@askexenow/exe-os 0.9.7 → 0.9.9

package/dist/bin/exe-new-employee.js

@@ -15,9 +15,34 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/lib/secure-files.ts
+import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+import { chmod, mkdir } from "fs/promises";
+function ensurePrivateDirSync(dirPath) {
+  mkdirSync2(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    chmodSync2(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+function enforcePrivateFileSync(filePath) {
+  try {
+    if (existsSync2(filePath)) chmodSync2(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+var PRIVATE_DIR_MODE, PRIVATE_FILE_MODE;
+var init_secure_files = __esm({
+  "src/lib/secure-files.ts"() {
+    "use strict";
+    PRIVATE_DIR_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+  }
+});
+
 // src/lib/config.ts
-import { readFile, writeFile, mkdir, chmod } from "fs/promises";
-import { readFileSync as readFileSync2, existsSync as existsSync2, renameSync } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { readFileSync as readFileSync2, existsSync as existsSync3, renameSync } from "fs";
 import path2 from "path";
 import os from "os";
 function resolveDataDir() {
@@ -25,7 +50,7 @@ function resolveDataDir() {
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
   const newDir = path2.join(os.homedir(), ".exe-os");
   const legacyDir = path2.join(os.homedir(), ".exe-mem");
-  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
+  if (!existsSync3(newDir) && existsSync3(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
       process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
@@ -40,6 +65,7 @@ var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CON
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
+    init_secure_files();
     EXE_AI_DIR = resolveDataDir();
     DB_PATH = path2.join(EXE_AI_DIR, "memories.db");
     MODELS_DIR = path2.join(EXE_AI_DIR, "models");
@@ -106,12 +132,135 @@ var init_config = __esm({
   }
 });
 
+// src/lib/runtime-table.ts
+var RUNTIME_TABLE, DEFAULT_RUNTIME;
+var init_runtime_table = __esm({
+  "src/lib/runtime-table.ts"() {
+    "use strict";
+    RUNTIME_TABLE = {
+      codex: {
+        binary: "codex",
+        launchMode: "interactive",
+        autoApproveFlag: "--dangerously-bypass-approvals-and-sandbox",
+        inlineFlag: "--no-alt-screen",
+        apiKeyEnv: "OPENAI_API_KEY",
+        defaultModel: "gpt-5.4"
+      },
+      opencode: {
+        binary: "opencode",
+        launchMode: "exec",
+        autoApproveFlag: "--dangerously-skip-permissions",
+        inlineFlag: "",
+        apiKeyEnv: "ANTHROPIC_API_KEY",
+        defaultModel: "anthropic/claude-sonnet-4-6"
+      }
+    };
+    DEFAULT_RUNTIME = "claude";
+  }
+});
+
+// src/lib/agent-config.ts
+var agent_config_exports = {};
+__export(agent_config_exports, {
+  AGENT_CONFIG_PATH: () => AGENT_CONFIG_PATH,
+  DEFAULT_MODELS: () => DEFAULT_MODELS,
+  KNOWN_RUNTIMES: () => KNOWN_RUNTIMES,
+  RUNTIME_LABELS: () => RUNTIME_LABELS,
+  clearAgentRuntime: () => clearAgentRuntime,
+  getAgentRuntime: () => getAgentRuntime,
+  loadAgentConfig: () => loadAgentConfig,
+  saveAgentConfig: () => saveAgentConfig,
+  setAgentRuntime: () => setAgentRuntime
+});
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync4 } from "fs";
+import path3 from "path";
+function loadAgentConfig() {
+  if (!existsSync4(AGENT_CONFIG_PATH)) return {};
+  try {
+    return JSON.parse(readFileSync3(AGENT_CONFIG_PATH, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function saveAgentConfig(config) {
+  const dir = path3.dirname(AGENT_CONFIG_PATH);
+  ensurePrivateDirSync(dir);
+  writeFileSync2(AGENT_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  enforcePrivateFileSync(AGENT_CONFIG_PATH);
+}
+function getAgentRuntime(agentId) {
+  const config = loadAgentConfig();
+  const entry = config[agentId];
+  if (entry) return entry;
+  const orgDefault = config["default"];
+  if (orgDefault) return orgDefault;
+  return { runtime: DEFAULT_RUNTIME, model: DEFAULT_MODELS[DEFAULT_RUNTIME] };
+}
+function setAgentRuntime(agentId, runtime, model) {
+  const knownModels = KNOWN_RUNTIMES[runtime];
+  if (!knownModels) {
+    return {
+      ok: false,
+      error: `Unknown runtime "${runtime}". Valid: ${Object.keys(KNOWN_RUNTIMES).join(", ")}`
+    };
+  }
+  if (!knownModels.includes(model)) {
+    return {
+      ok: false,
+      error: `Unknown model "${model}" for runtime "${runtime}". Valid: ${knownModels.join(", ")}`
+    };
+  }
+  const config = loadAgentConfig();
+  config[agentId] = { runtime, model };
+  saveAgentConfig(config);
+  return { ok: true };
+}
+function clearAgentRuntime(agentId) {
+  const config = loadAgentConfig();
+  delete config[agentId];
+  saveAgentConfig(config);
+}
+var AGENT_CONFIG_PATH, KNOWN_RUNTIMES, RUNTIME_LABELS, DEFAULT_MODELS;
+var init_agent_config = __esm({
+  "src/lib/agent-config.ts"() {
+    "use strict";
+    init_config();
+    init_runtime_table();
+    init_secure_files();
+    AGENT_CONFIG_PATH = path3.join(EXE_AI_DIR, "agent-config.json");
+    KNOWN_RUNTIMES = {
+      claude: ["claude-opus-4", "claude-sonnet-4", "claude-haiku-4.5"],
+      codex: ["gpt-5.4", "gpt-5.5", "gpt-5.3-codex-spark", "o3", "o4-mini"],
+      opencode: ["anthropic/claude-sonnet-4-6", "openai/gpt-5.4", "google/gemini-2.5-pro", "deepseek/deepseek-r3", "minimax/minimax-m2.5"]
+    };
+    RUNTIME_LABELS = {
+      claude: "Claude Code (Anthropic)",
+      codex: "Codex (OpenAI)",
+      opencode: "OpenCode (open source)"
+    };
+    DEFAULT_MODELS = {
+      claude: "claude-opus-4",
+      codex: RUNTIME_TABLE.codex?.defaultModel ?? "gpt-5.4",
+      opencode: RUNTIME_TABLE.opencode?.defaultModel ?? "anthropic/claude-sonnet-4-6"
+    };
+  }
+});
+
 // src/lib/employees.ts
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { existsSync as existsSync3, symlinkSync, readlinkSync, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync5, symlinkSync, readlinkSync, readFileSync as readFileSync4, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
 import { execSync } from "child_process";
-import path3 from "path";
+import path4 from "path";
 import os2 from "os";
+function normalizeRole(role) {
