@askexenow/exe-os 0.9.16 → 0.9.18

package/dist/bin/exe-boot.js

@@ -468,9 +468,9 @@ var MAX_RETRIES, BASE_DELAY_MS, MAX_JITTER_MS;
 var init_db_retry = __esm({
   "src/lib/db-retry.ts"() {
     "use strict";
-    MAX_RETRIES = 3;
-    BASE_DELAY_MS = 200;
-    MAX_JITTER_MS = 300;
+    MAX_RETRIES = 5;
+    BASE_DELAY_MS = 250;
+    MAX_JITTER_MS = 400;
   }
 });
 
@@ -1058,6 +1058,15 @@ var init_database_adapter = __esm({
   }
 });
 
+// src/types/memory.ts
+var EMBEDDING_DIM;
+var init_memory = __esm({
+  "src/types/memory.ts"() {
+    "use strict";
+    EMBEDDING_DIM = 1024;
+  }
+});
+
 // src/lib/daemon-auth.ts
 import crypto from "crypto";
 import path4 from "path";
@@ -1332,6 +1341,9 @@ async function connectEmbedDaemon() {
   }
   return false;
 }
+function sendRequest(texts, priority) {
+  return sendDaemonRequest({ texts, priority });
+}
 function sendDaemonRequest(payload, timeoutMs = REQUEST_TIMEOUT_MS) {
   return new Promise((resolve) => {
     if (!_socket || !_connected) {
@@ -1354,10 +1366,150 @@ function sendDaemonRequest(payload, timeoutMs = REQUEST_TIMEOUT_MS) {
     }
   });
 }
+async function pingDaemon() {
+  if (!_socket || !_connected) return null;
+  const response = await sendDaemonRequest({ type: "health" }, 5e3);
+  if (response.health) {
+    return response.health;
+  }
+  return null;
+}
+function killAndRespawnDaemon() {
+  if (!acquireSpawnLock()) {
+    process.stderr.write("[exed-client] Another process is already restarting daemon \u2014 skipping\n");
+    if (_socket) {
+      _socket.destroy();
+      _socket = null;
+    }
+    _connected = false;
+    _buffer = "";
+    return;
+  }
+  try {
+    process.stderr.write("[exed-client] Killing daemon for restart...\n");
+    if (existsSync5(PID_PATH)) {
+      try {
+        const pid = parseInt(readFileSync4(PID_PATH, "utf8").trim(), 10);
+        if (pid > 0) {
+          try {
+            process.kill(pid, "SIGKILL");
+          } catch {
+          }
+        }
+      } catch {
+      }
+    }
+    if (_socket) {
+      _socket.destroy();
+      _socket = null;
+    }
+    _connected = false;
+    _buffer = "";
+    try {
+      unlinkSync2(PID_PATH);
+    } catch {
+    }
+    try {
+      unlinkSync2(SOCKET_PATH);
+    } catch {
+    }
+    spawnDaemon();
+  } finally {
+    releaseSpawnLock();
+  }
+}
+function isDaemonTooYoung() {
+  try {
+    const stat = statSync(PID_PATH);
+    return Date.now() - stat.mtimeMs < MIN_DAEMON_AGE_MS;
+  } catch {
+    return false;
+  }
+}
+async function retryThenRestart(doRequest, label) {
+  const result = await doRequest();
+  if (!result.error) {
+    _consecutiveFailures = 0;
+    return result;
+  }
+  _consecutiveFailures++;
+  for (let i = 0; i < MAX_RETRIES_BEFORE_RESTART; i++) {
+    const delayMs = RETRY_DELAYS_MS[i] ?? 5e3;
+    process.stderr.write(`[exed-client] ${label} failed (${result.error}), retry ${i + 1}/${MAX_RETRIES_BEFORE_RESTART} in ${delayMs}ms
+`);
+    await new Promise((r) => setTimeout(r, delayMs));
+    if (!_connected) {
+      if (!await connectToSocket()) continue;
+    }
+    const retry = await doRequest();
+    if (!retry.error) {
+      _consecutiveFailures = 0;
+      return retry;
+    }
+    _consecutiveFailures++;
+  }
+  if (isDaemonTooYoung()) {
+    process.stderr.write(`[exed-client] ${label}: daemon too young (< ${MIN_DAEMON_AGE_MS / 1e3}s) \u2014 skipping restart
+`);
+    return { error: result.error };
+  }
+  process.stderr.write(`[exed-client] ${label}: ${_consecutiveFailures} consecutive failures \u2014 restarting daemon
