@askexenow/exe-os 0.9.7 → 0.9.9

package/dist/bin/setup.js

@@ -15,6 +15,44 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/lib/secure-files.ts
+import { chmodSync, existsSync, mkdirSync } from "fs";
+import { chmod, mkdir } from "fs/promises";
+async function ensurePrivateDir(dirPath) {
+  await mkdir(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    await chmod(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+function ensurePrivateDirSync(dirPath) {
+  mkdirSync(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    chmodSync(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+async function enforcePrivateFile(filePath) {
+  try {
+    await chmod(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+function enforcePrivateFileSync(filePath) {
+  try {
+    if (existsSync(filePath)) chmodSync(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+var PRIVATE_DIR_MODE, PRIVATE_FILE_MODE;
+var init_secure_files = __esm({
+  "src/lib/secure-files.ts"() {
+    "use strict";
+    PRIVATE_DIR_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+  }
+});
+
 // src/lib/config.ts
 var config_exports = {};
 __export(config_exports, {
@@ -31,8 +69,8 @@ __export(config_exports, {
   migrateConfig: () => migrateConfig,
   saveConfig: () => saveConfig
 });
-import { readFile, writeFile, mkdir, chmod } from "fs/promises";
-import { readFileSync, existsSync, renameSync } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
 import path from "path";
 import os from "os";
 function resolveDataDir() {
@@ -40,7 +78,7 @@ function resolveDataDir() {
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
   const newDir = path.join(os.homedir(), ".exe-os");
   const legacyDir = path.join(os.homedir(), ".exe-mem");
-  if (!existsSync(newDir) && existsSync(legacyDir)) {
+  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
       process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
@@ -103,9 +141,9 @@ function normalizeAutoUpdate(raw) {
 }
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path.join(dir, "config.json");
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
   }
   const raw = await readFile(configPath, "utf-8");
@@ -118,6 +156,7 @@ async function loadConfig() {
 `);
       try {
         await writeFile(configPath, JSON.stringify(migratedCfg, null, 2) + "\n");
+        await enforcePrivateFile(configPath);
       } catch {
       }
     }
@@ -136,7 +175,7 @@ async function loadConfig() {
 function loadConfigSync() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
   const configPath = path.join(dir, "config.json");
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
   }
   try {
@@ -154,12 +193,10 @@ function loadConfigSync() {
 }
 async function saveConfig(config) {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path.join(dir, "config.json");
   await writeFile(configPath, JSON.stringify(config, null, 2) + "\n");
-  if (config.cloud?.apiKey) {
-    await chmod(configPath, 384);
-  }
+  await enforcePrivateFile(configPath);
 }
 async function loadConfigFrom(configPath) {
   const raw = await readFile(configPath, "utf-8");
@@ -179,6 +216,7 @@ var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CON
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
+    init_secure_files();
     EXE_AI_DIR = resolveDataDir();
     DB_PATH = path.join(EXE_AI_DIR, "memories.db");
     MODELS_DIR = path.join(EXE_AI_DIR, "models");
@@ -265,7 +303,7 @@ __export(keychain_exports, {
   setMasterKey: () => setMasterKey
 });
 import { readFile as readFile2, writeFile as writeFile2, unlink, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import path2 from "path";
 import os2 from "os";
 function getKeyDir() {
@@ -293,7 +331,7 @@ async function getMasterKey() {
     }
   }
   const keyPath = getKeyPath();
-  if (!existsSync2(keyPath)) {
+  if (!existsSync3(keyPath)) {
     process.stderr.write(
       `[keychain] Key not found at ${keyPath} (HOME=${os2.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
 `
@@ -336,7 +374,7 @@ async function deleteMasterKey() {
     }
   }
   const keyPath = getKeyPath();
-  if (existsSync2(keyPath)) {
+  if (existsSync3(keyPath)) {
     await unlink(keyPath);
   }
 }
@@ -387,13 +425,50 @@ var init_memory = __esm({
   }
 });
 
+// src/lib/daemon-auth.ts
+import crypto from "crypto";
+import path4 from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync2, writeFileSync } from "fs";
+function normalizeToken(token) {
+  if (!token) return null;
+  const trimmed = token.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function readDaemonToken() {
+  try {
+    if (!existsSync5(DAEMON_TOKEN_PATH)) return null;
+    return normalizeToken(readFileSync2(DAEMON_TOKEN_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function ensureDaemonToken(seed) {
+  const existing = readDaemonToken();
+  if (existing) return existing;
+  const token = normalizeToken(seed) ?? crypto.randomBytes(32).toString("hex");
+  ensurePrivateDirSync(EXE_AI_DIR);
+  writeFileSync(DAEMON_TOKEN_PATH, `${token}
+`, "utf8");
+  enforcePrivateFileSync(DAEMON_TOKEN_PATH);
+  return token;
+}
+var DAEMON_TOKEN_PATH;
+var init_daemon_auth = __esm({
+  "src/lib/daemon-auth.ts"() {
+    "use strict";
+    init_config();
+    init_secure_files();
+    DAEMON_TOKEN_PATH = path4.join(EXE_AI_DIR, "exed.token");
+  }
+});
+
 // src/lib/exe-daemon-client.ts
 import net from "net";
 import os3 from "os";
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync4, unlinkSync as unlinkSync2, readFileSync as readFileSync2, openSync, closeSync, statSync } from "fs";
-import path4 from "path";
+import { existsSync as existsSync6, unlinkSync as unlinkSync2, readFileSync as readFileSync3, openSync, closeSync, statSync } from "fs";
+import path5 from "path";
 import { fileURLToPath } from "url";
 function handleData(chunk) {
   _buffer += chunk.toString();
@@ -421,9 +496,9 @@ function handleData(chunk) {
   }
 }
 function cleanupStaleFiles() {
-  if (existsSync4(PID_PATH)) {
+  if (existsSync6(PID_PATH)) {
     try {
-      const pid = parseInt(readFileSync2(PID_PATH, "utf8").trim(), 10);
+      const pid = parseInt(readFileSync3(PID_PATH, "utf8").trim(), 10);
       if (pid > 0) {
         try {
           process.kill(pid, 0);
@@ -444,11 +519,11 @@ function cleanupStaleFiles() {
   }
 }
 function findPackageRoot() {
-  let dir = path4.dirname(fileURLToPath(import.meta.url));
-  const { root } = path4.parse(dir);
+  let dir = path5.dirname(fileURLToPath(import.meta.url));
+  const { root } = path5.parse(dir);
   while (dir !== root) {
-    if (existsSync4(path4.join(dir, "package.json"))) return dir;
-    dir = path4.dirname(dir);
+    if (existsSync6(path5.join(dir, "package.json"))) return dir;
+    dir = path5.dirname(dir);
   }
   return null;
 }
@@ -474,16 +549,17 @@ function spawnDaemon() {
     process.stderr.write("[exed-client] WARN: cannot find package root\n");
     return;
   }
-  const daemonPath = path4.join(pkgRoot, "dist", "lib", "exe-daemon.js");
-  if (!existsSync4(daemonPath)) {
+  const daemonPath = path5.join(pkgRoot, "dist", "lib", "exe-daemon.js");
+  if (!existsSync6(daemonPath)) {
     process.stderr.write(`[exed-client] WARN: daemon script not found at ${daemonPath}
 `);
     return;
   }
   const resolvedPath = daemonPath;
+  const daemonToken = ensureDaemonToken(process.env[DAEMON_TOKEN_ENV] ?? null);
   process.stderr.write(`[exed-client] Spawning daemon: ${resolvedPath}
 `);
-  const logPath = path4.join(path4.dirname(SOCKET_PATH), "exed.log");
+  const logPath = path5.join(path5.dirname(SOCKET_PATH), "exed.log");
   let stderrFd = "ignore";
   try {
     stderrFd = openSync(logPath, "a");
@@ -501,7 +577,8 @@ function spawnDaemon() {
       TMUX_PANE: void 0,
       // Prevents resolveExeSession() from scoping to one session
       EXE_DAEMON_SOCK: SOCKET_PATH,
-      EXE_DAEMON_PID: PID_PATH
+      EXE_DAEMON_PID: PID_PATH,
+      [DAEMON_TOKEN_ENV]: daemonToken
     }
   });
   child.unref();
@@ -611,13 +688,14 @@ function sendDaemonRequest(payload, timeoutMs = REQUEST_TIMEOUT_MS) {
       return;
     }
     const id = randomUUID();
+    const token = process.env[DAEMON_TOKEN_ENV] ?? readDaemonToken();
     const timer = setTimeout(() => {
       _pending.delete(id);
       resolve({ error: "Request timeout" });
     }, timeoutMs);
     _pending.set(id, { resolve, timer });
     try {
-      _socket.write(JSON.stringify({ id, ...payload }) + "\n");
+      _socket.write(JSON.stringify({ id, token, ...payload }) + "\n");
     } catch {
       clearTimeout(timer);
       _pending.delete(id);
@@ -634,74 +712,123 @@ async function pingDaemon() {
   return null;
 }
 function killAndRespawnDaemon() {
-  process.stderr.write("[exed-client] Killing daemon for restart...\n");
-  if (existsSync4(PID_PATH)) {
-    try {
-      const pid = parseInt(readFileSync2(PID_PATH, "utf8").trim(), 10);
-      if (pid > 0) {
-        try {
-          process.kill(pid, "SIGKILL");
-        } catch {
+  if (!acquireSpawnLock()) {
+    process.stderr.write("[exed-client] Another process is already restarting daemon \u2014 skipping\n");
+    if (_socket) {
+      _socket.destroy();
+      _socket = null;
+    }
+    _connected = false;
+    _buffer = "";
+    return;
+  }
+  try {
+    process.stderr.write("[exed-client] Killing daemon for restart...\n");
+    if (existsSync6(PID_PATH)) {
+      try {
+        const pid = parseInt(readFileSync3(PID_PATH, "utf8").trim(), 10);
+        if (pid > 0) {
+          try {
+            process.kill(pid, "SIGKILL");
+          } catch {
+          }
         }
+      } catch {
       }
+    }
+    if (_socket) {
+      _socket.destroy();
+      _socket = null;
+    }
+    _connected = false;
+    _buffer = "";
+    try {
+      unlinkSync2(PID_PATH);
     } catch {
     }
+    try {
+      unlinkSync2(SOCKET_PATH);
+    } catch {
+    }
+    spawnDaemon();
+  } finally {
+    releaseSpawnLock();
   }
-  if (_socket) {
-    _socket.destroy();
-    _socket = null;
-  }
-  _connected = false;
-  _buffer = "";
+}
+function isDaemonTooYoung() {
   try {
-    unlinkSync2(PID_PATH);
+    const stat = statSync(PID_PATH);
+    return Date.now() - stat.mtimeMs < MIN_DAEMON_AGE_MS;
   } catch {
+    return false;
   }
-  try {
-    unlinkSync2(SOCKET_PATH);
-  } catch {
+}
+async function retryThenRestart(doRequest, label) {
+  const result = await doRequest();
+  if (!result.error) {
+    _consecutiveFailures = 0;
+    return result;
+  }
+  _consecutiveFailures++;
+  for (let i = 0; i < MAX_RETRIES_BEFORE_RESTART; i++) {
+    const delayMs = RETRY_DELAYS_MS[i] ?? 5e3;
+    process.stderr.write(`[exed-client] ${label} failed (${result.error}), retry ${i + 1}/${MAX_RETRIES_BEFORE_RESTART} in ${delayMs}ms
+`);
+    await new Promise((r) => setTimeout(r, delayMs));
+    if (!_connected) {
+      if (!await connectToSocket()) continue;
+    }
+    const retry = await doRequest();
+    if (!retry.error) {
+      _consecutiveFailures = 0;
+      return retry;
+    }
+    _consecutiveFailures++;
+  }
+  if (isDaemonTooYoung()) {
+    process.stderr.write(`[exed-client] ${label}: daemon too young (< ${MIN_DAEMON_AGE_MS / 1e3}s) \u2014 skipping restart
+`);
+    return { error: result.error };
   }
-  spawnDaemon();
+  process.stderr.write(`[exed-client] ${label}: ${_consecutiveFailures} consecutive failures \u2014 restarting daemon
+`);
+  killAndRespawnDaemon();
+  const start = Date.now();
+  let delay2 = 200;
+  while (Date.now() - start < CONNECT_TIMEOUT_MS) {
+    await new Promise((r) => setTimeout(r, delay2));
+    if (await connectToSocket()) break;
+    delay2 = Math.min(delay2 * 2, 3e3);
