@askexenow/exe-os 0.9.8 → 0.9.10

package/dist/lib/tmux-routing.js

@@ -307,9 +307,34 @@ var init_provider_table = __esm({
   }
 });
 
+// src/lib/secure-files.ts
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+import { chmod, mkdir } from "fs/promises";
+async function ensurePrivateDir(dirPath) {
+  await mkdir(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    await chmod(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+async function enforcePrivateFile(filePath) {
+  try {
+    await chmod(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+var PRIVATE_DIR_MODE, PRIVATE_FILE_MODE;
+var init_secure_files = __esm({
+  "src/lib/secure-files.ts"() {
+    "use strict";
+    PRIVATE_DIR_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+  }
+});
+
 // src/lib/config.ts
-import { readFile, writeFile, mkdir, chmod } from "fs/promises";
-import { readFileSync as readFileSync2, existsSync as existsSync2, renameSync } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { readFileSync as readFileSync2, existsSync as existsSync3, renameSync } from "fs";
 import path2 from "path";
 import os2 from "os";
 function resolveDataDir() {
@@ -317,7 +342,7 @@ function resolveDataDir() {
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
   const newDir = path2.join(os2.homedir(), ".exe-os");
   const legacyDir = path2.join(os2.homedir(), ".exe-mem");
-  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
+  if (!existsSync3(newDir) && existsSync3(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
       process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
@@ -380,9 +405,9 @@ function normalizeAutoUpdate(raw) {
 }
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path2.join(dir, "config.json");
-  if (!existsSync2(configPath)) {
+  if (!existsSync3(configPath)) {
     return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
   }
   const raw = await readFile(configPath, "utf-8");
@@ -395,6 +420,7 @@ async function loadConfig() {
 `);
       try {
         await writeFile(configPath, JSON.stringify(migratedCfg, null, 2) + "\n");
+        await enforcePrivateFile(configPath);
       } catch {
       }
     }
@@ -414,6 +440,7 @@ var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CON
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
+    init_secure_files();
     EXE_AI_DIR = resolveDataDir();
     DB_PATH = path2.join(EXE_AI_DIR, "memories.db");
     MODELS_DIR = path2.join(EXE_AI_DIR, "models");
@@ -518,10 +545,10 @@ var init_runtime_table = __esm({
 });
 
 // src/lib/agent-config.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync4 } from "fs";
 import path3 from "path";
 function loadAgentConfig() {
-  if (!existsSync3(AGENT_CONFIG_PATH)) return {};
+  if (!existsSync4(AGENT_CONFIG_PATH)) return {};
   try {
     return JSON.parse(readFileSync3(AGENT_CONFIG_PATH, "utf-8"));
   } catch {
@@ -542,6 +569,7 @@ var init_agent_config = __esm({
     "use strict";
     init_config();
     init_runtime_table();
+    init_secure_files();
     AGENT_CONFIG_PATH = path3.join(EXE_AI_DIR, "agent-config.json");
     DEFAULT_MODELS = {
       claude: "claude-opus-4",
@@ -560,16 +588,16 @@ __export(intercom_queue_exports, {
   queueIntercom: () => queueIntercom,
   readQueue: () => readQueue
 });
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, renameSync as renameSync2, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, renameSync as renameSync2, existsSync as existsSync5, mkdirSync as mkdirSync3 } from "fs";
 import path4 from "path";
 import os3 from "os";
 function ensureDir() {
   const dir = path4.dirname(QUEUE_PATH);
-  if (!existsSync4(dir)) mkdirSync3(dir, { recursive: true });
+  if (!existsSync5(dir)) mkdirSync3(dir, { recursive: true });
 }
 function readQueue() {
   try {
-    if (!existsSync4(QUEUE_PATH)) return [];
+    if (!existsSync5(QUEUE_PATH)) return [];
     return JSON.parse(readFileSync4(QUEUE_PATH, "utf8"));
   } catch {
     return [];
@@ -686,7 +714,7 @@ var init_db_retry = __esm({
 
 // src/lib/employees.ts
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { existsSync as existsSync5, symlinkSync, readlinkSync, readFileSync as readFileSync5, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync6, symlinkSync, readlinkSync, readFileSync as readFileSync5, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
 import { execSync as execSync3 } from "child_process";
 import path5 from "path";
 import os4 from "os";
@@ -707,7 +735,7 @@ function isCoordinatorName(agentName, employees = loadEmployeesSync()) {
   return agentName.toLowerCase() === getCoordinatorName(employees).toLowerCase();
 }
 function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync5(employeesPath)) return [];
+  if (!existsSync6(employeesPath)) return [];
   try {
     return JSON.parse(readFileSync5(employeesPath, "utf-8"));
   } catch {
@@ -796,8 +824,11 @@ var init_database = __esm({
 });
 
 // src/lib/license.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync7, mkdirSync as mkdirSync4 } from "fs";
 import { randomUUID } from "crypto";
+import { createRequire as createRequire2 } from "module";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import os6 from "os";
 import path7 from "path";
 import { jwtVerify, importSPKI } from "jose";
 var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, PLAN_LIMITS;
@@ -819,11 +850,11 @@ var init_license = __esm({
 });
 
