@askexenow/exe-os 0.9.8 → 0.9.9

package/dist/bin/exe-new-employee.js

@@ -15,9 +15,34 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/lib/secure-files.ts
+import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+import { chmod, mkdir } from "fs/promises";
+function ensurePrivateDirSync(dirPath) {
+  mkdirSync2(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    chmodSync2(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+function enforcePrivateFileSync(filePath) {
+  try {
+    if (existsSync2(filePath)) chmodSync2(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+var PRIVATE_DIR_MODE, PRIVATE_FILE_MODE;
+var init_secure_files = __esm({
+  "src/lib/secure-files.ts"() {
+    "use strict";
+    PRIVATE_DIR_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+  }
+});
+
 // src/lib/config.ts
-import { readFile, writeFile, mkdir, chmod } from "fs/promises";
-import { readFileSync as readFileSync2, existsSync as existsSync2, renameSync } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { readFileSync as readFileSync2, existsSync as existsSync3, renameSync } from "fs";
 import path2 from "path";
 import os from "os";
 function resolveDataDir() {
@@ -25,7 +50,7 @@ function resolveDataDir() {
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
   const newDir = path2.join(os.homedir(), ".exe-os");
   const legacyDir = path2.join(os.homedir(), ".exe-mem");
-  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
+  if (!existsSync3(newDir) && existsSync3(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
       process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
@@ -40,6 +65,7 @@ var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CON
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
+    init_secure_files();
     EXE_AI_DIR = resolveDataDir();
     DB_PATH = path2.join(EXE_AI_DIR, "memories.db");
     MODELS_DIR = path2.join(EXE_AI_DIR, "models");
@@ -146,10 +172,10 @@ __export(agent_config_exports, {
   saveAgentConfig: () => saveAgentConfig,
   setAgentRuntime: () => setAgentRuntime
 });
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync4 } from "fs";
 import path3 from "path";
 function loadAgentConfig() {
-  if (!existsSync3(AGENT_CONFIG_PATH)) return {};
+  if (!existsSync4(AGENT_CONFIG_PATH)) return {};
   try {
     return JSON.parse(readFileSync3(AGENT_CONFIG_PATH, "utf-8"));
   } catch {
@@ -158,8 +184,9 @@ function loadAgentConfig() {
 }
 function saveAgentConfig(config) {
   const dir = path3.dirname(AGENT_CONFIG_PATH);
-  if (!existsSync3(dir)) mkdirSync2(dir, { recursive: true });
+  ensurePrivateDirSync(dir);
   writeFileSync2(AGENT_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  enforcePrivateFileSync(AGENT_CONFIG_PATH);
 }
 function getAgentRuntime(agentId) {
   const config = loadAgentConfig();
@@ -199,6 +226,7 @@ var init_agent_config = __esm({
     "use strict";
     init_config();
     init_runtime_table();
+    init_secure_files();
     AGENT_CONFIG_PATH = path3.join(EXE_AI_DIR, "agent-config.json");
     KNOWN_RUNTIMES = {
       claude: ["claude-opus-4", "claude-sonnet-4", "claude-haiku-4.5"],
@@ -220,7 +248,7 @@ var init_agent_config = __esm({
 
 // src/lib/employees.ts
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { existsSync as existsSync4, symlinkSync, readlinkSync, readFileSync as readFileSync4, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync5, symlinkSync, readlinkSync, readFileSync as readFileSync4, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
 import { execSync } from "child_process";
 import path4 from "path";
 import os2 from "os";
@@ -249,7 +277,7 @@ function validateEmployeeName(name) {
   return { valid: true };
 }
 async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync4(employeesPath)) {
+  if (!existsSync5(employeesPath)) {
     return [];
   }
