@askexenow/exe-os 0.9.16 → 0.9.18

package/dist/bin/exe-pending-notifications.js

@@ -3,6 +3,12 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -69,9 +75,9 @@ var MAX_RETRIES, BASE_DELAY_MS, MAX_JITTER_MS;
 var init_db_retry = __esm({
   "src/lib/db-retry.ts"() {
     "use strict";
-    MAX_RETRIES = 3;
-    BASE_DELAY_MS = 200;
-    MAX_JITTER_MS = 300;
+    MAX_RETRIES = 5;
+    BASE_DELAY_MS = 250;
+    MAX_JITTER_MS = 400;
   }
 });
 
@@ -85,12 +91,25 @@ async function ensurePrivateDir(dirPath) {
   } catch {
   }
 }
+function ensurePrivateDirSync(dirPath) {
+  mkdirSync(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    chmodSync(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
 async function enforcePrivateFile(filePath) {
   try {
     await chmod(filePath, PRIVATE_FILE_MODE);
   } catch {
   }
 }
+function enforcePrivateFileSync(filePath) {
+  try {
+    if (existsSync(filePath)) chmodSync(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
 var PRIVATE_DIR_MODE, PRIVATE_FILE_MODE;
 var init_secure_files = __esm({
   "src/lib/secure-files.ts"() {
@@ -907,456 +926,1237 @@ var init_database_adapter = __esm({
   }
 });
 
-// src/lib/database.ts
-import { createClient } from "@libsql/client";
-async function initDatabase(config) {
-  if (_walCheckpointTimer) {
-    clearInterval(_walCheckpointTimer);
-    _walCheckpointTimer = null;
+// src/types/memory.ts
+var EMBEDDING_DIM;
+var init_memory = __esm({
+  "src/types/memory.ts"() {
+    "use strict";
+    EMBEDDING_DIM = 1024;
   }
-  if (_daemonClient) {
-    _daemonClient.close();
-    _daemonClient = null;
+});
+
+// src/lib/daemon-auth.ts
+import crypto from "crypto";
+import path4 from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+function normalizeToken(token) {
+  if (!token) return null;
+  const trimmed = token.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function readDaemonToken() {
+  try {
+    if (!existsSync4(DAEMON_TOKEN_PATH)) return null;
+    return normalizeToken(readFileSync3(DAEMON_TOKEN_PATH, "utf8"));
+  } catch {
+    return null;
   }
-  if (_adapterClient && _adapterClient !== _resilientClient) {
-    _adapterClient.close();
+}
+function ensureDaemonToken(seed) {
+  const existing = readDaemonToken();
+  if (existing) return existing;
+  const token = normalizeToken(seed) ?? crypto.randomBytes(32).toString("hex");
+  ensurePrivateDirSync(EXE_AI_DIR);
+  writeFileSync2(DAEMON_TOKEN_PATH, `${token}
+`, "utf8");
+  enforcePrivateFileSync(DAEMON_TOKEN_PATH);
+  return token;
+}
+var DAEMON_TOKEN_PATH;
+var init_daemon_auth = __esm({
+  "src/lib/daemon-auth.ts"() {
+    "use strict";
+    init_config();
+    init_secure_files();
+    DAEMON_TOKEN_PATH = path4.join(EXE_AI_DIR, "exed.token");
   }
-  _adapterClient = null;
-  if (_client) {
-    _client.close();
-    _client = null;
-    _resilientClient = null;
+});
+
+// src/lib/exe-daemon-client.ts
+var exe_daemon_client_exports = {};
+__export(exe_daemon_client_exports, {
+  connectEmbedDaemon: () => connectEmbedDaemon,
+  disconnectClient: () => disconnectClient,
+  embedBatchViaClient: () => embedBatchViaClient,
+  embedViaClient: () => embedViaClient,
+  isClientConnected: () => isClientConnected,
+  pingDaemon: () => pingDaemon,
+  sendDaemonRequest: () => sendDaemonRequest,
+  sendIngestRequest: () => sendIngestRequest
+});
+import net from "net";
+import os4 from "os";
+import { spawn } from "child_process";
+import { randomUUID } from "crypto";
+import { existsSync as existsSync5, unlinkSync as unlinkSync2, readFileSync as readFileSync4, openSync, closeSync, statSync } from "fs";
+import path5 from "path";
+import { fileURLToPath } from "url";
+function handleData(chunk) {
+  _buffer += chunk.toString();
+  if (_buffer.length > MAX_BUFFER) {
+    _buffer = "";
+    return;
+  }
+  let newlineIdx;
+  while ((newlineIdx = _buffer.indexOf("\n")) !== -1) {
+    const line = _buffer.slice(0, newlineIdx).trim();
+    _buffer = _buffer.slice(newlineIdx + 1);
+    if (!line) continue;
+    try {
+      const response = JSON.parse(line);
+      const id = response.id;
+      if (!id) continue;
+      const entry = _pending.get(id);
+      if (entry) {
+        clearTimeout(entry.timer);
+        _pending.delete(id);
+        entry.resolve(response);
+      }
+    } catch {
+    }
   }
-  const opts = {
-    url: `file:${config.dbPath}`
-  };
-  if (config.encryptionKey) {
-    opts.encryptionKey = config.encryptionKey;
+}
+function cleanupStaleFiles() {
+  if (existsSync5(PID_PATH)) {
+    try {
+      const pid = parseInt(readFileSync4(PID_PATH, "utf8").trim(), 10);
+      if (pid > 0) {
+        try {
+          process.kill(pid, 0);
+          return;
+        } catch {
+        }
+      }
+    } catch {
+    }
+    try {
+      unlinkSync2(PID_PATH);
+    } catch {
+    }
+    try {
+      unlinkSync2(SOCKET_PATH);
+    } catch {
+    }
   }
-  _client = createClient(opts);
-  _resilientClient = wrapWithRetry(_client);
-  _adapterClient = _resilientClient;
-  _client.execute("PRAGMA busy_timeout = 30000").catch(() => {
-  });
-  _client.execute("PRAGMA journal_mode = WAL").catch(() => {
-  });
-  if (_walCheckpointTimer) clearInterval(_walCheckpointTimer);
-  _walCheckpointTimer = setInterval(() => {
-    _client?.execute("PRAGMA wal_checkpoint(PASSIVE)").catch(() => {
-    });
-  }, 3e4);
-  _walCheckpointTimer.unref();
-  if (process.env.DATABASE_URL) {
-    _adapterClient = await createPrismaDbAdapter(_resilientClient);
+}
+function findPackageRoot() {
+  let dir = path5.dirname(fileURLToPath(import.meta.url));
+  const { root } = path5.parse(dir);
+  while (dir !== root) {
+    if (existsSync5(path5.join(dir, "package.json"))) return dir;
+    dir = path5.dirname(dir);
   }
+  return null;
 }
-function getClient() {
-  if (!_adapterClient) {
-    throw new Error("Database client not initialized. Call initDatabase() first.");
+function getAvailableMemoryGB() {
+  if (process.platform === "darwin") {
+    try {
+      const { execSync: execSync4 } = __require("child_process");
+      const vmstat = execSync4("vm_stat", { encoding: "utf8" });
+      const pageSize = 16384;
+      const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
+      const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
+      const free = vmstat.match(/Pages free:\s+(\d+)/);
+      const inactive = vmstat.match(/Pages inactive:\s+(\d+)/);
+      const speculative = vmstat.match(/Pages speculative:\s+(\d+)/);
+      const freePages = free ? parseInt(free[1], 10) : 0;
+      const inactivePages = inactive ? parseInt(inactive[1], 10) : 0;
+      const speculativePages = speculative ? parseInt(speculative[1], 10) : 0;
+      return (freePages + inactivePages + speculativePages) * actualPageSize / (1024 * 1024 * 1024);
+    } catch {
+      return os4.freemem() / (1024 * 1024 * 1024);
+    }
   }
-  if (process.env.DATABASE_URL) {
-    return _adapterClient;
+  return os4.freemem() / (1024 * 1024 * 1024);
+}
+function spawnDaemon() {
+  const freeGB = getAvailableMemoryGB();
+  const totalGB = os4.totalmem() / (1024 * 1024 * 1024);
+  if (totalGB <= 8) {
+    process.stderr.write(
+      `[exed-client] SKIP: ${totalGB.toFixed(0)}GB system \u2014 embedding daemon disabled. Using keyword search only. Minimum 16GB recommended for vector search.
+`
+    );
+    return;
   }
-  if (process.env.EXE_IS_DAEMON === "1") {
-    return _resilientClient;
+  if (totalGB <= 16 && freeGB < 2) {
+    process.stderr.write(
+      `[exed-client] SKIP: low memory (${freeGB.toFixed(1)}GB available / ${totalGB.toFixed(0)}GB total). Embedding daemon not started \u2014 using keyword search only.
+`
+    );
+    return;
   }
-  if (_daemonClient && _daemonClient._isDaemonActive()) {
-    return _daemonClient;
+  const pkgRoot = findPackageRoot();
+  if (!pkgRoot) {
+    process.stderr.write("[exed-client] WARN: cannot find package root\n");
+    return;
   }
-  return _resilientClient;
-}
-function getRawClient() {
-  if (!_client) {
-    throw new Error("Database client not initialized. Call initDatabase() first.");
+  const daemonPath = path5.join(pkgRoot, "dist", "lib", "exe-daemon.js");
+  if (!existsSync5(daemonPath)) {
+    process.stderr.write(`[exed-client] WARN: daemon script not found at ${daemonPath}
+`);
+    return;
   }
-  return _client;
-}
-async function ensureSchema() {
-  const client = getRawClient();
-  await client.execute("PRAGMA journal_mode = WAL");
-  await client.execute("PRAGMA busy_timeout = 30000");
-  await client.execute("PRAGMA wal_autocheckpoint = 1000");
+  const resolvedPath = daemonPath;
+  const daemonToken = ensureDaemonToken(process.env[DAEMON_TOKEN_ENV] ?? null);
+  process.stderr.write(`[exed-client] Spawning daemon: ${resolvedPath}
+`);
+  const logPath = path5.join(path5.dirname(SOCKET_PATH), "exed.log");
+  let stderrFd = "ignore";
   try {
-    await client.execute("PRAGMA libsql_vector_search_ef = 128");
+    stderrFd = openSync(logPath, "a");
   } catch {
   }
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS memories (
-      id            TEXT PRIMARY KEY,
-      agent_id      TEXT NOT NULL,
-      agent_role    TEXT NOT NULL,
-      session_id    TEXT NOT NULL,
-      timestamp     TEXT NOT NULL,
-      tool_name     TEXT NOT NULL,
-      project_name  TEXT NOT NULL,
-      has_error     INTEGER NOT NULL DEFAULT 0,
-      raw_text      TEXT NOT NULL,
-      vector        F32_BLOB(1024),
-      version       INTEGER NOT NULL DEFAULT 0
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_memories_agent
-      ON memories(agent_id);
-
-    CREATE INDEX IF NOT EXISTS idx_memories_timestamp
-      ON memories(timestamp);
-
-    CREATE INDEX IF NOT EXISTS idx_memories_session
-      ON memories(session_id);
-
-    CREATE INDEX IF NOT EXISTS idx_memories_project
-      ON memories(project_name);
-
-    CREATE INDEX IF NOT EXISTS idx_memories_tool
-      ON memories(tool_name);
-
-    CREATE INDEX IF NOT EXISTS idx_memories_version
-      ON memories(version);
-
-    CREATE INDEX IF NOT EXISTS idx_memories_agent_project
-      ON memories(agent_id, project_name);
-  `);
-  await client.executeMultiple(`
-    CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
-      raw_text,
-      content='memories',
-      content_rowid='rowid'
-    );
-
-    CREATE TRIGGER IF NOT EXISTS memories_fts_ai AFTER INSERT ON memories BEGIN
-      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
-    END;
-
-    CREATE TRIGGER IF NOT EXISTS memories_fts_ad AFTER DELETE ON memories BEGIN
-      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
-    END;
-
-    CREATE TRIGGER IF NOT EXISTS memories_fts_au AFTER UPDATE ON memories BEGIN
-      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
-      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
-    END;
-  `);
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS sync_meta (
-      key   TEXT PRIMARY KEY,
-      value TEXT NOT NULL
-    );
-  `);
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS tasks (
-      id            TEXT PRIMARY KEY,
-      title         TEXT NOT NULL,
-      assigned_to   TEXT NOT NULL,
-      assigned_by   TEXT NOT NULL,
-      project_name  TEXT NOT NULL,
-      priority      TEXT NOT NULL DEFAULT 'p1',
-      status        TEXT NOT NULL DEFAULT 'open',
-      task_file     TEXT,
-      created_at    TEXT NOT NULL,
-      updated_at    TEXT NOT NULL
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_tasks_assignee_status
-      ON tasks(assigned_to, status);
-  `);
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS behaviors (
-      id           TEXT PRIMARY KEY,
-      agent_id     TEXT NOT NULL,
-      project_name TEXT,
-      domain       TEXT,
-      content      TEXT NOT NULL,
-      active       INTEGER NOT NULL DEFAULT 1,
-      created_at   TEXT NOT NULL,
-      updated_at   TEXT NOT NULL
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_behaviors_agent
-      ON behaviors(agent_id, active);
-  `);
+  const heapCapMB = totalGB <= 8 ? 256 : 512;
+  const nodeArgs = [`--max-old-space-size=${heapCapMB}`, resolvedPath];
+  const child = spawn(process.execPath, nodeArgs, {
+    detached: true,
+    stdio: ["ignore", "ignore", stderrFd],
+    env: {
+      ...process.env,
+      TMUX: void 0,
+      // Daemon is global — must not inherit session scope
+      TMUX_PANE: void 0,
+      // Prevents resolveExeSession() from scoping to one session
+      EXE_DAEMON_SOCK: SOCKET_PATH,
+      EXE_DAEMON_PID: PID_PATH,
+      [DAEMON_TOKEN_ENV]: daemonToken
+    }
+  });
+  child.unref();
+  if (typeof stderrFd === "number") {
+    try {
+      closeSync(stderrFd);
+    } catch {
+    }
+  }
+}
+function acquireSpawnLock() {
   try {
-    const coordinatorName = getCoordinatorName();
-    const existing = await client.execute({
-      sql: "SELECT COUNT(*) as cnt FROM behaviors WHERE agent_id = ?",
-      args: [coordinatorName]
-    });
-    if (Number(existing.rows[0]?.cnt) === 0) {
-      const seededAt = "2026-03-25T00:00:00Z";
-      for (const [domain, content] of [
-        ["workflow", `Don't ask "keep going?" \u2014 just keep executing phases/plans autonomously`],
-        ["tool-use", "Always use create_task MCP tool, never write .md files directly for task creation"],
-        ["workflow", "Auto-start reviewing when idle and reviews are pending \u2014 never ask founder for permission"]
-      ]) {
-        await client.execute({
-          sql: `INSERT INTO behaviors (id, agent_id, project_name, domain, content, active, created_at, updated_at)
-                VALUES (hex(randomblob(16)), ?, NULL, ?, ?, 1, ?, ?)`,
-          args: [coordinatorName, domain, content, seededAt, seededAt]
-        });
+    const fd = openSync(SPAWN_LOCK_PATH, "wx");
+    closeSync(fd);
+    return true;
+  } catch {
+    try {
+      const stat = statSync(SPAWN_LOCK_PATH);
+      if (Date.now() - stat.mtimeMs > SPAWN_LOCK_STALE_MS) {
+        try {
+          unlinkSync2(SPAWN_LOCK_PATH);
+        } catch {
+        }
+        try {
+          const fd = openSync(SPAWN_LOCK_PATH, "wx");
+          closeSync(fd);
+          return true;
+        } catch {
+        }
       }
+    } catch {
     }
-  } catch {
+    return false;
   }
+}
+function releaseSpawnLock() {
   try {
-    await client.execute({
-      sql: `ALTER TABLE behaviors ADD COLUMN priority TEXT DEFAULT 'p1'`,
-      args: []
-    });
+    unlinkSync2(SPAWN_LOCK_PATH);
   } catch {
   }
-  try {
-    await client.execute({
-      sql: `ALTER TABLE tasks ADD COLUMN blocked_by TEXT`,
-      args: []
+}
+function connectToSocket() {
+  return new Promise((resolve) => {
+    if (_socket && _connected) {
+      resolve(true);
+      return;
+    }
+    const socket = net.createConnection({ path: SOCKET_PATH });
+    const connectTimeout = setTimeout(() => {
+      socket.destroy();
+      resolve(false);
+    }, 2e3);
+    socket.on("connect", () => {
+      clearTimeout(connectTimeout);
+      _socket = socket;
+      _connected = true;
+      _buffer = "";
+      socket.on("data", handleData);
+      socket.on("close", () => {
+        _connected = false;
+        _socket = null;
+        for (const [id, entry] of _pending) {
+          clearTimeout(entry.timer);
+          _pending.delete(id);
+          entry.resolve({ error: "Connection closed" });
+        }
+      });
+      socket.on("error", () => {
+        _connected = false;
+        _socket = null;
+      });
+      resolve(true);
     });
-  } catch {
-  }
-  try {
-    await client.execute({
-      sql: `ALTER TABLE tasks ADD COLUMN parent_task_id TEXT`,
-      args: []
+    socket.on("error", () => {
+      clearTimeout(connectTimeout);
+      resolve(false);
     });
-  } catch {
+  });
+}
+async function connectEmbedDaemon() {
+  if (_socket && _connected) return true;
+  if (await connectToSocket()) return true;
+  if (acquireSpawnLock()) {
+    try {
+      cleanupStaleFiles();
+      spawnDaemon();
+    } finally {
+      releaseSpawnLock();
+    }
   }
-  try {
-    await client.execute({
-      sql: `CREATE INDEX IF NOT EXISTS idx_tasks_parent_task_id
-              ON tasks(parent_task_id)
-              WHERE parent_task_id IS NOT NULL`,
-      args: []
-    });
-  } catch {
+  const start = Date.now();
+  let delay2 = 100;
+  while (Date.now() - start < CONNECT_TIMEOUT_MS) {
+    await new Promise((r) => setTimeout(r, delay2));
+    if (await connectToSocket()) return true;
+    delay2 = Math.min(delay2 * 2, 3e3);
   }
-  try {
-    await client.execute({
-      sql: `UPDATE tasks SET status = 'done' WHERE status = 'completed'`,
-      args: []
-    });
-  } catch {
+  return false;
+}
+function sendRequest(texts, priority) {
+  return sendDaemonRequest({ texts, priority });
+}
+function sendDaemonRequest(payload, timeoutMs = REQUEST_TIMEOUT_MS) {
+  return new Promise((resolve) => {
+    if (!_socket || !_connected) {
+      resolve({ error: "Not connected" });
+      return;
+    }
+    const id = randomUUID();
+    const token = process.env[DAEMON_TOKEN_ENV] ?? readDaemonToken();
+    const timer = setTimeout(() => {
+      _pending.delete(id);
+      resolve({ error: "Request timeout" });
+    }, timeoutMs);
+    _pending.set(id, { resolve, timer });
+    try {
+      _socket.write(JSON.stringify({ id, token, ...payload }) + "\n");
+    } catch {
+      clearTimeout(timer);
+      _pending.delete(id);
+      resolve({ error: "Write failed" });
+    }
+  });
+}
+async function pingDaemon() {
+  if (!_socket || !_connected) return null;
+  const response = await sendDaemonRequest({ type: "health" }, 5e3);
+  if (response.health) {
+    return response.health;
   }
-  try {
-    await client.execute({
-      sql: `ALTER TABLE tasks ADD COLUMN reviewer TEXT`,
-      args: []
-    });
-  } catch {
+  return null;
+}
+function killAndRespawnDaemon() {
+  if (!acquireSpawnLock()) {
+    process.stderr.write("[exed-client] Another process is already restarting daemon \u2014 skipping\n");
+    if (_socket) {
+      _socket.destroy();
+      _socket = null;
+    }
+    _connected = false;
+    _buffer = "";
+    return;
   }
   try {
-    await client.execute({
-      sql: `ALTER TABLE tasks ADD COLUMN context TEXT`,
-      args: []
-    });
-  } catch {
+    process.stderr.write("[exed-client] Killing daemon for restart...\n");
+    if (existsSync5(PID_PATH)) {
+      try {
+        const pid = parseInt(readFileSync4(PID_PATH, "utf8").trim(), 10);
+        if (pid > 0) {
+          try {
+            process.kill(pid, "SIGKILL");
+          } catch {
+          }
+        }
+      } catch {
+      }
+    }
+    if (_socket) {
+      _socket.destroy();
+      _socket = null;
+    }
+    _connected = false;
+    _buffer = "";
+    try {
+      unlinkSync2(PID_PATH);
+    } catch {
+    }
+    try {
+      unlinkSync2(SOCKET_PATH);
+    } catch {
+    }
+    spawnDaemon();
+  } finally {
+    releaseSpawnLock();
   }
+}
+function isDaemonTooYoung() {
   try {
-    await client.execute({
-      sql: `ALTER TABLE tasks ADD COLUMN result TEXT`,
-      args: []
-    });
+    const stat = statSync(PID_PATH);
+    return Date.now() - stat.mtimeMs < MIN_DAEMON_AGE_MS;
   } catch {
+    return false;
   }
-  try {
-    await client.execute({
-      sql: `ALTER TABLE tasks ADD COLUMN assigned_tmux TEXT`,
-      args: []
-    });
-  } catch {
+}
+async function retryThenRestart(doRequest, label) {
+  const result = await doRequest();
+  if (!result.error) {
+    _consecutiveFailures = 0;
+    return result;
+  }
+  _consecutiveFailures++;
+  for (let i = 0; i < MAX_RETRIES_BEFORE_RESTART; i++) {
+    const delayMs = RETRY_DELAYS_MS[i] ?? 5e3;
+    process.stderr.write(`[exed-client] ${label} failed (${result.error}), retry ${i + 1}/${MAX_RETRIES_BEFORE_RESTART} in ${delayMs}ms
+`);
+    await new Promise((r) => setTimeout(r, delayMs));
+    if (!_connected) {
+      if (!await connectToSocket()) continue;
+    }
+    const retry = await doRequest();
+    if (!retry.error) {
+      _consecutiveFailures = 0;
+      return retry;
+    }
+    _consecutiveFailures++;
   }
-  try {
-    await client.execute({
-      sql: `ALTER TABLE tasks ADD COLUMN checkpoint TEXT`,
-      args: []
-    });
-  } catch {
+  if (isDaemonTooYoung()) {
+    process.stderr.write(`[exed-client] ${label}: daemon too young (< ${MIN_DAEMON_AGE_MS / 1e3}s) \u2014 skipping restart
+`);
+    return { error: result.error };
   }
-  try {
-    await client.execute({
-      sql: `ALTER TABLE tasks ADD COLUMN checkpoint_count INTEGER NOT NULL DEFAULT 0`,
-      args: []
-    });
-  } catch {
+  process.stderr.write(`[exed-client] ${label}: ${_consecutiveFailures} consecutive failures \u2014 restarting daemon
+`);
+  killAndRespawnDaemon();
+  const start = Date.now();
+  let delay2 = 200;
+  while (Date.now() - start < CONNECT_TIMEOUT_MS) {
+    await new Promise((r) => setTimeout(r, delay2));
+    if (await connectToSocket()) break;
+    delay2 = Math.min(delay2 * 2, 3e3);
+  }
+  if (!_connected) return { error: "Daemon restart failed" };
+  const final = await doRequest();
+  if (!final.error) _consecutiveFailures = 0;
+  return final;
+}
+async function embedViaClient(text, priority = "high") {
+  if (!_connected && !await connectEmbedDaemon()) return null;
+  _requestCount++;
+  if (_requestCount % HEALTH_CHECK_INTERVAL === 0) {
+    const health = await pingDaemon();
+    if (!health && !isDaemonTooYoung()) {
+      process.stderr.write(`[exed-client] Periodic health check failed at request ${_requestCount} \u2014 restarting daemon
+`);
+      killAndRespawnDaemon();
+      const start = Date.now();
+      let d = 200;
+      while (Date.now() - start < CONNECT_TIMEOUT_MS) {
+        await new Promise((r) => setTimeout(r, d));
+        if (await connectToSocket()) break;
+        d = Math.min(d * 2, 3e3);
+      }
+      if (!_connected) return null;
+    }
   }
-  try {
-    await client.execute({
-      sql: `ALTER TABLE tasks ADD COLUMN complexity TEXT NOT NULL DEFAULT 'standard'`,
-      args: []
-    });
-  } catch {
+  const result = await retryThenRestart(
+    () => sendRequest([text], priority),
+    "Embed"
+  );
+  return !result.error && result.vectors?.[0] ? result.vectors[0] : null;
+}
+async function embedBatchViaClient(texts, priority = "high") {
+  if (!_connected && !await connectEmbedDaemon()) return null;
+  _requestCount++;
+  const result = await retryThenRestart(
+    () => sendRequest(texts, priority),
+    "Batch embed"
+  );
+  return !result.error && result.vectors ? result.vectors : null;
+}
+function disconnectClient() {
+  if (_socket) {
+    _socket.destroy();
+    _socket = null;
+  }
+  _connected = false;
+  _buffer = "";
+  for (const [id, entry] of _pending) {
+    clearTimeout(entry.timer);
+    _pending.delete(id);
+    entry.resolve({ error: "Client disconnected" });
   }
+}
+function isClientConnected() {
+  return _connected;
+}
+function sendIngestRequest(payload) {
+  if (!_socket || !_connected) return false;
   try {
-    await client.execute({
-      sql: `ALTER TABLE tasks ADD COLUMN session_scope TEXT`,
-      args: []
-    });
+    const id = randomUUID();
+    const token = process.env[DAEMON_TOKEN_ENV] ?? readDaemonToken();
+    _socket.write(JSON.stringify({ id, token, type: "ingest", ...payload }) + "\n");
+    return true;
   } catch {
+    return false;
   }
-  try {
-    await client.execute({
-      sql: `ALTER TABLE memories ADD COLUMN task_id TEXT`,
-      args: []
-    });
-  } catch {
+}
+var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, DAEMON_TOKEN_ENV, _socket, _connected, _buffer, _requestCount, _consecutiveFailures, HEALTH_CHECK_INTERVAL, MAX_RETRIES_BEFORE_RESTART, RETRY_DELAYS_MS, MIN_DAEMON_AGE_MS, _pending, MAX_BUFFER;
+var init_exe_daemon_client = __esm({
+  "src/lib/exe-daemon-client.ts"() {
+    "use strict";
+    init_config();
+    init_daemon_auth();
+    SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path5.join(EXE_AI_DIR, "exed.sock");
+    PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path5.join(EXE_AI_DIR, "exed.pid");
+    SPAWN_LOCK_PATH = path5.join(EXE_AI_DIR, "exed-spawn.lock");
+    SPAWN_LOCK_STALE_MS = 3e4;
+    CONNECT_TIMEOUT_MS = 15e3;
+    REQUEST_TIMEOUT_MS = 3e4;
+    DAEMON_TOKEN_ENV = "EXE_DAEMON_TOKEN";
+    _socket = null;
+    _connected = false;
+    _buffer = "";
+    _requestCount = 0;
+    _consecutiveFailures = 0;
+    HEALTH_CHECK_INTERVAL = 100;
+    MAX_RETRIES_BEFORE_RESTART = 3;
+    RETRY_DELAYS_MS = [1e3, 3e3, 5e3];
+    MIN_DAEMON_AGE_MS = 3e4;
+    _pending = /* @__PURE__ */ new Map();
+    MAX_BUFFER = 1e7;
   }
-  try {
-    await client.execute({
-      sql: `ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0`,
-      args: []
-    });
-  } catch {
+});
+
+// src/lib/daemon-protocol.ts
+var daemon_protocol_exports = {};
+__export(daemon_protocol_exports, {
+  deserializeArgs: () => deserializeArgs,
+  deserializeResultSet: () => deserializeResultSet,
+  deserializeValue: () => deserializeValue,
+  serializeArgs: () => serializeArgs,
+  serializeResultSet: () => serializeResultSet,
+  serializeValue: () => serializeValue
+});
+function serializeValue(v) {
+  if (v === null || v === void 0) return null;
+  if (typeof v === "bigint") return Number(v);
+  if (typeof v === "boolean") return v ? 1 : 0;
+  if (v instanceof Uint8Array) {
+    return { __blob: Buffer.from(v).toString("base64") };
   }
-  try {
-    await client.execute({
-      sql: `ALTER TABLE memories ADD COLUMN author_device_id TEXT`,
-      args: []
-    });
-  } catch {
+  if (ArrayBuffer.isView(v)) {
+    return { __blob: Buffer.from(v.buffer, v.byteOffset, v.byteLength).toString("base64") };
   }
-  try {
-    await client.execute({
-      sql: `ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'`,
-      args: []
-    });
-  } catch {
+  if (v instanceof ArrayBuffer) {
+    return { __blob: Buffer.from(v).toString("base64") };
   }
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS consolidations (
-      id                    TEXT PRIMARY KEY,
-      consolidated_memory_id TEXT NOT NULL,
-      source_memory_id      TEXT NOT NULL,
-      created_at            TEXT NOT NULL
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_consolidations_source
-      ON consolidations(source_memory_id);
-
-    CREATE INDEX IF NOT EXISTS idx_consolidations_consolidated
-      ON consolidations(consolidated_memory_id);
-  `);
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS reminders (
-      id            TEXT PRIMARY KEY,
-      text          TEXT NOT NULL,
-      created_at    TEXT NOT NULL,
-      due_date      TEXT,
-      completed_at  TEXT
-    );
-  `);
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS notifications (
-      id          TEXT PRIMARY KEY,
-      agent_id    TEXT NOT NULL,
-      agent_role  TEXT NOT NULL,
-      event       TEXT NOT NULL,
-      project     TEXT NOT NULL,
-      summary     TEXT NOT NULL,
-      task_file   TEXT,
-      session_scope TEXT,
-      read        INTEGER NOT NULL DEFAULT 0,
-      created_at  TEXT NOT NULL
+  if (typeof v === "string" || typeof v === "number") return v;
+  return String(v);
+}
+function deserializeValue(v) {
+  if (v === null) return null;
+  if (typeof v === "object" && v !== null && "__blob" in v) {
+    const buf = Buffer.from(v.__blob, "base64");
+    return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+  }
+  return v;
+}
+function serializeArgs(args) {
+  return args.map(serializeValue);
+}
+function deserializeArgs(args) {
+  return args.map(deserializeValue);
+}
+function serializeResultSet(rs) {
+  const rows = [];
+  for (const row of rs.rows) {
+    const obj = {};
+    for (let i = 0; i < rs.columns.length; i++) {
+      const col = rs.columns[i];
+      if (col !== void 0) {
+        obj[col] = serializeValue(row[i]);
+      }
+    }
+    rows.push(obj);
+  }
+  return {
+    columns: [...rs.columns],
+    columnTypes: [...rs.columnTypes ?? []],
+    rows,
+    rowsAffected: typeof rs.rowsAffected === "bigint" ? Number(rs.rowsAffected) : rs.rowsAffected ?? 0,
+    lastInsertRowid: rs.lastInsertRowid != null ? typeof rs.lastInsertRowid === "bigint" ? Number(rs.lastInsertRowid) : rs.lastInsertRowid : null
+  };
+}
+function deserializeResultSet(srs) {
+  const rows = srs.rows.map((obj) => {
+    const values = srs.columns.map(
+      (col) => deserializeValue(obj[col] ?? null)
     );
+    const row = values;
+    for (let i = 0; i < srs.columns.length; i++) {
+      const col = srs.columns[i];
+      if (col !== void 0) {
+        row[col] = values[i] ?? null;
+      }
+    }
+    Object.defineProperty(row, "length", {
+      value: values.length,
+      enumerable: false
+    });
+    return row;
+  });
+  return {
+    columns: srs.columns,
+    columnTypes: srs.columnTypes ?? [],
+    rows,
+    rowsAffected: srs.rowsAffected,
+    lastInsertRowid: srs.lastInsertRowid != null ? BigInt(srs.lastInsertRowid) : void 0,
+    toJSON: () => ({
+      columns: srs.columns,
+      columnTypes: srs.columnTypes ?? [],
+      rows: srs.rows,
+      rowsAffected: srs.rowsAffected,
+      lastInsertRowid: srs.lastInsertRowid
+    })
+  };
+}
+var init_daemon_protocol = __esm({
+  "src/lib/daemon-protocol.ts"() {
+    "use strict";
+  }
+});
 