+  return (role ?? "").trim().toLowerCase();
+}
+function isCoordinatorRole(role) {
+  return normalizeRole(role) === normalizeRole(COORDINATOR_ROLE);
+}
+function getCoordinatorEmployee(employees) {
+  return employees.find((e) => isCoordinatorRole(e.role));
+}
 function validateEmployeeName(name) {
   if (!name) {
     return { valid: false, error: "Name is required" };
@@ -128,7 +277,7 @@ function validateEmployeeName(name) {
   return { valid: true };
 }
 async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync3(employeesPath)) {
+  if (!existsSync5(employeesPath)) {
     return [];
   }
   const raw = await readFile2(employeesPath, "utf-8");
@@ -139,9 +288,17 @@ async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
   }
 }
 async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
-  await mkdir2(path3.dirname(employeesPath), { recursive: true });
+  await mkdir2(path4.dirname(employeesPath), { recursive: true });
   await writeFile2(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
 }
+function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
+  if (!existsSync5(employeesPath)) return [];
+  try {
+    return JSON.parse(readFileSync4(employeesPath, "utf-8"));
+  } catch {
+    return [];
+  }
+}
 function addEmployee(employees, employee) {
   const normalized = { ...employee, name: employee.name.toLowerCase() };
   if (employees.some((e) => e.name.toLowerCase() === normalized.name)) {
@@ -149,6 +306,52 @@ function addEmployee(employees, employee) {
   }
   return [...employees, normalized];
 }
+function appendToCoordinatorTeam(employee) {
+  const coordinator = getCoordinatorEmployee(loadEmployeesSync());
+  if (!coordinator) return;
+  const idPath = path4.join(IDENTITY_DIR, `${coordinator.name}.md`);
+  if (!existsSync5(idPath)) return;
+  const content = readFileSync4(idPath, "utf-8");
+  if (content.includes(`**${capitalize(employee.name)}`)) return;
+  const teamMatch = content.match(TEAM_SECTION_RE);
+  if (!teamMatch || teamMatch.index === void 0) return;
+  const afterTeam = content.slice(teamMatch.index + teamMatch[0].length);
+  const nextHeading = afterTeam.match(/\n## /);
+  const entry = `
+**${capitalize(employee.name)} (${employee.role}):** Newly hired. Update this description as the role develops.
+`;
+  let updated;
+  if (nextHeading && nextHeading.index !== void 0) {
+    const insertAt = teamMatch.index + teamMatch[0].length + nextHeading.index;
+    updated = content.slice(0, insertAt) + entry + content.slice(insertAt);
+  } else {
+    updated = content.trimEnd() + "\n" + entry;
+  }
+  writeFileSync3(idPath, updated, "utf-8");
+}
+function capitalize(s) {
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}
+async function hireEmployee(employee) {
+  const employees = await loadEmployees();
+  const updated = addEmployee(employees, employee);
+  await saveEmployees(updated);
+  try {
+    appendToCoordinatorTeam(employee);
+  } catch {
+  }
+  try {
+    const { loadAgentConfig: loadAgentConfig2, saveAgentConfig: saveAgentConfig2 } = await Promise.resolve().then(() => (init_agent_config(), agent_config_exports));
+    const config = loadAgentConfig2();
+    const name = employee.name.toLowerCase();
+    if (!config[name] && config["default"]) {
+      config[name] = { ...config["default"] };
+      saveAgentConfig2(config);
+    }
+  } catch {
+  }
+  return updated;
+}
 function findExeBin() {
   try {
     return execSync(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
@@ -165,7 +368,7 @@ function registerBinSymlinks(name) {
     errors.push("Could not find 'exe-os' in PATH");
     return { created, skipped, errors };
   }
-  const binDir = path3.dirname(exeBinPath);
+  const binDir = path4.dirname(exeBinPath);
   let target;
   try {
     target = readlinkSync(exeBinPath);
@@ -175,8 +378,8 @@ function registerBinSymlinks(name) {
   }
   for (const suffix of ["", "-opencode"]) {
     const linkName = `${name}${suffix}`;
-    const linkPath = path3.join(binDir, linkName);
-    if (existsSync3(linkPath)) {
+    const linkPath = path4.join(binDir, linkName);
+    if (existsSync5(linkPath)) {
       skipped.push(linkName);
       continue;
     }
@@ -189,12 +392,15 @@ function registerBinSymlinks(name) {
   }
   return { created, skipped, errors };
 }
-var EMPLOYEES_PATH;
+var EMPLOYEES_PATH, COORDINATOR_ROLE, IDENTITY_DIR, TEAM_SECTION_RE;
 var init_employees = __esm({
   "src/lib/employees.ts"() {
     "use strict";
     init_config();
-    EMPLOYEES_PATH = path3.join(EXE_AI_DIR, "exe-employees.json");
+    EMPLOYEES_PATH = path4.join(EXE_AI_DIR, "exe-employees.json");
+    COORDINATOR_ROLE = "COO";
+    IDENTITY_DIR = path4.join(EXE_AI_DIR, "identity");
+    TEAM_SECTION_RE = /^## Team\b.*$/m;
   }
 });
 
@@ -205,12 +411,36 @@ var init_db_retry = __esm({
   }
 });
 
+// src/lib/database-adapter.ts
+import os3 from "os";
+import path5 from "path";
+import { createRequire } from "module";
+import { pathToFileURL } from "url";
+var BOOLEAN_COLUMNS_BY_TABLE, BOOLEAN_COLUMN_NAMES;
+var init_database_adapter = __esm({
+  "src/lib/database-adapter.ts"() {
+    "use strict";
+    BOOLEAN_COLUMNS_BY_TABLE = {
+      memories: /* @__PURE__ */ new Set(["has_error", "draft"]),
+      behaviors: /* @__PURE__ */ new Set(["active"]),
+      notifications: /* @__PURE__ */ new Set(["read"]),
+      users: /* @__PURE__ */ new Set(["has_personal_memory"])
+    };
+    BOOLEAN_COLUMN_NAMES = new Set(
+      Object.values(BOOLEAN_COLUMNS_BY_TABLE).flatMap((cols) => [...cols])
+    );
+  }
+});
+
 // src/lib/database.ts
 import { createClient } from "@libsql/client";
 function getClient() {
-  if (!_resilientClient) {
+  if (!_adapterClient) {
     throw new Error("Database client not initialized. Call initDatabase() first.");
   }
+  if (process.env.DATABASE_URL) {
+    return _adapterClient;
+  }
   if (process.env.EXE_IS_DAEMON === "1") {
     return _resilientClient;
   }
@@ -219,14 +449,16 @@ function getClient() {
   }
   return _resilientClient;
 }
-var _resilientClient, _daemonClient;
+var _resilientClient, _daemonClient, _adapterClient;
 var init_database = __esm({
   "src/lib/database.ts"() {
     "use strict";
     init_db_retry();
     init_employees();
+    init_database_adapter();
