@askexenow/exe-os 0.9.300 → 0.9.301

package/dist/chunk-MUIMJGSQ.js

@@ -0,0 +1,128 @@
+import {
+  loadEmployeesSync
+} from "./chunk-V6LOEOXG.js";
+
+// src/adapters/mcp-http-config.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { randomBytes } from "crypto";
+import { execFileSync } from "child_process";
+import path from "path";
+import os from "os";
+var DEFAULT_MCP_HTTP_PORT = "48739";
+function resolveDefaultAgentId() {
+  if (process.env.AGENT_ID && process.env.AGENT_ID !== "default") return process.env.AGENT_ID;
+  try {
+    const coo = loadEmployeesSync().find((e) => e.role === "COO");
+    if (coo) return coo.name;
+  } catch {
+  }
+  return "exe";
+}
+var DEFAULT_MCP_HTTP_AGENT_ID = resolveDefaultAgentId();
+var DEFAULT_MCP_HTTP_AGENT_ROLE = "COO";
+function sanitizePort(raw) {
+  const v = raw?.trim();
+  if (!v) return null;
+  if (!/^\d+$/.test(v)) return null;
+  const port = Number(v);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
+  return v;
+}
+function configMcpPort(homeDir = os.homedir()) {
+  try {
+    const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(homeDir, ".exe-os");
+    const configPath = path.join(dir, "config.json");
+    if (!existsSync(configPath)) return null;
+    const cfg = JSON.parse(readFileSync(configPath, "utf-8"));
+    const candidate = cfg.mcpPort ?? cfg.fixedMcpPort;
+    if (candidate == null) return null;
+    return sanitizePort(String(candidate));
+  } catch {
+    return null;
+  }
+}
+function mcpHttpPort(homeDir = os.homedir()) {
+  return sanitizePort(process.env.EXE_MCP_PORT) ?? configMcpPort(homeDir) ?? DEFAULT_MCP_HTTP_PORT;
+}
+function mcpHttpUrl(homeDir = os.homedir()) {
+  return `http://127.0.0.1:${mcpHttpPort(homeDir)}/mcp`;
+}
+function persistMcpPortToConfig(port = DEFAULT_MCP_HTTP_PORT, homeDir = os.homedir()) {
+  try {
+    if (!sanitizePort(port)) return;
+    const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(homeDir, ".exe-os");
+    const configPath = path.join(dir, "config.json");
+    if (!existsSync(configPath)) return;
+    const cfg = JSON.parse(readFileSync(configPath, "utf-8"));
+    if (cfg.mcpPort === port) return;
+    cfg.mcpPort = port;
+    writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
+`, "utf-8");
+  } catch {
+  }
+}
+function readOrCreateDaemonToken(homeDir = os.homedir()) {
+  const exeDir = path.join(homeDir, ".exe-os");
+  const tokenPath = path.join(exeDir, "exed.token");
+  if (existsSync(tokenPath)) {
+    try {
+      const token2 = readFileSync(tokenPath, "utf-8").trim();
+      if (/^[a-f0-9]{64}$/i.test(token2)) return token2;
+    } catch {
+    }
+  }
+  const token = randomBytes(32).toString("hex");
+  mkdirSync(exeDir, { recursive: true });
+  writeFileSync(tokenPath, `${token}
+`, "utf-8");
+  try {
+    chmodSync(tokenPath, 384);
+  } catch {
+  }
+  return token;
+}
+function buildMcpHttpHeaders(homeDir = os.homedir(), opts = {}) {
+  const agentId = opts.useShellPlaceholders ? "${AGENT_ID:-exe}" : opts.agentId ?? DEFAULT_MCP_HTTP_AGENT_ID;
+  const agentRole = opts.useShellPlaceholders ? "${AGENT_ROLE:-COO}" : opts.agentRole ?? DEFAULT_MCP_HTTP_AGENT_ROLE;
+  let sessionName = process.env.EXE_SESSION_NAME ?? "";
+  if (!sessionName && !opts.useShellPlaceholders) {
+    try {
+      const sock = process.env.EXE_TMUX_SOCKET;
+      const tmuxArgs = sock ? ["-L", sock, "display-message", "-p", "#{session_name}"] : ["display-message", "-p", "#{session_name}"];