 // src/lib/plan-limits.ts
-import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
 import path8 from "path";
 function getLicenseSync() {
   try {
-    if (!existsSync7(CACHE_PATH2)) return freeLicense();
+    if (!existsSync8(CACHE_PATH2)) return freeLicense();
     const raw = JSON.parse(readFileSync7(CACHE_PATH2, "utf8"));
     if (!raw.token || typeof raw.token !== "string") return freeLicense();
     const parts = raw.token.split(".");
@@ -862,7 +893,7 @@ function assertEmployeeLimitSync(rosterPath) {
   const filePath = rosterPath ?? EMPLOYEES_PATH;
   let count = 0;
   try {
-    if (existsSync7(filePath)) {
+    if (existsSync8(filePath)) {
       const raw = readFileSync7(filePath, "utf8");
       const employees = JSON.parse(raw);
       count = Array.isArray(employees) ? employees.length : 0;
@@ -896,15 +927,48 @@ var init_plan_limits = __esm({
   }
 });
 
+// src/lib/task-scope.ts
+function getCurrentSessionScope() {
+  try {
+    return resolveExeSession();
+  } catch {
+    return null;
+  }
+}
+function sessionScopeFilter(sessionScope, tableAlias) {
+  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
+  if (!scope) return { sql: "", args: [] };
+  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
+  return {
+    sql: ` AND (${col} IS NULL OR ${col} = ?)`,
+    args: [scope]
+  };
+}
+function strictSessionScopeFilter(sessionScope, tableAlias) {
+  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
+  if (!scope) return { sql: "", args: [] };
+  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
+  return {
+    sql: ` AND ${col} = ?`,
+    args: [scope]
+  };
+}
+var init_task_scope = __esm({
+  "src/lib/task-scope.ts"() {
+    "use strict";
+    init_tmux_routing();
+  }
+});
+
 // src/lib/notifications.ts
 import crypto from "crypto";
 import path9 from "path";
-import os6 from "os";
+import os7 from "os";
 import {
   readFileSync as readFileSync8,
   readdirSync,
   unlinkSync as unlinkSync2,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   rmdirSync
 } from "fs";
 async function writeNotification(notification) {
@@ -912,9 +976,10 @@ async function writeNotification(notification) {
     const client = getClient();
     const id = crypto.randomUUID();
     const now = (/* @__PURE__ */ new Date()).toISOString();
+    const sessionScope = notification.sessionScope === void 0 ? getCurrentSessionScope() : notification.sessionScope;
     await client.execute({
-      sql: `INSERT INTO notifications (id, agent_id, agent_role, event, project, summary, task_file, read, created_at)
-            VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?)`,
+      sql: `INSERT INTO notifications (id, agent_id, agent_role, event, project, summary, task_file, session_scope, read, created_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, ?)`,
       args: [
         id,
         notification.agentId,
@@ -923,6 +988,7 @@ async function writeNotification(notification) {
         notification.project,
         notification.summary,
         notification.taskFile ?? null,
+        sessionScope,
         now
       ]
     });
@@ -931,12 +997,14 @@ async function writeNotification(notification) {
 `);
   }
 }
-async function markAsReadByTaskFile(taskFile) {
+async function markAsReadByTaskFile(taskFile, sessionScope) {
   try {
     const client = getClient();
+    const scope = strictSessionScopeFilter(sessionScope);
     await client.execute({
-      sql: "UPDATE notifications SET read = 1 WHERE task_file = ? AND read = 0",
-      args: [taskFile]
+      sql: `UPDATE notifications SET read = 1
+            WHERE task_file = ? AND read = 0${scope.sql}`,
+      args: [taskFile, ...scope.args]
     });
   } catch {
   }
@@ -945,6 +1013,7 @@ var init_notifications = __esm({
   "src/lib/notifications.ts"() {
     "use strict";
     init_database();
+    init_task_scope();
   }
 });
 
@@ -982,30 +1051,6 @@ var init_session_kill_telemetry = __esm({
   }
 });
 
-// src/lib/task-scope.ts
-function getCurrentSessionScope() {
-  try {
-    return resolveExeSession();
-  } catch {
-    return null;
-  }
-}
-function sessionScopeFilter(sessionScope, tableAlias) {
-  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
-  if (!scope) return { sql: "", args: [] };
-  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
-  return {
-    sql: ` AND (${col} IS NULL OR ${col} = ?)`,
-    args: [scope]
-  };
-}
-var init_task_scope = __esm({
-  "src/lib/task-scope.ts"() {
-    "use strict";
-    init_tmux_routing();
-  }
-});
-
 // src/lib/state-bus.ts
 var StateBus, orgBus;
 var init_state_bus = __esm({
@@ -1061,13 +1106,117 @@ var init_state_bus = __esm({
   }
 });
 