     _resilientClient = null;
     _daemonClient = null;
+    _adapterClient = null;
   }
 });
 
@@ -780,17 +1012,17 @@ __export(identity_exports, {
   listIdentities: () => listIdentities,
   updateIdentity: () => updateIdentity
 });
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
 import { readdirSync as readdirSync2 } from "fs";
-import path6 from "path";
+import path8 from "path";
 import { createHash } from "crypto";
 function ensureDir() {
-  if (!existsSync6(IDENTITY_DIR)) {
-    mkdirSync3(IDENTITY_DIR, { recursive: true });
+  if (!existsSync8(IDENTITY_DIR2)) {
+    mkdirSync4(IDENTITY_DIR2, { recursive: true });
   }
 }
 function identityPath(agentId) {
-  return path6.join(IDENTITY_DIR, `${agentId}.md`);
+  return path8.join(IDENTITY_DIR2, `${agentId}.md`);
 }
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
@@ -831,8 +1063,8 @@ function contentHash(content) {
 }
 function getIdentity(agentId) {
   const filePath = identityPath(agentId);
-  if (!existsSync6(filePath)) return null;
-  const raw = readFileSync6(filePath, "utf-8");
+  if (!existsSync8(filePath)) return null;
+  const raw = readFileSync7(filePath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(raw);
   return {
     agentId,
@@ -846,7 +1078,7 @@ async function updateIdentity(agentId, content, updatedBy) {
   ensureDir();
   const filePath = identityPath(agentId);
   const hash = contentHash(content);
-  writeFileSync4(filePath, content, "utf-8");
+  writeFileSync5(filePath, content, "utf-8");
   try {
     const client = getClient();
     await client.execute({
@@ -863,7 +1095,7 @@ async function updateIdentity(agentId, content, updatedBy) {
 }
 function listIdentities() {
   ensureDir();
-  const files = readdirSync2(IDENTITY_DIR).filter((f) => f.endsWith(".md"));
+  const files = readdirSync2(IDENTITY_DIR2).filter((f) => f.endsWith(".md"));
   const results = [];
   for (const file of files) {
     const agentId = file.replace(".md", "");
@@ -896,40 +1128,40 @@ ${teamLines.join("\n")}`);
   }
   return parts.join("\n\n");
 }
-var IDENTITY_DIR;
+var IDENTITY_DIR2;
 var init_identity = __esm({
   "src/lib/identity.ts"() {
     "use strict";
     init_config();
     init_database();
-    IDENTITY_DIR = path6.join(EXE_AI_DIR, "identity");
+    IDENTITY_DIR2 = path8.join(EXE_AI_DIR, "identity");
   }
 });
 
 // src/lib/agent-symlinks.ts
-import os3 from "os";
-import path7 from "path";
+import os5 from "os";
+import path9 from "path";
 import {
-  existsSync as existsSync7,
+  existsSync as existsSync9,
   lstatSync,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   readlinkSync as readlinkSync2,
   symlinkSync as symlinkSync2
 } from "fs";
 function claudeAgentsDir(homeDir) {
-  return path7.join(homeDir, ".claude", "agents");
+  return path9.join(homeDir, ".claude", "agents");
 }
 function identitySourcePath(homeDir, agentId) {
-  return path7.join(homeDir, ".exe-os", "identity", `${agentId}.md`);
+  return path9.join(homeDir, ".exe-os", "identity", `${agentId}.md`);
 }
 function claudeAgentLinkPath(homeDir, agentId) {
-  return path7.join(claudeAgentsDir(homeDir), `${agentId}.md`);
+  return path9.join(claudeAgentsDir(homeDir), `${agentId}.md`);
 }
-function ensureAgentSymlink(agentId, homeDir = os3.homedir()) {
+function ensureAgentSymlink(agentId, homeDir = os5.homedir()) {
   const target = identitySourcePath(homeDir, agentId);
   const link = claudeAgentLinkPath(homeDir, agentId);
-  mkdirSync4(claudeAgentsDir(homeDir), { recursive: true });
-  if (existsSync7(link)) {
+  mkdirSync5(claudeAgentsDir(homeDir), { recursive: true });
+  if (existsSync9(link)) {
     let stat;
     try {
       stat = lstatSync(link);
@@ -963,7 +1195,7 @@ function ensureAgentSymlink(agentId, homeDir = os3.homedir()) {
   }
   return { agentId, action: "created", target, link };
 }
-async function ensureAllAgentSymlinks(homeDir = os3.homedir()) {
+async function ensureAllAgentSymlinks(homeDir = os5.homedir()) {
   const employees = await loadEmployees();
   return employees.map((emp) => ensureAgentSymlink(emp.name, homeDir));
 }
@@ -998,14 +1230,14 @@ var init_mcp_prefix = __esm({
 });
 
 // src/lib/preferences.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5 } from "fs";
-import path8 from "path";
-import os4 from "os";
-function loadPreferences(homeDir = os4.homedir()) {
-  const configPath = path8.join(homeDir, ".exe-os", "config.json");
-  if (!existsSync8(configPath)) return {};
+import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
+import path10 from "path";
+import os6 from "os";
+function loadPreferences(homeDir = os6.homedir()) {
+  const configPath = path10.join(homeDir, ".exe-os", "config.json");
+  if (!existsSync10(configPath)) return {};
   try {
-    const config = JSON.parse(readFileSync7(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync8(configPath, "utf-8"));
     return config.preferences ?? {};
   } catch {
     return {};
@@ -1014,6 +1246,7 @@ function loadPreferences(homeDir = os4.homedir()) {
 var init_preferences = __esm({
   "src/lib/preferences.ts"() {
     "use strict";
+    init_secure_files();
   }
 });
 
@@ -1031,52 +1264,52 @@ __export(installer_exports, {
   setupTmux: () => setupTmux
 });
 import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3, readdir } from "fs/promises";
-import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync6, copyFileSync, mkdirSync as mkdirSync6 } from "fs";
-import path9 from "path";
-import os5 from "os";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync7, copyFileSync, mkdirSync as mkdirSync6 } from "fs";
+import path11 from "path";
+import os7 from "os";
 import { execSync as execSync2 } from "child_process";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolvePackageRoot() {
   const thisFile = fileURLToPath2(import.meta.url);
-  let dir = path9.dirname(thisFile);
-  const root = path9.parse(dir).root;
+  let dir = path11.dirname(thisFile);
+  const root = path11.parse(dir).root;
   while (dir !== root) {
-    const pkgPath = path9.join(dir, "package.json");
-    if (existsSync9(pkgPath)) {
+    const pkgPath = path11.join(dir, "package.json");
+    if (existsSync11(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
       } catch {
