading = afterTeam.match(/\n## /);
+  const entry = `
+**${capitalize(employee.name)} (${employee.role}):** Newly hired. Update this description as the role develops.
+`;
+  let updated;
+  if (nextHeading && nextHeading.index !== void 0) {
+    const insertAt = teamMatch.index + teamMatch[0].length + nextHeading.index;
+    updated = content.slice(0, insertAt) + entry + content.slice(insertAt);
+  } else {
+    updated = content.trimEnd() + "\n" + entry;
+  }
+  writeFileSync2(idPath, updated, "utf-8");
+}
+function capitalize(s) {
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}
+async function hireEmployee(employee) {
+  const employees = await loadEmployees();
+  const updated = addEmployee(employees, employee);
+  await saveEmployees(updated);
+  try {
+    appendToCoordinatorTeam(employee);
+  } catch {
+  }
+  try {
+    const { loadAgentConfig: loadAgentConfig2, saveAgentConfig: saveAgentConfig2 } = await Promise.resolve().then(() => (init_agent_config(), agent_config_exports));
+    const config = loadAgentConfig2();
+    const name = employee.name.toLowerCase();
+    if (!config[name] && config["default"]) {
+      config[name] = { ...config["default"] };
+      saveAgentConfig2(config);
+    }
+  } catch {
+  }
+  return updated;
+}
+async function normalizeRosterCase(rosterPath) {
+  const employees = await loadEmployees(rosterPath);
+  let changed = false;
+  for (const emp of employees) {
+    if (emp.name !== emp.name.toLowerCase()) {
+      const oldName = emp.name;
+      emp.name = emp.name.toLowerCase();
+      changed = true;
+      try {
+        const identityDir = path3.join(os2.homedir(), ".exe-os", "identity");
+        const oldPath = path3.join(identityDir, `${oldName}.md`);
+        const newPath = path3.join(identityDir, `${emp.name}.md`);
+        if (existsSync4(oldPath) && !existsSync4(newPath)) {
+          renameSync2(oldPath, newPath);
+        } else if (existsSync4(oldPath) && oldPath !== newPath) {
+          const content = readFileSync3(oldPath, "utf-8");
+          writeFileSync2(newPath, content, "utf-8");
+          if (oldPath.toLowerCase() !== newPath.toLowerCase()) {
+            unlinkSync(oldPath);
+          }
+        }
+      } catch {
+      }
+    }
+  }
+  if (changed) {
+    await saveEmployees(employees, rosterPath);
+  }
+  return changed;
+}
+function findExeBin() {
+  try {
+    return execSync(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
+  } catch {
+    return null;
+  }
+}
+function registerBinSymlinks(name) {
+  const created = [];
+  const skipped = [];
+  const errors = [];
+  const exeBinPath = findExeBin();
+  if (!exeBinPath) {
+    errors.push("Could not find 'exe-os' in PATH");
+    return { created, skipped, errors };
+  }
+  const binDir = path3.dirname(exeBinPath);
+  let target;
+  try {
+    target = readlinkSync(exeBinPath);
+  } catch {
+    errors.push("Could not read 'exe' symlink");
+    return { created, skipped, errors };
+  }
+  for (const suffix of ["", "-opencode"]) {
+    const linkName = `${name}${suffix}`;
+    const linkPath = path3.join(binDir, linkName);
+    if (existsSync4(linkPath)) {
+      skipped.push(linkName);
+      continue;
+    }
+    try {
+      symlinkSync(target, linkPath);
+      created.push(linkName);
+    } catch (err) {
+      errors.push(`${linkName}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return { created, skipped, errors };
+}
+var EMPLOYEES_PATH, DEFAULT_COORDINATOR_TEMPLATE_NAME, COORDINATOR_ROLE, MULTI_INSTANCE_ROLES, IDENTITY_DIR, TEAM_SECTION_RE;
 var init_employees = __esm({
   "src/lib/employees.ts"() {
     "use strict";
     init_config();
-    EMPLOYEES_PATH = path2.join(EXE_AI_DIR, "exe-employees.json");
+    EMPLOYEES_PATH = path3.join(EXE_AI_DIR, "exe-employees.json");
     DEFAULT_COORDINATOR_TEMPLATE_NAME = "exe";
     COORDINATOR_ROLE = "COO";
-    IDENTITY_DIR = path2.join(EXE_AI_DIR, "identity");
+    MULTI_INSTANCE_ROLES = /* @__PURE__ */ new Set(["principal engineer", "content production specialist", "staff code reviewer"]);
+    IDENTITY_DIR = path3.join(EXE_AI_DIR, "identity");
+    TEAM_SECTION_RE = /^## Team\b.*$/m;
   }
 });
 
 // src/lib/database-adapter.ts
 import os3 from "os";
-import path3 from "path";
+import path4 from "path";
 import { createRequire } from "module";
 import { pathToFileURL } from "url";
 function quotedIdentifier(identifier) {
@@ -757,8 +1096,8 @@ async function loadPrismaClient() {
         }
         return new PrismaClient2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path3.join(os3.homedir(), "exe-db");
-      const requireFromExeDb = createRequire(path3.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path4.join(os3.homedir(), "exe-db");
+      const requireFromExeDb = createRequire(path4.join(exeDbRoot, "package.json"));
       const prismaEntry = requireFromExeDb.resolve("@prisma/client");
       const module = await import(pathToFileURL(prismaEntry).href);
       const PrismaClient = module.PrismaClient ?? module.default?.PrismaClient;
@@ -1030,8 +1369,8 @@ var init_database_adapter = __esm({
 