+  }
+  if (!_connected) return { error: "Daemon restart failed" };
+  const final = await doRequest();
+  if (!final.error) _consecutiveFailures = 0;
+  return final;
 }
 async function embedViaClient(text, priority = "high") {
   if (!_connected && !await connectEmbedDaemon()) return null;
   _requestCount++;
   if (_requestCount % HEALTH_CHECK_INTERVAL === 0) {
     const health = await pingDaemon();
-    if (!health) {
+    if (!health && !isDaemonTooYoung()) {
       process.stderr.write(`[exed-client] Periodic health check failed at request ${_requestCount} \u2014 restarting daemon
 `);
       killAndRespawnDaemon();
       const start = Date.now();
-      let delay2 = 200;
+      let d = 200;
       while (Date.now() - start < CONNECT_TIMEOUT_MS) {
-        await new Promise((r) => setTimeout(r, delay2));
+        await new Promise((r) => setTimeout(r, d));
         if (await connectToSocket()) break;
-        delay2 = Math.min(delay2 * 2, 3e3);
+        d = Math.min(d * 2, 3e3);
       }
       if (!_connected) return null;
     }
   }
-  const result = await sendRequest([text], priority);
-  if (!result.error && result.vectors?.[0]) return result.vectors[0];
-  if (result.error) {
-    process.stderr.write(`[exed-client] Embed failed (${result.error}) \u2014 attempting restart
-`);
-    killAndRespawnDaemon();
-    const start = Date.now();
-    let delay2 = 200;
-    while (Date.now() - start < CONNECT_TIMEOUT_MS) {
-      await new Promise((r) => setTimeout(r, delay2));
-      if (await connectToSocket()) break;
-      delay2 = Math.min(delay2 * 2, 3e3);
-    }
-    if (!_connected) return null;
-    const retry = await sendRequest([text], priority);
-    if (!retry.error && retry.vectors?.[0]) return retry.vectors[0];
-    process.stderr.write(`[exed-client] Embed retry also failed: ${retry.error ?? "no vector"}
-`);
-  }
-  return null;
+  const result = await retryThenRestart(
+    () => sendRequest([text], priority),
+    "Embed"
+  );
+  return !result.error && result.vectors?.[0] ? result.vectors[0] : null;
 }
 function disconnectClient() {
   if (_socket) {
@@ -719,22 +846,28 @@ function disconnectClient() {
 function isClientConnected() {
   return _connected;
 }
-var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, _socket, _connected, _buffer, _requestCount, HEALTH_CHECK_INTERVAL, _pending, MAX_BUFFER;
+var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, DAEMON_TOKEN_ENV, _socket, _connected, _buffer, _requestCount, _consecutiveFailures, HEALTH_CHECK_INTERVAL, MAX_RETRIES_BEFORE_RESTART, RETRY_DELAYS_MS, MIN_DAEMON_AGE_MS, _pending, MAX_BUFFER;
 var init_exe_daemon_client = __esm({
   "src/lib/exe-daemon-client.ts"() {
     "use strict";
     init_config();
-    SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path4.join(EXE_AI_DIR, "exed.sock");
-    PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path4.join(EXE_AI_DIR, "exed.pid");
-    SPAWN_LOCK_PATH = path4.join(EXE_AI_DIR, "exed-spawn.lock");
+    init_daemon_auth();
+    SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path5.join(EXE_AI_DIR, "exed.sock");
+    PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path5.join(EXE_AI_DIR, "exed.pid");
+    SPAWN_LOCK_PATH = path5.join(EXE_AI_DIR, "exed-spawn.lock");
     SPAWN_LOCK_STALE_MS = 3e4;
     CONNECT_TIMEOUT_MS = 15e3;
     REQUEST_TIMEOUT_MS = 3e4;
+    DAEMON_TOKEN_ENV = "EXE_DAEMON_TOKEN";
     _socket = null;
     _connected = false;
     _buffer = "";
     _requestCount = 0;
+    _consecutiveFailures = 0;
     HEALTH_CHECK_INTERVAL = 100;
+    MAX_RETRIES_BEFORE_RESTART = 3;
+    RETRY_DELAYS_MS = [1e3, 3e3, 5e3];
+    MIN_DAEMON_AGE_MS = 3e4;
     _pending = /* @__PURE__ */ new Map();
     MAX_BUFFER = 1e7;
   }
@@ -777,10 +910,10 @@ async function disposeEmbedder() {
 async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync13 } = await import("fs");
-  const path13 = await import("path");
-  const modelPath = path13.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync13(modelPath)) {
+  const { existsSync: existsSync16 } = await import("fs");
+  const path16 = await import("path");
+  const modelPath = path16.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync16(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -825,9 +958,12 @@ __export(license_exports, {
   stopLicenseRevalidation: () => stopLicenseRevalidation,
   validateLicense: () => validateLicense
 });
-import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync5, mkdirSync } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync2 } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
-import path5 from "path";
+import { createRequire } from "module";
+import { pathToFileURL } from "url";
+import os4 from "os";
+import path6 from "path";
 import { jwtVerify, importSPKI } from "jose";
 async function fetchRetry(url, init) {
   try {
@@ -838,37 +974,37 @@ async function fetchRetry(url, init) {
   }
 }
 function loadDeviceId() {
-  const deviceJsonPath = path5.join(EXE_AI_DIR, "device.json");
+  const deviceJsonPath = path6.join(EXE_AI_DIR, "device.json");
   try {
-    if (existsSync5(deviceJsonPath)) {
-      const data = JSON.parse(readFileSync3(deviceJsonPath, "utf8"));
+    if (existsSync7(deviceJsonPath)) {
+      const data = JSON.parse(readFileSync4(deviceJsonPath, "utf8"));
       if (data.deviceId) return data.deviceId;
     }
   } catch {
   }
   try {
-    if (existsSync5(DEVICE_ID_PATH)) {
-      const id2 = readFileSync3(DEVICE_ID_PATH, "utf8").trim();
+    if (existsSync7(DEVICE_ID_PATH)) {
+      const id2 = readFileSync4(DEVICE_ID_PATH, "utf8").trim();
       if (id2) return id2;
     }
   } catch {
   }
   const id = randomUUID2();
-  mkdirSync(EXE_AI_DIR, { recursive: true });
-  writeFileSync(DEVICE_ID_PATH, id, "utf8");
+  mkdirSync2(EXE_AI_DIR, { recursive: true });
+  writeFileSync2(DEVICE_ID_PATH, id, "utf8");
   return id;
 }
 function loadLicense() {
   try {
-    if (!existsSync5(LICENSE_PATH)) return null;
-    return readFileSync3(LICENSE_PATH, "utf8").trim();
+    if (!existsSync7(LICENSE_PATH)) return null;
+    return readFileSync4(LICENSE_PATH, "utf8").trim();
   } catch {
     return null;
   }
 }
 function saveLicense(apiKey) {
-  mkdirSync(EXE_AI_DIR, { recursive: true });
-  writeFileSync(LICENSE_PATH, apiKey.trim(), { encoding: "utf8", mode: 384 });
+  mkdirSync2(EXE_AI_DIR, { recursive: true });
+  writeFileSync2(LICENSE_PATH, apiKey.trim(), { encoding: "utf8", mode: 384 });
 }
 async function verifyLicenseJwt(token) {
   try {
@@ -894,8 +1030,8 @@ async function verifyLicenseJwt(token) {
 }
 async function getCachedLicense() {
   try {
-    if (!existsSync5(CACHE_PATH)) return null;
-    const raw = JSON.parse(readFileSync3(CACHE_PATH, "utf8"));
+    if (!existsSync7(CACHE_PATH)) return null;
+    const raw = JSON.parse(readFileSync4(CACHE_PATH, "utf8"));
     if (!raw.token || typeof raw.token !== "string") return null;
     return await verifyLicenseJwt(raw.token);
   } catch {
@@ -904,8 +1040,8 @@ async function getCachedLicense() {
 }
 function readCachedToken() {
   try {
-    if (!existsSync5(CACHE_PATH)) return null;
-    const raw = JSON.parse(readFileSync3(CACHE_PATH, "utf8"));
+    if (!existsSync7(CACHE_PATH)) return null;
+    const raw = JSON.parse(readFileSync4(CACHE_PATH, "utf8"));
     return typeof raw.token === "string" ? raw.token : null;
   } catch {
     return null;
@@ -939,56 +1075,130 @@ function getRawCachedPlan() {
 }
 function cacheResponse(token) {
   try {
-    writeFileSync(CACHE_PATH, JSON.stringify({ token }), "utf8");
+    writeFileSync2(CACHE_PATH, JSON.stringify({ token }), "utf8");
   } catch {
   }
 }
-async function validateLicense(apiKey, deviceId) {
-  const did = deviceId ?? loadDeviceId();
+function loadPrismaForLicense() {
+  if (_prismaFailed) return null;
+  const dbUrl = process.env.DATABASE_URL;
+  if (!dbUrl) {
+    const exeDbRoot = process.env.EXE_DB_ROOT ?? path6.join(os4.homedir(), "exe-db");
+    if (!existsSync7(path6.join(exeDbRoot, "package.json"))) {
+      _prismaFailed = true;
+      return null;
+    }
+  }
+  if (!_prismaPromise) {
+    _prismaPromise = (async () => {
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path6.join(os4.homedir(), "exe-db");
+      const req = createRequire(path6.join(exeDbRoot, "package.json"));
+      const entry = req.resolve("@prisma/client");
+      const mod = await import(pathToFileURL(entry).href);
+      const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+      if (!Ctor) throw new Error(`No PrismaClient in ${entry}`);
+      return new Ctor();
+    })().catch((err) => {
+      _prismaFailed = true;
+      _prismaPromise = null;
+      throw err;
+    });
+  }
+  return _prismaPromise;
+}
+async function validateViaPostgres(apiKey) {
+  const loader = loadPrismaForLicense();
+  if (!loader) return null;
+  try {
+    const prisma = await loader;
+    const rows = await prisma.$queryRawUnsafe(
+      `SELECT plan, email, status, device_limit, employee_limit, memory_limit, expires_at
+       FROM billing.licenses WHERE key = $1 LIMIT 1`,
+      apiKey
+    );
+    if (!rows || rows.length === 0) return null;
+    const row = rows[0];
+    if (row.status !== "active") return null;
+    if (row.expires_at && new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
+    const plan = row.plan;
+    const limits = PLAN_LIMITS[plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: true,
+      plan,
+      email: row.email,
+      expiresAt: row.expires_at ? new Date(row.expires_at).toISOString() : null,
+      deviceLimit: row.device_limit ?? limits.devices,
+      employeeLimit: row.employee_limit ?? limits.employees,
+      memoryLimit: row.memory_limit ?? limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+async function validateViaCFWorker(apiKey, deviceId) {
   try {
     const res = await fetchRetry(`${API_BASE}/auth/activate`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ apiKey, deviceId: did }),
+      body: JSON.stringify({ apiKey, deviceId }),
       signal: AbortSignal.timeout(1e4)
     });
-    if (res.ok) {
-      const data = await res.json();
-      if (data.error === "device_limit_exceeded") {
-        const cached2 = await getCachedLicense();
-        if (cached2) return cached2;
-        const raw2 = getRawCachedPlan();
-        if (raw2) return { ...raw2, valid: false };
-        return { ...FREE_LICENSE, valid: false, plan: "free" };
-      }
-      if (data.token) {
-        cacheResponse(data.token);
-        const verified = await verifyLicenseJwt(data.token);
-        if (verified) return verified;
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (data.error === "device_limit_exceeded") return null;
+    if (!data.valid) return null;
+    if (data.token) {
+      cacheResponse(data.token);
+      const verified = await verifyLicenseJwt(data.token);
+      if (verified) return verified;
+    }
+    const limits = PLAN_LIMITS[data.plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: data.valid,
+      plan: data.plan,
+      email: data.email,
+      expiresAt: data.expiresAt,
+      deviceLimit: limits.devices,
+      employeeLimit: limits.employees,
+      memoryLimit: limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+async function validateLicense(apiKey, deviceId) {
+  const did = deviceId ?? loadDeviceId();
+  const pgResult = await validateViaPostgres(apiKey);
+  if (pgResult) {
+    try {
+      writeFileSync2(CACHE_PATH, JSON.stringify({ pgLicense: pgResult, ts: Date.now() }), "utf8");
+    } catch {
+    }
+    return pgResult;
+  }