       }
     }
-    dir = path9.dirname(dir);
+    dir = path11.dirname(dir);
   }
-  return path9.resolve(path9.dirname(thisFile), "..", "..", "..");
+  return path11.resolve(path11.dirname(thisFile), "..", "..", "..");
 }
-async function copySlashCommands(packageRoot, homeDir = os5.homedir()) {
+async function copySlashCommands(packageRoot, homeDir = os7.homedir()) {
   let copied = 0;
   let skipped = 0;
-  const skillsBase = path9.join(homeDir, ".claude", "skills");
-  const exeDir = path9.join(packageRoot, "src", "commands", "exe");
-  if (existsSync9(exeDir)) {
+  const skillsBase = path11.join(homeDir, ".claude", "skills");
+  const exeDir = path11.join(packageRoot, "src", "commands", "exe");
+  if (existsSync11(exeDir)) {
     const entries = await readdir(exeDir);
     const mdFiles = entries.filter((f) => f.endsWith(".md"));
     for (const file of mdFiles) {
       const name = file.replace(".md", "");
-      const destDir = path9.join(skillsBase, `exe-${name}`);
+      const destDir = path11.join(skillsBase, `exe-${name}`);
       await mkdir3(destDir, { recursive: true });
-      const srcPath = path9.join(exeDir, file);
-      const destPath = path9.join(destDir, "SKILL.md");
+      const srcPath = path11.join(exeDir, file);
+      const destPath = path11.join(destDir, "SKILL.md");
       const result = await copyAsSkill(srcPath, destPath, `exe-${name}`);
       if (result) copied++;
       else skipped++;
     }
   }
-  const topLevelSrc = path9.join(packageRoot, "src", "commands", "exe.md");
-  if (existsSync9(topLevelSrc)) {
-    const destDir = path9.join(skillsBase, "exe");
+  const topLevelSrc = path11.join(packageRoot, "src", "commands", "exe.md");
+  if (existsSync11(topLevelSrc)) {
+    const destDir = path11.join(skillsBase, "exe");
     await mkdir3(destDir, { recursive: true });
-    const destPath = path9.join(destDir, "SKILL.md");
+    const destPath = path11.join(destDir, "SKILL.md");
     const result = await copyAsSkill(topLevelSrc, destPath, "exe");
     if (result) copied++;
     else skipped++;
@@ -1099,17 +1332,17 @@ name: ${skillName}
 `);
     }
   }
-  if (existsSync9(destPath)) {
+  if (existsSync11(destPath)) {
     const existing = await readFile3(destPath, "utf-8");
     if (existing === content) return false;
   }
   await writeFile3(destPath, content);
   return true;
 }
-async function registerMcpServer(packageRoot, homeDir = os5.homedir()) {
-  const claudeJsonPath = path9.join(homeDir, ".claude.json");
+async function registerMcpServer(packageRoot, homeDir = os7.homedir()) {
+  const claudeJsonPath = path11.join(homeDir, ".claude.json");
   let claudeJson = {};
-  if (existsSync9(claudeJsonPath)) {
+  if (existsSync11(claudeJsonPath)) {
     try {
       claudeJson = JSON.parse(await readFile3(claudeJsonPath, "utf-8"));
     } catch {
@@ -1122,25 +1355,25 @@ async function registerMcpServer(packageRoot, homeDir = os5.homedir()) {
   const newEntry = {
     type: "stdio",
     command: "node",
-    args: [path9.join(packageRoot, "dist", "mcp", "server.js")],
+    args: [path11.join(packageRoot, "dist", "mcp", "server.js")],
     env: {}
   };
   const currentMem = claudeJson.mcpServers[MCP_LEGACY_KEY];
-  const currentOs = claudeJson.mcpServers[MCP_PRIMARY_KEY];
   const memMatches = currentMem && JSON.stringify(currentMem) === JSON.stringify(newEntry);
-  const osMatches = currentOs && JSON.stringify(currentOs) === JSON.stringify(newEntry);
-  if (memMatches && osMatches) {
-    await cleanSettingsJsonMcp(path9.join(homeDir, ".claude", "settings.json"));
+  if (claudeJson.mcpServers[MCP_PRIMARY_KEY]) {
+    delete claudeJson.mcpServers[MCP_PRIMARY_KEY];
+  }
+  if (memMatches && !claudeJson.mcpServers[MCP_PRIMARY_KEY]) {
+    await cleanSettingsJsonMcp(path11.join(homeDir, ".claude", "settings.json"));
     return false;
   }
   claudeJson.mcpServers[MCP_LEGACY_KEY] = newEntry;
-  claudeJson.mcpServers[MCP_PRIMARY_KEY] = newEntry;
   await writeFile3(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
-  await cleanSettingsJsonMcp(path9.join(homeDir, ".claude", "settings.json"));
+  await cleanSettingsJsonMcp(path11.join(homeDir, ".claude", "settings.json"));
   return true;
 }
 async function cleanSettingsJsonMcp(settingsPath) {
-  if (!existsSync9(settingsPath)) return;
+  if (!existsSync11(settingsPath)) return;
   try {
     const settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     const servers = settings.mcpServers;
@@ -1160,14 +1393,14 @@ async function cleanSettingsJsonMcp(settingsPath) {
   } catch {
   }
 }
-async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
-  const settingsPath = path9.join(homeDir, ".claude", "settings.json");
-  const logsDir = path9.join(homeDir, ".exe-os", "logs");
-  const hookLogPath = path9.join(logsDir, "hooks.log");
+async function mergeHooks(packageRoot, homeDir = os7.homedir()) {
+  const settingsPath = path11.join(homeDir, ".claude", "settings.json");
+  const logsDir = path11.join(homeDir, ".exe-os", "logs");
+  const hookLogPath = path11.join(logsDir, "hooks.log");
   const logSuffix = ` 2>> "${hookLogPath}"`;
   await mkdir3(logsDir, { recursive: true });
   let settings = {};
-  if (existsSync9(settingsPath)) {
+  if (existsSync11(settingsPath)) {
     try {
       settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     } catch {
@@ -1189,11 +1422,11 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "ingest.js")}"${logSuffix}`
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "ingest.js")}"${logSuffix}`
           },
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "error-recall.js")}"${logSuffix}`
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "error-recall.js")}"${logSuffix}`
           }
         ]
       },
@@ -1205,7 +1438,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "session-start.js")}"${logSuffix}`,
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "session-start.js")}"${logSuffix}`,
             timeout: 1e4
           }
         ]
@@ -1218,7 +1451,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
           }
         ]
       },
@@ -1230,7 +1463,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "exe-heartbeat-hook.js")}"${logSuffix}`,