   const raw = await readFile2(employeesPath, "utf-8");
@@ -264,7 +292,7 @@ async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
   await writeFile2(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
 }
 function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync4(employeesPath)) return [];
+  if (!existsSync5(employeesPath)) return [];
   try {
     return JSON.parse(readFileSync4(employeesPath, "utf-8"));
   } catch {
@@ -282,7 +310,7 @@ function appendToCoordinatorTeam(employee) {
   const coordinator = getCoordinatorEmployee(loadEmployeesSync());
   if (!coordinator) return;
   const idPath = path4.join(IDENTITY_DIR, `${coordinator.name}.md`);
-  if (!existsSync4(idPath)) return;
+  if (!existsSync5(idPath)) return;
   const content = readFileSync4(idPath, "utf-8");
   if (content.includes(`**${capitalize(employee.name)}`)) return;
   const teamMatch = content.match(TEAM_SECTION_RE);
@@ -351,7 +379,7 @@ function registerBinSymlinks(name) {
   for (const suffix of ["", "-opencode"]) {
     const linkName = `${name}${suffix}`;
     const linkPath = path4.join(binDir, linkName);
-    if (existsSync4(linkPath)) {
+    if (existsSync5(linkPath)) {
       skipped.push(linkName);
       continue;
     }
@@ -984,12 +1012,12 @@ __export(identity_exports, {
   listIdentities: () => listIdentities,
   updateIdentity: () => updateIdentity
 });
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
 import { readdirSync as readdirSync2 } from "fs";
 import path8 from "path";
 import { createHash } from "crypto";
 function ensureDir() {
-  if (!existsSync7(IDENTITY_DIR2)) {
+  if (!existsSync8(IDENTITY_DIR2)) {
     mkdirSync4(IDENTITY_DIR2, { recursive: true });
   }
 }
@@ -1035,7 +1063,7 @@ function contentHash(content) {
 }
 function getIdentity(agentId) {
   const filePath = identityPath(agentId);
-  if (!existsSync7(filePath)) return null;
+  if (!existsSync8(filePath)) return null;
   const raw = readFileSync7(filePath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(raw);
   return {
@@ -1111,10 +1139,10 @@ var init_identity = __esm({
 });
 
 // src/lib/agent-symlinks.ts
-import os4 from "os";
+import os5 from "os";
 import path9 from "path";
 import {
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   lstatSync,
   mkdirSync as mkdirSync5,
   readlinkSync as readlinkSync2,
@@ -1129,11 +1157,11 @@ function identitySourcePath(homeDir, agentId) {
 function claudeAgentLinkPath(homeDir, agentId) {
   return path9.join(claudeAgentsDir(homeDir), `${agentId}.md`);
 }
-function ensureAgentSymlink(agentId, homeDir = os4.homedir()) {
+function ensureAgentSymlink(agentId, homeDir = os5.homedir()) {
   const target = identitySourcePath(homeDir, agentId);
   const link = claudeAgentLinkPath(homeDir, agentId);
   mkdirSync5(claudeAgentsDir(homeDir), { recursive: true });
-  if (existsSync8(link)) {
+  if (existsSync9(link)) {
     let stat;
     try {
       stat = lstatSync(link);
@@ -1167,7 +1195,7 @@ function ensureAgentSymlink(agentId, homeDir = os4.homedir()) {
   }
   return { agentId, action: "created", target, link };
 }
-async function ensureAllAgentSymlinks(homeDir = os4.homedir()) {
+async function ensureAllAgentSymlinks(homeDir = os5.homedir()) {
   const employees = await loadEmployees();
   return employees.map((emp) => ensureAgentSymlink(emp.name, homeDir));
 }
@@ -1202,12 +1230,12 @@ var init_mcp_prefix = __esm({
 });
 
 // src/lib/preferences.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
 import path10 from "path";
-import os5 from "os";
-function loadPreferences(homeDir = os5.homedir()) {
+import os6 from "os";
+function loadPreferences(homeDir = os6.homedir()) {
   const configPath = path10.join(homeDir, ".exe-os", "config.json");
-  if (!existsSync9(configPath)) return {};
+  if (!existsSync10(configPath)) return {};
   try {