+      const tmuxSession = execFileSync("tmux", tmuxArgs, {
+        encoding: "utf8",
+        timeout: 2e3
+      }).trim();
+      if (tmuxSession) sessionName = tmuxSession;
+    } catch {
+    }
+  }
+  const headers = {
+    Authorization: `Bearer ${readOrCreateDaemonToken(homeDir)}`,
+    "X-Agent-Id": agentId,
+    "X-Agent-Role": agentRole
+  };
+  if (sessionName && !opts.useShellPlaceholders) headers["X-Exe-Session"] = sessionName;
+  return headers;
+}
+function buildClaudeHttpMcpEntry(homeDir = os.homedir()) {
+  const entry = {
+    type: "http",
+    url: mcpHttpUrl(),
+    headers: buildMcpHttpHeaders(homeDir, { useShellPlaceholders: true })
+  };
+  delete entry.headers["X-Exe-Session"];
+  return entry;
+}
+
+export {
+  DEFAULT_MCP_HTTP_PORT,
+  DEFAULT_MCP_HTTP_AGENT_ID,
+  DEFAULT_MCP_HTTP_AGENT_ROLE,
+  mcpHttpPort,
+  mcpHttpUrl,
+  persistMcpPortToConfig,
+  readOrCreateDaemonToken,
+  buildMcpHttpHeaders,
+  buildClaudeHttpMcpEntry
+};

package/dist/chunk-NJMPNYBS.js

@@ -0,0 +1,427 @@
+import {
+  CC_NATIVE_ONLY_CUTOFF,
+  compareSemver,
+  detectAutoupdaterVar
+} from "./chunk-FRNXQSB4.js";
+import {
+  checkCpuStealSync
+} from "./chunk-SSC7EKY2.js";
+import {
+  readMcpHttpEvents,
+  summarizeMcpTransport
+} from "./chunk-3V6KXHSV.js";
+import {
+  mcpHttpPort
+} from "./chunk-MUIMJGSQ.js";
+import {
+  EXE_AI_DIR
+} from "./chunk-R36FAN53.js";
+import {
+  isMainModule
+} from "./chunk-6Y4B3QF6.js";
+
+// src/bin/exe-healthcheck.ts
+import { existsSync, readFileSync, readdirSync } from "fs";
+import path from "path";
+import { execSync } from "child_process";
+import { fileURLToPath } from "url";
+var CC_NATIVE_ONLY_CUTOFF2 = CC_NATIVE_ONLY_CUTOFF;
+var compareSemver2 = compareSemver;
+var detectAutoupdaterVar2 = detectAutoupdaterVar;
+function findPackageRoot() {
+  let dir = path.dirname(fileURLToPath(import.meta.url));
+  const { root } = path.parse(dir);
+  while (dir !== root) {
+    if (existsSync(path.join(dir, "package.json"))) return dir;
+    dir = path.dirname(dir);
+  }
+  throw new Error("Cannot find package root");
+}
+function checkBuildIntegrity(pkgRoot) {
+  const results = [];
+  const tsupConfig = path.join(pkgRoot, "tsup.config.ts");
+  if (!existsSync(tsupConfig)) {
+    return [{ name: "build/tsup-config", pass: false, detail: "tsup.config.ts not found" }];
+  }
+  const configContent = readFileSync(tsupConfig, "utf-8");
+  const entryMatches = configContent.matchAll(/"([^"]+)":\s*"src\//g);
+  const missing = [];
+  let total = 0;
+  for (const match of entryMatches) {
+    const outputKey = match[1];
+    const expectedPath = path.join(pkgRoot, "dist", `${outputKey}.js`);
+    total++;
+    if (!existsSync(expectedPath)) {
+      missing.push(`dist/${outputKey}.js`);
+    }
+  }
+  if (missing.length > 0) {
+    results.push({
+      name: "build/entry-points",
+      pass: false,
+      detail: `${missing.length}/${total} entry points missing:
+    ${missing.join("\n    ")}`
+    });
+  } else {
+    results.push({
+      name: "build/entry-points",
+      pass: true,
+      detail: `${total} entry points verified`
+    });
+  }
+  return results;
+}
+function checkEmbedPipeline(pkgRoot) {
+  const results = [];
+  const daemonPath = path.join(pkgRoot, "dist", "lib", "exe-daemon.js");
+  if (!existsSync(daemonPath)) {
+    results.push({
