@askexenow/exe-os 0.9.8 → 0.9.9

package/dist/hooks/session-start.js

@@ -19,6 +19,44 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/lib/secure-files.ts
+import { chmodSync, existsSync, mkdirSync } from "fs";
+import { chmod, mkdir } from "fs/promises";
+async function ensurePrivateDir(dirPath) {
+  await mkdir(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    await chmod(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+function ensurePrivateDirSync(dirPath) {
+  mkdirSync(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    chmodSync(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+async function enforcePrivateFile(filePath) {
+  try {
+    await chmod(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+function enforcePrivateFileSync(filePath) {
+  try {
+    if (existsSync(filePath)) chmodSync(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+var PRIVATE_DIR_MODE, PRIVATE_FILE_MODE;
+var init_secure_files = __esm({
+  "src/lib/secure-files.ts"() {
+    "use strict";
+    PRIVATE_DIR_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+  }
+});
+
 // src/lib/config.ts
 var config_exports = {};
 __export(config_exports, {
@@ -35,8 +73,8 @@ __export(config_exports, {
   migrateConfig: () => migrateConfig,
   saveConfig: () => saveConfig
 });
-import { readFile, writeFile, mkdir, chmod } from "fs/promises";
-import { readFileSync, existsSync, renameSync } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
 import path from "path";
 import os from "os";
 function resolveDataDir() {
@@ -44,7 +82,7 @@ function resolveDataDir() {
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
   const newDir = path.join(os.homedir(), ".exe-os");
   const legacyDir = path.join(os.homedir(), ".exe-mem");
-  if (!existsSync(newDir) && existsSync(legacyDir)) {
+  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
       process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
@@ -107,9 +145,9 @@ function normalizeAutoUpdate(raw) {
 }
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path.join(dir, "config.json");
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
   }
   const raw = await readFile(configPath, "utf-8");
@@ -122,6 +160,7 @@ async function loadConfig() {
 `);
       try {
         await writeFile(configPath, JSON.stringify(migratedCfg, null, 2) + "\n");
+        await enforcePrivateFile(configPath);
       } catch {
       }
     }
@@ -140,7 +179,7 @@ async function loadConfig() {
 function loadConfigSync() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
   const configPath = path.join(dir, "config.json");
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
   }
   try {
@@ -158,12 +197,10 @@ function loadConfigSync() {
 }
 async function saveConfig(config) {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path.join(dir, "config.json");
   await writeFile(configPath, JSON.stringify(config, null, 2) + "\n");
-  if (config.cloud?.apiKey) {
-    await chmod(configPath, 384);
-  }
+  await enforcePrivateFile(configPath);
 }
 async function loadConfigFrom(configPath) {
   const raw = await readFile(configPath, "utf-8");
@@ -183,6 +220,7 @@ var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CON
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
+    init_secure_files();
     EXE_AI_DIR = resolveDataDir();
     DB_PATH = path.join(EXE_AI_DIR, "memories.db");
     MODELS_DIR = path.join(EXE_AI_DIR, "models");
@@ -363,10 +401,10 @@ __export(agent_config_exports, {
   saveAgentConfig: () => saveAgentConfig,
   setAgentRuntime: () => setAgentRuntime
 });
-import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, mkdirSync } from "fs";
+import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync3 } from "fs";
 import path2 from "path";
 function loadAgentConfig() {
-  if (!existsSync2(AGENT_CONFIG_PATH)) return {};
+  if (!existsSync3(AGENT_CONFIG_PATH)) return {};
   try {
     return JSON.parse(readFileSync2(AGENT_CONFIG_PATH, "utf-8"));
   } catch {
@@ -375,8 +413,9 @@ function loadAgentConfig() {
 }
 function saveAgentConfig(config) {
   const dir = path2.dirname(AGENT_CONFIG_PATH);
-  if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
+  ensurePrivateDirSync(dir);
   writeFileSync(AGENT_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  enforcePrivateFileSync(AGENT_CONFIG_PATH);
 }
 function getAgentRuntime(agentId) {
   const config = loadAgentConfig();
@@ -416,6 +455,7 @@ var init_agent_config = __esm({
     "use strict";
     init_config();
     init_runtime_table();
+    init_secure_files();
     AGENT_CONFIG_PATH = path2.join(EXE_AI_DIR, "agent-config.json");
     KNOWN_RUNTIMES = {
       claude: ["claude-opus-4", "claude-sonnet-4", "claude-haiku-4.5"],
@@ -463,7 +503,7 @@ __export(employees_exports, {
   validateEmployeeName: () => validateEmployeeName
 });
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { existsSync as existsSync3, symlinkSync, readlinkSync, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, symlinkSync, readlinkSync, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
 import { execSync } from "child_process";
 import path3 from "path";
 import os2 from "os";
@@ -502,7 +542,7 @@ function validateEmployeeName(name) {
   return { valid: true };
 }
 async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync3(employeesPath)) {
+  if (!existsSync4(employeesPath)) {
     return [];
   }
   const raw = await readFile2(employeesPath, "utf-8");
@@ -517,7 +557,7 @@ async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
   await writeFile2(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
 }
 function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync3(employeesPath)) return [];
+  if (!existsSync4(employeesPath)) return [];
   try {
     return JSON.parse(readFileSync3(employeesPath, "utf-8"));
   } catch {
@@ -565,7 +605,7 @@ function appendToCoordinatorTeam(employee) {
   const coordinator = getCoordinatorEmployee(loadEmployeesSync());
   if (!coordinator) return;
   const idPath = path3.join(IDENTITY_DIR, `${coordinator.name}.md`);
-  if (!existsSync3(idPath)) return;
+  if (!existsSync4(idPath)) return;
   const content = readFileSync3(idPath, "utf-8");
   if (content.includes(`**${capitalize(employee.name)}`)) return;
   const teamMatch = content.match(TEAM_SECTION_RE);
@@ -619,9 +659,9 @@ async function normalizeRosterCase(rosterPath) {
         const identityDir = path3.join(os2.homedir(), ".exe-os", "identity");
         const oldPath = path3.join(identityDir, `${oldName}.md`);
         const newPath = path3.join(identityDir, `${emp.name}.md`);
-        if (existsSync3(oldPath) && !existsSync3(newPath)) {
+        if (existsSync4(oldPath) && !existsSync4(newPath)) {
           renameSync2(oldPath, newPath);
-        } else if (existsSync3(oldPath) && oldPath !== newPath) {
+        } else if (existsSync4(oldPath) && oldPath !== newPath) {
           const content = readFileSync3(oldPath, "utf-8");
           writeFileSync2(newPath, content, "utf-8");
           if (oldPath.toLowerCase() !== newPath.toLowerCase()) {
@@ -664,7 +704,7 @@ function registerBinSymlinks(name) {
   for (const suffix of ["", "-opencode"]) {
     const linkName = `${name}${suffix}`;
     const linkPath = path3.join(binDir, linkName);
-    if (existsSync3(linkPath)) {
+    if (existsSync4(linkPath)) {
       skipped.push(linkName);
       continue;
     }
@@ -1275,13 +1315,50 @@ var init_database_adapter = __esm({
   }
 });
 