+`);
+  killAndRespawnDaemon();
+  const start = Date.now();
+  let delay2 = 200;
+  while (Date.now() - start < CONNECT_TIMEOUT_MS) {
+    await new Promise((r) => setTimeout(r, delay2));
+    if (await connectToSocket()) break;
+    delay2 = Math.min(delay2 * 2, 3e3);
+  }
+  if (!_connected) return { error: "Daemon restart failed" };
+  const final = await doRequest();
+  if (!final.error) _consecutiveFailures = 0;
+  return final;
+}
+async function embedViaClient(text, priority = "high") {
+  if (!_connected && !await connectEmbedDaemon()) return null;
+  _requestCount++;
+  if (_requestCount % HEALTH_CHECK_INTERVAL === 0) {
+    const health = await pingDaemon();
+    if (!health && !isDaemonTooYoung()) {
+      process.stderr.write(`[exed-client] Periodic health check failed at request ${_requestCount} \u2014 restarting daemon
+`);
+      killAndRespawnDaemon();
+      const start = Date.now();
+      let d = 200;
+      while (Date.now() - start < CONNECT_TIMEOUT_MS) {
+        await new Promise((r) => setTimeout(r, d));
+        if (await connectToSocket()) break;
+        d = Math.min(d * 2, 3e3);
+      }
+      if (!_connected) return null;
+    }
+  }
+  const result = await retryThenRestart(
+    () => sendRequest([text], priority),
+    "Embed"
+  );
+  return !result.error && result.vectors?.[0] ? result.vectors[0] : null;
+}
+function disconnectClient() {
+  if (_socket) {
+    _socket.destroy();
+    _socket = null;
+  }
+  _connected = false;
+  _buffer = "";
+  for (const [id, entry] of _pending) {
+    clearTimeout(entry.timer);
+    _pending.delete(id);
+    entry.resolve({ error: "Client disconnected" });
+  }
+}
 function isClientConnected() {
   return _connected;
 }
-var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, DAEMON_TOKEN_ENV, _socket, _connected, _buffer, _pending, MAX_BUFFER;
+var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, DAEMON_TOKEN_ENV, _socket, _connected, _buffer, _requestCount, _consecutiveFailures, HEALTH_CHECK_INTERVAL, MAX_RETRIES_BEFORE_RESTART, RETRY_DELAYS_MS, MIN_DAEMON_AGE_MS, _pending, MAX_BUFFER;
 var init_exe_daemon_client = __esm({
   "src/lib/exe-daemon-client.ts"() {
     "use strict";
@@ -1373,6 +1525,12 @@ var init_exe_daemon_client = __esm({
     _socket = null;
     _connected = false;
     _buffer = "";
+    _requestCount = 0;
+    _consecutiveFailures = 0;
+    HEALTH_CHECK_INTERVAL = 100;
+    MAX_RETRIES_BEFORE_RESTART = 3;
+    RETRY_DELAYS_MS = [1e3, 3e3, 5e3];
+    MIN_DAEMON_AGE_MS = 3e4;
     _pending = /* @__PURE__ */ new Map();
     MAX_BUFFER = 1e7;
   }
@@ -1480,7 +1638,7 @@ function createDaemonDbClient(fallbackClient) {
       });
       if (response.error) {
         const errMsg = String(response.error);
-        if (errMsg === "Not connected" || errMsg === "Request timeout" || errMsg === "Write failed") {
+        if (errMsg === "Not connected" || errMsg === "Request timeout" || errMsg === "Write failed" || errMsg === "DB not initialized") {
           process.stderr.write(`[db-daemon] Transport error (${errMsg}), falling back to direct
 `);
           return fallbackClient.execute(stmt);
@@ -1505,7 +1663,7 @@ function createDaemonDbClient(fallbackClient) {
       });
       if (response.error) {
         const errMsg = String(response.error);
-        if (errMsg === "Not connected" || errMsg === "Request timeout" || errMsg === "Write failed") {
+        if (errMsg === "Not connected" || errMsg === "Request timeout" || errMsg === "Write failed" || errMsg === "DB not initialized") {