+  const cfResult = await validateViaCFWorker(apiKey, did);
+  if (cfResult) return cfResult;
+  const cached = await getCachedLicense();
+  if (cached) return cached;
+  try {
+    if (existsSync7(CACHE_PATH)) {
+      const raw = JSON.parse(readFileSync4(CACHE_PATH, "utf8"));
+      if (raw.pgLicense && raw.ts && Date.now() - raw.ts < 7 * 24 * 60 * 60 * 1e3) {
+        return raw.pgLicense;
       }
-      const limits = PLAN_LIMITS[data.plan] ?? PLAN_LIMITS.free;
-      return {
-        valid: data.valid,
-        plan: data.plan,
-        email: data.email,
-        expiresAt: data.expiresAt,
-        deviceLimit: limits.devices,
-        employeeLimit: limits.employees,
-        memoryLimit: limits.memories
-      };
     }
-    const cached = await getCachedLicense();
-    if (cached) return cached;
-    const raw = getRawCachedPlan();
-    if (raw) return raw;
-    return { ...FREE_LICENSE, valid: false, plan: "free" };
   } catch {
-    const cached = await getCachedLicense();
-    if (cached) return cached;
-    const rawFallback = getRawCachedPlan();
-    if (rawFallback) return rawFallback;
-    return { ...FREE_LICENSE, valid: false, error: "offline" };
   }
+  const rawFallback = getRawCachedPlan();
+  if (rawFallback) return rawFallback;
+  return { ...FREE_LICENSE, valid: false };
 }
 function getCacheAgeMs() {
   try {
@@ -1003,9 +1213,9 @@ async function checkLicense() {
   let key = loadLicense();
   if (!key) {
     try {
-      const configPath = path5.join(EXE_AI_DIR, "config.json");
-      if (existsSync5(configPath)) {
-        const raw = JSON.parse(readFileSync3(configPath, "utf8"));
+      const configPath = path6.join(EXE_AI_DIR, "config.json");
+      if (existsSync7(configPath)) {
+        const raw = JSON.parse(readFileSync4(configPath, "utf8"));
         const cloud = raw.cloud;
         if (cloud?.apiKey) {
           key = cloud.apiKey;
@@ -1159,14 +1369,14 @@ function stopLicenseRevalidation() {
     _revalTimer = null;
   }
 }
-var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, API_BASE, RETRY_DELAY_MS, LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG, PLAN_LIMITS, FREE_LICENSE, CACHE_MAX_AGE_MS, _revalTimer;
+var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, API_BASE, RETRY_DELAY_MS, LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG, PLAN_LIMITS, FREE_LICENSE, _prismaPromise, _prismaFailed, CACHE_MAX_AGE_MS, _revalTimer;
 var init_license = __esm({
   "src/lib/license.ts"() {
     "use strict";
     init_config();
-    LICENSE_PATH = path5.join(EXE_AI_DIR, "license.key");
-    CACHE_PATH = path5.join(EXE_AI_DIR, "license-cache.json");
-    DEVICE_ID_PATH = path5.join(EXE_AI_DIR, "device-id");
+    LICENSE_PATH = path6.join(EXE_AI_DIR, "license.key");
+    CACHE_PATH = path6.join(EXE_AI_DIR, "license-cache.json");
+    DEVICE_ID_PATH = path6.join(EXE_AI_DIR, "device-id");
     API_BASE = "https://askexe.com/cloud";
     RETRY_DELAY_MS = 500;
     LICENSE_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
@@ -1190,6 +1400,8 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
       employeeLimit: 1,
       memoryLimit: 5e3
     };
+    _prismaPromise = null;
+    _prismaFailed = false;
     CACHE_MAX_AGE_MS = 36e5;
     _revalTimer = null;
   }
@@ -1203,13 +1415,13 @@ __export(crypto_exports, {
   initSyncCrypto: () => initSyncCrypto,
   isSyncCryptoInitialized: () => isSyncCryptoInitialized
 });
-import crypto from "crypto";
+import crypto2 from "crypto";
 function initSyncCrypto(masterKey) {
   if (masterKey.length !== 32) {
     throw new Error(`Master key must be 32 bytes, got ${masterKey.length}`);
   }
   _syncKey = Buffer.from(
-    crypto.hkdfSync("sha256", masterKey, "", SYNC_HKDF_INFO, 32)
+    crypto2.hkdfSync("sha256", masterKey, "", SYNC_HKDF_INFO, 32)
   );
 }
 function isSyncCryptoInitialized() {
@@ -1223,8 +1435,8 @@ function requireSyncKey() {
 }
 function encryptSyncBlob(data) {
   const key = requireSyncKey();
-  const iv = crypto.randomBytes(IV_LENGTH);
-  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  const iv = crypto2.randomBytes(IV_LENGTH);
+  const cipher = crypto2.createCipheriv(ALGORITHM, key, iv);
   const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
   const tag = cipher.getAuthTag();
   return Buffer.concat([iv, encrypted, tag]).toString("base64");
@@ -1238,7 +1450,7 @@ function decryptSyncBlob(ciphertext) {
   const iv = combined.subarray(0, IV_LENGTH);
   const tag = combined.subarray(combined.length - TAG_LENGTH);
   const encrypted = combined.subarray(IV_LENGTH, combined.length - TAG_LENGTH);
-  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+  const decipher = crypto2.createDecipheriv(ALGORITHM, key, iv);
   decipher.setAuthTag(tag);
   return Buffer.concat([decipher.update(encrypted), decipher.final()]);
 }
@@ -1309,6 +1521,120 @@ var init_db_retry = __esm({
   }
 });
 
+// src/lib/runtime-table.ts
+var RUNTIME_TABLE, DEFAULT_RUNTIME;
+var init_runtime_table = __esm({
+  "src/lib/runtime-table.ts"() {
+    "use strict";
+    RUNTIME_TABLE = {
+      codex: {
+        binary: "codex",
+        launchMode: "interactive",
+        autoApproveFlag: "--dangerously-bypass-approvals-and-sandbox",
+        inlineFlag: "--no-alt-screen",
+        apiKeyEnv: "OPENAI_API_KEY",
+        defaultModel: "gpt-5.4"
+      },
+      opencode: {
+        binary: "opencode",
+        launchMode: "exec",
+        autoApproveFlag: "--dangerously-skip-permissions",
+        inlineFlag: "",
+        apiKeyEnv: "ANTHROPIC_API_KEY",
+        defaultModel: "anthropic/claude-sonnet-4-6"
+      }
+    };
+    DEFAULT_RUNTIME = "claude";
+  }
+});
+
+// src/lib/agent-config.ts
+var agent_config_exports = {};
+__export(agent_config_exports, {
+  AGENT_CONFIG_PATH: () => AGENT_CONFIG_PATH,
+  DEFAULT_MODELS: () => DEFAULT_MODELS,
+  KNOWN_RUNTIMES: () => KNOWN_RUNTIMES,
+  RUNTIME_LABELS: () => RUNTIME_LABELS,
+  clearAgentRuntime: () => clearAgentRuntime,
+  getAgentRuntime: () => getAgentRuntime,
+  loadAgentConfig: () => loadAgentConfig,
+  saveAgentConfig: () => saveAgentConfig,
+  setAgentRuntime: () => setAgentRuntime
+});
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync8 } from "fs";
+import path7 from "path";
+function loadAgentConfig() {
+  if (!existsSync8(AGENT_CONFIG_PATH)) return {};
+  try {
+    return JSON.parse(readFileSync5(AGENT_CONFIG_PATH, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function saveAgentConfig(config) {
+  const dir = path7.dirname(AGENT_CONFIG_PATH);
+  ensurePrivateDirSync(dir);
+  writeFileSync3(AGENT_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  enforcePrivateFileSync(AGENT_CONFIG_PATH);
+}
+function getAgentRuntime(agentId) {
+  const config = loadAgentConfig();
+  const entry = config[agentId];
+  if (entry) return entry;
+  const orgDefault = config["default"];
+  if (orgDefault) return orgDefault;
+  return { runtime: DEFAULT_RUNTIME, model: DEFAULT_MODELS[DEFAULT_RUNTIME] };
+}
+function setAgentRuntime(agentId, runtime, model) {
+  const knownModels = KNOWN_RUNTIMES[runtime];
+  if (!knownModels) {
+    return {
+      ok: false,
+      error: `Unknown runtime "${runtime}". Valid: ${Object.keys(KNOWN_RUNTIMES).join(", ")}`
+    };
+  }
+  if (!knownModels.includes(model)) {
+    return {
+      ok: false,
+      error: `Unknown model "${model}" for runtime "${runtime}". Valid: ${knownModels.join(", ")}`
+    };
+  }
+  const config = loadAgentConfig();
+  config[agentId] = { runtime, model };
+  saveAgentConfig(config);
+  return { ok: true };
+}
+function clearAgentRuntime(agentId) {
+  const config = loadAgentConfig();
+  delete config[agentId];
+  saveAgentConfig(config);
+}
+var AGENT_CONFIG_PATH, KNOWN_RUNTIMES, RUNTIME_LABELS, DEFAULT_MODELS;
+var init_agent_config = __esm({
+  "src/lib/agent-config.ts"() {
+    "use strict";
+    init_config();
+    init_runtime_table();
+    init_secure_files();
+    AGENT_CONFIG_PATH = path7.join(EXE_AI_DIR, "agent-config.json");
+    KNOWN_RUNTIMES = {
+      claude: ["claude-opus-4", "claude-sonnet-4", "claude-haiku-4.5"],
+      codex: ["gpt-5.4", "gpt-5.5", "gpt-5.3-codex-spark", "o3", "o4-mini"],
+      opencode: ["anthropic/claude-sonnet-4-6", "openai/gpt-5.4", "google/gemini-2.5-pro", "deepseek/deepseek-r3", "minimax/minimax-m2.5"]
+    };
+    RUNTIME_LABELS = {
+      claude: "Claude Code (Anthropic)",
+      codex: "Codex (OpenAI)",
+      opencode: "OpenCode (open source)"
+    };
+    DEFAULT_MODELS = {
+      claude: "claude-opus-4",
+      codex: RUNTIME_TABLE.codex?.defaultModel ?? "gpt-5.4",
+      opencode: RUNTIME_TABLE.opencode?.defaultModel ?? "anthropic/claude-sonnet-4-6"
+    };
+  }
+});
+
 // src/lib/employees.ts
 var employees_exports = {};
 __export(employees_exports, {
@@ -1324,6 +1650,7 @@ __export(employees_exports, {
   getEmployeeByRole: () => getEmployeeByRole,
   getEmployeeNamesByRole: () => getEmployeeNamesByRole,
   hasRole: () => hasRole,
+  hireEmployee: () => hireEmployee,
   isCoordinatorName: () => isCoordinatorName,
   isCoordinatorRole: () => isCoordinatorRole,
   isMultiInstance: () => isMultiInstance,
@@ -1336,10 +1663,10 @@ __export(employees_exports, {
   validateEmployeeName: () => validateEmployeeName
 });
 import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir4 } from "fs/promises";
-import { existsSync as existsSync6, symlinkSync, readlinkSync, readFileSync as readFileSync4, renameSync as renameSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync9, symlinkSync, readlinkSync, readFileSync as readFileSync6, renameSync as renameSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "fs";
 import { execSync } from "child_process";
-import path6 from "path";
-import os4 from "os";
+import path8 from "path";
+import os5 from "os";
 function normalizeRole(role) {
   return (role ?? "").trim().toLowerCase();
 }
@@ -1375,7 +1702,7 @@ function validateEmployeeName(name) {
   return { valid: true };
 }
 async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync6(employeesPath)) {
+  if (!existsSync9(employeesPath)) {
     return [];
   }
   const raw = await readFile3(employeesPath, "utf-8");
@@ -1386,13 +1713,13 @@ async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
   }
 }
 async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
-  await mkdir4(path6.dirname(employeesPath), { recursive: true });
+  await mkdir4(path8.dirname(employeesPath), { recursive: true });
   await writeFile3(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
 }
 function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync6(employeesPath)) return [];
+  if (!existsSync9(employeesPath)) return [];
   try {
-    return JSON.parse(readFileSync4(employeesPath, "utf-8"));
+    return JSON.parse(readFileSync6(employeesPath, "utf-8"));
   } catch {
     return [];
   }
@@ -1434,6 +1761,52 @@ function addEmployee(employees, employee) {
   }
   return [...employees, normalized];
 }
+function appendToCoordinatorTeam(employee) {
+  const coordinator = getCoordinatorEmployee(loadEmployeesSync());
+  if (!coordinator) return;
+  const idPath = path8.join(IDENTITY_DIR, `${coordinator.name}.md`);
+  if (!existsSync9(idPath)) return;
+  const content = readFileSync6(idPath, "utf-8");
+  if (content.includes(`**${capitalize(employee.name)}`)) return;
+  const teamMatch = content.match(TEAM_SECTION_RE);
+  if (!teamMatch || teamMatch.index === void 0) return;
+  const afterTeam = content.slice(teamMatch.index + teamMatch[0].length);
+  const nextHeading = afterTeam.match(/\n## /);
+  const entry = `
+**${capitalize(employee.name)} (${employee.role}):** Newly hired. Update this description as the role develops.