 // src/lib/daemon-auth.ts
 import crypto from "crypto";
-import path4 from "path";
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import path5 from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 function normalizeToken(token) {
   if (!token) return null;
   const trimmed = token.trim();
@@ -1039,8 +1378,8 @@ function normalizeToken(token) {
 }
 function readDaemonToken() {
   try {
-    if (!existsSync4(DAEMON_TOKEN_PATH)) return null;
-    return normalizeToken(readFileSync3(DAEMON_TOKEN_PATH, "utf8"));
+    if (!existsSync5(DAEMON_TOKEN_PATH)) return null;
+    return normalizeToken(readFileSync4(DAEMON_TOKEN_PATH, "utf8"));
   } catch {
     return null;
   }
@@ -1050,7 +1389,7 @@ function ensureDaemonToken(seed) {
   if (existing) return existing;
   const token = normalizeToken(seed) ?? crypto.randomBytes(32).toString("hex");
   ensurePrivateDirSync(EXE_AI_DIR);
-  writeFileSync2(DAEMON_TOKEN_PATH, `${token}
+  writeFileSync3(DAEMON_TOKEN_PATH, `${token}
 `, "utf8");
   enforcePrivateFileSync(DAEMON_TOKEN_PATH);
   return token;
@@ -1061,7 +1400,7 @@ var init_daemon_auth = __esm({
     "use strict";
     init_config();
     init_secure_files();
-    DAEMON_TOKEN_PATH = path4.join(EXE_AI_DIR, "exed.token");
+    DAEMON_TOKEN_PATH = path5.join(EXE_AI_DIR, "exed.token");
   }
 });
 