           process.stderr.write(`[db-daemon] Batch transport error (${errMsg}), falling back to direct
 `);
           return fallbackClient.batch(stmts, mode);
@@ -1628,7 +1786,7 @@ async function initDatabase(config) {
     });
   }, 3e4);
   _walCheckpointTimer.unref();
-  if (process.env.DATABASE_URL) {
+  if (process.env.DATABASE_URL && process.env.EXE_USE_POSTGRES === "1") {
     _adapterClient = await createPrismaDbAdapter(_resilientClient);
   }
 }
@@ -1639,7 +1797,7 @@ function getClient() {
   if (!_adapterClient) {
     throw new Error("Database client not initialized. Call initDatabase() first.");
   }
-  if (process.env.DATABASE_URL) {
+  if (process.env.DATABASE_URL && process.env.EXE_USE_POSTGRES === "1") {
     return _adapterClient;
   }
   if (process.env.EXE_IS_DAEMON === "1") {
@@ -1651,9 +1809,11 @@ function getClient() {
   return _resilientClient;
 }
 async function initDaemonClient() {
-  if (process.env.DATABASE_URL) return;
+  if (process.env.DATABASE_URL && process.env.EXE_USE_POSTGRES === "1") return;
   if (process.env.EXE_IS_DAEMON === "1") return;
+  if (process.env.VITEST) return;
   if (!_resilientClient) return;
+  if (_daemonClient) return;
   try {
     const { initDaemonDbClient: initDaemonDbClient2 } = await Promise.resolve().then(() => (init_db_daemon_client(), db_daemon_client_exports));
     _daemonClient = await initDaemonDbClient2(_resilientClient);
@@ -1802,6 +1962,13 @@ async function ensureSchema() {
     });
   } catch {
   }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE behaviors ADD COLUMN vector F32_BLOB(${EMBEDDING_DIM})`,
+      args: []
+    });
+  } catch {
+  }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN blocked_by TEXT`,
@@ -2672,6 +2839,7 @@ var init_database = __esm({
     init_db_retry();
     init_employees();
     init_database_adapter();
+    init_memory();
     _client = null;
     _resilientClient = null;
     _walCheckpointTimer = null;
@@ -2790,6 +2958,68 @@ var init_platform_procedures = __esm({
         domain: "architecture",
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
+      },
+      // --- MCP is the ONLY data interface ---
+      {
+        title: "MCP disconnect \u2014 ask the user, never work around it",
+        domain: "workflow",
+        priority: "p0",
+        content: "If MCP tools are unavailable, disconnected, or returning connection errors: STOP. Tell the user clearly: 'MCP server is disconnected. Please run /mcp to reconnect.' Do NOT attempt workarounds \u2014 no raw Node imports, no direct DB access, no CLI hacks, no daemon socket calls. MCP is the ONLY data interface. Working around it wastes time, hits bundling issues, and bypasses the contract boundary. Ask once, wait, proceed when reconnected."
+      },
+      // --- MCP Tool Catalog (Layer 0 — every agent knows what tools exist) ---
+      {
+        title: "MCP tools \u2014 memory and search",
+        domain: "tool-use",
+        priority: "p1",
+        content: "recall_my_memory: search your own memories (semantic + FTS). ask_team_memory: search a colleague's memories by agent name. store_memory: persist a memory (decisions, summaries, context). commit_memory: high-importance memory that survives consolidation. search_everything: unified search across memories, tasks, entities, conversations. get_session_context: temporal window of memories around a timestamp. consolidate_memories: merge duplicate/related memories into insights. get_memory_cardinality: count memories per agent (health check)."