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "exe-heartbeat-hook.js")}"${logSuffix}`,
             timeout: 5e3
           }
         ]
@@ -1243,7 +1476,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
           }
         ]
       },
@@ -1256,7 +1489,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
           }
         ]
       },
@@ -1268,7 +1501,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "subagent-stop.js")}"${logSuffix}`
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "subagent-stop.js")}"${logSuffix}`
           }
         ]
       },
@@ -1280,7 +1513,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "pre-compact.js")}"${logSuffix}`,
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "pre-compact.js")}"${logSuffix}`,
             timeout: 1e4
           }
         ]
@@ -1293,7 +1526,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "session-end.js")}"${logSuffix}`
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "session-end.js")}"${logSuffix}`
           }
         ]
       },
@@ -1305,7 +1538,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "notification.js")}"${logSuffix}`
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "notification.js")}"${logSuffix}`
           }
         ]
       },
@@ -1317,7 +1550,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "post-compact.js")}"${logSuffix}`,
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "post-compact.js")}"${logSuffix}`,
             timeout: 1e4
           }
         ]
@@ -1330,7 +1563,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path9.join(packageRoot, "dist", "hooks", "instructions-loaded.js")}"${logSuffix}`
+            command: `node "${path11.join(packageRoot, "dist", "hooks", "instructions-loaded.js")}"${logSuffix}`
           }
         ]
       },
@@ -1429,13 +1662,13 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
       allowList.push(tool);
     }
   }
-  await mkdir3(path9.dirname(settingsPath), { recursive: true });
+  await mkdir3(path11.dirname(settingsPath), { recursive: true });
   await writeFile3(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   return { added, skipped };
 }
-async function cleanOldShellFunctions(homeDir = os5.homedir()) {
-  const rosterPath = path9.join(homeDir, ".exe-os", "exe-employees.json");
-  if (!existsSync9(rosterPath)) return 0;
+async function cleanOldShellFunctions(homeDir = os7.homedir()) {
+  const rosterPath = path11.join(homeDir, ".exe-os", "exe-employees.json");
+  if (!existsSync11(rosterPath)) return 0;
   let employees;
   try {
     employees = JSON.parse(await readFile3(rosterPath, "utf-8"));
@@ -1450,13 +1683,13 @@ async function cleanOldShellFunctions(homeDir = os5.homedir()) {
     return { name: n, funcDef, forLoop };
   });
   const rcFiles = [
-    path9.join(homeDir, ".zshrc"),
-    path9.join(homeDir, ".bashrc")
+    path11.join(homeDir, ".zshrc"),
+    path11.join(homeDir, ".bashrc")
   ];
   const REMOVED_MARKER = "# Removed by exe-os \u2014 wrappers now at ~/.exe-os/bin/";
   let totalRemoved = 0;
   for (const rcPath of rcFiles) {
-    if (!existsSync9(rcPath)) continue;
+    if (!existsSync11(rcPath)) continue;
     let content;
     try {
       content = await readFile3(rcPath, "utf-8");
@@ -1560,8 +1793,8 @@ function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 async function injectOrchestrationRules(homeDir) {
-  const claudeDir = path9.join(homeDir, ".claude");
-  const claudeMdPath = path9.join(claudeDir, "CLAUDE.md");
+  const claudeDir = path11.join(homeDir, ".claude");
+  const claudeMdPath = path11.join(claudeDir, "CLAUDE.md");
   await mkdir3(claudeDir, { recursive: true });
   let existing = "";
   try {
@@ -1583,19 +1816,19 @@ async function injectOrchestrationRules(homeDir) {
   await writeFile3(claudeMdPath, existing + separator + ORCHESTRATION_RULES + "\n", "utf-8");
   return "injected";
 }
-async function installStatusLine(packageRoot, homeDir = os5.homedir()) {
+async function installStatusLine(packageRoot, homeDir = os7.homedir()) {
   const prefs = loadPreferences(homeDir);
   if (prefs.ccStatusLine === false) return "opted-out";
-  const claudeDir = path9.join(homeDir, ".claude");
+  const claudeDir = path11.join(homeDir, ".claude");
   await mkdir3(claudeDir, { recursive: true });
-  const assetPath = path9.join(packageRoot, "dist", "assets", "statusline-command.sh");
-  if (!existsSync9(assetPath)) return "asset-missing";
-  const destScript = path9.join(claudeDir, "statusline-command.sh");
+  const assetPath = path11.join(packageRoot, "dist", "assets", "statusline-command.sh");
+  if (!existsSync11(assetPath)) return "asset-missing";
+  const destScript = path11.join(claudeDir, "statusline-command.sh");
   const assetContent = await readFile3(assetPath, "utf-8");
   await writeFile3(destScript, assetContent, { mode: 493 });
-  const settingsPath = path9.join(claudeDir, "settings.json");
+  const settingsPath = path11.join(claudeDir, "settings.json");
   let settings = {};
-  if (existsSync9(settingsPath)) {
+  if (existsSync11(settingsPath)) {
     try {
       settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     } catch {
@@ -1632,13 +1865,13 @@ async function runInstaller(homeDir) {
     `Hooks: ${hookResult.added} added, ${hookResult.skipped} unchanged
 `
   );
-  const resolvedHome = homeDir ?? os5.homedir();
-  const exeWorkspace = path9.join(resolvedHome, "exe");
-  if (!existsSync9(exeWorkspace)) {
+  const resolvedHome = homeDir ?? os7.homedir();
+  const exeWorkspace = path11.join(resolvedHome, "exe");
+  if (!existsSync11(exeWorkspace)) {
     try {
-      await mkdir3(path9.join(exeWorkspace, "content"), { recursive: true });
-      await mkdir3(path9.join(exeWorkspace, "operations"), { recursive: true });
-      await mkdir3(path9.join(exeWorkspace, "output"), { recursive: true });
+      await mkdir3(path11.join(exeWorkspace, "content"), { recursive: true });
+      await mkdir3(path11.join(exeWorkspace, "operations"), { recursive: true });
+      await mkdir3(path11.join(exeWorkspace, "output"), { recursive: true });
       process.stderr.write(
         `Created ~/exe/ \u2014 your automation workspace for non-code projects
 `
@@ -1673,34 +1906,34 @@ exe-os installed successfully.