@@ -1070,8 +1409,8 @@ import net from "net";
 import os4 from "os";
 import { spawn, execSync as execSync2 } from "child_process";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync5, unlinkSync as unlinkSync2, readFileSync as readFileSync4, openSync, closeSync, statSync } from "fs";
-import path5 from "path";
+import { existsSync as existsSync6, unlinkSync as unlinkSync2, readFileSync as readFileSync5, openSync, closeSync, statSync } from "fs";
+import path6 from "path";
 import { fileURLToPath } from "url";
 function handleData(chunk) {
   _buffer += chunk.toString();
@@ -1107,9 +1446,9 @@ function isZombie(pid) {
   }
 }
 function cleanupStaleFiles() {
-  if (existsSync5(PID_PATH)) {
+  if (existsSync6(PID_PATH)) {
     try {
-      const pid = parseInt(readFileSync4(PID_PATH, "utf8").trim(), 10);
+      const pid = parseInt(readFileSync5(PID_PATH, "utf8").trim(), 10);
       if (pid > 0) {
         try {
           process.kill(pid, 0);
@@ -1134,11 +1473,11 @@ function cleanupStaleFiles() {
   }
 }
 function findPackageRoot() {
-  let dir = path5.dirname(fileURLToPath(import.meta.url));
-  const { root } = path5.parse(dir);
+  let dir = path6.dirname(fileURLToPath(import.meta.url));
+  const { root } = path6.parse(dir);
   while (dir !== root) {
-    if (existsSync5(path5.join(dir, "package.json"))) return dir;
-    dir = path5.dirname(dir);
+    if (existsSync6(path6.join(dir, "package.json"))) return dir;
+    dir = path6.dirname(dir);
   }
   return null;
 }
@@ -1156,8 +1495,8 @@ function spawnDaemon() {
     process.stderr.write("[exed-client] WARN: cannot find package root\n");
     return;
   }
-  const daemonPath = path5.join(pkgRoot, "dist", "lib", "exe-daemon.js");
-  if (!existsSync5(daemonPath)) {
+  const daemonPath = path6.join(pkgRoot, "dist", "lib", "exe-daemon.js");
+  if (!existsSync6(daemonPath)) {
     process.stderr.write(`[exed-client] WARN: daemon script not found at ${daemonPath}
 `);
     return;
@@ -1166,7 +1505,7 @@ function spawnDaemon() {
   const daemonToken = ensureDaemonToken(process.env[DAEMON_TOKEN_ENV] ?? null);
   process.stderr.write(`[exed-client] Spawning daemon: ${resolvedPath}
 `);
-  const logPath = path5.join(path5.dirname(SOCKET_PATH), "exed.log");
+  const logPath = path6.join(path6.dirname(SOCKET_PATH), "exed.log");
   let stderrFd = "ignore";
   try {
     stderrFd = openSync(logPath, "a");
@@ -1316,9 +1655,9 @@ var init_exe_daemon_client = __esm({
     "use strict";
     init_config();
     init_daemon_auth();
-    SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path5.join(EXE_AI_DIR, "exed.sock");
-    PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path5.join(EXE_AI_DIR, "exed.pid");
-    SPAWN_LOCK_PATH = path5.join(EXE_AI_DIR, "exed-spawn.lock");
+    SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path6.join(EXE_AI_DIR, "exed.sock");
+    PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path6.join(EXE_AI_DIR, "exed.pid");
+    SPAWN_LOCK_PATH = path6.join(EXE_AI_DIR, "exed-spawn.lock");
     SPAWN_LOCK_STALE_MS = 3e4;
     CONNECT_TIMEOUT_MS = 15e3;
     REQUEST_TIMEOUT_MS = 3e4;
@@ -1545,7 +1884,7 @@ __export(database_exports, {
   isInitialized: () => isInitialized,
   setExternalClient: () => setExternalClient
 });
-import { chmodSync as chmodSync2, existsSync as existsSync6, statSync as statSync2, copyFileSync, unlinkSync as unlinkSync3, openSync as openSync2, closeSync as closeSync2, mkdirSync as mkdirSync2 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync7, statSync as statSync2, copyFileSync, unlinkSync as unlinkSync3, openSync as openSync2, closeSync as closeSync2, mkdirSync as mkdirSync2 } from "fs";
 import { createClient } from "@libsql/client";
 import { homedir } from "os";
 import { join } from "path";
@@ -1598,11 +1937,11 @@ function releaseDbLock() {
 }
 async function initDatabase(config) {
   acquireDbLock();
-  if (existsSync6(config.dbPath)) {
+  if (existsSync7(config.dbPath)) {
     const dbStat = statSync2(config.dbPath);
     if (dbStat.size === 0) {
       const walPath = config.dbPath + "-wal";
-      if (existsSync6(walPath) && statSync2(walPath).size > 0) {
+      if (existsSync7(walPath) && statSync2(walPath).size > 0) {
         const backupPath = config.dbPath + ".zeroed-" + Date.now();
         copyFileSync(config.dbPath, backupPath);
         unlinkSync3(config.dbPath);
@@ -1898,6 +2237,13 @@ async function ensureSchema() {
   } catch (e) {
     logCatchDebug("migration", e);
   }
+  for (const col of ["created_by_agent TEXT", "created_by_device TEXT", "source_session_id TEXT"]) {
+    try {
+      await client.execute({ sql: `ALTER TABLE behaviors ADD COLUMN ${col}`, args: [] });
+    } catch (e) {
+      logCatchDebug("migration", e);
+    }
+  }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN blocked_by TEXT`,
@@ -3114,6 +3460,22 @@ async function ensureSchema() {
   } catch (e) {
     logCatchDebug("migration", e);
   }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'`,
+      args: []
+    });
+  } catch (e) {
+    logCatchDebug("migration", e);
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0`,
+      args: []
+    });
+  } catch (e) {
+    logCatchDebug("migration", e);
+  }
 }
 async function disposeDatabase() {
   if (_walCheckpointTimer) {
@@ -3179,14 +3541,14 @@ __export(shard_manager_exports, {
   listShards: () => listShards,
   shardExists: () => shardExists
 });
-import path7 from "path";
-import { existsSync as existsSync8, mkdirSync as mkdirSync3, readdirSync, renameSync as renameSync3, statSync as statSync4 } from "fs";
+import path8 from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, readdirSync, renameSync as renameSync3, statSync as statSync4 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
   _keyValidated = false;
   _keyValidationPromise = null;
-  if (!existsSync8(SHARDS_DIR)) {
+  if (!existsSync9(SHARDS_DIR)) {
     mkdirSync3(SHARDS_DIR, { recursive: true });
   }
   const existingShards = readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db"));
@@ -3207,7 +3569,7 @@ async function validateEncryptionKey() {
     return true;
   }
   for (const shardFile of existingShards.slice(0, 3)) {
-    const dbPath = path7.join(SHARDS_DIR, shardFile);
+    const dbPath = path8.join(SHARDS_DIR, shardFile);
     const testClient = createClient2({ url: `file:${dbPath}`, encryptionKey: _encryptionKey });
     try {
       await testClient.execute("SELECT COUNT(*) FROM sqlite_schema");
@@ -3250,7 +3612,7 @@ function getShardClient(projectName) {
   while (_shards.size >= MAX_OPEN_SHARDS) {
     evictLRU();
   }
-  const dbPath = path7.join(SHARDS_DIR, `${safeName}.db`);
+  const dbPath = path8.join(SHARDS_DIR, `${safeName}.db`);
   const client = createClient2({
     url: `file:${dbPath}`,
     encryptionKey: _encryptionKey
@@ -3261,13 +3623,13 @@ function getShardClient(projectName) {
 }
 function shardExists(projectName) {
   const safeName = safeShardName(projectName);
-  return existsSync8(path7.join(SHARDS_DIR, `${safeName}.db`));
+  return existsSync9(path8.join(SHARDS_DIR, `${safeName}.db`));
 }
 function safeShardName(projectName) {
   return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function listShards() {
-  if (!existsSync8(SHARDS_DIR)) return [];
+  if (!existsSync9(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function auditShardHealth(options = {}) {
@@ -3279,7 +3641,7 @@ async function auditShardHealth(options = {}) {
   const names = listShards();
   const shards = [];
   for (const name of names) {
-    const dbPath = path7.join(SHARDS_DIR, `${name}.db`);
+    const dbPath = path8.join(SHARDS_DIR, `${name}.db`);
     const stat = statSync4(dbPath);
     const item = {
       name,
@@ -3314,7 +3676,7 @@ async function auditShardHealth(options = {}) {
         _shards.delete(name);
         _shardLastAccess.delete(name);
         const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-        const archivedPath = path7.join(SHARDS_DIR, `${name}.db.broken-${stamp}`);