+      },
+      {
+        title: "MCP tools \u2014 task orchestration",
+        domain: "tool-use",
+        priority: "p1",
+        content: "create_task: dispatch work to an employee (auto-spawns session). The ONLY dispatch path. list_tasks: query tasks by status, assignee, project. get_task: fetch full task details by ID. update_task: change status (in_progress, done, blocked, cancelled) + add result summary. close_task: finalize a reviewed task (COO only). checkpoint_task: save progress state for crash recovery. resume_employee: re-spawn an employee session for an existing task."
+      },
+      {
+        title: "MCP tools \u2014 knowledge graph (GraphRAG)",
+        domain: "tool-use",
+        priority: "p1",
+        content: "query_relationships: find connections between entities in the knowledge graph. get_entity_neighbors: explore an entity's direct connections. get_hot_entities: find most-referenced entities (trending topics). get_graph_stats: graph health \u2014 entity/relationship counts, density. export_graph: export graph data for visualization. merge_entities: deduplicate entities (alias resolution). find_similar_trajectories: match tool-call patterns to past task solutions."
+      },
+      {
+        title: "MCP tools \u2014 identity, behavior, and decisions",
+        domain: "tool-use",
+        priority: "p1",
+        content: "get_identity: read an agent's exe.md (Layer 1 identity). update_identity: write an agent's exe.md. Identity > behavior \u2014 use for permanent rules. store_behavior: record a correction or pattern for an agent (Layer 2 expertise). list_behaviors: view an agent's active behaviors. deactivate_behavior: soft-delete a stale or conflicting behavior. store_decision: record an ADR (architectural decision record). get_decision: retrieve a past decision by query."
+      },
+      {
+        title: "MCP tools \u2014 communication and messaging",
+        domain: "tool-use",
+        priority: "p1",
+        content: "send_message: send supplementary context to another agent (NOT for actionable work \u2014 use create_task). acknowledge_messages: mark messages as read. send_whatsapp: send WhatsApp message via gateway (customer-facing alerts). query_conversations: search ingested conversations across all channels (WhatsApp, email, etc.)."
+      },
+      {
+        title: "MCP tools \u2014 wiki, documents, and content",
+        domain: "tool-use",
+        priority: "p1",
+        content: "create_wiki_page: create a wiki page in exe-wiki. list_wiki_pages: browse wiki pages. get_wiki_page: read a wiki page. update_wiki_page: edit a wiki page. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
+      },
+      {
+        title: "MCP tools \u2014 system, operations, and admin",
+        domain: "tool-use",
+        priority: "p1",
+        content: "get_agent_spend: token usage per agent/session (cost tracking). list_agent_sessions: view agent session history. get_session_kills: audit log of killed sessions. get_daemon_health: check exed daemon status. get_auto_wake_status: daemon auto-wake configuration. get_worker_gate: check worker deployment gates. run_memory_audit: health check \u2014 duplicates, null vectors, orphaned rows. run_consolidation: trigger sleep-time memory consolidation. cloud_sync: force a cloud sync cycle. backup_vps: trigger VPS backup."
+      },
+      {
+        title: "MCP tools \u2014 config, licensing, and team",
+        domain: "tool-use",
+        priority: "p1",
+        content: "set_agent_config: view/change per-agent runtime and model settings. list_employees: view the employee roster. add_person: add a person to the CRM contacts roster. list_people: browse CRM contacts. get_person: fetch contact details. get_license_status: check license validity. create_license: generate a new license key (admin). list_licenses: view all issued licenses. activate_license: activate a license on a device."