+// src/lib/daemon-auth.ts
+import crypto from "crypto";
+import path5 from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+function normalizeToken(token) {
+  if (!token) return null;
+  const trimmed = token.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function readDaemonToken() {
+  try {
+    if (!existsSync5(DAEMON_TOKEN_PATH)) return null;
+    return normalizeToken(readFileSync4(DAEMON_TOKEN_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function ensureDaemonToken(seed) {
+  const existing = readDaemonToken();
+  if (existing) return existing;
+  const token = normalizeToken(seed) ?? crypto.randomBytes(32).toString("hex");
+  ensurePrivateDirSync(EXE_AI_DIR);
+  writeFileSync3(DAEMON_TOKEN_PATH, `${token}
+`, "utf8");
+  enforcePrivateFileSync(DAEMON_TOKEN_PATH);
+  return token;
+}
+var DAEMON_TOKEN_PATH;
+var init_daemon_auth = __esm({
+  "src/lib/daemon-auth.ts"() {
+    "use strict";
+    init_config();
+    init_secure_files();
+    DAEMON_TOKEN_PATH = path5.join(EXE_AI_DIR, "exed.token");
+  }
+});
+
 // src/lib/exe-daemon-client.ts
 import net from "net";
 import os4 from "os";
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync4, unlinkSync as unlinkSync2, readFileSync as readFileSync4, openSync, closeSync, statSync } from "fs";
-import path5 from "path";
+import { existsSync as existsSync6, unlinkSync as unlinkSync2, readFileSync as readFileSync5, openSync, closeSync, statSync } from "fs";
+import path6 from "path";
 import { fileURLToPath } from "url";
 function handleData(chunk) {
   _buffer += chunk.toString();
@@ -1309,9 +1386,9 @@ function handleData(chunk) {
   }
 }
 function cleanupStaleFiles() {
-  if (existsSync4(PID_PATH)) {
+  if (existsSync6(PID_PATH)) {
     try {
-      const pid = parseInt(readFileSync4(PID_PATH, "utf8").trim(), 10);
+      const pid = parseInt(readFileSync5(PID_PATH, "utf8").trim(), 10);
       if (pid > 0) {
         try {
           process.kill(pid, 0);
@@ -1332,11 +1409,11 @@ function cleanupStaleFiles() {
   }
 }
 function findPackageRoot() {
-  let dir = path5.dirname(fileURLToPath(import.meta.url));
-  const { root } = path5.parse(dir);
+  let dir = path6.dirname(fileURLToPath(import.meta.url));
+  const { root } = path6.parse(dir);
   while (dir !== root) {
-    if (existsSync4(path5.join(dir, "package.json"))) return dir;
-    dir = path5.dirname(dir);
+    if (existsSync6(path6.join(dir, "package.json"))) return dir;
+    dir = path6.dirname(dir);
   }
   return null;
 }
@@ -1362,16 +1439,17 @@ function spawnDaemon() {
     process.stderr.write("[exed-client] WARN: cannot find package root\n");
     return;
   }
-  const daemonPath = path5.join(pkgRoot, "dist", "lib", "exe-daemon.js");
-  if (!existsSync4(daemonPath)) {
+  const daemonPath = path6.join(pkgRoot, "dist", "lib", "exe-daemon.js");
+  if (!existsSync6(daemonPath)) {
     process.stderr.write(`[exed-client] WARN: daemon script not found at ${daemonPath}
 `);
     return;
   }
   const resolvedPath = daemonPath;
+  const daemonToken = ensureDaemonToken(process.env[DAEMON_TOKEN_ENV] ?? null);
   process.stderr.write(`[exed-client] Spawning daemon: ${resolvedPath}
 `);
-  const logPath = path5.join(path5.dirname(SOCKET_PATH), "exed.log");
+  const logPath = path6.join(path6.dirname(SOCKET_PATH), "exed.log");
   let stderrFd = "ignore";
   try {
     stderrFd = openSync(logPath, "a");
@@ -1389,7 +1467,8 @@ function spawnDaemon() {
       TMUX_PANE: void 0,
       // Prevents resolveExeSession() from scoping to one session
       EXE_DAEMON_SOCK: SOCKET_PATH,
-      EXE_DAEMON_PID: PID_PATH
+      EXE_DAEMON_PID: PID_PATH,
+      [DAEMON_TOKEN_ENV]: daemonToken
     }
   });
   child.unref();
@@ -1499,13 +1578,14 @@ function sendDaemonRequest(payload, timeoutMs = REQUEST_TIMEOUT_MS) {
       return;
     }
     const id = randomUUID();
+    const token = process.env[DAEMON_TOKEN_ENV] ?? readDaemonToken();
     const timer = setTimeout(() => {
       _pending.delete(id);
       resolve({ error: "Request timeout" });
     }, timeoutMs);
     _pending.set(id, { resolve, timer });
     try {
-      _socket.write(JSON.stringify({ id, ...payload }) + "\n");
+      _socket.write(JSON.stringify({ id, token, ...payload }) + "\n");
     } catch {
       clearTimeout(timer);
       _pending.delete(id);
@@ -1534,9 +1614,9 @@ function killAndRespawnDaemon() {
   }
   try {
     process.stderr.write("[exed-client] Killing daemon for restart...\n");
-    if (existsSync4(PID_PATH)) {
+    if (existsSync6(PID_PATH)) {
       try {
-        const pid = parseInt(readFileSync4(PID_PATH, "utf8").trim(), 10);
+        const pid = parseInt(readFileSync5(PID_PATH, "utf8").trim(), 10);
         if (pid > 0) {
           try {
             process.kill(pid, "SIGKILL");
@@ -1656,17 +1736,19 @@ function disconnectClient() {
 function isClientConnected() {
   return _connected;
 }
-var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, _socket, _connected, _buffer, _requestCount, _consecutiveFailures, HEALTH_CHECK_INTERVAL, MAX_RETRIES_BEFORE_RESTART, RETRY_DELAYS_MS, MIN_DAEMON_AGE_MS, _pending, MAX_BUFFER;
+var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, DAEMON_TOKEN_ENV, _socket, _connected, _buffer, _requestCount, _consecutiveFailures, HEALTH_CHECK_INTERVAL, MAX_RETRIES_BEFORE_RESTART, RETRY_DELAYS_MS, MIN_DAEMON_AGE_MS, _pending, MAX_BUFFER;
 var init_exe_daemon_client = __esm({
   "src/lib/exe-daemon-client.ts"() {
     "use strict";
     init_config();
-    SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path5.join(EXE_AI_DIR, "exed.sock");
-    PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path5.join(EXE_AI_DIR, "exed.pid");
-    SPAWN_LOCK_PATH = path5.join(EXE_AI_DIR, "exed-spawn.lock");
+    init_daemon_auth();
+    SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path6.join(EXE_AI_DIR, "exed.sock");
+    PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path6.join(EXE_AI_DIR, "exed.pid");
+    SPAWN_LOCK_PATH = path6.join(EXE_AI_DIR, "exed-spawn.lock");
     SPAWN_LOCK_STALE_MS = 3e4;
     CONNECT_TIMEOUT_MS = 15e3;
     REQUEST_TIMEOUT_MS = 3e4;
+    DAEMON_TOKEN_ENV = "EXE_DAEMON_TOKEN";
     _socket = null;
     _connected = false;
     _buffer = "";
@@ -2251,6 +2333,7 @@ async function ensureSchema() {
       project     TEXT NOT NULL,
       summary     TEXT NOT NULL,
       task_file   TEXT,
+      session_scope TEXT,
       read        INTEGER NOT NULL DEFAULT 0,
       created_at  TEXT NOT NULL
     );
@@ -2259,7 +2342,7 @@ async function ensureSchema() {
       ON notifications(read);
 
