@askexenow/exe-os 0.9.8 → 0.9.10

package/dist/bin/exe-dispatch.js

@@ -308,9 +308,34 @@ var init_provider_table = __esm({
   }
 });
 
+// src/lib/secure-files.ts
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+import { chmod, mkdir } from "fs/promises";
+async function ensurePrivateDir(dirPath) {
+  await mkdir(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    await chmod(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+async function enforcePrivateFile(filePath) {
+  try {
+    await chmod(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+var PRIVATE_DIR_MODE, PRIVATE_FILE_MODE;
+var init_secure_files = __esm({
+  "src/lib/secure-files.ts"() {
+    "use strict";
+    PRIVATE_DIR_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+  }
+});
+
 // src/lib/config.ts
-import { readFile, writeFile, mkdir, chmod } from "fs/promises";
-import { readFileSync as readFileSync2, existsSync as existsSync2, renameSync } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { readFileSync as readFileSync2, existsSync as existsSync3, renameSync } from "fs";
 import path2 from "path";
 import os2 from "os";
 function resolveDataDir() {
@@ -318,7 +343,7 @@ function resolveDataDir() {
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
   const newDir = path2.join(os2.homedir(), ".exe-os");
   const legacyDir = path2.join(os2.homedir(), ".exe-mem");
-  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
+  if (!existsSync3(newDir) && existsSync3(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
       process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
@@ -381,9 +406,9 @@ function normalizeAutoUpdate(raw) {
 }
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path2.join(dir, "config.json");
-  if (!existsSync2(configPath)) {
+  if (!existsSync3(configPath)) {
     return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
   }
   const raw = await readFile(configPath, "utf-8");
@@ -396,6 +421,7 @@ async function loadConfig() {
 `);
       try {
         await writeFile(configPath, JSON.stringify(migratedCfg, null, 2) + "\n");
+        await enforcePrivateFile(configPath);
       } catch {
       }
     }
@@ -415,6 +441,7 @@ var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CON
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
+    init_secure_files();
     EXE_AI_DIR = resolveDataDir();
     DB_PATH = path2.join(EXE_AI_DIR, "memories.db");
     MODELS_DIR = path2.join(EXE_AI_DIR, "models");
@@ -519,10 +546,10 @@ var init_runtime_table = __esm({
 });
 
 // src/lib/agent-config.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync4 } from "fs";
 import path3 from "path";
 function loadAgentConfig() {
-  if (!existsSync3(AGENT_CONFIG_PATH)) return {};
+  if (!existsSync4(AGENT_CONFIG_PATH)) return {};
   try {
     return JSON.parse(readFileSync3(AGENT_CONFIG_PATH, "utf-8"));
   } catch {
@@ -543,6 +570,7 @@ var init_agent_config = __esm({
     "use strict";
     init_config();
     init_runtime_table();
+    init_secure_files();
     AGENT_CONFIG_PATH = path3.join(EXE_AI_DIR, "agent-config.json");
     DEFAULT_MODELS = {
       claude: "claude-opus-4",
@@ -561,16 +589,16 @@ __export(intercom_queue_exports, {
   queueIntercom: () => queueIntercom,
   readQueue: () => readQueue
 });
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, renameSync as renameSync2, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, renameSync as renameSync2, existsSync as existsSync5, mkdirSync as mkdirSync3 } from "fs";
 import path4 from "path";
 import os3 from "os";
 function ensureDir() {
   const dir = path4.dirname(QUEUE_PATH);
-  if (!existsSync4(dir)) mkdirSync3(dir, { recursive: true });
+  if (!existsSync5(dir)) mkdirSync3(dir, { recursive: true });
 }
 function readQueue() {
   try {
-    if (!existsSync4(QUEUE_PATH)) return [];
+    if (!existsSync5(QUEUE_PATH)) return [];
     return JSON.parse(readFileSync4(QUEUE_PATH, "utf8"));
   } catch {
     return [];
@@ -735,7 +763,7 @@ var init_db_retry = __esm({
 
 // src/lib/employees.ts
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { existsSync as existsSync5, symlinkSync, readlinkSync, readFileSync as readFileSync5, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync6, symlinkSync, readlinkSync, readFileSync as readFileSync5, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
 import { execSync as execSync3 } from "child_process";
 import path5 from "path";
 import os4 from "os";
@@ -756,7 +784,7 @@ function isCoordinatorName(agentName, employees = loadEmployeesSync()) {
   return agentName.toLowerCase() === getCoordinatorName(employees).toLowerCase();
 }
 function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync5(employeesPath)) return [];
+  if (!existsSync6(employeesPath)) return [];
   try {
     return JSON.parse(readFileSync5(employeesPath, "utf-8"));
   } catch {
@@ -1719,6 +1747,7 @@ async function ensureSchema() {
       project     TEXT NOT NULL,
       summary     TEXT NOT NULL,
       task_file   TEXT,
+      session_scope TEXT,
       read        INTEGER NOT NULL DEFAULT 0,
       created_at  TEXT NOT NULL
     );
@@ -1727,7 +1756,7 @@ async function ensureSchema() {
       ON notifications(read);
 
     CREATE INDEX IF NOT EXISTS idx_notifications_agent
-      ON notifications(agent_id);
+      ON notifications(agent_id, session_scope);
 
     CREATE INDEX IF NOT EXISTS idx_notifications_task_file
       ON notifications(task_file);
@@ -1765,6 +1794,7 @@ async function ensureSchema() {
       target_agent    TEXT NOT NULL,
       target_project  TEXT,
       target_device   TEXT NOT NULL DEFAULT 'local',
+      session_scope   TEXT,
       content         TEXT NOT NULL,
       priority        TEXT DEFAULT 'normal',
       status          TEXT DEFAULT 'pending',
@@ -1778,10 +1808,31 @@ async function ensureSchema() {
     );
 
     CREATE INDEX IF NOT EXISTS idx_messages_target
-      ON messages(target_agent, status);
+      ON messages(target_agent, session_scope, status);
 