+// src/lib/project-name.ts
+import { execSync as execSync4 } from "child_process";
+import path10 from "path";
+function getProjectName(cwd) {
+  const dir = cwd ?? process.cwd();
+  if (_cached2 && _cachedCwd === dir) return _cached2;
+  try {
+    let repoRoot;
+    try {
+      const gitCommonDir = execSync4("git rev-parse --path-format=absolute --git-common-dir", {
+        cwd: dir,
+        encoding: "utf8",
+        timeout: 2e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+      repoRoot = path10.dirname(gitCommonDir);
+    } catch {
+      repoRoot = execSync4("git rev-parse --show-toplevel", {
+        cwd: dir,
+        encoding: "utf8",
+        timeout: 2e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+    }
+    _cached2 = path10.basename(repoRoot);
+    _cachedCwd = dir;
+    return _cached2;
+  } catch {
+    _cached2 = path10.basename(dir);
+    _cachedCwd = dir;
+    return _cached2;
+  }
+}
+var _cached2, _cachedCwd;
+var init_project_name = __esm({
+  "src/lib/project-name.ts"() {
+    "use strict";
+    _cached2 = null;
+    _cachedCwd = null;
+  }
+});
+
+// src/lib/session-scope.ts
+var session_scope_exports = {};
+__export(session_scope_exports, {
+  assertSessionScope: () => assertSessionScope,
+  findSessionForProject: () => findSessionForProject,
+  getSessionProject: () => getSessionProject
+});
+function getSessionProject(sessionName) {
+  const sessions = listSessions();
+  const entry = sessions.find((s) => s.windowName === sessionName);
+  if (!entry) return null;
+  const parts = entry.projectDir.split("/").filter(Boolean);
+  return parts[parts.length - 1] ?? null;
+}
+function findSessionForProject(projectName) {
+  const sessions = listSessions();
+  for (const s of sessions) {
+    const proj = s.projectDir.split("/").filter(Boolean).pop();
+    if (proj === projectName && isCoordinatorName(s.agentId)) return s;
+  }
+  return null;
+}
+function assertSessionScope(actionType, targetProject) {
+  try {
+    const currentProject = getProjectName();
+    const exeSession = resolveExeSession();
+    if (!exeSession) {
+      return { allowed: true, reason: "no_session" };
+    }
+    if (currentProject === targetProject) {
+      return {
+        allowed: true,
+        reason: "same_session",
+        currentProject,
+        targetProject
+      };
+    }
+    process.stderr.write(
+      `[session-scope] BLOCKED cross-project ${actionType}: session project="${currentProject}" \u2260 target project="${targetProject}"
+`
+    );
+    return {
+      allowed: false,
+      reason: "cross_session_denied",
+      currentProject,
+      targetProject,
+      targetSession: findSessionForProject(targetProject)?.windowName
+    };
+  } catch {
+    return { allowed: true, reason: "no_session" };
+  }
+}
+var init_session_scope = __esm({
+  "src/lib/session-scope.ts"() {
+    "use strict";
+    init_session_registry();
+    init_project_name();
+    init_tmux_routing();
+    init_employees();
+  }
+});
+
 // src/lib/tasks-crud.ts
 import crypto3 from "crypto";
-import path10 from "path";
-import os7 from "os";
-import { execSync as execSync4 } from "child_process";
+import path11 from "path";
+import os8 from "os";
+import { execSync as execSync5 } from "child_process";
 import { mkdir as mkdir3, writeFile as writeFile3, appendFile } from "fs/promises";
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
 async function writeCheckpoint(input) {
   const client = getClient();
   const row = await resolveTask(client, input.taskId);
@@ -1187,9 +1336,24 @@ async function createTaskCore(input) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const slug = slugify(input.title);
   let earlySessionScope = null;
+  let scopeMismatchWarning;
   try {
     const { resolveExeSession: resolveExeSession2 } = await Promise.resolve().then(() => (init_tmux_routing(), tmux_routing_exports));
-    earlySessionScope = resolveExeSession2();
+    const resolved = resolveExeSession2();
+    if (resolved && input.projectName) {
+      const { getSessionProject: getSessionProject2 } = await Promise.resolve().then(() => (init_session_scope(), session_scope_exports));
+      const sessionProject = getSessionProject2(resolved);
+      if (sessionProject && sessionProject !== input.projectName) {
+        scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
+        process.stderr.write(`[create_task] ${scopeMismatchWarning}
+`);
+        earlySessionScope = null;
+      } else {
+        earlySessionScope = resolved;
+      }
+    } else {
+      earlySessionScope = resolved;
+    }
   } catch {
   }
   const scope = earlySessionScope ?? "default";
@@ -1240,10 +1404,14 @@ async function createTaskCore(input) {
 ${laneWarning}` : laneWarning;
     }
   }
+  if (scopeMismatchWarning) {
+    warning = warning ? `${warning}
+${scopeMismatchWarning}` : scopeMismatchWarning;
+  }
   if (input.baseDir) {
     try {
-      await mkdir3(path10.join(input.baseDir, "exe", "output"), { recursive: true });
-      await mkdir3(path10.join(input.baseDir, "exe", "research"), { recursive: true });
+      await mkdir3(path11.join(input.baseDir, "exe", "output"), { recursive: true });
+      await mkdir3(path11.join(input.baseDir, "exe", "research"), { recursive: true });
       await ensureArchitectureDoc(input.baseDir, input.projectName);
       await ensureGitignoreExe(input.baseDir);
     } catch {
@@ -1279,13 +1447,19 @@ ${laneWarning}` : laneWarning;
   });
   if (input.baseDir) {
     try {
-      const EXE_OS_DIR = path10.join(os7.homedir(), ".exe-os");
-      const mdPath = path10.join(EXE_OS_DIR, taskFile);
-      const mdDir = path10.dirname(mdPath);
-      if (!existsSync9(mdDir)) await mkdir3(mdDir, { recursive: true });
+      const EXE_OS_DIR = path11.join(os8.homedir(), ".exe-os");
+      const mdPath = path11.join(EXE_OS_DIR, taskFile);
+      const mdDir = path11.dirname(mdPath);
+      if (!existsSync10(mdDir)) await mkdir3(mdDir, { recursive: true });
       const reviewer = input.reviewer ?? input.assignedBy;
       const mdContent = `# ${input.title}
 