+`;
+  let updated;
+  if (nextHeading && nextHeading.index !== void 0) {
+    const insertAt = teamMatch.index + teamMatch[0].length + nextHeading.index;
+    updated = content.slice(0, insertAt) + entry + content.slice(insertAt);
+  } else {
+    updated = content.trimEnd() + "\n" + entry;
+  }
+  writeFileSync4(idPath, updated, "utf-8");
+}
+function capitalize(s) {
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}
+async function hireEmployee(employee) {
+  const employees = await loadEmployees();
+  const updated = addEmployee(employees, employee);
+  await saveEmployees(updated);
+  try {
+    appendToCoordinatorTeam(employee);
+  } catch {
+  }
+  try {
+    const { loadAgentConfig: loadAgentConfig2, saveAgentConfig: saveAgentConfig2 } = await Promise.resolve().then(() => (init_agent_config(), agent_config_exports));
+    const config = loadAgentConfig2();
+    const name = employee.name.toLowerCase();
+    if (!config[name] && config["default"]) {
+      config[name] = { ...config["default"] };
+      saveAgentConfig2(config);
+    }
+  } catch {
+  }
+  return updated;
+}
 async function normalizeRosterCase(rosterPath) {
   const employees = await loadEmployees(rosterPath);
   let changed = false;
@@ -1443,14 +1816,14 @@ async function normalizeRosterCase(rosterPath) {
       emp.name = emp.name.toLowerCase();
       changed = true;
       try {
-        const identityDir = path6.join(os4.homedir(), ".exe-os", "identity");
-        const oldPath = path6.join(identityDir, `${oldName}.md`);
-        const newPath = path6.join(identityDir, `${emp.name}.md`);
-        if (existsSync6(oldPath) && !existsSync6(newPath)) {
+        const identityDir = path8.join(os5.homedir(), ".exe-os", "identity");
+        const oldPath = path8.join(identityDir, `${oldName}.md`);
+        const newPath = path8.join(identityDir, `${emp.name}.md`);
+        if (existsSync9(oldPath) && !existsSync9(newPath)) {
           renameSync3(oldPath, newPath);
-        } else if (existsSync6(oldPath) && oldPath !== newPath) {
-          const content = readFileSync4(oldPath, "utf-8");
-          writeFileSync2(newPath, content, "utf-8");
+        } else if (existsSync9(oldPath) && oldPath !== newPath) {
+          const content = readFileSync6(oldPath, "utf-8");
+          writeFileSync4(newPath, content, "utf-8");
           if (oldPath.toLowerCase() !== newPath.toLowerCase()) {
             unlinkSync3(oldPath);
           }
@@ -1480,7 +1853,7 @@ function registerBinSymlinks(name) {
     errors.push("Could not find 'exe-os' in PATH");
     return { created, skipped, errors };
   }
-  const binDir = path6.dirname(exeBinPath);
+  const binDir = path8.dirname(exeBinPath);
   let target;
   try {
     target = readlinkSync(exeBinPath);
@@ -1490,8 +1863,8 @@ function registerBinSymlinks(name) {
   }
   for (const suffix of ["", "-opencode"]) {
     const linkName = `${name}${suffix}`;
-    const linkPath = path6.join(binDir, linkName);
-    if (existsSync6(linkPath)) {
+    const linkPath = path8.join(binDir, linkName);
+    if (existsSync9(linkPath)) {
       skipped.push(linkName);
       continue;
     }
@@ -1504,15 +1877,601 @@ function registerBinSymlinks(name) {
   }
   return { created, skipped, errors };
 }
-var EMPLOYEES_PATH, DEFAULT_COORDINATOR_TEMPLATE_NAME, COORDINATOR_ROLE, MULTI_INSTANCE_ROLES;
+var EMPLOYEES_PATH, DEFAULT_COORDINATOR_TEMPLATE_NAME, COORDINATOR_ROLE, MULTI_INSTANCE_ROLES, IDENTITY_DIR, TEAM_SECTION_RE;
 var init_employees = __esm({
   "src/lib/employees.ts"() {
     "use strict";
     init_config();
-    EMPLOYEES_PATH = path6.join(EXE_AI_DIR, "exe-employees.json");
+    EMPLOYEES_PATH = path8.join(EXE_AI_DIR, "exe-employees.json");
     DEFAULT_COORDINATOR_TEMPLATE_NAME = "exe";
     COORDINATOR_ROLE = "COO";
     MULTI_INSTANCE_ROLES = /* @__PURE__ */ new Set(["principal engineer", "content production specialist", "staff code reviewer"]);
+    IDENTITY_DIR = path8.join(EXE_AI_DIR, "identity");
+    TEAM_SECTION_RE = /^## Team\b.*$/m;
+  }
+});
+
+// src/lib/database-adapter.ts
+import os6 from "os";
+import path9 from "path";
+import { createRequire as createRequire2 } from "module";
+import { pathToFileURL as pathToFileURL2 } from "url";
+function quotedIdentifier(identifier) {
+  return `"${identifier.replace(/"/g, '""')}"`;
+}
+function unqualifiedTableName(name) {
+  const raw = name.trim().replace(/^"|"$/g, "");
+  const parts = raw.split(".");
+  return parts[parts.length - 1].replace(/^"|"$/g, "").toLowerCase();
+}
+function stripTrailingSemicolon(sql) {
+  return sql.trim().replace(/;+\s*$/u, "");
+}
+function appendClause(sql, clause) {
+  const trimmed = stripTrailingSemicolon(sql);
+  const returningMatch = /\sRETURNING\b[\s\S]*$/iu.exec(trimmed);
+  if (!returningMatch) {
+    return `${trimmed}${clause}`;
+  }
+  const idx = returningMatch.index;
+  return `${trimmed.slice(0, idx)}${clause}${trimmed.slice(idx)}`;
+}
+function normalizeStatement(stmt) {
+  if (typeof stmt === "string") {
+    return { kind: "positional", sql: stmt, args: [] };
+  }
+  const sql = stmt.sql;
+  if (Array.isArray(stmt.args) || stmt.args === void 0) {
+    return { kind: "positional", sql, args: stmt.args ?? [] };
+  }
+  return { kind: "named", sql, args: stmt.args };
+}
+function rewriteBooleanLiterals(sql) {
+  let out = sql;
+  for (const column of BOOLEAN_COLUMN_NAMES) {
+    const scoped = `((?:\\b[a-z_][a-z0-9_]*\\.)?${column})`;
+    out = out.replace(new RegExp(`${scoped}\\s*=\\s*0\\b`, "giu"), "$1 = FALSE");
+    out = out.replace(new RegExp(`${scoped}\\s*=\\s*1\\b`, "giu"), "$1 = TRUE");
+    out = out.replace(new RegExp(`${scoped}\\s*!=\\s*0\\b`, "giu"), "$1 != FALSE");
+    out = out.replace(new RegExp(`${scoped}\\s*!=\\s*1\\b`, "giu"), "$1 != TRUE");
+    out = out.replace(new RegExp(`${scoped}\\s*<>\\s*0\\b`, "giu"), "$1 <> FALSE");
+    out = out.replace(new RegExp(`${scoped}\\s*<>\\s*1\\b`, "giu"), "$1 <> TRUE");
+  }
+  return out;
+}
+function rewriteInsertOrIgnore(sql) {
+  if (!/^\s*INSERT\s+OR\s+IGNORE\s+INTO\b/iu.test(sql)) {
+    return sql;
+  }
+  const replaced = sql.replace(/^\s*INSERT\s+OR\s+IGNORE\s+INTO\b/iu, "INSERT INTO");
+  return /\bON\s+CONFLICT\b/iu.test(replaced) ? replaced : appendClause(replaced, " ON CONFLICT DO NOTHING");
+}
+function rewriteInsertOrReplace(sql) {
+  const match = /^\s*INSERT\s+OR\s+REPLACE\s+INTO\s+([A-Za-z0-9_."]+)\s*\(([^)]+)\)([\s\S]*)$/iu.exec(sql);
+  if (!match) {
+    return sql;
+  }
+  const rawTable = match[1];
+  const rawColumns = match[2];
+  const remainder = match[3];
+  const tableName = unqualifiedTableName(rawTable);
+  const conflictKeys = UPSERT_KEYS[tableName];
+  if (!conflictKeys?.length) {
+    return sql;
+  }
+  const columns = rawColumns.split(",").map((col) => col.trim().replace(/^"|"$/g, ""));
+  const updateColumns = columns.filter((col) => !conflictKeys.includes(col));
+  const conflictTarget = conflictKeys.map(quotedIdentifier).join(", ");
+  const updateClause = updateColumns.length === 0 ? " DO NOTHING" : ` DO UPDATE SET ${updateColumns.map((col) => `${quotedIdentifier(col)} = EXCLUDED.${quotedIdentifier(col)}`).join(", ")}`;
+  return `INSERT INTO ${rawTable} (${rawColumns})${appendClause(remainder, ` ON CONFLICT (${conflictTarget})${updateClause}`)}`;
+}
+function rewriteSql(sql) {
+  let out = sql;
+  out = out.replace(/\bdatetime\(\s*['"]now['"]\s*\)/giu, "CURRENT_TIMESTAMP");
+  out = out.replace(/\bvector32\s*\(\s*\?\s*\)/giu, "?");
+  out = rewriteBooleanLiterals(out);
+  out = rewriteInsertOrReplace(out);
+  out = rewriteInsertOrIgnore(out);
+  return stripTrailingSemicolon(out);
+}
+function toBoolean(value) {
+  if (value === null || value === void 0) return value;
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") return value !== 0;
+  if (typeof value === "bigint") return value !== 0n;
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "0" || normalized === "false") return false;
+    if (normalized === "1" || normalized === "true") return true;
+  }
+  return Boolean(value);
+}
+function countQuestionMarks(sql, end) {
+  let count = 0;
+  let inSingle = false;
+  let inDouble = false;
+  let inLineComment = false;
+  let inBlockComment = false;
+  for (let i = 0; i < end; i++) {
+    const ch = sql[i];
+    const next = sql[i + 1];
+    if (inLineComment) {
+      if (ch === "\n") inLineComment = false;
+      continue;
+    }
+    if (inBlockComment) {
+      if (ch === "*" && next === "/") {
+        inBlockComment = false;
+        i += 1;
+      }
+      continue;
+    }
+    if (!inSingle && !inDouble && ch === "-" && next === "-") {
+      inLineComment = true;
+      i += 1;
+      continue;
+    }
+    if (!inSingle && !inDouble && ch === "/" && next === "*") {
+      inBlockComment = true;
+      i += 1;
+      continue;
+    }
+    if (!inDouble && ch === "'" && sql[i - 1] !== "\\") {
+      inSingle = !inSingle;
+      continue;
+    }
+    if (!inSingle && ch === '"' && sql[i - 1] !== "\\") {
+      inDouble = !inDouble;
+      continue;
+    }
+    if (!inSingle && !inDouble && ch === "?") {
+      count += 1;
+    }
+  }
+  return count;
+}
+function findBooleanPlaceholderIndexes(sql) {
+  const indexes = /* @__PURE__ */ new Set();
+  for (const column of BOOLEAN_COLUMN_NAMES) {
+    const pattern = new RegExp(`(?:\\b[a-z_][a-z0-9_]*\\.)?${column}\\s*=\\s*\\?`, "giu");
+    for (const match of sql.matchAll(pattern)) {
+      const matchText = match[0];
+      const qIndex = match.index + matchText.lastIndexOf("?");
+      indexes.add(countQuestionMarks(sql, qIndex + 1));
+    }
+  }
+  return indexes;
+}
+function coerceInsertBooleanArgs(sql, args2) {
+  const match = /^\s*INSERT(?:\s+OR\s+(?:IGNORE|REPLACE))?\s+INTO\s+([A-Za-z0-9_."]+)\s*\(([^)]+)\)/iu.exec(sql);
+  if (!match) return;
+  const rawTable = match[1];
+  const rawColumns = match[2];
+  const boolColumns = BOOLEAN_COLUMNS_BY_TABLE[unqualifiedTableName(rawTable)];
+  if (!boolColumns?.size) return;
+  const columns = rawColumns.split(",").map((col) => col.trim().replace(/^"|"$/g, ""));
+  for (const [index, column] of columns.entries()) {
+    if (boolColumns.has(column) && index < args2.length) {
+      args2[index] = toBoolean(args2[index]);
+    }
+  }
+}
+function coerceUpdateBooleanArgs(sql, args2) {
+  const match = /^\s*UPDATE\s+([A-Za-z0-9_."]+)\s+SET\s+([\s\S]+?)(?:\s+WHERE\b|$)/iu.exec(sql);
+  if (!match) return;
+  const rawTable = match[1];
+  const setClause = match[2];
+  const boolColumns = BOOLEAN_COLUMNS_BY_TABLE[unqualifiedTableName(rawTable)];
+  if (!boolColumns?.size) return;
+  const assignments = setClause.split(",");
+  let placeholderIndex = 0;
+  for (const assignment of assignments) {
+    if (!assignment.includes("?")) continue;
+    placeholderIndex += 1;
+    const colMatch = /^\s*(?:[A-Za-z_][A-Za-z0-9_]*\.)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*\?/iu.exec(assignment);
+    if (colMatch && boolColumns.has(colMatch[1])) {
+      args2[placeholderIndex - 1] = toBoolean(args2[placeholderIndex - 1]);
+    }
+  }
+}
+function coerceBooleanArgs(sql, args2) {
+  const nextArgs = [...args2];
+  coerceInsertBooleanArgs(sql, nextArgs);
+  coerceUpdateBooleanArgs(sql, nextArgs);
+  const placeholderIndexes = findBooleanPlaceholderIndexes(sql);
+  for (const index of placeholderIndexes) {
+    if (index > 0 && index <= nextArgs.length) {
+      nextArgs[index - 1] = toBoolean(nextArgs[index - 1]);
+    }
+  }
+  return nextArgs;
+}
+function convertQuestionMarksToDollarParams(sql) {
+  let out = "";
+  let placeholder = 0;
+  let inSingle = false;
+  let inDouble = false;
+  let inLineComment = false;
+  let inBlockComment = false;
+  for (let i = 0; i < sql.length; i++) {
+    const ch = sql[i];
+    const next = sql[i + 1];
+    if (inLineComment) {
+      out += ch;
+      if (ch === "\n") inLineComment = false;
+      continue;
+    }
+    if (inBlockComment) {
+      out += ch;
+      if (ch === "*" && next === "/") {
+        out += next;
+        inBlockComment = false;
+        i += 1;
+      }
+      continue;
+    }
+    if (!inSingle && !inDouble && ch === "-" && next === "-") {
+      out += ch + next;
+      inLineComment = true;
+      i += 1;
+      continue;
+    }
+    if (!inSingle && !inDouble && ch === "/" && next === "*") {
+      out += ch + next;
+      inBlockComment = true;
+      i += 1;
+      continue;
+    }
+    if (!inDouble && ch === "'" && sql[i - 1] !== "\\") {
+      inSingle = !inSingle;
+      out += ch;
+      continue;
+    }
+    if (!inSingle && ch === '"' && sql[i - 1] !== "\\") {
+      inDouble = !inDouble;
+      out += ch;
+      continue;
+    }
+    if (!inSingle && !inDouble && ch === "?") {
+      placeholder += 1;
+      out += `$${placeholder}`;
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+function translateStatementForPostgres(stmt) {
+  const normalized = normalizeStatement(stmt);
+  if (normalized.kind === "named") {
+    throw new Error("Named SQL parameters are not supported by the Prisma adapter.");
+  }
+  const rewrittenSql = rewriteSql(normalized.sql);
+  const coercedArgs = coerceBooleanArgs(rewrittenSql, normalized.args);
+  return {
+    sql: convertQuestionMarksToDollarParams(rewrittenSql),
+    args: coercedArgs
+  };
+}
+function shouldBypassPostgres(stmt) {
+  const normalized = normalizeStatement(stmt);
+  if (normalized.kind === "named") {
+    return true;
+  }
+  return IMMEDIATE_FALLBACK_PATTERNS.some((pattern) => pattern.test(normalized.sql));
+}
+function shouldFallbackOnError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /42P01|42883|42601|does not exist|syntax error|not supported|Named SQL parameters are not supported/iu.test(message);
+}
+function isReadQuery(sql) {
+  const trimmed = sql.trimStart();
+  return /^(SELECT|WITH|SHOW|EXPLAIN|VALUES)\b/iu.test(trimmed) || /\bRETURNING\b/iu.test(trimmed);
+}
+function buildRow(row, columns) {