     const config = JSON.parse(readFileSync8(configPath, "utf-8"));
     return config.preferences ?? {};
@@ -1218,6 +1246,7 @@ function loadPreferences(homeDir = os5.homedir()) {
 var init_preferences = __esm({
   "src/lib/preferences.ts"() {
     "use strict";
+    init_secure_files();
   }
 });
 
@@ -1235,9 +1264,9 @@ __export(installer_exports, {
   setupTmux: () => setupTmux
 });
 import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3, readdir } from "fs/promises";
-import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync7, copyFileSync, mkdirSync as mkdirSync7 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync7, copyFileSync, mkdirSync as mkdirSync6 } from "fs";
 import path11 from "path";
-import os6 from "os";
+import os7 from "os";
 import { execSync as execSync2 } from "child_process";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolvePackageRoot() {
@@ -1246,7 +1275,7 @@ function resolvePackageRoot() {
   const root = path11.parse(dir).root;
   while (dir !== root) {
     const pkgPath = path11.join(dir, "package.json");
-    if (existsSync10(pkgPath)) {
+    if (existsSync11(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
@@ -1257,12 +1286,12 @@ function resolvePackageRoot() {
   }
   return path11.resolve(path11.dirname(thisFile), "..", "..", "..");
 }
-async function copySlashCommands(packageRoot, homeDir = os6.homedir()) {
+async function copySlashCommands(packageRoot, homeDir = os7.homedir()) {
   let copied = 0;
   let skipped = 0;
   const skillsBase = path11.join(homeDir, ".claude", "skills");
   const exeDir = path11.join(packageRoot, "src", "commands", "exe");
-  if (existsSync10(exeDir)) {
+  if (existsSync11(exeDir)) {
     const entries = await readdir(exeDir);
     const mdFiles = entries.filter((f) => f.endsWith(".md"));
     for (const file of mdFiles) {
@@ -1277,7 +1306,7 @@ async function copySlashCommands(packageRoot, homeDir = os6.homedir()) {
     }
   }
   const topLevelSrc = path11.join(packageRoot, "src", "commands", "exe.md");
-  if (existsSync10(topLevelSrc)) {
+  if (existsSync11(topLevelSrc)) {
     const destDir = path11.join(skillsBase, "exe");
     await mkdir3(destDir, { recursive: true });
     const destPath = path11.join(destDir, "SKILL.md");
@@ -1303,17 +1332,17 @@ name: ${skillName}
 `);
     }
   }
-  if (existsSync10(destPath)) {
+  if (existsSync11(destPath)) {
     const existing = await readFile3(destPath, "utf-8");
     if (existing === content) return false;
   }
   await writeFile3(destPath, content);
   return true;
 }
-async function registerMcpServer(packageRoot, homeDir = os6.homedir()) {
+async function registerMcpServer(packageRoot, homeDir = os7.homedir()) {
   const claudeJsonPath = path11.join(homeDir, ".claude.json");
   let claudeJson = {};
-  if (existsSync10(claudeJsonPath)) {
+  if (existsSync11(claudeJsonPath)) {
     try {
       claudeJson = JSON.parse(await readFile3(claudeJsonPath, "utf-8"));
     } catch {
@@ -1330,21 +1359,21 @@ async function registerMcpServer(packageRoot, homeDir = os6.homedir()) {
     env: {}
   };
   const currentMem = claudeJson.mcpServers[MCP_LEGACY_KEY];
-  const currentOs = claudeJson.mcpServers[MCP_PRIMARY_KEY];
   const memMatches = currentMem && JSON.stringify(currentMem) === JSON.stringify(newEntry);
-  const osMatches = currentOs && JSON.stringify(currentOs) === JSON.stringify(newEntry);
-  if (memMatches && osMatches) {
+  if (claudeJson.mcpServers[MCP_PRIMARY_KEY]) {
+    delete claudeJson.mcpServers[MCP_PRIMARY_KEY];
+  }
+  if (memMatches && !claudeJson.mcpServers[MCP_PRIMARY_KEY]) {
     await cleanSettingsJsonMcp(path11.join(homeDir, ".claude", "settings.json"));
     return false;
   }
   claudeJson.mcpServers[MCP_LEGACY_KEY] = newEntry;
-  claudeJson.mcpServers[MCP_PRIMARY_KEY] = newEntry;
   await writeFile3(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