+## MANDATORY: When done
+
+You MUST call update_task with status "done" and a result summary when finished.
+If you skip this, your reviewer will not know you're done and your work won't be reviewed.
+Do NOT let a failed commit or any error prevent you from calling update_task(done).
+
 **ID:** ${id}
 **Status:** ${initialStatus}
 **Priority:** ${input.priority}
@@ -1299,12 +1473,6 @@ ${laneWarning}` : laneWarning;
 ## Context
 
 ${input.context}
-
-## MANDATORY: When done
-
-You MUST call update_task with status "done" and a result summary when finished.
-If you skip this, your reviewer will not know you're done and your work won't be reviewed.
-Do NOT let a failed commit or any error prevent you from calling update_task(done).
 `;
       await writeFile3(mdPath, mdContent, "utf-8");
     } catch (err) {
@@ -1386,14 +1554,14 @@ function isTmuxSessionAlive(identifier) {
   if (!identifier || identifier === "unknown") return true;
   try {
     if (identifier.startsWith("%")) {
-      const output = execSync4("tmux list-panes -a -F '#{pane_id}'", {
+      const output = execSync5("tmux list-panes -a -F '#{pane_id}'", {
         timeout: 2e3,
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"]
       });
       return output.split("\n").some((l) => l.trim() === identifier);
     } else {
-      execSync4(`tmux has-session -t ${JSON.stringify(identifier)}`, {
+      execSync5(`tmux has-session -t ${JSON.stringify(identifier)}`, {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -1402,7 +1570,7 @@ function isTmuxSessionAlive(identifier) {
   } catch {
     if (identifier.startsWith("%")) return true;
     try {
-      execSync4("tmux list-sessions", {
+      execSync5("tmux list-sessions", {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -1417,12 +1585,12 @@ function checkStaleCompletion(taskContext, taskCreatedAt) {
   if (!DELEGATION_KEYWORDS.test(taskContext)) return null;
   try {
     const since = new Date(taskCreatedAt).toISOString();
-    const branch = execSync4(
+    const branch = execSync5(
       "git rev-parse --abbrev-ref HEAD 2>/dev/null",
       { encoding: "utf8", timeout: 3e3 }
     ).trim();
     const branchArg = branch && branch !== "HEAD" ? branch : "";
-    const commitCount = execSync4(
+    const commitCount = execSync5(
       `git log --oneline --since="${since}" ${branchArg} 2>/dev/null | wc -l`,
       { encoding: "utf8", timeout: 5e3 }
     ).trim();
@@ -1553,7 +1721,7 @@ ${input.result}` : `\u26A0\uFE0F ${warning}`;
     await client.execute("PRAGMA wal_checkpoint(PASSIVE)");
   } catch {
   }
-  if (input.status === "done" || input.status === "cancelled") {
+  if (input.status === "done" || input.status === "cancelled" || input.status === "closed") {
     try {
       const { clearQueueForAgent: clearQueueForAgent2 } = await Promise.resolve().then(() => (init_intercom_queue(), intercom_queue_exports));
       clearQueueForAgent2(String(row.assigned_to));
@@ -1582,9 +1750,9 @@ async function deleteTaskCore(taskId, _baseDir) {
   return { taskFile, assignedTo, assignedBy, taskSlug };
 }
 async function ensureArchitectureDoc(baseDir, projectName) {
-  const archPath = path10.join(baseDir, "exe", "ARCHITECTURE.md");
+  const archPath = path11.join(baseDir, "exe", "ARCHITECTURE.md");
   try {
-    if (existsSync9(archPath)) return;
+    if (existsSync10(archPath)) return;
     const template = [
       `# ${projectName} \u2014 System Architecture`,
       "",
@@ -1617,9 +1785,9 @@ async function ensureArchitectureDoc(baseDir, projectName) {
   }
 }
 async function ensureGitignoreExe(baseDir) {
-  const gitignorePath = path10.join(baseDir, ".gitignore");
+  const gitignorePath = path11.join(baseDir, ".gitignore");
   try {
-    if (existsSync9(gitignorePath)) {
+    if (existsSync10(gitignorePath)) {
       const content = readFileSync9(gitignorePath, "utf-8");
       if (/^\/?exe\/?$/m.test(content)) return;
       await appendFile(gitignorePath, "\n# Employee task assignments (private)\n/exe/\n");
@@ -1651,58 +1819,42 @@ var init_tasks_crud = __esm({
 });
 
