@askexenow/exe-os 0.9.8 → 0.9.10

package/dist/bin/cli.js

@@ -26,6 +26,44 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/lib/secure-files.ts
+import { chmodSync, existsSync, mkdirSync } from "fs";
+import { chmod, mkdir } from "fs/promises";
+async function ensurePrivateDir(dirPath) {
+  await mkdir(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    await chmod(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+function ensurePrivateDirSync(dirPath) {
+  mkdirSync(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    chmodSync(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+async function enforcePrivateFile(filePath) {
+  try {
+    await chmod(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+function enforcePrivateFileSync(filePath) {
+  try {
+    if (existsSync(filePath)) chmodSync(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+var PRIVATE_DIR_MODE, PRIVATE_FILE_MODE;
+var init_secure_files = __esm({
+  "src/lib/secure-files.ts"() {
+    "use strict";
+    PRIVATE_DIR_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+  }
+});
+
 // src/lib/config.ts
 var config_exports = {};
 __export(config_exports, {
@@ -42,8 +80,8 @@ __export(config_exports, {
   migrateConfig: () => migrateConfig,
   saveConfig: () => saveConfig
 });
-import { readFile, writeFile, mkdir, chmod } from "fs/promises";
-import { readFileSync, existsSync, renameSync } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
 import path from "path";
 import os from "os";
 function resolveDataDir() {
@@ -51,7 +89,7 @@ function resolveDataDir() {
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
   const newDir = path.join(os.homedir(), ".exe-os");
   const legacyDir = path.join(os.homedir(), ".exe-mem");
-  if (!existsSync(newDir) && existsSync(legacyDir)) {
+  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
       process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
@@ -114,9 +152,9 @@ function normalizeAutoUpdate(raw) {
 }
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path.join(dir, "config.json");
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
   }
   const raw = await readFile(configPath, "utf-8");
@@ -129,6 +167,7 @@ async function loadConfig() {
 `);
       try {
         await writeFile(configPath, JSON.stringify(migratedCfg, null, 2) + "\n");
+        await enforcePrivateFile(configPath);
       } catch {
       }
     }
@@ -147,7 +186,7 @@ async function loadConfig() {
 function loadConfigSync() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
   const configPath = path.join(dir, "config.json");
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
   }
   try {
@@ -165,12 +204,10 @@ function loadConfigSync() {
 }
 async function saveConfig(config) {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path.join(dir, "config.json");
   await writeFile(configPath, JSON.stringify(config, null, 2) + "\n");
-  if (config.cloud?.apiKey) {
-    await chmod(configPath, 384);
-  }
+  await enforcePrivateFile(configPath);
 }
 async function loadConfigFrom(configPath) {
   const raw = await readFile(configPath, "utf-8");
@@ -190,6 +227,7 @@ var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CON
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
+    init_secure_files();
     EXE_AI_DIR = resolveDataDir();
     DB_PATH = path.join(EXE_AI_DIR, "memories.db");
     MODELS_DIR = path.join(EXE_AI_DIR, "models");
@@ -306,10 +344,10 @@ __export(agent_config_exports, {
   saveAgentConfig: () => saveAgentConfig,
   setAgentRuntime: () => setAgentRuntime
 });
-import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, mkdirSync } from "fs";
+import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync3 } from "fs";
 import path2 from "path";
 function loadAgentConfig() {
-  if (!existsSync2(AGENT_CONFIG_PATH)) return {};
+  if (!existsSync3(AGENT_CONFIG_PATH)) return {};
   try {
     return JSON.parse(readFileSync2(AGENT_CONFIG_PATH, "utf-8"));
   } catch {
@@ -318,8 +356,9 @@ function loadAgentConfig() {
 }
 function saveAgentConfig(config) {
   const dir = path2.dirname(AGENT_CONFIG_PATH);
-  if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
+  ensurePrivateDirSync(dir);
   writeFileSync(AGENT_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  enforcePrivateFileSync(AGENT_CONFIG_PATH);
 }
 function getAgentRuntime(agentId) {
   const config = loadAgentConfig();
@@ -359,6 +398,7 @@ var init_agent_config = __esm({
     "use strict";
     init_config();
     init_runtime_table();
+    init_secure_files();
     AGENT_CONFIG_PATH = path2.join(EXE_AI_DIR, "agent-config.json");
     KNOWN_RUNTIMES = {
       claude: ["claude-opus-4", "claude-sonnet-4", "claude-haiku-4.5"],
@@ -406,7 +446,7 @@ __export(employees_exports, {
   validateEmployeeName: () => validateEmployeeName
 });
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { existsSync as existsSync3, symlinkSync, readlinkSync, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, symlinkSync, readlinkSync, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
 import { execSync } from "child_process";
 import path3 from "path";
 import os2 from "os";
@@ -445,7 +485,7 @@ function validateEmployeeName(name) {
   return { valid: true };
 }
 async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync3(employeesPath)) {
+  if (!existsSync4(employeesPath)) {
     return [];
   }
   const raw = await readFile2(employeesPath, "utf-8");
@@ -460,7 +500,7 @@ async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
   await writeFile2(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
 }
 function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync3(employeesPath)) return [];
+  if (!existsSync4(employeesPath)) return [];
   try {
     return JSON.parse(readFileSync3(employeesPath, "utf-8"));
   } catch {
@@ -508,7 +548,7 @@ function appendToCoordinatorTeam(employee) {
   const coordinator = getCoordinatorEmployee(loadEmployeesSync());
   if (!coordinator) return;
   const idPath = path3.join(IDENTITY_DIR, `${coordinator.name}.md`);
-  if (!existsSync3(idPath)) return;
+  if (!existsSync4(idPath)) return;
   const content = readFileSync3(idPath, "utf-8");
   if (content.includes(`**${capitalize(employee.name)}`)) return;
   const teamMatch = content.match(TEAM_SECTION_RE);
@@ -562,9 +602,9 @@ async function normalizeRosterCase(rosterPath) {
         const identityDir = path3.join(os2.homedir(), ".exe-os", "identity");
         const oldPath = path3.join(identityDir, `${oldName}.md`);
         const newPath = path3.join(identityDir, `${emp.name}.md`);
-        if (existsSync3(oldPath) && !existsSync3(newPath)) {
+        if (existsSync4(oldPath) && !existsSync4(newPath)) {
           renameSync2(oldPath, newPath);
-        } else if (existsSync3(oldPath) && oldPath !== newPath) {
+        } else if (existsSync4(oldPath) && oldPath !== newPath) {
           const content = readFileSync3(oldPath, "utf-8");
           writeFileSync2(newPath, content, "utf-8");
           if (oldPath.toLowerCase() !== newPath.toLowerCase()) {
@@ -607,7 +647,7 @@ function registerBinSymlinks(name) {
   for (const suffix of ["", "-opencode"]) {
     const linkName = `${name}${suffix}`;
     const linkPath = path3.join(binDir, linkName);
-    if (existsSync3(linkPath)) {
+    if (existsSync4(linkPath)) {
       skipped.push(linkName);
       continue;
     }
@@ -638,7 +678,7 @@ var init_employees = __esm({
 import os3 from "os";
 import path4 from "path";
 import {
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   lstatSync,
   mkdirSync as mkdirSync2,
   readlinkSync as readlinkSync2,
@@ -657,7 +697,7 @@ function ensureAgentSymlink(agentId, homeDir = os3.homedir()) {
   const target = identitySourcePath(homeDir, agentId);
   const link = claudeAgentLinkPath(homeDir, agentId);
   mkdirSync2(claudeAgentsDir(homeDir), { recursive: true });
-  if (existsSync4(link)) {
+  if (existsSync5(link)) {
     let stat2;
     try {
       stat2 = lstatSync(link);
@@ -731,12 +771,12 @@ __export(preferences_exports, {
   loadPreferences: () => loadPreferences,
   savePreferences: () => savePreferences
 });
-import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import path5 from "path";
 import os4 from "os";
 function loadPreferences(homeDir = os4.homedir()) {
   const configPath = path5.join(homeDir, ".exe-os", "config.json");
-  if (!existsSync5(configPath)) return {};
+  if (!existsSync6(configPath)) return {};
   try {
     const config = JSON.parse(readFileSync4(configPath, "utf-8"));
     return config.preferences ?? {};
@@ -747,9 +787,9 @@ function loadPreferences(homeDir = os4.homedir()) {
 function savePreferences(prefs, homeDir = os4.homedir()) {
   const configDir = path5.join(homeDir, ".exe-os");
   const configPath = path5.join(configDir, "config.json");
-  mkdirSync3(configDir, { recursive: true });
+  ensurePrivateDirSync(configDir);
   let config = {};
-  if (existsSync5(configPath)) {
+  if (existsSync6(configPath)) {
     try {
       config = JSON.parse(readFileSync4(configPath, "utf-8"));
     } catch {
@@ -758,10 +798,12 @@ function savePreferences(prefs, homeDir = os4.homedir()) {
   }
   config.preferences = prefs;
   writeFileSync3(configPath, JSON.stringify(config, null, 2) + "\n");
+  enforcePrivateFileSync(configPath);
 }
 var init_preferences = __esm({
   "src/lib/preferences.ts"() {
     "use strict";
+    init_secure_files();
   }
 });
 
@@ -779,7 +821,7 @@ __export(installer_exports, {
   setupTmux: () => setupTmux
 });
 import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3, readdir } from "fs/promises";
-import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync4, copyFileSync, mkdirSync as mkdirSync4 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync4, copyFileSync, mkdirSync as mkdirSync3 } from "fs";
 import path6 from "path";
 import os5 from "os";
 import { execSync as execSync2 } from "child_process";
@@ -790,7 +832,7 @@ function resolvePackageRoot() {
   const root = path6.parse(dir).root;
   while (dir !== root) {
     const pkgPath = path6.join(dir, "package.json");
-    if (existsSync6(pkgPath)) {
+    if (existsSync7(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
@@ -806,7 +848,7 @@ async function copySlashCommands(packageRoot, homeDir = os5.homedir()) {
   let skipped = 0;
   const skillsBase = path6.join(homeDir, ".claude", "skills");
   const exeDir = path6.join(packageRoot, "src", "commands", "exe");
-  if (existsSync6(exeDir)) {
+  if (existsSync7(exeDir)) {
     const entries = await readdir(exeDir);
     const mdFiles = entries.filter((f) => f.endsWith(".md"));
     for (const file of mdFiles) {
@@ -821,7 +863,7 @@ async function copySlashCommands(packageRoot, homeDir = os5.homedir()) {
     }
   }
   const topLevelSrc = path6.join(packageRoot, "src", "commands", "exe.md");
-  if (existsSync6(topLevelSrc)) {
+  if (existsSync7(topLevelSrc)) {
     const destDir = path6.join(skillsBase, "exe");
     await mkdir3(destDir, { recursive: true });
     const destPath = path6.join(destDir, "SKILL.md");
@@ -847,7 +889,7 @@ name: ${skillName}
 `);
     }
   }
-  if (existsSync6(destPath)) {
+  if (existsSync7(destPath)) {
     const existing = await readFile3(destPath, "utf-8");
     if (existing === content) return false;
   }
@@ -857,7 +899,7 @@ name: ${skillName}
 async function registerMcpServer(packageRoot, homeDir = os5.homedir()) {
   const claudeJsonPath = path6.join(homeDir, ".claude.json");
   let claudeJson = {};
-  if (existsSync6(claudeJsonPath)) {
+  if (existsSync7(claudeJsonPath)) {
     try {
       claudeJson = JSON.parse(await readFile3(claudeJsonPath, "utf-8"));
     } catch {
@@ -874,21 +916,21 @@ async function registerMcpServer(packageRoot, homeDir = os5.homedir()) {
     env: {}
   };
   const currentMem = claudeJson.mcpServers[MCP_LEGACY_KEY];
-  const currentOs = claudeJson.mcpServers[MCP_PRIMARY_KEY];
   const memMatches = currentMem && JSON.stringify(currentMem) === JSON.stringify(newEntry);
-  const osMatches = currentOs && JSON.stringify(currentOs) === JSON.stringify(newEntry);
-  if (memMatches && osMatches) {
+  if (claudeJson.mcpServers[MCP_PRIMARY_KEY]) {
+    delete claudeJson.mcpServers[MCP_PRIMARY_KEY];
+  }
+  if (memMatches && !claudeJson.mcpServers[MCP_PRIMARY_KEY]) {
     await cleanSettingsJsonMcp(path6.join(homeDir, ".claude", "settings.json"));
     return false;
   }
   claudeJson.mcpServers[MCP_LEGACY_KEY] = newEntry;
-  claudeJson.mcpServers[MCP_PRIMARY_KEY] = newEntry;
   await writeFile3(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
   await cleanSettingsJsonMcp(path6.join(homeDir, ".claude", "settings.json"));
   return true;
 }
 async function cleanSettingsJsonMcp(settingsPath) {
-  if (!existsSync6(settingsPath)) return;
+  if (!existsSync7(settingsPath)) return;
   try {
     const settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     const servers = settings.mcpServers;
@@ -915,7 +957,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
   const logSuffix = ` 2>> "${hookLogPath}"`;
   await mkdir3(logsDir, { recursive: true });
   let settings = {};
-  if (existsSync6(settingsPath)) {
+  if (existsSync7(settingsPath)) {
     try {
       settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     } catch {
@@ -1183,7 +1225,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
 }
 async function cleanOldShellFunctions(homeDir = os5.homedir()) {
   const rosterPath = path6.join(homeDir, ".exe-os", "exe-employees.json");
-  if (!existsSync6(rosterPath)) return 0;
+  if (!existsSync7(rosterPath)) return 0;
   let employees;
   try {
     employees = JSON.parse(await readFile3(rosterPath, "utf-8"));
@@ -1204,7 +1246,7 @@ async function cleanOldShellFunctions(homeDir = os5.homedir()) {
   const REMOVED_MARKER = "# Removed by exe-os \u2014 wrappers now at ~/.exe-os/bin/";
   let totalRemoved = 0;
   for (const rcPath of rcFiles) {
-    if (!existsSync6(rcPath)) continue;
+    if (!existsSync7(rcPath)) continue;
     let content;
     try {
       content = await readFile3(rcPath, "utf-8");
@@ -1337,13 +1379,13 @@ async function installStatusLine(packageRoot, homeDir = os5.homedir()) {
   const claudeDir = path6.join(homeDir, ".claude");
   await mkdir3(claudeDir, { recursive: true });
   const assetPath = path6.join(packageRoot, "dist", "assets", "statusline-command.sh");
-  if (!existsSync6(assetPath)) return "asset-missing";
+  if (!existsSync7(assetPath)) return "asset-missing";
   const destScript = path6.join(claudeDir, "statusline-command.sh");
   const assetContent = await readFile3(assetPath, "utf-8");
   await writeFile3(destScript, assetContent, { mode: 493 });
   const settingsPath = path6.join(claudeDir, "settings.json");
   let settings = {};
-  if (existsSync6(settingsPath)) {
+  if (existsSync7(settingsPath)) {
     try {
       settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     } catch {
@@ -1382,7 +1424,7 @@ async function runInstaller(homeDir) {
   );
   const resolvedHome = homeDir ?? os5.homedir();
   const exeWorkspace = path6.join(resolvedHome, "exe");
-  if (!existsSync6(exeWorkspace)) {
+  if (!existsSync7(exeWorkspace)) {
     try {
       await mkdir3(path6.join(exeWorkspace, "content"), { recursive: true });
       await mkdir3(path6.join(exeWorkspace, "operations"), { recursive: true });
@@ -1429,17 +1471,17 @@ function setupTmux(home) {
   const sourceLine = "source-file ~/.exe-os/tmux.conf";
   const pkgRoot = resolvePackageRoot();
   const assetPath = path6.join(pkgRoot, "dist", "assets", "tmux.conf");
-  if (!existsSync6(assetPath)) {
+  if (!existsSync7(assetPath)) {
     process.stderr.write(`exe-os: tmux.conf asset not found at ${assetPath} \u2014 skipping tmux setup
 `);
     return;
   }
-  mkdirSync4(exeDir, { recursive: true });
+  mkdirSync3(exeDir, { recursive: true });
   copyFileSync(assetPath, exeTmuxConf);
-  if (existsSync6(userTmuxConf)) {
+  if (existsSync7(userTmuxConf)) {
     const existing = readFileSync5(userTmuxConf, "utf8");
     if (!existing.includes(sourceLine)) {
-      if (!existsSync6(backupPath)) {
+      if (!existsSync7(backupPath)) {
         copyFileSync(userTmuxConf, backupPath);
         process.stderr.write(`exe-os: backed up existing tmux config to ${backupPath}
 `);
@@ -1462,7 +1504,7 @@ function setupGhostty(home) {
   const homeDir = home ?? os5.homedir();
   const xdgConfig = path6.join(homeDir, ".config", "ghostty");
   const macConfig = path6.join(homeDir, "Library", "Application Support", "com.mitchellh.ghostty");
-  const ghosttyInstalled = existsSync6(xdgConfig) || existsSync6(macConfig) || (() => {
+  const ghosttyInstalled = existsSync7(xdgConfig) || existsSync7(macConfig) || (() => {
     try {
       execSync2("which ghostty 2>/dev/null");
       return true;
@@ -1475,28 +1517,28 @@ function setupGhostty(home) {
   }
   const pkgRoot = resolvePackageRoot();
   const assetPath = path6.join(pkgRoot, "dist", "assets", "ghostty.conf");
-  if (!existsSync6(assetPath)) {
+  if (!existsSync7(assetPath)) {
     process.stderr.write("exe-os: ghostty.conf asset not found \u2014 skipping Ghostty setup\n");
     return;
   }
   const configDir = xdgConfig;
   const configPath = path6.join(configDir, "config");
   const backupPath = path6.join(configDir, "config.backup");
-  mkdirSync4(configDir, { recursive: true });
+  mkdirSync3(configDir, { recursive: true });
   const START_MARKER = "# \u2500\u2500 exe-os:ghostty-start \u2500\u2500";
   const END_MARKER = "# \u2500\u2500 exe-os:ghostty-end \u2500\u2500";
   const assetContent = readFileSync5(assetPath, "utf8").trim();
   const markedSection = `${START_MARKER}
 ${assetContent}
 ${END_MARKER}`;
-  if (existsSync6(configPath)) {
+  if (existsSync7(configPath)) {
     const existing = readFileSync5(configPath, "utf8");
     if (existing.includes(START_MARKER) && existing.includes(END_MARKER)) {
       const before = existing.slice(0, existing.indexOf(START_MARKER));
       const after = existing.slice(existing.indexOf(END_MARKER) + END_MARKER.length);
       writeFileSync4(configPath, `${before}${markedSection}${after}`);
     } else if (existing.includes("Exe OS")) {
-      if (!existsSync6(backupPath)) {
+      if (!existsSync7(backupPath)) {
         copyFileSync(configPath, backupPath);
         process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
 `);
@@ -1504,7 +1546,7 @@ ${END_MARKER}`;
       writeFileSync4(configPath, `${markedSection}
 `);
     } else {
-      if (!existsSync6(backupPath)) {
+      if (!existsSync7(backupPath)) {
         copyFileSync(configPath, backupPath);
         process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
 `);
@@ -1564,7 +1606,7 @@ __export(keychain_exports, {
   setMasterKey: () => setMasterKey
 });
 import { readFile as readFile4, writeFile as writeFile4, unlink, mkdir as mkdir4, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import path7 from "path";
 import os6 from "os";
 function getKeyDir() {
@@ -1592,7 +1634,7 @@ async function getMasterKey() {
     }
   }
   const keyPath = getKeyPath();
-  if (!existsSync7(keyPath)) {
+  if (!existsSync8(keyPath)) {
     process.stderr.write(
       `[keychain] Key not found at ${keyPath} (HOME=${os6.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
 `
@@ -1635,7 +1677,7 @@ async function deleteMasterKey() {
     }
   }
   const keyPath = getKeyPath();
-  if (existsSync7(keyPath)) {
+  if (existsSync8(keyPath)) {
     await unlink(keyPath);
   }
 }
@@ -2363,13 +2405,50 @@ var init_database_adapter = __esm({
   }
 });
 
+// src/lib/daemon-auth.ts
+import crypto2 from "crypto";
+import path9 from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+function normalizeToken(token) {
+  if (!token) return null;
+  const trimmed = token.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function readDaemonToken() {
+  try {
+    if (!existsSync9(DAEMON_TOKEN_PATH)) return null;
+    return normalizeToken(readFileSync6(DAEMON_TOKEN_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function ensureDaemonToken(seed) {
+  const existing = readDaemonToken();
+  if (existing) return existing;
+  const token = normalizeToken(seed) ?? crypto2.randomBytes(32).toString("hex");
+  ensurePrivateDirSync(EXE_AI_DIR);
+  writeFileSync5(DAEMON_TOKEN_PATH, `${token}
+`, "utf8");
+  enforcePrivateFileSync(DAEMON_TOKEN_PATH);
+  return token;
+}
+var DAEMON_TOKEN_PATH;
+var init_daemon_auth = __esm({
+  "src/lib/daemon-auth.ts"() {
+    "use strict";
+    init_config();
+    init_secure_files();
+    DAEMON_TOKEN_PATH = path9.join(EXE_AI_DIR, "exed.token");
+  }
+});
+
 // src/lib/exe-daemon-client.ts
 import net from "net";
 import os8 from "os";
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync8, unlinkSync as unlinkSync2, readFileSync as readFileSync6, openSync, closeSync, statSync } from "fs";
-import path9 from "path";
+import { existsSync as existsSync10, unlinkSync as unlinkSync2, readFileSync as readFileSync7, openSync, closeSync, statSync } from "fs";
+import path10 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function handleData(chunk) {
   _buffer += chunk.toString();
@@ -2397,9 +2476,9 @@ function handleData(chunk) {
   }
 }
 function cleanupStaleFiles() {
-  if (existsSync8(PID_PATH)) {
+  if (existsSync10(PID_PATH)) {
     try {
-      const pid = parseInt(readFileSync6(PID_PATH, "utf8").trim(), 10);
+      const pid = parseInt(readFileSync7(PID_PATH, "utf8").trim(), 10);
       if (pid > 0) {
         try {
           process.kill(pid, 0);
@@ -2420,11 +2499,11 @@ function cleanupStaleFiles() {
   }
 }
 function findPackageRoot() {
-  let dir = path9.dirname(fileURLToPath3(import.meta.url));
-  const { root } = path9.parse(dir);
+  let dir = path10.dirname(fileURLToPath3(import.meta.url));
+  const { root } = path10.parse(dir);
   while (dir !== root) {
-    if (existsSync8(path9.join(dir, "package.json"))) return dir;
-    dir = path9.dirname(dir);
+    if (existsSync10(path10.join(dir, "package.json"))) return dir;
+    dir = path10.dirname(dir);
   }
   return null;
 }
@@ -2450,16 +2529,17 @@ function spawnDaemon() {
     process.stderr.write("[exed-client] WARN: cannot find package root\n");
     return;
   }
-  const daemonPath = path9.join(pkgRoot, "dist", "lib", "exe-daemon.js");
-  if (!existsSync8(daemonPath)) {
+  const daemonPath = path10.join(pkgRoot, "dist", "lib", "exe-daemon.js");
+  if (!existsSync10(daemonPath)) {
     process.stderr.write(`[exed-client] WARN: daemon script not found at ${daemonPath}
 `);
     return;
   }
   const resolvedPath = daemonPath;
+  const daemonToken = ensureDaemonToken(process.env[DAEMON_TOKEN_ENV] ?? null);
   process.stderr.write(`[exed-client] Spawning daemon: ${resolvedPath}
 `);
-  const logPath = path9.join(path9.dirname(SOCKET_PATH), "exed.log");
+  const logPath = path10.join(path10.dirname(SOCKET_PATH), "exed.log");
   let stderrFd = "ignore";
   try {
     stderrFd = openSync(logPath, "a");
@@ -2477,7 +2557,8 @@ function spawnDaemon() {
       TMUX_PANE: void 0,
       // Prevents resolveExeSession() from scoping to one session
       EXE_DAEMON_SOCK: SOCKET_PATH,
-      EXE_DAEMON_PID: PID_PATH
+      EXE_DAEMON_PID: PID_PATH,
+      [DAEMON_TOKEN_ENV]: daemonToken
     }
   });
   child.unref();
@@ -2587,13 +2668,14 @@ function sendDaemonRequest(payload, timeoutMs = REQUEST_TIMEOUT_MS) {
       return;
     }
     const id = randomUUID();
+    const token = process.env[DAEMON_TOKEN_ENV] ?? readDaemonToken();
     const timer = setTimeout(() => {
       _pending.delete(id);
       resolve({ error: "Request timeout" });
     }, timeoutMs);
     _pending.set(id, { resolve, timer });
     try {
-      _socket.write(JSON.stringify({ id, ...payload }) + "\n");
+      _socket.write(JSON.stringify({ id, token, ...payload }) + "\n");
     } catch {
       clearTimeout(timer);
       _pending.delete(id);
@@ -2622,9 +2704,9 @@ function killAndRespawnDaemon() {
   }
   try {
     process.stderr.write("[exed-client] Killing daemon for restart...\n");
-    if (existsSync8(PID_PATH)) {
+    if (existsSync10(PID_PATH)) {
       try {
-        const pid = parseInt(readFileSync6(PID_PATH, "utf8").trim(), 10);
+        const pid = parseInt(readFileSync7(PID_PATH, "utf8").trim(), 10);
         if (pid > 0) {
           try {
             process.kill(pid, "SIGKILL");
@@ -2744,17 +2826,19 @@ function disconnectClient() {
 function isClientConnected() {
   return _connected;
 }
-var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, _socket, _connected, _buffer, _requestCount, _consecutiveFailures, HEALTH_CHECK_INTERVAL, MAX_RETRIES_BEFORE_RESTART, RETRY_DELAYS_MS, MIN_DAEMON_AGE_MS, _pending, MAX_BUFFER;
+var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, DAEMON_TOKEN_ENV, _socket, _connected, _buffer, _requestCount, _consecutiveFailures, HEALTH_CHECK_INTERVAL, MAX_RETRIES_BEFORE_RESTART, RETRY_DELAYS_MS, MIN_DAEMON_AGE_MS, _pending, MAX_BUFFER;
 var init_exe_daemon_client = __esm({
   "src/lib/exe-daemon-client.ts"() {
     "use strict";
     init_config();
-    SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path9.join(EXE_AI_DIR, "exed.sock");
-    PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path9.join(EXE_AI_DIR, "exed.pid");
-    SPAWN_LOCK_PATH = path9.join(EXE_AI_DIR, "exed-spawn.lock");
+    init_daemon_auth();
+    SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path10.join(EXE_AI_DIR, "exed.sock");
+    PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path10.join(EXE_AI_DIR, "exed.pid");
+    SPAWN_LOCK_PATH = path10.join(EXE_AI_DIR, "exed-spawn.lock");
     SPAWN_LOCK_STALE_MS = 3e4;
     CONNECT_TIMEOUT_MS = 15e3;
     REQUEST_TIMEOUT_MS = 3e4;
+    DAEMON_TOKEN_ENV = "EXE_DAEMON_TOKEN";
     _socket = null;
     _connected = false;
     _buffer = "";
@@ -3339,6 +3423,7 @@ async function ensureSchema() {
       project     TEXT NOT NULL,
       summary     TEXT NOT NULL,
       task_file   TEXT,
+      session_scope TEXT,
       read        INTEGER NOT NULL DEFAULT 0,
       created_at  TEXT NOT NULL
     );
@@ -3347,7 +3432,7 @@ async function ensureSchema() {
       ON notifications(read);
 