+      name: "exed/daemon-exists",
+      pass: false,
+      detail: `exe-daemon.js not found at ${daemonPath}`
+    });
+    return results;
+  }
+  results.push({ name: "exed/daemon-exists", pass: true, detail: "dist/lib/exe-daemon.js exists" });
+  const entryDirs = ["dist/hooks", "dist/bin", "dist/mcp"];
+  for (const dir of entryDirs) {
+    const fullDir = path.join(pkgRoot, dir);
+    if (!existsSync(fullDir)) continue;
+    let walkDir = fullDir;
+    const { root } = path.parse(walkDir);
+    let foundRoot = null;
+    while (walkDir !== root) {
+      if (existsSync(path.join(walkDir, "package.json"))) {
+        foundRoot = walkDir;
+        break;
+      }
+      walkDir = path.dirname(walkDir);
+    }
+    if (!foundRoot) {
+      results.push({
+        name: `exed/reachable-from-${dir}`,
+        pass: false,
+        detail: `Cannot find package root from ${dir}`
+      });
+      continue;
+    }
+    const resolvedDaemon = path.join(foundRoot, "dist", "lib", "exe-daemon.js");
+    const reachable = existsSync(resolvedDaemon);
+    results.push({
+      name: `exed/reachable-from-${dir}`,
+      pass: reachable,
+      detail: reachable ? `Resolves to ${resolvedDaemon}` : `NOT FOUND: ${resolvedDaemon}`
+    });
+  }
+  return results;
+}
+function checkTaskSystem(pkgRoot) {
+  const results = [];
+  const scannerPath = path.join(pkgRoot, "dist", "bin", "scan-tasks.js");
+  if (!existsSync(scannerPath)) {
+    results.push({ name: "tasks/scanner", pass: false, detail: "scan-tasks.js not found" });
+    return results;
+  }
+  try {
+    execSync(`node "${scannerPath}" /tmp/nonexistent-healthcheck-test --format=json 2>/dev/null`, {
+      timeout: 1e4,
+      encoding: "utf-8"
+    });
+    results.push({ name: "tasks/scanner", pass: true, detail: "scan-tasks.js runs without import errors" });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Cannot find module") || msg.includes("ERR_MODULE_NOT_FOUND") || msg.includes("SyntaxError")) {
+      results.push({ name: "tasks/scanner", pass: false, detail: `Import error: ${msg.slice(0, 200)}` });
+    } else {
+      results.push({ name: "tasks/scanner", pass: true, detail: "scan-tasks.js runs (no import errors)" });
+    }
+  }
+  return results;
+}
+function checkWorkerSpawning(pkgRoot) {
+  const results = [];
+  const workerPath = path.join(pkgRoot, "dist", "hooks", "ingest-worker.js");
+  if (!existsSync(workerPath)) {
+    results.push({ name: "workers/ingest-worker", pass: false, detail: "ingest-worker.js not found" });
+    return results;
+  }
+  try {
+    execSync(`node --check "${workerPath}" 2>&1`, { timeout: 1e4, encoding: "utf-8" });
+    results.push({ name: "workers/ingest-worker", pass: true, detail: "ingest-worker.js parses OK" });
+  } catch (err) {
+    results.push({
+      name: "workers/ingest-worker",
+      pass: false,
+      detail: `Parse error: ${err instanceof Error ? err.message.slice(0, 200) : String(err)}`
+    });
+  }
+  const hooksDir = path.join(pkgRoot, "dist", "hooks");
+  if (existsSync(hooksDir)) {
+    const hookFiles = readdirSync(hooksDir).filter((f) => f.endsWith(".js") && !f.endsWith(".js.map"));
+    let hooksPassed = 0;
+    const hooksFailed = [];
+    for (const hook of hookFiles) {
+      try {
+        execSync(`node --check "${path.join(hooksDir, hook)}" 2>&1`, { timeout: 1e4, encoding: "utf-8" });
+        hooksPassed++;
+      } catch {