-    CREATE INDEX IF NOT EXISTS idx_notifications_read
-      ON notifications(read);
+// src/lib/db-daemon-client.ts
+var db_daemon_client_exports = {};
+__export(db_daemon_client_exports, {
+  createDaemonDbClient: () => createDaemonDbClient,
+  initDaemonDbClient: () => initDaemonDbClient
+});
+function normalizeStatement2(stmt) {
+  if (typeof stmt === "string") {
+    return { sql: stmt, args: [] };
+  }
+  const sql = stmt.sql;
+  let args = [];
+  if (Array.isArray(stmt.args)) {
+    args = stmt.args.map((v) => serializeValue(v));
+  } else if (stmt.args && typeof stmt.args === "object") {
+    const named = {};
+    for (const [key, val] of Object.entries(stmt.args)) {
+      named[key] = serializeValue(val);
+    }
+    return { sql, args: named };
+  }
+  return { sql, args };
+}
+function createDaemonDbClient(fallbackClient) {
+  let _useDaemon = false;
+  const client = {
+    async execute(stmt) {
+      if (!_useDaemon || !isClientConnected()) {
+        return fallbackClient.execute(stmt);
+      }
+      const { sql, args } = normalizeStatement2(stmt);
+      const response = await sendDaemonRequest({
+        type: "db-execute",
+        sql,
+        args
+      });
+      if (response.error) {
+        const errMsg = String(response.error);
+        if (errMsg === "Not connected" || errMsg === "Request timeout" || errMsg === "Write failed" || errMsg === "DB not initialized") {
+          process.stderr.write(`[db-daemon] Transport error (${errMsg}), falling back to direct
+`);
+          return fallbackClient.execute(stmt);
+        }
+        throw new Error(errMsg);
+      }
+      if (response.db) {
+        return deserializeResultSet(response.db);
+      }
+      process.stderr.write("[db-daemon] Unexpected response shape, falling back to direct\n");
+      return fallbackClient.execute(stmt);
+    },
+    async batch(stmts, mode) {
+      if (!_useDaemon || !isClientConnected()) {
+        return fallbackClient.batch(stmts, mode);
+      }
+      const statements = stmts.map(normalizeStatement2);
+      const response = await sendDaemonRequest({
+        type: "db-batch",
+        statements,
+        mode: mode ?? "deferred"
+      });
+      if (response.error) {
+        const errMsg = String(response.error);
+        if (errMsg === "Not connected" || errMsg === "Request timeout" || errMsg === "Write failed" || errMsg === "DB not initialized") {
+          process.stderr.write(`[db-daemon] Batch transport error (${errMsg}), falling back to direct
+`);
+          return fallbackClient.batch(stmts, mode);
+        }
+        throw new Error(errMsg);
+      }
+      const batchResults = response["db-batch"];
+      if (batchResults) {
+        return batchResults.map(deserializeResultSet);
+      }
+      process.stderr.write("[db-daemon] Unexpected batch response shape, falling back to direct\n");
+      return fallbackClient.batch(stmts, mode);
+    },
+    // Transaction support — delegate to fallback (transactions need direct connection)
+    async transaction(mode) {
+      return fallbackClient.transaction(mode);
+    },
+    // executeMultiple — delegate to fallback (used only for schema migrations)
+    async executeMultiple(sql) {
+      return fallbackClient.executeMultiple(sql);
+    },
+    // migrate — delegate to fallback
+    async migrate(stmts) {
+      return fallbackClient.migrate(stmts);
+    },
+    // Sync mode — delegate to fallback
+    sync() {
+      return fallbackClient.sync();
+    },
+    close() {
+      _useDaemon = false;
+    },
+    get closed() {
+      return fallbackClient.closed;
+    },
+    get protocol() {
+      return fallbackClient.protocol;
+    }
+  };
+  return {
+    ...client,
+    /** Enable daemon routing (call after confirming daemon is connected) */
+    _enableDaemon() {
+      _useDaemon = true;
+    },
+    /** Check if daemon routing is active */
+    _isDaemonActive() {
+      return _useDaemon && isClientConnected();
+    }
+  };
+}
+async function initDaemonDbClient(fallbackClient) {
+  if (process.env.EXE_IS_DAEMON === "1") return null;
+  const connected = await connectEmbedDaemon();
+  if (!connected) {
+    process.stderr.write("[db-daemon] Daemon unavailable \u2014 using direct SQLite\n");
+    return null;
+  }
+  const client = createDaemonDbClient(fallbackClient);
+  client._enableDaemon();
+  process.stderr.write("[db-daemon] DB routing through daemon (single-writer)\n");
+  return client;
+}
+var init_db_daemon_client = __esm({
+  "src/lib/db-daemon-client.ts"() {
+    "use strict";
+    init_exe_daemon_client();
+    init_daemon_protocol();
+  }
+});
 
-    CREATE INDEX IF NOT EXISTS idx_notifications_agent
-      ON notifications(agent_id, session_scope);
+// src/lib/database.ts
+var database_exports = {};
+__export(database_exports, {
+  disposeDatabase: () => disposeDatabase,
+  disposeTurso: () => disposeTurso,
+  ensureSchema: () => ensureSchema,
+  getClient: () => getClient,
+  getRawClient: () => getRawClient,
+  initDaemonClient: () => initDaemonClient,
+  initDatabase: () => initDatabase,
+  initTurso: () => initTurso,
+  isInitialized: () => isInitialized
+});
+import { createClient } from "@libsql/client";
+async function initDatabase(config) {
+  if (_walCheckpointTimer) {
+    clearInterval(_walCheckpointTimer);
+    _walCheckpointTimer = null;
+  }
+  if (_daemonClient) {
+    _daemonClient.close();
+    _daemonClient = null;
+  }
+  if (_adapterClient && _adapterClient !== _resilientClient) {
+    _adapterClient.close();
+  }
+  _adapterClient = null;
+  if (_client) {
+    _client.close();
+    _client = null;
+    _resilientClient = null;
+  }
+  const opts = {
+    url: `file:${config.dbPath}`
+  };
+  if (config.encryptionKey) {
+    opts.encryptionKey = config.encryptionKey;
+  }
+  _client = createClient(opts);
+  _resilientClient = wrapWithRetry(_client);
+  _adapterClient = _resilientClient;
+  _client.execute("PRAGMA busy_timeout = 30000").catch(() => {
+  });
+  _client.execute("PRAGMA journal_mode = WAL").catch(() => {
+  });
+  if (_walCheckpointTimer) clearInterval(_walCheckpointTimer);
+  _walCheckpointTimer = setInterval(() => {
+    _client?.execute("PRAGMA wal_checkpoint(PASSIVE)").catch(() => {
+    });
+  }, 3e4);
+  _walCheckpointTimer.unref();
+  if (process.env.DATABASE_URL && process.env.EXE_USE_POSTGRES === "1") {
+    _adapterClient = await createPrismaDbAdapter(_resilientClient);
+  }
+}
+function isInitialized() {
+  return _adapterClient !== null || _client !== null;
+}
+function getClient() {
+  if (!_adapterClient) {
+    throw new Error("Database client not initialized. Call initDatabase() first.");
+  }
+  if (process.env.DATABASE_URL && process.env.EXE_USE_POSTGRES === "1") {
+    return _adapterClient;
+  }
+  if (process.env.EXE_IS_DAEMON === "1") {
+    return _resilientClient;
+  }
+  if (_daemonClient && _daemonClient._isDaemonActive()) {
+    return _daemonClient;
+  }
+  return _resilientClient;
+}
+async function initDaemonClient() {
+  if (process.env.DATABASE_URL && process.env.EXE_USE_POSTGRES === "1") return;
+  if (process.env.EXE_IS_DAEMON === "1") return;
+  if (process.env.VITEST) return;
+  if (!_resilientClient) return;
+  if (_daemonClient) return;
+  try {
+    const { initDaemonDbClient: initDaemonDbClient2 } = await Promise.resolve().then(() => (init_db_daemon_client(), db_daemon_client_exports));
+    _daemonClient = await initDaemonDbClient2(_resilientClient);
+  } catch (err) {
+    process.stderr.write(
+      `[database] Daemon client init failed (non-fatal): ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+function getRawClient() {
+  if (!_client) {
+    throw new Error("Database client not initialized. Call initDatabase() first.");
+  }
+  return _client;
+}
+async function ensureSchema() {
+  const client = getRawClient();
+  await client.execute("PRAGMA journal_mode = WAL");
+  await client.execute("PRAGMA busy_timeout = 30000");
+  await client.execute("PRAGMA wal_autocheckpoint = 1000");
+  try {
+    await client.execute("PRAGMA libsql_vector_search_ef = 128");
+  } catch {
+  }
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS memories (
+      id            TEXT PRIMARY KEY,
+      agent_id      TEXT NOT NULL,
+      agent_role    TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      timestamp     TEXT NOT NULL,
+      tool_name     TEXT NOT NULL,
+      project_name  TEXT NOT NULL,
+      has_error     INTEGER NOT NULL DEFAULT 0,
+      raw_text      TEXT NOT NULL,
+      vector        F32_BLOB(1024),
+      version       INTEGER NOT NULL DEFAULT 0
+    );
 