     CREATE INDEX IF NOT EXISTS idx_notifications_agent
-      ON notifications(agent_id);
+      ON notifications(agent_id, session_scope);
 
     CREATE INDEX IF NOT EXISTS idx_notifications_task_file
       ON notifications(task_file);
@@ -2297,6 +2380,7 @@ async function ensureSchema() {
       target_agent    TEXT NOT NULL,
       target_project  TEXT,
       target_device   TEXT NOT NULL DEFAULT 'local',
+      session_scope   TEXT,
       content         TEXT NOT NULL,
       priority        TEXT DEFAULT 'normal',
       status          TEXT DEFAULT 'pending',
@@ -2310,10 +2394,31 @@ async function ensureSchema() {
     );
 
     CREATE INDEX IF NOT EXISTS idx_messages_target
-      ON messages(target_agent, status);
+      ON messages(target_agent, session_scope, status);
 
     CREATE INDEX IF NOT EXISTS idx_messages_conversation_order
-      ON messages(target_agent, from_agent, server_seq);
+      ON messages(target_agent, session_scope, from_agent, server_seq);
+  `);
+  try {
+    await client.execute({
+      sql: `ALTER TABLE notifications ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE messages ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  await client.executeMultiple(`
+    CREATE INDEX IF NOT EXISTS idx_notifications_agent_scope_read
+      ON notifications(agent_id, session_scope, read, created_at);
+
+    CREATE INDEX IF NOT EXISTS idx_messages_target_scope_status
+      ON messages(target_agent, session_scope, status, created_at);
   `);
   try {
     await client.execute({
@@ -2897,6 +3002,13 @@ async function ensureSchema() {
     } catch {
     }
   }
+  try {
+    await client.execute({
+      sql: `UPDATE tasks SET status = 'closed' WHERE status = 'done' AND result IS NOT NULL`,
+      args: []
+    });
+  } catch {
+  }
 }
 async function disposeDatabase() {
   if (_walCheckpointTimer) {
@@ -2936,14 +3048,14 @@ var init_database = __esm({
 