+  const values = columns.map((column) => row[column]);
+  return Object.assign(values, row);
+}
+function buildResultSet(rows, rowsAffected = 0) {
+  const columns = rows[0] ? Object.keys(rows[0]) : [];
+  const resultRows = rows.map((row) => buildRow(row, columns));
+  return {
+    columns,
+    columnTypes: columns.map(() => ""),
+    rows: resultRows,
+    rowsAffected,
+    lastInsertRowid: void 0,
+    toJSON() {
+      return {
+        columns,
+        columnTypes: columns.map(() => ""),
+        rows,
+        rowsAffected,
+        lastInsertRowid: void 0
+      };
+    }
+  };
+}
+async function loadPrismaClient() {
+  if (!prismaClientPromise) {
+    prismaClientPromise = (async () => {
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const module2 = await import(pathToFileURL2(explicitPath).href);
+        const PrismaClient2 = module2.PrismaClient ?? module2.default?.PrismaClient;
+        if (!PrismaClient2) {
+          throw new Error(`No PrismaClient export found at ${explicitPath}`);
+        }
+        return new PrismaClient2();
+      }
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path9.join(os6.homedir(), "exe-db");
+      const requireFromExeDb = createRequire2(path9.join(exeDbRoot, "package.json"));
+      const prismaEntry = requireFromExeDb.resolve("@prisma/client");
+      const module = await import(pathToFileURL2(prismaEntry).href);
+      const PrismaClient = module.PrismaClient ?? module.default?.PrismaClient;
+      if (!PrismaClient) {
+        throw new Error(`No PrismaClient export found in ${prismaEntry}`);
+      }
+      return new PrismaClient();
+    })();
+  }
+  return prismaClientPromise;
+}
+async function ensureCompatibilityViews(prisma) {
+  if (!compatibilityBootstrapPromise) {
+    compatibilityBootstrapPromise = (async () => {
+      for (const mapping of VIEW_MAPPINGS) {
+        const relation = mapping.source.replace(/"/g, "");
+        const rows = await prisma.$queryRawUnsafe(
+          "SELECT to_regclass($1) AS regclass",
+          relation
+        );
+        if (!rows[0]?.regclass) {
+          continue;
+        }
+        await prisma.$executeRawUnsafe(
+          `CREATE OR REPLACE VIEW public.${quotedIdentifier(mapping.view)} AS SELECT * FROM ${mapping.source}`
+        );
+      }
+    })();
+  }
+  return compatibilityBootstrapPromise;
+}
+async function executeOnPrisma(executor, stmt) {
+  const translated = translateStatementForPostgres(stmt);
+  if (isReadQuery(translated.sql)) {
+    const rows = await executor.$queryRawUnsafe(
+      translated.sql,
+      ...translated.args
+    );
+    return buildResultSet(rows, /\bRETURNING\b/iu.test(translated.sql) ? rows.length : 0);
+  }
+  const rowsAffected = await executor.$executeRawUnsafe(translated.sql, ...translated.args);
+  return buildResultSet([], rowsAffected);
+}
+function splitSqlStatements(sql) {
+  const parts = [];
+  let current = "";
+  let inSingle = false;
+  let inDouble = false;
+  let inLineComment = false;
+  let inBlockComment = false;
+  for (let i = 0; i < sql.length; i++) {
+    const ch = sql[i];
+    const next = sql[i + 1];
+    if (inLineComment) {
+      current += ch;
+      if (ch === "\n") inLineComment = false;
+      continue;
+    }
+    if (inBlockComment) {
+      current += ch;
+      if (ch === "*" && next === "/") {
+        current += next;
+        inBlockComment = false;
+        i += 1;
+      }
+      continue;
+    }
+    if (!inSingle && !inDouble && ch === "-" && next === "-") {
+      current += ch + next;
+      inLineComment = true;
+      i += 1;
+      continue;
+    }
+    if (!inSingle && !inDouble && ch === "/" && next === "*") {
+      current += ch + next;
+      inBlockComment = true;
+      i += 1;
+      continue;
+    }
+    if (!inDouble && ch === "'" && sql[i - 1] !== "\\") {
+      inSingle = !inSingle;
+      current += ch;
+      continue;
+    }
+    if (!inSingle && ch === '"' && sql[i - 1] !== "\\") {
+      inDouble = !inDouble;
+      current += ch;
+      continue;
+    }
+    if (!inSingle && !inDouble && ch === ";") {
+      if (current.trim()) {
+        parts.push(current.trim());
+      }
+      current = "";
+      continue;
+    }
+    current += ch;
+  }
+  if (current.trim()) {
+    parts.push(current.trim());
+  }
+  return parts;
+}
+async function createPrismaDbAdapter(fallbackClient) {
+  const prisma = await loadPrismaClient();
+  await ensureCompatibilityViews(prisma);
+  let closed = false;
+  let adapter;
+  const fallbackExecute = async (stmt, error) => {
+    if (!fallbackClient) {
+      if (error) throw error;
+      throw new Error("No fallback SQLite client is available for this Prisma-routed query.");
+    }
+    if (error) {
+      process.stderr.write(
+        `[database-adapter] Falling back to SQLite: ${error instanceof Error ? error.message : String(error)}
+`
+      );
+    }
+    return fallbackClient.execute(stmt);
+  };
+  adapter = {
+    async execute(stmt) {
+      if (shouldBypassPostgres(stmt)) {
+        return fallbackExecute(stmt);
+      }
+      try {
+        return await executeOnPrisma(prisma, stmt);
+      } catch (error) {
+        if (shouldFallbackOnError(error)) {
+          return fallbackExecute(stmt, error);
+        }
+        throw error;
+      }
+    },
+    async batch(stmts, mode) {
+      if (stmts.some((stmt) => shouldBypassPostgres(stmt))) {
+        if (!fallbackClient) {
+          throw new Error("Cannot batch unsupported SQLite-only statements without a fallback client.");
+        }
+        return fallbackClient.batch(stmts, mode);
+      }
+      try {
+        if (prisma.$transaction) {
+          return await prisma.$transaction(async (tx) => {
+            const results2 = [];
+            for (const stmt of stmts) {
+              results2.push(await executeOnPrisma(tx, stmt));
+            }
+            return results2;
+          });
+        }
+        const results = [];
+        for (const stmt of stmts) {
+          results.push(await executeOnPrisma(prisma, stmt));
+        }
+        return results;
+      } catch (error) {
+        if (fallbackClient && shouldFallbackOnError(error)) {
+          process.stderr.write(
+            `[database-adapter] Falling back batch to SQLite: ${error instanceof Error ? error.message : String(error)}
+`
+          );
+          return fallbackClient.batch(stmts, mode);
+        }
+        throw error;
+      }
+    },
+    async migrate(stmts) {
+      if (fallbackClient) {
+        return fallbackClient.migrate(stmts);
+      }
+      return adapter.batch(stmts, "deferred");
+    },
+    async transaction(mode) {
+      if (!fallbackClient) {
+        throw new Error("Interactive transactions are only supported on the SQLite fallback client.");
+      }
+      return fallbackClient.transaction(mode);
+    },
+    async executeMultiple(sql) {
+      if (fallbackClient && shouldBypassPostgres(sql)) {
+        return fallbackClient.executeMultiple(sql);
+      }
+      for (const statement of splitSqlStatements(sql)) {
+        await adapter.execute(statement);
+      }
+    },
+    async sync() {
+      if (fallbackClient) {
+        return fallbackClient.sync();
+      }
+      return { frame_no: 0, frames_synced: 0 };
+    },
+    close() {
+      closed = true;
+      prismaClientPromise = null;
+      compatibilityBootstrapPromise = null;
+      void prisma.$disconnect?.();
+    },
+    get closed() {
+      return closed;
+    },
+    get protocol() {
+      return "prisma-postgres";
+    }
+  };
+  return adapter;
+}
+var VIEW_MAPPINGS, UPSERT_KEYS, BOOLEAN_COLUMNS_BY_TABLE, BOOLEAN_COLUMN_NAMES, IMMEDIATE_FALLBACK_PATTERNS, prismaClientPromise, compatibilityBootstrapPromise;
+var init_database_adapter = __esm({
+  "src/lib/database-adapter.ts"() {
+    "use strict";
+    VIEW_MAPPINGS = [
+      { view: "memories", source: "memory.memory_records" },
+      { view: "tasks", source: "memory.tasks" },
+      { view: "behaviors", source: "memory.behaviors" },
+      { view: "entities", source: "memory.entities" },
+      { view: "relationships", source: "memory.relationships" },
+      { view: "entity_memories", source: "memory.entity_memories" },
+      { view: "entity_aliases", source: "memory.entity_aliases" },
+      { view: "notifications", source: "memory.notifications" },
+      { view: "messages", source: "memory.messages" },
+      { view: "users", source: "wiki.users" },
+      { view: "workspaces", source: "wiki.workspaces" },
+      { view: "workspace_users", source: "wiki.workspace_users" },
+      { view: "documents", source: "wiki.workspace_documents" },
+      { view: "chats", source: "wiki.workspace_chats" }
+    ];
+    UPSERT_KEYS = {
+      memories: ["id"],
+      tasks: ["id"],
+      behaviors: ["id"],
+      entities: ["id"],
+      relationships: ["id"],
+      entity_aliases: ["alias"],
+      notifications: ["id"],
+      messages: ["id"],
+      users: ["id"],
+      workspaces: ["id"],
+      workspace_users: ["id"],
+      documents: ["id"],
+      chats: ["id"]
+    };
+    BOOLEAN_COLUMNS_BY_TABLE = {
+      memories: /* @__PURE__ */ new Set(["has_error", "draft"]),
+      behaviors: /* @__PURE__ */ new Set(["active"]),
+      notifications: /* @__PURE__ */ new Set(["read"]),
+      users: /* @__PURE__ */ new Set(["has_personal_memory"])
+    };
+    BOOLEAN_COLUMN_NAMES = new Set(
+      Object.values(BOOLEAN_COLUMNS_BY_TABLE).flatMap((cols) => [...cols])
+    );
+    IMMEDIATE_FALLBACK_PATTERNS = [
+      /\bPRAGMA\b/i,
+      /\bsqlite_master\b/i,
+      /(?:^|[.\s])(?:memories|conversations|entities)_fts\b/i,
+      /\bMATCH\b/i,
+      /\bvector_distance_cos\s*\(/i,
+      /\bjson_extract\s*\(/i,
+      /\bjulianday\s*\(/i,
+      /\bstrftime\s*\(/i,
+      /\blast_insert_rowid\s*\(/i
+    ];
+    prismaClientPromise = null;
+    compatibilityBootstrapPromise = null;
   }
 });
 
@@ -1586,7 +2545,7 @@ __export(db_daemon_client_exports, {
   createDaemonDbClient: () => createDaemonDbClient,
   initDaemonDbClient: () => initDaemonDbClient
 });
-function normalizeStatement(stmt) {
+function normalizeStatement2(stmt) {
   if (typeof stmt === "string") {
     return { sql: stmt, args: [] };
   }
@@ -1610,7 +2569,7 @@ function createDaemonDbClient(fallbackClient) {
       if (!_useDaemon || !isClientConnected()) {
         return fallbackClient.execute(stmt);
       }
-      const { sql, args: args2 } = normalizeStatement(stmt);
+      const { sql, args: args2 } = normalizeStatement2(stmt);
       const response = await sendDaemonRequest({
         type: "db-execute",
         sql,
@@ -1635,7 +2594,7 @@ function createDaemonDbClient(fallbackClient) {
       if (!_useDaemon || !isClientConnected()) {
         return fallbackClient.batch(stmts, mode);
       }
-      const statements = stmts.map(normalizeStatement);
+      const statements = stmts.map(normalizeStatement2);
       const response = await sendDaemonRequest({
         type: "db-batch",
         statements,
@@ -1730,6 +2689,18 @@ __export(database_exports, {
 });
 import { createClient } from "@libsql/client";
 async function initDatabase(config) {
+  if (_walCheckpointTimer) {
+    clearInterval(_walCheckpointTimer);
+    _walCheckpointTimer = null;
+  }
+  if (_daemonClient) {
+    _daemonClient.close();
+    _daemonClient = null;
+  }
+  if (_adapterClient && _adapterClient !== _resilientClient) {
+    _adapterClient.close();
+  }
+  _adapterClient = null;
   if (_client) {
     _client.close();
     _client = null;
@@ -1743,6 +2714,7 @@ async function initDatabase(config) {
   }
   _client = createClient(opts);
   _resilientClient = wrapWithRetry(_client);
+  _adapterClient = _resilientClient;
   _client.execute("PRAGMA busy_timeout = 30000").catch(() => {
   });
   _client.execute("PRAGMA journal_mode = WAL").catch(() => {
@@ -1753,14 +2725,20 @@ async function initDatabase(config) {
     });
   }, 3e4);
   _walCheckpointTimer.unref();
+  if (process.env.DATABASE_URL) {
+    _adapterClient = await createPrismaDbAdapter(_resilientClient);
+  }
 }
 function isInitialized() {
-  return _client !== null;
+  return _adapterClient !== null || _client !== null;
 }
 function getClient() {
-  if (!_resilientClient) {
+  if (!_adapterClient) {
     throw new Error("Database client not initialized. Call initDatabase() first.");
   }
+  if (process.env.DATABASE_URL) {
+    return _adapterClient;
+  }
   if (process.env.EXE_IS_DAEMON === "1") {
     return _resilientClient;
   }
@@ -1770,6 +2748,7 @@ function getClient() {
   return _resilientClient;
 }
 async function initDaemonClient() {
+  if (process.env.DATABASE_URL) return;
   if (process.env.EXE_IS_DAEMON === "1") return;
   if (!_resilientClient) return;
   try {
@@ -2066,6 +3045,7 @@ async function ensureSchema() {
       project     TEXT NOT NULL,
       summary     TEXT NOT NULL,
       task_file   TEXT,
+      session_scope TEXT,
       read        INTEGER NOT NULL DEFAULT 0,
       created_at  TEXT NOT NULL
     );
@@ -2074,7 +3054,7 @@ async function ensureSchema() {
       ON notifications(read);
 
     CREATE INDEX IF NOT EXISTS idx_notifications_agent
-      ON notifications(agent_id);
+      ON notifications(agent_id, session_scope);
 
     CREATE INDEX IF NOT EXISTS idx_notifications_task_file
       ON notifications(task_file);
@@ -2112,6 +3092,7 @@ async function ensureSchema() {
       target_agent    TEXT NOT NULL,
       target_project  TEXT,
       target_device   TEXT NOT NULL DEFAULT 'local',
+      session_scope   TEXT,
       content         TEXT NOT NULL,
       priority        TEXT DEFAULT 'normal',
       status          TEXT DEFAULT 'pending',
@@ -2125,10 +3106,31 @@ async function ensureSchema() {
     );
 
     CREATE INDEX IF NOT EXISTS idx_messages_target
-      ON messages(target_agent, status);
+      ON messages(target_agent, session_scope, status);
 
     CREATE INDEX IF NOT EXISTS idx_messages_conversation_order