-    CREATE INDEX IF NOT EXISTS idx_notifications_task_file
-      ON notifications(task_file);
+    CREATE INDEX IF NOT EXISTS idx_memories_agent
+      ON memories(agent_id);
+
+    CREATE INDEX IF NOT EXISTS idx_memories_timestamp
+      ON memories(timestamp);
+
+    CREATE INDEX IF NOT EXISTS idx_memories_session
+      ON memories(session_id);
+
+    CREATE INDEX IF NOT EXISTS idx_memories_project
+      ON memories(project_name);
+
+    CREATE INDEX IF NOT EXISTS idx_memories_tool
+      ON memories(tool_name);
+
+    CREATE INDEX IF NOT EXISTS idx_memories_version
+      ON memories(version);
+
+    CREATE INDEX IF NOT EXISTS idx_memories_agent_project
+      ON memories(agent_id, project_name);
   `);
   await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS schedules (
-      id            TEXT PRIMARY KEY,
-      cron          TEXT NOT NULL,
-      description   TEXT NOT NULL,
-      job_type      TEXT NOT NULL DEFAULT 'report',
-      prompt        TEXT,
-      assigned_to   TEXT,
-      project_name  TEXT,
-      active        INTEGER NOT NULL DEFAULT 1,
-      use_crontab   INTEGER NOT NULL DEFAULT 0,
-      created_at    TEXT NOT NULL
+    CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
+      raw_text,
+      content='memories',
+      content_rowid='rowid'
     );
+
+    CREATE TRIGGER IF NOT EXISTS memories_fts_ai AFTER INSERT ON memories BEGIN
+      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memories_fts_ad AFTER DELETE ON memories BEGIN
+      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memories_fts_au AFTER UPDATE ON memories BEGIN
+      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
+      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
+    END;
   `);
   await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS device_registry (
-      device_id     TEXT PRIMARY KEY,
-      friendly_name TEXT NOT NULL,
-      hostname      TEXT NOT NULL,
-      projects      TEXT NOT NULL DEFAULT '[]',
-      agents        TEXT NOT NULL DEFAULT '[]',
-      connected     INTEGER DEFAULT 0,
-      last_seen     TEXT NOT NULL
+    CREATE TABLE IF NOT EXISTS sync_meta (
+      key   TEXT PRIMARY KEY,
+      value TEXT NOT NULL
     );
   `);
   await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS messages (
-      id              TEXT PRIMARY KEY,
-      from_agent      TEXT NOT NULL,
-      from_device     TEXT NOT NULL DEFAULT 'local',
-      target_agent    TEXT NOT NULL,
-      target_project  TEXT,
-      target_device   TEXT NOT NULL DEFAULT 'local',
-      session_scope   TEXT,
-      content         TEXT NOT NULL,
-      priority        TEXT DEFAULT 'normal',
-      status          TEXT DEFAULT 'pending',
-      server_seq      INTEGER,
-      retry_count     INTEGER DEFAULT 0,
-      created_at      TEXT NOT NULL,
-      delivered_at    TEXT,
-      processed_at    TEXT,
-      failed_at       TEXT,
-      failure_reason  TEXT
+    CREATE TABLE IF NOT EXISTS tasks (
+      id            TEXT PRIMARY KEY,
+      title         TEXT NOT NULL,
+      assigned_to   TEXT NOT NULL,
+      assigned_by   TEXT NOT NULL,
+      project_name  TEXT NOT NULL,
+      priority      TEXT NOT NULL DEFAULT 'p1',
+      status        TEXT NOT NULL DEFAULT 'open',
+      task_file     TEXT,
+      created_at    TEXT NOT NULL,
+      updated_at    TEXT NOT NULL
     );
 
-    CREATE INDEX IF NOT EXISTS idx_messages_target
-      ON messages(target_agent, session_scope, status);
+    CREATE INDEX IF NOT EXISTS idx_tasks_assignee_status
+      ON tasks(assigned_to, status);
+  `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS behaviors (
+      id           TEXT PRIMARY KEY,
+      agent_id     TEXT NOT NULL,
+      project_name TEXT,
+      domain       TEXT,
+      content      TEXT NOT NULL,
+      active       INTEGER NOT NULL DEFAULT 1,
+      created_at   TEXT NOT NULL,
+      updated_at   TEXT NOT NULL
+    );
 
-    CREATE INDEX IF NOT EXISTS idx_messages_conversation_order
-      ON messages(target_agent, session_scope, from_agent, server_seq);
+    CREATE INDEX IF NOT EXISTS idx_behaviors_agent
+      ON behaviors(agent_id, active);
   `);
   try {
-    await client.execute({
-      sql: `ALTER TABLE notifications ADD COLUMN session_scope TEXT`,
-      args: []
+    const coordinatorName = getCoordinatorName();
+    const existing = await client.execute({
+      sql: "SELECT COUNT(*) as cnt FROM behaviors WHERE agent_id = ?",
+      args: [coordinatorName]
     });
+    if (Number(existing.rows[0]?.cnt) === 0) {
+      const seededAt = "2026-03-25T00:00:00Z";
+      for (const [domain, content] of [
+        ["workflow", `Don't ask "keep going?" \u2014 just keep executing phases/plans autonomously`],
+        ["tool-use", "Always use create_task MCP tool, never write .md files directly for task creation"],
+        ["workflow", "Auto-start reviewing when idle and reviews are pending \u2014 never ask founder for permission"]
+      ]) {
+        await client.execute({
+          sql: `INSERT INTO behaviors (id, agent_id, project_name, domain, content, active, created_at, updated_at)
+                VALUES (hex(randomblob(16)), ?, NULL, ?, ?, 1, ?, ?)`,
+          args: [coordinatorName, domain, content, seededAt, seededAt]
+        });
+      }
+    }
   } catch {
   }
   try {
     await client.execute({
-      sql: `ALTER TABLE messages ADD COLUMN session_scope TEXT`,
+      sql: `ALTER TABLE behaviors ADD COLUMN priority TEXT DEFAULT 'p1'`,
       args: []
     });
   } catch {
   }
-  await client.executeMultiple(`
-    CREATE INDEX IF NOT EXISTS idx_notifications_agent_scope_read
-      ON notifications(agent_id, session_scope, read, created_at);
-
-    CREATE INDEX IF NOT EXISTS idx_messages_target_scope_status
-      ON messages(target_agent, session_scope, status, created_at);
-  `);
   try {
     await client.execute({
-      sql: `UPDATE memories SET project_name = 'exe-create' WHERE project_name = 'web'`,
+      sql: `ALTER TABLE behaviors ADD COLUMN vector F32_BLOB(${EMBEDDING_DIM})`,
       args: []
     });
+  } catch {
+  }
+  try {
     await client.execute({
-      sql: `UPDATE memories SET project_name = 'exe-os' WHERE project_name = 'worker'`,
+      sql: `ALTER TABLE tasks ADD COLUMN blocked_by TEXT`,
       args: []
     });
+  } catch {
+  }
+  try {
     await client.execute({
-      sql: `UPDATE tasks SET project_name = 'exe-create' WHERE project_name = 'web'`,
+      sql: `ALTER TABLE tasks ADD COLUMN parent_task_id TEXT`,
       args: []
     });
+  } catch {
+  }
+  try {
     await client.execute({
-      sql: `UPDATE tasks SET project_name = 'exe-os' WHERE project_name = 'worker'`,
+      sql: `CREATE INDEX IF NOT EXISTS idx_tasks_parent_task_id
+              ON tasks(parent_task_id)
+              WHERE parent_task_id IS NOT NULL`,
       args: []
     });
   } catch {
   }
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS trajectories (
+  try {
+    await client.execute({
+      sql: `UPDATE tasks SET status = 'done' WHERE status = 'completed'`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE tasks ADD COLUMN reviewer TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE tasks ADD COLUMN context TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE tasks ADD COLUMN result TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE tasks ADD COLUMN assigned_tmux TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE tasks ADD COLUMN checkpoint TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE tasks ADD COLUMN checkpoint_count INTEGER NOT NULL DEFAULT 0`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE tasks ADD COLUMN complexity TEXT NOT NULL DEFAULT 'standard'`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE tasks ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE memories ADD COLUMN task_id TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE memories ADD COLUMN author_device_id TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'`,
+      args: []
+    });
+  } catch {
+  }
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS consolidations (
+      id                    TEXT PRIMARY KEY,
+      consolidated_memory_id TEXT NOT NULL,
+      source_memory_id      TEXT NOT NULL,
+      created_at            TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_consolidations_source
+      ON consolidations(source_memory_id);
+
+    CREATE INDEX IF NOT EXISTS idx_consolidations_consolidated
+      ON consolidations(consolidated_memory_id);
+  `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS reminders (
+      id            TEXT PRIMARY KEY,
+      text          TEXT NOT NULL,
+      created_at    TEXT NOT NULL,
+      due_date      TEXT,
+      completed_at  TEXT
+    );
+  `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS notifications (
+      id          TEXT PRIMARY KEY,
+      agent_id    TEXT NOT NULL,
+      agent_role  TEXT NOT NULL,
+      event       TEXT NOT NULL,
+      project     TEXT NOT NULL,
+      summary     TEXT NOT NULL,
+      task_file   TEXT,
+      session_scope TEXT,
+      read        INTEGER NOT NULL DEFAULT 0,
+      created_at  TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_notifications_read
+      ON notifications(read);
+
+    CREATE INDEX IF NOT EXISTS idx_notifications_agent
+      ON notifications(agent_id, session_scope);
+
+    CREATE INDEX IF NOT EXISTS idx_notifications_task_file
+      ON notifications(task_file);
+  `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS schedules (
+      id            TEXT PRIMARY KEY,
+      cron          TEXT NOT NULL,
+      description   TEXT NOT NULL,
+      job_type      TEXT NOT NULL DEFAULT 'report',
+      prompt        TEXT,
+      assigned_to   TEXT,
+      project_name  TEXT,
+      active        INTEGER NOT NULL DEFAULT 1,
+      use_crontab   INTEGER NOT NULL DEFAULT 0,
+      created_at    TEXT NOT NULL
+    );
+  `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS device_registry (
+      device_id     TEXT PRIMARY KEY,
+      friendly_name TEXT NOT NULL,
+      hostname      TEXT NOT NULL,
+      projects      TEXT NOT NULL DEFAULT '[]',
+      agents        TEXT NOT NULL DEFAULT '[]',
+      connected     INTEGER DEFAULT 0,
+      last_seen     TEXT NOT NULL
+    );
+  `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS messages (
+      id              TEXT PRIMARY KEY,
+      from_agent      TEXT NOT NULL,
+      from_device     TEXT NOT NULL DEFAULT 'local',
+      target_agent    TEXT NOT NULL,
+      target_project  TEXT,
+      target_device   TEXT NOT NULL DEFAULT 'local',
+      session_scope   TEXT,
+      content         TEXT NOT NULL,
+      priority        TEXT DEFAULT 'normal',
+      status          TEXT DEFAULT 'pending',
+      server_seq      INTEGER,
+      retry_count     INTEGER DEFAULT 0,
+      created_at      TEXT NOT NULL,
+      delivered_at    TEXT,
+      processed_at    TEXT,
+      failed_at       TEXT,
+      failure_reason  TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_messages_target
+      ON messages(target_agent, session_scope, status);
+
+    CREATE INDEX IF NOT EXISTS idx_messages_conversation_order
+      ON messages(target_agent, session_scope, from_agent, server_seq);
+  `);
+  try {
+    await client.execute({
+      sql: `ALTER TABLE notifications ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE messages ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  await client.executeMultiple(`
+    CREATE INDEX IF NOT EXISTS idx_notifications_agent_scope_read
+      ON notifications(agent_id, session_scope, read, created_at);
+
+    CREATE INDEX IF NOT EXISTS idx_messages_target_scope_status
+      ON messages(target_agent, session_scope, status, created_at);
+  `);
+  try {
+    await client.execute({
+      sql: `UPDATE memories SET project_name = 'exe-create' WHERE project_name = 'web'`,
+      args: []
+    });
+    await client.execute({
+      sql: `UPDATE memories SET project_name = 'exe-os' WHERE project_name = 'worker'`,
+      args: []
+    });
+    await client.execute({
+      sql: `UPDATE tasks SET project_name = 'exe-create' WHERE project_name = 'web'`,
+      args: []
+    });
+    await client.execute({
+      sql: `UPDATE tasks SET project_name = 'exe-os' WHERE project_name = 'worker'`,
+      args: []
+    });
+  } catch {
+  }
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS trajectories (
       id              TEXT PRIMARY KEY,
       task_id         TEXT NOT NULL,
       agent_id        TEXT NOT NULL,
@@ -1947,1120 +2747,1219 @@ async function ensureSchema() {
   } catch {
   }
 }
-var _client, _resilientClient, _walCheckpointTimer, _daemonClient, _adapterClient, initTurso;
+async function disposeDatabase() {
+  if (_walCheckpointTimer) {
+    clearInterval(_walCheckpointTimer);
+    _walCheckpointTimer = null;
+  }
+  if (_daemonClient) {
+    _daemonClient.close();
+    _daemonClient = null;
+  }
+  if (_adapterClient && _adapterClient !== _resilientClient) {
+    _adapterClient.close();
+  }
+  _adapterClient = null;
+  if (_client) {
+    _client.close();
+    _client = null;
+    _resilientClient = null;
+  }
+}
+var _client, _resilientClient, _walCheckpointTimer, _daemonClient, _adapterClient, initTurso, disposeTurso;
 var init_database = __esm({
   "src/lib/database.ts"() {
     "use strict";
     init_db_retry();
     init_employees();
     init_database_adapter();
+    init_memory();
     _client = null;
     _resilientClient = null;
     _walCheckpointTimer = null;
     _daemonClient = null;
     _adapterClient = null;
     initTurso = initDatabase;
+    disposeTurso = disposeDatabase;
   }
 });
 
-// src/lib/state-bus.ts
-var StateBus, orgBus;
-var init_state_bus = __esm({
-  "src/lib/state-bus.ts"() {
-    "use strict";
-    StateBus = class {
-      handlers = /* @__PURE__ */ new Map();
-      globalHandlers = /* @__PURE__ */ new Set();
-      /** Emit an event to all subscribers */
-      emit(event) {
-        const typeHandlers = this.handlers.get(event.type);
-        if (typeHandlers) {
-          for (const handler of typeHandlers) {
-            try {
-              handler(event);
-            } catch {
-            }
-          }
+// src/lib/session-registry.ts
+import path6 from "path";
+import os5 from "os";
+var REGISTRY_PATH;
+var init_session_registry = __esm({
+  "src/lib/session-registry.ts"() {
+    "use strict";
+    REGISTRY_PATH = path6.join(os5.homedir(), ".exe-os", "session-registry.json");
+  }
+});
+
+// src/lib/session-key.ts
+import { execSync as execSync2 } from "child_process";
+function normalizeCommand(command) {
+  const trimmed = command.trim().toLowerCase();
+  const parts = trimmed.split(/[\\/]/);
+  return parts[parts.length - 1] ?? trimmed;
+}
+function detectRuntimeFromCommand(command) {
+  const normalized = normalizeCommand(command);
+  for (const [runtime, commands] of Object.entries(RUNTIME_COMMANDS)) {
+    if (commands.includes(normalized)) {
+      return runtime;
+    }
+  }
+  return null;
+}
+function resolveRuntimeProcess() {
+  let pid = process.ppid;
+  for (let i = 0; i < 10; i++) {
+    try {
+      const info = execSync2(`ps -p ${pid} -o ppid=,comm=`, {
+        encoding: "utf8",
+        timeout: 2e3
+      }).trim();
+      const match = info.match(/^\s*(\d+)\s+(.+)$/);
+      if (!match) break;
+      const [, ppid, cmd] = match;
+      const runtime = detectRuntimeFromCommand(cmd ?? "");
+      if (runtime) {
+        return { pid: String(pid), runtime };
+      }
+      pid = parseInt(ppid, 10);
+      if (pid <= 1) break;
+    } catch {
+      break;
+    }
+  }
+  return null;
+}
+function getSessionKey() {
+  if (_cached) return _cached;
+  if (process.env.EXE_SESSION_KEY) {
+    _cached = process.env.EXE_SESSION_KEY;
+    return _cached;
+  }
+  const resolved = resolveRuntimeProcess();
+  if (resolved) {
+    _cachedRuntime = resolved.runtime;
+    _cached = resolved.pid;
+    return _cached;
+  }
+  _cached = process.env.CLAUDE_CODE_SSE_PORT ?? String(process.ppid);
+  return _cached;
+}
+var _cached, _cachedRuntime, RUNTIME_COMMANDS;
+var init_session_key = __esm({
+  "src/lib/session-key.ts"() {
+    "use strict";
+    _cached = null;
+    _cachedRuntime = null;
+    RUNTIME_COMMANDS = {
+      claude: ["claude", "claude.exe", "claude-native"],
+      codex: ["codex"],
+      opencode: ["opencode"]
+    };
+  }
+});
+
+// src/lib/tmux-transport.ts
+var tmux_transport_exports = {};
+__export(tmux_transport_exports, {
+  TmuxTransport: () => TmuxTransport
+});
+import { execFileSync } from "child_process";
+var QUIET, TmuxTransport;
+var init_tmux_transport = __esm({
+  "src/lib/tmux-transport.ts"() {
+    "use strict";
+    QUIET = {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    };
+    TmuxTransport = class {
+      getMySession() {
+        try {
+          return execFileSync("tmux", ["display-message", "-p", "#{session_name}"], QUIET).trim() || null;
+        } catch {
+          return null;
         }
-        for (const handler of this.globalHandlers) {
-          try {
-            handler(event);
-          } catch {
-          }
+      }
+      listSessions() {
+        try {
+          return execFileSync("tmux", ["list-sessions", "-F", "#{session_name}"], QUIET).trim().split("\n").filter(Boolean);
+        } catch {
+          return [];
         }
       }
-      /** Subscribe to a specific event type */
-      on(type, handler) {
-        if (!this.handlers.has(type)) {
-          this.handlers.set(type, /* @__PURE__ */ new Set());
+      isAlive(target) {
+        try {
+          const sessions = this.listSessions();
+          if (!sessions.includes(target)) return false;
+          const paneStatus = execFileSync(
+            "tmux",
+            ["list-panes", "-t", target, "-F", "#{pane_dead}"],
+            QUIET
+          ).trim();
+          return paneStatus !== "1";
+        } catch {
+          return false;
         }
-        this.handlers.get(type).add(handler);
       }
-      /** Subscribe to ALL events */
-      onAny(handler) {
-        this.globalHandlers.add(handler);
+      sendKeys(target, keys) {
+        execFileSync("tmux", ["send-keys", "-t", target, keys, "Enter"], QUIET);
       }
-      /** Unsubscribe from a specific event type */
-      off(type, handler) {
-        this.handlers.get(type)?.delete(handler);
+      /**
+       * Send text as literal characters, then submit with Enter as a separate call.
+       * Fixes Codex intercom bug: long text + Enter in one send-keys blast causes
+       * Codex to drop the Enter. Splitting them ensures the text renders before
+       * the submit keystroke arrives.
+       */
+      sendKeysLiteral(target, text) {
+        execFileSync("tmux", ["send-keys", "-t", target, "-l", text], QUIET);
+        execFileSync("tmux", ["send-keys", "-t", target, "Enter"], QUIET);
       }
-      /** Unsubscribe from ALL events */
-      offAny(handler) {
-        this.globalHandlers.delete(handler);
+      capturePane(target, lines) {
+        const args = ["capture-pane", "-t", target, "-p"];
+        if (lines) args.push("-S", `-${lines}`);
+        return execFileSync("tmux", args, { ...QUIET, timeout: 3e3 });
       }
-      /** Remove all listeners */
-      clear() {
-        this.handlers.clear();
-        this.globalHandlers.clear();
+      isPaneInCopyMode(target) {
+        try {
+          const result = execFileSync(
+            "tmux",
+            ["display-message", "-p", "-t", target, "#{pane_in_mode}"],
+            { ...QUIET, timeout: 3e3 }
+          ).trim();
+          return result === "1";
+        } catch {
+          return false;
+        }
+      }
+      spawn(name, config) {
+        try {
+          const args = ["new-session", "-d", "-s", name];
+          if (config.cwd) args.push("-c", config.cwd);
+          args.push(config.command);
+          execFileSync("tmux", args);
+          return { sessionName: name };
+        } catch (e) {
+          return { sessionName: name, error: `spawn failed: ${e}` };
+        }
+      }
+      kill(target) {
+        try {
+          execFileSync("tmux", ["kill-session", "-t", target], QUIET);
+        } catch {
+        }
+      }
+      pipeLog(target, logFile) {
+        try {
+          const safePath = logFile.replace(/'/g, "'\\''");
+          execFileSync("tmux", ["pipe-pane", "-t", target, `cat >> '${safePath}'`], QUIET);
+        } catch {
+        }
       }
     };
-    orgBus = new StateBus();
   }
 });
 