     CREATE INDEX IF NOT EXISTS idx_messages_conversation_order
-      ON messages(target_agent, from_agent, server_seq);
+      ON messages(target_agent, session_scope, from_agent, server_seq);
+  `);
+  try {
+    await client.execute({
+      sql: `ALTER TABLE notifications ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE messages ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  await client.executeMultiple(`
+    CREATE INDEX IF NOT EXISTS idx_notifications_agent_scope_read
+      ON notifications(agent_id, session_scope, read, created_at);
+
+    CREATE INDEX IF NOT EXISTS idx_messages_target_scope_status
+      ON messages(target_agent, session_scope, status, created_at);
   `);
   try {
     await client.execute({
@@ -2365,6 +2416,13 @@ async function ensureSchema() {
     } catch {
     }
   }
+  try {
+    await client.execute({
+      sql: `UPDATE tasks SET status = 'closed' WHERE status = 'done' AND result IS NOT NULL`,
+      args: []
+    });
+  } catch {
+  }
 }
 var _client, _resilientClient, _walCheckpointTimer, _daemonClient, _adapterClient, initTurso;
 var init_database = __esm({
@@ -2383,8 +2441,11 @@ var init_database = __esm({
 });
 
 // src/lib/license.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync7, mkdirSync as mkdirSync4 } from "fs";
 import { randomUUID } from "crypto";
+import { createRequire as createRequire2 } from "module";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import os6 from "os";
 import path7 from "path";
 import { jwtVerify, importSPKI } from "jose";
 var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, PLAN_LIMITS;
@@ -2406,11 +2467,11 @@ var init_license = __esm({
 });
 
 // src/lib/plan-limits.ts
-import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
 import path8 from "path";
 function getLicenseSync() {
   try {
-    if (!existsSync7(CACHE_PATH2)) return freeLicense();
+    if (!existsSync8(CACHE_PATH2)) return freeLicense();
     const raw = JSON.parse(readFileSync7(CACHE_PATH2, "utf8"));
     if (!raw.token || typeof raw.token !== "string") return freeLicense();
     const parts = raw.token.split(".");
@@ -2449,7 +2510,7 @@ function assertEmployeeLimitSync(rosterPath) {
   const filePath = rosterPath ?? EMPLOYEES_PATH;
   let count = 0;
   try {
-    if (existsSync7(filePath)) {
+    if (existsSync8(filePath)) {
       const raw = readFileSync7(filePath, "utf8");
       const employees = JSON.parse(raw);
       count = Array.isArray(employees) ? employees.length : 0;
@@ -2483,15 +2544,48 @@ var init_plan_limits = __esm({
   }
 });
 
+// src/lib/task-scope.ts
+function getCurrentSessionScope() {
+  try {
+    return resolveExeSession();
+  } catch {
+    return null;
+  }
+}
+function sessionScopeFilter(sessionScope, tableAlias) {
+  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
+  if (!scope) return { sql: "", args: [] };
+  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
+  return {
+    sql: ` AND (${col} IS NULL OR ${col} = ?)`,
+    args: [scope]
+  };
+}
+function strictSessionScopeFilter(sessionScope, tableAlias) {
+  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
+  if (!scope) return { sql: "", args: [] };
+  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
+  return {
+    sql: ` AND ${col} = ?`,
+    args: [scope]
+  };
+}
+var init_task_scope = __esm({
+  "src/lib/task-scope.ts"() {
+    "use strict";
+    init_tmux_routing();
+  }
+});
+
 // src/lib/notifications.ts
 import crypto from "crypto";
 import path9 from "path";
-import os6 from "os";
+import os7 from "os";
 import {
   readFileSync as readFileSync8,
   readdirSync,
   unlinkSync as unlinkSync2,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   rmdirSync
 } from "fs";
 async function writeNotification(notification) {
@@ -2499,9 +2593,10 @@ async function writeNotification(notification) {
     const client = getClient();
     const id = crypto.randomUUID();
     const now = (/* @__PURE__ */ new Date()).toISOString();
+    const sessionScope = notification.sessionScope === void 0 ? getCurrentSessionScope() : notification.sessionScope;
     await client.execute({
-      sql: `INSERT INTO notifications (id, agent_id, agent_role, event, project, summary, task_file, read, created_at)
-            VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?)`,
+      sql: `INSERT INTO notifications (id, agent_id, agent_role, event, project, summary, task_file, session_scope, read, created_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, ?)`,
       args: [
         id,
         notification.agentId,
@@ -2510,6 +2605,7 @@ async function writeNotification(notification) {
         notification.project,
         notification.summary,
         notification.taskFile ?? null,
+        sessionScope,
         now
       ]
     });
@@ -2518,12 +2614,14 @@ async function writeNotification(notification) {
 `);
   }
 }
-async function markAsReadByTaskFile(taskFile) {
+async function markAsReadByTaskFile(taskFile, sessionScope) {
   try {
     const client = getClient();
+    const scope = strictSessionScopeFilter(sessionScope);
     await client.execute({
-      sql: "UPDATE notifications SET read = 1 WHERE task_file = ? AND read = 0",
-      args: [taskFile]
+      sql: `UPDATE notifications SET read = 1
+            WHERE task_file = ? AND read = 0${scope.sql}`,
+      args: [taskFile, ...scope.args]
     });
   } catch {
   }
@@ -2532,6 +2630,7 @@ var init_notifications = __esm({
   "src/lib/notifications.ts"() {
     "use strict";
     init_database();
+    init_task_scope();
   }
 });
 
@@ -2569,30 +2668,6 @@ var init_session_kill_telemetry = __esm({
   }
 });
 
-// src/lib/task-scope.ts
-function getCurrentSessionScope() {
-  try {
-    return resolveExeSession();
-  } catch {
-    return null;
-  }
-}
-function sessionScopeFilter(sessionScope, tableAlias) {
-  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
-  if (!scope) return { sql: "", args: [] };
-  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
-  return {
-    sql: ` AND (${col} IS NULL OR ${col} = ?)`,
-    args: [scope]
-  };
-}
-var init_task_scope = __esm({
-  "src/lib/task-scope.ts"() {
-    "use strict";
-    init_tmux_routing();
-  }
-});
-
 // src/lib/state-bus.ts
 var StateBus, orgBus;
 var init_state_bus = __esm({
@@ -2648,13 +2723,117 @@ var init_state_bus = __esm({
   }
 });
 