     CREATE INDEX IF NOT EXISTS idx_notifications_agent
-      ON notifications(agent_id);
+      ON notifications(agent_id, session_scope);
 
     CREATE INDEX IF NOT EXISTS idx_notifications_task_file
       ON notifications(task_file);
@@ -3385,6 +3470,7 @@ async function ensureSchema() {
       target_agent    TEXT NOT NULL,
       target_project  TEXT,
       target_device   TEXT NOT NULL DEFAULT 'local',
+      session_scope   TEXT,
       content         TEXT NOT NULL,
       priority        TEXT DEFAULT 'normal',
       status          TEXT DEFAULT 'pending',
@@ -3398,10 +3484,31 @@ async function ensureSchema() {
     );
 
     CREATE INDEX IF NOT EXISTS idx_messages_target
-      ON messages(target_agent, status);
+      ON messages(target_agent, session_scope, status);
 
     CREATE INDEX IF NOT EXISTS idx_messages_conversation_order
-      ON messages(target_agent, from_agent, server_seq);
+      ON messages(target_agent, session_scope, from_agent, server_seq);
+  `);
+  try {
+    await client.execute({
+      sql: `ALTER TABLE notifications ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE messages ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  await client.executeMultiple(`
+    CREATE INDEX IF NOT EXISTS idx_notifications_agent_scope_read
+      ON notifications(agent_id, session_scope, read, created_at);
+
+    CREATE INDEX IF NOT EXISTS idx_messages_target_scope_status
+      ON messages(target_agent, session_scope, status, created_at);
   `);
   try {
     await client.execute({
@@ -3985,6 +4092,13 @@ async function ensureSchema() {
     } catch {
     }
   }
+  try {
+    await client.execute({
+      sql: `UPDATE tasks SET status = 'closed' WHERE status = 'done' AND result IS NOT NULL`,
+      args: []
+    });
+  } catch {
+  }
 }
 async function disposeDatabase() {
   if (_walCheckpointTimer) {
@@ -4030,13 +4144,13 @@ __export(crypto_exports, {
   initSyncCrypto: () => initSyncCrypto,
   isSyncCryptoInitialized: () => isSyncCryptoInitialized
 });
-import crypto2 from "crypto";
+import crypto3 from "crypto";
 function initSyncCrypto(masterKey) {
   if (masterKey.length !== 32) {
     throw new Error(`Master key must be 32 bytes, got ${masterKey.length}`);
   }
   _syncKey = Buffer.from(
-    crypto2.hkdfSync("sha256", masterKey, "", SYNC_HKDF_INFO, 32)
+    crypto3.hkdfSync("sha256", masterKey, "", SYNC_HKDF_INFO, 32)
   );
 }
 function isSyncCryptoInitialized() {
@@ -4050,8 +4164,8 @@ function requireSyncKey() {
 }
 function encryptSyncBlob(data) {
   const key = requireSyncKey();
-  const iv = crypto2.randomBytes(IV_LENGTH);
-  const cipher = crypto2.createCipheriv(ALGORITHM, key, iv);
+  const iv = crypto3.randomBytes(IV_LENGTH);
+  const cipher = crypto3.createCipheriv(ALGORITHM, key, iv);
   const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
   const tag = cipher.getAuthTag();
   return Buffer.concat([iv, encrypted, tag]).toString("base64");
@@ -4065,7 +4179,7 @@ function decryptSyncBlob(ciphertext) {
   const iv = combined.subarray(0, IV_LENGTH);
   const tag = combined.subarray(combined.length - TAG_LENGTH);
   const encrypted = combined.subarray(IV_LENGTH, combined.length - TAG_LENGTH);
-  const decipher = crypto2.createDecipheriv(ALGORITHM, key, iv);
+  const decipher = crypto3.createDecipheriv(ALGORITHM, key, iv);
   decipher.setAuthTag(tag);
   return Buffer.concat([decipher.update(encrypted), decipher.final()]);
 }
@@ -4118,9 +4232,12 @@ __export(license_exports, {
   stopLicenseRevalidation: () => stopLicenseRevalidation,
   validateLicense: () => validateLicense
 });
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync9, mkdirSync as mkdirSync5 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync11, mkdirSync as mkdirSync4 } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
-import path10 from "path";
+import { createRequire as createRequire2 } from "module";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import os9 from "os";
+import path11 from "path";
 import { jwtVerify, importSPKI } from "jose";
 async function fetchRetry(url, init) {
   try {
@@ -4131,37 +4248,37 @@ async function fetchRetry(url, init) {
   }
 }
 function loadDeviceId() {
-  const deviceJsonPath = path10.join(EXE_AI_DIR, "device.json");
+  const deviceJsonPath = path11.join(EXE_AI_DIR, "device.json");
   try {
-    if (existsSync9(deviceJsonPath)) {
-      const data = JSON.parse(readFileSync7(deviceJsonPath, "utf8"));
+    if (existsSync11(deviceJsonPath)) {
+      const data = JSON.parse(readFileSync8(deviceJsonPath, "utf8"));
       if (data.deviceId) return data.deviceId;
     }
   } catch {
   }
   try {
-    if (existsSync9(DEVICE_ID_PATH)) {
-      const id2 = readFileSync7(DEVICE_ID_PATH, "utf8").trim();
+    if (existsSync11(DEVICE_ID_PATH)) {
+      const id2 = readFileSync8(DEVICE_ID_PATH, "utf8").trim();
       if (id2) return id2;
     }
   } catch {
   }
   const id = randomUUID2();
-  mkdirSync5(EXE_AI_DIR, { recursive: true });
-  writeFileSync5(DEVICE_ID_PATH, id, "utf8");
+  mkdirSync4(EXE_AI_DIR, { recursive: true });
+  writeFileSync6(DEVICE_ID_PATH, id, "utf8");
   return id;
 }
 function loadLicense() {
   try {
-    if (!existsSync9(LICENSE_PATH)) return null;
-    return readFileSync7(LICENSE_PATH, "utf8").trim();
+    if (!existsSync11(LICENSE_PATH)) return null;
+    return readFileSync8(LICENSE_PATH, "utf8").trim();
   } catch {
     return null;
   }
 }
 function saveLicense(apiKey) {
-  mkdirSync5(EXE_AI_DIR, { recursive: true });
-  writeFileSync5(LICENSE_PATH, apiKey.trim(), { encoding: "utf8", mode: 384 });
+  mkdirSync4(EXE_AI_DIR, { recursive: true });
+  writeFileSync6(LICENSE_PATH, apiKey.trim(), { encoding: "utf8", mode: 384 });
 }
 async function verifyLicenseJwt(token) {
   try {
@@ -4187,8 +4304,8 @@ async function verifyLicenseJwt(token) {
 }
 async function getCachedLicense() {
   try {
-    if (!existsSync9(CACHE_PATH)) return null;
-    const raw = JSON.parse(readFileSync7(CACHE_PATH, "utf8"));
+    if (!existsSync11(CACHE_PATH)) return null;
+    const raw = JSON.parse(readFileSync8(CACHE_PATH, "utf8"));
     if (!raw.token || typeof raw.token !== "string") return null;
     return await verifyLicenseJwt(raw.token);
   } catch {
@@ -4197,8 +4314,8 @@ async function getCachedLicense() {
 }
 function readCachedToken() {
   try {
-    if (!existsSync9(CACHE_PATH)) return null;
-    const raw = JSON.parse(readFileSync7(CACHE_PATH, "utf8"));
+    if (!existsSync11(CACHE_PATH)) return null;
+    const raw = JSON.parse(readFileSync8(CACHE_PATH, "utf8"));
     return typeof raw.token === "string" ? raw.token : null;
   } catch {
     return null;
@@ -4232,56 +4349,130 @@ function getRawCachedPlan() {
 }
 function cacheResponse(token) {
   try {
-    writeFileSync5(CACHE_PATH, JSON.stringify({ token }), "utf8");
+    writeFileSync6(CACHE_PATH, JSON.stringify({ token }), "utf8");
   } catch {
   }
 }
-async function validateLicense(apiKey, deviceId) {
-  const did = deviceId ?? loadDeviceId();
+function loadPrismaForLicense() {
+  if (_prismaFailed) return null;
+  const dbUrl = process.env.DATABASE_URL;
+  if (!dbUrl) {
+    const exeDbRoot = process.env.EXE_DB_ROOT ?? path11.join(os9.homedir(), "exe-db");
+    if (!existsSync11(path11.join(exeDbRoot, "package.json"))) {
+      _prismaFailed = true;
+      return null;
+    }
+  }
+  if (!_prismaPromise) {
+    _prismaPromise = (async () => {
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL2(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path11.join(os9.homedir(), "exe-db");
+      const req = createRequire2(path11.join(exeDbRoot, "package.json"));
+      const entry = req.resolve("@prisma/client");
+      const mod = await import(pathToFileURL2(entry).href);
+      const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+      if (!Ctor) throw new Error(`No PrismaClient in ${entry}`);
+      return new Ctor();
+    })().catch((err) => {
+      _prismaFailed = true;
+      _prismaPromise = null;
+      throw err;
+    });
+  }
+  return _prismaPromise;
+}
+async function validateViaPostgres(apiKey) {
+  const loader = loadPrismaForLicense();
+  if (!loader) return null;
+  try {
+    const prisma = await loader;
+    const rows = await prisma.$queryRawUnsafe(
+      `SELECT plan, email, status, device_limit, employee_limit, memory_limit, expires_at
+       FROM billing.licenses WHERE key = $1 LIMIT 1`,
+      apiKey
+    );
+    if (!rows || rows.length === 0) return null;
+    const row = rows[0];
+    if (row.status !== "active") return null;
+    if (row.expires_at && new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
+    const plan = row.plan;
+    const limits = PLAN_LIMITS[plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: true,
+      plan,
+      email: row.email,
+      expiresAt: row.expires_at ? new Date(row.expires_at).toISOString() : null,
+      deviceLimit: row.device_limit ?? limits.devices,
+      employeeLimit: row.employee_limit ?? limits.employees,
+      memoryLimit: row.memory_limit ?? limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+async function validateViaCFWorker(apiKey, deviceId) {
   try {
     const res = await fetchRetry(`${API_BASE}/auth/activate`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ apiKey, deviceId: did }),
+      body: JSON.stringify({ apiKey, deviceId }),
       signal: AbortSignal.timeout(1e4)
     });
-    if (res.ok) {
-      const data = await res.json();
-      if (data.error === "device_limit_exceeded") {
-        const cached2 = await getCachedLicense();
-        if (cached2) return cached2;
-        const raw2 = getRawCachedPlan();
-        if (raw2) return { ...raw2, valid: false };
-        return { ...FREE_LICENSE, valid: false, plan: "free" };
-      }
-      if (data.token) {
-        cacheResponse(data.token);
-        const verified = await verifyLicenseJwt(data.token);
-        if (verified) return verified;
-      }
-      const limits = PLAN_LIMITS[data.plan] ?? PLAN_LIMITS.free;
-      return {
-        valid: data.valid,
-        plan: data.plan,
-        email: data.email,
-        expiresAt: data.expiresAt,
-        deviceLimit: limits.devices,
-        employeeLimit: limits.employees,
-        memoryLimit: limits.memories
-      };
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (data.error === "device_limit_exceeded") return null;
+    if (!data.valid) return null;
+    if (data.token) {
+      cacheResponse(data.token);
+      const verified = await verifyLicenseJwt(data.token);
+      if (verified) return verified;
+    }
+    const limits = PLAN_LIMITS[data.plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: data.valid,
+      plan: data.plan,
+      email: data.email,
+      expiresAt: data.expiresAt,
+      deviceLimit: limits.devices,
+      employeeLimit: limits.employees,
+      memoryLimit: limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+async function validateLicense(apiKey, deviceId) {
+  const did = deviceId ?? loadDeviceId();
+  const pgResult = await validateViaPostgres(apiKey);
+  if (pgResult) {
+    try {
+      writeFileSync6(CACHE_PATH, JSON.stringify({ pgLicense: pgResult, ts: Date.now() }), "utf8");
+    } catch {
+    }
+    return pgResult;
+  }
+  const cfResult = await validateViaCFWorker(apiKey, did);
+  if (cfResult) return cfResult;
+  const cached = await getCachedLicense();
+  if (cached) return cached;
+  try {
+    if (existsSync11(CACHE_PATH)) {
+      const raw = JSON.parse(readFileSync8(CACHE_PATH, "utf8"));
+      if (raw.pgLicense && raw.ts && Date.now() - raw.ts < 7 * 24 * 60 * 60 * 1e3) {
+        return raw.pgLicense;
+      }
     }
-    const cached = await getCachedLicense();
-    if (cached) return cached;
-    const raw = getRawCachedPlan();
-    if (raw) return raw;
-    return { ...FREE_LICENSE, valid: false, plan: "free" };
   } catch {
-    const cached = await getCachedLicense();
-    if (cached) return cached;
-    const rawFallback = getRawCachedPlan();
-    if (rawFallback) return rawFallback;
-    return { ...FREE_LICENSE, valid: false, error: "offline" };
   }
+  const rawFallback = getRawCachedPlan();
+  if (rawFallback) return rawFallback;
+  return { ...FREE_LICENSE, valid: false };
 }
 function getCacheAgeMs() {
   try {
@@ -4296,9 +4487,9 @@ async function checkLicense() {
   let key = loadLicense();
   if (!key) {
     try {
-      const configPath = path10.join(EXE_AI_DIR, "config.json");
-      if (existsSync9(configPath)) {
-        const raw = JSON.parse(readFileSync7(configPath, "utf8"));
+      const configPath = path11.join(EXE_AI_DIR, "config.json");
+      if (existsSync11(configPath)) {
+        const raw = JSON.parse(readFileSync8(configPath, "utf8"));
         const cloud = raw.cloud;
         if (cloud?.apiKey) {
           key = cloud.apiKey;
@@ -4452,14 +4643,14 @@ function stopLicenseRevalidation() {
     _revalTimer = null;
   }
 }
-var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, API_BASE, RETRY_DELAY_MS, LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG, PLAN_LIMITS, FREE_LICENSE, CACHE_MAX_AGE_MS, _revalTimer;
+var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, API_BASE, RETRY_DELAY_MS, LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG, PLAN_LIMITS, FREE_LICENSE, _prismaPromise, _prismaFailed, CACHE_MAX_AGE_MS, _revalTimer;
 var init_license = __esm({
   "src/lib/license.ts"() {
     "use strict";
     init_config();
-    LICENSE_PATH = path10.join(EXE_AI_DIR, "license.key");
-    CACHE_PATH = path10.join(EXE_AI_DIR, "license-cache.json");
-    DEVICE_ID_PATH = path10.join(EXE_AI_DIR, "device-id");
+    LICENSE_PATH = path11.join(EXE_AI_DIR, "license.key");
+    CACHE_PATH = path11.join(EXE_AI_DIR, "license-cache.json");
+    DEVICE_ID_PATH = path11.join(EXE_AI_DIR, "device-id");
     API_BASE = "https://askexe.com/cloud";
     RETRY_DELAY_MS = 500;
     LICENSE_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
@@ -4483,6 +4674,8 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
       employeeLimit: 1,
       memoryLimit: 5e3
     };
+    _prismaPromise = null;
+    _prismaFailed = false;
     CACHE_MAX_AGE_MS = 36e5;
     _revalTimer = null;
   }
@@ -4507,8 +4700,8 @@ __export(crdt_sync_exports, {
   rebuildFromDb: () => rebuildFromDb
 });
 import * as Y from "yjs";
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync10, mkdirSync as mkdirSync6, unlinkSync as unlinkSync3 } from "fs";
-import path11 from "path";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, existsSync as existsSync12, mkdirSync as mkdirSync5, unlinkSync as unlinkSync3 } from "fs";
+import path12 from "path";
 import { homedir } from "os";
 function getStatePath() {
   return _statePathOverride ?? DEFAULT_STATE_PATH;
@@ -4520,9 +4713,9 @@ function initCrdtDoc() {
   if (doc) return doc;
   doc = new Y.Doc();
   const sp = getStatePath();
-  if (existsSync10(sp)) {
+  if (existsSync12(sp)) {
     try {
-      const state = readFileSync8(sp);
+      const state = readFileSync9(sp);
       Y.applyUpdate(doc, new Uint8Array(state));
     } catch {
       console.warn("[crdt-sync] WARN: corrupted state file, rebuilding from DB");
@@ -4664,10 +4857,10 @@ function persistState() {
   if (!doc) return;
   try {
     const sp = getStatePath();
-    const dir = path11.dirname(sp);
-    if (!existsSync10(dir)) mkdirSync6(dir, { recursive: true });
+    const dir = path12.dirname(sp);
+    if (!existsSync12(dir)) mkdirSync5(dir, { recursive: true });
     const state = Y.encodeStateAsUpdate(doc);
-    writeFileSync6(sp, Buffer.from(state));
+    writeFileSync7(sp, Buffer.from(state));
   } catch {
   }
 }
@@ -4708,7 +4901,7 @@ var DEFAULT_STATE_PATH, _statePathOverride, doc;
 var init_crdt_sync = __esm({
   "src/lib/crdt-sync.ts"() {
     "use strict";
-    DEFAULT_STATE_PATH = path11.join(homedir(), ".exe-os", "crdt-state.bin");
+    DEFAULT_STATE_PATH = path12.join(homedir(), ".exe-os", "crdt-state.bin");
     _statePathOverride = null;
     doc = null;
   }
@@ -4740,39 +4933,107 @@ __export(cloud_sync_exports, {
   cloudSync: () => cloudSync,
   mergeConfig: () => mergeConfig,
   mergeRosterFromRemote: () => mergeRosterFromRemote,
+  pushToPostgres: () => pushToPostgres,
   recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, existsSync as existsSync11, readdirSync, mkdirSync as mkdirSync7, appendFileSync, unlinkSync as unlinkSync4, openSync as openSync2, closeSync as closeSync2 } from "fs";
-import crypto3 from "crypto";
-import path12 from "path";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync8, existsSync as existsSync13, readdirSync, mkdirSync as mkdirSync6, appendFileSync, unlinkSync as unlinkSync4, openSync as openSync2, closeSync as closeSync2 } from "fs";
+import crypto4 from "crypto";
+import path13 from "path";
 import { homedir as homedir2 } from "os";
 function sqlSafe(v) {
   return v === void 0 ? null : v;
 }
 function logError(msg) {
   try {
-    const logPath = path12.join(homedir2(), ".exe-os", "workers.log");
+    const logPath = path13.join(homedir2(), ".exe-os", "workers.log");
     appendFileSync(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
   }
 }
+function loadPgClient() {
+  if (_pgFailed) return null;
+  const postgresUrl = process.env.DATABASE_URL;
+  const configPath = path13.join(EXE_AI_DIR, "config.json");
+  let cloudPostgresUrl;
+  try {
+    if (existsSync13(configPath)) {
+      const cfg = JSON.parse(readFileSync10(configPath, "utf8"));
+      cloudPostgresUrl = cfg.cloud?.postgresUrl;
+      if (cfg.cloud?.syncToPostgres === false) {
+        _pgFailed = true;
+        return null;
+      }
+    }
+  } catch {
+  }
+  const url = postgresUrl || cloudPostgresUrl;
+  if (!url) {
+    _pgFailed = true;
+    return null;
+  }
+  if (!_pgPromise) {
+    _pgPromise = (async () => {
+      const { createRequire: createRequire3 } = await import("module");
+      const { pathToFileURL: pathToFileURL3 } = await import("url");
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path13.join(homedir2(), "exe-db");
+      const req = createRequire3(path13.join(exeDbRoot, "package.json"));
+      const entry = req.resolve("@prisma/client");
+      const mod = await import(pathToFileURL3(entry).href);
+      const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+      if (!Ctor) throw new Error("No PrismaClient");
+      return new Ctor();
+    })().catch(() => {
+      _pgFailed = true;
+      _pgPromise = null;
+      throw new Error("pg_unavailable");
+    });
+  }
+  return _pgPromise;
+}
+async function pushToPostgres(records) {
+  const loader = loadPgClient();
+  if (!loader) return 0;
+  let prisma;
+  try {
+    prisma = await loader;
+  } catch {
+    return 0;
+  }
+  let inserted = 0;
+  for (const rec of records) {
+    try {
+      await prisma.$executeRawUnsafe(
+        `INSERT INTO raw.raw_events (id, source, source_id, event_type, payload, metadata, timestamp)
+         VALUES (gen_random_uuid(), 'cloud_sync', $1, 'memory', $2::jsonb, $3::jsonb, $4)
+         ON CONFLICT (source, source_id, event_type) DO NOTHING`,
+        String(rec.id ?? ""),
+        JSON.stringify(rec),
+        JSON.stringify({ agent_id: rec.agent_id, project_name: rec.project_name, tool_name: rec.tool_name }),
+        rec.timestamp ? new Date(String(rec.timestamp)) : /* @__PURE__ */ new Date()
+      );
+      inserted++;
+    } catch {
+    }
+  }
+  return inserted;
+}
 async function withRosterLock(fn) {
   try {
     const fd = openSync2(ROSTER_LOCK_PATH, "wx");
     closeSync2(fd);
-    writeFileSync7(ROSTER_LOCK_PATH, String(Date.now()));
+    writeFileSync8(ROSTER_LOCK_PATH, String(Date.now()));
   } catch (err) {
     if (err.code === "EEXIST") {
       try {
-        const ts = parseInt(readFileSync9(ROSTER_LOCK_PATH, "utf-8"), 10);
+        const ts = parseInt(readFileSync10(ROSTER_LOCK_PATH, "utf-8"), 10);
         if (Date.now() - ts < LOCK_STALE_MS) {
           throw new Error("Roster merge already in progress \u2014 another sync is running");
         }
         unlinkSync4(ROSTER_LOCK_PATH);
         const fd = openSync2(ROSTER_LOCK_PATH, "wx");
         closeSync2(fd);
-        writeFileSync7(ROSTER_LOCK_PATH, String(Date.now()));
+        writeFileSync8(ROSTER_LOCK_PATH, String(Date.now()));
       } catch (retryErr) {
         if (retryErr instanceof Error && retryErr.message.includes("already in progress")) throw retryErr;
         throw new Error("Roster merge already in progress \u2014 another sync is running");
@@ -5042,6 +5303,10 @@ async function cloudSync(config) {
     const maxVersion = Number(records[records.length - 1].version);
     const pushOk = await cloudPush(records, maxVersion, config);
     if (!pushOk) break;
+    try {
+      await pushToPostgres(records);
+    } catch {
+    }
     await client.execute({
       sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_push_version', ?)",
       args: [String(maxVersion)]
@@ -5146,8 +5411,8 @@ async function cloudSync(config) {
   try {
     const employees = await loadEmployees();
     rosterResult.employees = employees.length;
-    const idDir = path12.join(EXE_AI_DIR, "identity");
-    if (existsSync11(idDir)) {
+    const idDir = path13.join(EXE_AI_DIR, "identity");
+    if (existsSync13(idDir)) {
       rosterResult.identities = readdirSync(idDir).filter((f) => f.endsWith(".md")).length;
     }
   } catch {
@@ -5168,62 +5433,62 @@ async function cloudSync(config) {
 function recordRosterDeletion(name) {
   let deletions = [];
   try {
-    if (existsSync11(ROSTER_DELETIONS_PATH)) {
-      deletions = JSON.parse(readFileSync9(ROSTER_DELETIONS_PATH, "utf-8"));
+    if (existsSync13(ROSTER_DELETIONS_PATH)) {
+      deletions = JSON.parse(readFileSync10(ROSTER_DELETIONS_PATH, "utf-8"));
     }
   } catch {
   }
   if (!deletions.includes(name)) deletions.push(name);
-  writeFileSync7(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
+  writeFileSync8(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
 }
 function consumeRosterDeletions() {
   try {
-    if (!existsSync11(ROSTER_DELETIONS_PATH)) return [];
-    const deletions = JSON.parse(readFileSync9(ROSTER_DELETIONS_PATH, "utf-8"));
-    writeFileSync7(ROSTER_DELETIONS_PATH, "[]");
+    if (!existsSync13(ROSTER_DELETIONS_PATH)) return [];
+    const deletions = JSON.parse(readFileSync10(ROSTER_DELETIONS_PATH, "utf-8"));
+    writeFileSync8(ROSTER_DELETIONS_PATH, "[]");
     return deletions;
   } catch {
     return [];
   }
 }
 function buildRosterBlob(paths) {
-  const rosterPath = paths?.rosterPath ?? path12.join(EXE_AI_DIR, "exe-employees.json");
-  const identityDir = paths?.identityDir ?? path12.join(EXE_AI_DIR, "identity");
-  const configPath = paths?.configPath ?? path12.join(EXE_AI_DIR, "config.json");
+  const rosterPath = paths?.rosterPath ?? path13.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path13.join(EXE_AI_DIR, "identity");
+  const configPath = paths?.configPath ?? path13.join(EXE_AI_DIR, "config.json");
   let roster = [];
-  if (existsSync11(rosterPath)) {
+  if (existsSync13(rosterPath)) {
     try {
-      roster = JSON.parse(readFileSync9(rosterPath, "utf-8"));
+      roster = JSON.parse(readFileSync10(rosterPath, "utf-8"));
     } catch {
     }
   }
   const identities = {};
-  if (existsSync11(identityDir)) {
+  if (existsSync13(identityDir)) {
     for (const file of readdirSync(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
-        identities[file] = readFileSync9(path12.join(identityDir, file), "utf-8");
+        identities[file] = readFileSync10(path13.join(identityDir, file), "utf-8");
       } catch {
       }
     }
   }
   let config;
-  if (existsSync11(configPath)) {
+  if (existsSync13(configPath)) {
     try {
-      config = JSON.parse(readFileSync9(configPath, "utf-8"));
+      config = JSON.parse(readFileSync10(configPath, "utf-8"));
     } catch {
     }
   }
   let agentConfig;
-  const agentConfigPath = path12.join(EXE_AI_DIR, "agent-config.json");
-  if (existsSync11(agentConfigPath)) {
+  const agentConfigPath = path13.join(EXE_AI_DIR, "agent-config.json");
+  if (existsSync13(agentConfigPath)) {
     try {
-      agentConfig = JSON.parse(readFileSync9(agentConfigPath, "utf-8"));
+      agentConfig = JSON.parse(readFileSync10(agentConfigPath, "utf-8"));
     } catch {
     }
   }
   const deletedNames = consumeRosterDeletions();
   const content = JSON.stringify({ roster, identities, config, agentConfig, deletedNames });
-  const hash = crypto3.createHash("sha256").update(content).digest("hex").slice(0, 16);
+  const hash = crypto4.createHash("sha256").update(content).digest("hex").slice(0, 16);
   return { roster, identities, config, agentConfig, deletedNames, version: hash };
 }
 async function cloudPushRoster(config) {
@@ -5293,23 +5558,24 @@ async function cloudPullRoster(config) {
   }
 }
 function mergeConfig(remoteConfig, configPath) {
-  const cfgPath = configPath ?? path12.join(EXE_AI_DIR, "config.json");
+  const cfgPath = configPath ?? path13.join(EXE_AI_DIR, "config.json");
   let local = {};
-  if (existsSync11(cfgPath)) {
+  if (existsSync13(cfgPath)) {
     try {
-      local = JSON.parse(readFileSync9(cfgPath, "utf-8"));
+      local = JSON.parse(readFileSync10(cfgPath, "utf-8"));
     } catch {
     }
   }
   const merged = { ...remoteConfig, ...local };
-  const dir = path12.dirname(cfgPath);
-  if (!existsSync11(dir)) mkdirSync7(dir, { recursive: true });
-  writeFileSync7(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
+  const dir = path13.dirname(cfgPath);
+  ensurePrivateDirSync(dir);
+  writeFileSync8(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
+  enforcePrivateFileSync(cfgPath);
 }
 async function mergeRosterFromRemote(remote, paths) {
   return withRosterLock(async () => {
     const rosterPath = paths?.rosterPath ?? void 0;
-    const identityDir = paths?.identityDir ?? path12.join(EXE_AI_DIR, "identity");
+    const identityDir = paths?.identityDir ?? path13.join(EXE_AI_DIR, "identity");
     const localEmployees = await loadEmployees(rosterPath);
     const localNames = new Set(localEmployees.map((e) => e.name));
     let added = 0;
@@ -5330,15 +5596,15 @@ async function mergeRosterFromRemote(remote, paths) {
       ) ?? lookupKey;
       const remoteIdentity = remote.identities[matchedKey];
       if (remoteIdentity) {
-        if (!existsSync11(identityDir)) mkdirSync7(identityDir, { recursive: true });
-        const idPath = path12.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync13(identityDir)) mkdirSync6(identityDir, { recursive: true });
+        const idPath = path13.join(identityDir, `${remoteEmp.name}.md`);
         let localIdentity = null;
         try {
-          localIdentity = existsSync11(idPath) ? readFileSync9(idPath, "utf-8") : null;
+          localIdentity = existsSync13(idPath) ? readFileSync10(idPath, "utf-8") : null;
         } catch {
         }
         if (localIdentity !== remoteIdentity) {
-          writeFileSync7(idPath, remoteIdentity, "utf-8");
+          writeFileSync8(idPath, remoteIdentity, "utf-8");
           identitiesUpdated++;
         }
       }
@@ -5364,16 +5630,18 @@ async function mergeRosterFromRemote(remote, paths) {
     }
     if (remote.agentConfig && Object.keys(remote.agentConfig).length > 0) {
       try {
-        const agentConfigPath = path12.join(EXE_AI_DIR, "agent-config.json");
+        const agentConfigPath = path13.join(EXE_AI_DIR, "agent-config.json");
         let local = {};
-        if (existsSync11(agentConfigPath)) {
+        if (existsSync13(agentConfigPath)) {
           try {
-            local = JSON.parse(readFileSync9(agentConfigPath, "utf-8"));
+            local = JSON.parse(readFileSync10(agentConfigPath, "utf-8"));
           } catch {
           }
         }
         const merged = { ...remote.agentConfig, ...local };
-        writeFileSync7(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+        ensurePrivateDirSync(path13.dirname(agentConfigPath));
+        writeFileSync8(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+        enforcePrivateFileSync(agentConfigPath);
       } catch {
       }
     }
@@ -5797,7 +6065,7 @@ async function cloudPullDocuments(config) {
   }
   return { pulled };
 }
-var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, ROSTER_DELETIONS_PATH;
+var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, _pgPromise, _pgFailed, ROSTER_DELETIONS_PATH;
 var init_cloud_sync = __esm({
   "src/lib/cloud-sync.ts"() {
     "use strict";
@@ -5808,12 +6076,15 @@ var init_cloud_sync = __esm({
     init_config();
     init_crdt_sync();
     init_employees();
+    init_secure_files();
     LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
     FETCH_TIMEOUT_MS = 3e4;
     PUSH_BATCH_SIZE = 5e3;
-    ROSTER_LOCK_PATH = path12.join(EXE_AI_DIR, "roster-merge.lock");
+    ROSTER_LOCK_PATH = path13.join(EXE_AI_DIR, "roster-merge.lock");
     LOCK_STALE_MS = 3e4;
-    ROSTER_DELETIONS_PATH = path12.join(EXE_AI_DIR, "roster-deletions.json");
+    _pgPromise = null;
+    _pgFailed = false;
+    ROSTER_DELETIONS_PATH = path13.join(EXE_AI_DIR, "roster-deletions.json");
   }
 });
 