-// src/lib/shard-manager.ts
-var shard_manager_exports = {};
-__export(shard_manager_exports, {
-  disposeShards: () => disposeShards,
-  ensureShardSchema: () => ensureShardSchema,
-  getOpenShardCount: () => getOpenShardCount,
-  getReadyShardClient: () => getReadyShardClient,
-  getShardClient: () => getShardClient,
-  getShardsDir: () => getShardsDir,
-  initShardManager: () => initShardManager,
-  isShardingEnabled: () => isShardingEnabled,
-  listShards: () => listShards,
-  shardExists: () => shardExists
-});
-import path5 from "path";
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readdirSync } from "fs";
-import { createClient as createClient2 } from "@libsql/client";
-function initShardManager(encryptionKey) {
-  _encryptionKey = encryptionKey;
-  if (!existsSync5(SHARDS_DIR)) {
-    mkdirSync2(SHARDS_DIR, { recursive: true });
+// src/lib/transport.ts
+function getTransport() {
+  if (!_transport) {
+    const { TmuxTransport: TmuxTransport2 } = (init_tmux_transport(), __toCommonJS(tmux_transport_exports));
+    _transport = new TmuxTransport2();
   }
-  _shardingEnabled = true;
-  if (_evictionTimer) clearInterval(_evictionTimer);
-  _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
-  _evictionTimer.unref();
-}
-function isShardingEnabled() {
-  return _shardingEnabled;
-}
-function getShardsDir() {
-  return SHARDS_DIR;
+  return _transport;
 }
-function getShardClient(projectName) {
-  if (!_encryptionKey) {
-    throw new Error("Shard manager not initialized. Call initShardManager() first.");
+var _transport;
+var init_transport = __esm({
+  "src/lib/transport.ts"() {
+    "use strict";
+    _transport = null;
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
-  if (!safeName) {
-    throw new Error(`Invalid project name for shard: "${projectName}"`);
+});
+
+// src/lib/cc-agent-support.ts
+import { execSync as execSync3 } from "child_process";
+var init_cc_agent_support = __esm({
+  "src/lib/cc-agent-support.ts"() {
+    "use strict";
   }
-  const cached = _shards.get(safeName);
-  if (cached) {
-    _shardLastAccess.set(safeName, Date.now());
-    return cached;
+});
+
+// src/lib/mcp-prefix.ts
+var MCP_PRIMARY_KEY, MCP_LEGACY_KEY, MCP_TOOL_PREFIXES;
+var init_mcp_prefix = __esm({
+  "src/lib/mcp-prefix.ts"() {
+    "use strict";
+    MCP_PRIMARY_KEY = "exe-os";
+    MCP_LEGACY_KEY = "exe-mem";
+    MCP_TOOL_PREFIXES = [
+      `mcp__${MCP_PRIMARY_KEY}__`,
+      `mcp__${MCP_LEGACY_KEY}__`
+    ];
   }
-  while (_shards.size >= MAX_OPEN_SHARDS) {
-    evictLRU();
+});
+
+// src/lib/provider-table.ts
+var init_provider_table = __esm({
+  "src/lib/provider-table.ts"() {
+    "use strict";
   }
-  const dbPath = path5.join(SHARDS_DIR, `${safeName}.db`);
-  const client = createClient2({
-    url: `file:${dbPath}`,
-    encryptionKey: _encryptionKey
-  });
-  _shards.set(safeName, client);
-  _shardLastAccess.set(safeName, Date.now());
-  return client;
-}
-function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return existsSync5(path5.join(SHARDS_DIR, `${safeName}.db`));
-}
-function listShards() {
-  if (!existsSync5(SHARDS_DIR)) return [];
-  return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
-}
-async function ensureShardSchema(client) {
-  await client.execute("PRAGMA journal_mode = WAL");
-  await client.execute("PRAGMA busy_timeout = 30000");
-  try {
-    await client.execute("PRAGMA libsql_vector_search_ef = 128");
-  } catch {
+});
+
+// src/lib/runtime-table.ts
+var RUNTIME_TABLE;
+var init_runtime_table = __esm({
+  "src/lib/runtime-table.ts"() {
+    "use strict";
+    RUNTIME_TABLE = {
+      codex: {
+        binary: "codex",
+        launchMode: "interactive",
+        autoApproveFlag: "--dangerously-bypass-approvals-and-sandbox",
+        inlineFlag: "--no-alt-screen",
+        apiKeyEnv: "OPENAI_API_KEY",
+        defaultModel: "gpt-5.4"
+      },
+      opencode: {
+        binary: "opencode",
+        launchMode: "exec",
+        autoApproveFlag: "--dangerously-skip-permissions",
+        inlineFlag: "",
+        apiKeyEnv: "ANTHROPIC_API_KEY",
+        defaultModel: "anthropic/claude-sonnet-4-6"
+      }
+    };
   }
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS memories (
-      id            TEXT PRIMARY KEY,
-      agent_id      TEXT NOT NULL,
-      agent_role    TEXT NOT NULL,
-      session_id    TEXT NOT NULL,
-      timestamp     TEXT NOT NULL,
-      tool_name     TEXT NOT NULL,
-      project_name  TEXT NOT NULL,
-      has_error     INTEGER NOT NULL DEFAULT 0,
-      raw_text      TEXT NOT NULL,
-      vector        F32_BLOB(1024),
-      version       INTEGER NOT NULL DEFAULT 0
-    );
+});
 
-    CREATE INDEX IF NOT EXISTS idx_memories_agent ON memories(agent_id);
-    CREATE INDEX IF NOT EXISTS idx_memories_timestamp ON memories(timestamp);
-    CREATE INDEX IF NOT EXISTS idx_memories_agent_project ON memories(agent_id, project_name);
-  `);
-  await client.executeMultiple(`
-    CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
-      raw_text,
-      content='memories',
-      content_rowid='rowid'
-    );
+// src/lib/agent-config.ts
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync6 } from "fs";
+import path7 from "path";
+var AGENT_CONFIG_PATH, DEFAULT_MODELS;
+var init_agent_config = __esm({
+  "src/lib/agent-config.ts"() {
+    "use strict";
+    init_config();
+    init_runtime_table();
+    init_secure_files();
+    AGENT_CONFIG_PATH = path7.join(EXE_AI_DIR, "agent-config.json");
+    DEFAULT_MODELS = {
+      claude: "claude-opus-4.6",
+      codex: RUNTIME_TABLE.codex?.defaultModel ?? "gpt-5.4",
+      opencode: RUNTIME_TABLE.opencode?.defaultModel ?? "anthropic/claude-sonnet-4-6"
+    };
+  }
+});
 
-    CREATE TRIGGER IF NOT EXISTS memories_fts_ai AFTER INSERT ON memories BEGIN
-      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
-    END;
+// src/lib/intercom-queue.ts
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, renameSync as renameSync3, existsSync as existsSync7, mkdirSync as mkdirSync2 } from "fs";
+import path8 from "path";
+import os6 from "os";
+var QUEUE_PATH, TTL_MS, INTERCOM_LOG;
+var init_intercom_queue = __esm({
+  "src/lib/intercom-queue.ts"() {
+    "use strict";
+    QUEUE_PATH = path8.join(os6.homedir(), ".exe-os", "intercom-queue.json");
+    TTL_MS = 60 * 60 * 1e3;
+    INTERCOM_LOG = path8.join(os6.homedir(), ".exe-os", "intercom.log");
+  }
+});
 
-    CREATE TRIGGER IF NOT EXISTS memories_fts_ad AFTER DELETE ON memories BEGIN
-      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
-    END;
+// src/lib/license.ts
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync8, mkdirSync as mkdirSync3 } from "fs";
+import { randomUUID as randomUUID2 } from "crypto";
+import { createRequire as createRequire2 } from "module";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import os7 from "os";
+import path9 from "path";
+import { jwtVerify, importSPKI } from "jose";
+var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH;
+var init_license = __esm({
+  "src/lib/license.ts"() {
+    "use strict";
+    init_config();
+    LICENSE_PATH = path9.join(EXE_AI_DIR, "license.key");
+    CACHE_PATH = path9.join(EXE_AI_DIR, "license-cache.json");
+    DEVICE_ID_PATH = path9.join(EXE_AI_DIR, "device-id");
+  }
+});
 
-    CREATE TRIGGER IF NOT EXISTS memories_fts_au AFTER UPDATE ON memories BEGIN
-      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
-      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
-    END;
-  `);
-  for (const col of [
-    "ALTER TABLE memories ADD COLUMN task_id TEXT",
-    "ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0",
-    "ALTER TABLE memories ADD COLUMN author_device_id TEXT",
-    "ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'",
-    "ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5",
-    "ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'",
-    "ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0",
-    "ALTER TABLE memories ADD COLUMN graph_extracted INTEGER DEFAULT 0",
-    "ALTER TABLE memories ADD COLUMN content_hash TEXT",
-    "ALTER TABLE memories ADD COLUMN graph_extracted_hash TEXT",
-    "ALTER TABLE memories ADD COLUMN confidence REAL DEFAULT 0.7",
-    "ALTER TABLE memories ADD COLUMN last_accessed TEXT",
-    // Wiki linkage columns (must match database.ts)
-    "ALTER TABLE memories ADD COLUMN workspace_id TEXT",
-    "ALTER TABLE memories ADD COLUMN document_id TEXT",
-    "ALTER TABLE memories ADD COLUMN user_id TEXT",
-    "ALTER TABLE memories ADD COLUMN char_offset INTEGER",
-    "ALTER TABLE memories ADD COLUMN page_number INTEGER",
-    // Source provenance columns (must match database.ts)
-    "ALTER TABLE memories ADD COLUMN source_path TEXT",
-    "ALTER TABLE memories ADD COLUMN source_type TEXT DEFAULT 'text'",
-    "ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3",
-    "ALTER TABLE memories ADD COLUMN supersedes_id TEXT",
-    // MS-11: draft staging, MS-6a: memory_type, MS-7: trajectory
-    "ALTER TABLE memories ADD COLUMN draft INTEGER DEFAULT 0",
-    "ALTER TABLE memories ADD COLUMN memory_type TEXT DEFAULT 'raw'",
-    "ALTER TABLE memories ADD COLUMN trajectory TEXT",
-    // Metadata enrichment columns (must match database.ts)
-    "ALTER TABLE memories ADD COLUMN intent TEXT",
-    "ALTER TABLE memories ADD COLUMN outcome TEXT",
-    "ALTER TABLE memories ADD COLUMN domain TEXT",
-    "ALTER TABLE memories ADD COLUMN referenced_entities TEXT",
-    "ALTER TABLE memories ADD COLUMN retrieval_count INTEGER DEFAULT 0",
-    "ALTER TABLE memories ADD COLUMN chain_position TEXT",
-    "ALTER TABLE memories ADD COLUMN review_status TEXT",
-    "ALTER TABLE memories ADD COLUMN context_window_pct INTEGER",
-    "ALTER TABLE memories ADD COLUMN file_paths TEXT",
-    "ALTER TABLE memories ADD COLUMN commit_hash TEXT",
-    "ALTER TABLE memories ADD COLUMN duration_ms INTEGER",
-    "ALTER TABLE memories ADD COLUMN token_cost REAL",
-    "ALTER TABLE memories ADD COLUMN audience TEXT",
-    "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
-  ]) {
-    try {
-      await client.execute(col);
-    } catch {
-    }
+// src/lib/plan-limits.ts
+import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
+import path10 from "path";
+var CACHE_PATH2;
+var init_plan_limits = __esm({
+  "src/lib/plan-limits.ts"() {
+    "use strict";
+    init_database();
+    init_employees();
+    init_license();
+    init_config();
+    CACHE_PATH2 = path10.join(EXE_AI_DIR, "license-cache.json");
   }
-  for (const idx of [
-    "CREATE INDEX IF NOT EXISTS idx_memories_tier ON memories(tier)",
-    "CREATE INDEX IF NOT EXISTS idx_memories_supersedes ON memories(supersedes_id) WHERE supersedes_id IS NOT NULL"
-  ]) {
-    try {
-      await client.execute(idx);
-    } catch {
-    }
+});
+
+// src/lib/tmux-routing.ts
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, mkdirSync as mkdirSync4, existsSync as existsSync10, appendFileSync, readdirSync } from "fs";
+import path11 from "path";
+import os8 from "os";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function getMySession() {
+  return getTransport().getMySession();
+}
+function extractRootExe(name) {
+  if (!name) return null;
+  if (!name.includes("-")) return name;
+  const parts = name.split("-").filter(Boolean);
+  return parts.length > 0 ? parts[parts.length - 1] : null;
+}
+function getParentExe(sessionKey) {
+  try {
+    const data = JSON.parse(readFileSync9(path11.join(SESSION_CACHE, `parent-exe-${sessionKey}.json`), "utf8"));
+    return data.parentExe || null;
+  } catch {
+    return null;
   }
+}
+function resolveExeSession() {
+  const mySession = getMySession();
+  if (!mySession) return null;
+  const fromSessionName = extractRootExe(mySession);
   try {
-    await client.execute("CREATE INDEX IF NOT EXISTS idx_memories_status ON memories(status)");
+    const key = getSessionKey();
+    const parentExe = getParentExe(key);
+    if (parentExe) {
+      const fromCache = extractRootExe(parentExe) ?? parentExe;
+      if (fromSessionName && fromCache !== fromSessionName) {
+        process.stderr.write(
+          `[tmux-routing] WARN: cache says "${fromCache}" but session name says "${fromSessionName}". Trusting session name.
+`
+        );
+        return fromSessionName;
+      }
+      return fromCache;
+    }
   } catch {
   }
-  for (const idx of [
-    "CREATE INDEX IF NOT EXISTS idx_memories_workspace ON memories(workspace_id)",
-    "CREATE INDEX IF NOT EXISTS idx_memories_document ON memories(document_id)",
-    "CREATE INDEX IF NOT EXISTS idx_memories_user ON memories(user_id)"
-  ]) {
-    try {
-      await client.execute(idx);
-    } catch {
-    }
+  return fromSessionName ?? mySession;
+}
+var SPAWN_LOCK_DIR, SESSION_CACHE, INTERCOM_LOG2, DEBOUNCE_FILE, DEBOUNCE_CLEANUP_AGE_MS;
+var init_tmux_routing = __esm({
+  "src/lib/tmux-routing.ts"() {
+    "use strict";
+    init_session_registry();
+    init_session_key();
+    init_transport();
+    init_cc_agent_support();
+    init_mcp_prefix();
+    init_provider_table();
+    init_agent_config();
+    init_runtime_table();
+    init_intercom_queue();
+    init_plan_limits();
+    init_employees();
+    SPAWN_LOCK_DIR = path11.join(os8.homedir(), ".exe-os", "spawn-locks");
+    SESSION_CACHE = path11.join(os8.homedir(), ".exe-os", "session-cache");
+    INTERCOM_LOG2 = path11.join(os8.homedir(), ".exe-os", "intercom.log");
+    DEBOUNCE_FILE = path11.join(SESSION_CACHE, "intercom-debounce.json");
+    DEBOUNCE_CLEANUP_AGE_MS = 5 * 60 * 1e3;
   }
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS entities (
-      id TEXT PRIMARY KEY,
-      name TEXT NOT NULL,
-      type TEXT NOT NULL,
-      first_seen TEXT NOT NULL,
-      last_seen TEXT NOT NULL,
-      properties TEXT DEFAULT '{}',
-      UNIQUE(name, type)
-    );
-
-    CREATE TABLE IF NOT EXISTS relationships (
-      id TEXT PRIMARY KEY,
-      source_entity_id TEXT NOT NULL,
-      target_entity_id TEXT NOT NULL,
-      type TEXT NOT NULL,
-      weight REAL DEFAULT 1.0,
-      timestamp TEXT NOT NULL,
-      properties TEXT DEFAULT '{}',
-      UNIQUE(source_entity_id, target_entity_id, type)
-    );
-
-    CREATE TABLE IF NOT EXISTS entity_memories (
-      entity_id TEXT NOT NULL,
-      memory_id TEXT NOT NULL,
-      PRIMARY KEY (entity_id, memory_id)
-    );
-
-    CREATE TABLE IF NOT EXISTS relationship_memories (
-      relationship_id TEXT NOT NULL,
-      memory_id TEXT NOT NULL,
-      PRIMARY KEY (relationship_id, memory_id)
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_entities_name ON entities(name);
-    CREATE INDEX IF NOT EXISTS idx_entities_type ON entities(type);
-    CREATE INDEX IF NOT EXISTS idx_relationships_source ON relationships(source_entity_id);
-    CREATE INDEX IF NOT EXISTS idx_relationships_target ON relationships(target_entity_id);
-    CREATE INDEX IF NOT EXISTS idx_relationships_type ON relationships(type);
-
-    CREATE TABLE IF NOT EXISTS hyperedges (
-      id TEXT PRIMARY KEY,
-      label TEXT NOT NULL,
-      relation TEXT NOT NULL,
-      confidence REAL DEFAULT 1.0,
-      timestamp TEXT NOT NULL
-    );
+});
 
-    CREATE TABLE IF NOT EXISTS hyperedge_nodes (
-      hyperedge_id TEXT NOT NULL,
-      entity_id TEXT NOT NULL,
-      PRIMARY KEY (hyperedge_id, entity_id)
-    );
-  `);
-  for (const col of [
-    "ALTER TABLE relationships ADD COLUMN confidence REAL DEFAULT 1.0",
-    "ALTER TABLE relationships ADD COLUMN confidence_label TEXT DEFAULT 'extracted'"
-  ]) {
-    try {
-      await client.execute(col);
-    } catch {
-    }
+// src/lib/task-scope.ts
+function getCurrentSessionScope() {
+  try {
+    return resolveExeSession();
+  } catch {
+    return null;
   }
 }
-async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+function strictSessionScopeFilter(sessionScope, tableAlias) {
+  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
+  if (!scope) return { sql: "", args: [] };
+  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
+  return {
+    sql: ` AND ${col} = ?`,
+    args: [scope]
+  };
 }
-function evictLRU() {
-  let oldest = null;
-  let oldestTime = Infinity;
-  for (const [name, time] of _shardLastAccess) {
-    if (time < oldestTime) {
-      oldestTime = time;
-      oldest = name;
-    }
+var init_task_scope = __esm({
+  "src/lib/task-scope.ts"() {
+    "use strict";
+    init_tmux_routing();
   }
-  if (oldest) {
-    const client = _shards.get(oldest);
-    if (client) {
-      client.close();
+});
+
+// src/lib/notifications.ts
+import crypto2 from "crypto";
+import path12 from "path";
+import os9 from "os";
+import {
+  readFileSync as readFileSync10,
+  readdirSync as readdirSync2,
+  unlinkSync as unlinkSync3,
+  existsSync as existsSync11,
+  rmdirSync
+} from "fs";
+async function readUnreadNotifications(agentFilter, sessionScope) {
+  try {
+    const client = getClient();
+    const conditions = ["read = 0"];
+    const args = [];
+    const scope = strictSessionScopeFilter(sessionScope);
+    if (agentFilter) {
+      conditions.push("agent_id = ?");
+      args.push(agentFilter);
     }
-    _shards.delete(oldest);
-    _shardLastAccess.delete(oldest);
+    const result = await client.execute({
+      sql: `SELECT id, agent_id, agent_role, event, project, summary, task_file, session_scope, created_at
+            FROM notifications
+            WHERE ${conditions.join(" AND ")}${scope.sql}
+            ORDER BY created_at ASC`,
+      args: [...args, ...scope.args]
+    });
+    return result.rows.map((r) => ({
+      id: String(r.id),
+      agentId: String(r.agent_id),
+      agentRole: String(r.agent_role),
+      event: String(r.event),
+      project: String(r.project),
+      summary: String(r.summary),
+      taskFile: r.task_file ? String(r.task_file) : void 0,
+      sessionScope: r.session_scope == null ? null : String(r.session_scope),
+      timestamp: String(r.created_at),
+      read: false
+    }));
+  } catch {
+    return [];
   }
 }
-function evictIdleShards() {
-  const now = Date.now();
-  const toEvict = [];
-  for (const [name, lastAccess] of _shardLastAccess) {
-    if (now - lastAccess > SHARD_IDLE_MS) {
-      toEvict.push(name);
-    }
+async function markAsRead(ids, sessionScope) {
+  if (ids.length === 0) return;
+  try {
+    const client = getClient();
+    const placeholders = ids.map(() => "?").join(", ");
+    const scope = strictSessionScopeFilter(sessionScope);
+    await client.execute({
+      sql: `UPDATE notifications SET read = 1 WHERE id IN (${placeholders})${scope.sql}`,
+      args: [...ids, ...scope.args]
+    });
+  } catch {
   }
-  for (const name of toEvict) {
-    const client = _shards.get(name);
-    if (client) {
-      client.close();
-    }
-    _shards.delete(name);
-    _shardLastAccess.delete(name);
+}
+var init_notifications = __esm({
+  "src/lib/notifications.ts"() {
+    "use strict";
+    init_database();
+    init_task_scope();
   }
+});
+
+// src/lib/keychain.ts
+import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
+import { existsSync as existsSync12 } from "fs";
+import path13 from "path";
+import os10 from "os";
+function getKeyDir() {
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path13.join(os10.homedir(), ".exe-os");
 }
-function getOpenShardCount() {
-  return _shards.size;
+function getKeyPath() {
+  return path13.join(getKeyDir(), "master.key");
 }
-function disposeShards() {
-  if (_evictionTimer) {
-    clearInterval(_evictionTimer);
-    _evictionTimer = null;
+async function tryKeytar() {
+  try {
+    return await import("keytar");
+  } catch {
+    return null;
   }
-  for (const [, client] of _shards) {
-    client.close();
+}
+async function getMasterKey() {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
+      if (stored) {
+        return Buffer.from(stored, "base64");
+      }
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (!existsSync12(keyPath)) {
+    process.stderr.write(
+      `[keychain] Key not found at ${keyPath} (HOME=${os10.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
+`
+    );
+    return null;
+  }
+  try {
+    const content = await readFile3(keyPath, "utf-8");
+    return Buffer.from(content.trim(), "base64");
+  } catch (err) {
+    process.stderr.write(
+      `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return null;
   }
-  _shards.clear();
-  _shardLastAccess.clear();
-  _shardingEnabled = false;
-  _encryptionKey = null;
 }
-var SHARDS_DIR, SHARD_IDLE_MS, MAX_OPEN_SHARDS, EVICTION_INTERVAL_MS, _shards, _shardLastAccess, _evictionTimer, _encryptionKey, _shardingEnabled;
-var init_shard_manager = __esm({
-  "src/lib/shard-manager.ts"() {
+var SERVICE, ACCOUNT;
+var init_keychain = __esm({
+  "src/lib/keychain.ts"() {
     "use strict";
-    init_config();
-    SHARDS_DIR = path5.join(EXE_AI_DIR, "shards");
-    SHARD_IDLE_MS = 5 * 60 * 1e3;
-    MAX_OPEN_SHARDS = 10;
-    EVICTION_INTERVAL_MS = 60 * 1e3;
-    _shards = /* @__PURE__ */ new Map();
-    _shardLastAccess = /* @__PURE__ */ new Map();
-    _evictionTimer = null;
-    _encryptionKey = null;
-    _shardingEnabled = false;
+    SERVICE = "exe-mem";
+    ACCOUNT = "master-key";
   }
 });
 