-      ON messages(target_agent, from_agent, server_seq);
+      ON messages(target_agent, session_scope, from_agent, server_seq);
+  `);
+  try {
+    await client.execute({
+      sql: `ALTER TABLE notifications ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE messages ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  await client.executeMultiple(`
+    CREATE INDEX IF NOT EXISTS idx_notifications_agent_scope_read
+      ON notifications(agent_id, session_scope, read, created_at);
+
+    CREATE INDEX IF NOT EXISTS idx_messages_target_scope_status
+      ON messages(target_agent, session_scope, status, created_at);
   `);
   try {
     await client.execute({
@@ -2712,28 +3714,45 @@ async function ensureSchema() {
     } catch {
     }
   }
+  try {
+    await client.execute({
+      sql: `UPDATE tasks SET status = 'closed' WHERE status = 'done' AND result IS NOT NULL`,
+      args: []
+    });
+  } catch {
+  }
 }
 async function disposeDatabase() {
+  if (_walCheckpointTimer) {
+    clearInterval(_walCheckpointTimer);
+    _walCheckpointTimer = null;
+  }
   if (_daemonClient) {
     _daemonClient.close();
     _daemonClient = null;
   }
+  if (_adapterClient && _adapterClient !== _resilientClient) {
+    _adapterClient.close();
+  }
+  _adapterClient = null;
   if (_client) {
     _client.close();
     _client = null;
     _resilientClient = null;
   }
 }
-var _client, _resilientClient, _walCheckpointTimer, _daemonClient, initTurso, disposeTurso;
+var _client, _resilientClient, _walCheckpointTimer, _daemonClient, _adapterClient, initTurso, disposeTurso;
 var init_database = __esm({
   "src/lib/database.ts"() {
     "use strict";
     init_db_retry();
     init_employees();
+    init_database_adapter();
     _client = null;
     _resilientClient = null;
     _walCheckpointTimer = null;
     _daemonClient = null;
+    _adapterClient = null;
     initTurso = initDatabase;
     disposeTurso = disposeDatabase;
   }
@@ -2778,8 +3797,8 @@ __export(crdt_sync_exports, {
   rebuildFromDb: () => rebuildFromDb
 });
 import * as Y from "yjs";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync7, mkdirSync as mkdirSync2, unlinkSync as unlinkSync4 } from "fs";
-import path7 from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync10, mkdirSync as mkdirSync3, unlinkSync as unlinkSync4 } from "fs";
+import path10 from "path";
 import { homedir } from "os";
 function getStatePath() {
   return _statePathOverride ?? DEFAULT_STATE_PATH;
@@ -2791,9 +3810,9 @@ function initCrdtDoc() {
   if (doc) return doc;
   doc = new Y.Doc();
   const sp = getStatePath();
-  if (existsSync7(sp)) {
+  if (existsSync10(sp)) {
     try {
-      const state = readFileSync5(sp);
+      const state = readFileSync7(sp);
       Y.applyUpdate(doc, new Uint8Array(state));
     } catch {
       console.warn("[crdt-sync] WARN: corrupted state file, rebuilding from DB");
@@ -2935,10 +3954,10 @@ function persistState() {
   if (!doc) return;
   try {
     const sp = getStatePath();
-    const dir = path7.dirname(sp);
-    if (!existsSync7(dir)) mkdirSync2(dir, { recursive: true });
+    const dir = path10.dirname(sp);
+    if (!existsSync10(dir)) mkdirSync3(dir, { recursive: true });
     const state = Y.encodeStateAsUpdate(doc);
-    writeFileSync3(sp, Buffer.from(state));
+    writeFileSync5(sp, Buffer.from(state));
   } catch {
   }
 }
@@ -2979,7 +3998,7 @@ var DEFAULT_STATE_PATH, _statePathOverride, doc;
 var init_crdt_sync = __esm({
   "src/lib/crdt-sync.ts"() {
     "use strict";
-    DEFAULT_STATE_PATH = path7.join(homedir(), ".exe-os", "crdt-state.bin");
+    DEFAULT_STATE_PATH = path10.join(homedir(), ".exe-os", "crdt-state.bin");
     _statePathOverride = null;
     doc = null;
   }
@@ -3011,39 +4030,107 @@ __export(cloud_sync_exports, {
   cloudSync: () => cloudSync,
   mergeConfig: () => mergeConfig,
   mergeRosterFromRemote: () => mergeRosterFromRemote,
+  pushToPostgres: () => pushToPostgres,
   recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync8, readdirSync, mkdirSync as mkdirSync3, appendFileSync, unlinkSync as unlinkSync5, openSync as openSync2, closeSync as closeSync2 } from "fs";
-import crypto2 from "crypto";
-import path8 from "path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync11, readdirSync, mkdirSync as mkdirSync4, appendFileSync, unlinkSync as unlinkSync5, openSync as openSync2, closeSync as closeSync2 } from "fs";
+import crypto3 from "crypto";
+import path11 from "path";
 import { homedir as homedir2 } from "os";
 function sqlSafe(v) {
   return v === void 0 ? null : v;
 }
 function logError(msg) {
   try {
-    const logPath = path8.join(homedir2(), ".exe-os", "workers.log");
+    const logPath = path11.join(homedir2(), ".exe-os", "workers.log");
     appendFileSync(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
   }
 }
+function loadPgClient() {
+  if (_pgFailed) return null;
+  const postgresUrl = process.env.DATABASE_URL;
+  const configPath = path11.join(EXE_AI_DIR, "config.json");
+  let cloudPostgresUrl;
+  try {
+    if (existsSync11(configPath)) {
+      const cfg = JSON.parse(readFileSync8(configPath, "utf8"));
+      cloudPostgresUrl = cfg.cloud?.postgresUrl;
+      if (cfg.cloud?.syncToPostgres === false) {
+        _pgFailed = true;
+        return null;
+      }
+    }
+  } catch {
+  }
+  const url = postgresUrl || cloudPostgresUrl;
+  if (!url) {
+    _pgFailed = true;
+    return null;
+  }
+  if (!_pgPromise) {
+    _pgPromise = (async () => {
+      const { createRequire: createRequire3 } = await import("module");
+      const { pathToFileURL: pathToFileURL3 } = await import("url");
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path11.join(homedir2(), "exe-db");
+      const req = createRequire3(path11.join(exeDbRoot, "package.json"));
+      const entry = req.resolve("@prisma/client");
+      const mod = await import(pathToFileURL3(entry).href);
+      const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+      if (!Ctor) throw new Error("No PrismaClient");
+      return new Ctor();
+    })().catch(() => {
+      _pgFailed = true;
+      _pgPromise = null;
+      throw new Error("pg_unavailable");
+    });
+  }
+  return _pgPromise;
+}
+async function pushToPostgres(records) {
+  const loader = loadPgClient();
+  if (!loader) return 0;
+  let prisma;
+  try {
+    prisma = await loader;
+  } catch {
+    return 0;
+  }
+  let inserted = 0;
+  for (const rec of records) {
+    try {
+      await prisma.$executeRawUnsafe(
+        `INSERT INTO raw.raw_events (id, source, source_id, event_type, payload, metadata, timestamp)
+         VALUES (gen_random_uuid(), 'cloud_sync', $1, 'memory', $2::jsonb, $3::jsonb, $4)
+         ON CONFLICT (source, source_id, event_type) DO NOTHING`,
+        String(rec.id ?? ""),
+        JSON.stringify(rec),
+        JSON.stringify({ agent_id: rec.agent_id, project_name: rec.project_name, tool_name: rec.tool_name }),
+        rec.timestamp ? new Date(String(rec.timestamp)) : /* @__PURE__ */ new Date()
+      );
+      inserted++;
+    } catch {
+    }
+  }
+  return inserted;
+}
 async function withRosterLock(fn) {
   try {
     const fd = openSync2(ROSTER_LOCK_PATH, "wx");
     closeSync2(fd);
-    writeFileSync4(ROSTER_LOCK_PATH, String(Date.now()));
+    writeFileSync6(ROSTER_LOCK_PATH, String(Date.now()));
   } catch (err) {
     if (err.code === "EEXIST") {
       try {
-        const ts = parseInt(readFileSync6(ROSTER_LOCK_PATH, "utf-8"), 10);
+        const ts = parseInt(readFileSync8(ROSTER_LOCK_PATH, "utf-8"), 10);
         if (Date.now() - ts < LOCK_STALE_MS) {
           throw new Error("Roster merge already in progress \u2014 another sync is running");
         }
         unlinkSync5(ROSTER_LOCK_PATH);
         const fd = openSync2(ROSTER_LOCK_PATH, "wx");
         closeSync2(fd);
-        writeFileSync4(ROSTER_LOCK_PATH, String(Date.now()));
+        writeFileSync6(ROSTER_LOCK_PATH, String(Date.now()));
       } catch (retryErr) {
         if (retryErr instanceof Error && retryErr.message.includes("already in progress")) throw retryErr;
         throw new Error("Roster merge already in progress \u2014 another sync is running");
@@ -3313,6 +4400,10 @@ async function cloudSync(config) {
     const maxVersion = Number(records[records.length - 1].version);
     const pushOk = await cloudPush(records, maxVersion, config);
     if (!pushOk) break;
+    try {
+      await pushToPostgres(records);
+    } catch {
+    }
     await client.execute({
       sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_push_version', ?)",
       args: [String(maxVersion)]
@@ -3417,8 +4508,8 @@ async function cloudSync(config) {
   try {
     const employees = await loadEmployees();
     rosterResult.employees = employees.length;
-    const idDir = path8.join(EXE_AI_DIR, "identity");
-    if (existsSync8(idDir)) {
+    const idDir = path11.join(EXE_AI_DIR, "identity");
+    if (existsSync11(idDir)) {
       rosterResult.identities = readdirSync(idDir).filter((f) => f.endsWith(".md")).length;
     }
   } catch {
@@ -3439,62 +4530,62 @@ async function cloudSync(config) {
 function recordRosterDeletion(name) {
   let deletions = [];
   try {
-    if (existsSync8(ROSTER_DELETIONS_PATH)) {
-      deletions = JSON.parse(readFileSync6(ROSTER_DELETIONS_PATH, "utf-8"));
+    if (existsSync11(ROSTER_DELETIONS_PATH)) {
+      deletions = JSON.parse(readFileSync8(ROSTER_DELETIONS_PATH, "utf-8"));
     }
   } catch {
   }
   if (!deletions.includes(name)) deletions.push(name);
-  writeFileSync4(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
+  writeFileSync6(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
 }
 function consumeRosterDeletions() {
   try {
-    if (!existsSync8(ROSTER_DELETIONS_PATH)) return [];
-    const deletions = JSON.parse(readFileSync6(ROSTER_DELETIONS_PATH, "utf-8"));
-    writeFileSync4(ROSTER_DELETIONS_PATH, "[]");
+    if (!existsSync11(ROSTER_DELETIONS_PATH)) return [];
+    const deletions = JSON.parse(readFileSync8(ROSTER_DELETIONS_PATH, "utf-8"));
+    writeFileSync6(ROSTER_DELETIONS_PATH, "[]");
     return deletions;
   } catch {
     return [];
   }
 }
 function buildRosterBlob(paths) {
-  const rosterPath = paths?.rosterPath ?? path8.join(EXE_AI_DIR, "exe-employees.json");
-  const identityDir = paths?.identityDir ?? path8.join(EXE_AI_DIR, "identity");
-  const configPath = paths?.configPath ?? path8.join(EXE_AI_DIR, "config.json");
+  const rosterPath = paths?.rosterPath ?? path11.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path11.join(EXE_AI_DIR, "identity");
+  const configPath = paths?.configPath ?? path11.join(EXE_AI_DIR, "config.json");
   let roster = [];
-  if (existsSync8(rosterPath)) {
+  if (existsSync11(rosterPath)) {
     try {
-      roster = JSON.parse(readFileSync6(rosterPath, "utf-8"));
+      roster = JSON.parse(readFileSync8(rosterPath, "utf-8"));
     } catch {
     }
   }
   const identities = {};
-  if (existsSync8(identityDir)) {
+  if (existsSync11(identityDir)) {
     for (const file of readdirSync(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
-        identities[file] = readFileSync6(path8.join(identityDir, file), "utf-8");
+        identities[file] = readFileSync8(path11.join(identityDir, file), "utf-8");
       } catch {
       }
     }
   }
   let config;
-  if (existsSync8(configPath)) {
+  if (existsSync11(configPath)) {
     try {
-      config = JSON.parse(readFileSync6(configPath, "utf-8"));
+      config = JSON.parse(readFileSync8(configPath, "utf-8"));
     } catch {
     }
   }
   let agentConfig;
-  const agentConfigPath = path8.join(EXE_AI_DIR, "agent-config.json");
-  if (existsSync8(agentConfigPath)) {
+  const agentConfigPath = path11.join(EXE_AI_DIR, "agent-config.json");
+  if (existsSync11(agentConfigPath)) {
     try {
-      agentConfig = JSON.parse(readFileSync6(agentConfigPath, "utf-8"));
+      agentConfig = JSON.parse(readFileSync8(agentConfigPath, "utf-8"));
     } catch {
     }
   }
   const deletedNames = consumeRosterDeletions();
   const content = JSON.stringify({ roster, identities, config, agentConfig, deletedNames });
-  const hash = crypto2.createHash("sha256").update(content).digest("hex").slice(0, 16);
+  const hash = crypto3.createHash("sha256").update(content).digest("hex").slice(0, 16);
   return { roster, identities, config, agentConfig, deletedNames, version: hash };
 }
 async function cloudPushRoster(config) {
@@ -3564,23 +4655,24 @@ async function cloudPullRoster(config) {
   }
 }
 function mergeConfig(remoteConfig, configPath) {
-  const cfgPath = configPath ?? path8.join(EXE_AI_DIR, "config.json");
+  const cfgPath = configPath ?? path11.join(EXE_AI_DIR, "config.json");
   let local = {};
-  if (existsSync8(cfgPath)) {
+  if (existsSync11(cfgPath)) {
     try {
-      local = JSON.parse(readFileSync6(cfgPath, "utf-8"));
+      local = JSON.parse(readFileSync8(cfgPath, "utf-8"));
     } catch {
     }
   }
   const merged = { ...remoteConfig, ...local };
-  const dir = path8.dirname(cfgPath);
-  if (!existsSync8(dir)) mkdirSync3(dir, { recursive: true });
-  writeFileSync4(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
+  const dir = path11.dirname(cfgPath);
+  ensurePrivateDirSync(dir);
+  writeFileSync6(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
+  enforcePrivateFileSync(cfgPath);
 }
 async function mergeRosterFromRemote(remote, paths) {
   return withRosterLock(async () => {
     const rosterPath = paths?.rosterPath ?? void 0;
-    const identityDir = paths?.identityDir ?? path8.join(EXE_AI_DIR, "identity");
+    const identityDir = paths?.identityDir ?? path11.join(EXE_AI_DIR, "identity");
     const localEmployees = await loadEmployees(rosterPath);
     const localNames = new Set(localEmployees.map((e) => e.name));
     let added = 0;
@@ -3601,15 +4693,15 @@ async function mergeRosterFromRemote(remote, paths) {
       ) ?? lookupKey;