+        const archivedPath = path8.join(SHARDS_DIR, `${name}.db.broken-${stamp}`);
         renameSync3(dbPath, archivedPath);
         item.archivedPath = archivedPath;
       }
@@ -3542,11 +3904,11 @@ async function getReadyShardClient(projectName) {
     client.close();
     _shards.delete(safeName);
     _shardLastAccess.delete(safeName);
-    const dbPath = path7.join(SHARDS_DIR, `${safeName}.db`);
-    if (existsSync8(dbPath)) {
+    const dbPath = path8.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync9(dbPath)) {
       const stat = statSync4(dbPath);
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const archivedPath = path7.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      const archivedPath = path8.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
       renameSync3(dbPath, archivedPath);
       process.stderr.write(
         `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
@@ -3614,7 +3976,7 @@ var init_shard_manager = __esm({
   "src/lib/shard-manager.ts"() {
     "use strict";
     init_config();
-    SHARDS_DIR = path7.join(EXE_AI_DIR, "shards");
+    SHARDS_DIR = path8.join(EXE_AI_DIR, "shards");
     SHARD_IDLE_MS = 5 * 60 * 1e3;
     MAX_OPEN_SHARDS = 10;
     EVICTION_INTERVAL_MS = 60 * 1e3;
@@ -3680,11 +4042,17 @@ var init_platform_procedures = __esm({
         content: "Founder -> coordinator (the executive agent, internally routed as 'COO') -> CTO/CMO. CTO -> engineers. CMO -> content production. Never skip levels: the coordinator does not bypass managers for specialist work. Specialists report to their manager. If you need cross-team info, use ask_team_memory \u2014 don't read other agents' task folders. Each level owns dispatch downward and review upward."
       },
       {
-        title: "Customer orchestration maturity \u2014 recommend, never trap",
+        title: "Orchestration phase guidance \u2014 recommend, never trap",
         domain: "workflow",
         priority: "p1",
         content: "New customers start best in Phase 1: founder \u2194 coordinator/Chief of Staff, building company context. Suggest Phase 2 executives when domain work repeats; suggest Phase 3 parallel execution only when review/permission gates are ready. This is guidance, not a blocker: users may jump phases anytime. Never overwrite their phase, role titles, identities, or custom org design."
       },
+      {
+        title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
+        domain: "identity",
+        priority: "p0",
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+      },
       {
         title: "Single dispatch path \u2014 create_task only",
         domain: "workflow",
@@ -3718,6 +4086,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "NEVER: (1) Access the database directly \u2014 it's SQLCipher encrypted, always fails. Use MCP tools only. (2) Manually spawn tmux sessions \u2014 create_task handles it. (3) Run git checkout main \u2014 agents work in worktrees. (4) Modify another agent's in-progress task. (5) Push to remote \u2014 the COO reviews and pushes. (6) Skip update_task(done) \u2014 it's the ONLY way your work gets reviewed. (7) Run git init."
       },
+      {
+        title: "Destructive operations \u2014 mandatory reviewer gate",
+        domain: "security",
+        priority: "p0",
+        content: "Before ANY destructive operation (delete, remove, overwrite, drop, reset, force-push, truncate), you MUST: (1) Have your full task spec accessible \u2014 if you cannot read it, STOP and report to your reviewer. Never improvise destructive actions. (2) Confirm with your reviewer (assigned_by or COO) before executing. (3) If the task spec explicitly authorizes the operation, proceed \u2014 but log it. Violation = immediate task failure. This applies to ALL agents regardless of role."
+      },
       {
         title: "Customer patch triage \u2014 upstream bug vs customization",
         domain: "support",
@@ -3869,7 +4243,7 @@ var init_platform_procedures = __esm({
         title: "MCP tool dispatch \u2014 all tools use action parameter",
         domain: "tool-use",
         priority: "p0",
-        content: 'exe-os MCP tools come in two surfaces depending on EXE_MCP_TOOL_SURFACE config. Consolidated (19 tools): action-based dispatch \u2014 memory(action="recall"), task(action="create"), etc. Legacy (108 tools): one tool per operation \u2014 recall_my_memory, create_task, etc. Both surfaces have identical functionality. Use whichever tool names are available in your session. If you see domain tools (memory, task, config, etc.), use the action parameter. If you see specific tools (recall_my_memory, create_task, etc.), call them directly.'
+        content: 'exe-os MCP tools use consolidated action-based dispatch by default (19 tools). Call domain tools with an action parameter: memory(action="recall"), task(action="create"), config(action="list_employees"), etc. Legacy mode (108 separate tools like recall_my_memory, create_task) is still available via EXE_MCP_TOOL_SURFACE=legacy but will be removed in a future version. If you see specific tool names, call them directly \u2014 both surfaces are identical. Consolidated is the default and recommended surface.'
       },
       {
         title: "MCP tools \u2014 memory, decision, and search",
@@ -4003,10 +4377,24 @@ function stableId(memoryId, type, content) {
   return createHash2("sha256").update(`${memoryId}:${type}:${content}`).digest("hex").slice(0, 32);
 }
 function cleanText(text) {
-  return text.replace(/```[\s\S]*?```/g, " ").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
-}
-function splitSentences(text) {
-  return cleanText(text).split(/(?<=[.!?])\s+|\n+/).map((s) => s.trim()).filter((s) => s.length >= 24 && s.length <= MAX_SENTENCE_CHARS);
+  let cleaned = text.replace(
+    /```(\w*)\n(.*?)(?:\n[\s\S]*?)```/g,
+    (_m, lang, firstLine) => `[code${lang ? `:${lang}` : ""}] ${firstLine.trim()}`
+  );
+  cleaned = cleaned.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+  return cleaned;
+}
+function splitSegments(text) {
+  const cleaned = cleanText(text);
+  const segments = cleaned.split(/(?<=[.!?:;])\s+|\n{2,}|(?<=\))\s+(?=[A-Z])|\s*[|│]\s*/).map((s) => s.trim()).filter((s) => s.length >= MIN_SEGMENT_CHARS && s.length <= MAX_SEGMENT_CHARS);
+  if (segments.length === 0 && cleaned.length >= MIN_SEGMENT_CHARS) {
+    const lines = cleaned.split(/\n+/).map((l) => l.trim()).filter((l) => l.length >= MIN_SEGMENT_CHARS && l.length <= MAX_SEGMENT_CHARS);
+    if (lines.length > 0) return lines;
+    if (cleaned.length >= MIN_SEGMENT_CHARS) {
+      return [cleaned.slice(0, MAX_SEGMENT_CHARS)];
+    }
+  }
+  return segments;
 }
 function inferCardType(sentence, toolName) {
   const lower = sentence.toLowerCase();
@@ -4038,12 +4426,12 @@ function predicateFor(type) {
   }
 }
 function extractMemoryCards(row) {
-  const sentences = splitSentences(row.raw_text);
+  const segments = splitSegments(row.raw_text);
   const cards = [];
-  for (const sentence of sentences) {
+  for (const sentence of segments) {
     const type = inferCardType(sentence, row.tool_name);
     const subject = extractSubject(sentence, row.agent_id);
-    const content = sentence.length > MAX_SENTENCE_CHARS ? `${sentence.slice(0, MAX_SENTENCE_CHARS - 1)}\u2026` : sentence;
+    const content = sentence.length > MAX_SEGMENT_CHARS ? `${sentence.slice(0, MAX_SEGMENT_CHARS - 1)}\u2026` : sentence;
     cards.push({
       id: stableId(row.id, type, content),
       memory_id: row.id,
@@ -4139,13 +4527,14 @@ Source memory: ${String(row.source_ref ?? row.memory_id)}`,
     last_accessed: String(row.timestamp)
   }));
 }
-var MAX_CARDS_PER_MEMORY, MAX_SENTENCE_CHARS;
+var MAX_CARDS_PER_MEMORY, MAX_SEGMENT_CHARS, MIN_SEGMENT_CHARS;
 var init_memory_cards = __esm({
   "src/lib/memory-cards.ts"() {
     "use strict";
     init_database();
-    MAX_CARDS_PER_MEMORY = 6;
-    MAX_SENTENCE_CHARS = 360;
+    MAX_CARDS_PER_MEMORY = 8;
+    MAX_SEGMENT_CHARS = 500;
+    MIN_SEGMENT_CHARS = 20;
   }
 });
 