+        hooksFailed.push(hook);
+      }
+    }
+    if (hooksFailed.length > 0) {
+      results.push({
+        name: "workers/hooks-parse",
+        pass: false,
+        detail: `${hooksFailed.length}/${hookFiles.length} hooks fail to parse: ${hooksFailed.join(", ")}`
+      });
+    } else {
+      results.push({
+        name: "workers/hooks-parse",
+        pass: true,
+        detail: `${hooksPassed} hook entry points parse OK`
+      });
+    }
+  }
+  return results;
+}
+function checkMcpTransport() {
+  const results = [];
+  const pidPath = path.join(EXE_AI_DIR, "exed.pid");
+  const tokenPath = path.join(EXE_AI_DIR, "exed.token");
+  let daemonAlive = false;
+  if (existsSync(pidPath)) {
+    try {
+      const pid = parseInt(readFileSync(pidPath, "utf8").trim(), 10);
+      process.kill(pid, 0);
+      daemonAlive = true;
+      results.push({ name: "mcp/daemon-process", pass: true, detail: `exed process alive (pid ${pid})` });
+    } catch {
+      results.push({ name: "mcp/daemon-process", pass: false, detail: "exed.pid exists but process is not alive; restart exe-os/exed" });
+    }
+  } else {
+    results.push({ name: "mcp/daemon-process", pass: false, detail: "No exed.pid found; daemon is not running" });
+  }
+  if (daemonAlive && existsSync(tokenPath)) {
+    try {
+      const token = readFileSync(tokenPath, "utf8").trim();
+      const port = /^\d+$/.test(mcpHttpPort()) ? mcpHttpPort() : "48739";
+      const url = `http://127.0.0.1:${port}/mcp`;
+      const response = execSync(
+        `curl -sS -i -m 1 -H "Authorization: Bearer ${token}" -H 'Accept: application/json, text/event-stream' ${url}`,
+        { encoding: "utf8", timeout: 1500 }
+      );
+      const jsonRpcError = response.includes("Content-Type: application/json") && response.includes("missing MCP session");
+      results.push({
+        name: "mcp/http-endpoint",
+        pass: jsonRpcError,
+        detail: jsonRpcError ? "MCP HTTP endpoint reachable; missing-session probe returns JSON-RPC (expected)" : "MCP HTTP endpoint reachable but did not return expected JSON-RPC missing-session response"
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message.slice(0, 180) : String(err);
+      const timedOut = msg.includes("ETIMEDOUT") || msg.includes("timed out") || msg.includes("killed");
+      results.push({
+        name: "mcp/http-endpoint",
+        pass: false,
+        detail: timedOut ? "Daemon alive but MCP unresponsive (timed out after 1.5s)" : `MCP HTTP endpoint not reachable: ${msg}`
+      });
+    }
+  } else if (daemonAlive) {
+    results.push({ name: "mcp/http-endpoint", pass: false, detail: "Daemon is alive but exed.token is missing; cannot probe MCP HTTP" });
+  }
+  const events = readMcpHttpEvents(200);
+  const summary = summarizeMcpTransport(events);
+  results.push({
+    name: "mcp/local-event-log",
+    pass: true,
+    detail: `${events.length} recent event(s); activeSessions=${summary.activeSessions ?? "unknown"}; lastHandshake=${summary.lastSuccessfulHandshake ?? "none"}; lastTool=${summary.lastSuccessfulToolCall ?? "none"}`
+  });
+  results.push({
+    name: "mcp/monitor-summary",
+    pass: true,
+    detail: `Privacy-safe local monitor summary: ${path.join(EXE_AI_DIR, "monitor", "mcp-transport-summary.json")}`
+  });
+  return results;
+}
+function checkClaudeCodeInstall() {
+  const results = [];