 // src/lib/keychain.ts
 import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync5 } from "fs";
-import path6 from "path";
+import { existsSync as existsSync7 } from "fs";
+import path7 from "path";
 import os5 from "os";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path6.join(os5.homedir(), ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path7.join(os5.homedir(), ".exe-os");
 }
 function getKeyPath() {
-  return path6.join(getKeyDir(), "master.key");
+  return path7.join(getKeyDir(), "master.key");
 }
 async function tryKeytar() {
   try {
@@ -2964,7 +3076,7 @@ async function getMasterKey() {
     }
   }
   const keyPath = getKeyPath();
-  if (!existsSync5(keyPath)) {
+  if (!existsSync7(keyPath)) {
     process.stderr.write(
       `[keychain] Key not found at ${keyPath} (HOME=${os5.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
 `
@@ -3051,6 +3163,7 @@ var shard_manager_exports = {};
 __export(shard_manager_exports, {
   disposeShards: () => disposeShards,
   ensureShardSchema: () => ensureShardSchema,
+  getOpenShardCount: () => getOpenShardCount,
   getReadyShardClient: () => getReadyShardClient,
   getShardClient: () => getShardClient,
   getShardsDir: () => getShardsDir,
@@ -3059,15 +3172,18 @@ __export(shard_manager_exports, {
   listShards: () => listShards,
   shardExists: () => shardExists
 });
-import path7 from "path";
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import path8 from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
-  if (!existsSync6(SHARDS_DIR)) {
+  if (!existsSync8(SHARDS_DIR)) {
     mkdirSync2(SHARDS_DIR, { recursive: true });
   }
   _shardingEnabled = true;
+  if (_evictionTimer) clearInterval(_evictionTimer);
+  _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
+  _evictionTimer.unref();
 }
 function isShardingEnabled() {
   return _shardingEnabled;
@@ -3084,21 +3200,28 @@ function getShardClient(projectName) {
     throw new Error(`Invalid project name for shard: "${projectName}"`);
   }
   const cached = _shards.get(safeName);
-  if (cached) return cached;
-  const dbPath = path7.join(SHARDS_DIR, `${safeName}.db`);
+  if (cached) {
+    _shardLastAccess.set(safeName, Date.now());
+    return cached;
+  }
+  while (_shards.size >= MAX_OPEN_SHARDS) {
+    evictLRU();
+  }
+  const dbPath = path8.join(SHARDS_DIR, `${safeName}.db`);
   const client = createClient2({
     url: `file:${dbPath}`,
     encryptionKey: _encryptionKey
   });
   _shards.set(safeName, client);
+  _shardLastAccess.set(safeName, Date.now());
   return client;
 }
 function shardExists(projectName) {
   const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return existsSync6(path7.join(SHARDS_DIR, `${safeName}.db`));
+  return existsSync8(path8.join(SHARDS_DIR, `${safeName}.db`));
 }
 function listShards() {
-  if (!existsSync6(SHARDS_DIR)) return [];
+  if (!existsSync8(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
@@ -3150,6 +3273,8 @@ async function ensureShardSchema(client) {
   for (const col of [
     "ALTER TABLE memories ADD COLUMN task_id TEXT",
     "ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN author_device_id TEXT",
+    "ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'",
     "ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5",
     "ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'",
     "ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0",
@@ -3287,21 +3412,69 @@ async function getReadyShardClient(projectName) {
   await ensureShardSchema(client);
   return client;
 }
+function evictLRU() {
+  let oldest = null;
+  let oldestTime = Infinity;
+  for (const [name, time] of _shardLastAccess) {
+    if (time < oldestTime) {
+      oldestTime = time;
+      oldest = name;
+    }
+  }
+  if (oldest) {
+    const client = _shards.get(oldest);
+    if (client) {
+      client.close();
+    }
+    _shards.delete(oldest);
+    _shardLastAccess.delete(oldest);
+  }
+}
+function evictIdleShards() {
+  const now = Date.now();
+  const toEvict = [];
+  for (const [name, lastAccess] of _shardLastAccess) {
+    if (now - lastAccess > SHARD_IDLE_MS) {
+      toEvict.push(name);
+    }
+  }
+  for (const name of toEvict) {
+    const client = _shards.get(name);
+    if (client) {
+      client.close();
+    }
+    _shards.delete(name);
+    _shardLastAccess.delete(name);
+  }
+}
+function getOpenShardCount() {
+  return _shards.size;
+}
 function disposeShards() {
+  if (_evictionTimer) {
+    clearInterval(_evictionTimer);
+    _evictionTimer = null;
+  }
   for (const [, client] of _shards) {
     client.close();
   }
   _shards.clear();
+  _shardLastAccess.clear();
   _shardingEnabled = false;
   _encryptionKey = null;
 }
-var SHARDS_DIR, _shards, _encryptionKey, _shardingEnabled;
+var SHARDS_DIR, SHARD_IDLE_MS, MAX_OPEN_SHARDS, EVICTION_INTERVAL_MS, _shards, _shardLastAccess, _evictionTimer, _encryptionKey, _shardingEnabled;
 var init_shard_manager = __esm({
   "src/lib/shard-manager.ts"() {
     "use strict";
     init_config();
-    SHARDS_DIR = path7.join(EXE_AI_DIR, "shards");
+    SHARDS_DIR = path8.join(EXE_AI_DIR, "shards");
+    SHARD_IDLE_MS = 5 * 60 * 1e3;
+    MAX_OPEN_SHARDS = 10;
+    EVICTION_INTERVAL_MS = 60 * 1e3;
     _shards = /* @__PURE__ */ new Map();
+    _shardLastAccess = /* @__PURE__ */ new Map();
+    _evictionTimer = null;
     _encryptionKey = null;
     _shardingEnabled = false;
   }
@@ -4163,8 +4336,8 @@ __export(reranker_exports, {
   rerankWithContext: () => rerankWithContext,
   rerankWithScores: () => rerankWithScores
 });
-import path8 from "path";
-import { existsSync as existsSync7 } from "fs";
+import path9 from "path";
+import { existsSync as existsSync9 } from "fs";
 function resetIdleTimer() {
   if (_idleTimer) clearTimeout(_idleTimer);
   _idleTimer = setTimeout(() => {
@@ -4175,18 +4348,18 @@ function resetIdleTimer() {
   }
 }
 function isRerankerAvailable() {
-  return existsSync7(path8.join(MODELS_DIR, RERANKER_MODEL_FILE));
+  return existsSync9(path9.join(MODELS_DIR, RERANKER_MODEL_FILE));
 }
 function getRerankerModelPath() {
-  return path8.join(MODELS_DIR, RERANKER_MODEL_FILE);
+  return path9.join(MODELS_DIR, RERANKER_MODEL_FILE);
 }
 async function ensureLoaded() {
   if (_rerankerContext) {
     resetIdleTimer();
     return;
   }
-  const modelPath = path8.join(MODELS_DIR, RERANKER_MODEL_FILE);
-  if (!existsSync7(modelPath)) {