 // src/lib/tasks-review.ts
-import path11 from "path";
-import { existsSync as existsSync10, readdirSync as readdirSync2, unlinkSync as unlinkSync3 } from "fs";
+import path12 from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync2, unlinkSync as unlinkSync3 } from "fs";
 async function countPendingReviews(sessionScope) {
   const client = getClient();
-  if (sessionScope) {
-    const result2 = await client.execute({
-      sql: "SELECT COUNT(*) as cnt FROM tasks WHERE status = 'needs_review' AND session_scope = ?",
-      args: [sessionScope]
-    });
-    return Number(result2.rows[0]?.cnt) || 0;
-  }
+  const scope = strictSessionScopeFilter(
+    sessionScope === void 0 ? getCurrentSessionScope() : sessionScope
+  );
   const result = await client.execute({
-    sql: "SELECT COUNT(*) as cnt FROM tasks WHERE status = 'needs_review'",
-    args: []
+    sql: `SELECT COUNT(*) as cnt FROM tasks
+          WHERE status = 'needs_review'${scope.sql}`,
+    args: [...scope.args]
   });
   return Number(result.rows[0]?.cnt) || 0;
 }
 async function countNewPendingReviewsSince(sinceIso, sessionScope) {
   const client = getClient();
-  if (sessionScope) {
-    const result2 = await client.execute({
-      sql: `SELECT COUNT(*) as cnt FROM tasks
-            WHERE status = 'needs_review' AND updated_at > ?
-              AND session_scope = ?`,
-      args: [sinceIso, sessionScope]
-    });
-    return Number(result2.rows[0]?.cnt) || 0;
-  }
+  const scope = strictSessionScopeFilter(
+    sessionScope === void 0 ? getCurrentSessionScope() : sessionScope
+  );
   const result = await client.execute({
     sql: `SELECT COUNT(*) as cnt FROM tasks
-          WHERE status = 'needs_review' AND updated_at > ?`,
-    args: [sinceIso]
+          WHERE status = 'needs_review' AND updated_at > ?${scope.sql}`,
+    args: [sinceIso, ...scope.args]
   });
   return Number(result.rows[0]?.cnt) || 0;
 }
 async function listPendingReviews(limit, sessionScope) {
   const client = getClient();
-  if (sessionScope) {
-    const result2 = await client.execute({
-      sql: `SELECT title, assigned_to, project_name, updated_at FROM tasks
-            WHERE status = 'needs_review'
-              AND session_scope = ?
-            ORDER BY updated_at ASC LIMIT ?`,
-      args: [sessionScope, limit]
-    });
-    return result2.rows;
-  }
+  const scope = strictSessionScopeFilter(
+    sessionScope === void 0 ? getCurrentSessionScope() : sessionScope
+  );
   const result = await client.execute({
     sql: `SELECT title, assigned_to, project_name, updated_at FROM tasks
-          WHERE status = 'needs_review'
+          WHERE status = 'needs_review'${scope.sql}
           ORDER BY updated_at ASC LIMIT ?`,
-    args: [limit]
+    args: [...scope.args, limit]
   });
   return result.rows;
 }
@@ -1714,7 +1866,7 @@ async function cleanupOrphanedReviews() {
           WHERE status IN ('open', 'needs_review', 'in_progress')
           AND assigned_by = 'system'
           AND title LIKE 'Review:%'
-          AND parent_task_id IN (SELECT id FROM tasks WHERE status IN ('done', 'cancelled'))`,
+          AND parent_task_id IN (SELECT id FROM tasks WHERE status IN ('done', 'cancelled', 'closed'))`,
     args: [now]
   });
   const r1b = await client.execute({
@@ -1833,11 +1985,11 @@ async function cleanupReviewFile(row, taskFile, _baseDir) {
     );
   }
   try {
-    const cacheDir = path11.join(EXE_AI_DIR, "session-cache");
-    if (existsSync10(cacheDir)) {
+    const cacheDir = path12.join(EXE_AI_DIR, "session-cache");
+    if (existsSync11(cacheDir)) {
       for (const f of readdirSync2(cacheDir)) {
         if (f.startsWith("review-notified-")) {
-          unlinkSync3(path11.join(cacheDir, f));
+          unlinkSync3(path12.join(cacheDir, f));
         }
       }
     }
@@ -1854,11 +2006,12 @@ var init_tasks_review = __esm({
     init_tmux_routing();
     init_session_key();
     init_state_bus();
+    init_task_scope();
   }
 });
 
 // src/lib/tasks-chain.ts
-import path12 from "path";
+import path13 from "path";
 import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
 async function cascadeUnblock(taskId, baseDir, now) {
   const client = getClient();
@@ -1875,7 +2028,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
     });
     for (const ur of unblockedRows.rows) {
       try {
-        const ubFile = path12.join(baseDir, String(ur.task_file));
+        const ubFile = path13.join(baseDir, String(ur.task_file));
         let ubContent = await readFile3(ubFile, "utf-8");
         ubContent = ubContent.replace(/\*\*Status:\*\* blocked/, "**Status:** open");
         ubContent = ubContent.replace(/\n\*\*Blocked by:\*\*.*\n/, "\n");
@@ -1910,7 +2063,7 @@ async function checkSubtaskCompletion(parentTaskId, projectName) {
   const scScope = sessionScopeFilter();
   const remaining = await client.execute({
     sql: `SELECT COUNT(*) as cnt FROM tasks
-          WHERE parent_task_id = ? AND status NOT IN ('done', 'cancelled')${scScope.sql}`,
+          WHERE parent_task_id = ? AND status NOT IN ('done', 'cancelled', 'closed')${scScope.sql}`,
     args: [parentTaskId, ...scScope.args]
   });
   const cnt = Number(remaining.rows[0]?.cnt ?? 1);
@@ -1942,110 +2095,6 @@ var init_tasks_chain = __esm({
   }
 });
 