@@ -4417,32 +4806,6 @@ var init_agentic_ontology = __esm({
   }
 });
 
-// src/lib/runtime-table.ts
-var RUNTIME_TABLE;
-var init_runtime_table = __esm({
-  "src/lib/runtime-table.ts"() {
-    "use strict";
-    RUNTIME_TABLE = {
-      codex: {
-        binary: "codex",
-        launchMode: "interactive",
-        autoApproveFlag: "--dangerously-bypass-approvals-and-sandbox",
-        inlineFlag: "--no-alt-screen",
-        apiKeyEnv: "OPENAI_API_KEY",
-        defaultModel: "gpt-5.5"
-      },
-      opencode: {
-        binary: "opencode",
-        launchMode: "exec",
-        autoApproveFlag: "--dangerously-skip-permissions",
-        inlineFlag: "",
-        apiKeyEnv: "ANTHROPIC_API_KEY",
-        defaultModel: "anthropic/claude-sonnet-4-6"
-      }
-    };
-  }
-});
-
 // src/lib/session-key.ts
 import { execSync as execSync4 } from "child_process";
 function normalizeCommand(command) {
@@ -4534,9 +4897,9 @@ __export(active_agent_exports, {
   resolveActiveAgentFromTmuxSession: () => resolveActiveAgentFromTmuxSession,
   writeActiveAgent: () => writeActiveAgent
 });
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, unlinkSync as unlinkSync5, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, unlinkSync as unlinkSync5, readdirSync as readdirSync3 } from "fs";
 import { execSync as execSync5 } from "child_process";
-import path9 from "path";
+import path10 from "path";
 function isNameWithOptionalInstance(candidate, baseName) {
   if (candidate === baseName) return true;
   if (!candidate.startsWith(baseName)) return false;
@@ -4580,12 +4943,12 @@ function resolveActiveAgentFromTmuxSession(sessionName) {
   return null;
 }
 function getMarkerPath() {
-  return path9.join(CACHE_DIR, `active-agent-${getSessionKey()}.json`);
+  return path10.join(CACHE_DIR, `active-agent-${getSessionKey()}.json`);
 }
 function writeActiveAgent(agentId, agentRole) {
   try {
     mkdirSync5(CACHE_DIR, { recursive: true });
-    writeFileSync4(
+    writeFileSync5(
       getMarkerPath(),
       JSON.stringify({ agentId, agentRole, startedAt: (/* @__PURE__ */ new Date()).toISOString() })
     );
@@ -4603,7 +4966,7 @@ function getActiveAgent() {
   if (httpCtx) return httpCtx;
   try {
     const markerPath = getMarkerPath();
-    const raw = readFileSync5(markerPath, "utf8");
+    const raw = readFileSync6(markerPath, "utf8");
     const data = JSON.parse(raw);
     if (data.agentId) {
       if (data.startedAt) {
@@ -4651,14 +5014,14 @@ function getAllActiveAgents() {
       const key = file.slice("active-agent-".length, -".json".length);
       if (key === "undefined") continue;
       try {
-        const raw = readFileSync5(path9.join(CACHE_DIR, file), "utf8");
+        const raw = readFileSync6(path10.join(CACHE_DIR, file), "utf8");
         const data = JSON.parse(raw);
         if (!data.agentId) continue;
         if (data.startedAt) {
           const age = Date.now() - new Date(data.startedAt).getTime();
           if (age > STALE_MS) {
             try {
-              unlinkSync5(path9.join(CACHE_DIR, file));
+              unlinkSync5(path10.join(CACHE_DIR, file));
             } catch {
             }
             continue;
@@ -4681,11 +5044,11 @@ function getAllActiveAgents() {
 function cleanupSessionMarkers() {
   const key = getSessionKey();
   try {
-    unlinkSync5(path9.join(CACHE_DIR, `active-agent-${key}.json`));
+    unlinkSync5(path10.join(CACHE_DIR, `active-agent-${key}.json`));
   } catch {
   }
   try {
-    unlinkSync5(path9.join(CACHE_DIR, "active-agent-undefined.json"));
+    unlinkSync5(path10.join(CACHE_DIR, "active-agent-undefined.json"));
   } catch {
   }
 }
@@ -4697,16 +5060,16 @@ var init_active_agent = __esm({
     init_session_key();
     init_agent_context();
     init_employees();
-    CACHE_DIR = path9.join(EXE_AI_DIR, "session-cache");
+    CACHE_DIR = path10.join(EXE_AI_DIR, "session-cache");
     STALE_MS = 24 * 60 * 60 * 1e3;
   }
 });
 
 // src/lib/agent-symlinks.ts
 import os7 from "os";
-import path10 from "path";
+import path11 from "path";
 import {
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   lstatSync,
   mkdirSync as mkdirSync6,
   readlinkSync as readlinkSync2,
@@ -4734,8 +5097,8 @@ var init_mcp_prefix = __esm({
 });
 
 // src/lib/preferences.ts
-import { existsSync as existsSync11, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import path11 from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import path12 from "path";
 import os8 from "os";
 var init_preferences = __esm({
   "src/lib/preferences.ts"() {
@@ -4745,10 +5108,20 @@ var init_preferences = __esm({
 });
 