@@ -6111,6 +6382,7 @@ var shard_manager_exports = {};
 __export(shard_manager_exports, {
   disposeShards: () => disposeShards,
   ensureShardSchema: () => ensureShardSchema,
+  getOpenShardCount: () => getOpenShardCount,
   getReadyShardClient: () => getReadyShardClient,
   getShardClient: () => getShardClient,
   getShardsDir: () => getShardsDir,
@@ -6119,15 +6391,18 @@ __export(shard_manager_exports, {
   listShards: () => listShards,
   shardExists: () => shardExists
 });
-import path13 from "path";
-import { existsSync as existsSync12, mkdirSync as mkdirSync8, readdirSync as readdirSync2 } from "fs";
+import path14 from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, readdirSync as readdirSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
-  if (!existsSync12(SHARDS_DIR)) {
-    mkdirSync8(SHARDS_DIR, { recursive: true });
+  if (!existsSync14(SHARDS_DIR)) {
+    mkdirSync7(SHARDS_DIR, { recursive: true });
   }
   _shardingEnabled = true;
+  if (_evictionTimer) clearInterval(_evictionTimer);
+  _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
+  _evictionTimer.unref();
 }
 function isShardingEnabled() {
   return _shardingEnabled;
@@ -6144,21 +6419,28 @@ function getShardClient(projectName) {
     throw new Error(`Invalid project name for shard: "${projectName}"`);
   }
   const cached = _shards.get(safeName);
-  if (cached) return cached;
-  const dbPath = path13.join(SHARDS_DIR, `${safeName}.db`);
+  if (cached) {
+    _shardLastAccess.set(safeName, Date.now());
+    return cached;
+  }
+  while (_shards.size >= MAX_OPEN_SHARDS) {
+    evictLRU();
+  }
+  const dbPath = path14.join(SHARDS_DIR, `${safeName}.db`);
   const client = createClient2({
     url: `file:${dbPath}`,
     encryptionKey: _encryptionKey
   });
   _shards.set(safeName, client);
+  _shardLastAccess.set(safeName, Date.now());
   return client;
 }
 function shardExists(projectName) {
   const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return existsSync12(path13.join(SHARDS_DIR, `${safeName}.db`));
+  return existsSync14(path14.join(SHARDS_DIR, `${safeName}.db`));
 }
 function listShards() {
-  if (!existsSync12(SHARDS_DIR)) return [];
+  if (!existsSync14(SHARDS_DIR)) return [];
   return readdirSync2(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
@@ -6210,6 +6492,8 @@ async function ensureShardSchema(client) {
   for (const col of [
     "ALTER TABLE memories ADD COLUMN task_id TEXT",
     "ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN author_device_id TEXT",
+    "ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'",
     "ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5",
     "ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'",
     "ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0",
@@ -6347,21 +6631,69 @@ async function getReadyShardClient(projectName) {
   await ensureShardSchema(client);
   return client;
 }
+function evictLRU() {
+  let oldest = null;
+  let oldestTime = Infinity;
+  for (const [name, time] of _shardLastAccess) {
+    if (time < oldestTime) {
+      oldestTime = time;
+      oldest = name;
+    }
+  }
+  if (oldest) {
+    const client = _shards.get(oldest);
+    if (client) {
+      client.close();
+    }
+    _shards.delete(oldest);
+    _shardLastAccess.delete(oldest);
+  }
+}
+function evictIdleShards() {
+  const now = Date.now();
+  const toEvict = [];
+  for (const [name, lastAccess] of _shardLastAccess) {
+    if (now - lastAccess > SHARD_IDLE_MS) {
+      toEvict.push(name);
+    }
+  }
+  for (const name of toEvict) {
+    const client = _shards.get(name);
+    if (client) {
+      client.close();
+    }
+    _shards.delete(name);
+    _shardLastAccess.delete(name);
+  }
+}
+function getOpenShardCount() {
+  return _shards.size;
+}
 function disposeShards() {
+  if (_evictionTimer) {
+    clearInterval(_evictionTimer);
+    _evictionTimer = null;
+  }
   for (const [, client] of _shards) {
     client.close();
   }
   _shards.clear();
+  _shardLastAccess.clear();
   _shardingEnabled = false;
   _encryptionKey = null;
 }
-var SHARDS_DIR, _shards, _encryptionKey, _shardingEnabled;
+var SHARDS_DIR, SHARD_IDLE_MS, MAX_OPEN_SHARDS, EVICTION_INTERVAL_MS, _shards, _shardLastAccess, _evictionTimer, _encryptionKey, _shardingEnabled;
 var init_shard_manager = __esm({
   "src/lib/shard-manager.ts"() {
     "use strict";
     init_config();
-    SHARDS_DIR = path13.join(EXE_AI_DIR, "shards");
+    SHARDS_DIR = path14.join(EXE_AI_DIR, "shards");
+    SHARD_IDLE_MS = 5 * 60 * 1e3;
+    MAX_OPEN_SHARDS = 10;
+    EVICTION_INTERVAL_MS = 60 * 1e3;
     _shards = /* @__PURE__ */ new Map();
+    _shardLastAccess = /* @__PURE__ */ new Map();
+    _evictionTimer = null;
     _encryptionKey = null;
     _shardingEnabled = false;
   }
@@ -7129,15 +7461,15 @@ var backfill_conversations_exports = {};
 __export(backfill_conversations_exports, {
   backfillConversations: () => backfillConversations
 });
-import crypto4 from "crypto";
+import crypto5 from "crypto";
 import { createReadStream } from "fs";
 import { readdir as readdir2, stat } from "fs/promises";
-import path14 from "path";
+import path15 from "path";
 import { createInterface as createInterface2 } from "readline";
 import { homedir as homedir3 } from "os";
 import { parseArgs } from "util";
 async function findJsonlFiles(sinceDate, projectFilter) {
-  const projectsDir = path14.join(homedir3(), ".claude", "projects");
+  const projectsDir = path15.join(homedir3(), ".claude", "projects");
   const files = [];
   async function walk(dir, depth = 0) {
     if (depth > MAX_WALK_DEPTH) return;
@@ -7148,7 +7480,7 @@ async function findJsonlFiles(sinceDate, projectFilter) {
       return;
     }
     for (const entry of entries) {
-      const full = path14.join(dir, entry.name);
+      const full = path15.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "subagents" || entry.name === "tool-results") continue;
         await walk(full, depth + 1);
@@ -7173,7 +7505,7 @@ async function findJsonlFiles(sinceDate, projectFilter) {
       if (!entry.isDirectory()) continue;
       const decoded = decodeProjectDir(entry.name);
       if (decoded.toLowerCase().includes(projectFilter.toLowerCase())) {
-        await walk(path14.join(projectsDir, entry.name));
+        await walk(path15.join(projectsDir, entry.name));
       }
     }
   } else {
@@ -7190,14 +7522,14 @@ function decodeProjectDir(dirName) {
   return dirName;
 }
 function projectNameFromPath(filePath) {
-  const projectsDir = path14.join(homedir3(), ".claude", "projects");
-  const relative = path14.relative(projectsDir, filePath);
-  const projectDir = relative.split(path14.sep)[0] ?? "unknown";
+  const projectsDir = path15.join(homedir3(), ".claude", "projects");
+  const relative = path15.relative(projectsDir, filePath);
+  const projectDir = relative.split(path15.sep)[0] ?? "unknown";
   return decodeProjectDir(projectDir);
 }
 async function parseConversation(filePath) {
   const conv = {
-    sessionId: path14.basename(filePath, ".jsonl"),
+    sessionId: path15.basename(filePath, ".jsonl"),
     projectName: projectNameFromPath(filePath),
     cwd: void 0,
     startTime: void 0,
@@ -7261,7 +7593,7 @@ async function parseConversation(filePath) {
     }
   }
   if (conv.cwd) {
-    conv.projectName = path14.basename(conv.cwd);
+    conv.projectName = path15.basename(conv.cwd);
     const worktreeMatch = conv.cwd.match(/\.worktrees\/([^/]+)/);
     if (worktreeMatch?.[1]) {
       conv.agentId = worktreeMatch[1];
@@ -7434,7 +7766,7 @@ async function backfillConversations(options) {
         }
       }
       await writeMemory({
-        id: crypto4.randomUUID(),
+        id: crypto5.randomUUID(),
         agent_id: conv.agentId,
         agent_role: isCoordinatorName(conv.agentId) ? "COO" : "specialist",
         session_id: conv.sessionId,
@@ -7913,9 +8245,9 @@ Unclassified: ${unclassified}
 }
 async function exportBatches(options) {
   const fs8 = await import("fs");
-  const path45 = await import("path");
+  const path46 = await import("path");
   const client = getClient();
-  const outDir = path45.join(process.cwd(), "exe/output/classifications/input");
+  const outDir = path46.join(process.cwd(), "exe/output/classifications/input");
   fs8.mkdirSync(outDir, { recursive: true });
   const countResult = await client.execute({
     sql: "SELECT COUNT(*) as cnt FROM memories WHERE intent IS NULL AND outcome IS NULL AND domain IS NULL",
@@ -7939,7 +8271,7 @@ async function exportBatches(options) {
       const text = String(row.text || "").replace(/\n/g, " ");
       return JSON.stringify({ id: row.id, text });
     });
-    const batchFile = path45.join(outDir, `batch-${String(batchNum).padStart(4, "0")}.jsonl`);
+    const batchFile = path46.join(outDir, `batch-${String(batchNum).padStart(4, "0")}.jsonl`);
     fs8.writeFileSync(batchFile, lines.join("\n") + "\n");
     exported += batch.rows.length;
     offset += options.batchSize;
@@ -7955,7 +8287,7 @@ async function exportBatches(options) {
 }
 async function importClassifications(importDir) {
   const fs8 = await import("fs");
-  const path45 = await import("path");
+  const path46 = await import("path");
   const client = getClient();
   const files = fs8.readdirSync(importDir).filter((f) => f.endsWith(".jsonl")).sort();
   process.stderr.write(`[backfill-metadata] Found ${files.length} JSONL files to import from ${importDir}
@@ -7963,7 +8295,7 @@ async function importClassifications(importDir) {
   let imported = 0;
   let invalid = 0;
   for (const file of files) {
-    const lines = fs8.readFileSync(path45.join(importDir, file), "utf-8").split("\n").filter(Boolean);
+    const lines = fs8.readFileSync(path46.join(importDir, file), "utf-8").split("\n").filter(Boolean);
     for (const line of lines) {
       try {
         const rec = JSON.parse(line);
@@ -8104,17 +8436,17 @@ __export(identity_exports, {
   listIdentities: () => listIdentities,
   updateIdentity: () => updateIdentity
 });
-import { existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
 import { readdirSync as readdirSync3 } from "fs";
-import path15 from "path";
+import path16 from "path";
 import { createHash as createHash2 } from "crypto";
 function ensureDir() {
-  if (!existsSync13(IDENTITY_DIR2)) {
-    mkdirSync9(IDENTITY_DIR2, { recursive: true });
+  if (!existsSync15(IDENTITY_DIR2)) {
+    mkdirSync8(IDENTITY_DIR2, { recursive: true });
   }
 }
 function identityPath(agentId) {
-  return path15.join(IDENTITY_DIR2, `${agentId}.md`);
+  return path16.join(IDENTITY_DIR2, `${agentId}.md`);
 }
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
@@ -8155,8 +8487,8 @@ function contentHash(content) {
 }
 function getIdentity(agentId) {
   const filePath = identityPath(agentId);
-  if (!existsSync13(filePath)) return null;
-  const raw = readFileSync10(filePath, "utf-8");
+  if (!existsSync15(filePath)) return null;
+  const raw = readFileSync11(filePath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(raw);
   return {
     agentId,
@@ -8170,7 +8502,7 @@ async function updateIdentity(agentId, content, updatedBy) {
   ensureDir();
   const filePath = identityPath(agentId);
   const hash = contentHash(content);
-  writeFileSync8(filePath, content, "utf-8");
+  writeFileSync9(filePath, content, "utf-8");
   try {
     const client = getClient();
     await client.execute({
@@ -8226,15 +8558,15 @@ var init_identity = __esm({
     "use strict";
     init_config();
     init_database();
-    IDENTITY_DIR2 = path15.join(EXE_AI_DIR, "identity");
+    IDENTITY_DIR2 = path16.join(EXE_AI_DIR, "identity");
   }
 });
 
 // src/lib/orchestration-package.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { copyFileSync as copyFileSync2, existsSync as existsSync14, mkdirSync as mkdirSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
-import os9 from "os";
-import path16 from "path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync16, mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync10 } from "fs";
+import os10 from "os";
+import path17 from "path";
 function ensureObject(value, label) {
   if (value == null || Array.isArray(value) || typeof value !== "object") {
     throw new Error(`${label} must be an object`);
@@ -8293,15 +8625,15 @@ function validateProcedureEntry(value, index) {
   };
 }
 function getRosterPath() {
-  return path16.join(os9.homedir(), EXE_OS_DIRNAME, ROSTER_FILENAME);
+  return path17.join(os10.homedir(), EXE_OS_DIRNAME, ROSTER_FILENAME);
 }
 function getBackupPath() {
-  return path16.join(os9.homedir(), EXE_OS_DIRNAME, ROSTER_BACKUP_FILENAME);
+  return path17.join(os10.homedir(), EXE_OS_DIRNAME, ROSTER_BACKUP_FILENAME);
 }
 function readRosterFile() {
   const rosterPath = getRosterPath();
-  if (!existsSync14(rosterPath)) return [];
-  const raw = readFileSync11(rosterPath, "utf-8");
+  if (!existsSync16(rosterPath)) return [];
+  const raw = readFileSync12(rosterPath, "utf-8");
   const parsed = JSON.parse(raw);
   if (!Array.isArray(parsed)) {
     throw new Error("Roster file must contain a JSON array");
@@ -8313,8 +8645,8 @@ function writeRosterFile(roster) {
     throw new Error("Refusing to write empty roster \u2014 this would delete all employees");
   }
   const rosterPath = getRosterPath();
-  mkdirSync10(path16.dirname(rosterPath), { recursive: true });
-  if (existsSync14(rosterPath)) {
+  mkdirSync9(path17.dirname(rosterPath), { recursive: true });
+  if (existsSync16(rosterPath)) {
     const currentRoster = readRosterFile();
     if (roster.length < currentRoster.length) {
       throw new Error(
@@ -8323,7 +8655,7 @@ function writeRosterFile(roster) {
     }
     copyFileSync2(rosterPath, getBackupPath());
   }
-  writeFileSync9(rosterPath, `${JSON.stringify(roster, null, 2)}
+  writeFileSync10(rosterPath, `${JSON.stringify(roster, null, 2)}
 `, "utf-8");
 }
 function buildImportedRosterEntries(roster, timestamp) {
@@ -8590,8 +8922,8 @@ var exe_export_exports = {};
 __export(exe_export_exports, {
   runExeExport: () => runExeExport
 });
-import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync10 } from "fs";
-import path17 from "path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync11 } from "fs";
+import path18 from "path";
 function printUsage() {
   process.stdout.write("Usage: exe-os export --output <path>\n");
 }
@@ -8612,8 +8944,8 @@ async function runExeExport(argv = process.argv.slice(2)) {
   await initStore();
   try {
     const pkg = await exportOrchestration("cli");
-    mkdirSync11(path17.dirname(outputPath), { recursive: true });
-    writeFileSync10(outputPath, `${JSON.stringify(pkg, null, 2)}
+    mkdirSync10(path18.dirname(outputPath), { recursive: true });
+    writeFileSync11(outputPath, `${JSON.stringify(pkg, null, 2)}
 `, "utf-8");
     process.stdout.write(
       `Exported ${pkg.roster.length} roster entries, ${Object.keys(pkg.identities).length} identities, ${pkg.behaviors.length} behaviors, ${pkg.procedures.length} procedures to ${outputPath}
@@ -8649,7 +8981,7 @@ var exe_import_exports = {};
 __export(exe_import_exports, {
   runExeImport: () => runExeImport
 });
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 function printUsage2() {
   process.stdout.write("Usage: exe-os import --from <path> [--merge]\n");
 }
@@ -8672,7 +9004,7 @@ async function runExeImport(argv = process.argv.slice(2)) {
   if (parsed == null) return;
   await initStore();
   try {
-    const raw = readFileSync12(parsed.packagePath, "utf-8");
+    const raw = readFileSync13(parsed.packagePath, "utf-8");
     const pkg = validatePackage(JSON.parse(raw));
     const result = await importOrchestration(pkg, parsed.strategy);
     process.stdout.write(
@@ -8712,14 +9044,14 @@ __export(session_registry_exports, {
   pruneStaleSessions: () => pruneStaleSessions,
   registerSession: () => registerSession
 });
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync11, mkdirSync as mkdirSync12, existsSync as existsSync15 } from "fs";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync12, mkdirSync as mkdirSync11, existsSync as existsSync17 } from "fs";
 import { execSync as execSync3 } from "child_process";
-import path18 from "path";
-import os10 from "os";
+import path19 from "path";
+import os11 from "os";
 function registerSession(entry) {
-  const dir = path18.dirname(REGISTRY_PATH);
-  if (!existsSync15(dir)) {
-    mkdirSync12(dir, { recursive: true });
+  const dir = path19.dirname(REGISTRY_PATH);
+  if (!existsSync17(dir)) {
+    mkdirSync11(dir, { recursive: true });
   }
   const sessions = listSessions();
   const idx = sessions.findIndex((s) => s.windowName === entry.windowName);
@@ -8728,11 +9060,11 @@ function registerSession(entry) {
   } else {
     sessions.push(entry);
   }
-  writeFileSync11(REGISTRY_PATH, JSON.stringify(sessions, null, 2));
+  writeFileSync12(REGISTRY_PATH, JSON.stringify(sessions, null, 2));
 }
 function listSessions() {
   try {
-    const raw = readFileSync13(REGISTRY_PATH, "utf8");
+    const raw = readFileSync14(REGISTRY_PATH, "utf8");
     return JSON.parse(raw);
   } catch {
     return [];
@@ -8753,7 +9085,7 @@ function pruneStaleSessions() {
   const alive = sessions.filter((s) => liveSet.has(s.windowName));
   const pruned = sessions.length - alive.length;
   if (pruned > 0) {
-    writeFileSync11(REGISTRY_PATH, JSON.stringify(alive, null, 2));
+    writeFileSync12(REGISTRY_PATH, JSON.stringify(alive, null, 2));
   }
   return pruned;
 }
@@ -8761,7 +9093,7 @@ var REGISTRY_PATH;
 var init_session_registry = __esm({
   "src/lib/session-registry.ts"() {
     "use strict";
-    REGISTRY_PATH = path18.join(os10.homedir(), ".exe-os", "session-registry.json");
+    REGISTRY_PATH = path19.join(os11.homedir(), ".exe-os", "session-registry.json");
   }
 });
 
@@ -9007,17 +9339,17 @@ __export(intercom_queue_exports, {
   queueIntercom: () => queueIntercom,
   readQueue: () => readQueue
 });
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync12, renameSync as renameSync3, existsSync as existsSync16, mkdirSync as mkdirSync13 } from "fs";
-import path19 from "path";
-import os11 from "os";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync13, renameSync as renameSync3, existsSync as existsSync18, mkdirSync as mkdirSync12 } from "fs";
+import path20 from "path";
+import os12 from "os";
 function ensureDir2() {
-  const dir = path19.dirname(QUEUE_PATH);
-  if (!existsSync16(dir)) mkdirSync13(dir, { recursive: true });
+  const dir = path20.dirname(QUEUE_PATH);
+  if (!existsSync18(dir)) mkdirSync12(dir, { recursive: true });
 }
 function readQueue() {
   try {
-    if (!existsSync16(QUEUE_PATH)) return [];
-    return JSON.parse(readFileSync14(QUEUE_PATH, "utf8"));
+    if (!existsSync18(QUEUE_PATH)) return [];
+    return JSON.parse(readFileSync15(QUEUE_PATH, "utf8"));
   } catch {
     return [];
   }
@@ -9025,7 +9357,7 @@ function readQueue() {
 function writeQueue(queue) {
   ensureDir2();
   const tmp = `${QUEUE_PATH}.tmp`;
-  writeFileSync12(tmp, JSON.stringify(queue, null, 2));
+  writeFileSync13(tmp, JSON.stringify(queue, null, 2));
   renameSync3(tmp, QUEUE_PATH);
 }
 function queueIntercom(targetSession, reason) {
@@ -9117,20 +9449,20 @@ var QUEUE_PATH, MAX_RETRIES2, TTL_MS, INTERCOM_LOG;
 var init_intercom_queue = __esm({
   "src/lib/intercom-queue.ts"() {
     "use strict";
-    QUEUE_PATH = path19.join(os11.homedir(), ".exe-os", "intercom-queue.json");
+    QUEUE_PATH = path20.join(os12.homedir(), ".exe-os", "intercom-queue.json");
     MAX_RETRIES2 = 5;
     TTL_MS = 60 * 60 * 1e3;
-    INTERCOM_LOG = path19.join(os11.homedir(), ".exe-os", "intercom.log");
+    INTERCOM_LOG = path20.join(os12.homedir(), ".exe-os", "intercom.log");
   }
 });
 
 // src/lib/plan-limits.ts
-import { readFileSync as readFileSync15, existsSync as existsSync17 } from "fs";
-import path20 from "path";
+import { readFileSync as readFileSync16, existsSync as existsSync19 } from "fs";
+import path21 from "path";
 function getLicenseSync() {
   try {
-    if (!existsSync17(CACHE_PATH2)) return freeLicense();
-    const raw = JSON.parse(readFileSync15(CACHE_PATH2, "utf8"));
+    if (!existsSync19(CACHE_PATH2)) return freeLicense();
+    const raw = JSON.parse(readFileSync16(CACHE_PATH2, "utf8"));
     if (!raw.token || typeof raw.token !== "string") return freeLicense();
     const parts = raw.token.split(".");
     if (parts.length !== 3) return freeLicense();
@@ -9168,8 +9500,8 @@ function assertEmployeeLimitSync(rosterPath) {
   const filePath = rosterPath ?? EMPLOYEES_PATH;
   let count = 0;
   try {
-    if (existsSync17(filePath)) {
-      const raw = readFileSync15(filePath, "utf8");
+    if (existsSync19(filePath)) {
+      const raw = readFileSync16(filePath, "utf8");
       const employees = JSON.parse(raw);
       count = Array.isArray(employees) ? employees.length : 0;
     }
@@ -9198,29 +9530,69 @@ var init_plan_limits = __esm({
         this.name = "PlanLimitError";
       }
     };
-    CACHE_PATH2 = path20.join(EXE_AI_DIR, "license-cache.json");
+    CACHE_PATH2 = path21.join(EXE_AI_DIR, "license-cache.json");
+  }
+});
+
+// src/lib/task-scope.ts
+var task_scope_exports = {};
+__export(task_scope_exports, {
+  getCurrentSessionScope: () => getCurrentSessionScope,
+  sessionScopeFilter: () => sessionScopeFilter,
+  strictSessionScopeFilter: () => strictSessionScopeFilter
+});
+function getCurrentSessionScope() {
+  try {
+    return resolveExeSession();
+  } catch {
+    return null;
+  }
+}
+function sessionScopeFilter(sessionScope, tableAlias) {
+  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
+  if (!scope) return { sql: "", args: [] };
+  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
+  return {
+    sql: ` AND (${col} IS NULL OR ${col} = ?)`,
+    args: [scope]
+  };
+}
+function strictSessionScopeFilter(sessionScope, tableAlias) {
+  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
+  if (!scope) return { sql: "", args: [] };
+  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
+  return {
+    sql: ` AND ${col} = ?`,
+    args: [scope]
+  };
+}
+var init_task_scope = __esm({
+  "src/lib/task-scope.ts"() {
+    "use strict";
+    init_tmux_routing();
   }
 });
 