       const remoteIdentity = remote.identities[matchedKey];
       if (remoteIdentity) {
-        if (!existsSync8(identityDir)) mkdirSync3(identityDir, { recursive: true });
-        const idPath = path8.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync11(identityDir)) mkdirSync4(identityDir, { recursive: true });
+        const idPath = path11.join(identityDir, `${remoteEmp.name}.md`);
         let localIdentity = null;
         try {
-          localIdentity = existsSync8(idPath) ? readFileSync6(idPath, "utf-8") : null;
+          localIdentity = existsSync11(idPath) ? readFileSync8(idPath, "utf-8") : null;
         } catch {
         }
         if (localIdentity !== remoteIdentity) {
-          writeFileSync4(idPath, remoteIdentity, "utf-8");
+          writeFileSync6(idPath, remoteIdentity, "utf-8");
           identitiesUpdated++;
         }
       }
@@ -3635,16 +4727,18 @@ async function mergeRosterFromRemote(remote, paths) {
     }
     if (remote.agentConfig && Object.keys(remote.agentConfig).length > 0) {
       try {
-        const agentConfigPath = path8.join(EXE_AI_DIR, "agent-config.json");
+        const agentConfigPath = path11.join(EXE_AI_DIR, "agent-config.json");
         let local = {};
-        if (existsSync8(agentConfigPath)) {
+        if (existsSync11(agentConfigPath)) {
           try {
-            local = JSON.parse(readFileSync6(agentConfigPath, "utf-8"));
+            local = JSON.parse(readFileSync8(agentConfigPath, "utf-8"));
           } catch {
           }
         }
         const merged = { ...remote.agentConfig, ...local };
-        writeFileSync4(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+        ensurePrivateDirSync(path11.dirname(agentConfigPath));
+        writeFileSync6(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+        enforcePrivateFileSync(agentConfigPath);
       } catch {
       }
     }
@@ -4068,7 +5162,7 @@ async function cloudPullDocuments(config) {
   }
   return { pulled };
 }
-var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, ROSTER_DELETIONS_PATH;
+var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, _pgPromise, _pgFailed, ROSTER_DELETIONS_PATH;
 var init_cloud_sync = __esm({
   "src/lib/cloud-sync.ts"() {
     "use strict";
@@ -4079,12 +5173,15 @@ var init_cloud_sync = __esm({
     init_config();
     init_crdt_sync();
     init_employees();
+    init_secure_files();
     LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
     FETCH_TIMEOUT_MS = 3e4;
     PUSH_BATCH_SIZE = 5e3;
-    ROSTER_LOCK_PATH = path8.join(EXE_AI_DIR, "roster-merge.lock");
+    ROSTER_LOCK_PATH = path11.join(EXE_AI_DIR, "roster-merge.lock");
     LOCK_STALE_MS = 3e4;
-    ROSTER_DELETIONS_PATH = path8.join(EXE_AI_DIR, "roster-deletions.json");
+    _pgPromise = null;
+    _pgFailed = false;
+    ROSTER_DELETIONS_PATH = path11.join(EXE_AI_DIR, "roster-deletions.json");
   }
 });
 
@@ -4094,37 +5191,39 @@ __export(preferences_exports, {
   loadPreferences: () => loadPreferences,
   savePreferences: () => savePreferences
 });
-import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "fs";
-import path9 from "path";
-import os5 from "os";
-function loadPreferences(homeDir = os5.homedir()) {
-  const configPath = path9.join(homeDir, ".exe-os", "config.json");
-  if (!existsSync9(configPath)) return {};
+import { existsSync as existsSync12, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+import path12 from "path";
+import os7 from "os";
+function loadPreferences(homeDir = os7.homedir()) {
+  const configPath = path12.join(homeDir, ".exe-os", "config.json");
+  if (!existsSync12(configPath)) return {};
   try {
-    const config = JSON.parse(readFileSync7(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync9(configPath, "utf-8"));
     return config.preferences ?? {};
   } catch {
     return {};
   }
 }
-function savePreferences(prefs, homeDir = os5.homedir()) {
-  const configDir = path9.join(homeDir, ".exe-os");
-  const configPath = path9.join(configDir, "config.json");
-  mkdirSync4(configDir, { recursive: true });
+function savePreferences(prefs, homeDir = os7.homedir()) {
+  const configDir = path12.join(homeDir, ".exe-os");
+  const configPath = path12.join(configDir, "config.json");
+  ensurePrivateDirSync(configDir);
   let config = {};
-  if (existsSync9(configPath)) {
+  if (existsSync12(configPath)) {
     try {
-      config = JSON.parse(readFileSync7(configPath, "utf-8"));
+      config = JSON.parse(readFileSync9(configPath, "utf-8"));
     } catch {
       config = {};
     }
   }
   config.preferences = prefs;
-  writeFileSync5(configPath, JSON.stringify(config, null, 2) + "\n");
+  writeFileSync7(configPath, JSON.stringify(config, null, 2) + "\n");
+  enforcePrivateFileSync(configPath);
 }
 var init_preferences = __esm({
   "src/lib/preferences.ts"() {
     "use strict";
+    init_secure_files();
   }
 });
 
@@ -4895,17 +5994,17 @@ __export(identity_exports, {
   listIdentities: () => listIdentities,
   updateIdentity: () => updateIdentity
 });
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
 import { readdirSync as readdirSync2 } from "fs";
-import path10 from "path";
+import path13 from "path";
 import { createHash as createHash2 } from "crypto";
 function ensureDir() {
-  if (!existsSync10(IDENTITY_DIR)) {
-    mkdirSync5(IDENTITY_DIR, { recursive: true });
+  if (!existsSync13(IDENTITY_DIR2)) {
+    mkdirSync5(IDENTITY_DIR2, { recursive: true });
   }
 }
 function identityPath(agentId) {
-  return path10.join(IDENTITY_DIR, `${agentId}.md`);
+  return path13.join(IDENTITY_DIR2, `${agentId}.md`);
 }
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
@@ -4946,8 +6045,8 @@ function contentHash(content) {
 }
 function getIdentity(agentId) {
   const filePath = identityPath(agentId);
-  if (!existsSync10(filePath)) return null;
-  const raw = readFileSync8(filePath, "utf-8");
+  if (!existsSync13(filePath)) return null;
+  const raw = readFileSync10(filePath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(raw);
   return {
     agentId,
@@ -4961,7 +6060,7 @@ async function updateIdentity(agentId, content, updatedBy) {
   ensureDir();
   const filePath = identityPath(agentId);
   const hash = contentHash(content);
-  writeFileSync6(filePath, content, "utf-8");
+  writeFileSync8(filePath, content, "utf-8");
   try {
     const client = getClient();
     await client.execute({
@@ -4978,7 +6077,7 @@ async function updateIdentity(agentId, content, updatedBy) {
 }
 function listIdentities() {
   ensureDir();
-  const files = readdirSync2(IDENTITY_DIR).filter((f) => f.endsWith(".md"));
+  const files = readdirSync2(IDENTITY_DIR2).filter((f) => f.endsWith(".md"));
   const results = [];
   for (const file of files) {
     const agentId = file.replace(".md", "");
@@ -5011,13 +6110,13 @@ ${teamLines.join("\n")}`);
   }
   return parts.join("\n\n");
 }
-var IDENTITY_DIR;
+var IDENTITY_DIR2;
 var init_identity = __esm({
   "src/lib/identity.ts"() {
     "use strict";
     init_config();
     init_database();
-    IDENTITY_DIR = path10.join(EXE_AI_DIR, "identity");
+    IDENTITY_DIR2 = path13.join(EXE_AI_DIR, "identity");
   }
 });
 
@@ -5568,36 +6667,36 @@ __export(session_wrappers_exports, {
   generateSessionWrappers: () => generateSessionWrappers
 });
 import {
-  existsSync as existsSync11,
-  readFileSync as readFileSync9,
-  writeFileSync as writeFileSync7,
+  existsSync as existsSync14,
+  readFileSync as readFileSync11,
+  writeFileSync as writeFileSync9,
   mkdirSync as mkdirSync6,
-  chmodSync,
+  chmodSync as chmodSync2,
   readdirSync as readdirSync3,
   unlinkSync as unlinkSync6
 } from "fs";
-import path11 from "path";
+import path14 from "path";
 import { homedir as homedir3 } from "os";
 function generateSessionWrappers(packageRoot, homeDir) {
   const home = homeDir ?? homedir3();
-  const binDir = path11.join(home, ".exe-os", "bin");
-  const rosterPath = path11.join(home, ".exe-os", "exe-employees.json");
+  const binDir = path14.join(home, ".exe-os", "bin");
+  const rosterPath = path14.join(home, ".exe-os", "exe-employees.json");
   mkdirSync6(binDir, { recursive: true });
-  const exeStartDst = path11.join(binDir, "exe-start");
+  const exeStartDst = path14.join(binDir, "exe-start");
   const candidates = [
-    path11.join(packageRoot, "dist", "bin", "exe-start.sh"),
-    path11.join(packageRoot, "src", "bin", "exe-start.sh")
+    path14.join(packageRoot, "dist", "bin", "exe-start.sh"),
+    path14.join(packageRoot, "src", "bin", "exe-start.sh")
   ];
   for (const src of candidates) {
-    if (existsSync11(src)) {
-      writeFileSync7(exeStartDst, readFileSync9(src));
-      chmodSync(exeStartDst, 493);
+    if (existsSync14(src)) {
+      writeFileSync9(exeStartDst, readFileSync11(src));
+      chmodSync2(exeStartDst, 493);
       break;
     }
   }
   let employees = [];
   try {
-    employees = JSON.parse(readFileSync9(rosterPath, "utf8"));
+    employees = JSON.parse(readFileSync11(rosterPath, "utf8"));
   } catch {
     return { created: 0, pathConfigured: false };
   }
@@ -5607,9 +6706,9 @@ function generateSessionWrappers(packageRoot, homeDir) {
   try {
     for (const f of readdirSync3(binDir)) {
       if (f === "exe-start") continue;
-      const fPath = path11.join(binDir, f);
+      const fPath = path14.join(binDir, f);
       try {
-        const content = readFileSync9(fPath, "utf8");
+        const content = readFileSync11(fPath, "utf8");
         if (content.includes("exe-start")) {
           unlinkSync6(fPath);
         }
@@ -5624,31 +6723,31 @@ exec "${exeStartDst}" "$0" "$@"
 `;
   for (const emp of employees) {
     for (let n = 1; n <= MAX_N; n++) {
-      const wrapperPath = path11.join(binDir, `${emp.name}${n}`);
-      writeFileSync7(wrapperPath, wrapperContent);
-      chmodSync(wrapperPath, 493);
+      const wrapperPath = path14.join(binDir, `${emp.name}${n}`);
+      writeFileSync9(wrapperPath, wrapperContent);
+      chmodSync2(wrapperPath, 493);
       created++;
     }
   }
   const codexLauncherCandidates = [
-    path11.join(packageRoot, "dist", "bin", "exe-start-codex.js"),
-    path11.join(packageRoot, "src", "bin", "exe-start-codex.ts")
+    path14.join(packageRoot, "dist", "bin", "exe-start-codex.js"),
+    path14.join(packageRoot, "src", "bin", "exe-start-codex.ts")
   ];
   let codexLauncher = null;
   for (const c of codexLauncherCandidates) {
-    if (existsSync11(c)) {
+    if (existsSync14(c)) {
       codexLauncher = c;
       break;
     }
   }
   if (codexLauncher) {
     for (const emp of employees) {
-      const wrapperPath = path11.join(binDir, `${emp.name}-codex`);
+      const wrapperPath = path14.join(binDir, `${emp.name}-codex`);
       const content = `#!/bin/bash
 exec node "${codexLauncher}" --agent ${emp.name} "$@"
 `;
-      writeFileSync7(wrapperPath, content);
-      chmodSync(wrapperPath, 493);
+      writeFileSync9(wrapperPath, content);
+      chmodSync2(wrapperPath, 493);
       created++;
     }
   }
@@ -5666,24 +6765,24 @@ export PATH="${binDir}:$PATH"
   const shell = process.env.SHELL ?? "/bin/bash";
   const profilePaths = [];
   if (shell.includes("zsh")) {
-    profilePaths.push(path11.join(home, ".zshrc"));
+    profilePaths.push(path14.join(home, ".zshrc"));
   } else if (shell.includes("bash")) {
-    profilePaths.push(path11.join(home, ".bashrc"));
-    profilePaths.push(path11.join(home, ".bash_profile"));
+    profilePaths.push(path14.join(home, ".bashrc"));
+    profilePaths.push(path14.join(home, ".bash_profile"));
   } else {
-    profilePaths.push(path11.join(home, ".profile"));
+    profilePaths.push(path14.join(home, ".profile"));
   }
   for (const profilePath of profilePaths) {
     try {
       let content = "";
       try {
-        content = readFileSync9(profilePath, "utf8");
+        content = readFileSync11(profilePath, "utf8");
       } catch {
       }
       if (content.includes(".exe-os/bin")) {
         return false;
       }
-      writeFileSync7(profilePath, content + exportLine);
+      writeFileSync9(profilePath, content + exportLine);
       return true;
     } catch {
       continue;
@@ -5702,14 +6801,14 @@ var init_session_wrappers = __esm({
 // src/lib/setup-wizard.ts
 init_config();
 init_keychain();
-import crypto3 from "crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync8, unlinkSync as unlinkSync7 } from "fs";
-import os6 from "os";
-import path12 from "path";
+import crypto4 from "crypto";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync10, unlinkSync as unlinkSync7 } from "fs";
+import os8 from "os";
+import path15 from "path";
 import { createInterface } from "readline";
 
 // src/lib/model-downloader.ts
-import { createWriteStream, createReadStream, existsSync as existsSync3, unlinkSync, renameSync as renameSync2 } from "fs";
+import { createWriteStream, createReadStream, existsSync as existsSync4, unlinkSync, renameSync as renameSync2 } from "fs";
 import { mkdir as mkdir3 } from "fs/promises";
 import { createHash } from "crypto";
 import path3 from "path";
@@ -5722,7 +6821,7 @@ async function downloadModel(opts) {
   const destPath = path3.join(destDir, LOCAL_FILENAME);
   const tmpPath = destPath + ".tmp";
   await mkdir3(destDir, { recursive: true });
-  if (existsSync3(destPath)) {
+  if (existsSync4(destPath)) {
     const hash = await fileHash(destPath);
     if (hash === EXPECTED_SHA256) {
       return destPath;
@@ -5734,7 +6833,7 @@ async function downloadModel(opts) {
   let downloaded = 0;
   for (let attempt = 1; attempt <= MAX_RETRIES2; attempt++) {
     try {
-      if (existsSync3(tmpPath)) unlinkSync(tmpPath);
+      if (existsSync4(tmpPath)) unlinkSync(tmpPath);
       const response = await fetchFn(GGUF_URL, {
         redirect: "follow",
         signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
@@ -5779,7 +6878,7 @@ async function downloadModel(opts) {
         process.stderr.write(`
 Download attempt ${attempt} failed, retrying...