 `);
 }
 function setupTmux(home) {
-  const homeDir = home ?? os5.homedir();
-  const exeDir = path9.join(homeDir, ".exe-os");
-  const exeTmuxConf = path9.join(exeDir, "tmux.conf");
-  const userTmuxConf = path9.join(homeDir, ".tmux.conf");
-  const backupPath = path9.join(homeDir, ".tmux.conf.backup");
+  const homeDir = home ?? os7.homedir();
+  const exeDir = path11.join(homeDir, ".exe-os");
+  const exeTmuxConf = path11.join(exeDir, "tmux.conf");
+  const userTmuxConf = path11.join(homeDir, ".tmux.conf");
+  const backupPath = path11.join(homeDir, ".tmux.conf.backup");
   const sourceLine = "source-file ~/.exe-os/tmux.conf";
   const pkgRoot = resolvePackageRoot();
-  const assetPath = path9.join(pkgRoot, "dist", "assets", "tmux.conf");
-  if (!existsSync9(assetPath)) {
+  const assetPath = path11.join(pkgRoot, "dist", "assets", "tmux.conf");
+  if (!existsSync11(assetPath)) {
     process.stderr.write(`exe-os: tmux.conf asset not found at ${assetPath} \u2014 skipping tmux setup
 `);
     return;
   }
   mkdirSync6(exeDir, { recursive: true });
   copyFileSync(assetPath, exeTmuxConf);
-  if (existsSync9(userTmuxConf)) {
-    const existing = readFileSync8(userTmuxConf, "utf8");
+  if (existsSync11(userTmuxConf)) {
+    const existing = readFileSync9(userTmuxConf, "utf8");
     if (!existing.includes(sourceLine)) {
-      if (!existsSync9(backupPath)) {
+      if (!existsSync11(backupPath)) {
         copyFileSync(userTmuxConf, backupPath);
         process.stderr.write(`exe-os: backed up existing tmux config to ${backupPath}
 `);
       }
-      writeFileSync6(userTmuxConf, `${sourceLine}
+      writeFileSync7(userTmuxConf, `${sourceLine}
 ${existing}`);
     }
   } else {
-    writeFileSync6(userTmuxConf, `# Exe OS tmux defaults \u2014 remove this line to use your own config
+    writeFileSync7(userTmuxConf, `# Exe OS tmux defaults \u2014 remove this line to use your own config
 ${sourceLine}
 `);
   }
@@ -1711,10 +1944,10 @@ ${sourceLine}
   process.stderr.write("exe-os: tmux config installed\n");
 }
 function setupGhostty(home) {
-  const homeDir = home ?? os5.homedir();
-  const xdgConfig = path9.join(homeDir, ".config", "ghostty");
-  const macConfig = path9.join(homeDir, "Library", "Application Support", "com.mitchellh.ghostty");
-  const ghosttyInstalled = existsSync9(xdgConfig) || existsSync9(macConfig) || (() => {
+  const homeDir = home ?? os7.homedir();
+  const xdgConfig = path11.join(homeDir, ".config", "ghostty");
+  const macConfig = path11.join(homeDir, "Library", "Application Support", "com.mitchellh.ghostty");
+  const ghosttyInstalled = existsSync11(xdgConfig) || existsSync11(macConfig) || (() => {
     try {
       execSync2("which ghostty 2>/dev/null");
       return true;
@@ -1726,47 +1959,47 @@ function setupGhostty(home) {
     return;
   }
   const pkgRoot = resolvePackageRoot();
-  const assetPath = path9.join(pkgRoot, "dist", "assets", "ghostty.conf");
-  if (!existsSync9(assetPath)) {
+  const assetPath = path11.join(pkgRoot, "dist", "assets", "ghostty.conf");
+  if (!existsSync11(assetPath)) {
     process.stderr.write("exe-os: ghostty.conf asset not found \u2014 skipping Ghostty setup\n");
     return;
   }
   const configDir = xdgConfig;
-  const configPath = path9.join(configDir, "config");
-  const backupPath = path9.join(configDir, "config.backup");
+  const configPath = path11.join(configDir, "config");
+  const backupPath = path11.join(configDir, "config.backup");
   mkdirSync6(configDir, { recursive: true });
   const START_MARKER = "# \u2500\u2500 exe-os:ghostty-start \u2500\u2500";
   const END_MARKER = "# \u2500\u2500 exe-os:ghostty-end \u2500\u2500";
-  const assetContent = readFileSync8(assetPath, "utf8").trim();
+  const assetContent = readFileSync9(assetPath, "utf8").trim();
   const markedSection = `${START_MARKER}
 ${assetContent}
 ${END_MARKER}`;
-  if (existsSync9(configPath)) {
-    const existing = readFileSync8(configPath, "utf8");
+  if (existsSync11(configPath)) {
+    const existing = readFileSync9(configPath, "utf8");
     if (existing.includes(START_MARKER) && existing.includes(END_MARKER)) {
       const before = existing.slice(0, existing.indexOf(START_MARKER));
       const after = existing.slice(existing.indexOf(END_MARKER) + END_MARKER.length);
-      writeFileSync6(configPath, `${before}${markedSection}${after}`);
+      writeFileSync7(configPath, `${before}${markedSection}${after}`);
     } else if (existing.includes("Exe OS")) {
-      if (!existsSync9(backupPath)) {
+      if (!existsSync11(backupPath)) {
         copyFileSync(configPath, backupPath);
         process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
 `);
       }
-      writeFileSync6(configPath, `${markedSection}
+      writeFileSync7(configPath, `${markedSection}
 `);
     } else {
-      if (!existsSync9(backupPath)) {
+      if (!existsSync11(backupPath)) {
         copyFileSync(configPath, backupPath);
         process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
 `);
       }
-      writeFileSync6(configPath, `${markedSection}
+      writeFileSync7(configPath, `${markedSection}
 
 ${existing}`);
     }
   } else {
-    writeFileSync6(configPath, `${markedSection}
+    writeFileSync7(configPath, `${markedSection}
 `);
   }
   process.stderr.write("exe-os: Ghostty config installed\n");
@@ -1807,8 +2040,8 @@ ${EXE_SECTION_END}`;
 });
 
 // src/bin/exe-new-employee.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync7 } from "fs";
-import path10 from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7 } from "fs";
+import path12 from "path";
 
 // src/lib/session-wrappers.ts
 import {
@@ -2400,18 +2633,21 @@ function isMainModule(importMetaUrl) {
 // src/lib/plan-limits.ts
 init_database();
 init_employees();
-import { readFileSync as readFileSync5, existsSync as existsSync5 } from "fs";
-import path5 from "path";
+import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