-// src/lib/project-name.ts
-import { execSync as execSync5 } from "child_process";
-import path13 from "path";
-function getProjectName(cwd) {
-  const dir = cwd ?? process.cwd();
-  if (_cached2 && _cachedCwd === dir) return _cached2;
-  try {
-    let repoRoot;
-    try {
-      const gitCommonDir = execSync5("git rev-parse --path-format=absolute --git-common-dir", {
-        cwd: dir,
-        encoding: "utf8",
-        timeout: 2e3,
-        stdio: ["pipe", "pipe", "pipe"]
-      }).trim();
-      repoRoot = path13.dirname(gitCommonDir);
-    } catch {
-      repoRoot = execSync5("git rev-parse --show-toplevel", {
-        cwd: dir,
-        encoding: "utf8",
-        timeout: 2e3,
-        stdio: ["pipe", "pipe", "pipe"]
-      }).trim();
-    }
-    _cached2 = path13.basename(repoRoot);
-    _cachedCwd = dir;
-    return _cached2;
-  } catch {
-    _cached2 = path13.basename(dir);
-    _cachedCwd = dir;
-    return _cached2;
-  }
-}
-var _cached2, _cachedCwd;
-var init_project_name = __esm({
-  "src/lib/project-name.ts"() {
-    "use strict";
-    _cached2 = null;
-    _cachedCwd = null;
-  }
-});
-
-// src/lib/session-scope.ts
-var session_scope_exports = {};
-__export(session_scope_exports, {
-  assertSessionScope: () => assertSessionScope,
-  findSessionForProject: () => findSessionForProject,
-  getSessionProject: () => getSessionProject
-});
-function getSessionProject(sessionName) {
-  const sessions = listSessions();
-  const entry = sessions.find((s) => s.windowName === sessionName);
-  if (!entry) return null;
-  const parts = entry.projectDir.split("/").filter(Boolean);
-  return parts[parts.length - 1] ?? null;
-}
-function findSessionForProject(projectName) {
-  const sessions = listSessions();
-  for (const s of sessions) {
-    const proj = s.projectDir.split("/").filter(Boolean).pop();
-    if (proj === projectName && isCoordinatorName(s.agentId)) return s;
-  }
-  return null;
-}
-function assertSessionScope(actionType, targetProject) {
-  try {
-    const currentProject = getProjectName();
-    const exeSession = resolveExeSession();
-    if (!exeSession) {
-      return { allowed: true, reason: "no_session" };
-    }
-    if (currentProject === targetProject) {
-      return {
-        allowed: true,
-        reason: "same_session",
-        currentProject,
-        targetProject
-      };
-    }
-    process.stderr.write(
-      `[session-scope] BLOCKED cross-project ${actionType}: session project="${currentProject}" \u2260 target project="${targetProject}"
-`
-    );
-    return {
-      allowed: false,
-      reason: "cross_session_denied",
-      currentProject,
-      targetProject,
-      targetSession: findSessionForProject(targetProject)?.windowName
-    };
-  } catch {
-    return { allowed: true, reason: "no_session" };
-  }
-}
-var init_session_scope = __esm({
-  "src/lib/session-scope.ts"() {
-    "use strict";
-    init_session_registry();
-    init_project_name();
-    init_tmux_routing();
-    init_employees();
-  }
-});
-
 // src/lib/tasks-notify.ts
 async function dispatchTaskToEmployee(input) {
   if (isCoordinatorName(input.assignedTo)) return { dispatched: "skipped" };
@@ -2468,7 +2517,7 @@ async function updateTask(input) {
     if (input.status === "in_progress") {
       mkdirSync5(cacheDir, { recursive: true });
       writeFileSync6(cachePath, JSON.stringify({ taskId, title: String(row.title) }));
-    } else if (input.status === "done" || input.status === "blocked" || input.status === "cancelled") {
+    } else if (input.status === "done" || input.status === "blocked" || input.status === "cancelled" || input.status === "closed") {
       try {
         unlinkSync4(cachePath);
       } catch {
@@ -2476,10 +2525,10 @@ async function updateTask(input) {
     }
   } catch {
   }
-  if (input.status === "done") {
+  if (input.status === "done" || input.status === "closed") {
     await cleanupReviewFile(row, taskFile, input.baseDir);
   }
-  if (input.status === "done" || input.status === "cancelled") {
+  if (input.status === "done" || input.status === "cancelled" || input.status === "closed") {
     try {
       const client = getClient();
       const taskTitle = String(row.title);
@@ -2495,7 +2544,7 @@ async function updateTask(input) {
     if (!isCoordinatorName(assignedAgent)) {
       try {
         const draftClient = getClient();
-        if (input.status === "done") {
+        if (input.status === "done" || input.status === "closed") {
           await draftClient.execute({
             sql: `UPDATE memories SET draft = 0 WHERE agent_id = ? AND draft = 1`,
             args: [assignedAgent]
@@ -2512,7 +2561,7 @@ async function updateTask(input) {
     try {
       const client = getClient();
       const cascaded = await client.execute({
-        sql: `UPDATE tasks SET status = 'done', updated_at = ?
+        sql: `UPDATE tasks SET status = 'closed', updated_at = ?
               WHERE parent_task_id = ? AND status = 'needs_review'`,