+  const execPath = process.env.CLAUDE_CODE_EXECPATH ?? "";
+  if (execPath.length > 0 && (execPath.includes("claude/versions/") || execPath.includes("claude.exe") || execPath.includes("claude-native"))) {
+    results.push({
+      name: "cc/execpath-clean",
+      pass: false,
+      detail: `CLAUDE_CODE_EXECPATH points to native binary: "${execPath}" \u2014 20K phantom billing risk. Unset it: unset CLAUDE_CODE_EXECPATH`
+    });
+  } else {
+    results.push({
+      name: "cc/execpath-clean",
+      pass: true,
+      detail: execPath ? `CLAUDE_CODE_EXECPATH=${execPath} (node runtime, OK)` : "CLAUDE_CODE_EXECPATH is unset"
+    });
+  }
+  try {
+    const claudePath = execSync("which claude 2>/dev/null || true", { encoding: "utf8", timeout: 5e3 }).trim();
+    if (!claudePath) {
+      results.push({
+        name: "cc/cli-binary",
+        pass: false,
+        detail: "claude not found in PATH"
+      });
+    } else {
+      let resolved = claudePath;
+      try {
+        resolved = execSync(`readlink -f "${claudePath}" 2>/dev/null || readlink "${claudePath}" 2>/dev/null || echo "${claudePath}"`, {
+          encoding: "utf8",
+          timeout: 5e3
+        }).trim();
+      } catch {
+      }
+      if (resolved.includes("bin/claude.exe") || resolved.includes("bin/claude-native")) {
+        results.push({
+          name: "cc/cli-binary",
+          pass: false,
+          detail: `claude resolves to native binary: ${resolved}. Should be cli.js. Run: npm install -g @anthropic-ai/claude-code@2.1.98`
+        });
+      } else {
+        results.push({
+          name: "cc/cli-binary",
+          pass: true,
+          detail: `claude resolves to: ${resolved}`
+        });
+      }
+    }
+  } catch {
+    results.push({
+      name: "cc/cli-binary",
+      pass: false,
+      detail: "Failed to check claude binary path"
+    });
+  }
+  const versionsDir = path.join(
+    process.env.HOME ?? process.env.USERPROFILE ?? "",
+    ".local",
+    "share",
+    "claude",
+    "versions"
+  );
+  if (existsSync(versionsDir)) {
+    try {
+      const entries = readdirSync(versionsDir);
+      if (entries.length > 0) {
+        results.push({
+          name: "cc/native-cache-clean",
+          pass: false,
+          detail: `${entries.length} cached native version(s) found in ${versionsDir}: ${entries.slice(0, 3).join(", ")}${entries.length > 3 ? "..." : ""}. Remove: rm -rf "${versionsDir}"`
+        });
+      } else {
+        results.push({
+          name: "cc/native-cache-clean",
+          pass: true,
+          detail: `${versionsDir} is empty`
+        });
+      }
+    } catch {
+      results.push({
+        name: "cc/native-cache-clean",
+        pass: true,
+        detail: `${versionsDir} not readable (OK)`
+      });
+    }
+  } else {
+    results.push({
+      name: "cc/native-cache-clean",
+      pass: true,
+      detail: `${versionsDir} does not exist`
+    });
+  }
+  const disableOld = detectAutoupdaterVar2("DISABLE_AUTOUPDATER");
+  const disableNew = detectAutoupdaterVar2("CLAUDE_CODE_AUTOUPDATER_DISABLED");
+  if (!disableOld && !disableNew) {
+    results.push({
+      name: "cc/autoupdater-disabled",
+      pass: false,
+      detail: "Neither DISABLE_AUTOUPDATER=1 nor CLAUDE_CODE_AUTOUPDATER_DISABLED=1 is set in the environment or your shell profile. Auto-updater may install infected native binary. Export both in your shell profile."