+  const modelPath = path9.join(MODELS_DIR, RERANKER_MODEL_FILE);
+  if (!existsSync9(modelPath)) {
     throw new Error(
       `Reranker model not found at ${modelPath}. Run /exe-setup to download it.`
     );
@@ -4319,10 +4492,10 @@ async function disposeEmbedder() {
 async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync14 } = await import("fs");
-  const path18 = await import("path");
-  const modelPath = path18.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync14(modelPath)) {
+  const { existsSync: existsSync16 } = await import("fs");
+  const path19 = await import("path");
+  const modelPath = path19.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync16(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -4357,7 +4530,7 @@ __export(project_name_exports, {
   getProjectName: () => getProjectName
 });
 import { execSync as execSync2 } from "child_process";
-import path9 from "path";
+import path10 from "path";
 function getProjectName(cwd) {
   const dir = cwd ?? process.cwd();
   if (_cached && _cachedCwd === dir) return _cached;
@@ -4370,7 +4543,7 @@ function getProjectName(cwd) {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       }).trim();
-      repoRoot = path9.dirname(gitCommonDir);
+      repoRoot = path10.dirname(gitCommonDir);
     } catch {
       repoRoot = execSync2("git rev-parse --show-toplevel", {
         cwd: dir,
@@ -4379,11 +4552,11 @@ function getProjectName(cwd) {
         stdio: ["pipe", "pipe", "pipe"]
       }).trim();
     }
-    _cached = path9.basename(repoRoot);
+    _cached = path10.basename(repoRoot);
     _cachedCwd = dir;
     return _cached;
   } catch {
-    _cached = path9.basename(dir);
+    _cached = path10.basename(dir);
     _cachedCwd = dir;
     return _cached;
   }
@@ -4407,9 +4580,9 @@ __export(file_grep_exports, {
   grepProjectFiles: () => grepProjectFiles
 });
 import { execSync as execSync3 } from "child_process";
-import { readFileSync as readFileSync5, readdirSync as readdirSync2, statSync as statSync2, existsSync as existsSync8 } from "fs";
-import path10 from "path";
-import crypto from "crypto";
+import { readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync2, existsSync as existsSync10 } from "fs";
+import path11 from "path";
+import crypto2 from "crypto";
 function hasRipgrep() {
   if (_hasRg === null) {
     try {
@@ -4442,13 +4615,13 @@ async function grepProjectFiles(query, projectRoot, options) {
     const chunkCtx = getChunkContext(hit.filePath, hit.lineNumber);
     const prefix = chunkCtx ? `[file: ${hit.filePath}:${hit.lineNumber} in ${chunkCtx}]` : `[file: ${hit.filePath}:${hit.lineNumber}]`;
     return {
-      id: crypto.createHash("sha256").update(`${hit.filePath}:${hit.lineNumber}`).digest("hex").slice(0, 36),
+      id: crypto2.createHash("sha256").update(`${hit.filePath}:${hit.lineNumber}`).digest("hex").slice(0, 36),
       agent_id: "project",
       agent_role: "file",
       session_id: "file-grep",
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       tool_name: "file_grep",
-      project_name: path10.basename(projectRoot),
+      project_name: path11.basename(projectRoot),
       has_error: false,
       raw_text: `${prefix} ${buildSnippet(hit, projectRoot)}`,
       vector: null,
@@ -4460,7 +4633,7 @@ function getChunkContext(filePath, lineNumber) {
   try {
     const ext = filePath.split(".").pop()?.toLowerCase();
     if (ext !== "ts" && ext !== "tsx" && ext !== "js" && ext !== "jsx") return "";
-    const source = readFileSync5(filePath, "utf8");
+    const source = readFileSync6(filePath, "utf8");
     const lines = source.split("\n");
     for (let i = Math.min(lineNumber - 1, lines.length - 1); i >= 0; i--) {
       const line = lines[i];
@@ -4522,11 +4695,11 @@ function grepWithNodeFs(pattern, projectRoot, patterns) {
   const files = collectFiles(projectRoot, patterns ?? DEFAULT_PATTERNS);
   const hits = [];
   for (const filePath of files.slice(0, MAX_FILES)) {
-    const absPath = path10.join(projectRoot, filePath);
+    const absPath = path11.join(projectRoot, filePath);
     try {
       const stat = statSync2(absPath);
       if (stat.size > MAX_FILE_SIZE) continue;
-      const content = readFileSync5(absPath, "utf8");
+      const content = readFileSync6(absPath, "utf8");
       const lines = content.split("\n");
       const matches = content.match(regex);
       if (!matches || matches.length === 0) continue;
@@ -4549,15 +4722,15 @@ function collectFiles(root, patterns) {
   const files = [];
   function walk(dir, relative) {
     if (files.length >= MAX_FILES) return;
-    const basename = path10.basename(dir);
+    const basename = path11.basename(dir);
     if (EXCLUDE_DIRS.includes(basename)) return;
     try {
       const entries = readdirSync2(dir, { withFileTypes: true });
       for (const entry of entries) {
         if (files.length >= MAX_FILES) return;
-        const rel = path10.join(relative, entry.name);
+        const rel = path11.join(relative, entry.name);
         if (entry.isDirectory()) {
-          walk(path10.join(dir, entry.name), rel);
+          walk(path11.join(dir, entry.name), rel);
         } else if (entry.isFile()) {
           for (const pat of patterns) {
             if (matchGlob(rel, pat)) {
@@ -4589,7 +4762,7 @@ function matchGlob(filePath, pattern) {
   if (slashIdx !== -1) {
     const dir = pattern.slice(0, slashIdx);
     const ext2 = pattern.slice(slashIdx + 1).replace("*", "");
-    const fileDir = path10.dirname(filePath);
+    const fileDir = path11.dirname(filePath);
     return fileDir === dir && filePath.endsWith(ext2);
   }
   const ext = pattern.replace("*", "");
@@ -4597,9 +4770,9 @@ function matchGlob(filePath, pattern) {
 }
 function buildSnippet(hit, projectRoot) {
   try {
-    const absPath = path10.join(projectRoot, hit.filePath);
-    if (!existsSync8(absPath)) return hit.matchLine;
-    const lines = readFileSync5(absPath, "utf8").split("\n");
+    const absPath = path11.join(projectRoot, hit.filePath);
+    if (!existsSync10(absPath)) return hit.matchLine;
+    const lines = readFileSync6(absPath, "utf8").split("\n");
     const start = Math.max(0, hit.lineNumber - 3);
     const end = Math.min(lines.length, hit.lineNumber + 2);
     return lines.slice(start, end).join("\n").slice(0, 500);
@@ -5815,9 +5988,9 @@ var init_session_key = __esm({
 });
 