 // src/lib/notifications.ts
-import crypto5 from "crypto";
-import path21 from "path";
-import os12 from "os";
+import crypto6 from "crypto";
+import path22 from "path";
+import os13 from "os";
 import {
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync17,
   readdirSync as readdirSync4,
   unlinkSync as unlinkSync5,
-  existsSync as existsSync18,
+  existsSync as existsSync20,
   rmdirSync
 } from "fs";
 async function writeNotification(notification) {
   try {
     const client = getClient();
-    const id = crypto5.randomUUID();
+    const id = crypto6.randomUUID();
     const now = (/* @__PURE__ */ new Date()).toISOString();
+    const sessionScope = notification.sessionScope === void 0 ? getCurrentSessionScope() : notification.sessionScope;
     await client.execute({
-      sql: `INSERT INTO notifications (id, agent_id, agent_role, event, project, summary, task_file, read, created_at)
-            VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?)`,
+      sql: `INSERT INTO notifications (id, agent_id, agent_role, event, project, summary, task_file, session_scope, read, created_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, ?)`,
       args: [
         id,
         notification.agentId,
@@ -9229,6 +9601,7 @@ async function writeNotification(notification) {
         notification.project,
         notification.summary,
         notification.taskFile ?? null,
+        sessionScope,
         now
       ]
     });
@@ -9237,12 +9610,14 @@ async function writeNotification(notification) {
 `);
   }
 }
-async function markAsReadByTaskFile(taskFile) {
+async function markAsReadByTaskFile(taskFile, sessionScope) {
   try {
     const client = getClient();
+    const scope = strictSessionScopeFilter(sessionScope);
     await client.execute({
-      sql: "UPDATE notifications SET read = 1 WHERE task_file = ? AND read = 0",
-      args: [taskFile]
+      sql: `UPDATE notifications SET read = 1
+            WHERE task_file = ? AND read = 0${scope.sql}`,
+      args: [taskFile, ...scope.args]
     });
   } catch {
   }
@@ -9251,11 +9626,12 @@ var init_notifications = __esm({
   "src/lib/notifications.ts"() {
     "use strict";
     init_database();
+    init_task_scope();
   }
 });
 
 // src/lib/session-kill-telemetry.ts
-import crypto6 from "crypto";
+import crypto7 from "crypto";
 async function recordSessionKill(input) {
   try {
     const client = getClient();
@@ -9265,7 +9641,7 @@ async function recordSessionKill(input) {
                ticks_idle, estimated_tokens_saved)
             VALUES (?, ?, ?, ?, ?, ?, ?)`,
       args: [
-        crypto6.randomUUID(),
+        crypto7.randomUUID(),
         input.sessionName,
         input.agentId,
         (/* @__PURE__ */ new Date()).toISOString(),
@@ -9288,32 +9664,107 @@ var init_session_kill_telemetry = __esm({
   }
 });
 
-// src/lib/task-scope.ts
-var task_scope_exports = {};
-__export(task_scope_exports, {
-  getCurrentSessionScope: () => getCurrentSessionScope,
-  sessionScopeFilter: () => sessionScopeFilter
-});
-function getCurrentSessionScope() {
+// src/lib/project-name.ts
+import { execSync as execSync6 } from "child_process";
+import path23 from "path";
+function getProjectName(cwd2) {
+  const dir = cwd2 ?? process.cwd();
+  if (_cached2 && _cachedCwd === dir) return _cached2;
   try {
-    return resolveExeSession();
+    let repoRoot;
+    try {
+      const gitCommonDir = execSync6("git rev-parse --path-format=absolute --git-common-dir", {
+        cwd: dir,
+        encoding: "utf8",
+        timeout: 2e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+      repoRoot = path23.dirname(gitCommonDir);
+    } catch {
+      repoRoot = execSync6("git rev-parse --show-toplevel", {
+        cwd: dir,
+        encoding: "utf8",
+        timeout: 2e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+    }
+    _cached2 = path23.basename(repoRoot);
+    _cachedCwd = dir;
+    return _cached2;
   } catch {
-    return null;
+    _cached2 = path23.basename(dir);
+    _cachedCwd = dir;
+    return _cached2;
   }
 }
-function sessionScopeFilter(sessionScope, tableAlias) {
-  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
-  if (!scope) return { sql: "", args: [] };
-  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
-  return {
-    sql: ` AND (${col} IS NULL OR ${col} = ?)`,
-    args: [scope]
-  };
+var _cached2, _cachedCwd;
+var init_project_name = __esm({
+  "src/lib/project-name.ts"() {
+    "use strict";
+    _cached2 = null;
+    _cachedCwd = null;
+  }
+});
+
+// src/lib/session-scope.ts
+var session_scope_exports = {};
+__export(session_scope_exports, {
+  assertSessionScope: () => assertSessionScope,
+  findSessionForProject: () => findSessionForProject,
+  getSessionProject: () => getSessionProject
+});
+function getSessionProject(sessionName) {
+  const sessions = listSessions();
+  const entry = sessions.find((s) => s.windowName === sessionName);
+  if (!entry) return null;
+  const parts = entry.projectDir.split("/").filter(Boolean);
+  return parts[parts.length - 1] ?? null;
 }
-var init_task_scope = __esm({
-  "src/lib/task-scope.ts"() {
+function findSessionForProject(projectName) {
+  const sessions = listSessions();
+  for (const s of sessions) {
+    const proj = s.projectDir.split("/").filter(Boolean).pop();
+    if (proj === projectName && isCoordinatorName(s.agentId)) return s;
+  }
+  return null;
+}
+function assertSessionScope(actionType, targetProject) {
+  try {
+    const currentProject = getProjectName();
+    const exeSession = resolveExeSession();
+    if (!exeSession) {
+      return { allowed: true, reason: "no_session" };
+    }
+    if (currentProject === targetProject) {
+      return {
+        allowed: true,
+        reason: "same_session",
+        currentProject,
+        targetProject
+      };
+    }
+    process.stderr.write(
+      `[session-scope] BLOCKED cross-project ${actionType}: session project="${currentProject}" \u2260 target project="${targetProject}"
+`
+    );
+    return {
+      allowed: false,
+      reason: "cross_session_denied",
+      currentProject,
+      targetProject,
+      targetSession: findSessionForProject(targetProject)?.windowName
+    };
+  } catch {
+    return { allowed: true, reason: "no_session" };
+  }
+}
+var init_session_scope = __esm({
+  "src/lib/session-scope.ts"() {
     "use strict";
+    init_session_registry();
+    init_project_name();
     init_tmux_routing();
+    init_employees();
   }
 });
 
@@ -9334,12 +9785,12 @@ __export(tasks_crud_exports, {
   updateTaskStatus: () => updateTaskStatus,
   writeCheckpoint: () => writeCheckpoint
 });
-import crypto7 from "crypto";
-import path22 from "path";
-import os13 from "os";
-import { execSync as execSync6 } from "child_process";
+import crypto8 from "crypto";
+import path24 from "path";
+import os14 from "os";
+import { execSync as execSync7 } from "child_process";
 import { mkdir as mkdir5, writeFile as writeFile5, appendFile } from "fs/promises";
-import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync18 } from "fs";
 async function writeCheckpoint(input) {
   const client = getClient();
   const row = await resolveTask(client, input.taskId);
@@ -9455,13 +9906,28 @@ async function resolveTask(client, identifier, scopeSession) {
 }
 async function createTaskCore(input) {
   const client = getClient();
-  const id = crypto7.randomUUID();
+  const id = crypto8.randomUUID();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const slug = slugify(input.title);
   let earlySessionScope = null;
+  let scopeMismatchWarning;
   try {
     const { resolveExeSession: resolveExeSession2 } = await Promise.resolve().then(() => (init_tmux_routing(), tmux_routing_exports));
-    earlySessionScope = resolveExeSession2();
+    const resolved = resolveExeSession2();
+    if (resolved && input.projectName) {
+      const { getSessionProject: getSessionProject2 } = await Promise.resolve().then(() => (init_session_scope(), session_scope_exports));
+      const sessionProject = getSessionProject2(resolved);
+      if (sessionProject && sessionProject !== input.projectName) {
+        scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
+        process.stderr.write(`[create_task] ${scopeMismatchWarning}
+`);
+        earlySessionScope = null;
+      } else {
+        earlySessionScope = resolved;
+      }
+    } else {
+      earlySessionScope = resolved;
+    }
   } catch {
   }
   const scope = earlySessionScope ?? "default";
@@ -9512,10 +9978,14 @@ async function createTaskCore(input) {
 ${laneWarning}` : laneWarning;
     }
   }
+  if (scopeMismatchWarning) {
+    warning = warning ? `${warning}
+${scopeMismatchWarning}` : scopeMismatchWarning;
+  }
   if (input.baseDir) {
     try {
-      await mkdir5(path22.join(input.baseDir, "exe", "output"), { recursive: true });
-      await mkdir5(path22.join(input.baseDir, "exe", "research"), { recursive: true });
+      await mkdir5(path24.join(input.baseDir, "exe", "output"), { recursive: true });
+      await mkdir5(path24.join(input.baseDir, "exe", "research"), { recursive: true });
       await ensureArchitectureDoc(input.baseDir, input.projectName);
       await ensureGitignoreExe(input.baseDir);
     } catch {
@@ -9551,13 +10021,19 @@ ${laneWarning}` : laneWarning;
   });
   if (input.baseDir) {
     try {
-      const EXE_OS_DIR = path22.join(os13.homedir(), ".exe-os");
-      const mdPath = path22.join(EXE_OS_DIR, taskFile);
-      const mdDir = path22.dirname(mdPath);
-      if (!existsSync19(mdDir)) await mkdir5(mdDir, { recursive: true });
+      const EXE_OS_DIR = path24.join(os14.homedir(), ".exe-os");
+      const mdPath = path24.join(EXE_OS_DIR, taskFile);
+      const mdDir = path24.dirname(mdPath);
+      if (!existsSync21(mdDir)) await mkdir5(mdDir, { recursive: true });
       const reviewer = input.reviewer ?? input.assignedBy;
       const mdContent = `# ${input.title}
 
+## MANDATORY: When done
+
+You MUST call update_task with status "done" and a result summary when finished.
+If you skip this, your reviewer will not know you're done and your work won't be reviewed.
+Do NOT let a failed commit or any error prevent you from calling update_task(done).
+
 **ID:** ${id}
 **Status:** ${initialStatus}
 **Priority:** ${input.priority}
@@ -9571,12 +10047,6 @@ ${laneWarning}` : laneWarning;
 ## Context
 
 ${input.context}
-
-## MANDATORY: When done
-
-You MUST call update_task with status "done" and a result summary when finished.
-If you skip this, your reviewer will not know you're done and your work won't be reviewed.
-Do NOT let a failed commit or any error prevent you from calling update_task(done).
 `;
       await writeFile5(mdPath, mdContent, "utf-8");
     } catch (err) {
@@ -9658,14 +10128,14 @@ function isTmuxSessionAlive(identifier) {
   if (!identifier || identifier === "unknown") return true;
   try {
     if (identifier.startsWith("%")) {
-      const output = execSync6("tmux list-panes -a -F '#{pane_id}'", {
+      const output = execSync7("tmux list-panes -a -F '#{pane_id}'", {
         timeout: 2e3,
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"]
       });
       return output.split("\n").some((l) => l.trim() === identifier);
     } else {
-      execSync6(`tmux has-session -t ${JSON.stringify(identifier)}`, {
+      execSync7(`tmux has-session -t ${JSON.stringify(identifier)}`, {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -9674,7 +10144,7 @@ function isTmuxSessionAlive(identifier) {
   } catch {
     if (identifier.startsWith("%")) return true;
     try {
-      execSync6("tmux list-sessions", {
+      execSync7("tmux list-sessions", {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -9689,12 +10159,12 @@ function checkStaleCompletion(taskContext, taskCreatedAt) {
   if (!DELEGATION_KEYWORDS.test(taskContext)) return null;
   try {
     const since = new Date(taskCreatedAt).toISOString();
-    const branch = execSync6(
+    const branch = execSync7(
       "git rev-parse --abbrev-ref HEAD 2>/dev/null",
       { encoding: "utf8", timeout: 3e3 }
     ).trim();
     const branchArg = branch && branch !== "HEAD" ? branch : "";
-    const commitCount = execSync6(
+    const commitCount = execSync7(
       `git log --oneline --since="${since}" ${branchArg} 2>/dev/null | wc -l`,
       { encoding: "utf8", timeout: 5e3 }
     ).trim();
@@ -9825,7 +10295,7 @@ ${input.result}` : `\u26A0\uFE0F ${warning}`;
     await client.execute("PRAGMA wal_checkpoint(PASSIVE)");
   } catch {
   }
-  if (input.status === "done" || input.status === "cancelled") {
+  if (input.status === "done" || input.status === "cancelled" || input.status === "closed") {
     try {
       const { clearQueueForAgent: clearQueueForAgent2 } = await Promise.resolve().then(() => (init_intercom_queue(), intercom_queue_exports));
       clearQueueForAgent2(String(row.assigned_to));
@@ -9854,9 +10324,9 @@ async function deleteTaskCore(taskId, _baseDir) {
   return { taskFile, assignedTo, assignedBy, taskSlug };
 }
 async function ensureArchitectureDoc(baseDir, projectName) {
-  const archPath = path22.join(baseDir, "exe", "ARCHITECTURE.md");
+  const archPath = path24.join(baseDir, "exe", "ARCHITECTURE.md");
   try {
-    if (existsSync19(archPath)) return;
+    if (existsSync21(archPath)) return;
     const template = [
       `# ${projectName} \u2014 System Architecture`,
       "",
@@ -9889,10 +10359,10 @@ async function ensureArchitectureDoc(baseDir, projectName) {
   }
 }
 async function ensureGitignoreExe(baseDir) {
-  const gitignorePath = path22.join(baseDir, ".gitignore");
+  const gitignorePath = path24.join(baseDir, ".gitignore");
   try {
-    if (existsSync19(gitignorePath)) {
-      const content = readFileSync17(gitignorePath, "utf-8");
+    if (existsSync21(gitignorePath)) {
+      const content = readFileSync18(gitignorePath, "utf-8");
       if (/^\/?exe\/?$/m.test(content)) return;
       await appendFile(gitignorePath, "\n# Employee task assignments (private)\n/exe/\n");
     } else {
@@ -9923,58 +10393,42 @@ var init_tasks_crud = __esm({
 });
 
 // src/lib/tasks-review.ts
-import path23 from "path";
-import { existsSync as existsSync20, readdirSync as readdirSync5, unlinkSync as unlinkSync6 } from "fs";
+import path25 from "path";
+import { existsSync as existsSync22, readdirSync as readdirSync5, unlinkSync as unlinkSync6 } from "fs";
 async function countPendingReviews(sessionScope) {
   const client = getClient();
-  if (sessionScope) {
-    const result2 = await client.execute({
-      sql: "SELECT COUNT(*) as cnt FROM tasks WHERE status = 'needs_review' AND session_scope = ?",
-      args: [sessionScope]
-    });
-    return Number(result2.rows[0]?.cnt) || 0;
-  }
+  const scope = strictSessionScopeFilter(
+    sessionScope === void 0 ? getCurrentSessionScope() : sessionScope
+  );
   const result = await client.execute({
-    sql: "SELECT COUNT(*) as cnt FROM tasks WHERE status = 'needs_review'",
-    args: []
+    sql: `SELECT COUNT(*) as cnt FROM tasks
+          WHERE status = 'needs_review'${scope.sql}`,
+    args: [...scope.args]
   });
   return Number(result.rows[0]?.cnt) || 0;
 }
 async function countNewPendingReviewsSince(sinceIso, sessionScope) {
   const client = getClient();
-  if (sessionScope) {
-    const result2 = await client.execute({
-      sql: `SELECT COUNT(*) as cnt FROM tasks
-            WHERE status = 'needs_review' AND updated_at > ?
-              AND session_scope = ?`,
-      args: [sinceIso, sessionScope]
-    });
-    return Number(result2.rows[0]?.cnt) || 0;
-  }
+  const scope = strictSessionScopeFilter(
+    sessionScope === void 0 ? getCurrentSessionScope() : sessionScope
+  );
   const result = await client.execute({
     sql: `SELECT COUNT(*) as cnt FROM tasks
-          WHERE status = 'needs_review' AND updated_at > ?`,
-    args: [sinceIso]
+          WHERE status = 'needs_review' AND updated_at > ?${scope.sql}`,
+    args: [sinceIso, ...scope.args]
   });
   return Number(result.rows[0]?.cnt) || 0;
 }
 async function listPendingReviews(limit, sessionScope) {
   const client = getClient();
-  if (sessionScope) {
-    const result2 = await client.execute({
-      sql: `SELECT title, assigned_to, project_name, updated_at FROM tasks
-            WHERE status = 'needs_review'
-              AND session_scope = ?
-            ORDER BY updated_at ASC LIMIT ?`,
-      args: [sessionScope, limit]
-    });
-    return result2.rows;
-  }
+  const scope = strictSessionScopeFilter(
+    sessionScope === void 0 ? getCurrentSessionScope() : sessionScope
+  );
   const result = await client.execute({
     sql: `SELECT title, assigned_to, project_name, updated_at FROM tasks
-          WHERE status = 'needs_review'
+          WHERE status = 'needs_review'${scope.sql}
           ORDER BY updated_at ASC LIMIT ?`,
-    args: [limit]
+    args: [...scope.args, limit]
   });
   return result.rows;
 }
@@ -9986,7 +10440,7 @@ async function cleanupOrphanedReviews() {
           WHERE status IN ('open', 'needs_review', 'in_progress')
           AND assigned_by = 'system'
           AND title LIKE 'Review:%'
-          AND parent_task_id IN (SELECT id FROM tasks WHERE status IN ('done', 'cancelled'))`,
+          AND parent_task_id IN (SELECT id FROM tasks WHERE status IN ('done', 'cancelled', 'closed'))`,
     args: [now]
   });
   const r1b = await client.execute({
@@ -10105,11 +10559,11 @@ async function cleanupReviewFile(row, taskFile, _baseDir) {
     );
   }
   try {
-    const cacheDir = path23.join(EXE_AI_DIR, "session-cache");
-    if (existsSync20(cacheDir)) {
+    const cacheDir = path25.join(EXE_AI_DIR, "session-cache");
+    if (existsSync22(cacheDir)) {
       for (const f of readdirSync5(cacheDir)) {
         if (f.startsWith("review-notified-")) {
-          unlinkSync6(path23.join(cacheDir, f));
+          unlinkSync6(path25.join(cacheDir, f));
         }
       }
     }
@@ -10126,11 +10580,12 @@ var init_tasks_review = __esm({
     init_tmux_routing();
     init_session_key();
     init_state_bus();
+    init_task_scope();
   }
 });
 
 // src/lib/tasks-chain.ts
-import path24 from "path";
+import path26 from "path";
 import { readFile as readFile5, writeFile as writeFile6 } from "fs/promises";
 async function cascadeUnblock(taskId, baseDir, now) {
   const client = getClient();
@@ -10147,7 +10602,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
     });
     for (const ur of unblockedRows.rows) {
       try {
-        const ubFile = path24.join(baseDir, String(ur.task_file));
+        const ubFile = path26.join(baseDir, String(ur.task_file));
         let ubContent = await readFile5(ubFile, "utf-8");
         ubContent = ubContent.replace(/\*\*Status:\*\* blocked/, "**Status:** open");
         ubContent = ubContent.replace(/\n\*\*Blocked by:\*\*.*\n/, "\n");
@@ -10182,7 +10637,7 @@ async function checkSubtaskCompletion(parentTaskId, projectName) {
   const scScope = sessionScopeFilter();
   const remaining = await client.execute({
     sql: `SELECT COUNT(*) as cnt FROM tasks
-          WHERE parent_task_id = ? AND status NOT IN ('done', 'cancelled')${scScope.sql}`,
+          WHERE parent_task_id = ? AND status NOT IN ('done', 'cancelled', 'closed')${scScope.sql}`,
     args: [parentTaskId, ...scScope.args]
   });
   const cnt = Number(remaining.rows[0]?.cnt ?? 1);
@@ -10214,110 +10669,6 @@ var init_tasks_chain = __esm({
   }
 });
 
-// src/lib/project-name.ts
-import { execSync as execSync7 } from "child_process";
-import path25 from "path";
-function getProjectName(cwd2) {
-  const dir = cwd2 ?? process.cwd();
-  if (_cached2 && _cachedCwd === dir) return _cached2;
-  try {
-    let repoRoot;
-    try {
-      const gitCommonDir = execSync7("git rev-parse --path-format=absolute --git-common-dir", {
-        cwd: dir,
-        encoding: "utf8",
-        timeout: 2e3,
-        stdio: ["pipe", "pipe", "pipe"]
-      }).trim();
-      repoRoot = path25.dirname(gitCommonDir);
-    } catch {
-      repoRoot = execSync7("git rev-parse --show-toplevel", {
-        cwd: dir,
-        encoding: "utf8",
-        timeout: 2e3,
-        stdio: ["pipe", "pipe", "pipe"]
-      }).trim();
-    }
-    _cached2 = path25.basename(repoRoot);
-    _cachedCwd = dir;
-    return _cached2;
-  } catch {
-    _cached2 = path25.basename(dir);
-    _cachedCwd = dir;
-    return _cached2;
-  }
-}
-var _cached2, _cachedCwd;
-var init_project_name = __esm({
-  "src/lib/project-name.ts"() {
-    "use strict";
-    _cached2 = null;
-    _cachedCwd = null;
-  }
-});
-
-// src/lib/session-scope.ts
-var session_scope_exports = {};
-__export(session_scope_exports, {
-  assertSessionScope: () => assertSessionScope,
-  findSessionForProject: () => findSessionForProject,
-  getSessionProject: () => getSessionProject
-});
-function getSessionProject(sessionName) {
-  const sessions = listSessions();
-  const entry = sessions.find((s) => s.windowName === sessionName);
-  if (!entry) return null;
-  const parts = entry.projectDir.split("/").filter(Boolean);
-  return parts[parts.length - 1] ?? null;
-}
-function findSessionForProject(projectName) {
-  const sessions = listSessions();
-  for (const s of sessions) {
-    const proj = s.projectDir.split("/").filter(Boolean).pop();
-    if (proj === projectName && isCoordinatorName(s.agentId)) return s;
-  }
-  return null;
-}
-function assertSessionScope(actionType, targetProject) {
-  try {
-    const currentProject = getProjectName();
-    const exeSession = resolveExeSession();
-    if (!exeSession) {
-      return { allowed: true, reason: "no_session" };
-    }
-    if (currentProject === targetProject) {
-      return {
-        allowed: true,
-        reason: "same_session",
-        currentProject,
-        targetProject
-      };
-    }
-    process.stderr.write(
-      `[session-scope] BLOCKED cross-project ${actionType}: session project="${currentProject}" \u2260 target project="${targetProject}"
-`
-    );
-    return {
-      allowed: false,
-      reason: "cross_session_denied",
-      currentProject,
-      targetProject,
-      targetSession: findSessionForProject(targetProject)?.windowName
-    };
-  } catch {
-    return { allowed: true, reason: "no_session" };
-  }
-}
-var init_session_scope = __esm({
-  "src/lib/session-scope.ts"() {
-    "use strict";
-    init_session_registry();
-    init_project_name();
-    init_tmux_routing();
-    init_employees();
-  }
-});
-
 // src/lib/tasks-notify.ts
 async function dispatchTaskToEmployee(input) {
   if (isCoordinatorName(input.assignedTo)) return { dispatched: "skipped" };
@@ -10385,10 +10736,10 @@ var init_tasks_notify = __esm({
 });
 