+      },
+      {
+        title: "MCP tools \u2014 advanced (triggers, skills, orchestration)",
+        domain: "tool-use",
+        priority: "p1",
+        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage Layer 0 procedures (actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
       }
     ];
     PLATFORM_PROCEDURE_TITLES = new Set(
@@ -2869,13 +3099,6 @@ ${p.content}`).join("\n\n");
   }
 });
 
-// src/types/memory.ts
-var init_memory = __esm({
-  "src/types/memory.ts"() {
-    "use strict";
-  }
-});
-
 // src/lib/keychain.ts
 var keychain_exports = {};
 __export(keychain_exports, {
@@ -3429,6 +3652,11 @@ async function initStore(options) {
     encryptionKey: hexKey
   });
   await retryOnBusy2(() => ensureSchema(), "ensureSchema");
+  try {
+    const { initDaemonClient: initDaemonClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+    await initDaemonClient2();
+  } catch {
+  }
   if (!options?.lightweight) {
     try {
       const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
@@ -3473,6 +3701,7 @@ var session_registry_exports = {};
 __export(session_registry_exports, {
   listSessions: () => listSessions,
   pruneStaleSessions: () => pruneStaleSessions,
+  refreshSessionProject: () => refreshSessionProject,
   registerSession: () => registerSession
 });
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, existsSync as existsSync8 } from "fs";
@@ -3493,6 +3722,16 @@ function registerSession(entry) {
   }
   writeFileSync3(REGISTRY_PATH, JSON.stringify(sessions, null, 2));
 }
+function refreshSessionProject(windowName, projectDir) {
+  const sessions = listSessions();
+  const entry = sessions.find((s) => s.windowName === windowName);
+  if (!entry || entry.projectDir === projectDir) return;
+  entry.projectDir = projectDir;
+  try {
+    writeFileSync3(REGISTRY_PATH, JSON.stringify(sessions, null, 2));
+  } catch {
+  }
+}
 function listSessions() {
   try {
     const raw = readFileSync5(REGISTRY_PATH, "utf8");
@@ -3841,7 +4080,7 @@ var init_agent_config = __esm({
     init_secure_files();
     AGENT_CONFIG_PATH = path9.join(EXE_AI_DIR, "agent-config.json");
     DEFAULT_MODELS = {
-      claude: "claude-opus-4",
+      claude: "claude-opus-4.6",
       codex: RUNTIME_TABLE.codex?.defaultModel ?? "gpt-5.4",
       opencode: RUNTIME_TABLE.opencode?.defaultModel ?? "anthropic/claude-sonnet-4-6"
     };
@@ -5051,15 +5290,20 @@ async function createTaskCore(input) {
     const { resolveExeSession: resolveExeSession2 } = await Promise.resolve().then(() => (init_tmux_routing(), tmux_routing_exports));
     const resolved = resolveExeSession2();
     if (resolved && input.projectName) {
-      const { getSessionProject: getSessionProject2 } = await Promise.resolve().then(() => (init_session_scope(), session_scope_exports));
-      const sessionProject = getSessionProject2(resolved);
-      if (sessionProject && sessionProject !== input.projectName) {
-        scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
-        process.stderr.write(`[create_task] ${scopeMismatchWarning}
-`);
-        earlySessionScope = null;
-      } else {
+      const isCoordinatorSession = !resolved.includes("-");
+      if (isCoordinatorSession) {
         earlySessionScope = resolved;
+      } else {
+        const { getSessionProject: getSessionProject2 } = await Promise.resolve().then(() => (init_session_scope(), session_scope_exports));
+        const sessionProject = getSessionProject2(resolved);
+        if (sessionProject && sessionProject !== input.projectName) {
+          scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
+          process.stderr.write(`[create_task] ${scopeMismatchWarning}
+`);
+          earlySessionScope = null;
+        } else {
+          earlySessionScope = resolved;
+        }
       }
     } else {
       earlySessionScope = resolved;