+// src/lib/project-name.ts
+import { execSync as execSync4 } from "child_process";
+import path10 from "path";
+function getProjectName(cwd) {
+  const dir = cwd ?? process.cwd();
+  if (_cached2 && _cachedCwd === dir) return _cached2;
+  try {
+    let repoRoot;
+    try {
+      const gitCommonDir = execSync4("git rev-parse --path-format=absolute --git-common-dir", {
+        cwd: dir,
+        encoding: "utf8",
+        timeout: 2e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+      repoRoot = path10.dirname(gitCommonDir);
+    } catch {
+      repoRoot = execSync4("git rev-parse --show-toplevel", {
+        cwd: dir,
+        encoding: "utf8",
+        timeout: 2e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+    }
+    _cached2 = path10.basename(repoRoot);
+    _cachedCwd = dir;
+    return _cached2;
+  } catch {
+    _cached2 = path10.basename(dir);
+    _cachedCwd = dir;
+    return _cached2;
+  }
+}
+var _cached2, _cachedCwd;
+var init_project_name = __esm({
+  "src/lib/project-name.ts"() {
+    "use strict";
+    _cached2 = null;
+    _cachedCwd = null;
+  }
+});
+
+// src/lib/session-scope.ts
+var session_scope_exports = {};
+__export(session_scope_exports, {
+  assertSessionScope: () => assertSessionScope,
+  findSessionForProject: () => findSessionForProject,
+  getSessionProject: () => getSessionProject
+});
+function getSessionProject(sessionName) {
+  const sessions = listSessions();
+  const entry = sessions.find((s) => s.windowName === sessionName);
+  if (!entry) return null;
+  const parts = entry.projectDir.split("/").filter(Boolean);
+  return parts[parts.length - 1] ?? null;
+}
+function findSessionForProject(projectName) {
+  const sessions = listSessions();
+  for (const s of sessions) {
+    const proj = s.projectDir.split("/").filter(Boolean).pop();
+    if (proj === projectName && isCoordinatorName(s.agentId)) return s;
+  }
+  return null;
+}
+function assertSessionScope(actionType, targetProject) {
+  try {
+    const currentProject = getProjectName();
+    const exeSession2 = resolveExeSession();
+    if (!exeSession2) {
+      return { allowed: true, reason: "no_session" };
+    }
+    if (currentProject === targetProject) {
+      return {
+        allowed: true,
+        reason: "same_session",
+        currentProject,
+        targetProject
+      };
+    }
+    process.stderr.write(
+      `[session-scope] BLOCKED cross-project ${actionType}: session project="${currentProject}" \u2260 target project="${targetProject}"
+`
+    );
+    return {
+      allowed: false,
+      reason: "cross_session_denied",
+      currentProject,
+      targetProject,
+      targetSession: findSessionForProject(targetProject)?.windowName
+    };
+  } catch {
+    return { allowed: true, reason: "no_session" };
+  }
+}
+var init_session_scope = __esm({
+  "src/lib/session-scope.ts"() {
+    "use strict";
+    init_session_registry();
+    init_project_name();
+    init_tmux_routing();
+    init_employees();
+  }
+});
+
 // src/lib/tasks-crud.ts
 import crypto3 from "crypto";
-import path10 from "path";
-import os7 from "os";
-import { execSync as execSync4 } from "child_process";
+import path11 from "path";
+import os8 from "os";
+import { execSync as execSync5 } from "child_process";
 import { mkdir as mkdir3, writeFile as writeFile3, appendFile } from "fs/promises";
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
 async function writeCheckpoint(input) {
   const client = getClient();
   const row = await resolveTask(client, input.taskId);
@@ -2774,9 +2953,24 @@ async function createTaskCore(input) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const slug = slugify(input.title);
   let earlySessionScope = null;
+  let scopeMismatchWarning;
   try {
     const { resolveExeSession: resolveExeSession2 } = await Promise.resolve().then(() => (init_tmux_routing(), tmux_routing_exports));
-    earlySessionScope = resolveExeSession2();
+    const resolved = resolveExeSession2();
+    if (resolved && input.projectName) {
+      const { getSessionProject: getSessionProject2 } = await Promise.resolve().then(() => (init_session_scope(), session_scope_exports));
+      const sessionProject = getSessionProject2(resolved);
+      if (sessionProject && sessionProject !== input.projectName) {
+        scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
+        process.stderr.write(`[create_task] ${scopeMismatchWarning}
+`);
+        earlySessionScope = null;
+      } else {
+        earlySessionScope = resolved;
+      }
+    } else {
+      earlySessionScope = resolved;
+    }
   } catch {
   }
   const scope = earlySessionScope ?? "default";
@@ -2827,10 +3021,14 @@ async function createTaskCore(input) {
 ${laneWarning}` : laneWarning;
     }
   }
+  if (scopeMismatchWarning) {
+    warning = warning ? `${warning}
+${scopeMismatchWarning}` : scopeMismatchWarning;
+  }
   if (input.baseDir) {
     try {
-      await mkdir3(path10.join(input.baseDir, "exe", "output"), { recursive: true });
-      await mkdir3(path10.join(input.baseDir, "exe", "research"), { recursive: true });
+      await mkdir3(path11.join(input.baseDir, "exe", "output"), { recursive: true });
+      await mkdir3(path11.join(input.baseDir, "exe", "research"), { recursive: true });
       await ensureArchitectureDoc(input.baseDir, input.projectName);
       await ensureGitignoreExe(input.baseDir);
     } catch {
@@ -2866,13 +3064,19 @@ ${laneWarning}` : laneWarning;
   });
   if (input.baseDir) {
     try {
-      const EXE_OS_DIR = path10.join(os7.homedir(), ".exe-os");
-      const mdPath = path10.join(EXE_OS_DIR, taskFile);
-      const mdDir = path10.dirname(mdPath);
-      if (!existsSync9(mdDir)) await mkdir3(mdDir, { recursive: true });
+      const EXE_OS_DIR = path11.join(os8.homedir(), ".exe-os");
+      const mdPath = path11.join(EXE_OS_DIR, taskFile);
+      const mdDir = path11.dirname(mdPath);
+      if (!existsSync10(mdDir)) await mkdir3(mdDir, { recursive: true });
       const reviewer = input.reviewer ?? input.assignedBy;
       const mdContent = `# ${input.title}
 
+## MANDATORY: When done
+
+You MUST call update_task with status "done" and a result summary when finished.
+If you skip this, your reviewer will not know you're done and your work won't be reviewed.
+Do NOT let a failed commit or any error prevent you from calling update_task(done).
+
 **ID:** ${id}
 **Status:** ${initialStatus}
 **Priority:** ${input.priority}
@@ -2886,12 +3090,6 @@ ${laneWarning}` : laneWarning;
 ## Context
 