 // src/lib/behaviors.ts
-import crypto8 from "crypto";
+import crypto9 from "crypto";
 async function storeBehavior(opts) {
   const client = getClient();
-  const id = crypto8.randomUUID();
+  const id = crypto9.randomUUID();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   await client.execute({
     sql: `INSERT INTO behaviors (id, agent_id, project_name, domain, priority, content, active, created_at, updated_at)
@@ -10417,7 +10768,7 @@ __export(skill_learning_exports, {
   storeTrajectory: () => storeTrajectory,
   sweepTrajectories: () => sweepTrajectories
 });
-import crypto9 from "crypto";
+import crypto10 from "crypto";
 async function extractTrajectory(taskId, agentId) {
   const client = getClient();
   const result = await client.execute({
@@ -10446,11 +10797,11 @@ async function extractTrajectory(taskId, agentId) {
   return signature;
 }
 function hashSignature(signature) {
-  return crypto9.createHash("sha256").update(signature.join("|")).digest("hex").slice(0, 16);
+  return crypto10.createHash("sha256").update(signature.join("|")).digest("hex").slice(0, 16);
 }
 async function storeTrajectory(opts) {
   const client = getClient();
-  const id = crypto9.randomUUID();
+  const id = crypto10.randomUUID();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const signatureHash = hashSignature(opts.signature);
   await client.execute({
@@ -10715,8 +11066,8 @@ __export(tasks_exports, {
   updateTaskStatus: () => updateTaskStatus,
   writeCheckpoint: () => writeCheckpoint
 });
-import path26 from "path";
-import { writeFileSync as writeFileSync13, mkdirSync as mkdirSync14, unlinkSync as unlinkSync7 } from "fs";
+import path27 from "path";
+import { writeFileSync as writeFileSync14, mkdirSync as mkdirSync13, unlinkSync as unlinkSync7 } from "fs";
 async function createTask(input) {
   const result = await createTaskCore(input);
   if (!input.skipDispatch && result.status !== "blocked" && !process.env.VITEST) {
@@ -10735,12 +11086,12 @@ async function updateTask(input) {
   const { row, taskFile, now, taskId } = await updateTaskStatus(input);
   try {
     const agent = String(row.assigned_to);
-    const cacheDir = path26.join(EXE_AI_DIR, "session-cache");
-    const cachePath = path26.join(cacheDir, `current-task-${agent}.json`);
+    const cacheDir = path27.join(EXE_AI_DIR, "session-cache");
+    const cachePath = path27.join(cacheDir, `current-task-${agent}.json`);
     if (input.status === "in_progress") {
-      mkdirSync14(cacheDir, { recursive: true });
-      writeFileSync13(cachePath, JSON.stringify({ taskId, title: String(row.title) }));
-    } else if (input.status === "done" || input.status === "blocked" || input.status === "cancelled") {
+      mkdirSync13(cacheDir, { recursive: true });
+      writeFileSync14(cachePath, JSON.stringify({ taskId, title: String(row.title) }));
+    } else if (input.status === "done" || input.status === "blocked" || input.status === "cancelled" || input.status === "closed") {
       try {
         unlinkSync7(cachePath);
       } catch {
@@ -10748,10 +11099,10 @@ async function updateTask(input) {
     }
   } catch {
   }
-  if (input.status === "done") {
+  if (input.status === "done" || input.status === "closed") {
     await cleanupReviewFile(row, taskFile, input.baseDir);
   }
-  if (input.status === "done" || input.status === "cancelled") {
+  if (input.status === "done" || input.status === "cancelled" || input.status === "closed") {
     try {
       const client = getClient();
       const taskTitle = String(row.title);
@@ -10767,7 +11118,7 @@ async function updateTask(input) {
     if (!isCoordinatorName(assignedAgent)) {
       try {
         const draftClient = getClient();
-        if (input.status === "done") {
+        if (input.status === "done" || input.status === "closed") {
           await draftClient.execute({
             sql: `UPDATE memories SET draft = 0 WHERE agent_id = ? AND draft = 1`,
             args: [assignedAgent]
@@ -10784,7 +11135,7 @@ async function updateTask(input) {
     try {
       const client = getClient();
       const cascaded = await client.execute({
-        sql: `UPDATE tasks SET status = 'done', updated_at = ?
+        sql: `UPDATE tasks SET status = 'closed', updated_at = ?
               WHERE parent_task_id = ? AND status = 'needs_review'`,
         args: [now, taskId]
       });
@@ -10797,14 +11148,14 @@ async function updateTask(input) {
     } catch {
     }
   }
-  const isTerminal = input.status === "done" || input.status === "needs_review";
+  const isTerminal = input.status === "done" || input.status === "needs_review" || input.status === "closed";
   if (isTerminal) {
     const isCoordinator = isCoordinatorName(String(row.assigned_to));
     if (!isCoordinator) {
       notifyTaskDone();
     }
     await markTaskNotificationsRead(taskFile);
-    if (input.status === "done") {
+    if (input.status === "done" || input.status === "closed") {
       try {
         await cascadeUnblock(taskId, input.baseDir, now);
       } catch {
@@ -10824,7 +11175,7 @@ async function updateTask(input) {
       }
     }
   }
-  if (input.status === "done" && !isCoordinatorName(String(row.assigned_to)) && !process.env.VITEST) {
+  if ((input.status === "done" || input.status === "closed") && !isCoordinatorName(String(row.assigned_to)) && !process.env.VITEST) {
     Promise.resolve().then(() => (init_skill_learning(), skill_learning_exports)).then(
       ({ captureAndLearn: captureAndLearn2 }) => captureAndLearn2({
         taskId,
@@ -11196,6 +11547,7 @@ __export(tmux_routing_exports, {
   isEmployeeAlive: () => isEmployeeAlive,
   isExeSession: () => isExeSession,
   isSessionBusy: () => isSessionBusy,
+  notifyCoordinatorTaskCompletion: () => notifyCoordinatorTaskCompletion,
   notifyParentExe: () => notifyParentExe,
   parseParentExe: () => parseParentExe,
   registerParentExe: () => registerParentExe,
@@ -11206,13 +11558,13 @@ __export(tmux_routing_exports, {
   verifyPaneAtCapacity: () => verifyPaneAtCapacity
 });
 import { execFileSync as execFileSync2, execSync as execSync8 } from "child_process";
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync14, mkdirSync as mkdirSync15, existsSync as existsSync21, appendFileSync as appendFileSync2, readdirSync as readdirSync6 } from "fs";
-import path27 from "path";
-import os14 from "os";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync15, mkdirSync as mkdirSync14, existsSync as existsSync23, appendFileSync as appendFileSync2, readdirSync as readdirSync6 } from "fs";
+import path28 from "path";
+import os15 from "os";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { unlinkSync as unlinkSync8 } from "fs";
 function spawnLockPath(sessionName) {
-  return path27.join(SPAWN_LOCK_DIR, `${sessionName}.lock`);
+  return path28.join(SPAWN_LOCK_DIR, `${sessionName}.lock`);
 }
 function isProcessAlive(pid) {
   try {
@@ -11223,13 +11575,13 @@ function isProcessAlive(pid) {
   }
 }
 function acquireSpawnLock2(sessionName) {
-  if (!existsSync21(SPAWN_LOCK_DIR)) {
-    mkdirSync15(SPAWN_LOCK_DIR, { recursive: true });
+  if (!existsSync23(SPAWN_LOCK_DIR)) {
+    mkdirSync14(SPAWN_LOCK_DIR, { recursive: true });
   }
   const lockFile = spawnLockPath(sessionName);
-  if (existsSync21(lockFile)) {
+  if (existsSync23(lockFile)) {
     try {
-      const lock = JSON.parse(readFileSync18(lockFile, "utf8"));
+      const lock = JSON.parse(readFileSync19(lockFile, "utf8"));
       const age = Date.now() - lock.timestamp;
       if (isProcessAlive(lock.pid) && age < 6e4) {
         return false;
@@ -11237,7 +11589,7 @@ function acquireSpawnLock2(sessionName) {
     } catch {
     }
   }
-  writeFileSync14(lockFile, JSON.stringify({ pid: process.pid, timestamp: Date.now() }));
+  writeFileSync15(lockFile, JSON.stringify({ pid: process.pid, timestamp: Date.now() }));
   return true;
 }
 function releaseSpawnLock2(sessionName) {
@@ -11249,13 +11601,13 @@ function releaseSpawnLock2(sessionName) {
 function resolveBehaviorsExporterScript() {
   try {
     const thisFile = fileURLToPath4(import.meta.url);
-    const scriptPath = path27.join(
-      path27.dirname(thisFile),
+    const scriptPath = path28.join(
+      path28.dirname(thisFile),
       "..",
       "bin",
       "exe-export-behaviors.js"
     );
-    return existsSync21(scriptPath) ? scriptPath : null;
+    return existsSync23(scriptPath) ? scriptPath : null;
   } catch {
     return null;
   }
@@ -11321,12 +11673,12 @@ function extractRootExe(name) {
   return parts.length > 0 ? parts[parts.length - 1] : null;
 }
 function registerParentExe(sessionKey, parentExe, dispatchedBy) {
-  if (!existsSync21(SESSION_CACHE)) {
-    mkdirSync15(SESSION_CACHE, { recursive: true });
+  if (!existsSync23(SESSION_CACHE)) {
+    mkdirSync14(SESSION_CACHE, { recursive: true });
   }
   const rootExe = extractRootExe(parentExe) ?? parentExe;
-  const filePath = path27.join(SESSION_CACHE, `parent-exe-${sessionKey}.json`);
-  writeFileSync14(filePath, JSON.stringify({
+  const filePath = path28.join(SESSION_CACHE, `parent-exe-${sessionKey}.json`);
+  writeFileSync15(filePath, JSON.stringify({
     parentExe: rootExe,
     dispatchedBy: dispatchedBy || rootExe,
     registeredAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -11334,7 +11686,7 @@ function registerParentExe(sessionKey, parentExe, dispatchedBy) {
 }
 function getParentExe(sessionKey) {
   try {
-    const data = JSON.parse(readFileSync18(path27.join(SESSION_CACHE, `parent-exe-${sessionKey}.json`), "utf8"));
+    const data = JSON.parse(readFileSync19(path28.join(SESSION_CACHE, `parent-exe-${sessionKey}.json`), "utf8"));
     return data.parentExe || null;
   } catch {
     return null;
@@ -11342,8 +11694,8 @@ function getParentExe(sessionKey) {
 }
 function getDispatchedBy(sessionKey) {
   try {
-    const data = JSON.parse(readFileSync18(
-      path27.join(SESSION_CACHE, `parent-exe-${sessionKey}.json`),
+    const data = JSON.parse(readFileSync19(
+      path28.join(SESSION_CACHE, `parent-exe-${sessionKey}.json`),
       "utf8"
     ));
     return data.dispatchedBy ?? data.parentExe ?? null;
@@ -11413,8 +11765,8 @@ async function verifyPaneAtCapacity(sessionName) {
 }
 function readDebounceState() {
   try {
-    if (!existsSync21(DEBOUNCE_FILE)) return {};
-    const raw = JSON.parse(readFileSync18(DEBOUNCE_FILE, "utf8"));
+    if (!existsSync23(DEBOUNCE_FILE)) return {};
+    const raw = JSON.parse(readFileSync19(DEBOUNCE_FILE, "utf8"));
     const state = {};
     for (const [key, val] of Object.entries(raw)) {
       if (typeof val === "number") {
@@ -11430,8 +11782,8 @@ function readDebounceState() {
 }
 function writeDebounceState(state) {
   try {
-    if (!existsSync21(SESSION_CACHE)) mkdirSync15(SESSION_CACHE, { recursive: true });
-    writeFileSync14(DEBOUNCE_FILE, JSON.stringify(state));
+    if (!existsSync23(SESSION_CACHE)) mkdirSync14(SESSION_CACHE, { recursive: true });
+    writeFileSync15(DEBOUNCE_FILE, JSON.stringify(state));
   } catch {
   }
 }
@@ -11529,8 +11881,8 @@ function sendIntercom(targetSession) {
     try {
       const rawAgent = targetSession.split("-")[0] ?? targetSession;
       const agent = baseAgentName(rawAgent);
-      const markerPath = path27.join(SESSION_CACHE, `current-task-${agent}.json`);
-      if (existsSync21(markerPath)) {
+      const markerPath = path28.join(SESSION_CACHE, `current-task-${agent}.json`);
+      if (existsSync23(markerPath)) {
         logIntercom(`SKIP \u2192 ${targetSession} (has in_progress task marker \u2014 will auto-chain)`);
         return "debounced";
       }
@@ -11539,8 +11891,8 @@ function sendIntercom(targetSession) {
     try {
       const rawAgent = targetSession.split("-")[0] ?? targetSession;
       const agent = baseAgentName(rawAgent);
-      const taskDir = path27.join(process.cwd(), "exe", agent);
-      if (existsSync21(taskDir)) {
+      const taskDir = path28.join(process.cwd(), "exe", agent);
+      if (existsSync23(taskDir)) {
         const files = readdirSync6(taskDir).filter(
           (f) => f.endsWith(".md") && f !== "DONE.txt"
         );
@@ -11600,6 +11952,21 @@ function notifyParentExe(sessionKey) {
   }
   return true;
 }
+function notifyCoordinatorTaskCompletion(coordinatorSession, agentName, taskTitle) {
+  const transport = getTransport();
+  try {
+    const sessions = transport.listSessions();
+    if (!sessions.includes(coordinatorSession)) return false;
+    execSync8(
+      `tmux send-keys -t ${JSON.stringify(coordinatorSession)} '/exe-intercom' Enter`,
+      { timeout: 3e3 }
+    );
+    logIntercom(`COMPLETION \u2192 ${coordinatorSession} (${agentName} completed "${taskTitle.slice(0, 50)}")`);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function ensureEmployee(employeeName, exeSession, projectDir, opts) {
   if (isCoordinatorName(employeeName)) {
     return { status: "failed", sessionName: "", error: "The COO is not a dispatchable employee" };
@@ -11673,26 +12040,26 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   const transport = getTransport();
   const sessionName = employeeSessionName(employeeName, exeSession, opts?.instance);
   const instanceLabel = opts?.instance != null && opts.instance > 0 ? `${employeeName}${opts.instance}` : employeeName;
-  const logDir = path27.join(os14.homedir(), ".exe-os", "session-logs");
-  const logFile = path27.join(logDir, `${instanceLabel}-${Date.now()}.log`);
-  if (!existsSync21(logDir)) {
-    mkdirSync15(logDir, { recursive: true });
+  const logDir = path28.join(os15.homedir(), ".exe-os", "session-logs");
+  const logFile = path28.join(logDir, `${instanceLabel}-${Date.now()}.log`);
+  if (!existsSync23(logDir)) {
+    mkdirSync14(logDir, { recursive: true });
   }
   transport.kill(sessionName);
   let cleanupSuffix = "";
   try {
     const thisFile = fileURLToPath4(import.meta.url);
-    const cleanupScript = path27.join(path27.dirname(thisFile), "..", "bin", "exe-session-cleanup.js");
-    if (existsSync21(cleanupScript)) {
+    const cleanupScript = path28.join(path28.dirname(thisFile), "..", "bin", "exe-session-cleanup.js");
+    if (existsSync23(cleanupScript)) {
       cleanupSuffix = `; ${process.execPath} "${cleanupScript}" "${employeeName}" "${exeSession}"`;
     }
   } catch {
   }
   try {
-    const claudeJsonPath = path27.join(os14.homedir(), ".claude.json");
+    const claudeJsonPath = path28.join(os15.homedir(), ".claude.json");
     let claudeJson = {};
     try {
-      claudeJson = JSON.parse(readFileSync18(claudeJsonPath, "utf8"));
+      claudeJson = JSON.parse(readFileSync19(claudeJsonPath, "utf8"));
     } catch {
     }
     if (!claudeJson.projects) claudeJson.projects = {};
@@ -11700,17 +12067,17 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
     const trustDir = opts?.cwd ?? projectDir;
     if (!projects[trustDir]) projects[trustDir] = {};
     projects[trustDir].hasTrustDialogAccepted = true;
-    writeFileSync14(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
+    writeFileSync15(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
   } catch {
   }
   try {
-    const settingsDir = path27.join(os14.homedir(), ".claude", "projects");
+    const settingsDir = path28.join(os15.homedir(), ".claude", "projects");
     const normalizedKey = (opts?.cwd ?? projectDir).replace(/\//g, "-").replace(/^-/, "");
-    const projSettingsDir = path27.join(settingsDir, normalizedKey);
-    const settingsPath = path27.join(projSettingsDir, "settings.json");
+    const projSettingsDir = path28.join(settingsDir, normalizedKey);
+    const settingsPath = path28.join(projSettingsDir, "settings.json");
     let settings = {};
     try {
-      settings = JSON.parse(readFileSync18(settingsPath, "utf8"));
+      settings = JSON.parse(readFileSync19(settingsPath, "utf8"));
     } catch {
     }
     const perms = settings.permissions ?? {};
@@ -11738,8 +12105,8 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
     if (changed) {
       perms.allow = allow;
       settings.permissions = perms;
-      mkdirSync15(projSettingsDir, { recursive: true });
-      writeFileSync14(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+      mkdirSync14(projSettingsDir, { recursive: true });
+      writeFileSync15(settingsPath, JSON.stringify(settings, null, 2) + "\n");
     }
   } catch {
   }
@@ -11754,8 +12121,8 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   let behaviorsFlag = "";
   let legacyFallbackWarned = false;
   if (!useExeAgent && !useBinSymlink) {
-    const identityPath2 = path27.join(
-      os14.homedir(),
+    const identityPath2 = path28.join(
+      os15.homedir(),
       ".exe-os",
       "identity",
       `${employeeName}.md`
@@ -11764,13 +12131,13 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
     const hasAgentFlag = claudeSupportsAgentFlag();
     if (hasAgentFlag) {
       identityFlag = ` --agent ${employeeName}`;
-    } else if (existsSync21(identityPath2)) {
+    } else if (existsSync23(identityPath2)) {
       identityFlag = ` --append-system-prompt-file ${identityPath2}`;
       legacyFallbackWarned = true;
     }
     const behaviorsFile = exportBehaviorsSync(
       employeeName,
-      path27.basename(spawnCwd),
+      path28.basename(spawnCwd),
       sessionName
     );
     if (behaviorsFile) {
@@ -11785,16 +12152,16 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   }
   let sessionContextFlag = "";
   try {
-    const ctxDir = path27.join(os14.homedir(), ".exe-os", "session-cache");
-    mkdirSync15(ctxDir, { recursive: true });
-    const ctxFile = path27.join(ctxDir, `session-context-${sessionName}.md`);
+    const ctxDir = path28.join(os15.homedir(), ".exe-os", "session-cache");
+    mkdirSync14(ctxDir, { recursive: true });
+    const ctxFile = path28.join(ctxDir, `session-context-${sessionName}.md`);
     const ctxContent = [
       `## Session Context`,
       `You are running in tmux session: ${sessionName}.`,
       `Your parent coordinator session is ${exeSession}.`,
       `Your employees (if any) use the -${exeSession} suffix.`
     ].join("\n");
-    writeFileSync14(ctxFile, ctxContent);
+    writeFileSync15(ctxFile, ctxContent);
     sessionContextFlag = ` --append-system-prompt-file ${ctxFile}`;
   } catch {
   }
@@ -11871,8 +12238,8 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   transport.pipeLog(sessionName, logFile);
   try {
     const mySession = getMySession();
-    const dispatchInfo = path27.join(SESSION_CACHE, `dispatch-info-${sessionName}.json`);
-    writeFileSync14(dispatchInfo, JSON.stringify({
+    const dispatchInfo = path28.join(SESSION_CACHE, `dispatch-info-${sessionName}.json`);
+    writeFileSync15(dispatchInfo, JSON.stringify({
       dispatchedBy: mySession,
       rootExe: exeSession,
       provider: useBinSymlink ? ccProvider : useExeAgent ? opts.provider : useCodex ? "openai" : useOpencode ? "opencode" : "anthropic",
@@ -11946,15 +12313,15 @@ var init_tmux_routing = __esm({
     init_intercom_queue();
     init_plan_limits();
     init_employees();
-    SPAWN_LOCK_DIR = path27.join(os14.homedir(), ".exe-os", "spawn-locks");
-    SESSION_CACHE = path27.join(os14.homedir(), ".exe-os", "session-cache");
+    SPAWN_LOCK_DIR = path28.join(os15.homedir(), ".exe-os", "spawn-locks");
+    SESSION_CACHE = path28.join(os15.homedir(), ".exe-os", "session-cache");
     BEHAVIORS_EXPORT_TIMEOUT_MS = 1e4;
     VALID_SESSION_NAME = /^[a-z]+\d*-[a-zA-Z0-9_]+$/;
     VERIFY_PANE_LINES = 200;
     INTERCOM_DEBOUNCE_MS = 3e4;
     CODEX_DEBOUNCE_MS = 12e4;
-    INTERCOM_LOG2 = path27.join(os14.homedir(), ".exe-os", "intercom.log");
-    DEBOUNCE_FILE = path27.join(SESSION_CACHE, "intercom-debounce.json");
+    INTERCOM_LOG2 = path28.join(os15.homedir(), ".exe-os", "intercom.log");
+    DEBOUNCE_FILE = path28.join(SESSION_CACHE, "intercom-debounce.json");
     DEBOUNCE_CLEANUP_AGE_MS = 5 * 60 * 1e3;
     BUSY_PATTERN = /[✻✽✶✳·].*…|Running…|• Working|• Ran |• Explored|• Called|esc to interrupt/;
   }
@@ -11977,10 +12344,10 @@ __export(messaging_exports, {
   sendMessage: () => sendMessage,
   setWsClientSend: () => setWsClientSend
 });
-import crypto10 from "crypto";
+import crypto11 from "crypto";
 function generateUlid() {
   const timestamp = Date.now().toString(36).padStart(10, "0");
-  const random = crypto10.randomBytes(10).toString("hex").slice(0, 16);
+  const random = crypto11.randomBytes(10).toString("hex").slice(0, 16);
   return (timestamp + random).toUpperCase();
 }
 function rowToMessage(row) {
@@ -11991,6 +12358,7 @@ function rowToMessage(row) {
     targetAgent: row.target_agent,
     targetProject: row.target_project ?? null,
     targetDevice: row.target_device,
+    sessionScope: row.session_scope ?? null,
     content: row.content,
     priority: row.priority ?? "normal",
     status: row.status ?? "pending",
@@ -12008,15 +12376,17 @@ async function sendMessage(input) {
   const id = generateUlid();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const targetDevice = input.targetDevice ?? "local";
+  const sessionScope = input.sessionScope === void 0 ? resolveExeSession() : input.sessionScope;
   await client.execute({
-    sql: `INSERT INTO messages (id, from_agent, from_device, target_agent, target_project, target_device, content, priority, status, created_at)
-          VALUES (?, ?, 'local', ?, ?, ?, ?, ?, 'pending', ?)`,
+    sql: `INSERT INTO messages (id, from_agent, from_device, target_agent, target_project, target_device, session_scope, content, priority, status, created_at)
+          VALUES (?, ?, 'local', ?, ?, ?, ?, ?, ?, 'pending', ?)`,
     args: [
       id,
       input.fromAgent,
       input.targetAgent,
       input.targetProject ?? null,
       targetDevice,
+      sessionScope,
       input.content,
       input.priority ?? "normal",
       now
@@ -12030,9 +12400,10 @@ async function sendMessage(input) {
     }
   } catch {
   }
+  const sentScope = strictSessionScopeFilter(sessionScope);
   const result = await client.execute({
-    sql: "SELECT * FROM messages WHERE id = ?",
-    args: [id]
+    sql: `SELECT * FROM messages WHERE id = ?${sentScope.sql}`,
+    args: [id, ...sentScope.args]
   });
   return rowToMessage(result.rows[0]);
 }
@@ -12056,6 +12427,7 @@ async function deliverCrossMachineMessage(messageId, targetDevice) {
     fromAgent: msg.fromAgent,
     targetAgent: msg.targetAgent,
     targetProject: msg.targetProject,
+    sessionScope: msg.sessionScope,
     content: msg.content,
     priority: msg.priority,
     createdAt: msg.createdAt
@@ -12099,7 +12471,7 @@ async function deliverLocalMessage(messageId) {
   } catch {
     const newRetryCount = msg.retryCount + 1;
     if (newRetryCount >= MAX_RETRIES3) {
-      await markFailed(messageId, "session unavailable after 10 retries");
+      await markFailed(messageId, "session unavailable after 10 retries", msg.sessionScope);
     } else {
       await client.execute({
         sql: "UPDATE messages SET retry_count = ? WHERE id = ?",
@@ -12109,85 +12481,101 @@ async function deliverLocalMessage(messageId) {
     return false;
   }
 }
-async function getPendingMessages(targetAgent) {
+async function getPendingMessages(targetAgent, sessionScope) {
   const client = getClient();
+  const scope = strictSessionScopeFilter(sessionScope);
   const result = await client.execute({
     sql: `SELECT * FROM messages
-          WHERE target_agent = ? AND status IN ('pending', 'delivered')
+          WHERE target_agent = ? AND status IN ('pending', 'delivered')${scope.sql}
           ORDER BY id`,
-    args: [targetAgent]
+    args: [targetAgent, ...scope.args]
   });
   return result.rows.map((row) => rowToMessage(row));
 }
-async function markRead(messageId) {
+async function markRead(messageId, sessionScope) {
   const client = getClient();
+  const scope = strictSessionScopeFilter(sessionScope);
   await client.execute({
-    sql: "UPDATE messages SET status = 'read' WHERE id = ? AND status IN ('pending', 'delivered')",
-    args: [messageId]
+    sql: `UPDATE messages SET status = 'read'
+          WHERE id = ? AND status IN ('pending', 'delivered')${scope.sql}`,
+    args: [messageId, ...scope.args]
   });
 }
-async function markAcknowledged(messageId) {
+async function markAcknowledged(messageId, sessionScope) {
   const client = getClient();
+  const scope = strictSessionScopeFilter(sessionScope);
   await client.execute({
-    sql: "UPDATE messages SET status = 'acknowledged', processed_at = ? WHERE id = ? AND status = 'read'",
-    args: [(/* @__PURE__ */ new Date()).toISOString(), messageId]
+    sql: `UPDATE messages SET status = 'acknowledged', processed_at = ?
+          WHERE id = ? AND status = 'read'${scope.sql}`,
+    args: [(/* @__PURE__ */ new Date()).toISOString(), messageId, ...scope.args]
   });
 }
-async function markProcessed(messageId) {
+async function markProcessed(messageId, sessionScope) {
   const client = getClient();
+  const scope = strictSessionScopeFilter(sessionScope);
   await client.execute({
-    sql: "UPDATE messages SET status = 'processed', processed_at = ? WHERE id = ?",
-    args: [(/* @__PURE__ */ new Date()).toISOString(), messageId]
+    sql: `UPDATE messages SET status = 'processed', processed_at = ?
+          WHERE id = ?${scope.sql}`,
+    args: [(/* @__PURE__ */ new Date()).toISOString(), messageId, ...scope.args]
   });
 }
-async function getMessageStatus(messageId) {
+async function getMessageStatus(messageId, sessionScope) {
   const client = getClient();
+  const scope = strictSessionScopeFilter(sessionScope);
   const result = await client.execute({
-    sql: "SELECT status FROM messages WHERE id = ?",
-    args: [messageId]
+    sql: `SELECT status FROM messages WHERE id = ?${scope.sql}`,
+    args: [messageId, ...scope.args]
   });
   return result.rows[0]?.status ?? null;
 }
-async function getUnacknowledgedMessages(targetAgent) {
+async function getUnacknowledgedMessages(targetAgent, sessionScope) {
   const client = getClient();
+  const scope = strictSessionScopeFilter(sessionScope);
   const result = await client.execute({
     sql: `SELECT * FROM messages
-          WHERE target_agent = ? AND status IN ('pending', 'delivered', 'read')
+          WHERE target_agent = ? AND status IN ('pending', 'delivered', 'read')${scope.sql}
           ORDER BY id`,
-    args: [targetAgent]
+    args: [targetAgent, ...scope.args]
   });
   return result.rows.map((row) => rowToMessage(row));
 }
-async function getReadMessages(targetAgent) {
+async function getReadMessages(targetAgent, sessionScope) {
   const client = getClient();
+  const scope = strictSessionScopeFilter(sessionScope);
   const result = await client.execute({
-    sql: "SELECT * FROM messages WHERE target_agent = ? AND status = 'read' ORDER BY id",
-    args: [targetAgent]
+    sql: `SELECT * FROM messages
+          WHERE target_agent = ? AND status = 'read'${scope.sql}
+          ORDER BY id`,
+    args: [targetAgent, ...scope.args]
   });
   return result.rows.map((row) => rowToMessage(row));
 }
-async function markFailed(messageId, reason) {
+async function markFailed(messageId, reason, sessionScope) {
   const client = getClient();
+  const scope = strictSessionScopeFilter(sessionScope);
   await client.execute({
-    sql: "UPDATE messages SET status = 'failed', failed_at = ?, failure_reason = ? WHERE id = ?",
-    args: [(/* @__PURE__ */ new Date()).toISOString(), reason, messageId]
+    sql: `UPDATE messages SET status = 'failed', failed_at = ?, failure_reason = ?
+          WHERE id = ?${scope.sql}`,
+    args: [(/* @__PURE__ */ new Date()).toISOString(), reason, messageId, ...scope.args]
   });
 }
-async function getFailedMessages() {
+async function getFailedMessages(sessionScope) {
   const client = getClient();
+  const scope = strictSessionScopeFilter(sessionScope);
   const result = await client.execute({
-    sql: "SELECT * FROM messages WHERE status = 'failed' ORDER BY created_at DESC",
-    args: []
+    sql: `SELECT * FROM messages WHERE status = 'failed'${scope.sql} ORDER BY created_at DESC`,
+    args: [...scope.args]
   });
   return result.rows.map((row) => rowToMessage(row));
 }
-async function retryPendingMessages() {
+async function retryPendingMessages(sessionScope) {
   const client = getClient();
+  const scope = strictSessionScopeFilter(sessionScope);
   const result = await client.execute({
     sql: `SELECT * FROM messages
-          WHERE status = 'pending' AND retry_count < ?
+          WHERE status = 'pending' AND retry_count < ?${scope.sql}
           ORDER BY id`,
-    args: [MAX_RETRIES3]
+    args: [MAX_RETRIES3, ...scope.args]
   });
   let delivered = 0;
   for (const row of result.rows) {
@@ -12206,6 +12594,7 @@ var init_messaging = __esm({
     "use strict";
     init_database();
     init_tmux_routing();
+    init_task_scope();
     MAX_RETRIES3 = 10;
     _wsClientSend = null;
   }
@@ -12221,9 +12610,9 @@ __export(active_agent_exports, {
   resolveActiveAgentFromTmuxSession: () => resolveActiveAgentFromTmuxSession,
   writeActiveAgent: () => writeActiveAgent
 });
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync15, mkdirSync as mkdirSync16, unlinkSync as unlinkSync9, readdirSync as readdirSync7 } from "fs";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync16, mkdirSync as mkdirSync15, unlinkSync as unlinkSync9, readdirSync as readdirSync7 } from "fs";
 import { execSync as execSync9 } from "child_process";
-import path28 from "path";
+import path29 from "path";
 function isNameWithOptionalInstance(candidate, baseName) {
   if (candidate === baseName) return true;
   if (!candidate.startsWith(baseName)) return false;
@@ -12267,12 +12656,12 @@ function resolveActiveAgentFromTmuxSession(sessionName) {
   return null;
 }
 function getMarkerPath() {
-  return path28.join(CACHE_DIR, `active-agent-${getSessionKey()}.json`);
+  return path29.join(CACHE_DIR, `active-agent-${getSessionKey()}.json`);
 }
 function writeActiveAgent(agentId, agentRole) {
   try {
-    mkdirSync16(CACHE_DIR, { recursive: true });
-    writeFileSync15(
+    mkdirSync15(CACHE_DIR, { recursive: true });
+    writeFileSync16(
       getMarkerPath(),
       JSON.stringify({ agentId, agentRole, startedAt: (/* @__PURE__ */ new Date()).toISOString() })
     );
@@ -12288,7 +12677,7 @@ function clearActiveAgent() {
 function getActiveAgent() {
   try {
     const markerPath = getMarkerPath();
-    const raw = readFileSync19(markerPath, "utf8");
+    const raw = readFileSync20(markerPath, "utf8");
     const data = JSON.parse(raw);
     if (data.agentId) {
       if (data.startedAt) {
@@ -12336,14 +12725,14 @@ function getAllActiveAgents() {
       const key = file.slice("active-agent-".length, -".json".length);
       if (key === "undefined") continue;
       try {
-        const raw = readFileSync19(path28.join(CACHE_DIR, file), "utf8");
+        const raw = readFileSync20(path29.join(CACHE_DIR, file), "utf8");
         const data = JSON.parse(raw);
         if (!data.agentId) continue;
         if (data.startedAt) {
           const age = Date.now() - new Date(data.startedAt).getTime();
           if (age > STALE_MS) {
             try {
-              unlinkSync9(path28.join(CACHE_DIR, file));
+              unlinkSync9(path29.join(CACHE_DIR, file));
             } catch {
             }
             continue;
@@ -12366,11 +12755,11 @@ function getAllActiveAgents() {
 function cleanupSessionMarkers() {
   const key = getSessionKey();
   try {
-    unlinkSync9(path28.join(CACHE_DIR, `active-agent-${key}.json`));
+    unlinkSync9(path29.join(CACHE_DIR, `active-agent-${key}.json`));
   } catch {
   }
   try {
-    unlinkSync9(path28.join(CACHE_DIR, "active-agent-undefined.json"));
+    unlinkSync9(path29.join(CACHE_DIR, "active-agent-undefined.json"));
   } catch {
   }
 }
@@ -12381,7 +12770,7 @@ var init_active_agent = __esm({
     init_config();
     init_session_key();
     init_employees();
-    CACHE_DIR = path28.join(EXE_AI_DIR, "session-cache");
+    CACHE_DIR = path29.join(EXE_AI_DIR, "session-cache");
     STALE_MS = 24 * 60 * 60 * 1e3;
   }
 });
@@ -13009,14 +13398,14 @@ __export(exe_rename_exports, {
   main: () => main2,
   renameEmployee: () => renameEmployee
 });
-import { readFileSync as readFileSync20, writeFileSync as writeFileSync16, renameSync as renameSync4, unlinkSync as unlinkSync10, existsSync as existsSync22 } from "fs";
+import { readFileSync as readFileSync21, writeFileSync as writeFileSync17, renameSync as renameSync4, unlinkSync as unlinkSync10, existsSync as existsSync24 } from "fs";
 import { execSync as execSync10 } from "child_process";
-import path29 from "path";
+import path30 from "path";
 import { homedir as homedir4 } from "os";
 async function renameEmployee(oldName, newName, opts = {}) {
-  const rosterPath = opts.rosterPath ?? path29.join(homedir4(), ".exe-os", "exe-employees.json");
-  const identityDir = opts.identityDir ?? path29.join(homedir4(), ".exe-os", "identity");
-  const agentsDir = opts.agentsDir ?? path29.join(homedir4(), ".claude", "agents");
+  const rosterPath = opts.rosterPath ?? path30.join(homedir4(), ".exe-os", "exe-employees.json");
+  const identityDir = opts.identityDir ?? path30.join(homedir4(), ".exe-os", "identity");
+  const agentsDir = opts.agentsDir ?? path30.join(homedir4(), ".claude", "agents");
   const validation = validateEmployeeName(newName);
   if (!validation.valid) {
     return { success: false, error: validation.error };
@@ -13045,40 +13434,40 @@ async function renameEmployee(oldName, newName, opts = {}) {
       undo: () => {
         employee.name = originalName;
         employee.systemPrompt = originalPrompt;
-        writeFileSync16(rosterPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
+        writeFileSync17(rosterPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
       }
     });
-    const oldIdentityPath = path29.join(identityDir, `${rosterOldName}.md`);
-    const newIdentityPath = path29.join(identityDir, `${newName}.md`);
-    if (existsSync22(oldIdentityPath)) {
-      const content = readFileSync20(oldIdentityPath, "utf-8");
+    const oldIdentityPath = path30.join(identityDir, `${rosterOldName}.md`);
+    const newIdentityPath = path30.join(identityDir, `${newName}.md`);
+    if (existsSync24(oldIdentityPath)) {
+      const content = readFileSync21(oldIdentityPath, "utf-8");
       const updatedContent = content.replace(
         /^(agent_id:\s*)\S+/m,
         `$1${newName}`
       );
       renameSync4(oldIdentityPath, newIdentityPath);
-      writeFileSync16(newIdentityPath, updatedContent, "utf-8");
+      writeFileSync17(newIdentityPath, updatedContent, "utf-8");
       rollbackStack.push({
         description: "restore identity file",
         undo: () => {
-          if (existsSync22(newIdentityPath)) {
-            writeFileSync16(newIdentityPath, content, "utf-8");
+          if (existsSync24(newIdentityPath)) {
+            writeFileSync17(newIdentityPath, content, "utf-8");
             renameSync4(newIdentityPath, oldIdentityPath);
           }
         }
       });
     }
-    const oldAgentPath = path29.join(agentsDir, `${rosterOldName}.md`);
-    const newAgentPath = path29.join(agentsDir, `${newName}.md`);
-    if (existsSync22(oldAgentPath)) {
-      const agentContent = readFileSync20(oldAgentPath, "utf-8");
+    const oldAgentPath = path30.join(agentsDir, `${rosterOldName}.md`);
+    const newAgentPath = path30.join(agentsDir, `${newName}.md`);
+    if (existsSync24(oldAgentPath)) {
+      const agentContent = readFileSync21(oldAgentPath, "utf-8");
       renameSync4(oldAgentPath, newAgentPath);
       rollbackStack.push({
         description: "restore agent file",
         undo: () => {
-          if (existsSync22(newAgentPath)) {
+          if (existsSync24(newAgentPath)) {
             renameSync4(newAgentPath, oldAgentPath);
-            writeFileSync16(oldAgentPath, agentContent, "utf-8");
+            writeFileSync17(oldAgentPath, agentContent, "utf-8");
           }
         }
       });
@@ -13156,10 +13545,10 @@ function removeOldSymlinks(name) {
   try {
     const exeBinPath = findExeBin2();
     if (!exeBinPath) return;
-    const binDir = path29.dirname(exeBinPath);
+    const binDir = path30.dirname(exeBinPath);
     for (const suffix of ["", "-opencode"]) {
-      const linkPath = path29.join(binDir, `${name}${suffix}`);
-      if (existsSync22(linkPath)) {
+      const linkPath = path30.join(binDir, `${name}${suffix}`);
+      if (existsSync24(linkPath)) {
         try {
           unlinkSync10(linkPath);
         } catch {
@@ -13204,16 +13593,16 @@ var init_exe_rename = __esm({
 });
 