@@ -5944,6 +6188,10 @@ async function dispatchTaskToEmployee(input) {
     if (transport.isAlive(sessionName)) {
       const result = sendIntercom(sessionName);
       const dispatched = result === "acknowledged" || result === "debounced" || result === "queued" ? "verified" : result === "delivered" ? "sent_unverified" : "session_dead";
+      process.stderr.write(
+        `[dispatch-audit] intercom \u2192 ${sessionName} | task="${input.title}" [${input.priority}] | result=${dispatched} (sendIntercom=${result})
+`
+      );
       return { dispatched, session: sessionName, crossProject };
     } else {
       const projectDir = input.projectDir ?? process.cwd();
@@ -5952,11 +6200,15 @@ async function dispatchTaskToEmployee(input) {
       });
       if (result.status === "failed") {
         process.stderr.write(
-          `[dispatch] Failed to spawn ${input.assignedTo}: ${result.error}
+          `[dispatch-audit] SPAWN FAILED \u2192 ${input.assignedTo} | task="${input.title}" [${input.priority}] | error=${result.error}
 `
         );
         return { dispatched: "session_missing" };
       }
+      process.stderr.write(
+        `[dispatch-audit] SPAWNED \u2192 ${result.sessionName} | task="${input.title}" [${input.priority}]
+`
+      );
       return { dispatched: "spawned", session: result.sessionName, crossProject };
     }
   } catch {
@@ -5966,7 +6218,13 @@ async function dispatchTaskToEmployee(input) {
 function notifyTaskDone() {
   try {
     const key = getSessionKey();
-    if (key && !process.env.VITEST) notifyParentExe(key);
+    if (key && !process.env.VITEST) {
+      notifyParentExe(key);
+      process.stderr.write(
+        `[dispatch-audit] notifyTaskDone \u2192 parent coordinator (session=${key})
+`
+      );
+    }
   } catch {
   }
 }
@@ -5987,16 +6245,91 @@ var init_tasks_notify = __esm({
   }
 });
 
+// src/lib/embedder.ts
+var embedder_exports = {};
+__export(embedder_exports, {
+  disposeEmbedder: () => disposeEmbedder,
+  embed: () => embed,
+  embedDirect: () => embedDirect,
+  getEmbedder: () => getEmbedder
+});
+async function getEmbedder() {
+  const ok = await connectEmbedDaemon();
+  if (!ok) {
+    throw new Error(
+      "Could not connect to embedding daemon. Ensure the model is installed (run /exe-setup)."
+    );
+  }
+}
+async function embed(text) {
+  const priority = process.env.EXE_EMBED_PRIORITY === "low" ? "low" : "high";
+  const vector = await embedViaClient(text, priority);
+  if (!vector) {
+    throw new Error(
+      "Embedding failed: daemon unavailable. Run /exe-setup to verify model installation."
+    );
+  }
+  if (vector.length !== EMBEDDING_DIM) {
+    throw new Error(
+      `Embedding dimension mismatch: expected ${EMBEDDING_DIM}, got ${vector.length}. Ensure the correct Jina v5-small Q4_K_M GGUF model is installed.`
+    );
+  }
+  return vector;
+}
+async function disposeEmbedder() {
+  disconnectClient();
+}
+async function embedDirect(text) {
+  const llamaCpp = await import("node-llama-cpp");
+  const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+  const { existsSync: existsSync21 } = await import("fs");
+  const path25 = await import("path");
+  const modelPath = path25.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync21(modelPath)) {
+    throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
+  }
+  const llama = await llamaCpp.getLlama();
+  const model = await llama.loadModel({ modelPath });
+  const context = await model.createEmbeddingContext();
+  try {
+    const embedding = await context.getEmbeddingFor(text);
+    const vector = Array.from(embedding.vector);
+    if (vector.length !== EMBEDDING_DIM) {
+      throw new Error(
+        `Embedding dimension mismatch: expected ${EMBEDDING_DIM}, got ${vector.length}.`
+      );
+    }
+    return vector;
+  } finally {
+    await context.dispose();
+    await model.dispose();
+  }
+}
+var init_embedder = __esm({