 // src/lib/active-agent.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3 } from "fs";
 import { execSync as execSync5 } from "child_process";
-import path11 from "path";
+import path12 from "path";
 function isNameWithOptionalInstance(candidate, baseName) {
   if (candidate === baseName) return true;
   if (!candidate.startsWith(baseName)) return false;
@@ -5861,12 +6034,12 @@ function resolveActiveAgentFromTmuxSession(sessionName) {
   return null;
 }
 function getMarkerPath() {
-  return path11.join(CACHE_DIR, `active-agent-${getSessionKey()}.json`);
+  return path12.join(CACHE_DIR, `active-agent-${getSessionKey()}.json`);
 }
 function writeActiveAgent(agentId, agentRole) {
   try {
     mkdirSync3(CACHE_DIR, { recursive: true });
-    writeFileSync3(
+    writeFileSync4(
       getMarkerPath(),
       JSON.stringify({ agentId, agentRole, startedAt: (/* @__PURE__ */ new Date()).toISOString() })
     );
@@ -5882,7 +6055,7 @@ function clearActiveAgent() {
 function getActiveAgent() {
   try {
     const markerPath = getMarkerPath();
-    const raw = readFileSync6(markerPath, "utf8");
+    const raw = readFileSync7(markerPath, "utf8");
     const data = JSON.parse(raw);
     if (data.agentId) {
       if (data.startedAt) {
@@ -5930,14 +6103,14 @@ function getAllActiveAgents() {
       const key = file.slice("active-agent-".length, -".json".length);
       if (key === "undefined") continue;
       try {
-        const raw = readFileSync6(path11.join(CACHE_DIR, file), "utf8");
+        const raw = readFileSync7(path12.join(CACHE_DIR, file), "utf8");
         const data = JSON.parse(raw);
         if (!data.agentId) continue;
         if (data.startedAt) {
           const age = Date.now() - new Date(data.startedAt).getTime();
           if (age > STALE_MS) {
             try {
-              unlinkSync3(path11.join(CACHE_DIR, file));
+              unlinkSync3(path12.join(CACHE_DIR, file));
             } catch {
             }
             continue;
@@ -5960,11 +6133,11 @@ function getAllActiveAgents() {
 function cleanupSessionMarkers() {
   const key = getSessionKey();
   try {
-    unlinkSync3(path11.join(CACHE_DIR, `active-agent-${key}.json`));
+    unlinkSync3(path12.join(CACHE_DIR, `active-agent-${key}.json`));
   } catch {
   }
   try {
-    unlinkSync3(path11.join(CACHE_DIR, "active-agent-undefined.json"));
+    unlinkSync3(path12.join(CACHE_DIR, "active-agent-undefined.json"));
   } catch {
   }
 }
@@ -5975,7 +6148,7 @@ var init_active_agent = __esm({
     init_config();
     init_session_key();
     init_employees();
-    CACHE_DIR = path11.join(EXE_AI_DIR, "session-cache");
+    CACHE_DIR = path12.join(EXE_AI_DIR, "session-cache");
     STALE_MS = 24 * 60 * 60 * 1e3;
   }
 });
@@ -5998,13 +6171,13 @@ var init_active_agent2 = __esm({
 });
 