 ${input.context}
-
-## MANDATORY: When done
-
-You MUST call update_task with status "done" and a result summary when finished.
-If you skip this, your reviewer will not know you're done and your work won't be reviewed.
-Do NOT let a failed commit or any error prevent you from calling update_task(done).
 `;
       await writeFile3(mdPath, mdContent, "utf-8");
     } catch (err) {
@@ -2973,14 +3171,14 @@ function isTmuxSessionAlive(identifier) {
   if (!identifier || identifier === "unknown") return true;
   try {
     if (identifier.startsWith("%")) {
-      const output = execSync4("tmux list-panes -a -F '#{pane_id}'", {
+      const output = execSync5("tmux list-panes -a -F '#{pane_id}'", {
         timeout: 2e3,
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"]
       });
       return output.split("\n").some((l) => l.trim() === identifier);
     } else {
-      execSync4(`tmux has-session -t ${JSON.stringify(identifier)}`, {
+      execSync5(`tmux has-session -t ${JSON.stringify(identifier)}`, {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -2989,7 +3187,7 @@ function isTmuxSessionAlive(identifier) {
   } catch {
     if (identifier.startsWith("%")) return true;
     try {
-      execSync4("tmux list-sessions", {
+      execSync5("tmux list-sessions", {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -3004,12 +3202,12 @@ function checkStaleCompletion(taskContext, taskCreatedAt) {
   if (!DELEGATION_KEYWORDS.test(taskContext)) return null;
   try {
     const since = new Date(taskCreatedAt).toISOString();
-    const branch = execSync4(
+    const branch = execSync5(
       "git rev-parse --abbrev-ref HEAD 2>/dev/null",
       { encoding: "utf8", timeout: 3e3 }
     ).trim();
     const branchArg = branch && branch !== "HEAD" ? branch : "";
-    const commitCount = execSync4(
+    const commitCount = execSync5(
       `git log --oneline --since="${since}" ${branchArg} 2>/dev/null | wc -l`,
       { encoding: "utf8", timeout: 5e3 }
     ).trim();
@@ -3140,7 +3338,7 @@ ${input.result}` : `\u26A0\uFE0F ${warning}`;
     await client.execute("PRAGMA wal_checkpoint(PASSIVE)");
   } catch {
   }
-  if (input.status === "done" || input.status === "cancelled") {
+  if (input.status === "done" || input.status === "cancelled" || input.status === "closed") {
     try {
       const { clearQueueForAgent: clearQueueForAgent2 } = await Promise.resolve().then(() => (init_intercom_queue(), intercom_queue_exports));
       clearQueueForAgent2(String(row.assigned_to));
@@ -3169,9 +3367,9 @@ async function deleteTaskCore(taskId, _baseDir) {
   return { taskFile, assignedTo, assignedBy, taskSlug };
 }
 async function ensureArchitectureDoc(baseDir, projectName) {
-  const archPath = path10.join(baseDir, "exe", "ARCHITECTURE.md");
+  const archPath = path11.join(baseDir, "exe", "ARCHITECTURE.md");
   try {
-    if (existsSync9(archPath)) return;
+    if (existsSync10(archPath)) return;
     const template = [
       `# ${projectName} \u2014 System Architecture`,
       "",
@@ -3204,9 +3402,9 @@ async function ensureArchitectureDoc(baseDir, projectName) {
   }
 }
 async function ensureGitignoreExe(baseDir) {
-  const gitignorePath = path10.join(baseDir, ".gitignore");
+  const gitignorePath = path11.join(baseDir, ".gitignore");
   try {
-    if (existsSync9(gitignorePath)) {
+    if (existsSync10(gitignorePath)) {
       const content = readFileSync9(gitignorePath, "utf-8");
       if (/^\/?exe\/?$/m.test(content)) return;
       await appendFile(gitignorePath, "\n# Employee task assignments (private)\n/exe/\n");
@@ -3238,58 +3436,42 @@ var init_tasks_crud = __esm({
 });
 
 // src/lib/tasks-review.ts
-import path11 from "path";
-import { existsSync as existsSync10, readdirSync as readdirSync2, unlinkSync as unlinkSync3 } from "fs";
+import path12 from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync2, unlinkSync as unlinkSync3 } from "fs";
 async function countPendingReviews(sessionScope) {
   const client = getClient();
-  if (sessionScope) {
-    const result3 = await client.execute({
-      sql: "SELECT COUNT(*) as cnt FROM tasks WHERE status = 'needs_review' AND session_scope = ?",
-      args: [sessionScope]
-    });
-    return Number(result3.rows[0]?.cnt) || 0;
-  }
+  const scope = strictSessionScopeFilter(
+    sessionScope === void 0 ? getCurrentSessionScope() : sessionScope
+  );
   const result2 = await client.execute({
-    sql: "SELECT COUNT(*) as cnt FROM tasks WHERE status = 'needs_review'",
-    args: []
+    sql: `SELECT COUNT(*) as cnt FROM tasks
+          WHERE status = 'needs_review'${scope.sql}`,
+    args: [...scope.args]
   });
   return Number(result2.rows[0]?.cnt) || 0;
 }
 async function countNewPendingReviewsSince(sinceIso, sessionScope) {
   const client = getClient();
-  if (sessionScope) {
-    const result3 = await client.execute({
-      sql: `SELECT COUNT(*) as cnt FROM tasks
-            WHERE status = 'needs_review' AND updated_at > ?
-              AND session_scope = ?`,
-      args: [sinceIso, sessionScope]
-    });
-    return Number(result3.rows[0]?.cnt) || 0;
-  }
+  const scope = strictSessionScopeFilter(
+    sessionScope === void 0 ? getCurrentSessionScope() : sessionScope
+  );
   const result2 = await client.execute({
     sql: `SELECT COUNT(*) as cnt FROM tasks
-          WHERE status = 'needs_review' AND updated_at > ?`,
-    args: [sinceIso]
+          WHERE status = 'needs_review' AND updated_at > ?${scope.sql}`,
+    args: [sinceIso, ...scope.args]
   });
   return Number(result2.rows[0]?.cnt) || 0;
 }
 async function listPendingReviews(limit, sessionScope) {
   const client = getClient();
-  if (sessionScope) {
-    const result3 = await client.execute({
-      sql: `SELECT title, assigned_to, project_name, updated_at FROM tasks
-            WHERE status = 'needs_review'
-              AND session_scope = ?
-            ORDER BY updated_at ASC LIMIT ?`,
-      args: [sessionScope, limit]
-    });
-    return result3.rows;
-  }
+  const scope = strictSessionScopeFilter(
+    sessionScope === void 0 ? getCurrentSessionScope() : sessionScope
+  );
   const result2 = await client.execute({
     sql: `SELECT title, assigned_to, project_name, updated_at FROM tasks
-          WHERE status = 'needs_review'
+          WHERE status = 'needs_review'${scope.sql}
           ORDER BY updated_at ASC LIMIT ?`,
-    args: [limit]
+    args: [...scope.args, limit]
   });
   return result2.rows;
 }
@@ -3301,7 +3483,7 @@ async function cleanupOrphanedReviews() {
           WHERE status IN ('open', 'needs_review', 'in_progress')
           AND assigned_by = 'system'
           AND title LIKE 'Review:%'
-          AND parent_task_id IN (SELECT id FROM tasks WHERE status IN ('done', 'cancelled'))`,
+          AND parent_task_id IN (SELECT id FROM tasks WHERE status IN ('done', 'cancelled', 'closed'))`,
     args: [now]
   });
   const r1b = await client.execute({
@@ -3420,11 +3602,11 @@ async function cleanupReviewFile(row, taskFile, _baseDir) {
     );
   }
   try {
-    const cacheDir = path11.join(EXE_AI_DIR, "session-cache");
-    if (existsSync10(cacheDir)) {
+    const cacheDir = path12.join(EXE_AI_DIR, "session-cache");
+    if (existsSync11(cacheDir)) {
       for (const f of readdirSync2(cacheDir)) {
         if (f.startsWith("review-notified-")) {
-          unlinkSync3(path11.join(cacheDir, f));
+          unlinkSync3(path12.join(cacheDir, f));
         }
       }
     }
@@ -3441,11 +3623,12 @@ var init_tasks_review = __esm({
     init_tmux_routing();
     init_session_key();
     init_state_bus();
+    init_task_scope();
   }
 });
 