 // src/lib/model-downloader.ts
-import { createWriteStream, createReadStream as createReadStream2, existsSync as existsSync23, unlinkSync as unlinkSync11, renameSync as renameSync5 } from "fs";
+import { createWriteStream, createReadStream as createReadStream2, existsSync as existsSync25, unlinkSync as unlinkSync11, renameSync as renameSync5 } from "fs";
 import { mkdir as mkdir6 } from "fs/promises";
 import { createHash as createHash3 } from "crypto";
-import path30 from "path";
+import path31 from "path";
 async function downloadModel(opts) {
   const { destDir, onProgress, fetchFn = globalThis.fetch } = opts;
-  const destPath = path30.join(destDir, LOCAL_FILENAME);
+  const destPath = path31.join(destDir, LOCAL_FILENAME);
   const tmpPath = destPath + ".tmp";
   await mkdir6(destDir, { recursive: true });
-  if (existsSync23(destPath)) {
+  if (existsSync25(destPath)) {
     const hash = await fileHash(destPath);
     if (hash === EXPECTED_SHA256) {
       return destPath;
@@ -13225,7 +13614,7 @@ async function downloadModel(opts) {
   let downloaded = 0;
   for (let attempt = 1; attempt <= MAX_RETRIES4; attempt++) {
     try {
-      if (existsSync23(tmpPath)) unlinkSync11(tmpPath);
+      if (existsSync25(tmpPath)) unlinkSync11(tmpPath);
       const response = await fetchFn(GGUF_URL, {
         redirect: "follow",
         signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
@@ -13270,7 +13659,7 @@ async function downloadModel(opts) {
         process.stderr.write(`
 Download attempt ${attempt} failed, retrying...
 `);
-        if (existsSync23(tmpPath)) unlinkSync11(tmpPath);
+        if (existsSync25(tmpPath)) unlinkSync11(tmpPath);
       }
     }
   }
@@ -13333,10 +13722,10 @@ async function disposeEmbedder() {
 async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync30 } = await import("fs");
-  const path45 = await import("path");
-  const modelPath = path45.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync30(modelPath)) {
+  const { existsSync: existsSync32 } = await import("fs");
+  const path46 = await import("path");
+  const modelPath = path46.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync32(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -13911,36 +14300,36 @@ __export(session_wrappers_exports, {
   generateSessionWrappers: () => generateSessionWrappers
 });
 import {
-  existsSync as existsSync24,
-  readFileSync as readFileSync21,
-  writeFileSync as writeFileSync17,
-  mkdirSync as mkdirSync17,
-  chmodSync,
+  existsSync as existsSync26,
+  readFileSync as readFileSync22,
+  writeFileSync as writeFileSync18,
+  mkdirSync as mkdirSync16,
+  chmodSync as chmodSync2,
   readdirSync as readdirSync8,
   unlinkSync as unlinkSync12
 } from "fs";
-import path31 from "path";
+import path32 from "path";
 import { homedir as homedir5 } from "os";
 function generateSessionWrappers(packageRoot, homeDir) {
   const home = homeDir ?? homedir5();
-  const binDir = path31.join(home, ".exe-os", "bin");
-  const rosterPath = path31.join(home, ".exe-os", "exe-employees.json");
-  mkdirSync17(binDir, { recursive: true });
-  const exeStartDst = path31.join(binDir, "exe-start");
+  const binDir = path32.join(home, ".exe-os", "bin");
+  const rosterPath = path32.join(home, ".exe-os", "exe-employees.json");
+  mkdirSync16(binDir, { recursive: true });
+  const exeStartDst = path32.join(binDir, "exe-start");
   const candidates = [
-    path31.join(packageRoot, "dist", "bin", "exe-start.sh"),
-    path31.join(packageRoot, "src", "bin", "exe-start.sh")
+    path32.join(packageRoot, "dist", "bin", "exe-start.sh"),
+    path32.join(packageRoot, "src", "bin", "exe-start.sh")
   ];
   for (const src of candidates) {
-    if (existsSync24(src)) {
-      writeFileSync17(exeStartDst, readFileSync21(src));
-      chmodSync(exeStartDst, 493);
+    if (existsSync26(src)) {
+      writeFileSync18(exeStartDst, readFileSync22(src));
+      chmodSync2(exeStartDst, 493);
       break;
     }
   }
   let employees = [];
   try {
-    employees = JSON.parse(readFileSync21(rosterPath, "utf8"));
+    employees = JSON.parse(readFileSync22(rosterPath, "utf8"));
   } catch {
     return { created: 0, pathConfigured: false };
   }
@@ -13950,9 +14339,9 @@ function generateSessionWrappers(packageRoot, homeDir) {
   try {
     for (const f of readdirSync8(binDir)) {
       if (f === "exe-start") continue;
-      const fPath = path31.join(binDir, f);
+      const fPath = path32.join(binDir, f);
       try {
-        const content = readFileSync21(fPath, "utf8");
+        const content = readFileSync22(fPath, "utf8");
         if (content.includes("exe-start")) {
           unlinkSync12(fPath);
         }
@@ -13967,31 +14356,31 @@ exec "${exeStartDst}" "$0" "$@"
 `;
   for (const emp of employees) {
     for (let n = 1; n <= MAX_N; n++) {
-      const wrapperPath = path31.join(binDir, `${emp.name}${n}`);
-      writeFileSync17(wrapperPath, wrapperContent);
-      chmodSync(wrapperPath, 493);
+      const wrapperPath = path32.join(binDir, `${emp.name}${n}`);
+      writeFileSync18(wrapperPath, wrapperContent);
+      chmodSync2(wrapperPath, 493);
       created++;
     }
   }
   const codexLauncherCandidates = [
-    path31.join(packageRoot, "dist", "bin", "exe-start-codex.js"),
-    path31.join(packageRoot, "src", "bin", "exe-start-codex.ts")
+    path32.join(packageRoot, "dist", "bin", "exe-start-codex.js"),
+    path32.join(packageRoot, "src", "bin", "exe-start-codex.ts")
   ];
   let codexLauncher = null;
   for (const c of codexLauncherCandidates) {
-    if (existsSync24(c)) {
+    if (existsSync26(c)) {
       codexLauncher = c;
       break;
     }
   }
   if (codexLauncher) {
     for (const emp of employees) {
-      const wrapperPath = path31.join(binDir, `${emp.name}-codex`);
+      const wrapperPath = path32.join(binDir, `${emp.name}-codex`);
       const content = `#!/bin/bash
 exec node "${codexLauncher}" --agent ${emp.name} "$@"
 `;
-      writeFileSync17(wrapperPath, content);
-      chmodSync(wrapperPath, 493);
+      writeFileSync18(wrapperPath, content);
+      chmodSync2(wrapperPath, 493);
       created++;
     }
   }
@@ -14009,24 +14398,24 @@ export PATH="${binDir}:$PATH"
   const shell = process.env.SHELL ?? "/bin/bash";
   const profilePaths = [];
   if (shell.includes("zsh")) {
-    profilePaths.push(path31.join(home, ".zshrc"));
+    profilePaths.push(path32.join(home, ".zshrc"));
   } else if (shell.includes("bash")) {
-    profilePaths.push(path31.join(home, ".bashrc"));
-    profilePaths.push(path31.join(home, ".bash_profile"));
+    profilePaths.push(path32.join(home, ".bashrc"));
+    profilePaths.push(path32.join(home, ".bash_profile"));
   } else {
-    profilePaths.push(path31.join(home, ".profile"));
+    profilePaths.push(path32.join(home, ".profile"));
   }
   for (const profilePath of profilePaths) {
     try {
       let content = "";
       try {
-        content = readFileSync21(profilePath, "utf8");
+        content = readFileSync22(profilePath, "utf8");
       } catch {
       }
       if (content.includes(".exe-os/bin")) {
         return false;
       }
-      writeFileSync17(profilePath, content + exportLine);
+      writeFileSync18(profilePath, content + exportLine);
       return true;
     } catch {
       continue;
@@ -14048,37 +14437,37 @@ __export(setup_wizard_exports, {
   runSetupWizard: () => runSetupWizard,
   validateModel: () => validateModel
 });
-import crypto11 from "crypto";
-import { existsSync as existsSync25, mkdirSync as mkdirSync18, readFileSync as readFileSync22, writeFileSync as writeFileSync18, unlinkSync as unlinkSync13 } from "fs";
-import os15 from "os";
-import path32 from "path";
+import crypto12 from "crypto";
+import { existsSync as existsSync27, mkdirSync as mkdirSync17, readFileSync as readFileSync23, writeFileSync as writeFileSync19, unlinkSync as unlinkSync13 } from "fs";
+import os16 from "os";
+import path33 from "path";
 import { createInterface as createInterface3 } from "readline";
 function findPackageRoot2() {
-  let dir = path32.dirname(new URL(import.meta.url).pathname);
-  const root = path32.parse(dir).root;
+  let dir = path33.dirname(new URL(import.meta.url).pathname);
+  const root = path33.parse(dir).root;
   while (dir !== root) {
-    const pkgPath = path32.join(dir, "package.json");
-    if (existsSync25(pkgPath)) {
+    const pkgPath = path33.join(dir, "package.json");
+    if (existsSync27(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync22(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync23(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
       } catch {
       }
     }
-    dir = path32.dirname(dir);
+    dir = path33.dirname(dir);
   }
   return null;
 }
 function loadSetupState() {
   try {
-    return JSON.parse(readFileSync22(SETUP_STATE_PATH, "utf8"));
+    return JSON.parse(readFileSync23(SETUP_STATE_PATH, "utf8"));
   } catch {
     return { completedSteps: [], startedAt: (/* @__PURE__ */ new Date()).toISOString() };
   }
 }
 function saveSetupState(state) {
-  mkdirSync18(path32.dirname(SETUP_STATE_PATH), { recursive: true });
-  writeFileSync18(SETUP_STATE_PATH, JSON.stringify(state, null, 2));
+  mkdirSync17(path33.dirname(SETUP_STATE_PATH), { recursive: true });
+  writeFileSync19(SETUP_STATE_PATH, JSON.stringify(state, null, 2));
 }
 function clearSetupState() {
   try {
@@ -14097,10 +14486,10 @@ function ask2(rl, prompt) {
   });
 }
 function getAvailableMemoryGB() {
-  return os15.freemem() / (1024 * 1024 * 1024);
+  return os16.freemem() / (1024 * 1024 * 1024);
 }
 function getTotalMemoryGB() {
-  return os15.totalmem() / (1024 * 1024 * 1024);
+  return os16.totalmem() / (1024 * 1024 * 1024);
 }
 function isLowMemory() {
   return getAvailableMemoryGB() < 2;
@@ -14111,8 +14500,8 @@ async function validateModel(log) {
   if (totalGB <= 8 || isLowMemory()) {
     log(`System memory: ${totalGB.toFixed(0)}GB total, ${freeGB.toFixed(1)}GB free`);
     log("Skipping in-memory model validation (low memory \u2014 will validate on first use).");
-    const modelPath = path32.join(MODELS_DIR, LOCAL_FILENAME);
-    if (existsSync25(modelPath)) {
+    const modelPath = path33.join(MODELS_DIR, LOCAL_FILENAME);
+    if (existsSync27(modelPath)) {
       const { statSync: statSync2 } = await import("fs");
       const size = statSync2(modelPath).size;
       if (size > 300 * 1e6) {
@@ -14203,7 +14592,7 @@ async function runSetupWizard(opts = {}) {
     if (state.completedSteps.length > 0) {
       log(`Resuming setup from step ${Math.max(...state.completedSteps) + 1}...`);
     }
-    if (existsSync25(LEGACY_LANCE_PATH)) {
+    if (existsSync27(LEGACY_LANCE_PATH)) {
       log("\u26A0 Found v1.0 LanceDB at ~/.exe-os/local.lance");
       log("  v1.1 uses libSQL (SQLite). Your existing memories are not automatically migrated.");
       log("  The old directory will not be modified or deleted.");
@@ -14215,7 +14604,7 @@ async function runSetupWizard(opts = {}) {
         log("Encryption key already exists \u2014 skipping generation.");
       } else {
         log("Generating 256-bit encryption key...");
-        const key = crypto11.randomBytes(32);
+        const key = crypto12.randomBytes(32);
         await setMasterKey(key);
         log("Encryption key generated and stored securely.");
       }
@@ -14367,19 +14756,19 @@ async function runSetupWizard(opts = {}) {
       await saveConfig(config);
       log("");
       try {
-        const claudeJsonPath = path32.join(os15.homedir(), ".claude.json");
+        const claudeJsonPath = path33.join(os16.homedir(), ".claude.json");
         let claudeJson = {};
         try {
-          claudeJson = JSON.parse(readFileSync22(claudeJsonPath, "utf8"));
+          claudeJson = JSON.parse(readFileSync23(claudeJsonPath, "utf8"));
         } catch {
         }
         if (!claudeJson.projects) claudeJson.projects = {};
         const projects = claudeJson.projects;
-        for (const dir of [process.cwd(), os15.homedir()]) {
+        for (const dir of [process.cwd(), os16.homedir()]) {
           if (!projects[dir]) projects[dir] = {};
           projects[dir].hasTrustDialogAccepted = true;
         }
-        writeFileSync18(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
+        writeFileSync19(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
       } catch {
       }
       state.completedSteps.push(5);
@@ -14393,7 +14782,7 @@ async function runSetupWizard(opts = {}) {
       const prefs = { ...existingPrefs };
       log("=== Config Defaults ===");
       log("");
-      const ghosttyDetected = existsSync25(path32.join(os15.homedir(), ".config", "ghostty")) || existsSync25(path32.join(os15.homedir(), "Library", "Application Support", "com.mitchellh.ghostty"));
+      const ghosttyDetected = existsSync27(path33.join(os16.homedir(), ".config", "ghostty")) || existsSync27(path33.join(os16.homedir(), "Library", "Application Support", "com.mitchellh.ghostty"));
       if (ghosttyDetected) {
         const ghosttyAnswer = await ask2(rl, "Detected Ghostty terminal. Use exe-os Ghostty defaults? (Y/n) ");
         prefs.ghostty = ghosttyAnswer.toLowerCase() !== "n";
@@ -14440,7 +14829,7 @@ async function runSetupWizard(opts = {}) {
       let missingIdentities = [];
       for (const emp of roster) {
         const idPath = identityPath2(emp.name);
-        if (!existsSync25(idPath)) {
+        if (!existsSync27(idPath)) {
           missingIdentities.push(emp.name);
         }
       }
@@ -14472,7 +14861,7 @@ async function runSetupWizard(opts = {}) {
           }
           missingIdentities = [];
           for (const emp of roster) {
-            if (!existsSync25(identityPath2(emp.name))) {
+            if (!existsSync27(identityPath2(emp.name))) {
               missingIdentities.push(emp.name);
             }
           }
@@ -14537,9 +14926,9 @@ async function runSetupWizard(opts = {}) {
       const cooIdentityContent = getIdentityTemplate("coo");
       if (cooIdentityContent) {
         const cooIdPath = identityPath2(cooName);
-        mkdirSync18(path32.dirname(cooIdPath), { recursive: true });
+        mkdirSync17(path33.dirname(cooIdPath), { recursive: true });
         const replaced = cooIdentityContent.replace(/agent_id:\s*exe/g, `agent_id: ${cooName}`).replace(/\$\{agent_id\}/g, cooName);
-        writeFileSync18(cooIdPath, replaced, "utf-8");
+        writeFileSync19(cooIdPath, replaced, "utf-8");
       }
       registerBinSymlinks2(cooName);
       createdEmployees.push({ name: cooName, role: "COO" });
@@ -14633,9 +15022,9 @@ async function runSetupWizard(opts = {}) {
       const ctoIdentityContent = getIdentityTemplate("cto");
       if (ctoIdentityContent) {
         const ctoIdPath = identityPath2(ctoName);
-        mkdirSync18(path32.dirname(ctoIdPath), { recursive: true });
+        mkdirSync17(path33.dirname(ctoIdPath), { recursive: true });
         const replaced = ctoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${ctoName}`).replace(/\$\{agent_id\}/g, ctoName);
-        writeFileSync18(ctoIdPath, replaced, "utf-8");
+        writeFileSync19(ctoIdPath, replaced, "utf-8");
       }
       registerBinSymlinks2(ctoName);
       createdEmployees.push({ name: ctoName, role: "CTO" });
@@ -14656,9 +15045,9 @@ async function runSetupWizard(opts = {}) {
       const cmoIdentityContent = getIdentityTemplate("cmo");
       if (cmoIdentityContent) {
         const cmoIdPath = identityPath2(cmoName);
-        mkdirSync18(path32.dirname(cmoIdPath), { recursive: true });
+        mkdirSync17(path33.dirname(cmoIdPath), { recursive: true });
         const replaced = cmoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${cmoName}`).replace(/\$\{agent_id\}/g, cmoName);
-        writeFileSync18(cmoIdPath, replaced, "utf-8");
+        writeFileSync19(cmoIdPath, replaced, "utf-8");
       }
       registerBinSymlinks2(cmoName);
       createdEmployees.push({ name: cmoName, role: "CMO" });
@@ -14680,7 +15069,7 @@ async function runSetupWizard(opts = {}) {
             log(`Session shortcuts generated (${cooName}1, ${cooName}2, ...)`);
           }
           if (wrapResult.pathConfigured) {
-            const binDir = path32.join(os15.homedir(), ".exe-os", "bin");
+            const binDir = path33.join(os16.homedir(), ".exe-os", "bin");
             process.env.PATH = `${binDir}:${process.env.PATH ?? ""}`;
             pathJustConfigured = true;
           }
@@ -14723,7 +15112,7 @@ async function runSetupWizard(opts = {}) {
     const pkgRoot2 = findPackageRoot2();
     if (pkgRoot2) {
       try {
-        version = JSON.parse(readFileSync22(path32.join(pkgRoot2, "package.json"), "utf-8")).version;
+        version = JSON.parse(readFileSync23(path33.join(pkgRoot2, "package.json"), "utf-8")).version;
       } catch {
       }
     }
@@ -14757,17 +15146,17 @@ var init_setup_wizard = __esm({
     init_config();
     init_keychain();
     init_model_downloader();
-    SETUP_STATE_PATH = path32.join(os15.homedir(), ".exe-os", "setup-state.json");
+    SETUP_STATE_PATH = path33.join(os16.homedir(), ".exe-os", "setup-state.json");
   }
 });
 