-// src/lib/platform-procedures.ts
-var PLATFORM_PROCEDURES, PLATFORM_PROCEDURE_TITLES;
-var init_platform_procedures = __esm({
-  "src/lib/platform-procedures.ts"() {
+// src/lib/state-bus.ts
+var StateBus, orgBus;
+var init_state_bus = __esm({
+  "src/lib/state-bus.ts"() {
     "use strict";
-    PLATFORM_PROCEDURES = [
-      // --- Foundation: what is exe-os ---
-      {
-        title: "What is exe-os \u2014 the operating model every agent must understand",
-        domain: "architecture",
-        priority: "p0",
-        content: "Exe OS is an AI employee operating system. A founder runs 5-10 AI agents as a real org: COO, CTO, CMO, engineers, and content production specialists. Each agent has identity, expertise, and experience layers \u2014 persistent memory that makes them better over time. All data is local-first, E2EE, owned by the user. The MCP server is the ONLY data interface \u2014 never access the DB directly."
-      },
-      {
-        title: "Mode 1 \u2014 how exe-os runs inside Claude Code",
-        domain: "architecture",
-        priority: "p0",
-        content: "Mode 1: exe-os runs AS hooks + MCP + skills inside Claude Code, Codex, or OpenCode. The founder picks their default tool at setup. The COO manages employees in tmux sessions. Each coordinator session is a separate window/project. Employees run in their own tmux panes via create_task auto-spawn. The founder talks to the COO; the COO orchestrates the team. The tool is the shell, exe-os is the brain."
-      },
-      {
-        title: "Sessions explained \u2014 coordinator session names and projects",
-        domain: "architecture",
-        priority: "p0",
-        content: "Each coordinator session is an isolated project session. One might be exe-os development, another might be exe-wiki. Each session spawns its own employees using {employee}-{coordinatorSession}. Sessions share the same memory DB but tasks are scoped to the session that created them. A founder can run multiple projects simultaneously. Sessions never interfere with each other."
-      },
-      {
-        title: "Runtime settings \u2014 COO can view and change tools per agent",
-        domain: "workflow",
-        priority: "p1",
-        content: "exe-os supports three tools: Claude Code (Anthropic), Codex (OpenAI), and OpenCode (open source, 75+ providers). Each agent can use a different tool and model. COO uses set_agent_config MCP tool to view or change settings. Call with no args to show all agents. Call with agent_id + runtime + model to change. Users can also run `exe-os settings` from terminal for interactive arrow-key selection."
-      },
-      // --- Hierarchy and dispatch ---
-      {
-        title: "Chain of command \u2014 who talks to whom",
-        domain: "workflow",
-        priority: "p0",
-        content: "Founder -> COO -> CTO/CMO. CTO -> engineers. CMO -> content production. Never skip levels: the COO does not bypass managers for specialist work. Specialists report to their manager. If you need cross-team info, use ask_team_memory \u2014 don't read other agents' task folders. Each level owns dispatch downward and review upward."
-      },
-      {
-        title: "Single dispatch path \u2014 create_task only",
-        domain: "workflow",
-        priority: "p0",
-        content: "create_task is the ONLY way to dispatch work to another agent. No direct ensureEmployee calls, no manual tmux spawns, no send_message for actionable work. create_task \u2192 system auto-spawns \u2192 session correctly named. ONE PATH. No backdoors. No exceptions."
-      },
-      // --- Session isolation ---
-      {
-        title: "Session scoping \u2014 stay in your coordinator boundary",
-        domain: "security",
-        priority: "p0",
-        content: "Session scoping is mandatory. Managers dispatch to workers within their own coordinator session ONLY. Employee sessions use {employee}-{coordinatorSession}. Cross-session dispatch is blocked by the system. Verify session names before dispatch. Tasks are scoped to the creating coordinator session."
-      },
-      {
-        title: "Session isolation \u2014 never touch another session's work",
-        domain: "workflow",
-        priority: "p0",
-        content: "Sessions are isolated. A coordinator session owns ONLY tasks it dispatched. (1) Never close/update/cancel tasks from another coordinator session. (2) Never review work from a different session \u2014 report that it belongs to another session and skip. (3) Ignore other sessions' items in list_tasks results. (4) Employees inherit session: employee sessions work ONLY on their parent coordinator session's tasks. Cross-session work is a system violation."
-      },
-      // --- Engineering: session scoping in code ---
-      {
-        title: "Three-dimensional scoping \u2014 session, project, role \u2014 enforced in every query",
-        domain: "architecture",
-        priority: "p0",
-        content: "Every DB query, notification, review count, and task operation MUST be scoped on 3 dimensions: (1) Session \u2014 filter by session_scope matching the current coordinator session. (2) Project \u2014 filter by project_name. (3) Role \u2014 agents only see data at their hierarchy level. When writing ANY function that touches tasks, reviews, messages, or notifications: always accept a sessionScope parameter and pass it to the SQL WHERE clause. Unscoped queries are bugs. Test by running 2+ coordinator sessions simultaneously."
-      },
-      // --- Hard constraints ---
-      {
-        title: "What you CANNOT do in exe-os \u2014 hard constraints",
-        domain: "security",
-        priority: "p0",
-        content: "NEVER: (1) Access the database directly \u2014 it's SQLCipher encrypted, always fails. Use MCP tools only. (2) Manually spawn tmux sessions \u2014 create_task handles it. (3) Run git checkout main \u2014 agents work in worktrees. (4) Modify another agent's in-progress task. (5) Push to remote \u2014 the COO reviews and pushes. (6) Skip update_task(done) \u2014 it's the ONLY way your work gets reviewed. (7) Run git init."
-      },
-      // --- Operations ---
-      {
-        title: "Managers must supervise deployed workers",
-        domain: "workflow",
-        priority: "p0",
-        content: `Every manager (COO/CTO/CMO) who dispatches work to a worker MUST actively monitor them. Check tmux capture-pane every 10 minutes. Verify they're working, not stuck. If idle at prompt with in_progress task \u2192 send intercom. If stuck \u2192 unblock or escalate. "Standing by" without checking is negligence.`
-      },
-      {
-        title: "COO boot health check \u2014 memory, cloud sync, daemon on every launch",
-        domain: "workflow",
-        priority: "p0",
-        content: "On every /exe boot, COO MUST check system health BEFORE other work: (1) daemon \u2014 is exed PID alive, (2) cloud sync \u2014 grep workers.log for recent cloud-sync errors, (3) memory count \u2014 total in DB, (4) sync delta \u2014 local vs cloud storage_bytes. Report as 4-line status table. If ANY check fails, surface to founder immediately. Do not proceed to tasks until health confirmed."
-      },
-      {
-        title: "exe-build-adv mandatory for 3+ files",
-        domain: "workflow",
-        priority: "p0",
-        content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
-      },
-      {
-        title: "Desktop and TUI are the same product",
-        domain: "architecture",
-        priority: "p0",
-        content: "Desktop and TUI are the SAME product in different renderers. Same data contracts, same interactions, same acceptance criteria. Desktop tab specs in ARCHITECTURE.md ARE the TUI specs. When building TUI, cross-reference Desktop spec. Different tab names, identical behavior. Never treat them as separate products."
-      },
-      // --- Orchestration golden path ---
-      {
-        title: "Task lifecycle \u2014 the golden path every agent follows",
-        domain: "workflow",
-        priority: "p0",
-        content: "create_task is dispatch + delivery. Task lifecycle: open \u2192 in_progress (you start) \u2192 done (update_task when finished) \u2192 needs_review (reviewer nudged) \u2192 closed (COO only via close_task). DB is the reliable delivery \u2014 intercom is just a speedup nudge. If you finish a task, self-chain: check for next task immediately (step 7). Never wait for a nudge. Never say 'standing by.'"
-      },
-      {
-        title: "Intercom is a speedup, not delivery \u2014 DB is the source of truth",
-        domain: "architecture",
-        priority: "p0",
-        content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
+    StateBus = class {
+      handlers = /* @__PURE__ */ new Map();
+      globalHandlers = /* @__PURE__ */ new Set();
+      /** Emit an event to all subscribers */
+      emit(event) {
+        const typeHandlers = this.handlers.get(event.type);
+        if (typeHandlers) {
+          for (const handler of typeHandlers) {
+            try {
+              handler(event);
+            } catch {
+            }
+          }
+        }
+        for (const handler of this.globalHandlers) {
+          try {
+            handler(event);
+          } catch {
+          }
+        }
       }
-    ];
-    PLATFORM_PROCEDURE_TITLES = new Set(
-      PLATFORM_PROCEDURES.map((p) => p.title)
-    );
+      /** Subscribe to a specific event type */
+      on(type, handler) {
+        if (!this.handlers.has(type)) {
+          this.handlers.set(type, /* @__PURE__ */ new Set());
+        }
+        this.handlers.get(type).add(handler);
+      }
+      /** Subscribe to ALL events */
+      onAny(handler) {
+        this.globalHandlers.add(handler);
+      }
+      /** Unsubscribe from a specific event type */
+      off(type, handler) {
+        this.handlers.get(type)?.delete(handler);
+      }
+      /** Unsubscribe from ALL events */
+      offAny(handler) {
+        this.globalHandlers.delete(handler);
+      }
+      /** Remove all listeners */
+      clear() {
+        this.handlers.clear();
+        this.globalHandlers.clear();
+      }
+    };
+    orgBus = new StateBus();
   }
 });
 
-// src/lib/global-procedures.ts
-var global_procedures_exports = {};
-__export(global_procedures_exports, {
-  deactivateGlobalProcedure: () => deactivateGlobalProcedure,
-  getGlobalProceduresBlock: () => getGlobalProceduresBlock,
-  loadGlobalProcedures: () => loadGlobalProcedures,
-  storeGlobalProcedure: () => storeGlobalProcedure
+// src/lib/shard-manager.ts
+var shard_manager_exports = {};
+__export(shard_manager_exports, {
+  disposeShards: () => disposeShards,
+  ensureShardSchema: () => ensureShardSchema,
+  getOpenShardCount: () => getOpenShardCount,
+  getReadyShardClient: () => getReadyShardClient,
+  getShardClient: () => getShardClient,
+  getShardsDir: () => getShardsDir,
+  initShardManager: () => initShardManager,
+  isShardingEnabled: () => isShardingEnabled,
+  listShards: () => listShards,
+  shardExists: () => shardExists
 });
-import { randomUUID } from "crypto";
-async function loadGlobalProcedures() {
-  const client = getClient();
-  const result = await client.execute({
-    sql: "SELECT * FROM global_procedures WHERE active = 1 ORDER BY priority ASC, created_at ASC",
-    args: []
-  });
-  const allRows = result.rows;
-  const customerOnly = allRows.filter((p) => !PLATFORM_PROCEDURE_TITLES.has(p.title));
-  if (customerOnly.length > 0) {
-    _customerCache = customerOnly.map((p) => `### ${p.title}
-${p.content}`).join("\n\n");
-  } else {
-    _customerCache = "";
+import path14 from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, readdirSync as readdirSync3 } from "fs";
+import { createClient as createClient2 } from "@libsql/client";
+function initShardManager(encryptionKey) {
+  _encryptionKey = encryptionKey;
+  if (!existsSync13(SHARDS_DIR)) {
+    mkdirSync5(SHARDS_DIR, { recursive: true });
   }
-  _cacheLoaded = true;
-  return customerOnly;
-}
-function getGlobalProceduresBlock() {
-  const sections = [];
-  if (_platformCache) sections.push(_platformCache);
-  if (_cacheLoaded && _customerCache) sections.push(_customerCache);
-  if (sections.length === 0) return "";
-  return `## Organization-Wide Procedures (MANDATORY \u2014 supersedes all other rules)
-
-${sections.join("\n\n")}
-`;
+  _shardingEnabled = true;
+  if (_evictionTimer) clearInterval(_evictionTimer);
+  _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
+  _evictionTimer.unref();
 }
-async function storeGlobalProcedure(input) {
-  const id = randomUUID();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const client = getClient();
-  await client.execute({
-    sql: `INSERT INTO global_procedures (id, title, content, priority, domain, active, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, 1, ?, ?)`,
-    args: [id, input.title, input.content, input.priority ?? "p0", input.domain ?? null, now, now]
-  });
-  await loadGlobalProcedures();
-  return id;
+function isShardingEnabled() {
+  return _shardingEnabled;
 }
-async function deactivateGlobalProcedure(id) {
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const client = getClient();
-  const result = await client.execute({
-    sql: "UPDATE global_procedures SET active = 0, updated_at = ? WHERE id = ?",
-    args: [now, id]
-  });
-  await loadGlobalProcedures();
-  return result.rowsAffected > 0;
+function getShardsDir() {
+  return SHARDS_DIR;
 }
-var _customerCache, _cacheLoaded, _platformCache;
-var init_global_procedures = __esm({
-  "src/lib/global-procedures.ts"() {
-    "use strict";
-    init_database();
-    init_platform_procedures();
-    _customerCache = "";
-    _cacheLoaded = false;
-    _platformCache = PLATFORM_PROCEDURES.map((p) => `### ${p.title}
-${p.content}`).join("\n\n");
+function getShardClient(projectName) {
+  if (!_encryptionKey) {
+    throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-});
-
-// src/lib/session-registry.ts
-import path6 from "path";
-import os5 from "os";
-var REGISTRY_PATH;
-var init_session_registry = __esm({
-  "src/lib/session-registry.ts"() {
-    "use strict";
-    REGISTRY_PATH = path6.join(os5.homedir(), ".exe-os", "session-registry.json");
+  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  if (!safeName) {
+    throw new Error(`Invalid project name for shard: "${projectName}"`);
   }
-});
-
-// src/lib/session-key.ts
-import { execSync as execSync2 } from "child_process";
-function normalizeCommand(command) {
-  const trimmed = command.trim().toLowerCase();
-  const parts = trimmed.split(/[\\/]/);
-  return parts[parts.length - 1] ?? trimmed;
-}
-function detectRuntimeFromCommand(command) {
-  const normalized = normalizeCommand(command);
-  for (const [runtime, commands] of Object.entries(RUNTIME_COMMANDS)) {
-    if (commands.includes(normalized)) {
-      return runtime;
-    }
+  const cached = _shards.get(safeName);
+  if (cached) {
+    _shardLastAccess.set(safeName, Date.now());
+    return cached;
   }
-  return null;
+  while (_shards.size >= MAX_OPEN_SHARDS) {
+    evictLRU();
+  }
+  const dbPath = path14.join(SHARDS_DIR, `${safeName}.db`);
+  const client = createClient2({
+    url: `file:${dbPath}`,
+    encryptionKey: _encryptionKey
+  });
+  _shards.set(safeName, client);
+  _shardLastAccess.set(safeName, Date.now());
+  return client;
 }
-function resolveRuntimeProcess() {
-  let pid = process.ppid;
-  for (let i = 0; i < 10; i++) {
+function shardExists(projectName) {
+  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  return existsSync13(path14.join(SHARDS_DIR, `${safeName}.db`));
+}
+function listShards() {
+  if (!existsSync13(SHARDS_DIR)) return [];
+  return readdirSync3(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
+}
+async function ensureShardSchema(client) {
+  await client.execute("PRAGMA journal_mode = WAL");
+  await client.execute("PRAGMA busy_timeout = 30000");
+  try {
+    await client.execute("PRAGMA libsql_vector_search_ef = 128");
+  } catch {
+  }
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS memories (
+      id            TEXT PRIMARY KEY,
+      agent_id      TEXT NOT NULL,
+      agent_role    TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      timestamp     TEXT NOT NULL,
+      tool_name     TEXT NOT NULL,
+      project_name  TEXT NOT NULL,
+      has_error     INTEGER NOT NULL DEFAULT 0,
+      raw_text      TEXT NOT NULL,
+      vector        F32_BLOB(1024),
+      version       INTEGER NOT NULL DEFAULT 0
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_memories_agent ON memories(agent_id);
+    CREATE INDEX IF NOT EXISTS idx_memories_timestamp ON memories(timestamp);
+    CREATE INDEX IF NOT EXISTS idx_memories_agent_project ON memories(agent_id, project_name);
+  `);
+  await client.executeMultiple(`
+    CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
+      raw_text,
+      content='memories',
+      content_rowid='rowid'
+    );
+
+    CREATE TRIGGER IF NOT EXISTS memories_fts_ai AFTER INSERT ON memories BEGIN
+      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memories_fts_ad AFTER DELETE ON memories BEGIN
+      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memories_fts_au AFTER UPDATE ON memories BEGIN
+      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
+      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
+    END;
+  `);
+  for (const col of [
+    "ALTER TABLE memories ADD COLUMN task_id TEXT",
+    "ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN author_device_id TEXT",
+    "ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'",
+    "ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5",
+    "ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'",
+    "ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN graph_extracted INTEGER DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN content_hash TEXT",
+    "ALTER TABLE memories ADD COLUMN graph_extracted_hash TEXT",
+    "ALTER TABLE memories ADD COLUMN confidence REAL DEFAULT 0.7",
+    "ALTER TABLE memories ADD COLUMN last_accessed TEXT",
+    // Wiki linkage columns (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN workspace_id TEXT",
+    "ALTER TABLE memories ADD COLUMN document_id TEXT",
+    "ALTER TABLE memories ADD COLUMN user_id TEXT",
+    "ALTER TABLE memories ADD COLUMN char_offset INTEGER",
+    "ALTER TABLE memories ADD COLUMN page_number INTEGER",
+    // Source provenance columns (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN source_path TEXT",
+    "ALTER TABLE memories ADD COLUMN source_type TEXT DEFAULT 'text'",
+    "ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3",
+    "ALTER TABLE memories ADD COLUMN supersedes_id TEXT",
+    // MS-11: draft staging, MS-6a: memory_type, MS-7: trajectory
+    "ALTER TABLE memories ADD COLUMN draft INTEGER DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN memory_type TEXT DEFAULT 'raw'",
+    "ALTER TABLE memories ADD COLUMN trajectory TEXT",
+    // Metadata enrichment columns (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN intent TEXT",
+    "ALTER TABLE memories ADD COLUMN outcome TEXT",
+    "ALTER TABLE memories ADD COLUMN domain TEXT",
+    "ALTER TABLE memories ADD COLUMN referenced_entities TEXT",
+    "ALTER TABLE memories ADD COLUMN retrieval_count INTEGER DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN chain_position TEXT",
+    "ALTER TABLE memories ADD COLUMN review_status TEXT",
+    "ALTER TABLE memories ADD COLUMN context_window_pct INTEGER",
+    "ALTER TABLE memories ADD COLUMN file_paths TEXT",
+    "ALTER TABLE memories ADD COLUMN commit_hash TEXT",
+    "ALTER TABLE memories ADD COLUMN duration_ms INTEGER",
+    "ALTER TABLE memories ADD COLUMN token_cost REAL",
+    "ALTER TABLE memories ADD COLUMN audience TEXT",
+    "ALTER TABLE memories ADD COLUMN language_type TEXT",
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+  ]) {
     try {
-      const info = execSync2(`ps -p ${pid} -o ppid=,comm=`, {
-        encoding: "utf8",
-        timeout: 2e3
-      }).trim();
-      const match = info.match(/^\s*(\d+)\s+(.+)$/);
-      if (!match) break;
-      const [, ppid, cmd] = match;
-      const runtime = detectRuntimeFromCommand(cmd ?? "");
-      if (runtime) {
-        return { pid: String(pid), runtime };
-      }
-      pid = parseInt(ppid, 10);
-      if (pid <= 1) break;
+      await client.execute(col);
     } catch {
-      break;
     }
   }
-  return null;
-}
-function getSessionKey() {
-  if (_cached) return _cached;
-  if (process.env.EXE_SESSION_KEY) {
-    _cached = process.env.EXE_SESSION_KEY;
-    return _cached;
+  for (const idx of [
+    "CREATE INDEX IF NOT EXISTS idx_memories_tier ON memories(tier)",
+    "CREATE INDEX IF NOT EXISTS idx_memories_supersedes ON memories(supersedes_id) WHERE supersedes_id IS NOT NULL"
+  ]) {
+    try {
+      await client.execute(idx);
+    } catch {
+    }
   }
-  const resolved = resolveRuntimeProcess();
-  if (resolved) {
-    _cachedRuntime = resolved.runtime;
-    _cached = resolved.pid;
-    return _cached;
+  try {
+    await client.execute("CREATE INDEX IF NOT EXISTS idx_memories_status ON memories(status)");
+  } catch {
   }
-  _cached = process.env.CLAUDE_CODE_SSE_PORT ?? String(process.ppid);
-  return _cached;
-}
-var _cached, _cachedRuntime, RUNTIME_COMMANDS;
-var init_session_key = __esm({
-  "src/lib/session-key.ts"() {
-    "use strict";
-    _cached = null;
-    _cachedRuntime = null;
-    RUNTIME_COMMANDS = {
-      claude: ["claude", "claude.exe", "claude-native"],
-      codex: ["codex"],
-      opencode: ["opencode"]
-    };
+  for (const idx of [
+    "CREATE INDEX IF NOT EXISTS idx_memories_workspace ON memories(workspace_id)",
+    "CREATE INDEX IF NOT EXISTS idx_memories_document ON memories(document_id)",
+    "CREATE INDEX IF NOT EXISTS idx_memories_user ON memories(user_id)"
+  ]) {
+    try {
+      await client.execute(idx);
+    } catch {
+    }
   }
-});
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS entities (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      type TEXT NOT NULL,
+      first_seen TEXT NOT NULL,
+      last_seen TEXT NOT NULL,
+      properties TEXT DEFAULT '{}',
+      UNIQUE(name, type)
+    );
 