 // src/lib/tasks-chain.ts
-import path12 from "path";
+import path13 from "path";
 import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
 async function cascadeUnblock(taskId, baseDir, now) {
   const client = getClient();
@@ -3462,7 +3645,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
     });
     for (const ur of unblockedRows.rows) {
       try {
-        const ubFile = path12.join(baseDir, String(ur.task_file));
+        const ubFile = path13.join(baseDir, String(ur.task_file));
         let ubContent = await readFile3(ubFile, "utf-8");
         ubContent = ubContent.replace(/\*\*Status:\*\* blocked/, "**Status:** open");
         ubContent = ubContent.replace(/\n\*\*Blocked by:\*\*.*\n/, "\n");
@@ -3497,7 +3680,7 @@ async function checkSubtaskCompletion(parentTaskId, projectName) {
   const scScope = sessionScopeFilter();
   const remaining = await client.execute({
     sql: `SELECT COUNT(*) as cnt FROM tasks
-          WHERE parent_task_id = ? AND status NOT IN ('done', 'cancelled')${scScope.sql}`,
+          WHERE parent_task_id = ? AND status NOT IN ('done', 'cancelled', 'closed')${scScope.sql}`,
     args: [parentTaskId, ...scScope.args]
   });
   const cnt = Number(remaining.rows[0]?.cnt ?? 1);
@@ -3529,110 +3712,6 @@ var init_tasks_chain = __esm({
   }
 });
 