+    });
+  } else {
+    const describe = (label, hit) => {
+      if (!hit) return null;
+      if (hit.source === "env") return `${label}=1 (env)`;
+      return `${label}=1 (~/${hit.profile})`;
+    };
+    const which = [
+      describe("DISABLE_AUTOUPDATER", disableOld),
+      describe("CLAUDE_CODE_AUTOUPDATER_DISABLED", disableNew)
+    ].filter(Boolean).join(" + ");
+    results.push({
+      name: "cc/autoupdater-disabled",
+      pass: true,
+      detail: `Auto-updater disabled via ${which}`
+    });
+  }
+  try {
+    const ccVersion = execSync("claude --version 2>/dev/null || echo unknown", {
+      encoding: "utf8",
+      timeout: 5e3
+    }).trim();
+    const versionMatch = ccVersion.match(/(\d+\.\d+\.\d+)/);
+    if (versionMatch) {
+      const ver = versionMatch[1];
+      const isRisky = compareSemver2(ver, CC_NATIVE_ONLY_CUTOFF2) >= 0;
+      results.push({
+        name: "cc/version",
+        pass: !isRisky,
+        detail: isRisky ? `CC version ${ver} \u2014 \u2265${CC_NATIVE_ONLY_CUTOFF2} ships native binary only. Pin: npm install -g @anthropic-ai/claude-code@2.1.98` : `CC version ${ver}`
+      });
+    }
+  } catch {
+  }
+  return results;
+}
+function checkCpuSteal() {
+  const steal = checkCpuStealSync();
+  if (!steal.available) {
+    return [{ name: "host/cpu-steal", pass: true, detail: `n/a \u2014 ${steal.message}` }];
+  }
+  const pass = steal.severity === "ok";
+  return [{
+    name: "host/cpu-steal",
+    pass,
+    detail: steal.severity === "critical" ? `\u{1F534} CRITICAL: ${steal.message}` : steal.severity === "warning" ? `\u{1F7E0} WARN: ${steal.message}` : steal.message
+  }];
+}
+function runHealthCheck() {
+  const pkgRoot = findPackageRoot();
+  const results = [
+    ...checkBuildIntegrity(pkgRoot),
+    ...checkEmbedPipeline(pkgRoot),
+    ...checkTaskSystem(pkgRoot),
+    ...checkWorkerSpawning(pkgRoot),
+    ...checkMcpTransport(),
+    ...checkClaudeCodeInstall(),
+    ...checkCpuSteal()
+  ];
+  const passed = results.filter((r) => r.pass).length;
+  const failed = results.filter((r) => !r.pass).length;
+  return { results, passed, failed };
+}
+if (isMainModule(import.meta.url) && (process.argv[1] ?? "").includes("exe-healthcheck")) {
+  const { results, passed, failed } = runHealthCheck();
+  console.log("\n  exe-os Health Check\n");
+  for (const r of results) {
+    const icon = r.pass ? "\x1B[32m\u2713\x1B[0m" : "\x1B[31m\u2717\x1B[0m";
+    console.log(`  ${icon} ${r.name}`);
+    console.log(`    ${r.detail}`);
+  }
+  console.log(`
+  ${passed} passed, ${failed} failed
+`);
+  process.exit(failed > 0 ? 1 : 0);
+}
+
+export {
+  CC_NATIVE_ONLY_CUTOFF2 as CC_NATIVE_ONLY_CUTOFF,
+  compareSemver2 as compareSemver,
+  detectAutoupdaterVar2 as detectAutoupdaterVar,
+  checkClaudeCodeInstall,
+  checkCpuSteal,
+  runHealthCheck
+};

package/dist/chunk-OJACH2JF.js

@@ -0,0 +1,128 @@
+import {
+  getCurrentSessionScope,
+  strictSessionScopeFilter
+} from "./chunk-ZSUACDQC.js";
+import {
+  getProjectName
+} from "./chunk-OPU3NYOO.js";
+
+// src/lib/session-events.ts
+import { randomUUID } from "crypto";
+async function ensureSessionEventsTable(client) {
+  await client.execute(`
+    CREATE TABLE IF NOT EXISTS session_events (
+      id            TEXT PRIMARY KEY,
+      agent_id      TEXT NOT NULL,
+      agent_role    TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      session_scope TEXT,
+      project_name  TEXT NOT NULL,
+      event_index   INTEGER NOT NULL,
+      event_type    TEXT NOT NULL,
+      tool_name     TEXT,
+      tool_use_id   TEXT,
+      content       TEXT NOT NULL,
+      payload_json  TEXT,
+      has_error     INTEGER NOT NULL DEFAULT 0,
+      created_at    TEXT NOT NULL
+    )
+  `);