 // src/adapters/mcp-http-config.ts
-import { chmodSync as chmodSync3, existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
 import { randomBytes } from "crypto";
-import path12 from "path";
+import path13 from "path";
 import os9 from "os";
+function resolveDefaultAgentId() {
+  if (process.env.AGENT_ID && process.env.AGENT_ID !== "default") return process.env.AGENT_ID;
+  try {
+    const { loadEmployeesSync: loadEmployeesSync2 } = (init_employees(), __toCommonJS(employees_exports));
+    const coo = loadEmployeesSync2().find((e) => e.role === "COO");
+    if (coo) return coo.name;
+  } catch {
+  }
+  return "exe";
+}
 function mcpHttpPort() {
   return process.env.EXE_MCP_PORT || DEFAULT_MCP_HTTP_PORT;
 }
@@ -4756,18 +5129,18 @@ function mcpHttpUrl() {
   return `http://127.0.0.1:${mcpHttpPort()}/mcp`;
 }
 function readOrCreateDaemonToken(homeDir = os9.homedir()) {
-  const exeDir = path12.join(homeDir, ".exe-os");
-  const tokenPath = path12.join(exeDir, "exed.token");
-  if (existsSync12(tokenPath)) {
+  const exeDir = path13.join(homeDir, ".exe-os");
+  const tokenPath = path13.join(exeDir, "exed.token");
+  if (existsSync13(tokenPath)) {
     try {
-      const token2 = readFileSync7(tokenPath, "utf-8").trim();
+      const token2 = readFileSync8(tokenPath, "utf-8").trim();
       if (/^[a-f0-9]{64}$/i.test(token2)) return token2;
     } catch {
     }
   }
   const token = randomBytes(32).toString("hex");
   mkdirSync7(exeDir, { recursive: true });
-  writeFileSync6(tokenPath, `${token}
+  writeFileSync7(tokenPath, `${token}
 `, "utf-8");
   try {
     chmodSync3(tokenPath, 384);
@@ -4778,18 +5151,21 @@ function readOrCreateDaemonToken(homeDir = os9.homedir()) {
 function buildMcpHttpHeaders(homeDir = os9.homedir(), opts = {}) {
   const agentId = opts.useShellPlaceholders ? "${AGENT_ID:-exe}" : opts.agentId ?? DEFAULT_MCP_HTTP_AGENT_ID;
   const agentRole = opts.useShellPlaceholders ? "${AGENT_ROLE:-COO}" : opts.agentRole ?? DEFAULT_MCP_HTTP_AGENT_ROLE;
-  return {
+  const sessionName = opts.useShellPlaceholders ? "$(tmux display-message -p '#{session_name}' 2>/dev/null || echo '')" : process.env.EXE_SESSION_NAME ?? "";
+  const headers = {
     Authorization: `Bearer ${readOrCreateDaemonToken(homeDir)}`,
     "X-Agent-Id": agentId,
     "X-Agent-Role": agentRole
   };
+  if (sessionName) headers["X-Exe-Session"] = sessionName;
+  return headers;
 }
 var DEFAULT_MCP_HTTP_PORT, DEFAULT_MCP_HTTP_AGENT_ID, DEFAULT_MCP_HTTP_AGENT_ROLE;
 var init_mcp_http_config = __esm({
   "src/adapters/mcp-http-config.ts"() {
     "use strict";
     DEFAULT_MCP_HTTP_PORT = "48739";
-    DEFAULT_MCP_HTTP_AGENT_ID = "exe";
+    DEFAULT_MCP_HTTP_AGENT_ID = resolveDefaultAgentId();
     DEFAULT_MCP_HTTP_AGENT_ROLE = "COO";
   }
 });
@@ -4937,28 +5313,28 @@ var init_runtime_hook_manifest = __esm({
 
 // src/adapters/claude/installer.ts
 import { readFile as readFile4, writeFile as writeFile4, mkdir as mkdir4, readdir, rm } from "fs/promises";
-import { existsSync as existsSync13, readFileSync as readFileSync8, writeFileSync as writeFileSync7, copyFileSync as copyFileSync2, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync9, writeFileSync as writeFileSync8, copyFileSync as copyFileSync2, mkdirSync as mkdirSync8 } from "fs";
 import { createHash as createHash4 } from "crypto";
-import path13 from "path";
+import path14 from "path";
 import os10 from "os";
 import { execSync as execSync6 } from "child_process";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolvePackageRoot() {
   const thisFile = fileURLToPath2(import.meta.url);
-  let dir = path13.dirname(thisFile);
-  const root = path13.parse(dir).root;
+  let dir = path14.dirname(thisFile);
+  const root = path14.parse(dir).root;
   while (dir !== root) {
-    const pkgPath = path13.join(dir, "package.json");
-    if (existsSync13(pkgPath)) {
+    const pkgPath = path14.join(dir, "package.json");
+    if (existsSync14(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
       } catch {
       }
     }
-    dir = path13.dirname(dir);
+    dir = path14.dirname(dir);
   }
-  return path13.resolve(path13.dirname(thisFile), "..", "..", "..");
+  return path14.resolve(path14.dirname(thisFile), "..", "..", "..");
 }
 var EXE_SECTION_START, EXE_SECTION_END, ORCHESTRATION_RULES;
 var init_installer = __esm({
@@ -5178,16 +5554,16 @@ __export(installer_exports, {
   verifyOpenCodeHooks: () => verifyOpenCodeHooks
 });
 import { readFile as readFile5, writeFile as writeFile5, mkdir as mkdir5 } from "fs/promises";
-import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
-import path14 from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync10 } from "fs";
+import path15 from "path";
 import os11 from "os";
 async function registerOpenCodeMcp(packageRoot, homeDir = os11.homedir()) {
   void packageRoot;
-  const configDir = path14.join(homeDir, ".config", "opencode");
-  const configPath = path14.join(configDir, "opencode.json");
+  const configDir = path15.join(homeDir, ".config", "opencode");
+  const configPath = path15.join(configDir, "opencode.json");
   await mkdir5(configDir, { recursive: true });
   let config = {};
-  if (existsSync14(configPath)) {
+  if (existsSync15(configPath)) {
     try {
       config = JSON.parse(await readFile5(configPath, "utf-8"));
     } catch {
@@ -5215,14 +5591,14 @@ async function registerOpenCodeMcp(packageRoot, homeDir = os11.homedir()) {
   return true;
 }
 async function installOpenCodePlugin(packageRoot, homeDir = os11.homedir()) {
-  const pluginDir = path14.join(homeDir, ".config", "opencode", "plugins");
-  const pluginPath = path14.join(pluginDir, "exe-os.mjs");
+  const pluginDir = path15.join(homeDir, ".config", "opencode", "plugins");
+  const pluginPath = path15.join(pluginDir, "exe-os.mjs");
   await mkdir5(pluginDir, { recursive: true });
   const pluginContent = PLUGIN_TEMPLATE.replace(
     /__PACKAGE_ROOT__/g,
     packageRoot.replace(/\\/g, "\\\\")
   );
-  if (existsSync14(pluginPath)) {
+  if (existsSync15(pluginPath)) {
     const existing = await readFile5(pluginPath, "utf-8");
     if (existing === pluginContent) {
       return false;
@@ -5232,18 +5608,18 @@ async function installOpenCodePlugin(packageRoot, homeDir = os11.homedir()) {
   return true;
 }
 function verifyOpenCodeHooks(homeDir = os11.homedir()) {
-  const configPath = path14.join(homeDir, ".config", "opencode", "opencode.json");
-  const pluginPath = path14.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
-  if (!existsSync14(configPath)) return false;
+  const configPath = path15.join(homeDir, ".config", "opencode", "opencode.json");
+  const pluginPath = path15.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
+  if (!existsSync15(configPath)) return false;
   try {
-    const config = JSON.parse(readFileSync9(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync10(configPath, "utf-8"));
     if (!config.mcp?.["exe-os"]?.enabled) return false;
   } catch {
     return false;
   }
-  if (!existsSync14(pluginPath)) return false;
+  if (!existsSync15(pluginPath)) return false;
   try {
-    const plugin = readFileSync9(pluginPath, "utf-8");
+    const plugin = readFileSync10(pluginPath, "utf-8");
     if (!plugin.includes(EXE_HOOK_FILES.postToolCombined)) return false;
     if (textHasLegacySplitPostToolHook(plugin)) return false;
   } catch {
@@ -5276,11 +5652,11 @@ var init_installer2 = __esm({
 