-// src/lib/project-name.ts
-import { execSync as execSync5 } from "child_process";
-import path13 from "path";
-function getProjectName(cwd) {
-  const dir = cwd ?? process.cwd();
-  if (_cached2 && _cachedCwd === dir) return _cached2;
-  try {
-    let repoRoot;
-    try {
-      const gitCommonDir = execSync5("git rev-parse --path-format=absolute --git-common-dir", {
-        cwd: dir,
-        encoding: "utf8",
-        timeout: 2e3,
-        stdio: ["pipe", "pipe", "pipe"]
-      }).trim();
-      repoRoot = path13.dirname(gitCommonDir);
-    } catch {
-      repoRoot = execSync5("git rev-parse --show-toplevel", {
-        cwd: dir,
-        encoding: "utf8",
-        timeout: 2e3,
-        stdio: ["pipe", "pipe", "pipe"]
-      }).trim();
-    }
-    _cached2 = path13.basename(repoRoot);
-    _cachedCwd = dir;
-    return _cached2;
-  } catch {
-    _cached2 = path13.basename(dir);
-    _cachedCwd = dir;
-    return _cached2;
-  }
-}
-var _cached2, _cachedCwd;
-var init_project_name = __esm({
-  "src/lib/project-name.ts"() {
-    "use strict";
-    _cached2 = null;
-    _cachedCwd = null;
-  }
-});
-
-// src/lib/session-scope.ts
-var session_scope_exports = {};
-__export(session_scope_exports, {
-  assertSessionScope: () => assertSessionScope,
-  findSessionForProject: () => findSessionForProject,
-  getSessionProject: () => getSessionProject
-});
-function getSessionProject(sessionName) {
-  const sessions = listSessions();
-  const entry = sessions.find((s) => s.windowName === sessionName);
-  if (!entry) return null;
-  const parts = entry.projectDir.split("/").filter(Boolean);
-  return parts[parts.length - 1] ?? null;
-}
-function findSessionForProject(projectName) {
-  const sessions = listSessions();
-  for (const s of sessions) {
-    const proj = s.projectDir.split("/").filter(Boolean).pop();
-    if (proj === projectName && isCoordinatorName(s.agentId)) return s;
-  }
-  return null;
-}
-function assertSessionScope(actionType, targetProject) {
-  try {
-    const currentProject = getProjectName();
-    const exeSession2 = resolveExeSession();
-    if (!exeSession2) {
-      return { allowed: true, reason: "no_session" };
-    }
-    if (currentProject === targetProject) {
-      return {
-        allowed: true,
-        reason: "same_session",
-        currentProject,
-        targetProject
-      };
-    }
-    process.stderr.write(
-      `[session-scope] BLOCKED cross-project ${actionType}: session project="${currentProject}" \u2260 target project="${targetProject}"
-`
-    );
-    return {
-      allowed: false,
-      reason: "cross_session_denied",
-      currentProject,
-      targetProject,
-      targetSession: findSessionForProject(targetProject)?.windowName
-    };
-  } catch {
-    return { allowed: true, reason: "no_session" };
-  }
-}
-var init_session_scope = __esm({
-  "src/lib/session-scope.ts"() {
-    "use strict";
-    init_session_registry();
-    init_project_name();
-    init_tmux_routing();
-    init_employees();
-  }
-});
-
 // src/lib/tasks-notify.ts
 async function dispatchTaskToEmployee(input) {
   if (isCoordinatorName(input.assignedTo)) return { dispatched: "skipped" };
@@ -4055,7 +4134,7 @@ async function updateTask(input) {
     if (input.status === "in_progress") {
       mkdirSync5(cacheDir, { recursive: true });
       writeFileSync6(cachePath, JSON.stringify({ taskId, title: String(row.title) }));
-    } else if (input.status === "done" || input.status === "blocked" || input.status === "cancelled") {
+    } else if (input.status === "done" || input.status === "blocked" || input.status === "cancelled" || input.status === "closed") {
       try {
         unlinkSync4(cachePath);
       } catch {
@@ -4063,10 +4142,10 @@ async function updateTask(input) {
     }
   } catch {
   }
-  if (input.status === "done") {
+  if (input.status === "done" || input.status === "closed") {
     await cleanupReviewFile(row, taskFile, input.baseDir);
   }
-  if (input.status === "done" || input.status === "cancelled") {
+  if (input.status === "done" || input.status === "cancelled" || input.status === "closed") {
     try {
       const client = getClient();
       const taskTitle = String(row.title);
@@ -4082,7 +4161,7 @@ async function updateTask(input) {
     if (!isCoordinatorName(assignedAgent)) {
       try {
         const draftClient = getClient();
-        if (input.status === "done") {
+        if (input.status === "done" || input.status === "closed") {
           await draftClient.execute({
             sql: `UPDATE memories SET draft = 0 WHERE agent_id = ? AND draft = 1`,
             args: [assignedAgent]
@@ -4099,7 +4178,7 @@ async function updateTask(input) {
     try {
       const client = getClient();
       const cascaded = await client.execute({
-        sql: `UPDATE tasks SET status = 'done', updated_at = ?
+        sql: `UPDATE tasks SET status = 'closed', updated_at = ?
               WHERE parent_task_id = ? AND status = 'needs_review'`,
         args: [now, taskId]
       });
@@ -4112,14 +4191,14 @@ async function updateTask(input) {
     } catch {
     }
   }
-  const isTerminal = input.status === "done" || input.status === "needs_review";
+  const isTerminal = input.status === "done" || input.status === "needs_review" || input.status === "closed";
   if (isTerminal) {
     const isCoordinator = isCoordinatorName(String(row.assigned_to));
     if (!isCoordinator) {
       notifyTaskDone();
     }
     await markTaskNotificationsRead(taskFile);
-    if (input.status === "done") {
+    if (input.status === "done" || input.status === "closed") {
       try {
         await cascadeUnblock(taskId, input.baseDir, now);
       } catch {
@@ -4139,7 +4218,7 @@ async function updateTask(input) {
       }
     }
   }
-  if (input.status === "done" && !isCoordinatorName(String(row.assigned_to)) && !process.env.VITEST) {
+  if ((input.status === "done" || input.status === "closed") && !isCoordinatorName(String(row.assigned_to)) && !process.env.VITEST) {
     Promise.resolve().then(() => (init_skill_learning(), skill_learning_exports)).then(
       ({ captureAndLearn: captureAndLearn2 }) => captureAndLearn2({
         taskId,
@@ -4511,6 +4590,7 @@ __export(tmux_routing_exports, {
   isEmployeeAlive: () => isEmployeeAlive,
   isExeSession: () => isExeSession,
   isSessionBusy: () => isSessionBusy,
+  notifyCoordinatorTaskCompletion: () => notifyCoordinatorTaskCompletion,
   notifyParentExe: () => notifyParentExe,
   parseParentExe: () => parseParentExe,
   registerParentExe: () => registerParentExe,
@@ -4521,9 +4601,9 @@ __export(tmux_routing_exports, {
   verifyPaneAtCapacity: () => verifyPaneAtCapacity
 });
 import { execFileSync as execFileSync2, execSync as execSync6 } from "child_process";