+  await client.execute(`
+    CREATE INDEX IF NOT EXISTS idx_session_events_agent_time
+      ON session_events(agent_id, created_at DESC)
+  `);
+  await client.execute(`
+    CREATE INDEX IF NOT EXISTS idx_session_events_session_index
+      ON session_events(session_id, event_index)
+  `);
+  await client.execute(`
+    CREATE INDEX IF NOT EXISTS idx_session_events_scope_agent_time
+      ON session_events(session_scope, agent_id, created_at DESC)
+  `);
+}
+async function recordSessionEvent(client, input) {
+  if (!input.content || input.content.trim().length === 0) return;
+  await ensureSessionEventsTable(client);
+  const maxResult = await client.execute({
+    sql: "SELECT COALESCE(MAX(event_index), 0) AS max_index FROM session_events WHERE session_id = ?",
+    args: [input.sessionId]
+  });
+  const currentMax = Number(maxResult.rows[0]?.max_index ?? 0);
+  const eventIndex = Number.isFinite(currentMax) ? currentMax + 1 : 1;
+  await client.execute({
+    sql: `INSERT INTO session_events (
+            id, agent_id, agent_role, session_id, session_scope, project_name,
+            event_index, event_type, tool_name, tool_use_id, content,
+            payload_json, has_error, created_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    args: [
+      randomUUID(),
+      input.agentId,
+      input.agentRole,
+      input.sessionId,
+      input.sessionScope ?? getCurrentSessionScope(),
+      input.projectName ?? getProjectName(input.cwd),
+      eventIndex,
+      input.eventType,
+      input.toolName ?? null,
+      input.toolUseId ?? null,
+      input.content,
+      input.payloadJson ?? null,
+      input.hasError ? 1 : 0,
+      input.timestamp ?? (/* @__PURE__ */ new Date()).toISOString()
+    ]
+  });
+}
+async function listRecentSessionEvents(client, options) {
+  await ensureSessionEventsTable(client);
+  const conditions = ["agent_id = ?"];
+  const args = [options.agentId];
+  if (options.sessionId) {
+    conditions.push("session_id = ?");
+    args.push(options.sessionId);
+  }
+  if (options.eventType) {
+    conditions.push("event_type = ?");
+    args.push(options.eventType);
+  }
+  if (options.projectName && options.projectName !== "all") {
+    conditions.push("project_name = ?");
+    args.push(options.projectName);
+  }
+  const scope = strictSessionScopeFilter(options.sessionScope);
+  const where = `WHERE ${conditions.join(" AND ")}${scope.sql}`;
+  args.push(...scope.args);
+  args.push(Math.min(Math.max(options.limit ?? 20, 1), 100));
+  const result = await client.execute({
+    sql: `SELECT id, agent_id, agent_role, session_id, session_scope,
+                 project_name, event_index, event_type, tool_name, tool_use_id,
+                 content, payload_json, has_error, created_at
+          FROM session_events
+          ${where}
+          ORDER BY created_at DESC, event_index DESC
+          LIMIT ?`,
+    args
+  });
+  return result.rows.map((row) => ({
+    id: String(row.id),
+    agentId: String(row.agent_id),
+    agentRole: String(row.agent_role),
+    sessionId: String(row.session_id),
+    sessionScope: row.session_scope == null ? null : String(row.session_scope),
+    projectName: String(row.project_name),
+    eventIndex: Number(row.event_index),
+    eventType: String(row.event_type),
+    toolName: row.tool_name == null ? null : String(row.tool_name),
+    toolUseId: row.tool_use_id == null ? null : String(row.tool_use_id),
+    content: String(row.content),
+    payloadJson: row.payload_json == null ? null : String(row.payload_json),
+    hasError: Number(row.has_error) === 1,
+    createdAt: String(row.created_at)
+  }));
+}
+
+export {
+  ensureSessionEventsTable,
+  recordSessionEvent,
+  listRecentSessionEvents
+};