 // src/lib/session-registry.ts
-import path12 from "path";
+import path13 from "path";
 import os6 from "os";
 var REGISTRY_PATH;
 var init_session_registry = __esm({
   "src/lib/session-registry.ts"() {
     "use strict";
-    REGISTRY_PATH = path12.join(os6.homedir(), ".exe-os", "session-registry.json");
+    REGISTRY_PATH = path13.join(os6.homedir(), ".exe-os", "session-registry.json");
   }
 });
 
@@ -6145,38 +6318,41 @@ var init_provider_table = __esm({
 });
 
 // src/lib/intercom-queue.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, renameSync as renameSync3, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
-import path13 from "path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync5, renameSync as renameSync3, existsSync as existsSync11, mkdirSync as mkdirSync4 } from "fs";
+import path14 from "path";
 import os7 from "os";
 var QUEUE_PATH, TTL_MS, INTERCOM_LOG;
 var init_intercom_queue = __esm({
   "src/lib/intercom-queue.ts"() {
     "use strict";
-    QUEUE_PATH = path13.join(os7.homedir(), ".exe-os", "intercom-queue.json");
+    QUEUE_PATH = path14.join(os7.homedir(), ".exe-os", "intercom-queue.json");
     TTL_MS = 60 * 60 * 1e3;
-    INTERCOM_LOG = path13.join(os7.homedir(), ".exe-os", "intercom.log");
+    INTERCOM_LOG = path14.join(os7.homedir(), ".exe-os", "intercom.log");
   }
 });
 
 // src/lib/license.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync5, existsSync as existsSync10, mkdirSync as mkdirSync5 } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, existsSync as existsSync12, mkdirSync as mkdirSync5 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
-import path14 from "path";
+import { createRequire as createRequire2 } from "module";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import os8 from "os";
+import path15 from "path";
 import { jwtVerify, importSPKI } from "jose";
 var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH;
 var init_license = __esm({
   "src/lib/license.ts"() {
     "use strict";
     init_config();
-    LICENSE_PATH = path14.join(EXE_AI_DIR, "license.key");
-    CACHE_PATH = path14.join(EXE_AI_DIR, "license-cache.json");
-    DEVICE_ID_PATH = path14.join(EXE_AI_DIR, "device-id");
+    LICENSE_PATH = path15.join(EXE_AI_DIR, "license.key");
+    CACHE_PATH = path15.join(EXE_AI_DIR, "license-cache.json");
+    DEVICE_ID_PATH = path15.join(EXE_AI_DIR, "device-id");
   }
 });
 
 // src/lib/plan-limits.ts
-import { readFileSync as readFileSync9, existsSync as existsSync11 } from "fs";
-import path15 from "path";
+import { readFileSync as readFileSync10, existsSync as existsSync13 } from "fs";
+import path16 from "path";
 var CACHE_PATH2;
 var init_plan_limits = __esm({
   "src/lib/plan-limits.ts"() {
@@ -6185,14 +6361,14 @@ var init_plan_limits = __esm({
     init_employees();
     init_license();
     init_config();
-    CACHE_PATH2 = path15.join(EXE_AI_DIR, "license-cache.json");
+    CACHE_PATH2 = path16.join(EXE_AI_DIR, "license-cache.json");
   }
 });
 