   await cleanSettingsJsonMcp(path11.join(homeDir, ".claude", "settings.json"));
   return true;
 }
 async function cleanSettingsJsonMcp(settingsPath) {
-  if (!existsSync10(settingsPath)) return;
+  if (!existsSync11(settingsPath)) return;
   try {
     const settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     const servers = settings.mcpServers;
@@ -1364,14 +1393,14 @@ async function cleanSettingsJsonMcp(settingsPath) {
   } catch {
   }
 }
-async function mergeHooks(packageRoot, homeDir = os6.homedir()) {
+async function mergeHooks(packageRoot, homeDir = os7.homedir()) {
   const settingsPath = path11.join(homeDir, ".claude", "settings.json");
   const logsDir = path11.join(homeDir, ".exe-os", "logs");
   const hookLogPath = path11.join(logsDir, "hooks.log");
   const logSuffix = ` 2>> "${hookLogPath}"`;
   await mkdir3(logsDir, { recursive: true });
   let settings = {};
-  if (existsSync10(settingsPath)) {
+  if (existsSync11(settingsPath)) {
     try {
       settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     } catch {
@@ -1637,9 +1666,9 @@ async function mergeHooks(packageRoot, homeDir = os6.homedir()) {
   await writeFile3(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   return { added, skipped };
 }
-async function cleanOldShellFunctions(homeDir = os6.homedir()) {
+async function cleanOldShellFunctions(homeDir = os7.homedir()) {
   const rosterPath = path11.join(homeDir, ".exe-os", "exe-employees.json");
-  if (!existsSync10(rosterPath)) return 0;
+  if (!existsSync11(rosterPath)) return 0;
   let employees;
   try {
     employees = JSON.parse(await readFile3(rosterPath, "utf-8"));
@@ -1660,7 +1689,7 @@ async function cleanOldShellFunctions(homeDir = os6.homedir()) {
   const REMOVED_MARKER = "# Removed by exe-os \u2014 wrappers now at ~/.exe-os/bin/";
   let totalRemoved = 0;
   for (const rcPath of rcFiles) {
-    if (!existsSync10(rcPath)) continue;
+    if (!existsSync11(rcPath)) continue;
     let content;
     try {
       content = await readFile3(rcPath, "utf-8");
@@ -1787,19 +1816,19 @@ async function injectOrchestrationRules(homeDir) {
   await writeFile3(claudeMdPath, existing + separator + ORCHESTRATION_RULES + "\n", "utf-8");
   return "injected";
 }
-async function installStatusLine(packageRoot, homeDir = os6.homedir()) {
+async function installStatusLine(packageRoot, homeDir = os7.homedir()) {
   const prefs = loadPreferences(homeDir);
   if (prefs.ccStatusLine === false) return "opted-out";
   const claudeDir = path11.join(homeDir, ".claude");
   await mkdir3(claudeDir, { recursive: true });
   const assetPath = path11.join(packageRoot, "dist", "assets", "statusline-command.sh");
-  if (!existsSync10(assetPath)) return "asset-missing";
+  if (!existsSync11(assetPath)) return "asset-missing";
   const destScript = path11.join(claudeDir, "statusline-command.sh");
   const assetContent = await readFile3(assetPath, "utf-8");
   await writeFile3(destScript, assetContent, { mode: 493 });
   const settingsPath = path11.join(claudeDir, "settings.json");
   let settings = {};
-  if (existsSync10(settingsPath)) {
+  if (existsSync11(settingsPath)) {
     try {
       settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     } catch {
@@ -1836,9 +1865,9 @@ async function runInstaller(homeDir) {
     `Hooks: ${hookResult.added} added, ${hookResult.skipped} unchanged
 `
   );
-  const resolvedHome = homeDir ?? os6.homedir();
+  const resolvedHome = homeDir ?? os7.homedir();
   const exeWorkspace = path11.join(resolvedHome, "exe");
-  if (!existsSync10(exeWorkspace)) {
+  if (!existsSync11(exeWorkspace)) {
     try {
       await mkdir3(path11.join(exeWorkspace, "content"), { recursive: true });
       await mkdir3(path11.join(exeWorkspace, "operations"), { recursive: true });
@@ -1877,7 +1906,7 @@ exe-os installed successfully.