 `);
-        if (existsSync3(tmpPath)) unlinkSync(tmpPath);
+        if (existsSync4(tmpPath)) unlinkSync(tmpPath);
       }
     }
   }
@@ -5797,32 +6896,32 @@ async function fileHash(filePath) {
 
 // src/lib/setup-wizard.ts
 function findPackageRoot2() {
-  let dir = path12.dirname(new URL(import.meta.url).pathname);
-  const root = path12.parse(dir).root;
+  let dir = path15.dirname(new URL(import.meta.url).pathname);
+  const root = path15.parse(dir).root;
   while (dir !== root) {
-    const pkgPath = path12.join(dir, "package.json");
-    if (existsSync12(pkgPath)) {
+    const pkgPath = path15.join(dir, "package.json");
+    if (existsSync15(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync12(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
       } catch {
       }
     }
-    dir = path12.dirname(dir);
+    dir = path15.dirname(dir);
   }
   return null;
 }
-var SETUP_STATE_PATH = path12.join(os6.homedir(), ".exe-os", "setup-state.json");
+var SETUP_STATE_PATH = path15.join(os8.homedir(), ".exe-os", "setup-state.json");
 function loadSetupState() {
   try {
-    return JSON.parse(readFileSync10(SETUP_STATE_PATH, "utf8"));
+    return JSON.parse(readFileSync12(SETUP_STATE_PATH, "utf8"));
   } catch {
     return { completedSteps: [], startedAt: (/* @__PURE__ */ new Date()).toISOString() };
   }
 }
 function saveSetupState(state) {
-  mkdirSync7(path12.dirname(SETUP_STATE_PATH), { recursive: true });
-  writeFileSync8(SETUP_STATE_PATH, JSON.stringify(state, null, 2));
+  mkdirSync7(path15.dirname(SETUP_STATE_PATH), { recursive: true });
+  writeFileSync10(SETUP_STATE_PATH, JSON.stringify(state, null, 2));
 }
 function clearSetupState() {
   try {
@@ -5841,10 +6940,10 @@ function ask(rl, prompt) {
   });
 }
 function getAvailableMemoryGB() {
-  return os6.freemem() / (1024 * 1024 * 1024);
+  return os8.freemem() / (1024 * 1024 * 1024);
 }
 function getTotalMemoryGB() {
-  return os6.totalmem() / (1024 * 1024 * 1024);
+  return os8.totalmem() / (1024 * 1024 * 1024);
 }
 function isLowMemory() {
   return getAvailableMemoryGB() < 2;
@@ -5855,8 +6954,8 @@ async function validateModel(log) {
   if (totalGB <= 8 || isLowMemory()) {
     log(`System memory: ${totalGB.toFixed(0)}GB total, ${freeGB.toFixed(1)}GB free`);
     log("Skipping in-memory model validation (low memory \u2014 will validate on first use).");
-    const modelPath = path12.join(MODELS_DIR, LOCAL_FILENAME);
-    if (existsSync12(modelPath)) {
+    const modelPath = path15.join(MODELS_DIR, LOCAL_FILENAME);
+    if (existsSync15(modelPath)) {
       const { statSync: statSync2 } = await import("fs");
       const size = statSync2(modelPath).size;
       if (size > 300 * 1e6) {
@@ -5947,7 +7046,7 @@ async function runSetupWizard(opts = {}) {
     if (state.completedSteps.length > 0) {
       log(`Resuming setup from step ${Math.max(...state.completedSteps) + 1}...`);
     }
-    if (existsSync12(LEGACY_LANCE_PATH)) {
+    if (existsSync15(LEGACY_LANCE_PATH)) {
       log("\u26A0 Found v1.0 LanceDB at ~/.exe-os/local.lance");
       log("  v1.1 uses libSQL (SQLite). Your existing memories are not automatically migrated.");
       log("  The old directory will not be modified or deleted.");
@@ -5959,7 +7058,7 @@ async function runSetupWizard(opts = {}) {
         log("Encryption key already exists \u2014 skipping generation.");
       } else {
         log("Generating 256-bit encryption key...");
-        const key = crypto3.randomBytes(32);
+        const key = crypto4.randomBytes(32);
         await setMasterKey(key);
         log("Encryption key generated and stored securely.");
       }
@@ -6111,19 +7210,19 @@ async function runSetupWizard(opts = {}) {
       await saveConfig(config);
       log("");
       try {
-        const claudeJsonPath = path12.join(os6.homedir(), ".claude.json");
+        const claudeJsonPath = path15.join(os8.homedir(), ".claude.json");
         let claudeJson = {};
         try {
-          claudeJson = JSON.parse(readFileSync10(claudeJsonPath, "utf8"));
+          claudeJson = JSON.parse(readFileSync12(claudeJsonPath, "utf8"));
         } catch {
         }
         if (!claudeJson.projects) claudeJson.projects = {};
         const projects = claudeJson.projects;
-        for (const dir of [process.cwd(), os6.homedir()]) {
+        for (const dir of [process.cwd(), os8.homedir()]) {
           if (!projects[dir]) projects[dir] = {};
           projects[dir].hasTrustDialogAccepted = true;
         }
-        writeFileSync8(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
+        writeFileSync10(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
       } catch {
       }
       state.completedSteps.push(5);
@@ -6137,7 +7236,7 @@ async function runSetupWizard(opts = {}) {
       const prefs = { ...existingPrefs };
       log("=== Config Defaults ===");
       log("");
-      const ghosttyDetected = existsSync12(path12.join(os6.homedir(), ".config", "ghostty")) || existsSync12(path12.join(os6.homedir(), "Library", "Application Support", "com.mitchellh.ghostty"));
+      const ghosttyDetected = existsSync15(path15.join(os8.homedir(), ".config", "ghostty")) || existsSync15(path15.join(os8.homedir(), "Library", "Application Support", "com.mitchellh.ghostty"));
       if (ghosttyDetected) {
         const ghosttyAnswer = await ask(rl, "Detected Ghostty terminal. Use exe-os Ghostty defaults? (Y/n) ");
         prefs.ghostty = ghosttyAnswer.toLowerCase() !== "n";
@@ -6184,7 +7283,7 @@ async function runSetupWizard(opts = {}) {
       let missingIdentities = [];
       for (const emp of roster) {
         const idPath = identityPath2(emp.name);
-        if (!existsSync12(idPath)) {
+        if (!existsSync15(idPath)) {
           missingIdentities.push(emp.name);
         }
       }
@@ -6216,7 +7315,7 @@ async function runSetupWizard(opts = {}) {
           }
           missingIdentities = [];
           for (const emp of roster) {
-            if (!existsSync12(identityPath2(emp.name))) {
+            if (!existsSync15(identityPath2(emp.name))) {
               missingIdentities.push(emp.name);
             }
           }
@@ -6281,9 +7380,9 @@ async function runSetupWizard(opts = {}) {
       const cooIdentityContent = getIdentityTemplate("coo");
       if (cooIdentityContent) {
         const cooIdPath = identityPath2(cooName);
-        mkdirSync7(path12.dirname(cooIdPath), { recursive: true });
+        mkdirSync7(path15.dirname(cooIdPath), { recursive: true });
         const replaced = cooIdentityContent.replace(/agent_id:\s*exe/g, `agent_id: ${cooName}`).replace(/\$\{agent_id\}/g, cooName);
-        writeFileSync8(cooIdPath, replaced, "utf-8");
+        writeFileSync10(cooIdPath, replaced, "utf-8");
       }
       registerBinSymlinks2(cooName);
       createdEmployees.push({ name: cooName, role: "COO" });
@@ -6377,9 +7476,9 @@ async function runSetupWizard(opts = {}) {
       const ctoIdentityContent = getIdentityTemplate("cto");
       if (ctoIdentityContent) {
         const ctoIdPath = identityPath2(ctoName);
-        mkdirSync7(path12.dirname(ctoIdPath), { recursive: true });
+        mkdirSync7(path15.dirname(ctoIdPath), { recursive: true });
         const replaced = ctoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${ctoName}`).replace(/\$\{agent_id\}/g, ctoName);
-        writeFileSync8(ctoIdPath, replaced, "utf-8");
+        writeFileSync10(ctoIdPath, replaced, "utf-8");
       }
       registerBinSymlinks2(ctoName);
       createdEmployees.push({ name: ctoName, role: "CTO" });
@@ -6400,9 +7499,9 @@ async function runSetupWizard(opts = {}) {
       const cmoIdentityContent = getIdentityTemplate("cmo");
       if (cmoIdentityContent) {
         const cmoIdPath = identityPath2(cmoName);
-        mkdirSync7(path12.dirname(cmoIdPath), { recursive: true });
+        mkdirSync7(path15.dirname(cmoIdPath), { recursive: true });
         const replaced = cmoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${cmoName}`).replace(/\$\{agent_id\}/g, cmoName);
-        writeFileSync8(cmoIdPath, replaced, "utf-8");
+        writeFileSync10(cmoIdPath, replaced, "utf-8");
       }
       registerBinSymlinks2(cmoName);
       createdEmployees.push({ name: cmoName, role: "CMO" });
@@ -6424,7 +7523,7 @@ async function runSetupWizard(opts = {}) {
             log(`Session shortcuts generated (${cooName}1, ${cooName}2, ...)`);
           }
           if (wrapResult.pathConfigured) {
-            const binDir = path12.join(os6.homedir(), ".exe-os", "bin");
+            const binDir = path15.join(os8.homedir(), ".exe-os", "bin");
             process.env.PATH = `${binDir}:${process.env.PATH ?? ""}`;
             pathJustConfigured = true;
           }
@@ -6467,7 +7566,7 @@ async function runSetupWizard(opts = {}) {
     const pkgRoot2 = findPackageRoot2();
     if (pkgRoot2) {
       try {
-        version = JSON.parse(readFileSync10(path12.join(pkgRoot2, "package.json"), "utf-8")).version;
+        version = JSON.parse(readFileSync12(path15.join(pkgRoot2, "package.json"), "utf-8")).version;
       } catch {
       }
     }