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync11, appendFileSync, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync12, appendFileSync, readdirSync as readdirSync3 } from "fs";
 import path15 from "path";
-import os8 from "os";
+import os9 from "os";
 import { fileURLToPath } from "url";
 import { unlinkSync as unlinkSync5 } from "fs";
 function spawnLockPath(sessionName) {
@@ -4538,11 +4618,11 @@ function isProcessAlive(pid) {
   }
 }
 function acquireSpawnLock(sessionName) {
-  if (!existsSync11(SPAWN_LOCK_DIR)) {
+  if (!existsSync12(SPAWN_LOCK_DIR)) {
     mkdirSync6(SPAWN_LOCK_DIR, { recursive: true });
   }
   const lockFile = spawnLockPath(sessionName);
-  if (existsSync11(lockFile)) {
+  if (existsSync12(lockFile)) {
     try {
       const lock = JSON.parse(readFileSync10(lockFile, "utf8"));
       const age = Date.now() - lock.timestamp;
@@ -4570,7 +4650,7 @@ function resolveBehaviorsExporterScript() {
       "bin",
       "exe-export-behaviors.js"
     );
-    return existsSync11(scriptPath) ? scriptPath : null;
+    return existsSync12(scriptPath) ? scriptPath : null;
   } catch {
     return null;
   }
@@ -4636,7 +4716,7 @@ function extractRootExe(name) {
   return parts.length > 0 ? parts[parts.length - 1] : null;
 }
 function registerParentExe(sessionKey, parentExe, dispatchedBy) {
-  if (!existsSync11(SESSION_CACHE)) {
+  if (!existsSync12(SESSION_CACHE)) {
     mkdirSync6(SESSION_CACHE, { recursive: true });
   }
   const rootExe = extractRootExe(parentExe) ?? parentExe;
@@ -4728,7 +4808,7 @@ async function verifyPaneAtCapacity(sessionName) {
 }
 function readDebounceState() {
   try {
-    if (!existsSync11(DEBOUNCE_FILE)) return {};
+    if (!existsSync12(DEBOUNCE_FILE)) return {};
     const raw = JSON.parse(readFileSync10(DEBOUNCE_FILE, "utf8"));
     const state = {};
     for (const [key, val] of Object.entries(raw)) {
@@ -4745,7 +4825,7 @@ function readDebounceState() {
 }
 function writeDebounceState(state) {
   try {
-    if (!existsSync11(SESSION_CACHE)) mkdirSync6(SESSION_CACHE, { recursive: true });
+    if (!existsSync12(SESSION_CACHE)) mkdirSync6(SESSION_CACHE, { recursive: true });
     writeFileSync7(DEBOUNCE_FILE, JSON.stringify(state));
   } catch {
   }
@@ -4845,7 +4925,7 @@ function sendIntercom(targetSession) {
       const rawAgent = targetSession.split("-")[0] ?? targetSession;
       const agent = baseAgentName(rawAgent);
       const markerPath = path15.join(SESSION_CACHE, `current-task-${agent}.json`);
-      if (existsSync11(markerPath)) {
+      if (existsSync12(markerPath)) {
         logIntercom(`SKIP \u2192 ${targetSession} (has in_progress task marker \u2014 will auto-chain)`);
         return "debounced";
       }
@@ -4855,7 +4935,7 @@ function sendIntercom(targetSession) {
       const rawAgent = targetSession.split("-")[0] ?? targetSession;
       const agent = baseAgentName(rawAgent);
       const taskDir = path15.join(process.cwd(), "exe", agent);
-      if (existsSync11(taskDir)) {
+      if (existsSync12(taskDir)) {
         const files = readdirSync3(taskDir).filter(
           (f) => f.endsWith(".md") && f !== "DONE.txt"
         );
@@ -4915,6 +4995,21 @@ function notifyParentExe(sessionKey) {
   }
   return true;
 }
+function notifyCoordinatorTaskCompletion(coordinatorSession, agentName, taskTitle) {
+  const transport = getTransport();
+  try {
+    const sessions = transport.listSessions();
+    if (!sessions.includes(coordinatorSession)) return false;
+    execSync6(
+      `tmux send-keys -t ${JSON.stringify(coordinatorSession)} '/exe-intercom' Enter`,
+      { timeout: 3e3 }
+    );
+    logIntercom(`COMPLETION \u2192 ${coordinatorSession} (${agentName} completed "${taskTitle.slice(0, 50)}")`);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function ensureEmployee(employeeName2, exeSession2, projectDir2, opts) {
   if (isCoordinatorName(employeeName2)) {
     return { status: "failed", sessionName: "", error: "The COO is not a dispatchable employee" };
@@ -4988,9 +5083,9 @@ function spawnEmployee(employeeName2, exeSession2, projectDir2, opts) {
   const transport = getTransport();
   const sessionName = employeeSessionName(employeeName2, exeSession2, opts?.instance);
   const instanceLabel = opts?.instance != null && opts.instance > 0 ? `${employeeName2}${opts.instance}` : employeeName2;
-  const logDir = path15.join(os8.homedir(), ".exe-os", "session-logs");
+  const logDir = path15.join(os9.homedir(), ".exe-os", "session-logs");
   const logFile = path15.join(logDir, `${instanceLabel}-${Date.now()}.log`);
-  if (!existsSync11(logDir)) {
+  if (!existsSync12(logDir)) {
     mkdirSync6(logDir, { recursive: true });
   }
   transport.kill(sessionName);
@@ -4998,13 +5093,13 @@ function spawnEmployee(employeeName2, exeSession2, projectDir2, opts) {
   try {
     const thisFile = fileURLToPath(import.meta.url);
     const cleanupScript = path15.join(path15.dirname(thisFile), "..", "bin", "exe-session-cleanup.js");
-    if (existsSync11(cleanupScript)) {
+    if (existsSync12(cleanupScript)) {
       cleanupSuffix = `; ${process.execPath} "${cleanupScript}" "${employeeName2}" "${exeSession2}"`;
     }
   } catch {
   }
   try {
-    const claudeJsonPath = path15.join(os8.homedir(), ".claude.json");
+    const claudeJsonPath = path15.join(os9.homedir(), ".claude.json");
     let claudeJson = {};
     try {
       claudeJson = JSON.parse(readFileSync10(claudeJsonPath, "utf8"));
@@ -5019,7 +5114,7 @@ function spawnEmployee(employeeName2, exeSession2, projectDir2, opts) {
   } catch {
   }
   try {
-    const settingsDir = path15.join(os8.homedir(), ".claude", "projects");
+    const settingsDir = path15.join(os9.homedir(), ".claude", "projects");
     const normalizedKey = (opts?.cwd ?? projectDir2).replace(/\//g, "-").replace(/^-/, "");
     const projSettingsDir = path15.join(settingsDir, normalizedKey);
     const settingsPath = path15.join(projSettingsDir, "settings.json");
@@ -5070,7 +5165,7 @@ function spawnEmployee(employeeName2, exeSession2, projectDir2, opts) {
   let legacyFallbackWarned = false;
   if (!useExeAgent && !useBinSymlink) {
     const identityPath = path15.join(
-      os8.homedir(),
+      os9.homedir(),
       ".exe-os",
       "identity",
       `${employeeName2}.md`
@@ -5079,7 +5174,7 @@ function spawnEmployee(employeeName2, exeSession2, projectDir2, opts) {
     const hasAgentFlag = claudeSupportsAgentFlag();
     if (hasAgentFlag) {
       identityFlag = ` --agent ${employeeName2}`;
-    } else if (existsSync11(identityPath)) {
+    } else if (existsSync12(identityPath)) {
       identityFlag = ` --append-system-prompt-file ${identityPath}`;
       legacyFallbackWarned = true;
     }
@@ -5100,7 +5195,7 @@ function spawnEmployee(employeeName2, exeSession2, projectDir2, opts) {
   }
   let sessionContextFlag = "";
   try {