 `);
 }
 function setupTmux(home) {
-  const homeDir = home ?? os6.homedir();
+  const homeDir = home ?? os7.homedir();
   const exeDir = path11.join(homeDir, ".exe-os");
   const exeTmuxConf = path11.join(exeDir, "tmux.conf");
   const userTmuxConf = path11.join(homeDir, ".tmux.conf");
@@ -1885,17 +1914,17 @@ function setupTmux(home) {
   const sourceLine = "source-file ~/.exe-os/tmux.conf";
   const pkgRoot = resolvePackageRoot();
   const assetPath = path11.join(pkgRoot, "dist", "assets", "tmux.conf");
-  if (!existsSync10(assetPath)) {
+  if (!existsSync11(assetPath)) {
     process.stderr.write(`exe-os: tmux.conf asset not found at ${assetPath} \u2014 skipping tmux setup
 `);
     return;
   }
-  mkdirSync7(exeDir, { recursive: true });
+  mkdirSync6(exeDir, { recursive: true });
   copyFileSync(assetPath, exeTmuxConf);
-  if (existsSync10(userTmuxConf)) {
+  if (existsSync11(userTmuxConf)) {
     const existing = readFileSync9(userTmuxConf, "utf8");
     if (!existing.includes(sourceLine)) {
-      if (!existsSync10(backupPath)) {
+      if (!existsSync11(backupPath)) {
         copyFileSync(userTmuxConf, backupPath);
         process.stderr.write(`exe-os: backed up existing tmux config to ${backupPath}
 `);
@@ -1915,10 +1944,10 @@ ${sourceLine}
   process.stderr.write("exe-os: tmux config installed\n");
 }
 function setupGhostty(home) {
-  const homeDir = home ?? os6.homedir();
+  const homeDir = home ?? os7.homedir();
   const xdgConfig = path11.join(homeDir, ".config", "ghostty");
   const macConfig = path11.join(homeDir, "Library", "Application Support", "com.mitchellh.ghostty");
-  const ghosttyInstalled = existsSync10(xdgConfig) || existsSync10(macConfig) || (() => {
+  const ghosttyInstalled = existsSync11(xdgConfig) || existsSync11(macConfig) || (() => {
     try {
       execSync2("which ghostty 2>/dev/null");
       return true;
@@ -1931,28 +1960,28 @@ function setupGhostty(home) {
   }
   const pkgRoot = resolvePackageRoot();
   const assetPath = path11.join(pkgRoot, "dist", "assets", "ghostty.conf");
-  if (!existsSync10(assetPath)) {
+  if (!existsSync11(assetPath)) {
     process.stderr.write("exe-os: ghostty.conf asset not found \u2014 skipping Ghostty setup\n");
     return;
   }
   const configDir = xdgConfig;
   const configPath = path11.join(configDir, "config");
   const backupPath = path11.join(configDir, "config.backup");
-  mkdirSync7(configDir, { recursive: true });
+  mkdirSync6(configDir, { recursive: true });
   const START_MARKER = "# \u2500\u2500 exe-os:ghostty-start \u2500\u2500";
   const END_MARKER = "# \u2500\u2500 exe-os:ghostty-end \u2500\u2500";
   const assetContent = readFileSync9(assetPath, "utf8").trim();
   const markedSection = `${START_MARKER}
 ${assetContent}
 ${END_MARKER}`;
-  if (existsSync10(configPath)) {
+  if (existsSync11(configPath)) {
     const existing = readFileSync9(configPath, "utf8");
     if (existing.includes(START_MARKER) && existing.includes(END_MARKER)) {
       const before = existing.slice(0, existing.indexOf(START_MARKER));
       const after = existing.slice(existing.indexOf(END_MARKER) + END_MARKER.length);
       writeFileSync7(configPath, `${before}${markedSection}${after}`);
     } else if (existing.includes("Exe OS")) {
-      if (!existsSync10(backupPath)) {
+      if (!existsSync11(backupPath)) {
         copyFileSync(configPath, backupPath);
         process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
 `);
@@ -1960,7 +1989,7 @@ ${END_MARKER}`;
       writeFileSync7(configPath, `${markedSection}
 `);
     } else {
-      if (!existsSync10(backupPath)) {
+      if (!existsSync11(backupPath)) {
         copyFileSync(configPath, backupPath);
         process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
 `);
@@ -2011,7 +2040,7 @@ ${EXE_SECTION_END}`;
 });
 
 // src/bin/exe-new-employee.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7 } from "fs";
 import path12 from "path";
 
 // src/lib/session-wrappers.ts
@@ -2604,13 +2633,16 @@ function isMainModule(importMetaUrl) {
 // src/lib/plan-limits.ts
 init_database();
 init_employees();
-import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