 // src/bin/exe-start-opencode.ts
 import os12 from "os";
-import path15 from "path";
+import path16 from "path";
 import {
-  existsSync as existsSync15,
-  readFileSync as readFileSync10,
-  writeFileSync as writeFileSync8,
+  existsSync as existsSync16,
+  readFileSync as readFileSync11,
+  writeFileSync as writeFileSync9,
   mkdirSync as mkdirSync9,
   readdirSync as readdirSync4
 } from "fs";
@@ -5292,18 +5668,18 @@ init_database();
 
 // src/lib/keychain.ts
 import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync7, statSync as statSync3 } from "fs";
+import { existsSync as existsSync8, statSync as statSync3 } from "fs";
 import { execSync as execSync3 } from "child_process";
-import path6 from "path";
+import path7 from "path";
 import os5 from "os";
 var SERVICE = "exe-os";
 var LEGACY_SERVICE = "exe-mem";
 var ACCOUNT = "master-key";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path6.join(os5.homedir(), ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path7.join(os5.homedir(), ".exe-os");
 }
 function getKeyPath() {
-  return path6.join(getKeyDir(), "master.key");
+  return path7.join(getKeyDir(), "master.key");
 }
 function nativeKeychainAllowed() {
   return process.env.EXE_OS_DISABLE_NATIVE_KEYCHAIN !== "1";
@@ -5335,7 +5711,7 @@ function isRootOnlyTrustedServerKeyFile(keyPath) {
     if (!st.isFile() || (st.mode & 63) !== 0) return false;
     if (uid === 0) return true;
     const exeOsDir = process.env.EXE_OS_DIR;
-    return Boolean(exeOsDir && path6.resolve(keyPath).startsWith(path6.resolve(exeOsDir) + path6.sep));
+    return Boolean(exeOsDir && path7.resolve(keyPath).startsWith(path7.resolve(exeOsDir) + path7.sep));
   } catch {
     return false;
   }
@@ -5448,8 +5824,8 @@ function deriveMachineKey() {
 }
 function readMachineId() {
   try {
-    const { readFileSync: readFileSync11 } = __require("fs");
-    return readFileSync11("/etc/machine-id", "utf-8").trim();
+    const { readFileSync: readFileSync12 } = __require("fs");
+    return readFileSync12("/etc/machine-id", "utf-8").trim();
   } catch {
     return "";
   }
@@ -5533,7 +5909,7 @@ async function getMasterKey() {
     }
   }
   const keyPath = getKeyPath();
-  if (!existsSync7(keyPath)) {
+  if (!existsSync8(keyPath)) {
     process.stderr.write(
       `[keychain] Key not found at ${keyPath} (HOME=${os5.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
 `
@@ -6017,14 +6393,14 @@ function vectorToBlob(vector) {
 
 // src/lib/behaviors-export.ts
 import os6 from "os";
-import path8 from "path";
+import path9 from "path";
 import {
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync2,
   statSync as statSync5,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "fs";
 
 // src/lib/behaviors.ts
@@ -6033,7 +6409,7 @@ import crypto2 from "crypto";
 async function listBehaviors(agentId, projectName, limit = 30) {
   const client = getClient();
   const result = await client.execute({
-    sql: `SELECT id, agent_id, project_name, domain, priority, content, active, created_at, updated_at, vector
+    sql: `SELECT id, agent_id, project_name, domain, priority, content, active, created_at, updated_at, vector, created_by_agent, created_by_device, source_session_id
           FROM behaviors
           WHERE agent_id = ? AND active = 1
             AND (project_name IS NULL OR project_name = ?)
@@ -6062,12 +6438,15 @@ async function listBehaviors(agentId, projectName, limit = 30) {
     active: Number(r.active),
     created_at: String(r.created_at),
     updated_at: String(r.updated_at),
-    vector: r.vector ? Array.from(new Float32Array(r.vector)) : null
+    vector: r.vector ? Array.from(new Float32Array(r.vector)) : null,
+    created_by_agent: r.created_by_agent ? String(r.created_by_agent) : null,
+    created_by_device: r.created_by_device ? String(r.created_by_device) : null,
+    source_session_id: r.source_session_id ? String(r.source_session_id) : null
   }));
 }
 