 // src/lib/tmux-routing.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6, existsSync as existsSync12, appendFileSync, readdirSync as readdirSync4 } from "fs";
-import path16 from "path";
-import os8 from "os";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync14, appendFileSync, readdirSync as readdirSync4 } from "fs";
+import path17 from "path";
+import os9 from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getMySession() {
   return getTransport().getMySession();
@@ -6205,7 +6381,7 @@ function extractRootExe(name) {
 }
 function getParentExe(sessionKey) {
   try {
-    const data = JSON.parse(readFileSync10(path16.join(SESSION_CACHE, `parent-exe-${sessionKey}.json`), "utf8"));
+    const data = JSON.parse(readFileSync11(path17.join(SESSION_CACHE, `parent-exe-${sessionKey}.json`), "utf8"));
     return data.parentExe || null;
   } catch {
     return null;
@@ -6248,10 +6424,10 @@ var init_tmux_routing = __esm({
     init_intercom_queue();
     init_plan_limits();
     init_employees();
-    SPAWN_LOCK_DIR = path16.join(os8.homedir(), ".exe-os", "spawn-locks");
-    SESSION_CACHE = path16.join(os8.homedir(), ".exe-os", "session-cache");
-    INTERCOM_LOG2 = path16.join(os8.homedir(), ".exe-os", "intercom.log");
-    DEBOUNCE_FILE = path16.join(SESSION_CACHE, "intercom-debounce.json");
+    SPAWN_LOCK_DIR = path17.join(os9.homedir(), ".exe-os", "spawn-locks");
+    SESSION_CACHE = path17.join(os9.homedir(), ".exe-os", "session-cache");
+    INTERCOM_LOG2 = path17.join(os9.homedir(), ".exe-os", "intercom.log");
+    DEBOUNCE_FILE = path17.join(SESSION_CACHE, "intercom-debounce.json");
     DEBOUNCE_CLEANUP_AGE_MS = 5 * 60 * 1e3;
   }
 });
@@ -6260,7 +6436,8 @@ var init_tmux_routing = __esm({
 var task_scope_exports = {};
 __export(task_scope_exports, {
   getCurrentSessionScope: () => getCurrentSessionScope,
-  sessionScopeFilter: () => sessionScopeFilter
+  sessionScopeFilter: () => sessionScopeFilter,
+  strictSessionScopeFilter: () => strictSessionScopeFilter
 });
 function getCurrentSessionScope() {
   try {
@@ -6278,6 +6455,15 @@ function sessionScopeFilter(sessionScope, tableAlias) {
     args: [scope]
   };
 }
+function strictSessionScopeFilter(sessionScope, tableAlias) {
+  const scope = sessionScope !== void 0 ? sessionScope : getCurrentSessionScope();
+  if (!scope) return { sql: "", args: [] };
+  const col = tableAlias ? `${tableAlias}.session_scope` : "session_scope";
+  return {
+    sql: ` AND ${col} = ?`,
+    args: [scope]
+  };
+}
 var init_task_scope = __esm({
   "src/lib/task-scope.ts"() {
     "use strict";
@@ -6287,8 +6473,8 @@ var init_task_scope = __esm({
 
 // src/adapters/claude/hooks/session-start.ts
 init_config();
-import path17 from "path";
-import { unlinkSync as unlinkSync4, existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
+import path18 from "path";
+import { unlinkSync as unlinkSync4, existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
 if (!process.env.AGENT_ID) {
   process.env.AGENT_ID = "default";
   process.env.AGENT_ROLE = "employee";
@@ -6321,8 +6507,8 @@ process.stdin.on("end", async () => {
     const source = data.source ?? "startup";
     if (source === "startup") {
       try {
-        const undefinedPath = path17.join(
-          process.env.EXE_OS_DIR ?? path17.join(process.env.HOME ?? "", ".exe-os"),
+        const undefinedPath = path18.join(
+          process.env.EXE_OS_DIR ?? path18.join(process.env.HOME ?? "", ".exe-os"),
           "session-cache",
           "active-agent-undefined.json"
         );
@@ -6335,13 +6521,13 @@ process.stdin.on("end", async () => {
     const agentId = agent.agentId;
     if (agentId !== "default") {
       try {
-        const cacheDir = path17.join(
-          process.env.EXE_OS_DIR ?? path17.join(process.env.HOME ?? "", ".exe-os"),
+        const cacheDir = path18.join(
+          process.env.EXE_OS_DIR ?? path18.join(process.env.HOME ?? "", ".exe-os"),
           "session-cache"
         );
-        const markerPath = path17.join(cacheDir, `current-task-${agentId}.json`);
-        if (existsSync13(markerPath)) {
-          const marker = JSON.parse(readFileSync11(markerPath, "utf-8"));
+        const markerPath = path18.join(cacheDir, `current-task-${agentId}.json`);
+        if (existsSync15(markerPath)) {
+          const marker = JSON.parse(readFileSync12(markerPath, "utf-8"));
           if (marker.taskId) {
             const client = getClient2();
             const result = await client.execute({