 import path7 from "path";
 
 // src/lib/license.ts
 init_config();
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5, mkdirSync as mkdirSync3 } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync6, mkdirSync as mkdirSync3 } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
+import { createRequire as createRequire2 } from "module";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import os4 from "os";
 import path6 from "path";
 import { jwtVerify, importSPKI } from "jose";
 var LICENSE_PATH = path6.join(EXE_AI_DIR, "license.key");
@@ -2650,14 +2682,14 @@ var FREE_LICENSE = {
 function loadDeviceId() {
   const deviceJsonPath = path6.join(EXE_AI_DIR, "device.json");
   try {
-    if (existsSync5(deviceJsonPath)) {
+    if (existsSync6(deviceJsonPath)) {
       const data = JSON.parse(readFileSync5(deviceJsonPath, "utf8"));
       if (data.deviceId) return data.deviceId;
     }
   } catch {
   }
   try {
-    if (existsSync5(DEVICE_ID_PATH)) {
+    if (existsSync6(DEVICE_ID_PATH)) {
       const id2 = readFileSync5(DEVICE_ID_PATH, "utf8").trim();
       if (id2) return id2;
     }
@@ -2670,7 +2702,7 @@ function loadDeviceId() {
 }
 function loadLicense() {
   try {
-    if (!existsSync5(LICENSE_PATH)) return null;
+    if (!existsSync6(LICENSE_PATH)) return null;
     return readFileSync5(LICENSE_PATH, "utf8").trim();
   } catch {
     return null;
@@ -2704,7 +2736,7 @@ async function verifyLicenseJwt(token) {
 }
 async function getCachedLicense() {
   try {
-    if (!existsSync5(CACHE_PATH)) return null;
+    if (!existsSync6(CACHE_PATH)) return null;
     const raw = JSON.parse(readFileSync5(CACHE_PATH, "utf8"));
     if (!raw.token || typeof raw.token !== "string") return null;
     return await verifyLicenseJwt(raw.token);
@@ -2714,7 +2746,7 @@ async function getCachedLicense() {
 }
 function readCachedToken() {
   try {
-    if (!existsSync5(CACHE_PATH)) return null;
+    if (!existsSync6(CACHE_PATH)) return null;
     const raw = JSON.parse(readFileSync5(CACHE_PATH, "utf8"));
     return typeof raw.token === "string" ? raw.token : null;
   } catch {
@@ -2753,52 +2785,128 @@ function cacheResponse(token) {
   } catch {
   }
 }
-async function validateLicense(apiKey, deviceId) {
-  const did = deviceId ?? loadDeviceId();
+var _prismaPromise = null;
+var _prismaFailed = false;
+function loadPrismaForLicense() {
+  if (_prismaFailed) return null;
+  const dbUrl = process.env.DATABASE_URL;
+  if (!dbUrl) {
+    const exeDbRoot = process.env.EXE_DB_ROOT ?? path6.join(os4.homedir(), "exe-db");
+    if (!existsSync6(path6.join(exeDbRoot, "package.json"))) {
+      _prismaFailed = true;
+      return null;
+    }
+  }
+  if (!_prismaPromise) {
+    _prismaPromise = (async () => {
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL2(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path6.join(os4.homedir(), "exe-db");
+      const req = createRequire2(path6.join(exeDbRoot, "package.json"));
+      const entry = req.resolve("@prisma/client");
+      const mod = await import(pathToFileURL2(entry).href);
+      const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+      if (!Ctor) throw new Error(`No PrismaClient in ${entry}`);
+      return new Ctor();
+    })().catch((err) => {
+      _prismaFailed = true;
+      _prismaPromise = null;
+      throw err;
+    });
+  }
+  return _prismaPromise;
+}
+async function validateViaPostgres(apiKey) {
+  const loader = loadPrismaForLicense();
+  if (!loader) return null;
+  try {
+    const prisma = await loader;
+    const rows = await prisma.$queryRawUnsafe(
+      `SELECT plan, email, status, device_limit, employee_limit, memory_limit, expires_at
+       FROM billing.licenses WHERE key = $1 LIMIT 1`,
+      apiKey
+    );
+    if (!rows || rows.length === 0) return null;
+    const row = rows[0];
+    if (row.status !== "active") return null;
+    if (row.expires_at && new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
+    const plan = row.plan;
+    const limits = PLAN_LIMITS[plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: true,
+      plan,
+      email: row.email,
+      expiresAt: row.expires_at ? new Date(row.expires_at).toISOString() : null,