 // src/lib/behaviors-export.ts
-var BEHAVIORS_EXPORT_DIR = path8.join(
+var BEHAVIORS_EXPORT_DIR = path9.join(
   os6.homedir(),
   ".exe-os",
   "behaviors-export"
@@ -6084,7 +6463,7 @@ function getBehaviorLimit() {
   }
 }
 function sweepStaleBehaviorExports(now = Date.now()) {
-  if (!existsSync9(BEHAVIORS_EXPORT_DIR)) return;
+  if (!existsSync10(BEHAVIORS_EXPORT_DIR)) return;
   let entries;
   try {
     entries = readdirSync2(BEHAVIORS_EXPORT_DIR);
@@ -6092,7 +6471,7 @@ function sweepStaleBehaviorExports(now = Date.now()) {
     return;
   }
   for (const entry of entries) {
-    const filePath = path8.join(BEHAVIORS_EXPORT_DIR, entry);
+    const filePath = path9.join(BEHAVIORS_EXPORT_DIR, entry);
     try {
       const stat = statSync5(filePath);
       if (now - stat.mtimeMs > STALE_EXPORT_AGE_MS) {
@@ -6125,10 +6504,10 @@ function renderBehaviorExport(behaviors) {
 }
 function exportFilePath(agentId, projectName, sessionKey) {
   if (!sessionKey) {
-    return path8.join(BEHAVIORS_EXPORT_DIR, `${agentId}.md`);
+    return path9.join(BEHAVIORS_EXPORT_DIR, `${agentId}.md`);
   }
   const safeProject = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return path8.join(
+  return path9.join(
     BEHAVIORS_EXPORT_DIR,
     `${agentId}-${safeProject}-${sessionKey}.md`
   );
@@ -6140,7 +6519,7 @@ async function exportBehaviorsForAgent(agentId, projectName, sessionKey) {
   if (behaviors.length === 0) return null;
   const body = renderBehaviorExport(behaviors);
   const target = exportFilePath(agentId, projectName, sessionKey);
-  writeFileSync3(target, body, "utf-8");
+  writeFileSync4(target, body, "utf-8");
   return target;
 }
 
@@ -6157,7 +6536,7 @@ When done with a task: call update_task with status "done".
 Always call store_memory to persist important findings.
 `;
 function resolveAgent(argv) {
-  const invokedAs = path15.basename(argv[1] ?? "");
+  const invokedAs = path16.basename(argv[1] ?? "");
   if (invokedAs && invokedAs !== "exe-start-opencode" && !invokedAs.endsWith(".js")) {
     const agent2 = invokedAs.replace(/-opencode$/, "").toLowerCase();
     return { agent: agent2, passthrough: argv.slice(2) };
@@ -6174,24 +6553,24 @@ function resolveAgent(argv) {
   return { agent, passthrough };
 }
 function loadIdentity(agent) {
-  const dir = path15.join(os12.homedir(), ".exe-os", "identity");
-  const exact = path15.join(dir, `${agent}.md`);
-  if (existsSync15(exact)) {
-    const content = readFileSync10(exact, "utf-8").trim();
+  const dir = path16.join(os12.homedir(), ".exe-os", "identity");
+  const exact = path16.join(dir, `${agent}.md`);
+  if (existsSync16(exact)) {
+    const content = readFileSync11(exact, "utf-8").trim();
     if (content) return content;
   }
   try {
     const files = readdirSync4(dir);
     const match = files.find((f) => f.toLowerCase() === `${agent.toLowerCase()}.md`);
     if (match) {
-      const content = readFileSync10(path15.join(dir, match), "utf-8").trim();
+      const content = readFileSync11(path16.join(dir, match), "utf-8").trim();
       if (content) return content;
     }
   } catch {
   }
   try {
-    const rosterPath = path15.join(os12.homedir(), ".exe-os", "exe-employees.json");
-    const roster = JSON.parse(readFileSync10(rosterPath, "utf8"));
+    const rosterPath = path16.join(os12.homedir(), ".exe-os", "exe-employees.json");
+    const roster = JSON.parse(readFileSync11(rosterPath, "utf8"));
     const emp = roster.find((e) => e.name.toLowerCase() === agent.toLowerCase());
     if (emp?.systemPrompt && emp.systemPrompt.trim().length > 20) {
       return emp.systemPrompt;
@@ -6201,18 +6580,18 @@ function loadIdentity(agent) {
   return null;
 }
 function writeAgentFile(agent, identity, behaviorsPath) {
-  const agentDir = path15.join(os12.homedir(), ".config", "opencode", "agents");
+  const agentDir = path16.join(os12.homedir(), ".config", "opencode", "agents");
   mkdirSync9(agentDir, { recursive: true });
   let content = identity;
-  if (behaviorsPath && existsSync15(behaviorsPath)) {
-    const behaviors = readFileSync10(behaviorsPath, "utf-8").trim();
+  if (behaviorsPath && existsSync16(behaviorsPath)) {
+    const behaviors = readFileSync11(behaviorsPath, "utf-8").trim();
     if (behaviors) {
       content += "\n\n" + behaviors;
     }
   }
   content += "\n" + BOOT_INSTRUCTIONS;
-  const outPath = path15.join(agentDir, `${agent}.md`);
-  writeFileSync8(outPath, content, "utf-8");
+  const outPath = path16.join(agentDir, `${agent}.md`);
+  writeFileSync9(outPath, content, "utf-8");
   return outPath;
 }
 async function main() {
@@ -6273,8 +6652,8 @@ async function main() {
   process.env.EXE_RUNTIME = "opencode";
   const empRole = (() => {
     try {
-      const emps = readFileSync10(
-        path15.join(os12.homedir(), ".exe-os", "exe-employees.json"),
+      const emps = readFileSync11(
+        path16.join(os12.homedir(), ".exe-os", "exe-employees.json"),
         "utf-8"
       );
       const found = JSON.parse(emps).find(