+import path7 from "path";
 
 // src/lib/license.ts
 init_config();
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync6, mkdirSync as mkdirSync3 } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
-import path4 from "path";
+import { createRequire as createRequire2 } from "module";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import os4 from "os";
+import path6 from "path";
 import { jwtVerify, importSPKI } from "jose";
-var LICENSE_PATH = path4.join(EXE_AI_DIR, "license.key");
-var CACHE_PATH = path4.join(EXE_AI_DIR, "license-cache.json");
-var DEVICE_ID_PATH = path4.join(EXE_AI_DIR, "device-id");
+var LICENSE_PATH = path6.join(EXE_AI_DIR, "license.key");
+var CACHE_PATH = path6.join(EXE_AI_DIR, "license-cache.json");
+var DEVICE_ID_PATH = path6.join(EXE_AI_DIR, "device-id");
 var API_BASE = "https://askexe.com/cloud";
 var RETRY_DELAY_MS = 500;
 async function fetchRetry(url, init) {
@@ -2444,37 +2680,37 @@ var FREE_LICENSE = {
   memoryLimit: 5e3
 };
 function loadDeviceId() {
-  const deviceJsonPath = path4.join(EXE_AI_DIR, "device.json");
+  const deviceJsonPath = path6.join(EXE_AI_DIR, "device.json");
   try {
-    if (existsSync4(deviceJsonPath)) {
-      const data = JSON.parse(readFileSync4(deviceJsonPath, "utf8"));
+    if (existsSync6(deviceJsonPath)) {
+      const data = JSON.parse(readFileSync5(deviceJsonPath, "utf8"));
       if (data.deviceId) return data.deviceId;
     }
   } catch {
   }
   try {
-    if (existsSync4(DEVICE_ID_PATH)) {
-      const id2 = readFileSync4(DEVICE_ID_PATH, "utf8").trim();
+    if (existsSync6(DEVICE_ID_PATH)) {
+      const id2 = readFileSync5(DEVICE_ID_PATH, "utf8").trim();
       if (id2) return id2;
     }
   } catch {
   }
   const id = randomUUID2();
-  mkdirSync2(EXE_AI_DIR, { recursive: true });
-  writeFileSync3(DEVICE_ID_PATH, id, "utf8");
+  mkdirSync3(EXE_AI_DIR, { recursive: true });
+  writeFileSync4(DEVICE_ID_PATH, id, "utf8");
   return id;
 }
 function loadLicense() {
   try {
-    if (!existsSync4(LICENSE_PATH)) return null;
-    return readFileSync4(LICENSE_PATH, "utf8").trim();
+    if (!existsSync6(LICENSE_PATH)) return null;
+    return readFileSync5(LICENSE_PATH, "utf8").trim();
   } catch {
     return null;
   }
 }
 function saveLicense(apiKey) {
-  mkdirSync2(EXE_AI_DIR, { recursive: true });
-  writeFileSync3(LICENSE_PATH, apiKey.trim(), { encoding: "utf8", mode: 384 });
+  mkdirSync3(EXE_AI_DIR, { recursive: true });
+  writeFileSync4(LICENSE_PATH, apiKey.trim(), { encoding: "utf8", mode: 384 });
 }
 async function verifyLicenseJwt(token) {
   try {
@@ -2500,8 +2736,8 @@ async function verifyLicenseJwt(token) {
 }
 async function getCachedLicense() {
   try {
-    if (!existsSync4(CACHE_PATH)) return null;
-    const raw = JSON.parse(readFileSync4(CACHE_PATH, "utf8"));
+    if (!existsSync6(CACHE_PATH)) return null;
+    const raw = JSON.parse(readFileSync5(CACHE_PATH, "utf8"));
     if (!raw.token || typeof raw.token !== "string") return null;
     return await verifyLicenseJwt(raw.token);
   } catch {
@@ -2510,8 +2746,8 @@ async function getCachedLicense() {
 }
 function readCachedToken() {
   try {
-    if (!existsSync4(CACHE_PATH)) return null;
-    const raw = JSON.parse(readFileSync4(CACHE_PATH, "utf8"));
+    if (!existsSync6(CACHE_PATH)) return null;
+    const raw = JSON.parse(readFileSync5(CACHE_PATH, "utf8"));
     return typeof raw.token === "string" ? raw.token : null;
   } catch {
     return null;
@@ -2545,56 +2781,132 @@ function getRawCachedPlan() {
 }
 function cacheResponse(token) {
   try {
-    writeFileSync3(CACHE_PATH, JSON.stringify({ token }), "utf8");
+    writeFileSync4(CACHE_PATH, JSON.stringify({ token }), "utf8");
   } catch {
   }
 }
-async function validateLicense(apiKey, deviceId) {
-  const did = deviceId ?? loadDeviceId();
+var _prismaPromise = null;
+var _prismaFailed = false;
+function loadPrismaForLicense() {
+  if (_prismaFailed) return null;
+  const dbUrl = process.env.DATABASE_URL;
+  if (!dbUrl) {
+    const exeDbRoot = process.env.EXE_DB_ROOT ?? path6.join(os4.homedir(), "exe-db");
+    if (!existsSync6(path6.join(exeDbRoot, "package.json"))) {
+      _prismaFailed = true;
+      return null;
+    }
+  }
+  if (!_prismaPromise) {
+    _prismaPromise = (async () => {
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL2(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path6.join(os4.homedir(), "exe-db");
+      const req = createRequire2(path6.join(exeDbRoot, "package.json"));
+      const entry = req.resolve("@prisma/client");
+      const mod = await import(pathToFileURL2(entry).href);
+      const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+      if (!Ctor) throw new Error(`No PrismaClient in ${entry}`);
+      return new Ctor();
+    })().catch((err) => {
+      _prismaFailed = true;
+      _prismaPromise = null;
+      throw err;
+    });
+  }
+  return _prismaPromise;
+}
+async function validateViaPostgres(apiKey) {
+  const loader = loadPrismaForLicense();
+  if (!loader) return null;
+  try {
+    const prisma = await loader;
+    const rows = await prisma.$queryRawUnsafe(
+      `SELECT plan, email, status, device_limit, employee_limit, memory_limit, expires_at
+       FROM billing.licenses WHERE key = $1 LIMIT 1`,
+      apiKey
+    );
+    if (!rows || rows.length === 0) return null;
+    const row = rows[0];
+    if (row.status !== "active") return null;
+    if (row.expires_at && new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
+    const plan = row.plan;
+    const limits = PLAN_LIMITS[plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: true,
+      plan,
+      email: row.email,
+      expiresAt: row.expires_at ? new Date(row.expires_at).toISOString() : null,
+      deviceLimit: row.device_limit ?? limits.devices,
+      employeeLimit: row.employee_limit ?? limits.employees,