-// src/lib/tmux-transport.ts
-var tmux_transport_exports = {};
-__export(tmux_transport_exports, {
-  TmuxTransport: () => TmuxTransport
-});
-import { execFileSync } from "child_process";
-var QUIET, TmuxTransport;
-var init_tmux_transport = __esm({
-  "src/lib/tmux-transport.ts"() {
-    "use strict";
-    QUIET = {
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    };
-    TmuxTransport = class {
-      getMySession() {
-        try {
-          return execFileSync("tmux", ["display-message", "-p", "#{session_name}"], QUIET).trim() || null;
-        } catch {
-          return null;
-        }
-      }
-      listSessions() {
-        try {
-          return execFileSync("tmux", ["list-sessions", "-F", "#{session_name}"], QUIET).trim().split("\n").filter(Boolean);
-        } catch {
-          return [];
-        }
-      }
-      isAlive(target) {
-        try {
-          const sessions = this.listSessions();
-          if (!sessions.includes(target)) return false;
-          const paneStatus = execFileSync(
-            "tmux",
-            ["list-panes", "-t", target, "-F", "#{pane_dead}"],
-            QUIET
-          ).trim();
-          return paneStatus !== "1";
-        } catch {
-          return false;
-        }
-      }
-      sendKeys(target, keys) {
-        execFileSync("tmux", ["send-keys", "-t", target, keys, "Enter"], QUIET);
-      }
-      /**
-       * Send text as literal characters, then submit with Enter as a separate call.
-       * Fixes Codex intercom bug: long text + Enter in one send-keys blast causes
-       * Codex to drop the Enter. Splitting them ensures the text renders before
-       * the submit keystroke arrives.
-       */
-      sendKeysLiteral(target, text) {
-        execFileSync("tmux", ["send-keys", "-t", target, "-l", text], QUIET);
-        execFileSync("tmux", ["send-keys", "-t", target, "Enter"], QUIET);
-      }
-      capturePane(target, lines) {
-        const args = ["capture-pane", "-t", target, "-p"];
-        if (lines) args.push("-S", `-${lines}`);
-        return execFileSync("tmux", args, { ...QUIET, timeout: 3e3 });
-      }
-      isPaneInCopyMode(target) {
-        try {
-          const result = execFileSync(
-            "tmux",
-            ["display-message", "-p", "-t", target, "#{pane_in_mode}"],
-            { ...QUIET, timeout: 3e3 }
-          ).trim();
-          return result === "1";
-        } catch {
-          return false;
-        }
-      }
-      spawn(name, config) {
-        try {
-          const args = ["new-session", "-d", "-s", name];
-          if (config.cwd) args.push("-c", config.cwd);
-          args.push(config.command);
-          execFileSync("tmux", args);
-          return { sessionName: name };
-        } catch (e) {
-          return { sessionName: name, error: `spawn failed: ${e}` };
-        }
-      }
-      kill(target) {
-        try {
-          execFileSync("tmux", ["kill-session", "-t", target], QUIET);
-        } catch {
-        }
-      }
-      pipeLog(target, logFile) {
-        try {
-          const safePath = logFile.replace(/'/g, "'\\''");
-          execFileSync("tmux", ["pipe-pane", "-t", target, `cat >> '${safePath}'`], QUIET);
-        } catch {
-        }
-      }
-    };
-  }
-});
+    CREATE TABLE IF NOT EXISTS relationships (
+      id TEXT PRIMARY KEY,
+      source_entity_id TEXT NOT NULL,
+      target_entity_id TEXT NOT NULL,
+      type TEXT NOT NULL,
+      weight REAL DEFAULT 1.0,
+      timestamp TEXT NOT NULL,
+      properties TEXT DEFAULT '{}',
+      UNIQUE(source_entity_id, target_entity_id, type)
+    );
 
-// src/lib/transport.ts
-function getTransport() {
-  if (!_transport) {
-    const { TmuxTransport: TmuxTransport2 } = (init_tmux_transport(), __toCommonJS(tmux_transport_exports));
-    _transport = new TmuxTransport2();
+    CREATE TABLE IF NOT EXISTS entity_memories (
+      entity_id TEXT NOT NULL,
+      memory_id TEXT NOT NULL,
+      PRIMARY KEY (entity_id, memory_id)
+    );
+
+    CREATE TABLE IF NOT EXISTS relationship_memories (
+      relationship_id TEXT NOT NULL,
+      memory_id TEXT NOT NULL,
+      PRIMARY KEY (relationship_id, memory_id)
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_entities_name ON entities(name);
+    CREATE INDEX IF NOT EXISTS idx_entities_type ON entities(type);
+    CREATE INDEX IF NOT EXISTS idx_relationships_source ON relationships(source_entity_id);
+    CREATE INDEX IF NOT EXISTS idx_relationships_target ON relationships(target_entity_id);
+    CREATE INDEX IF NOT EXISTS idx_relationships_type ON relationships(type);
+
+    CREATE TABLE IF NOT EXISTS hyperedges (
+      id TEXT PRIMARY KEY,
+      label TEXT NOT NULL,
+      relation TEXT NOT NULL,
+      confidence REAL DEFAULT 1.0,
+      timestamp TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS hyperedge_nodes (
+      hyperedge_id TEXT NOT NULL,
+      entity_id TEXT NOT NULL,
+      PRIMARY KEY (hyperedge_id, entity_id)
+    );
+  `);
+  for (const col of [
+    "ALTER TABLE relationships ADD COLUMN confidence REAL DEFAULT 1.0",
+    "ALTER TABLE relationships ADD COLUMN confidence_label TEXT DEFAULT 'extracted'"
+  ]) {
+    try {
+      await client.execute(col);
+    } catch {
+    }
   }
-  return _transport;
 }
-var _transport;
-var init_transport = __esm({
-  "src/lib/transport.ts"() {
-    "use strict";
-    _transport = null;
+async function getReadyShardClient(projectName) {
+  const client = getShardClient(projectName);
+  await ensureShardSchema(client);
+  return client;
+}
+function evictLRU() {
+  let oldest = null;
+  let oldestTime = Infinity;
+  for (const [name, time] of _shardLastAccess) {
+    if (time < oldestTime) {
+      oldestTime = time;
+      oldest = name;
+    }
   }
-});
-
-// src/lib/cc-agent-support.ts
-import { execSync as execSync3 } from "child_process";
-var init_cc_agent_support = __esm({
-  "src/lib/cc-agent-support.ts"() {
-    "use strict";
+  if (oldest) {
+    const client = _shards.get(oldest);
+    if (client) {
+      client.close();
+    }
+    _shards.delete(oldest);
+    _shardLastAccess.delete(oldest);
   }
-});
-
-// src/lib/mcp-prefix.ts
-var MCP_PRIMARY_KEY, MCP_LEGACY_KEY, MCP_TOOL_PREFIXES;
-var init_mcp_prefix = __esm({
-  "src/lib/mcp-prefix.ts"() {
-    "use strict";
-    MCP_PRIMARY_KEY = "exe-os";
-    MCP_LEGACY_KEY = "exe-mem";
-    MCP_TOOL_PREFIXES = [
-      `mcp__${MCP_PRIMARY_KEY}__`,
-      `mcp__${MCP_LEGACY_KEY}__`
-    ];
+}
+function evictIdleShards() {
+  const now = Date.now();
+  const toEvict = [];
+  for (const [name, lastAccess] of _shardLastAccess) {
+    if (now - lastAccess > SHARD_IDLE_MS) {
+      toEvict.push(name);
+    }
   }
-});
-
-// src/lib/provider-table.ts
-var init_provider_table = __esm({
-  "src/lib/provider-table.ts"() {
-    "use strict";
+  for (const name of toEvict) {
+    const client = _shards.get(name);
+    if (client) {
+      client.close();
+    }
+    _shards.delete(name);
+    _shardLastAccess.delete(name);
   }
-});
-
-// src/lib/runtime-table.ts
-var RUNTIME_TABLE;
-var init_runtime_table = __esm({
-  "src/lib/runtime-table.ts"() {
-    "use strict";
-    RUNTIME_TABLE = {
-      codex: {
-        binary: "codex",
-        launchMode: "interactive",
-        autoApproveFlag: "--dangerously-bypass-approvals-and-sandbox",
-        inlineFlag: "--no-alt-screen",
-        apiKeyEnv: "OPENAI_API_KEY",
-        defaultModel: "gpt-5.4"
-      },
-      opencode: {
-        binary: "opencode",
-        launchMode: "exec",
-        autoApproveFlag: "--dangerously-skip-permissions",
-        inlineFlag: "",
-        apiKeyEnv: "ANTHROPIC_API_KEY",
-        defaultModel: "anthropic/claude-sonnet-4-6"
-      }
-    };
+}
+function getOpenShardCount() {
+  return _shards.size;
+}
+function disposeShards() {
+  if (_evictionTimer) {
+    clearInterval(_evictionTimer);
+    _evictionTimer = null;
   }
-});
-
-// src/lib/agent-config.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync6 } from "fs";
-import path7 from "path";
-var AGENT_CONFIG_PATH, DEFAULT_MODELS;
-var init_agent_config = __esm({
-  "src/lib/agent-config.ts"() {
+  for (const [, client] of _shards) {
+    client.close();
+  }
+  _shards.clear();
+  _shardLastAccess.clear();
+  _shardingEnabled = false;
+  _encryptionKey = null;
+}
+var SHARDS_DIR, SHARD_IDLE_MS, MAX_OPEN_SHARDS, EVICTION_INTERVAL_MS, _shards, _shardLastAccess, _evictionTimer, _encryptionKey, _shardingEnabled;
+var init_shard_manager = __esm({
+  "src/lib/shard-manager.ts"() {
     "use strict";
     init_config();
-    init_runtime_table();
-    init_secure_files();
-    AGENT_CONFIG_PATH = path7.join(EXE_AI_DIR, "agent-config.json");
-    DEFAULT_MODELS = {
-      claude: "claude-opus-4",
-      codex: RUNTIME_TABLE.codex?.defaultModel ?? "gpt-5.4",
-      opencode: RUNTIME_TABLE.opencode?.defaultModel ?? "anthropic/claude-sonnet-4-6"
-    };
+    SHARDS_DIR = path14.join(EXE_AI_DIR, "shards");
+    SHARD_IDLE_MS = 5 * 60 * 1e3;
+    MAX_OPEN_SHARDS = 10;
+    EVICTION_INTERVAL_MS = 60 * 1e3;
+    _shards = /* @__PURE__ */ new Map();
+    _shardLastAccess = /* @__PURE__ */ new Map();
+    _evictionTimer = null;
+    _encryptionKey = null;
+    _shardingEnabled = false;
   }
 });
 