+      deviceLimit: row.device_limit ?? limits.devices,
+      employeeLimit: row.employee_limit ?? limits.employees,
+      memoryLimit: row.memory_limit ?? limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+async function validateViaCFWorker(apiKey, deviceId) {
   try {
     const res = await fetchRetry(`${API_BASE}/auth/activate`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ apiKey, deviceId: did }),
+      body: JSON.stringify({ apiKey, deviceId }),
       signal: AbortSignal.timeout(1e4)
     });
-    if (res.ok) {
-      const data = await res.json();
-      if (data.error === "device_limit_exceeded") {
-        const cached2 = await getCachedLicense();
-        if (cached2) return cached2;
-        const raw2 = getRawCachedPlan();
-        if (raw2) return { ...raw2, valid: false };
-        return { ...FREE_LICENSE, valid: false, plan: "free" };
-      }
-      if (data.token) {
-        cacheResponse(data.token);
-        const verified = await verifyLicenseJwt(data.token);
-        if (verified) return verified;
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (data.error === "device_limit_exceeded") return null;
+    if (!data.valid) return null;
+    if (data.token) {
+      cacheResponse(data.token);
+      const verified = await verifyLicenseJwt(data.token);
+      if (verified) return verified;
+    }
+    const limits = PLAN_LIMITS[data.plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: data.valid,
+      plan: data.plan,
+      email: data.email,
+      expiresAt: data.expiresAt,
+      deviceLimit: limits.devices,
+      employeeLimit: limits.employees,
+      memoryLimit: limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+async function validateLicense(apiKey, deviceId) {
+  const did = deviceId ?? loadDeviceId();
+  const pgResult = await validateViaPostgres(apiKey);
+  if (pgResult) {
+    try {
+      writeFileSync4(CACHE_PATH, JSON.stringify({ pgLicense: pgResult, ts: Date.now() }), "utf8");
+    } catch {
+    }
+    return pgResult;
+  }
+  const cfResult = await validateViaCFWorker(apiKey, did);
+  if (cfResult) return cfResult;
+  const cached = await getCachedLicense();
+  if (cached) return cached;
+  try {
+    if (existsSync6(CACHE_PATH)) {
+      const raw = JSON.parse(readFileSync5(CACHE_PATH, "utf8"));
+      if (raw.pgLicense && raw.ts && Date.now() - raw.ts < 7 * 24 * 60 * 60 * 1e3) {
+        return raw.pgLicense;
       }
-      const limits = PLAN_LIMITS[data.plan] ?? PLAN_LIMITS.free;
-      return {
-        valid: data.valid,
-        plan: data.plan,
-        email: data.email,
-        expiresAt: data.expiresAt,
-        deviceLimit: limits.devices,
-        employeeLimit: limits.employees,
-        memoryLimit: limits.memories
-      };
     }
-    const cached = await getCachedLicense();
-    if (cached) return cached;
-    const raw = getRawCachedPlan();
-    if (raw) return raw;
-    return { ...FREE_LICENSE, valid: false, plan: "free" };
   } catch {
-    const cached = await getCachedLicense();
-    if (cached) return cached;
-    const rawFallback = getRawCachedPlan();
-    if (rawFallback) return rawFallback;
-    return { ...FREE_LICENSE, valid: false, error: "offline" };
   }
+  const rawFallback = getRawCachedPlan();
+  if (rawFallback) return rawFallback;
+  return { ...FREE_LICENSE, valid: false };
 }
 var CACHE_MAX_AGE_MS = 36e5;
 function getCacheAgeMs() {
@@ -2815,7 +2923,7 @@ async function checkLicense() {
   if (!key) {
     try {
       const configPath = path6.join(EXE_AI_DIR, "config.json");
-      if (existsSync5(configPath)) {
+      if (existsSync6(configPath)) {
         const raw = JSON.parse(readFileSync5(configPath, "utf8"));
         const cloud = raw.cloud;
         if (cloud?.apiKey) {
@@ -2943,8 +3051,8 @@ async function main() {
   } catch {
   }
   const taskDir = path12.join(process.cwd(), "exe", name);
-  if (!existsSync11(taskDir)) {
-    mkdirSync8(taskDir, { recursive: true });
+  if (!existsSync12(taskDir)) {
+    mkdirSync7(taskDir, { recursive: true });
   }
   const bins = registerBinSymlinks(newEmployee.name);
   if (bins.created.length > 0) {