         args: [now, taskId]
       });
@@ -2525,14 +2574,14 @@ async function updateTask(input) {
     } catch {
     }
   }
-  const isTerminal = input.status === "done" || input.status === "needs_review";
+  const isTerminal = input.status === "done" || input.status === "needs_review" || input.status === "closed";
   if (isTerminal) {
     const isCoordinator = isCoordinatorName(String(row.assigned_to));
     if (!isCoordinator) {
       notifyTaskDone();
     }
     await markTaskNotificationsRead(taskFile);
-    if (input.status === "done") {
+    if (input.status === "done" || input.status === "closed") {
       try {
         await cascadeUnblock(taskId, input.baseDir, now);
       } catch {
@@ -2552,7 +2601,7 @@ async function updateTask(input) {
       }
     }
   }
-  if (input.status === "done" && !isCoordinatorName(String(row.assigned_to)) && !process.env.VITEST) {
+  if ((input.status === "done" || input.status === "closed") && !isCoordinatorName(String(row.assigned_to)) && !process.env.VITEST) {
     Promise.resolve().then(() => (init_skill_learning(), skill_learning_exports)).then(
       ({ captureAndLearn: captureAndLearn2 }) => captureAndLearn2({
         taskId,
@@ -2924,6 +2973,7 @@ __export(tmux_routing_exports, {
   isEmployeeAlive: () => isEmployeeAlive,
   isExeSession: () => isExeSession,
   isSessionBusy: () => isSessionBusy,
+  notifyCoordinatorTaskCompletion: () => notifyCoordinatorTaskCompletion,
   notifyParentExe: () => notifyParentExe,
   parseParentExe: () => parseParentExe,
   registerParentExe: () => registerParentExe,
@@ -2934,9 +2984,9 @@ __export(tmux_routing_exports, {
   verifyPaneAtCapacity: () => verifyPaneAtCapacity
 });
 import { execFileSync as execFileSync2, execSync as execSync6 } from "child_process";
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync11, appendFileSync, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync12, appendFileSync, readdirSync as readdirSync3 } from "fs";
 import path15 from "path";
-import os8 from "os";
+import os9 from "os";
 import { fileURLToPath } from "url";
 import { unlinkSync as unlinkSync5 } from "fs";
 function spawnLockPath(sessionName) {
@@ -2951,11 +3001,11 @@ function isProcessAlive(pid) {
   }
 }
 function acquireSpawnLock(sessionName) {
-  if (!existsSync11(SPAWN_LOCK_DIR)) {
+  if (!existsSync12(SPAWN_LOCK_DIR)) {
     mkdirSync6(SPAWN_LOCK_DIR, { recursive: true });
   }
   const lockFile = spawnLockPath(sessionName);
-  if (existsSync11(lockFile)) {
+  if (existsSync12(lockFile)) {
     try {
       const lock = JSON.parse(readFileSync10(lockFile, "utf8"));
       const age = Date.now() - lock.timestamp;
@@ -2983,7 +3033,7 @@ function resolveBehaviorsExporterScript() {
       "bin",
       "exe-export-behaviors.js"
     );
-    return existsSync11(scriptPath) ? scriptPath : null;
+    return existsSync12(scriptPath) ? scriptPath : null;
   } catch {
     return null;
   }
@@ -3049,7 +3099,7 @@ function extractRootExe(name) {
   return parts.length > 0 ? parts[parts.length - 1] : null;
 }
 function registerParentExe(sessionKey, parentExe, dispatchedBy) {
-  if (!existsSync11(SESSION_CACHE)) {
+  if (!existsSync12(SESSION_CACHE)) {
     mkdirSync6(SESSION_CACHE, { recursive: true });
   }
   const rootExe = extractRootExe(parentExe) ?? parentExe;
@@ -3141,7 +3191,7 @@ async function verifyPaneAtCapacity(sessionName) {
 }
 function readDebounceState() {
   try {
-    if (!existsSync11(DEBOUNCE_FILE)) return {};
+    if (!existsSync12(DEBOUNCE_FILE)) return {};
     const raw = JSON.parse(readFileSync10(DEBOUNCE_FILE, "utf8"));
     const state = {};
     for (const [key, val] of Object.entries(raw)) {
@@ -3158,7 +3208,7 @@ function readDebounceState() {
 }
 function writeDebounceState(state) {
   try {
-    if (!existsSync11(SESSION_CACHE)) mkdirSync6(SESSION_CACHE, { recursive: true });
+    if (!existsSync12(SESSION_CACHE)) mkdirSync6(SESSION_CACHE, { recursive: true });
     writeFileSync7(DEBOUNCE_FILE, JSON.stringify(state));
   } catch {
   }
@@ -3258,7 +3308,7 @@ function sendIntercom(targetSession) {
       const rawAgent = targetSession.split("-")[0] ?? targetSession;
       const agent = baseAgentName(rawAgent);
       const markerPath = path15.join(SESSION_CACHE, `current-task-${agent}.json`);
-      if (existsSync11(markerPath)) {
+      if (existsSync12(markerPath)) {
         logIntercom(`SKIP \u2192 ${targetSession} (has in_progress task marker \u2014 will auto-chain)`);
         return "debounced";
       }
@@ -3268,7 +3318,7 @@ function sendIntercom(targetSession) {
       const rawAgent = targetSession.split("-")[0] ?? targetSession;
       const agent = baseAgentName(rawAgent);
       const taskDir = path15.join(process.cwd(), "exe", agent);
-      if (existsSync11(taskDir)) {
+      if (existsSync12(taskDir)) {
         const files = readdirSync3(taskDir).filter(
           (f) => f.endsWith(".md") && f !== "DONE.txt"
         );
@@ -3328,6 +3378,21 @@ function notifyParentExe(sessionKey) {