+  "src/lib/embedder.ts"() {
+    "use strict";
+    init_memory();
+    init_exe_daemon_client();
+  }
+});
+
 // src/lib/behaviors.ts
 import crypto5 from "crypto";
 async function storeBehavior(opts) {
   const client = getClient();
   const id = crypto5.randomUUID();
   const now = (/* @__PURE__ */ new Date()).toISOString();
+  let vector = null;
+  try {
+    const { embed: embed2 } = await Promise.resolve().then(() => (init_embedder(), embedder_exports));
+    const vec = await embed2(opts.content);
+    vector = new Float32Array(vec);
+  } catch {
+  }
   await client.execute({
-    sql: `INSERT INTO behaviors (id, agent_id, project_name, domain, priority, content, active, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, 1, ?, ?)`,
-    args: [id, opts.agentId, opts.projectName ?? null, opts.domain ?? null, opts.priority ?? "p1", opts.content, now, now]
+    sql: `INSERT INTO behaviors (id, agent_id, project_name, domain, priority, content, active, created_at, updated_at, vector)
+          VALUES (?, ?, ?, ?, ?, ?, 1, ?, ?, ?)`,
+    args: [id, opts.agentId, opts.projectName ?? null, opts.domain ?? null, opts.priority ?? "p1", opts.content, now, now, vector ? vector.buffer : null]
   });
   return id;
 }
@@ -7099,7 +7432,7 @@ function isSessionBusy(sessionName) {
 function isExeSession(sessionName) {
   const matchesBaseWithInstance = (baseName) => sessionName === baseName || sessionName.startsWith(baseName) && /^\d+$/.test(sessionName.slice(baseName.length));
   const coordinatorName = getCoordinatorName();
-  return matchesBaseWithInstance(coordinatorName) || matchesBaseWithInstance("exe");
+  return matchesBaseWithInstance(coordinatorName);
 }
 function sendIntercom(targetSession) {
   const transport = getTransport();
@@ -9265,6 +9598,14 @@ __export(schedules_exports, {
 });
 import crypto9 from "crypto";
 import { execSync as execSync9 } from "child_process";
+function isValidCron(cron) {
+  const fields = cron.trim().split(/\s+/);
+  if (fields.length !== 5) return false;
+  return fields.every((f) => CRON_FIELD.test(f));
+}
+function isValidScheduleId(id) {
+  return SAFE_ID.test(id) && id.length <= 128;
+}
 async function ensureDb() {
   if (!isInitialized()) {
     await initStore();
@@ -9330,6 +9671,9 @@ function parseHumanCron(input) {
   return `${minute} ${hour} * * ${dow}`;
 }
 async function createSchedule(input) {
+  if (!isValidCron(input.cron)) {
+    throw new Error(`Invalid cron expression: ${input.cron}. Must be 5 fields with only digits, *, /, -, comma.`);
+  }
   await ensureDb();
   const client = getClient();
   const id = crypto9.randomUUID().slice(0, 8);
@@ -9403,6 +9747,12 @@ async function deleteSchedule(id) {
   return true;
 }
 function addToCrontab(id, cron, prompt, projectDir) {
+  if (!isValidCron(cron)) {
+    throw new Error(`Invalid cron expression: ${cron}`);
+  }
+  if (!isValidScheduleId(id)) {
+    throw new Error(`Invalid schedule ID: ${id}`);
+  }
   try {
     const cwd = projectDir ? `cd ${JSON.stringify(projectDir)} && ` : "";
     const escapedPrompt = prompt.replace(/"/g, '\\"');
@@ -9411,10 +9761,12 @@ function addToCrontab(id, cron, prompt, projectDir) {
       `(crontab -l 2>/dev/null; echo ${JSON.stringify(entry)}) | crontab -`,
       { timeout: 5e3, stdio: "ignore" }
     );
-  } catch {
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Invalid")) throw err;
   }
 }
 function removeFromCrontab(id) {
+  if (!isValidScheduleId(id)) return;
   try {
     execSync9(
       `crontab -l 2>/dev/null | grep -v "exe-schedule:${id}" | crontab -`,
@@ -9423,11 +9775,14 @@ function removeFromCrontab(id) {
   } catch {
   }
 }
+var CRON_FIELD, SAFE_ID;
 var init_schedules = __esm({
   "src/lib/schedules.ts"() {
     "use strict";
     init_database();
     init_store();
+    CRON_FIELD = /^[\d*/,\-]+$/;
+    SAFE_ID = /^[a-zA-Z0-9_\-]+$/;
   }
 });