-    const ctxDir = path15.join(os8.homedir(), ".exe-os", "session-cache");
+    const ctxDir = path15.join(os9.homedir(), ".exe-os", "session-cache");
     mkdirSync6(ctxDir, { recursive: true });
     const ctxFile = path15.join(ctxDir, `session-context-${sessionName}.md`);
     const ctxContent = [
@@ -5261,14 +5356,14 @@ var init_tmux_routing = __esm({
     init_intercom_queue();
     init_plan_limits();
     init_employees();
-    SPAWN_LOCK_DIR = path15.join(os8.homedir(), ".exe-os", "spawn-locks");
-    SESSION_CACHE = path15.join(os8.homedir(), ".exe-os", "session-cache");
+    SPAWN_LOCK_DIR = path15.join(os9.homedir(), ".exe-os", "spawn-locks");
+    SESSION_CACHE = path15.join(os9.homedir(), ".exe-os", "session-cache");
     BEHAVIORS_EXPORT_TIMEOUT_MS = 1e4;
     VALID_SESSION_NAME = /^[a-z]+\d*-[a-zA-Z0-9_]+$/;
     VERIFY_PANE_LINES = 200;
     INTERCOM_DEBOUNCE_MS = 3e4;
     CODEX_DEBOUNCE_MS = 12e4;
-    INTERCOM_LOG2 = path15.join(os8.homedir(), ".exe-os", "intercom.log");
+    INTERCOM_LOG2 = path15.join(os9.homedir(), ".exe-os", "intercom.log");
     DEBOUNCE_FILE = path15.join(SESSION_CACHE, "intercom-debounce.json");
     DEBOUNCE_CLEANUP_AGE_MS = 5 * 60 * 1e3;
     BUSY_PATTERN = /[✻✽✶✳·].*…|Running…|• Working|• Ran |• Explored|• Called|esc to interrupt/;
@@ -5280,6 +5375,7 @@ var shard_manager_exports = {};
 __export(shard_manager_exports, {
   disposeShards: () => disposeShards,
   ensureShardSchema: () => ensureShardSchema,
+  getOpenShardCount: () => getOpenShardCount,
   getReadyShardClient: () => getReadyShardClient,
   getShardClient: () => getShardClient,
   getShardsDir: () => getShardsDir,
@@ -5289,14 +5385,17 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path17 from "path";
-import { existsSync as existsSync13, mkdirSync as mkdirSync7, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, readdirSync as readdirSync4 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
-  if (!existsSync13(SHARDS_DIR)) {
+  if (!existsSync14(SHARDS_DIR)) {
     mkdirSync7(SHARDS_DIR, { recursive: true });
   }
   _shardingEnabled = true;
+  if (_evictionTimer) clearInterval(_evictionTimer);
+  _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
+  _evictionTimer.unref();
 }
 function isShardingEnabled() {
   return _shardingEnabled;
@@ -5313,21 +5412,28 @@ function getShardClient(projectName) {
     throw new Error(`Invalid project name for shard: "${projectName}"`);
   }
   const cached = _shards.get(safeName);
-  if (cached) return cached;
+  if (cached) {
+    _shardLastAccess.set(safeName, Date.now());
+    return cached;
+  }
+  while (_shards.size >= MAX_OPEN_SHARDS) {
+    evictLRU();
+  }
   const dbPath = path17.join(SHARDS_DIR, `${safeName}.db`);
   const client = createClient2({
     url: `file:${dbPath}`,
     encryptionKey: _encryptionKey
   });
   _shards.set(safeName, client);
+  _shardLastAccess.set(safeName, Date.now());
   return client;
 }
 function shardExists(projectName) {
   const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return existsSync13(path17.join(SHARDS_DIR, `${safeName}.db`));
+  return existsSync14(path17.join(SHARDS_DIR, `${safeName}.db`));
 }
 function listShards() {
-  if (!existsSync13(SHARDS_DIR)) return [];
+  if (!existsSync14(SHARDS_DIR)) return [];
   return readdirSync4(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
@@ -5379,6 +5485,8 @@ async function ensureShardSchema(client) {
   for (const col of [
     "ALTER TABLE memories ADD COLUMN task_id TEXT",
     "ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN author_device_id TEXT",
+    "ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'",
     "ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5",
     "ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'",
     "ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0",
@@ -5516,21 +5624,69 @@ async function getReadyShardClient(projectName) {
   await ensureShardSchema(client);
   return client;
 }
+function evictLRU() {
+  let oldest = null;
+  let oldestTime = Infinity;
+  for (const [name, time] of _shardLastAccess) {
+    if (time < oldestTime) {
+      oldestTime = time;
+      oldest = name;
+    }
+  }
+  if (oldest) {
+    const client = _shards.get(oldest);
+    if (client) {
+      client.close();
+    }
+    _shards.delete(oldest);
+    _shardLastAccess.delete(oldest);
+  }
+}
+function evictIdleShards() {
+  const now = Date.now();
+  const toEvict = [];
+  for (const [name, lastAccess] of _shardLastAccess) {
+    if (now - lastAccess > SHARD_IDLE_MS) {
+      toEvict.push(name);
+    }
+  }
+  for (const name of toEvict) {
+    const client = _shards.get(name);
+    if (client) {
+      client.close();
+    }
+    _shards.delete(name);
+    _shardLastAccess.delete(name);
+  }
+}
+function getOpenShardCount() {
+  return _shards.size;
+}
 function disposeShards() {
+  if (_evictionTimer) {
+    clearInterval(_evictionTimer);
+    _evictionTimer = null;
+  }
   for (const [, client] of _shards) {
     client.close();
   }
   _shards.clear();
+  _shardLastAccess.clear();
   _shardingEnabled = false;
   _encryptionKey = null;
 }
-var SHARDS_DIR, _shards, _encryptionKey, _shardingEnabled;
+var SHARDS_DIR, SHARD_IDLE_MS, MAX_OPEN_SHARDS, EVICTION_INTERVAL_MS, _shards, _shardLastAccess, _evictionTimer, _encryptionKey, _shardingEnabled;
 var init_shard_manager = __esm({
   "src/lib/shard-manager.ts"() {
     "use strict";
     init_config();
     SHARDS_DIR = path17.join(EXE_AI_DIR, "shards");
+    SHARD_IDLE_MS = 5 * 60 * 1e3;
+    MAX_OPEN_SHARDS = 10;
+    EVICTION_INTERVAL_MS = 60 * 1e3;
     _shards = /* @__PURE__ */ new Map();
+    _shardLastAccess = /* @__PURE__ */ new Map();
+    _evictionTimer = null;
     _encryptionKey = null;
     _shardingEnabled = false;
   }
@@ -5733,13 +5889,13 @@ init_database();
 
 // src/lib/keychain.ts
 import { readFile as readFile4, writeFile as writeFile5, unlink, mkdir as mkdir4, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync13 } from "fs";
 import path16 from "path";
-import os9 from "os";
+import os10 from "os";
 var SERVICE = "exe-mem";
 var ACCOUNT = "master-key";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path16.join(os9.homedir(), ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path16.join(os10.homedir(), ".exe-os");
 }
 function getKeyPath() {
   return path16.join(getKeyDir(), "master.key");
@@ -5763,9 +5919,9 @@ async function getMasterKey() {
     }
   }
   const keyPath = getKeyPath();
-  if (!existsSync12(keyPath)) {
+  if (!existsSync13(keyPath)) {
     process.stderr.write(
-      `[keychain] Key not found at ${keyPath} (HOME=${os9.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
+      `[keychain] Key not found at ${keyPath} (HOME=${os10.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
 `
     );
     return null;