+      memoryLimit: row.memory_limit ?? limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+async function validateViaCFWorker(apiKey, deviceId) {
   try {
     const res = await fetchRetry(`${API_BASE}/auth/activate`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ apiKey, deviceId: did }),
+      body: JSON.stringify({ apiKey, deviceId }),
       signal: AbortSignal.timeout(1e4)
     });
-    if (res.ok) {
-      const data = await res.json();
-      if (data.error === "device_limit_exceeded") {
-        const cached2 = await getCachedLicense();
-        if (cached2) return cached2;
-        const raw2 = getRawCachedPlan();
-        if (raw2) return { ...raw2, valid: false };
-        return { ...FREE_LICENSE, valid: false, plan: "free" };
-      }
-      if (data.token) {
-        cacheResponse(data.token);
-        const verified = await verifyLicenseJwt(data.token);
-        if (verified) return verified;
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (data.error === "device_limit_exceeded") return null;
+    if (!data.valid) return null;
+    if (data.token) {
+      cacheResponse(data.token);
+      const verified = await verifyLicenseJwt(data.token);
+      if (verified) return verified;
+    }
+    const limits = PLAN_LIMITS[data.plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: data.valid,
+      plan: data.plan,
+      email: data.email,
+      expiresAt: data.expiresAt,
+      deviceLimit: limits.devices,
+      employeeLimit: limits.employees,
+      memoryLimit: limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+async function validateLicense(apiKey, deviceId) {
+  const did = deviceId ?? loadDeviceId();
+  const pgResult = await validateViaPostgres(apiKey);
+  if (pgResult) {
+    try {
+      writeFileSync4(CACHE_PATH, JSON.stringify({ pgLicense: pgResult, ts: Date.now() }), "utf8");
+    } catch {
+    }
+    return pgResult;
+  }
+  const cfResult = await validateViaCFWorker(apiKey, did);
+  if (cfResult) return cfResult;
+  const cached = await getCachedLicense();
+  if (cached) return cached;
+  try {
+    if (existsSync6(CACHE_PATH)) {
+      const raw = JSON.parse(readFileSync5(CACHE_PATH, "utf8"));
+      if (raw.pgLicense && raw.ts && Date.now() - raw.ts < 7 * 24 * 60 * 60 * 1e3) {
+        return raw.pgLicense;
       }
-      const limits = PLAN_LIMITS[data.plan] ?? PLAN_LIMITS.free;
-      return {
-        valid: data.valid,
-        plan: data.plan,
-        email: data.email,
-        expiresAt: data.expiresAt,
-        deviceLimit: limits.devices,
-        employeeLimit: limits.employees,
-        memoryLimit: limits.memories
-      };
     }
-    const cached = await getCachedLicense();
-    if (cached) return cached;
-    const raw = getRawCachedPlan();
-    if (raw) return raw;
-    return { ...FREE_LICENSE, valid: false, plan: "free" };
   } catch {
-    const cached = await getCachedLicense();
-    if (cached) return cached;
-    const rawFallback = getRawCachedPlan();
-    if (rawFallback) return rawFallback;
-    return { ...FREE_LICENSE, valid: false, error: "offline" };
   }
+  const rawFallback = getRawCachedPlan();
+  if (rawFallback) return rawFallback;
+  return { ...FREE_LICENSE, valid: false };
 }
 var CACHE_MAX_AGE_MS = 36e5;
 function getCacheAgeMs() {
@@ -2610,9 +2922,9 @@ async function checkLicense() {
   let key = loadLicense();
   if (!key) {
     try {
-      const configPath = path4.join(EXE_AI_DIR, "config.json");
-      if (existsSync4(configPath)) {
-        const raw = JSON.parse(readFileSync4(configPath, "utf8"));
+      const configPath = path6.join(EXE_AI_DIR, "config.json");
+      if (existsSync6(configPath)) {
+        const raw = JSON.parse(readFileSync5(configPath, "utf8"));
         const cloud = raw.cloud;
         if (cloud?.apiKey) {
           key = cloud.apiKey;
@@ -2637,7 +2949,7 @@ var PlanLimitError = class extends Error {
     this.name = "PlanLimitError";
   }
 };
-var CACHE_PATH2 = path5.join(EXE_AI_DIR, "license-cache.json");
+var CACHE_PATH2 = path7.join(EXE_AI_DIR, "license-cache.json");
 async function assertEmployeeLimit(license, rosterPath) {
   const lic = license ?? await checkLicense();
   if (lic.employeeLimit < 0) return;
@@ -2671,7 +2983,6 @@ async function main() {
     console.error(`Invalid name: ${validation.error}`);
     process.exit(1);
   }
-  const employees = await loadEmployees();
   let newEmployee;
   const effectiveTemplate = templateName ?? name;
   const template = getTemplate(effectiveTemplate);
@@ -2709,14 +3020,12 @@ async function main() {
     }
     throw err;
   }
-  let updated;
   try {
-    updated = addEmployee(employees, newEmployee);
+    await hireEmployee(newEmployee);
   } catch (err) {
     console.error(err instanceof Error ? err.message : String(err));
     process.exit(1);
   }
-  await saveEmployees(updated);
   try {
     const { getTemplate: getIdentityTemplate } = await Promise.resolve().then(() => (init_identity_templates(), identity_templates_exports));
     const { identityPath: identityPath2 } = await Promise.resolve().then(() => (init_identity(), identity_exports));
@@ -2733,7 +3042,7 @@ async function main() {
     const identityTemplate = templateKey ? getIdentityTemplate(templateKey) : null;
     if (identityTemplate) {
       const idPath = identityPath2(name);
-      const dir = path10.dirname(idPath);
+      const dir = path12.dirname(idPath);
       if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
       const content = identityTemplate.replace(/^agent_id: \w+/m, `agent_id: ${name}`);
       fs.writeFileSync(idPath, content, "utf-8");
@@ -2741,8 +3050,8 @@ async function main() {
     }
   } catch {
   }
-  const taskDir = path10.join(process.cwd(), "exe", name);
-  if (!existsSync10(taskDir)) {
+  const taskDir = path12.join(process.cwd(), "exe", name);
+  if (!existsSync12(taskDir)) {
     mkdirSync7(taskDir, { recursive: true });
   }
   const bins = registerBinSymlinks(newEmployee.name);