-// src/lib/intercom-queue.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, renameSync as renameSync3, existsSync as existsSync7, mkdirSync as mkdirSync3 } from "fs";
-import path8 from "path";
-import os6 from "os";
-var QUEUE_PATH, TTL_MS, INTERCOM_LOG;
-var init_intercom_queue = __esm({
-  "src/lib/intercom-queue.ts"() {
+// src/lib/platform-procedures.ts
+var PLATFORM_PROCEDURES, PLATFORM_PROCEDURE_TITLES;
+var init_platform_procedures = __esm({
+  "src/lib/platform-procedures.ts"() {
     "use strict";
-    QUEUE_PATH = path8.join(os6.homedir(), ".exe-os", "intercom-queue.json");
-    TTL_MS = 60 * 60 * 1e3;
-    INTERCOM_LOG = path8.join(os6.homedir(), ".exe-os", "intercom.log");
-  }
-});
-
-// src/lib/license.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync8, mkdirSync as mkdirSync4 } from "fs";
-import { randomUUID as randomUUID2 } from "crypto";
-import { createRequire as createRequire2 } from "module";
-import { pathToFileURL as pathToFileURL2 } from "url";
-import os7 from "os";
-import path9 from "path";
-import { jwtVerify, importSPKI } from "jose";
-var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH;
-var init_license = __esm({
-  "src/lib/license.ts"() {
-    "use strict";
-    init_config();
-    LICENSE_PATH = path9.join(EXE_AI_DIR, "license.key");
-    CACHE_PATH = path9.join(EXE_AI_DIR, "license-cache.json");
-    DEVICE_ID_PATH = path9.join(EXE_AI_DIR, "device-id");
-  }
-});
-
-// src/lib/plan-limits.ts
-import { readFileSync as readFileSync6, existsSync as existsSync9 } from "fs";
-import path10 from "path";
-var CACHE_PATH2;
-var init_plan_limits = __esm({
-  "src/lib/plan-limits.ts"() {
-    "use strict";
-    init_database();
-    init_employees();
-    init_license();
-    init_config();
-    CACHE_PATH2 = path10.join(EXE_AI_DIR, "license-cache.json");
-  }
-});
-
-// src/lib/tmux-routing.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, existsSync as existsSync10, appendFileSync, readdirSync as readdirSync2 } from "fs";
-import path11 from "path";
-import os8 from "os";
-import { fileURLToPath } from "url";
-function getMySession() {
-  return getTransport().getMySession();
-}
-function extractRootExe(name) {
-  if (!name) return null;
-  if (!name.includes("-")) return name;
-  const parts = name.split("-").filter(Boolean);
-  return parts.length > 0 ? parts[parts.length - 1] : null;
-}
-function getParentExe(sessionKey) {
-  try {
-    const data = JSON.parse(readFileSync7(path11.join(SESSION_CACHE, `parent-exe-${sessionKey}.json`), "utf8"));
-    return data.parentExe || null;
-  } catch {
-    return null;
-  }
-}
-function resolveExeSession() {
-  const mySession = getMySession();
-  if (!mySession) return null;
-  const fromSessionName = extractRootExe(mySession);
-  try {
-    const key = getSessionKey();
-    const parentExe = getParentExe(key);
-    if (parentExe) {
-      const fromCache = extractRootExe(parentExe) ?? parentExe;
-      if (fromSessionName && fromCache !== fromSessionName) {
-        process.stderr.write(
-          `[tmux-routing] WARN: cache says "${fromCache}" but session name says "${fromSessionName}". Trusting session name.
-`
-        );
-        return fromSessionName;
+    PLATFORM_PROCEDURES = [
+      // --- Foundation: what is exe-os ---
+      {
+        title: "What is exe-os \u2014 the operating model every agent must understand",
+        domain: "architecture",
+        priority: "p0",
+        content: "Exe OS is an AI employee operating system. A founder runs 5-10 AI agents as a real org: COO, CTO, CMO, engineers, and content production specialists. Each agent has identity, expertise, and experience layers \u2014 persistent memory that makes them better over time. All data is local-first, E2EE, owned by the user. The MCP server is the ONLY data interface \u2014 never access the DB directly."
+      },
+      {
+        title: "Mode 1 \u2014 how exe-os runs inside Claude Code",
+        domain: "architecture",
+        priority: "p0",
+        content: "Mode 1: exe-os runs AS hooks + MCP + skills inside Claude Code, Codex, or OpenCode. The founder picks their default tool at setup. The COO manages employees in tmux sessions. Each coordinator session is a separate window/project. Employees run in their own tmux panes via create_task auto-spawn. The founder talks to the COO; the COO orchestrates the team. The tool is the shell, exe-os is the brain."
+      },
+      {
+        title: "Sessions explained \u2014 coordinator session names and projects",
+        domain: "architecture",
+        priority: "p0",
+        content: "Each coordinator session is an isolated project session. One might be exe-os development, another might be exe-wiki. Each session spawns its own employees using {employee}-{coordinatorSession}. Sessions share the same memory DB but tasks are scoped to the session that created them. A founder can run multiple projects simultaneously. Sessions never interfere with each other."
+      },
+      {
+        title: "Runtime settings \u2014 COO can view and change tools per agent",
+        domain: "workflow",
+        priority: "p1",
+        content: "exe-os supports three tools: Claude Code (Anthropic), Codex (OpenAI), and OpenCode (open source, 75+ providers). Each agent can use a different tool and model. COO uses set_agent_config MCP tool to view or change settings. Call with no args to show all agents. Call with agent_id + runtime + model to change. Users can also run `exe-os settings` from terminal for interactive arrow-key selection."
+      },
+      // --- Hierarchy and dispatch ---
+      {
+        title: "Chain of command \u2014 who talks to whom",
+        domain: "workflow",
+        priority: "p0",
+        content: "Founder -> COO -> CTO/CMO. CTO -> engineers. CMO -> content production. Never skip levels: the COO does not bypass managers for specialist work. Specialists report to their manager. If you need cross-team info, use ask_team_memory \u2014 don't read other agents' task folders. Each level owns dispatch downward and review upward."
+      },
+      {
+        title: "Single dispatch path \u2014 create_task only",
+        domain: "workflow",
+        priority: "p0",
+        content: "create_task is the ONLY way to dispatch work to another agent. No direct ensureEmployee calls, no manual tmux spawns, no send_message for actionable work. create_task \u2192 system auto-spawns \u2192 session correctly named. ONE PATH. No backdoors. No exceptions."
+      },
+      // --- Session isolation ---
+      {
+        title: "Session scoping \u2014 stay in your coordinator boundary",
+        domain: "security",
+        priority: "p0",
+        content: "Session scoping is mandatory. Managers dispatch to workers within their own coordinator session ONLY. Employee sessions use {employee}-{coordinatorSession}. Cross-session dispatch is blocked by the system. Verify session names before dispatch. Tasks are scoped to the creating coordinator session."
+      },
+      {
+        title: "Session isolation \u2014 never touch another session's work",
+        domain: "workflow",
+        priority: "p0",
+        content: "Sessions are isolated. A coordinator session owns ONLY tasks it dispatched. (1) Never close/update/cancel tasks from another coordinator session. (2) Never review work from a different session \u2014 report that it belongs to another session and skip. (3) Ignore other sessions' items in list_tasks results. (4) Employees inherit session: employee sessions work ONLY on their parent coordinator session's tasks. Cross-session work is a system violation."
+      },
+      // --- Engineering: session scoping in code ---
+      {
+        title: "Three-dimensional scoping \u2014 session, project, role \u2014 enforced in every query",
+        domain: "architecture",
+        priority: "p0",
+        content: "Every DB query, notification, review count, and task operation MUST be scoped on 3 dimensions: (1) Session \u2014 filter by session_scope matching the current coordinator session. (2) Project \u2014 filter by project_name. (3) Role \u2014 agents only see data at their hierarchy level. When writing ANY function that touches tasks, reviews, messages, or notifications: always accept a sessionScope parameter and pass it to the SQL WHERE clause. Unscoped queries are bugs. Test by running 2+ coordinator sessions simultaneously."
+      },
+      // --- Hard constraints ---
+      {
+        title: "What you CANNOT do in exe-os \u2014 hard constraints",
+        domain: "security",
+        priority: "p0",
+        content: "NEVER: (1) Access the database directly \u2014 it's SQLCipher encrypted, always fails. Use MCP tools only. (2) Manually spawn tmux sessions \u2014 create_task handles it. (3) Run git checkout main \u2014 agents work in worktrees. (4) Modify another agent's in-progress task. (5) Push to remote \u2014 the COO reviews and pushes. (6) Skip update_task(done) \u2014 it's the ONLY way your work gets reviewed. (7) Run git init."
+      },
+      // --- Operations ---
+      {
+        title: "Managers must supervise deployed workers",
+        domain: "workflow",
+        priority: "p0",
+        content: `Every manager (COO/CTO/CMO) who dispatches work to a worker MUST actively monitor them. Check tmux capture-pane every 10 minutes. Verify they're working, not stuck. If idle at prompt with in_progress task \u2192 send intercom. If stuck \u2192 unblock or escalate. "Standing by" without checking is negligence.`
+      },
+      {
+        title: "COO boot health check \u2014 memory, cloud sync, daemon on every launch",
+        domain: "workflow",
+        priority: "p0",
+        content: "On every /exe boot, COO MUST check system health BEFORE other work: (1) daemon \u2014 is exed PID alive, (2) cloud sync \u2014 grep workers.log for recent cloud-sync errors, (3) memory count \u2014 total in DB, (4) sync delta \u2014 local vs cloud storage_bytes. Report as 4-line status table. If ANY check fails, surface to founder immediately. Do not proceed to tasks until health confirmed."
+      },
+      {
+        title: "exe-build-adv mandatory for 3+ files",
+        domain: "workflow",
+        priority: "p0",
+        content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
+      },
+      {
+        title: "Desktop and TUI are the same product",
+        domain: "architecture",
+        priority: "p0",
+        content: "Desktop and TUI are the SAME product in different renderers. Same data contracts, same interactions, same acceptance criteria. Desktop tab specs in ARCHITECTURE.md ARE the TUI specs. When building TUI, cross-reference Desktop spec. Different tab names, identical behavior. Never treat them as separate products."
+      },
+      // --- Orchestration golden path ---
+      {
+        title: "Task lifecycle \u2014 the golden path every agent follows",
+        domain: "workflow",
+        priority: "p0",
+        content: "create_task is dispatch + delivery. Task lifecycle: open \u2192 in_progress (you start) \u2192 done (update_task when finished) \u2192 needs_review (reviewer nudged) \u2192 closed (COO only via close_task). DB is the reliable delivery \u2014 intercom is just a speedup nudge. If you finish a task, self-chain: check for next task immediately (step 7). Never wait for a nudge. Never say 'standing by.'"
+      },
+      {
+        title: "Intercom is a speedup, not delivery \u2014 DB is the source of truth",
+        domain: "architecture",
+        priority: "p0",
+        content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
+      },
+      // --- MCP is the ONLY data interface ---
+      {
+        title: "MCP disconnect \u2014 ask the user, never work around it",
+        domain: "workflow",
+        priority: "p0",
+        content: "If MCP tools are unavailable, disconnected, or returning connection errors: STOP. Tell the user clearly: 'MCP server is disconnected. Please run /mcp to reconnect.' Do NOT attempt workarounds \u2014 no raw Node imports, no direct DB access, no CLI hacks, no daemon socket calls. MCP is the ONLY data interface. Working around it wastes time, hits bundling issues, and bypasses the contract boundary. Ask once, wait, proceed when reconnected."
+      },
+      // --- MCP Tool Catalog (Layer 0 — every agent knows what tools exist) ---
+      {
+        title: "MCP tools \u2014 memory and search",
+        domain: "tool-use",
+        priority: "p1",
+        content: "recall_my_memory: search your own memories (semantic + FTS). ask_team_memory: search a colleague's memories by agent name. store_memory: persist a memory (decisions, summaries, context). commit_memory: high-importance memory that survives consolidation. search_everything: unified search across memories, tasks, entities, conversations. get_session_context: temporal window of memories around a timestamp. consolidate_memories: merge duplicate/related memories into insights. get_memory_cardinality: count memories per agent (health check)."
+      },
+      {
+        title: "MCP tools \u2014 task orchestration",
+        domain: "tool-use",
+        priority: "p1",
+        content: "create_task: dispatch work to an employee (auto-spawns session). The ONLY dispatch path. list_tasks: query tasks by status, assignee, project. get_task: fetch full task details by ID. update_task: change status (in_progress, done, blocked, cancelled) + add result summary. close_task: finalize a reviewed task (COO only). checkpoint_task: save progress state for crash recovery. resume_employee: re-spawn an employee session for an existing task."
+      },
+      {
+        title: "MCP tools \u2014 knowledge graph (GraphRAG)",
+        domain: "tool-use",
+        priority: "p1",
+        content: "query_relationships: find connections between entities in the knowledge graph. get_entity_neighbors: explore an entity's direct connections. get_hot_entities: find most-referenced entities (trending topics). get_graph_stats: graph health \u2014 entity/relationship counts, density. export_graph: export graph data for visualization. merge_entities: deduplicate entities (alias resolution). find_similar_trajectories: match tool-call patterns to past task solutions."
+      },
+      {
+        title: "MCP tools \u2014 identity, behavior, and decisions",
+        domain: "tool-use",
+        priority: "p1",
+        content: "get_identity: read an agent's exe.md (Layer 1 identity). update_identity: write an agent's exe.md. Identity > behavior \u2014 use for permanent rules. store_behavior: record a correction or pattern for an agent (Layer 2 expertise). list_behaviors: view an agent's active behaviors. deactivate_behavior: soft-delete a stale or conflicting behavior. store_decision: record an ADR (architectural decision record). get_decision: retrieve a past decision by query."
+      },
+      {
+        title: "MCP tools \u2014 communication and messaging",
+        domain: "tool-use",
+        priority: "p1",
+        content: "send_message: send supplementary context to another agent (NOT for actionable work \u2014 use create_task). acknowledge_messages: mark messages as read. send_whatsapp: send WhatsApp message via gateway (customer-facing alerts). query_conversations: search ingested conversations across all channels (WhatsApp, email, etc.)."
+      },
+      {
+        title: "MCP tools \u2014 wiki, documents, and content",
+        domain: "tool-use",
+        priority: "p1",
+        content: "create_wiki_page: create a wiki page in exe-wiki. list_wiki_pages: browse wiki pages. get_wiki_page: read a wiki page. update_wiki_page: edit a wiki page. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
+      },
+      {
+        title: "MCP tools \u2014 system, operations, and admin",
+        domain: "tool-use",
+        priority: "p1",
+        content: "get_agent_spend: token usage per agent/session (cost tracking). list_agent_sessions: view agent session history. get_session_kills: audit log of killed sessions. get_daemon_health: check exed daemon status. get_auto_wake_status: daemon auto-wake configuration. get_worker_gate: check worker deployment gates. run_memory_audit: health check \u2014 duplicates, null vectors, orphaned rows. run_consolidation: trigger sleep-time memory consolidation. cloud_sync: force a cloud sync cycle. backup_vps: trigger VPS backup."
+      },
+      {
+        title: "MCP tools \u2014 config, licensing, and team",
+        domain: "tool-use",
+        priority: "p1",
+        content: "set_agent_config: view/change per-agent runtime and model settings. list_employees: view the employee roster. add_person: add a person to the CRM contacts roster. list_people: browse CRM contacts. get_person: fetch contact details. get_license_status: check license validity. create_license: generate a new license key (admin). list_licenses: view all issued licenses. activate_license: activate a license on a device."
+      },
+      {
+        title: "MCP tools \u2014 advanced (triggers, skills, orchestration)",
+        domain: "tool-use",
+        priority: "p1",
+        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage Layer 0 procedures (actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
       }
-      return fromCache;
-    }
-  } catch {
-  }
-  return fromSessionName ?? mySession;
-}
-var SPAWN_LOCK_DIR, SESSION_CACHE, INTERCOM_LOG2, DEBOUNCE_FILE, DEBOUNCE_CLEANUP_AGE_MS;
-var init_tmux_routing = __esm({
-  "src/lib/tmux-routing.ts"() {
-    "use strict";
-    init_session_registry();
-    init_session_key();
-    init_transport();
-    init_cc_agent_support();
-    init_mcp_prefix();
-    init_provider_table();
-    init_agent_config();
-    init_runtime_table();
-    init_intercom_queue();
-    init_plan_limits();
-    init_employees();
-    SPAWN_LOCK_DIR = path11.join(os8.homedir(), ".exe-os", "spawn-locks");
-    SESSION_CACHE = path11.join(os8.homedir(), ".exe-os", "session-cache");
-    INTERCOM_LOG2 = path11.join(os8.homedir(), ".exe-os", "intercom.log");
-    DEBOUNCE_FILE = path11.join(SESSION_CACHE, "intercom-debounce.json");
-    DEBOUNCE_CLEANUP_AGE_MS = 5 * 60 * 1e3;
+    ];
+    PLATFORM_PROCEDURE_TITLES = new Set(
+      PLATFORM_PROCEDURES.map((p) => p.title)
+    );
   }
 });
 
-// src/lib/task-scope.ts
-function getCurrentSessionScope() {
-  try {
-    return resolveExeSession();
-  } catch {
-    return null;
-  }
-}
-function strictSessionScopeFilter(sessionScope, tableAlias) {
-  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
-  if (!scope) return { sql: "", args: [] };
-  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
-  return {
-    sql: ` AND ${col} = ?`,
-    args: [scope]
-  };
-}
-var init_task_scope = __esm({
-  "src/lib/task-scope.ts"() {
-    "use strict";
-    init_tmux_routing();
+// src/lib/global-procedures.ts
+var global_procedures_exports = {};
+__export(global_procedures_exports, {
+  deactivateGlobalProcedure: () => deactivateGlobalProcedure,
+  getGlobalProceduresBlock: () => getGlobalProceduresBlock,
+  loadGlobalProcedures: () => loadGlobalProcedures,
+  storeGlobalProcedure: () => storeGlobalProcedure
+});
+import { randomUUID as randomUUID3 } from "crypto";
+async function loadGlobalProcedures() {
+  const client = getClient();
+  const result = await client.execute({
+    sql: "SELECT * FROM global_procedures WHERE active = 1 ORDER BY priority ASC, created_at ASC",
+    args: []
+  });
+  const allRows = result.rows;
+  const customerOnly = allRows.filter((p) => !PLATFORM_PROCEDURE_TITLES.has(p.title));
+  if (customerOnly.length > 0) {
+    _customerCache = customerOnly.map((p) => `### ${p.title}
+${p.content}`).join("\n\n");
+  } else {
+    _customerCache = "";
   }
-});
+  _cacheLoaded = true;
+  return customerOnly;
+}
+function getGlobalProceduresBlock() {
+  const sections = [];
+  if (_platformCache) sections.push(_platformCache);
+  if (_cacheLoaded && _customerCache) sections.push(_customerCache);
+  if (sections.length === 0) return "";
+  return `## Organization-Wide Procedures (MANDATORY \u2014 supersedes all other rules)
 
-// src/lib/notifications.ts
-import crypto from "crypto";
-import path12 from "path";
-import os9 from "os";
-import {
-  readFileSync as readFileSync8,
-  readdirSync as readdirSync3,
-  unlinkSync as unlinkSync2,
-  existsSync as existsSync11,
-  rmdirSync
-} from "fs";
-async function readUnreadNotifications(agentFilter, sessionScope) {
-  try {
-    const client = getClient();
-    const conditions = ["read = 0"];
-    const args = [];
-    const scope = strictSessionScopeFilter(sessionScope);
-    if (agentFilter) {
-      conditions.push("agent_id = ?");
-      args.push(agentFilter);
-    }
-    const result = await client.execute({
-      sql: `SELECT id, agent_id, agent_role, event, project, summary, task_file, session_scope, created_at
-            FROM notifications
-            WHERE ${conditions.join(" AND ")}${scope.sql}
-            ORDER BY created_at ASC`,
-      args: [...args, ...scope.args]
-    });
-    return result.rows.map((r) => ({
-      id: String(r.id),
-      agentId: String(r.agent_id),
-      agentRole: String(r.agent_role),
-      event: String(r.event),
-      project: String(r.project),
-      summary: String(r.summary),
-      taskFile: r.task_file ? String(r.task_file) : void 0,
-      sessionScope: r.session_scope == null ? null : String(r.session_scope),
-      timestamp: String(r.created_at),
-      read: false
-    }));
-  } catch {
-    return [];
-  }
+${sections.join("\n\n")}
+`;
 }
-async function markAsRead(ids, sessionScope) {
-  if (ids.length === 0) return;
-  try {
-    const client = getClient();
-    const placeholders = ids.map(() => "?").join(", ");
-    const scope = strictSessionScopeFilter(sessionScope);
-    await client.execute({
-      sql: `UPDATE notifications SET read = 1 WHERE id IN (${placeholders})${scope.sql}`,
-      args: [...ids, ...scope.args]
-    });
-  } catch {
-  }
+async function storeGlobalProcedure(input) {
+  const id = randomUUID3();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const client = getClient();
+  await client.execute({
+    sql: `INSERT INTO global_procedures (id, title, content, priority, domain, active, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, 1, ?, ?)`,
+    args: [id, input.title, input.content, input.priority ?? "p0", input.domain ?? null, now, now]
+  });
+  await loadGlobalProcedures();
+  return id;
 }
-var init_notifications = __esm({
-  "src/lib/notifications.ts"() {
+async function deactivateGlobalProcedure(id) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const client = getClient();
+  const result = await client.execute({
+    sql: "UPDATE global_procedures SET active = 0, updated_at = ? WHERE id = ?",
+    args: [now, id]
+  });
+  await loadGlobalProcedures();
+  return result.rowsAffected > 0;
+}
+var _customerCache, _cacheLoaded, _platformCache;
+var init_global_procedures = __esm({
+  "src/lib/global-procedures.ts"() {
     "use strict";
     init_database();
-    init_task_scope();
+    init_platform_procedures();
+    _customerCache = "";
+    _cacheLoaded = false;
+    _platformCache = PLATFORM_PROCEDURES.map((p) => `### ${p.title}
+${p.content}`).join("\n\n");
   }
 });
 