 // src/lib/update-check.ts
 import { execSync as execSync11 } from "child_process";
-import { readFileSync as readFileSync23 } from "fs";
-import path33 from "path";
+import { readFileSync as readFileSync24 } from "fs";
+import path34 from "path";
 function getLocalVersion(packageRoot) {
-  const pkgPath = path33.join(packageRoot, "package.json");
-  const pkg = JSON.parse(readFileSync23(pkgPath, "utf-8"));
+  const pkgPath = path34.join(packageRoot, "package.json");
+  const pkg = JSON.parse(readFileSync24(pkgPath, "utf-8"));
   return pkg.version;
 }
 function getRemoteVersion() {
@@ -19291,8 +19680,8 @@ var init_ErrorOverview = __esm({
     "use strict";
     init_Box();
     init_Text();
-    cleanupPath = (path45) => {
-      return path45?.replace(`file://${cwd()}/`, "");
+    cleanupPath = (path46) => {
+      return path46?.replace(`file://${cwd()}/`, "");
     };
     stackUtils = new StackUtils({
       cwd: cwd(),
@@ -21700,11 +22089,11 @@ function Footer() {
       } catch {
       }
       try {
-        const { existsSync: existsSync30 } = await import("fs");
+        const { existsSync: existsSync32 } = await import("fs");
         const { join } = await import("path");
         const home = process.env.HOME ?? "";
         const pidPath = join(home, ".exe-os", "exed.pid");
-        setDaemon(existsSync30(pidPath) ? "running" : "stopped");
+        setDaemon(existsSync32(pidPath) ? "running" : "stopped");
       } catch {
         setDaemon("unknown");
       }
@@ -23746,10 +24135,10 @@ var init_hooks = __esm({
 });
 
 // src/runtime/safety-checks.ts
-import path34 from "path";
-import os16 from "os";
+import path35 from "path";
+import os17 from "os";
 function checkPathSafety(filePath) {
-  const resolved = path34.resolve(filePath);
+  const resolved = path35.resolve(filePath);
   for (const { pattern, reason } of BYPASS_IMMUNE_PATTERNS) {
     const matches = typeof pattern === "function" ? pattern(resolved) : pattern.test(resolved);
     if (matches) {
@@ -23759,7 +24148,7 @@ function checkPathSafety(filePath) {
   return { safe: true, bypassImmune: true };
 }
 function checkReadPathSafety(filePath) {
-  const resolved = path34.resolve(filePath);
+  const resolved = path35.resolve(filePath);
   const credPatterns = BYPASS_IMMUNE_PATTERNS.filter(
     (p) => typeof p.pattern !== "function" && (p.reason.includes("secrets") || p.reason.includes("Private key") || p.reason.includes("Credential"))
   );
@@ -23774,7 +24163,7 @@ var HOME, BYPASS_IMMUNE_PATTERNS;
 var init_safety_checks = __esm({
   "src/runtime/safety-checks.ts"() {
     "use strict";
-    HOME = os16.homedir();
+    HOME = os17.homedir();
     BYPASS_IMMUNE_PATTERNS = [
       {
         pattern: /\/\.git\/hooks\//,
@@ -23785,11 +24174,11 @@ var init_safety_checks = __esm({
         reason: "Git config can set hooks and command execution"
       },
       {
-        pattern: (p) => p.startsWith(path34.join(HOME, ".claude")),
+        pattern: (p) => p.startsWith(path35.join(HOME, ".claude")),
         reason: "Claude configuration files are protected"
       },
       {
-        pattern: (p) => p.startsWith(path34.join(HOME, ".exe-os")),
+        pattern: (p) => p.startsWith(path35.join(HOME, ".exe-os")),
         reason: "exe-os configuration files are protected"
       },
       {
@@ -23806,7 +24195,7 @@ var init_safety_checks = __esm({
       },
       {
         pattern: (p) => {
-          const name = path34.basename(p);
+          const name = path35.basename(p);
           return [".bashrc", ".zshrc", ".profile", ".bash_profile", ".zprofile", ".zshenv"].includes(name);
         },
         reason: "Shell configuration files can execute arbitrary code on login"
@@ -23833,7 +24222,7 @@ __export(file_read_exports, {
   FileReadTool: () => FileReadTool
 });
 import fs3 from "fs/promises";
-import path35 from "path";
+import path36 from "path";
 import { z } from "zod";
 function isBinary(buf) {
   for (let i = 0; i < buf.length; i++) {
@@ -23869,7 +24258,7 @@ var init_file_read = __esm({
         return { behavior: "allow" };
       },
       async call(input, context) {
-        const filePath = path35.isAbsolute(input.file_path) ? input.file_path : path35.resolve(context.cwd, input.file_path);
+        const filePath = path36.isAbsolute(input.file_path) ? input.file_path : path36.resolve(context.cwd, input.file_path);
         let stat2;
         try {
           stat2 = await fs3.stat(filePath);
@@ -23909,7 +24298,7 @@ __export(glob_exports, {
   GlobTool: () => GlobTool
 });
 import fs4 from "fs/promises";
-import path36 from "path";
+import path37 from "path";
 import { z as z2 } from "zod";
 async function walkDir(dir, maxDepth = 10) {
   const results = [];
@@ -23925,7 +24314,7 @@ async function walkDir(dir, maxDepth = 10) {
       if (entry.isDirectory() && (entry.name === "node_modules" || entry.name === ".git")) {
         continue;
       }
-      const fullPath = path36.join(current, entry.name);
+      const fullPath = path37.join(current, entry.name);
       if (entry.isDirectory()) {
         await walk(fullPath, depth + 1);
       } else {
@@ -23959,11 +24348,11 @@ var init_glob = __esm({
       inputSchema: inputSchema2,
       isReadOnly: true,
       async call(input, context) {
-        const baseDir = input.path ? path36.isAbsolute(input.path) ? input.path : path36.resolve(context.cwd, input.path) : context.cwd;
+        const baseDir = input.path ? path37.isAbsolute(input.path) ? input.path : path37.resolve(context.cwd, input.path) : context.cwd;
         try {
           const entries = await walkDir(baseDir);
           const matched = entries.filter(
-            (e) => simpleGlobMatch(path36.relative(baseDir, e.path), input.pattern)
+            (e) => simpleGlobMatch(path37.relative(baseDir, e.path), input.pattern)
           );
           matched.sort((a, b) => b.mtime - a.mtime);
           if (matched.length === 0) {
@@ -23989,7 +24378,7 @@ __export(grep_exports, {
 });
 import { spawn as spawn2 } from "child_process";
 import fs5 from "fs/promises";
-import path37 from "path";
+import path38 from "path";
 import { z as z3 } from "zod";
 function runRipgrep(input, searchPath, context) {
   return new Promise((resolve, reject) => {
@@ -24043,7 +24432,7 @@ async function nodeGrep(input, searchPath) {
     }
     for (const entry of entries) {
       if (entry.name === "node_modules" || entry.name === ".git") continue;
-      const fullPath = path37.join(dir, entry.name);
+      const fullPath = path38.join(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(fullPath);
       } else {
@@ -24089,7 +24478,7 @@ var init_grep = __esm({
       inputSchema: inputSchema3,
       isReadOnly: true,
       async call(input, context) {
-        const searchPath = input.path ? path37.isAbsolute(input.path) ? input.path : path37.resolve(context.cwd, input.path) : context.cwd;
+        const searchPath = input.path ? path38.isAbsolute(input.path) ? input.path : path38.resolve(context.cwd, input.path) : context.cwd;
         try {
           const result = await runRipgrep(input, searchPath, context);
           return result;
@@ -24114,7 +24503,7 @@ __export(file_write_exports, {
   FileWriteTool: () => FileWriteTool
 });
 import fs6 from "fs/promises";
-import path38 from "path";
+import path39 from "path";
 import { z as z4 } from "zod";
 var inputSchema4, FileWriteTool;
 var init_file_write = __esm({
@@ -24142,8 +24531,8 @@ var init_file_write = __esm({
         return { behavior: "allow" };
       },
       async call(input, context) {
-        const filePath = path38.isAbsolute(input.file_path) ? input.file_path : path38.resolve(context.cwd, input.file_path);
-        const dir = path38.dirname(filePath);
+        const filePath = path39.isAbsolute(input.file_path) ? input.file_path : path39.resolve(context.cwd, input.file_path);
+        const dir = path39.dirname(filePath);
         await fs6.mkdir(dir, { recursive: true });
         await fs6.writeFile(filePath, input.content, "utf-8");
         return {
@@ -24161,7 +24550,7 @@ __export(file_edit_exports, {
   FileEditTool: () => FileEditTool
 });
 import fs7 from "fs/promises";
-import path39 from "path";
+import path40 from "path";
 import { z as z5 } from "zod";
 function countOccurrences(haystack, needle) {
   let count = 0;
@@ -24202,7 +24591,7 @@ var init_file_edit = __esm({
         return { behavior: "allow" };
       },
       async call(input, context) {
-        const filePath = path39.isAbsolute(input.file_path) ? input.file_path : path39.resolve(context.cwd, input.file_path);
+        const filePath = path40.isAbsolute(input.file_path) ? input.file_path : path40.resolve(context.cwd, input.file_path);
         let content;
         try {
           content = await fs7.readFile(filePath, "utf-8");
@@ -24444,7 +24833,7 @@ var init_bash = __esm({
 // src/tui/views/CommandCenter.tsx
 import { useState as useState6, useEffect as useEffect8, useMemo as useMemo4, useCallback as useCallback4, useRef as useRef4 } from "react";
 import TextInput from "ink-text-input";
-import path40 from "path";
+import path41 from "path";
 import { homedir as homedir6 } from "os";
 import { Fragment as Fragment2, jsx as jsx7, jsxs as jsxs5 } from "react/jsx-runtime";
 function CommandCenterView({
@@ -24479,15 +24868,15 @@ function CommandCenterView({
         const { createPermissionsFromPreset: createPermissionsFromPreset2, EMPLOYEE_PERMISSIONS: EMPLOYEE_PERMISSIONS2 } = await Promise.resolve().then(() => (init_permissions(), permissions_exports));
         const { getPresetByRole: getPresetByRole2 } = await Promise.resolve().then(() => (init_permission_presets(), permission_presets_exports));
         const { createDefaultHooks: createDefaultHooks2 } = await Promise.resolve().then(() => (init_hooks(), hooks_exports));
-        const { readFileSync: readFileSync27, existsSync: existsSync30 } = await import("fs");
+        const { readFileSync: readFileSync28, existsSync: existsSync32 } = await import("fs");
         const { join } = await import("path");
         const { homedir: homedir8 } = await import("os");
         const configPath = join(homedir8(), ".exe-os", "config.json");
         let failoverChain = ["anthropic", "opencode", "gemini", "openai"];
         let providerConfigs = {};
-        if (existsSync30(configPath)) {
+        if (existsSync32(configPath)) {
           try {
-            const raw = JSON.parse(readFileSync27(configPath, "utf8"));
+            const raw = JSON.parse(readFileSync28(configPath, "utf8"));
             if (Array.isArray(raw.failoverChain)) failoverChain = raw.failoverChain;
             if (raw.providers && typeof raw.providers === "object") {
               providerConfigs = raw.providers;
@@ -24548,7 +24937,7 @@ function CommandCenterView({
           const markerDir = join(homedir8(), ".exe-os", "session-cache");
           const agentFiles = (await import("fs")).readdirSync(markerDir).filter((f) => f.startsWith("active-agent-"));
           for (const f of agentFiles) {
-            const data = JSON.parse(readFileSync27(join(markerDir, f), "utf8"));
+            const data = JSON.parse(readFileSync28(join(markerDir, f), "utf8"));
             if (data.agentRole) {
               agentRole = data.agentRole;
               break;
@@ -24693,7 +25082,7 @@ function CommandCenterView({
       const demoEntries = DEMO_PROJECTS.map((p) => ({
         projectName: p.projectName,
         exeSession: p.exeSession,
-        projectDir: path40.join(homedir6(), p.projectName),
+        projectDir: path41.join(homedir6(), p.projectName),
         employeeCount: p.employees.length,
         activeCount: p.employees.filter((e) => e.status === "active").length,
         memoryCount: p.employees.length * 4e3,
@@ -24731,7 +25120,7 @@ function CommandCenterView({
         const { listSessions: listSessions2 } = await Promise.resolve().then(() => (init_session_registry(), session_registry_exports));
         const { listTmuxSessions: listTmuxSessions2, inTmux: inTmux2 } = await Promise.resolve().then(() => (init_tmux_status(), tmux_status_exports));
         const { loadEmployees: loadEmployees2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
-        const { existsSync: existsSync30 } = await import("fs");
+        const { existsSync: existsSync32 } = await import("fs");
         const { join } = await import("path");
         const client = getClient2();
         if (!client) {
@@ -24802,7 +25191,7 @@ function CommandCenterView({
           }
           const memoryCount = memoryCounts.get(name) ?? 0;
           const openTaskCount = openTaskCounts.get(name) ?? 0;
-          const hasGit = projectDir ? existsSync30(join(projectDir, ".git")) : false;
+          const hasGit = projectDir ? existsSync32(join(projectDir, ".git")) : false;
           const type = hasGit ? "code" : memoryCount > 0 ? "code" : "automation";
           projectList.push({
             projectName: name,
@@ -24827,7 +25216,7 @@ function CommandCenterView({
         setHealth((h) => ({ ...h, memories: Number(totalResult.rows[0]?.cnt ?? 0) }));
         try {
           const pidPath = join(process.env.HOME ?? "", ".exe-os", "exed.pid");
-          setHealth((h) => ({ ...h, daemon: existsSync30(pidPath) ? "running" : "stopped" }));
+          setHealth((h) => ({ ...h, daemon: existsSync32(pidPath) ? "running" : "stopped" }));
         } catch {
         }
         const activityResult = await client.execute(
@@ -25697,7 +26086,7 @@ var init_useOrchestrator = __esm({
 
 // src/tui/views/Sessions.tsx
 import React19, { useState as useState9, useEffect as useEffect11, useCallback as useCallback6 } from "react";
-import path41 from "path";
+import path42 from "path";
 import { homedir as homedir7 } from "os";
 import { jsx as jsx9, jsxs as jsxs7 } from "react/jsx-runtime";
 function isCoordinatorEntry(entry) {
@@ -25735,7 +26124,7 @@ function SessionsView({
     if (demo) {
       setProjects(DEMO_PROJECTS.map((p) => ({
         ...p,
-        projectDir: path41.join(homedir7(), p.projectName),
+        projectDir: path42.join(homedir7(), p.projectName),
         employees: p.employees.map((e) => ({ ...e, attached: e.status === "active" }))
       })));
       return;
@@ -26145,6 +26534,133 @@ var init_Sessions = __esm({
   }
 });
 
+// src/lib/tui-data.ts
+var tui_data_exports = {};
+__export(tui_data_exports, {
+  loadMemoryDashboard: () => loadMemoryDashboard,
+  loadTaskList: () => loadTaskList,
+  loadTeamMetrics: () => loadTeamMetrics,
+  searchWikiMemoryRows: () => searchWikiMemoryRows
+});
+async function loadMemoryDashboard(limit) {
+  const client = getClient();
+  const [countResult, recentResult, agentResult] = await Promise.all([
+    client.execute("SELECT COUNT(*) as cnt FROM memories"),
+    client.execute({
+      sql: "SELECT agent_id, tool_name, project_name, raw_text, timestamp FROM memories ORDER BY timestamp DESC LIMIT ?",
+      args: [limit]
+    }),
+    client.execute("SELECT agent_id, COUNT(*) as cnt FROM memories GROUP BY agent_id ORDER BY cnt DESC")
+  ]);
+  return {
+    total: Number(countResult.rows[0]?.cnt ?? 0),
+    recent: recentResult.rows.map((row) => ({
+      agentId: String(row.agent_id ?? "unknown"),
+      toolName: String(row.tool_name ?? ""),
+      projectName: String(row.project_name ?? ""),
+      rawText: String(row.raw_text ?? ""),
+      timestamp: String(row.timestamp ?? "")
+    })),
+    byAgent: agentResult.rows.map((row) => ({
+      agentId: String(row.agent_id ?? "unknown"),
+      count: Number(row.cnt ?? 0)
+    }))
+  };
+}
+async function loadTeamMetrics(employeeNames) {
+  const client = getClient();
+  const memoryCounts = /* @__PURE__ */ new Map();
+  const projectsByEmployee = /* @__PURE__ */ new Map();
+  const currentTaskByEmployee = /* @__PURE__ */ new Map();
+  const scope = sessionScopeFilter();
+  const memResult = await client.execute("SELECT agent_id, COUNT(*) as cnt FROM memories GROUP BY agent_id");
+  for (const row of memResult.rows) {
+    memoryCounts.set(String(row.agent_id), Number(row.cnt));
+  }
+  for (const employeeName of employeeNames) {
+    const [projectResult, taskResult] = await Promise.all([
+      client.execute({
+        sql: `SELECT DISTINCT project_name,
+                     MAX(CASE WHEN status = 'in_progress' THEN 1 WHEN status = 'open' THEN 2 ELSE 3 END) as urgency
+              FROM tasks
+              WHERE assigned_to = ? AND status IN ('open','in_progress','done')${scope.sql}
+              GROUP BY project_name
+              ORDER BY urgency ASC
+              LIMIT 5`,
+        args: [employeeName, ...scope.args]
+      }),
+      client.execute({
+        sql: `SELECT title FROM tasks
+              WHERE assigned_to = ? AND status = 'in_progress'${scope.sql}
+              ORDER BY updated_at DESC
+              LIMIT 1`,
+        args: [employeeName, ...scope.args]
+      })
+    ]);
+    const projects = projectResult.rows.map((row) => {
+      const urgency = Number(row.urgency);
+      return {
+        name: String(row.project_name),
+        status: urgency === 1 ? "active" : urgency === 2 ? "has_tasks" : "idle"
+      };
+    });
+    if (projects.length > 0) projectsByEmployee.set(employeeName, projects);
+    if (taskResult.rows.length > 0) {
+      currentTaskByEmployee.set(employeeName, String(taskResult.rows[0].title));
+    }
+  }
+  return { memoryCounts, projectsByEmployee, currentTaskByEmployee };
+}
+async function loadTaskList() {
+  const client = getClient();
+  const scope = sessionScopeFilter();
+  const result = await client.execute({
+    sql: `SELECT id, title, priority, assigned_to, assigned_by, status, project_name, created_at, result
+          FROM tasks
+          WHERE 1=1${scope.sql}
+          ORDER BY
+            CASE status WHEN 'in_progress' THEN 0 WHEN 'open' THEN 1 WHEN 'blocked' THEN 2 WHEN 'needs_review' THEN 3 WHEN 'done' THEN 4 ELSE 5 END,
+            CASE priority WHEN 'p0' THEN 0 WHEN 'p1' THEN 1 WHEN 'p2' THEN 2 ELSE 3 END,
+            created_at DESC`,
+    args: [...scope.args]
+  });
+  return result.rows.map((row) => ({
+    id: String(row.id ?? ""),
+    title: String(row.title ?? ""),
+    priority: String(row.priority ?? "p2").toUpperCase(),
+    assignedTo: String(row.assigned_to ?? ""),
+    assignedBy: String(row.assigned_by ?? ""),
+    status: String(row.status ?? "open"),
+    projectName: String(row.project_name ?? ""),
+    createdAt: String(row.created_at ?? ""),
+    result: String(row.result ?? "")
+  }));
+}
+async function searchWikiMemoryRows(query) {
+  const client = getClient();
+  const result = await client.execute({
+    sql: `SELECT id, agent_id, raw_text, timestamp, project_name
+          FROM memories
+          WHERE raw_text LIKE ? AND COALESCE(status, 'active') = 'active'
+          ORDER BY timestamp DESC LIMIT 20`,
+    args: [`%${query}%`]
+  });
+  return result.rows.map((row) => ({
+    id: String(row.id),
+    agentId: String(row.agent_id),
+    rawText: String(row.raw_text),
+    timestamp: String(row.timestamp),
+    projectName: String(row.project_name ?? "")
+  }));
+}
+var init_tui_data = __esm({
+  "src/lib/tui-data.ts"() {
+    "use strict";
+    init_database();
+    init_task_scope();
+  }
+});
+
 // src/tui/views/Tasks.tsx
 import React20, { useState as useState10, useEffect as useEffect12, useMemo as useMemo5 } from "react";
 import { Fragment as Fragment3, jsx as jsx10, jsxs as jsxs8 } from "react/jsx-runtime";
@@ -26264,37 +26780,22 @@ function TasksView({ onBack }) {
     const { withTrace: withTrace2 } = await Promise.resolve().then(() => (init_telemetry(), telemetry_exports));
     return withTrace2("tui.tasks.loadTasks", async () => {
       try {
-        const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
-        const client = getClient2();
-        if (client) {
-          const tScope = sessionScopeFilter();
-          const result = await client.execute({
-            sql: `SELECT id, title, priority, assigned_to, assigned_by, status, project_name, created_at, result
-           FROM tasks
-           WHERE 1=1${tScope.sql}
-           ORDER BY
-             CASE status WHEN 'in_progress' THEN 0 WHEN 'open' THEN 1 WHEN 'blocked' THEN 2 WHEN 'needs_review' THEN 3 WHEN 'done' THEN 4 ELSE 5 END,
-             CASE priority WHEN 'p0' THEN 0 WHEN 'p1' THEN 1 WHEN 'p2' THEN 2 ELSE 3 END,
-             created_at DESC`,
-            args: [...tScope.args]
-          });
-          setAllTasks(
-            result.rows.map((r) => ({
-              id: String(r.id ?? ""),
-              priority: String(r.priority ?? "p2").toUpperCase(),
-              title: String(r.title ?? ""),
-              assignee: String(r.assigned_to ?? ""),
-              assignedBy: String(r.assigned_by ?? ""),
-              status: String(r.status ?? "open"),
-              project: String(r.project_name ?? ""),
-              createdAt: String(r.created_at ?? ""),
-              result: String(r.result ?? "")
-            }))
-          );
-          setDbError(null);
-        } else {
-          setDbError("Database client not initialized. Run exe-os setup.");
-        }
+        const { loadTaskList: loadTaskList2 } = await Promise.resolve().then(() => (init_tui_data(), tui_data_exports));
+        const tasks = await loadTaskList2();
+        setAllTasks(
+          tasks.map((task) => ({
+            id: task.id,
+            priority: task.priority,
+            title: task.title,
+            assignee: task.assignedTo,
+            assignedBy: task.assignedBy,
+            status: task.status,
+            project: task.projectName,
+            createdAt: task.createdAt,
+            result: task.result
+          }))
+        );
+        setDbError(null);
       } catch (err) {
         setDbError(err instanceof Error ? err.message : "Unknown error");
       } finally {
@@ -26423,7 +26924,6 @@ var init_Tasks = __esm({
     await init_ink2();
     init_DemoContext();
     init_demo_data();
-    init_task_scope();
     STATUS_FILTERS = ["all", "open", "in_progress", "done", "blocked", "needs_review"];
     PRIORITY_COLORS = {
       P0: "red",
@@ -26839,12 +27339,12 @@ async function loadGatewayConfig() {
     state.running = false;
   }
   try {
-    const { existsSync: existsSync30, readFileSync: readFileSync27 } = await import("fs");
+    const { existsSync: existsSync32, readFileSync: readFileSync28 } = await import("fs");
     const { join } = await import("path");
     const home = process.env.HOME ?? "";
     const configPath = join(home, ".exe-os", "gateway.json");
-    if (existsSync30(configPath)) {
-      const raw = JSON.parse(readFileSync27(configPath, "utf8"));
+    if (existsSync32(configPath)) {
+      const raw = JSON.parse(readFileSync28(configPath, "utf8"));
       state.port = raw.port ?? 3100;
       state.gatewayUrl = raw.gatewayUrl ?? "";
       if (raw.adapters) {
@@ -27414,41 +27914,16 @@ function TeamView({ onBack, onViewSessions }) {
         let projectsByEmployee = /* @__PURE__ */ new Map();
         let currentTaskByEmployee = /* @__PURE__ */ new Map();
         try {
-          const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
-          const client = getClient2();
-          if (client) {
-            const memResult = await client.execute("SELECT agent_id, COUNT(*) as cnt FROM memories GROUP BY agent_id");
-            for (const row of memResult.rows) {
-              memoryCounts.set(String(row.agent_id), Number(row.cnt));
-            }
-            const tmScope = sessionScopeFilter();
-            for (const emp of roster) {
-              const projResult = await client.execute({
-                sql: `SELECT DISTINCT project_name,
-                      MAX(CASE WHEN status = 'in_progress' THEN 1 WHEN status = 'open' THEN 2 ELSE 3 END) as urgency
-                    FROM tasks WHERE assigned_to = ? AND status IN ('open','in_progress','done')${tmScope.sql}
-                    GROUP BY project_name ORDER BY urgency ASC LIMIT 5`,
-                args: [emp.name, ...tmScope.args]
-              });
-              const projects = projResult.rows.filter((r) => !DEPRECATED_PROJECTS.has(String(r.project_name))).map((r) => {
-                const urgency = Number(r.urgency);
-                let pStatus = "idle";
-                if (urgency === 1) pStatus = "active";
-                else if (urgency === 2) pStatus = "has_tasks";
-                return { name: String(r.project_name), status: pStatus };
-              });
-              if (projects.length > 0) projectsByEmployee.set(emp.name, projects);
-            }
-            for (const emp of roster) {
-              const taskResult = await client.execute({
-                sql: `SELECT title FROM tasks WHERE assigned_to = ? AND status = 'in_progress'${tmScope.sql} ORDER BY updated_at DESC LIMIT 1`,
-                args: [emp.name, ...tmScope.args]
-              });
-              if (taskResult.rows.length > 0) {
-                currentTaskByEmployee.set(emp.name, String(taskResult.rows[0].title));
-              }
-            }
-          }
+          const { loadTeamMetrics: loadTeamMetrics2 } = await Promise.resolve().then(() => (init_tui_data(), tui_data_exports));
+          const teamMetrics = await loadTeamMetrics2(roster.map((emp) => emp.name));
+          memoryCounts = teamMetrics.memoryCounts;
+          projectsByEmployee = new Map(
+            Array.from(teamMetrics.projectsByEmployee.entries()).map(([name, projects]) => [
+              name,
+              projects.filter((project) => !DEPRECATED_PROJECTS.has(project.name))
+            ])
+          );
+          currentTaskByEmployee = teamMetrics.currentTaskByEmployee;
         } catch {
         }
         const teamData = roster.map((emp) => {
@@ -27467,12 +27942,12 @@ function TeamView({ onBack, onViewSessions }) {
         setMembers(teamData);
         setDbError(null);
         try {
-          const { existsSync: existsSync30, readFileSync: readFileSync27 } = await import("fs");
+          const { existsSync: existsSync32, readFileSync: readFileSync28 } = await import("fs");
           const { join } = await import("path");
           const home = process.env.HOME ?? "";
           const gatewayConfig = join(home, ".exe-os", "gateway.json");
-          if (existsSync30(gatewayConfig)) {
-            const raw = JSON.parse(readFileSync27(gatewayConfig, "utf8"));
+          if (existsSync32(gatewayConfig)) {
+            const raw = JSON.parse(readFileSync28(gatewayConfig, "utf8"));
             if (raw.agents && raw.agents.length > 0) {
               setExternals(raw.agents.map((a) => ({
                 name: a.name,
@@ -27639,7 +28114,6 @@ var init_Team = __esm({
     init_demo_data();
     init_useOrchestrator();
     init_agent_status();
-    init_task_scope();
     DEPRECATED_PROJECTS = /* @__PURE__ */ new Set(["exe-ai-employees"]);
   }
 });
@@ -27653,8 +28127,8 @@ __export(wiki_client_exports, {
   listDocuments: () => listDocuments,
   listWorkspaces: () => listWorkspaces
 });
-async function wikiFetch(config, path45, method = "GET", body) {
-  const url = `${config.baseUrl}/api/v1${path45}`;
+async function wikiFetch(config, path46, method = "GET", body) {
+  const url = `${config.baseUrl}/api/v1${path46}`;
   const headers = {
     Authorization: `Bearer ${config.apiKey}`,
     "Content-Type": "application/json"
@@ -27687,7 +28161,7 @@ async function wikiFetch(config, path45, method = "GET", body) {
       }
     }
     if (!response.ok) {
-      throw new Error(`Wiki API ${method} ${path45}: ${response.status} ${response.statusText}`);
+      throw new Error(`Wiki API ${method} ${path46}: ${response.status} ${response.statusText}`);
     }
     return response.json();
   } finally {
@@ -27933,24 +28407,8 @@ function WikiView({ onBack }) {
     }
     setSearchLoading(true);
     try {
-      const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
-      const client = getClient2();
-      const result = await client.execute({
-        sql: `SELECT id, agent_id, raw_text, timestamp, project_name
-              FROM memories
-              WHERE raw_text LIKE ? AND COALESCE(status, 'active') = 'active'
-              ORDER BY timestamp DESC LIMIT 20`,
-        args: [`%${query}%`]
-      });
-      setSearchResults(
-        result.rows.map((r) => ({
-          id: String(r.id),
-          agentId: String(r.agent_id),
-          rawText: String(r.raw_text),
-          timestamp: String(r.timestamp),
-          projectName: String(r.project_name ?? "")
-        }))
-      );
+      const { searchWikiMemoryRows: searchWikiMemoryRows2 } = await Promise.resolve().then(() => (init_tui_data(), tui_data_exports));
+      setSearchResults(await searchWikiMemoryRows2(query));
     } catch {
       setSearchResults([]);
     } finally {
@@ -28297,12 +28755,12 @@ function SettingsView({ onBack }) {
     }
     setProviders(providerList);
     try {
-      const { existsSync: existsSync30 } = await import("fs");
+      const { existsSync: existsSync32 } = await import("fs");
       const { join } = await import("path");
       const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
       const cfg = await loadConfig2();
       const home = process.env.HOME ?? "";
-      const hasKey = existsSync30(join(home, ".exe-os", "master.key"));
+      const hasKey = existsSync32(join(home, ".exe-os", "master.key"));
       if (cfg.cloud) {
         setCloud({
           configured: true,
@@ -28315,22 +28773,22 @@ function SettingsView({ onBack }) {
       const pidPath = join(home, ".exe-os", "exed.pid");
       let daemon = "unknown";
       try {
-        daemon = existsSync30(pidPath) ? "running" : "stopped";
+        daemon = existsSync32(pidPath) ? "running" : "stopped";
       } catch {
       }
       let version = "unknown";
       try {
-        const { readFileSync: readFileSync27 } = await import("fs");
-        const { createRequire: createRequire2 } = await import("module");
-        const require2 = createRequire2(import.meta.url);
+        const { readFileSync: readFileSync28 } = await import("fs");
+        const { createRequire: createRequire3 } = await import("module");
+        const require2 = createRequire3(import.meta.url);
         const pkgPath = require2.resolve("@askexenow/exe-os/package.json");
-        const pkg = JSON.parse(readFileSync27(pkgPath, "utf8"));
+        const pkg = JSON.parse(readFileSync28(pkgPath, "utf8"));
         version = pkg.version;
       } catch {
         try {
-          const { readFileSync: readFileSync27 } = await import("fs");
+          const { readFileSync: readFileSync28 } = await import("fs");
           const { join: joinPath } = await import("path");
-          const pkg = JSON.parse(readFileSync27(joinPath(process.cwd(), "package.json"), "utf8"));
+          const pkg = JSON.parse(readFileSync28(joinPath(process.cwd(), "package.json"), "utf8"));
           version = pkg.version;
         } catch {
         }
@@ -29131,15 +29589,15 @@ __export(installer_exports2, {
   verifyOpenCodeHooks: () => verifyOpenCodeHooks
 });
 import { readFile as readFile6, writeFile as writeFile7, mkdir as mkdir7 } from "fs/promises";
-import { existsSync as existsSync27, readFileSync as readFileSync25 } from "fs";
-import path42 from "path";
-import os17 from "os";
-async function registerOpenCodeMcp(packageRoot, homeDir = os17.homedir()) {
-  const configDir = path42.join(homeDir, ".config", "opencode");
-  const configPath = path42.join(configDir, "opencode.json");
+import { existsSync as existsSync29, readFileSync as readFileSync26 } from "fs";
+import path43 from "path";
+import os18 from "os";
+async function registerOpenCodeMcp(packageRoot, homeDir = os18.homedir()) {
+  const configDir = path43.join(homeDir, ".config", "opencode");
+  const configPath = path43.join(configDir, "opencode.json");
   await mkdir7(configDir, { recursive: true });
   let config = {};
-  if (existsSync27(configPath)) {
+  if (existsSync29(configPath)) {
     try {
       config = JSON.parse(await readFile6(configPath, "utf-8"));
     } catch {
@@ -29151,7 +29609,7 @@ async function registerOpenCodeMcp(packageRoot, homeDir = os17.homedir()) {
   }
   const newEntry = {
     type: "local",
-    command: ["node", path42.join(packageRoot, "dist", "mcp", "server.js")],
+    command: ["node", path43.join(packageRoot, "dist", "mcp", "server.js")],
     enabled: true
   };
   const current = config.mcp["exe-os"];
@@ -29165,15 +29623,15 @@ async function registerOpenCodeMcp(packageRoot, homeDir = os17.homedir()) {
   await writeFile7(configPath, JSON.stringify(config, null, 2) + "\n");
   return true;
 }
-async function installOpenCodePlugin(packageRoot, homeDir = os17.homedir()) {
-  const pluginDir = path42.join(homeDir, ".config", "opencode", "plugins");
-  const pluginPath = path42.join(pluginDir, "exe-os.mjs");
+async function installOpenCodePlugin(packageRoot, homeDir = os18.homedir()) {
+  const pluginDir = path43.join(homeDir, ".config", "opencode", "plugins");
+  const pluginPath = path43.join(pluginDir, "exe-os.mjs");
   await mkdir7(pluginDir, { recursive: true });
   const pluginContent = PLUGIN_TEMPLATE.replace(
     /__PACKAGE_ROOT__/g,
     packageRoot.replace(/\\/g, "\\\\")
   );
-  if (existsSync27(pluginPath)) {
+  if (existsSync29(pluginPath)) {
     const existing = await readFile6(pluginPath, "utf-8");
     if (existing === pluginContent) {
       return false;
@@ -29182,17 +29640,17 @@ async function installOpenCodePlugin(packageRoot, homeDir = os17.homedir()) {
   await writeFile7(pluginPath, pluginContent);
   return true;
 }
-function verifyOpenCodeHooks(homeDir = os17.homedir()) {
-  const configPath = path42.join(homeDir, ".config", "opencode", "opencode.json");
-  const pluginPath = path42.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
-  if (!existsSync27(configPath)) return false;
+function verifyOpenCodeHooks(homeDir = os18.homedir()) {
+  const configPath = path43.join(homeDir, ".config", "opencode", "opencode.json");
+  const pluginPath = path43.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
+  if (!existsSync29(configPath)) return false;
   try {
-    const config = JSON.parse(readFileSync25(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync26(configPath, "utf-8"));
     if (!config.mcp?.["exe-os"]?.enabled) return false;
   } catch {
     return false;
   }
-  if (!existsSync27(pluginPath)) return false;
+  if (!existsSync29(pluginPath)) return false;
   return true;
 }
 async function runOpenCodeInstaller(homeDir) {
@@ -29225,19 +29683,19 @@ __export(installer_exports3, {
   verifyCodexHooks: () => verifyCodexHooks
 });
 import { readFile as readFile7, writeFile as writeFile8, mkdir as mkdir8 } from "fs/promises";
-import { existsSync as existsSync28 } from "fs";
-import path43 from "path";
-import os18 from "os";
-async function mergeCodexHooks(packageRoot, homeDir = os18.homedir()) {
-  const codexDir = path43.join(homeDir, ".codex");
-  const hooksPath = path43.join(codexDir, "hooks.json");
-  const logsDir = path43.join(homeDir, ".exe-os", "logs");
-  const hookLogPath = path43.join(logsDir, "hooks.log");
+import { existsSync as existsSync30 } from "fs";
+import path44 from "path";
+import os19 from "os";
+async function mergeCodexHooks(packageRoot, homeDir = os19.homedir()) {
+  const codexDir = path44.join(homeDir, ".codex");
+  const hooksPath = path44.join(codexDir, "hooks.json");
+  const logsDir = path44.join(homeDir, ".exe-os", "logs");
+  const hookLogPath = path44.join(logsDir, "hooks.log");
   const logSuffix = ` 2>> "${hookLogPath}"`;
   await mkdir8(codexDir, { recursive: true });
   await mkdir8(logsDir, { recursive: true });
   let hooksJson = {};
-  if (existsSync28(hooksPath)) {
+  if (existsSync30(hooksPath)) {
     try {
       hooksJson = JSON.parse(await readFile7(hooksPath, "utf-8"));
     } catch {
@@ -29254,7 +29712,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os18.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path43.join(packageRoot, "dist", "hooks", "session-start.js")}"${logSuffix}`,
+            command: `node "${path44.join(packageRoot, "dist", "hooks", "session-start.js")}"${logSuffix}`,
             timeout: 30,
             statusMessage: "exe-os: loading memory brief"
           }
@@ -29269,11 +29727,11 @@ async function mergeCodexHooks(packageRoot, homeDir = os18.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path43.join(packageRoot, "dist", "hooks", "ingest.js")}"${logSuffix}`
+            command: `node "${path44.join(packageRoot, "dist", "hooks", "ingest.js")}"${logSuffix}`
           },
           {
             type: "command",
-            command: `node "${path43.join(packageRoot, "dist", "hooks", "error-recall.js")}"${logSuffix}`
+            command: `node "${path44.join(packageRoot, "dist", "hooks", "error-recall.js")}"${logSuffix}`
           }
         ]
       },
@@ -29285,11 +29743,11 @@ async function mergeCodexHooks(packageRoot, homeDir = os18.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path43.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
+            command: `node "${path44.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
           },
           {
             type: "command",
-            command: `node "${path43.join(packageRoot, "dist", "hooks", "exe-heartbeat-hook.js")}"${logSuffix}`,
+            command: `node "${path44.join(packageRoot, "dist", "hooks", "exe-heartbeat-hook.js")}"${logSuffix}`,
             timeout: 5
           }
         ]
@@ -29302,7 +29760,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os18.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path43.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
+            command: `node "${path44.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
           }
         ]
       },
@@ -29315,7 +29773,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os18.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path43.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
+            command: `node "${path44.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
           }
         ]
       },
@@ -29346,9 +29804,9 @@ async function mergeCodexHooks(packageRoot, homeDir = os18.homedir()) {
   await writeFile8(hooksPath, JSON.stringify(hooksJson, null, 2) + "\n");
   return { added, skipped };
 }
-function verifyCodexHooks(homeDir = os18.homedir()) {
-  const hooksPath = path43.join(homeDir, ".codex", "hooks.json");
-  if (!existsSync28(hooksPath)) return false;
+function verifyCodexHooks(homeDir = os19.homedir()) {
+  const hooksPath = path44.join(homeDir, ".codex", "hooks.json");
+  if (!existsSync30(hooksPath)) return false;
   try {
     const hooksJson = JSON.parse(
       __require("fs").readFileSync(hooksPath, "utf-8")
@@ -29368,14 +29826,14 @@ function verifyCodexHooks(homeDir = os18.homedir()) {
     return false;
   }
 }
-async function installCodexStatusLine(homeDir = os18.homedir()) {
+async function installCodexStatusLine(homeDir = os19.homedir()) {
   const prefs = loadPreferences(homeDir);
   if (prefs.codexStatusLine === false) return "opted-out";
-  const codexDir = path43.join(homeDir, ".codex");
-  const configPath = path43.join(codexDir, "config.toml");
+  const codexDir = path44.join(homeDir, ".codex");
+  const configPath = path44.join(codexDir, "config.toml");
   await mkdir8(codexDir, { recursive: true });
   let content = "";
-  if (existsSync28(configPath)) {
+  if (existsSync30(configPath)) {
     content = await readFile7(configPath, "utf-8");
     if (/\[tui\][\s\S]*?status_line\s*=/.test(content)) {
       return "already-configured";
@@ -29423,14 +29881,14 @@ var init_installer3 = __esm({
 });
 