   }
   return true;
 }
+function notifyCoordinatorTaskCompletion(coordinatorSession, agentName, taskTitle) {
+  const transport = getTransport();
+  try {
+    const sessions = transport.listSessions();
+    if (!sessions.includes(coordinatorSession)) return false;
+    execSync6(
+      `tmux send-keys -t ${JSON.stringify(coordinatorSession)} '/exe-intercom' Enter`,
+      { timeout: 3e3 }
+    );
+    logIntercom(`COMPLETION \u2192 ${coordinatorSession} (${agentName} completed "${taskTitle.slice(0, 50)}")`);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function ensureEmployee(employeeName, exeSession, projectDir, opts) {
   if (isCoordinatorName(employeeName)) {
     return { status: "failed", sessionName: "", error: "The COO is not a dispatchable employee" };
@@ -3401,9 +3466,9 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   const transport = getTransport();
   const sessionName = employeeSessionName(employeeName, exeSession, opts?.instance);
   const instanceLabel = opts?.instance != null && opts.instance > 0 ? `${employeeName}${opts.instance}` : employeeName;
-  const logDir = path15.join(os8.homedir(), ".exe-os", "session-logs");
+  const logDir = path15.join(os9.homedir(), ".exe-os", "session-logs");
   const logFile = path15.join(logDir, `${instanceLabel}-${Date.now()}.log`);
-  if (!existsSync11(logDir)) {
+  if (!existsSync12(logDir)) {
     mkdirSync6(logDir, { recursive: true });
   }
   transport.kill(sessionName);
@@ -3411,13 +3476,13 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   try {
     const thisFile = fileURLToPath(import.meta.url);
     const cleanupScript = path15.join(path15.dirname(thisFile), "..", "bin", "exe-session-cleanup.js");
-    if (existsSync11(cleanupScript)) {
+    if (existsSync12(cleanupScript)) {
       cleanupSuffix = `; ${process.execPath} "${cleanupScript}" "${employeeName}" "${exeSession}"`;
     }
   } catch {
   }
   try {
-    const claudeJsonPath = path15.join(os8.homedir(), ".claude.json");
+    const claudeJsonPath = path15.join(os9.homedir(), ".claude.json");
     let claudeJson = {};
     try {
       claudeJson = JSON.parse(readFileSync10(claudeJsonPath, "utf8"));
@@ -3432,7 +3497,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   } catch {
   }
   try {
-    const settingsDir = path15.join(os8.homedir(), ".claude", "projects");
+    const settingsDir = path15.join(os9.homedir(), ".claude", "projects");
     const normalizedKey = (opts?.cwd ?? projectDir).replace(/\//g, "-").replace(/^-/, "");
     const projSettingsDir = path15.join(settingsDir, normalizedKey);
     const settingsPath = path15.join(projSettingsDir, "settings.json");
@@ -3483,7 +3548,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   let legacyFallbackWarned = false;
   if (!useExeAgent && !useBinSymlink) {
     const identityPath = path15.join(
-      os8.homedir(),
+      os9.homedir(),
       ".exe-os",
       "identity",
       `${employeeName}.md`
@@ -3492,7 +3557,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
     const hasAgentFlag = claudeSupportsAgentFlag();
     if (hasAgentFlag) {
       identityFlag = ` --agent ${employeeName}`;
-    } else if (existsSync11(identityPath)) {
+    } else if (existsSync12(identityPath)) {
       identityFlag = ` --append-system-prompt-file ${identityPath}`;
       legacyFallbackWarned = true;
     }
@@ -3513,7 +3578,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   }
   let sessionContextFlag = "";
   try {
-    const ctxDir = path15.join(os8.homedir(), ".exe-os", "session-cache");
+    const ctxDir = path15.join(os9.homedir(), ".exe-os", "session-cache");
     mkdirSync6(ctxDir, { recursive: true });
     const ctxFile = path15.join(ctxDir, `session-context-${sessionName}.md`);
     const ctxContent = [
@@ -3673,14 +3738,14 @@ var init_tmux_routing = __esm({
     init_intercom_queue();
     init_plan_limits();
     init_employees();
-    SPAWN_LOCK_DIR = path15.join(os8.homedir(), ".exe-os", "spawn-locks");
-    SESSION_CACHE = path15.join(os8.homedir(), ".exe-os", "session-cache");
+    SPAWN_LOCK_DIR = path15.join(os9.homedir(), ".exe-os", "spawn-locks");
+    SESSION_CACHE = path15.join(os9.homedir(), ".exe-os", "session-cache");
     BEHAVIORS_EXPORT_TIMEOUT_MS = 1e4;
     VALID_SESSION_NAME = /^[a-z]+\d*-[a-zA-Z0-9_]+$/;
     VERIFY_PANE_LINES = 200;
     INTERCOM_DEBOUNCE_MS = 3e4;
     CODEX_DEBOUNCE_MS = 12e4;
-    INTERCOM_LOG2 = path15.join(os8.homedir(), ".exe-os", "intercom.log");
+    INTERCOM_LOG2 = path15.join(os9.homedir(), ".exe-os", "intercom.log");
     DEBOUNCE_FILE = path15.join(SESSION_CACHE, "intercom-debounce.json");
     DEBOUNCE_CLEANUP_AGE_MS = 5 * 60 * 1e3;
     BUSY_PATTERN = /[✻✽✶✳·].*…|Running…|• Working|• Ran |• Explored|• Called|esc to interrupt/;
@@ -3700,6 +3765,7 @@ export {
   isEmployeeAlive,
   isExeSession,
   isSessionBusy,
+  notifyCoordinatorTaskCompletion,
   notifyParentExe,
   parseParentExe,
   registerParentExe,