 // src/lib/store.ts
+var store_exports = {};
+__export(store_exports, {
+  attachDocumentMetadata: () => attachDocumentMetadata,
+  buildRawVisibilityFilter: () => buildRawVisibilityFilter,
+  buildWikiScopeFilter: () => buildWikiScopeFilter,
+  classifyTier: () => classifyTier,
+  disposeStore: () => disposeStore,
+  flushBatch: () => flushBatch,
+  flushTier3: () => flushTier3,
+  getMemoryCardinality: () => getMemoryCardinality,
+  initStore: () => initStore,
+  reserveVersions: () => reserveVersions,
+  searchMemories: () => searchMemories,
+  updateMemoryStatus: () => updateMemoryStatus,
+  vectorToBlob: () => vectorToBlob,
+  writeMemory: () => writeMemory
+});
 import { createHash } from "crypto";
-init_database();
-
-// src/lib/keychain.ts
-import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync4 } from "fs";
-import path4 from "path";
-import os4 from "os";
-var SERVICE = "exe-mem";
-var ACCOUNT = "master-key";
-function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path4.join(os4.homedir(), ".exe-os");
-}
-function getKeyPath() {
-  return path4.join(getKeyDir(), "master.key");
-}
-async function tryKeytar() {
-  try {
-    return await import("keytar");
-  } catch {
-    return null;
-  }
-}
-async function getMasterKey() {
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
-      if (stored) {
-        return Buffer.from(stored, "base64");
-      }
-    } catch {
-    }
-  }
-  const keyPath = getKeyPath();
-  if (!existsSync4(keyPath)) {
-    process.stderr.write(
-      `[keychain] Key not found at ${keyPath} (HOME=${os4.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
-`
-    );
-    return null;
-  }
-  try {
-    const content = await readFile3(keyPath, "utf-8");
-    return Buffer.from(content.trim(), "base64");
-  } catch (err) {
-    process.stderr.write(
-      `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
-`
-    );
-    return null;
-  }
-}
-
-// src/lib/store.ts
-init_config();
-init_state_bus();
-var INIT_MAX_RETRIES = 3;
-var INIT_RETRY_DELAY_MS = 1e3;
 function isBusyError2(err) {
   if (err instanceof Error) {
     const msg = err.message.toLowerCase();
@@ -3083,12 +3982,6 @@ async function retryOnBusy2(fn, label) {
   }
   throw new Error("unreachable");
 }
-var _pendingRecords = [];
-var _batchSize = 20;
-var _flushIntervalMs = 1e4;
-var _flushTimer = null;
-var _flushing = false;
-var _nextVersion = 1;
 async function initStore(options) {
   if (_flushTimer !== null) {
     clearInterval(_flushTimer);
@@ -3118,6 +4011,11 @@ async function initStore(options) {
     encryptionKey: hexKey
   });
   await retryOnBusy2(() => ensureSchema(), "ensureSchema");
+  try {
+    const { initDaemonClient: initDaemonClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+    await initDaemonClient2();
+  } catch {
+  }
   if (!options?.lightweight) {
     try {
       const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
@@ -3137,25 +4035,580 @@ async function initStore(options) {
     }
   }
 }
+function classifyTier(record) {
+  if (record.tool_name === "commit_to_long_term_memory" && (record.importance ?? 0) >= 8) return 1;
+  if (["store_memory", "manual"].includes(record.tool_name ?? "") && (record.importance ?? 0) >= 5) return 2;
+  return 3;
+}
+function inferFilePaths(record) {
+  if (!["Read", "Write", "Edit"].includes(record.tool_name)) return null;
+  const firstLine = record.raw_text.split("\n")[0] ?? "";
+  const match = firstLine.match(/(\/[\w./-]+\.\w+)/);
+  return match ? JSON.stringify([match[1]]) : null;
+}
+function inferCommitHash(record) {
+  if (record.tool_name !== "Bash") return null;
+  const match = record.raw_text.match(/\b([a-f0-9]{7,40})\b/);
+  return match ? match[1] : null;
+}
+function inferLanguageType(record) {
+  const text = record.raw_text;
+  if (!text || text.length < 10) return null;
+  const trimmed = text.trimStart();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) return "json";
+  if (/\b(SELECT|INSERT|UPDATE|DELETE|CREATE TABLE|ALTER TABLE)\b/i.test(text)) return "sql";
+  if (/\b(function |const |import |export |class |def |async |=>)\b/.test(text)) return "code";
+  if (trimmed.startsWith("#") || trimmed.startsWith("*")) return "prose";
+  return "mixed";
+}
+function inferDomain(record) {
+  const proj = (record.project_name ?? "").toLowerCase();
+  if (proj.includes("marketing") || proj.includes("content")) return "marketing";
+  if (proj.includes("crm") || proj.includes("customer")) return "customer";
+  return null;
+}
+async function writeMemory(record) {
+  if (record.vector !== null && record.vector.length !== EMBEDDING_DIM) {
+    throw new Error(
+      `Expected ${EMBEDDING_DIM}-dim vector, got ${record.vector.length}`
+    );
+  }
+  const contentHash = createHash("md5").update(record.raw_text).digest("hex");
+  if (_pendingRecords.some((r) => r.content_hash === contentHash && r.agent_id === record.agent_id)) {
+    return;
+  }
+  try {
+    const client = getClient();
+    const existing = await client.execute({
+      sql: "SELECT id FROM memories WHERE content_hash = ? AND agent_id = ? LIMIT 1",
+      args: [contentHash, record.agent_id]
+    });
+    if (existing.rows.length > 0) return;
+  } catch {
+  }
+  const dbRow = {
+    id: record.id,
+    agent_id: record.agent_id,
+    agent_role: record.agent_role,
+    session_id: record.session_id,
+    timestamp: record.timestamp,
+    tool_name: record.tool_name,
+    project_name: record.project_name,
+    has_error: record.has_error ? 1 : 0,
+    raw_text: record.raw_text,
+    vector: record.vector,
+    version: 0,
+    // Placeholder — assigned atomically at flush time
+    task_id: record.task_id ?? null,
+    importance: record.importance ?? 5,
+    status: record.status ?? "active",
+    confidence: record.confidence ?? 0.7,
+    last_accessed: record.last_accessed ?? record.timestamp,
+    workspace_id: record.workspace_id ?? null,
+    document_id: record.document_id ?? null,
+    user_id: record.user_id ?? null,
+    char_offset: record.char_offset ?? null,
+    page_number: record.page_number ?? null,
+    source_path: record.source_path ?? null,
+    source_type: record.source_type ?? null,
+    tier: record.tier ?? classifyTier(record),
+    supersedes_id: record.supersedes_id ?? null,
+    draft: record.draft ? 1 : 0,
+    memory_type: record.memory_type ?? "raw",
+    trajectory: record.trajectory ? JSON.stringify(record.trajectory) : null,
+    content_hash: contentHash,
+    intent: record.intent ?? null,
+    outcome: record.outcome ?? null,
+    domain: record.domain ?? inferDomain(record),
+    referenced_entities: record.referenced_entities ?? null,
+    retrieval_count: record.retrieval_count ?? 0,
+    chain_position: record.chain_position ?? null,
+    review_status: record.review_status ?? null,
+    context_window_pct: record.context_window_pct ?? null,
+    file_paths: record.file_paths ?? inferFilePaths(record),
+    commit_hash: record.commit_hash ?? inferCommitHash(record),
+    duration_ms: record.duration_ms ?? null,
+    token_cost: record.token_cost ?? null,
+    audience: record.audience ?? null,
+    language_type: record.language_type ?? inferLanguageType(record),
+    parent_memory_id: record.parent_memory_id ?? null
+  };
+  _pendingRecords.push(dbRow);
+  orgBus.emit({
+    type: "memory_stored",
+    agentId: record.agent_id,
+    project: record.project_name,
+    timestamp: record.timestamp
+  });
+  const MAX_PENDING = 1e3;
+  if (_pendingRecords.length > MAX_PENDING) {
+    const dropped = _pendingRecords.length - MAX_PENDING;
+    _pendingRecords = _pendingRecords.slice(-MAX_PENDING);
+    console.warn(`[store] Dropped ${dropped} oldest pending records (overflow)`);
+  }
+  if (_flushTimer === null) {
+    _flushTimer = setInterval(() => {
+      void flushBatch();
+    }, _flushIntervalMs);
+    if (_flushTimer && typeof _flushTimer === "object" && "unref" in _flushTimer) {
+      _flushTimer.unref();
+    }
+  }
+  if (_pendingRecords.length >= _batchSize) {
+    await flushBatch();
+  }
+}
+async function flushBatch() {
+  if (_flushing || _pendingRecords.length === 0) return 0;
+  _flushing = true;
+  try {
+    const batch = _pendingRecords.slice(0);
+    const client = getClient();
+    const vResult = await client.execute("SELECT MAX(version) as max_v FROM memories");
+    let baseVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
+    for (const row of batch) {
+      row.version = baseVersion++;
+    }
+    _nextVersion = baseVersion;
+    const buildStmt = (row) => {
+      const hasVector = row.vector !== null;
+      const taskId = row.task_id ?? null;
+      const importance = row.importance ?? 5;
+      const status = row.status ?? "active";
+      const confidence = row.confidence ?? 0.7;
+      const lastAccessed = row.last_accessed ?? row.timestamp;
+      const workspaceId = row.workspace_id ?? null;
+      const documentId = row.document_id ?? null;
+      const userId = row.user_id ?? null;
+      const charOffset = row.char_offset ?? null;
+      const pageNumber = row.page_number ?? null;
+      const sourcePath = row.source_path ?? null;
+      const sourceType = row.source_type ?? null;
+      const tier = row.tier ?? 3;
+      const supersedesId = row.supersedes_id ?? null;
+      const draft = row.draft ? 1 : 0;
+      const memoryType = row.memory_type ?? "raw";
+      const trajectory = row.trajectory ?? null;
+      const contentHash = row.content_hash ?? null;
+      const intent = row.intent ?? null;
+      const outcome = row.outcome ?? null;
+      const domain = row.domain ?? null;
+      const referencedEntities = row.referenced_entities ?? null;
+      const retrievalCount = row.retrieval_count ?? 0;
+      const chainPosition = row.chain_position ?? null;
+      const reviewStatus = row.review_status ?? null;
+      const contextWindowPct = row.context_window_pct ?? null;
+      const filePaths = row.file_paths ?? null;
+      const commitHash = row.commit_hash ?? null;
+      const durationMs = row.duration_ms ?? null;
+      const tokenCost = row.token_cost ?? null;
+      const audience = row.audience ?? null;
+      const languageType = row.language_type ?? null;
+      const parentMemoryId = row.parent_memory_id ?? null;
+      const cols = `id, agent_id, agent_role, session_id, timestamp,
+               tool_name, project_name,
+               has_error, raw_text, vector, version, task_id, importance, status,
+               confidence, last_accessed,
+               workspace_id, document_id, user_id, char_offset, page_number,
+               source_path, source_type, tier, supersedes_id, draft, memory_type, trajectory, content_hash,
+               intent, outcome, domain, referenced_entities, retrieval_count,
+               chain_position, review_status, context_window_pct, file_paths, commit_hash,
+               duration_ms, token_cost, audience, language_type, parent_memory_id`;
+      const metaArgs = [
+        intent,
+        outcome,
+        domain,
+        referencedEntities,
+        retrievalCount,
+        chainPosition,
+        reviewStatus,
+        contextWindowPct,
+        filePaths,
+        commitHash,
+        durationMs,
+        tokenCost,
+        audience,
+        languageType,
+        parentMemoryId
+      ];
+      const baseArgs = [
+        row.id,
+        row.agent_id,
+        row.agent_role,
+        row.session_id,
+        row.timestamp,
+        row.tool_name,
+        row.project_name,
+        row.has_error,
+        row.raw_text
+      ];
+      const sharedArgs = [
+        row.version,
+        taskId,
+        importance,
+        status,
+        confidence,
+        lastAccessed,
+        workspaceId,
+        documentId,
+        userId,
+        charOffset,
+        pageNumber,
+        sourcePath,
+        sourceType,
+        tier,
+        supersedesId,
+        draft,
+        memoryType,
+        trajectory,
+        contentHash
+      ];
+      return {
+        sql: hasVector ? `INSERT OR IGNORE INTO memories (${cols})
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, vector32(?), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)` : `INSERT OR IGNORE INTO memories (${cols})
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: hasVector ? [...baseArgs, vectorToBlob(row.vector), ...sharedArgs, ...metaArgs] : [...baseArgs, ...sharedArgs, ...metaArgs]
+      };
+    };
+    const globalClient = getClient();
+    const globalStmts = batch.map(buildStmt);
+    await globalClient.batch(globalStmts, "write");
+    _pendingRecords.splice(0, batch.length);
+    try {
+      const { isShardingEnabled: isShardingEnabled2, getReadyShardClient: getReadyShardClient2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
+      if (isShardingEnabled2()) {
+        const byProject = /* @__PURE__ */ new Map();
+        for (const row of batch) {
+          const proj = row.project_name || "unknown";
+          if (!byProject.has(proj)) byProject.set(proj, []);
+          byProject.get(proj).push(row);
+        }
+        for (const [project, rows] of byProject) {
+          try {
+            const shardClient = await getReadyShardClient2(project);
+            const shardStmts = rows.map(buildStmt);
+            await shardClient.batch(shardStmts, "write");
+          } catch (err) {
+            process.stderr.write(
+              `[store] Shard write failed for ${project}: ${err instanceof Error ? err.message : String(err)}
+`
+            );
+          }
+        }
+      }
+    } catch {
+    }
+    return batch.length;
+  } finally {
+    _flushing = false;
+  }
+}
+function buildWikiScopeFilter(options, columnPrefix) {
+  const args = [];
+  let clause = "";
+  if (options?.workspaceId !== void 0) {
+    clause += ` AND ${columnPrefix}workspace_id = ?`;
+    args.push(options.workspaceId);
+  }
+  if (options?.userId === void 0) {
+    clause += ` AND ${columnPrefix}user_id IS NULL`;
+  } else if (options.userId === null) {
+    clause += ` AND ${columnPrefix}user_id IS NULL`;
+  } else {
+    clause += ` AND (${columnPrefix}user_id = ? OR ${columnPrefix}user_id IS NULL)`;
+    args.push(options.userId);
+  }
+  return { clause, args };
+}
+function buildRawVisibilityFilter(options, columnPrefix) {
+  if (options?.includeRaw === false) {
+    return {
+      clause: ` AND COALESCE(${columnPrefix}memory_type, 'raw') != 'raw'`,
+      args: []
+    };
+  }
+  return { clause: "", args: [] };
+}
+async function searchMemories(queryVector, agentId, options) {
+  let client;
+  try {
+    const { isShardingEnabled: isShardingEnabled2, shardExists: shardExists2, getReadyShardClient: getReadyShardClient2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
+    if (isShardingEnabled2() && options?.projectName && shardExists2(options.projectName)) {
+      client = await getReadyShardClient2(options.projectName);
+    } else {
+      client = getClient();
+    }
+  } catch {
+    client = getClient();
+  }
+  const limit = options?.limit ?? 10;
+  const statusFilter = options?.includeArchived ? "" : `
+               AND COALESCE(status, 'active') = 'active'`;
+  const draftFilter = options?.includeDrafts ? "" : `
+               AND (draft = 0 OR draft IS NULL)`;
+  let sql = `SELECT id, agent_id, agent_role, session_id, timestamp,
+                    tool_name, project_name,
+                    has_error, raw_text, vector, importance, status,
+                    confidence, last_accessed,
+                    workspace_id, document_id, user_id,
+                    char_offset, page_number,
+                    source_path, source_type
+             FROM memories
+             WHERE agent_id = ?
+               AND vector IS NOT NULL${statusFilter}${draftFilter}
+               AND COALESCE(confidence, 0.7) >= 0.3`;
+  const args = [agentId];
+  const scope = buildWikiScopeFilter(options, "");
+  sql += scope.clause;
+  args.push(...scope.args);
+  const rawVisibility = buildRawVisibilityFilter(options, "");
+  sql += rawVisibility.clause;
+  args.push(...rawVisibility.args);
+  if (options?.projectName) {
+    sql += ` AND project_name = ?`;
+    args.push(options.projectName);
+  }
+  if (options?.toolName) {
+    sql += ` AND tool_name = ?`;
+    args.push(options.toolName);
+  }
+  if (options?.hasError !== void 0) {
+    sql += ` AND has_error = ?`;
+    args.push(options.hasError ? 1 : 0);
+  }
+  if (options?.since) {
+    sql += ` AND timestamp >= ?`;
+    args.push(options.since);
+  }
+  if (options?.memoryType) {
+    sql += ` AND memory_type = ?`;
+    args.push(options.memoryType);
+  }
+  sql += ` ORDER BY vector_distance_cos(vector, vector32(?))`;
+  args.push(vectorToBlob(queryVector));
+  sql += ` LIMIT ?`;
+  args.push(limit);
+  const result = await client.execute({ sql, args });
+  return result.rows.map((row) => ({
+    id: row.id,
+    agent_id: row.agent_id,
+    agent_role: row.agent_role,
+    session_id: row.session_id,
+    timestamp: row.timestamp,
+    tool_name: row.tool_name,
+    project_name: row.project_name,
+    has_error: row.has_error === 1,
+    raw_text: row.raw_text,
+    vector: row.vector == null ? [] : Array.isArray(row.vector) ? row.vector : Array.from(row.vector),
+    importance: row.importance ?? 5,
+    status: row.status ?? "active",
+    confidence: row.confidence ?? 0.7,
+    last_accessed: row.last_accessed ?? row.timestamp,
+    workspace_id: row.workspace_id ?? null,
+    document_id: row.document_id ?? null,
+    user_id: row.user_id ?? null,
+    char_offset: row.char_offset ?? null,
+    page_number: row.page_number ?? null,
+    source_path: row.source_path ?? null,
+    source_type: row.source_type ?? null
+  }));
+}
+async function attachDocumentMetadata(records) {
+  const docIds = [
+    ...new Set(
+      records.map((r) => r.document_id).filter((id) => typeof id === "string" && id.length > 0)
+    )
+  ];
+  if (docIds.length === 0) return records;
+  try {
+    const client = getClient();
+    const placeholders = docIds.map(() => "?").join(",");
+    const result = await client.execute({
+      sql: `SELECT id, filename, mime, source_type, uploaded_at
+            FROM documents
+            WHERE id IN (${placeholders})`,
+      args: docIds
+    });
+    const byId = /* @__PURE__ */ new Map();
+    for (const row of result.rows) {
+      const id = row.id;
+      byId.set(id, {
+        document_id: id,
+        filename: row.filename,
+        mime: row.mime ?? null,
+        source_type: row.source_type ?? null,
+        uploaded_at: row.uploaded_at
+      });
+    }
+    for (const record of records) {
+      if (!record.document_id) continue;
+      record.document_metadata = byId.get(record.document_id) ?? null;
+    }
+  } catch {
+  }
+  return records;
+}
+async function flushTier3(agentId, options) {
+  const client = getClient();
+  const maxAge = options?.maxAgeHours ?? 72;
+  const cutoff = new Date(Date.now() - maxAge * 36e5).toISOString();
+  if (options?.dryRun) {
+    const result2 = await client.execute({
+      sql: `SELECT COUNT(*) as cnt FROM memories
+            WHERE agent_id = ? AND tier = 3 AND status = 'active' AND timestamp < ?`,
+      args: [agentId, cutoff]
+    });
+    return { archived: Number(result2.rows[0]?.cnt ?? 0) };
+  }
+  const result = await client.execute({
+    sql: `UPDATE memories SET status = 'archived'
+          WHERE agent_id = ? AND tier = 3 AND status = 'active' AND timestamp < ?`,
+    args: [agentId, cutoff]
+  });
+  return { archived: result.rowsAffected };
+}
+async function disposeStore() {
+  if (_flushTimer !== null) {
+    clearInterval(_flushTimer);
+    _flushTimer = null;
+  }
+  if (_pendingRecords.length > 0) {
+    await flushBatch();
+  }
+  await disposeTurso();
+  _pendingRecords = [];
+  _nextVersion = 1;
+}
+function vectorToBlob(vector) {
+  const f32 = vector instanceof Float32Array ? vector : new Float32Array(vector);
+  return JSON.stringify(Array.from(f32));
+}
+async function updateMemoryStatus(id, status) {
+  const client = getClient();
+  await client.execute({
+    sql: `UPDATE memories SET status = ? WHERE id = ?`,
+    args: [status, id]
+  });
+}
+function reserveVersions(count) {
+  const reserved = [];
+  for (let i = 0; i < count; i++) {
+    reserved.push(_nextVersion++);
+  }
+  return reserved;
+}
+async function getMemoryCardinality(agentId) {
+  try {
+    const client = getClient();
+    const result = await client.execute({
+      sql: `SELECT COUNT(*) as cnt FROM memories WHERE agent_id = ? AND COALESCE(status, 'active') = 'active'`,
+      args: [agentId]
+    });
+    return Number(result.rows[0]?.cnt) || 0;
+  } catch {
+    return 0;
+  }
+}
+var INIT_MAX_RETRIES, INIT_RETRY_DELAY_MS, _pendingRecords, _batchSize, _flushIntervalMs, _flushTimer, _flushing, _nextVersion;
+var init_store = __esm({
+  "src/lib/store.ts"() {
+    "use strict";
+    init_memory();
+    init_database();
+    init_keychain();
+    init_config();
+    init_state_bus();
+    INIT_MAX_RETRIES = 3;
+    INIT_RETRY_DELAY_MS = 1e3;
+    _pendingRecords = [];
+    _batchSize = 20;
+    _flushIntervalMs = 1e4;
+    _flushTimer = null;
+    _flushing = false;
+    _nextVersion = 1;
+  }
+});
 
 // src/bin/exe-pending-notifications.ts
 init_notifications();
 
 // src/lib/is-main.ts
 import { realpathSync } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { fileURLToPath as fileURLToPath3 } from "url";
 function isMainModule(importMetaUrl) {
   if (process.argv[1] == null) return false;
   if (process.argv[1].includes("mcp/server")) return false;
   try {
     const scriptPath = realpathSync(process.argv[1]);
-    const modulePath = realpathSync(fileURLToPath2(importMetaUrl));
+    const modulePath = realpathSync(fileURLToPath3(importMetaUrl));
     return scriptPath === modulePath;
   } catch {
     return importMetaUrl === `file://${process.argv[1]}` || importMetaUrl === new URL(process.argv[1], "file://").href;
   }
 }
 
+// src/bin/fast-db-init.ts
+async function fastDbInit() {
+  const { isInitialized: isInitialized2, getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+  if (isInitialized2()) {
+    return getClient2();
+  }
+  try {
+    const { connectEmbedDaemon: connectEmbedDaemon2, sendDaemonRequest: sendDaemonRequest2, isClientConnected: isClientConnected2 } = await Promise.resolve().then(() => (init_exe_daemon_client(), exe_daemon_client_exports));
+    const { deserializeResultSet: deserializeResultSet2 } = await Promise.resolve().then(() => (init_daemon_protocol(), daemon_protocol_exports));
+    await connectEmbedDaemon2();
+    if (isClientConnected2()) {
+      const daemonClient = {
+        async execute(stmt) {
+          const sql = typeof stmt === "string" ? stmt : stmt.sql;
+          const args = typeof stmt === "string" ? [] : Array.isArray(stmt.args) ? stmt.args : [];
+          const resp = await sendDaemonRequest2({ type: "db-execute", sql, args });
+          if (resp.error) throw new Error(String(resp.error));
+          if (resp.db) return deserializeResultSet2(resp.db);
+          throw new Error("Unexpected daemon response");
+        },
+        async batch(stmts, mode) {
+          const statements = stmts.map((s) => {
+            const sql = typeof s === "string" ? s : s.sql;
+            const args = typeof s === "string" ? [] : Array.isArray(s.args) ? s.args : [];
+            return { sql, args };
+          });
+          const resp = await sendDaemonRequest2({ type: "db-batch", statements, mode: mode ?? "deferred" });
+          if (resp.error) throw new Error(String(resp.error));
+          const batchResults = resp["db-batch"];
+          if (batchResults) return batchResults.map(deserializeResultSet2);
+          throw new Error("Unexpected daemon batch response");
+        },
+        async transaction(_mode) {
+          throw new Error("Transactions not supported via daemon socket");
+        },
+        async executeMultiple(_sql) {
+          throw new Error("executeMultiple not supported via daemon socket");
+        },
+        async migrate(_stmts) {
+          throw new Error("migrate not supported via daemon socket");
+        },
+        sync() {
+          return Promise.resolve(void 0);
+        },
+        close() {
+        },
+        get closed() {
+          return false;
+        },
+        get protocol() {
+          return "file";
+        }
+      };
+      return daemonClient;
+    }
+  } catch {
+  }
+  const { initStore: initStore2 } = await Promise.resolve().then(() => (init_store(), store_exports));
+  await initStore2({ lightweight: true });
+  return getClient2();
+}
+
 // src/bin/exe-pending-notifications.ts
 function formatLine(row) {
   switch (row.event) {
@@ -3190,7 +4643,7 @@ async function main() {
   if (!agentId) {
     process.exit(0);
   }
-  await initStore();
+  await fastDbInit();
   const notifications = await readUnreadNotifications(agentId);
   const recentCutoff = Date.now() - 24 * 60 * 60 * 1e3;
   const pending = notifications.filter((row) => new Date(row.timestamp).getTime() > recentCutoff).map((row) => ({