 // src/bin/cli.ts
-import { existsSync as existsSync29, readFileSync as readFileSync26, writeFileSync as writeFileSync19, readdirSync as readdirSync9, rmSync } from "fs";
-import path44 from "path";
-import os19 from "os";
+import { existsSync as existsSync31, readFileSync as readFileSync27, writeFileSync as writeFileSync20, readdirSync as readdirSync9, rmSync } from "fs";
+import path45 from "path";
+import os20 from "os";
 var args = process.argv.slice(2);
 if (args.includes("--version") || args.includes("-v")) {
   try {
-    const pkgPath = path44.join(path44.dirname(new URL(import.meta.url).pathname), "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync26(pkgPath, "utf8"));
+    const pkgPath = path45.join(path45.dirname(new URL(import.meta.url).pathname), "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync27(pkgPath, "utf8"));
     console.log(pkg.version);
   } catch {
     console.log("unknown");
@@ -29594,11 +30052,11 @@ ID: ${result.id}`);
   });
   await init_App2().then(() => App_exports);
 } else {
-  const claudeDir = path44.join(os19.homedir(), ".claude");
-  const settingsPath = path44.join(claudeDir, "settings.json");
-  const hasClaudeCode = existsSync29(settingsPath) && (() => {
+  const claudeDir = path45.join(os20.homedir(), ".claude");
+  const settingsPath = path45.join(claudeDir, "settings.json");
+  const hasClaudeCode = existsSync31(settingsPath) && (() => {
     try {
-      const raw = readFileSync26(settingsPath, "utf8");
+      const raw = readFileSync27(settingsPath, "utf8");
       return raw.includes("exe-os") || raw.includes("exe-mem");
     } catch {
       return false;
@@ -29608,9 +30066,9 @@ ID: ${result.id}`);
     const { DEFAULT_COORDINATOR_TEMPLATE_NAME: DEFAULT_COORDINATOR_TEMPLATE_NAME2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
     let cooName = DEFAULT_COORDINATOR_TEMPLATE_NAME2;
     try {
-      const rosterPath = path44.join(os19.homedir(), ".exe-os", "exe-employees.json");
-      if (existsSync29(rosterPath)) {
-        const roster = JSON.parse(readFileSync26(rosterPath, "utf8"));
+      const rosterPath = path45.join(os20.homedir(), ".exe-os", "exe-employees.json");
+      if (existsSync31(rosterPath)) {
+        const roster = JSON.parse(readFileSync27(rosterPath, "utf8"));
         const coo = roster.find((e) => e.role === "COO");
         if (coo) cooName = coo.name;
       }
@@ -29674,14 +30132,14 @@ async function runCodexInstall() {
   }
 }
 async function runClaudeCheck() {
-  const claudeDir = path44.join(os19.homedir(), ".claude");
-  const settingsPath = path44.join(claudeDir, "settings.json");
-  const claudeJsonPath = path44.join(os19.homedir(), ".claude.json");
+  const claudeDir = path45.join(os20.homedir(), ".claude");
+  const settingsPath = path45.join(claudeDir, "settings.json");
+  const claudeJsonPath = path45.join(os20.homedir(), ".claude.json");
   let ok = true;
-  if (existsSync29(settingsPath)) {
+  if (existsSync31(settingsPath)) {
     let settings;
     try {
-      settings = JSON.parse(readFileSync26(settingsPath, "utf8"));
+      settings = JSON.parse(readFileSync27(settingsPath, "utf8"));
     } catch {
       console.log("\x1B[31m\u2717\x1B[0m settings.json is malformed (invalid JSON)");
       ok = false;
@@ -29707,10 +30165,10 @@ async function runClaudeCheck() {
     console.log("\x1B[31m\u2717\x1B[0m settings.json not found");
     ok = false;
   }
-  if (existsSync29(claudeJsonPath)) {
+  if (existsSync31(claudeJsonPath)) {
     let claudeJson;
     try {
-      claudeJson = JSON.parse(readFileSync26(claudeJsonPath, "utf8"));
+      claudeJson = JSON.parse(readFileSync27(claudeJsonPath, "utf8"));
     } catch {
       console.log("\x1B[31m\u2717\x1B[0m claude.json is malformed (invalid JSON)");
       ok = false;
@@ -29729,8 +30187,8 @@ async function runClaudeCheck() {
     console.log("\x1B[31m\u2717\x1B[0m claude.json not found");
     ok = false;
   }
-  const skillsDir = path44.join(claudeDir, "skills");
-  if (existsSync29(skillsDir)) {
+  const skillsDir = path45.join(claudeDir, "skills");
+  if (existsSync31(skillsDir)) {
     console.log("\x1B[32m\u2713\x1B[0m Slash skills directory exists");
   } else {
     console.log("\x1B[31m\u2717\x1B[0m Slash skills directory missing");
@@ -29746,17 +30204,17 @@ async function runClaudeCheck() {
 async function runClaudeUninstall(flags = []) {
   const dryRun = flags.includes("--dry-run");
   const purge = flags.includes("--purge");
-  const homeDir = os19.homedir();
-  const claudeDir = path44.join(homeDir, ".claude");
-  const settingsPath = path44.join(claudeDir, "settings.json");
-  const claudeJsonPath = path44.join(homeDir, ".claude.json");
-  const exeOsDir = path44.join(homeDir, ".exe-os");
+  const homeDir = os20.homedir();
+  const claudeDir = path45.join(homeDir, ".claude");
+  const settingsPath = path45.join(claudeDir, "settings.json");
+  const claudeJsonPath = path45.join(homeDir, ".claude.json");
+  const exeOsDir = path45.join(homeDir, ".exe-os");
   let removed = 0;
   const log = (msg) => console.log(dryRun ? `[dry-run] ${msg}` : msg);
   let settings = {};
-  if (existsSync29(settingsPath)) {
+  if (existsSync31(settingsPath)) {
     try {
-      settings = JSON.parse(readFileSync26(settingsPath, "utf8"));
+      settings = JSON.parse(readFileSync27(settingsPath, "utf8"));
     } catch {
       console.error("Your ~/.claude/settings.json appears malformed.");
       if (purge) {
@@ -29794,15 +30252,15 @@ async function runClaudeUninstall(flags = []) {
         permCount = before - settings.permissions.allow.length;
       }
       if (!dryRun) {
-        writeFileSync19(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+        writeFileSync20(settingsPath, JSON.stringify(settings, null, 2) + "\n");
       }
       log("\u2713 Removed exe-os hooks from settings.json");
       if (permCount > 0) log(`\u2713 Removed ${permCount} MCP permission entries`);
       removed++;
     }
   }
-  if (existsSync29(claudeJsonPath)) {
-    const raw = readFileSync26(claudeJsonPath, "utf8");
+  if (existsSync31(claudeJsonPath)) {
+    const raw = readFileSync27(claudeJsonPath, "utf8");
     if (raw.length > 1e6) {
       console.error("claude.json exceeds 1 MB \u2014 skipping parse.");
     } else {
@@ -29823,7 +30281,7 @@ async function runClaudeUninstall(flags = []) {
         }
         if (removedMcp) {
           if (!dryRun) {
-            writeFileSync19(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
+            writeFileSync20(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
           }
           log("\u2713 Removed exe-os MCP server from claude.json");
           removed++;
@@ -29831,14 +30289,14 @@ async function runClaudeUninstall(flags = []) {
       }
     }
   }
-  const skillsDir = path44.join(claudeDir, "skills");
-  if (existsSync29(skillsDir)) {
+  const skillsDir = path45.join(claudeDir, "skills");
+  if (existsSync31(skillsDir)) {
     let skillCount = 0;
     try {
       const entries = readdirSync9(skillsDir);
       for (const entry of entries) {
         if (entry.startsWith("exe")) {
-          const fullPath = path44.join(skillsDir, entry);
+          const fullPath = path45.join(skillsDir, entry);
           if (!dryRun) rmSync(fullPath, { recursive: true, force: true });
           skillCount++;
         }
@@ -29850,30 +30308,30 @@ async function runClaudeUninstall(flags = []) {
       removed++;
     }
   }
-  const claudeMdPath = path44.join(claudeDir, "CLAUDE.md");
-  if (existsSync29(claudeMdPath)) {
-    const content = readFileSync26(claudeMdPath, "utf8");
+  const claudeMdPath = path45.join(claudeDir, "CLAUDE.md");
+  if (existsSync31(claudeMdPath)) {
+    const content = readFileSync27(claudeMdPath, "utf8");
     const startMarker = "<!-- exe-os:orchestration-start -->";
     const endMarker = "<!-- exe-os:orchestration-end -->";
     const startIdx = content.indexOf(startMarker);
     const endIdx = content.indexOf(endMarker);
     if (startIdx !== -1 && endIdx !== -1) {
       const cleaned = (content.slice(0, startIdx) + content.slice(endIdx + endMarker.length)).replace(/\n{3,}/g, "\n\n").trim() + "\n";
-      if (!dryRun) writeFileSync19(claudeMdPath, cleaned);
+      if (!dryRun) writeFileSync20(claudeMdPath, cleaned);
       log("\u2713 Removed orchestration block from CLAUDE.md");
       removed++;
     }
   }
-  const agentsDir = path44.join(claudeDir, "agents");
-  if (existsSync29(agentsDir)) {
+  const agentsDir = path45.join(claudeDir, "agents");
+  if (existsSync31(agentsDir)) {
     let agentCount = 0;
     try {
       const entries = readdirSync9(agentsDir).filter((f) => f.endsWith(".md"));
       let knownNames = /* @__PURE__ */ new Set();
-      const rosterPath = path44.join(exeOsDir, "exe-employees.json");
-      if (existsSync29(rosterPath)) {
+      const rosterPath = path45.join(exeOsDir, "exe-employees.json");
+      if (existsSync31(rosterPath)) {
         try {
-          const roster = JSON.parse(readFileSync26(rosterPath, "utf8"));
+          const roster = JSON.parse(readFileSync27(rosterPath, "utf8"));
           knownNames = new Set(roster.map((e) => e.name));
         } catch {
         }
@@ -29881,7 +30339,7 @@ async function runClaudeUninstall(flags = []) {
       for (const entry of entries) {
         const name = entry.replace(/\.md$/, "");
         if (knownNames.has(name)) {
-          if (!dryRun) rmSync(path44.join(agentsDir, entry), { force: true });
+          if (!dryRun) rmSync(path45.join(agentsDir, entry), { force: true });
           agentCount++;
         }
       }
@@ -29892,16 +30350,16 @@ async function runClaudeUninstall(flags = []) {
       removed++;
     }
   }
-  const projectsDir = path44.join(claudeDir, "projects");
-  if (existsSync29(projectsDir)) {
+  const projectsDir = path45.join(claudeDir, "projects");
+  if (existsSync31(projectsDir)) {
     let projectCount = 0;
     try {
       const projects = readdirSync9(projectsDir);
       for (const proj of projects) {
-        const projSettings = path44.join(projectsDir, proj, "settings.json");
-        if (!existsSync29(projSettings)) continue;
+        const projSettings = path45.join(projectsDir, proj, "settings.json");
+        if (!existsSync31(projSettings)) continue;
         try {
-          const pSettings = JSON.parse(readFileSync26(projSettings, "utf8"));
+          const pSettings = JSON.parse(readFileSync27(projSettings, "utf8"));
           let changed = false;
           if (Array.isArray(pSettings.permissions?.allow)) {
             const before = pSettings.permissions.allow.length;
@@ -29911,7 +30369,7 @@ async function runClaudeUninstall(flags = []) {
             if (pSettings.permissions.allow.length < before) changed = true;
           }
           if (changed && !dryRun) {
-            writeFileSync19(projSettings, JSON.stringify(pSettings, null, 2) + "\n");
+            writeFileSync20(projSettings, JSON.stringify(pSettings, null, 2) + "\n");
           }
           if (changed) projectCount++;
         } catch {
@@ -29935,18 +30393,18 @@ async function runClaudeUninstall(flags = []) {
     };
     const exeBinPath = findExeBin3();
     if (!exeBinPath) throw new Error("exe-os not found in PATH");
-    const binDir = path44.dirname(exeBinPath);
+    const binDir = path45.dirname(exeBinPath);
     let symlinkCount = 0;
-    const rosterPath = path44.join(exeOsDir, "exe-employees.json");
-    if (existsSync29(rosterPath)) {
-      const roster = JSON.parse(readFileSync26(rosterPath, "utf8"));
+    const rosterPath = path45.join(exeOsDir, "exe-employees.json");
+    if (existsSync31(rosterPath)) {
+      const roster = JSON.parse(readFileSync27(rosterPath, "utf8"));
       const { DEFAULT_COORDINATOR_TEMPLATE_NAME: DEFAULT_COORDINATOR_TEMPLATE_NAME2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
       const coordinatorName = roster.find((e) => e.role?.toLowerCase() === "coo")?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME2;
       for (const emp of roster) {
         if (emp.name === coordinatorName) continue;
         for (const suffix of ["", "-opencode"]) {
-          const linkPath = path44.join(binDir, `${emp.name}${suffix}`);
-          if (existsSync29(linkPath)) {
+          const linkPath = path45.join(binDir, `${emp.name}${suffix}`);
+          if (existsSync31(linkPath)) {
             if (!dryRun) rmSync(linkPath, { force: true });
             symlinkCount++;
           }
@@ -29959,7 +30417,7 @@ async function runClaudeUninstall(flags = []) {
     }
   } catch {
   }
-  if (purge && existsSync29(exeOsDir)) {
+  if (purge && existsSync31(exeOsDir)) {
     if (!dryRun) {
       process.stdout.write("\x1B[33m\u26A0 This will delete all memories, identities, and agent data.\x1B[0m\n");
       process.stdout.write("  Removing ~/.exe-os...\n");
@@ -29984,7 +30442,7 @@ async function checkForUpdateOnBoot() {
     const config = await loadConfig2();
     if (!config.autoUpdate.checkOnBoot) return;
     const { checkForUpdate: checkForUpdate2 } = await Promise.resolve().then(() => (init_update(), update_exports));
-    const packageRoot = path44.resolve(
+    const packageRoot = path45.resolve(
       new URL("../..", import.meta.url).pathname
     );
     const result = checkForUpdate2(packageRoot);
@@ -30044,7 +30502,7 @@ async function runActivate(key) {
       const idTemplate = getIdentityTemplate(identityKey);
       if (idTemplate) {
         const idPath = identityPath2(name);
-        const dir = path44.dirname(idPath);
+        const dir = path45.dirname(idPath);
         if (!fs8.existsSync(dir)) fs8.mkdirSync(dir, { recursive: true });
         fs8.writeFileSync(idPath, idTemplate.replace(/^agent_id: \w+/m, `agent_id: ${name}`), "utf-8");
       }