@askexenow/exe-os 0.9.85 → 0.9.87

package/dist/bin/exe-search.js

@@ -1046,7 +1046,7 @@ var init_daemon_auth = __esm({
 // src/lib/exe-daemon-client.ts
 import net from "net";
 import os4 from "os";
-import { spawn } from "child_process";
+import { spawn, execSync as execSync2 } from "child_process";
 import { randomUUID } from "crypto";
 import { existsSync as existsSync5, unlinkSync as unlinkSync2, readFileSync as readFileSync4, openSync, closeSync, statSync } from "fs";
 import path5 from "path";
@@ -1076,6 +1076,14 @@ function handleData(chunk) {
     }
   }
 }
+function isZombie(pid) {
+  try {
+    const state = execSync2(`ps -p ${pid} -o state=`, { encoding: "utf8", timeout: 2e3 }).trim();
+    return state.startsWith("Z");
+  } catch {
+    return false;
+  }
+}
 function cleanupStaleFiles() {
   if (existsSync5(PID_PATH)) {
     try {
@@ -1083,7 +1091,11 @@ function cleanupStaleFiles() {
       if (pid > 0) {
         try {
           process.kill(pid, 0);
-          return;
+          if (!isZombie(pid)) {
+            return;
+          }
+          process.stderr.write(`[exed-client] PID ${pid} is a zombie \u2014 cleaning up stale files
+`);
         } catch {
         }
       }
@@ -1111,8 +1123,8 @@ function findPackageRoot() {
 function getAvailableMemoryGB() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync5 } = __require("child_process");
-      const vmstat = execSync5("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync6 } = __require("child_process");
+      const vmstat = execSync6("vm_stat", { encoding: "utf8" });
       const pageSize = 16384;
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -3047,6 +3059,12 @@ async function disposeDatabase() {
     clearInterval(_walCheckpointTimer);
     _walCheckpointTimer = null;
   }
+  if (_client) {
+    try {
+      await _client.execute("PRAGMA wal_checkpoint(PASSIVE)");
+    } catch {
+    }
+  }
   if (_daemonClient) {
     _daemonClient.close();
     _daemonClient = null;
@@ -3083,7 +3101,7 @@ var init_database = __esm({
 // src/lib/keychain.ts
 import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync6, statSync as statSync2 } from "fs";
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 import path6 from "path";
 import os5 from "os";
 function getKeyDir() {
@@ -3100,13 +3118,13 @@ function linuxSecretAvailable() {
   if (process.platform !== "linux") return false;
   if (linuxSecretAvailability !== null) return linuxSecretAvailability;
   try {
-    execSync2("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
+    execSync3("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
   } catch {
     linuxSecretAvailability = false;
     return false;
   }
   try {
-    execSync2("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
+    execSync3("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
     linuxSecretAvailability = true;
   } catch {
     linuxSecretAvailability = false;
@@ -3130,7 +3148,7 @@ function macKeychainGet(service = SERVICE) {
   if (!nativeKeychainAllowed()) return null;
   if (process.platform !== "darwin") return null;
   try {
-    return execSync2(
+    return execSync3(
       `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
@@ -3143,13 +3161,13 @@ function macKeychainSet(value, service = SERVICE) {
   if (process.platform !== "darwin") return false;
   try {
     try {
-      execSync2(
+      execSync3(
         `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
         { timeout: 5e3 }
       );
     } catch {
     }
-    execSync2(
+    execSync3(
       `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
       { timeout: 5e3 }
     );
@@ -3162,7 +3180,7 @@ function macKeychainDelete(service = SERVICE) {
   if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "darwin") return false;
   try {
-    execSync2(
+    execSync3(
       `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
@@ -3174,7 +3192,7 @@ function macKeychainDelete(service = SERVICE) {
 function linuxSecretGet(service = SERVICE) {
   if (!linuxSecretAvailable()) return null;
   try {
-    return execSync2(
+    return execSync3(
       `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
@@ -3185,7 +3203,7 @@ function linuxSecretGet(service = SERVICE) {
 function linuxSecretSet(value, service = SERVICE) {
   if (!linuxSecretAvailable()) return false;
   try {
-    execSync2(
+    execSync3(
       `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
@@ -3198,7 +3216,7 @@ function linuxSecretDelete(service = SERVICE) {
   if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "linux") return false;
   try {
-    execSync2(
+    execSync3(
       `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
@@ -4135,6 +4153,24 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "When an agent encounters a suspected Exe OS bug, update breakage, MCP/tool failure, installer issue, memory/orchestration defect, or customer-local patch need, it MUST use create_bug_report. Do this before or alongside any local workaround so the report reaches AskExe support directly via the customer's license. Do NOT ask the founder for permission to file a required bug report. If create_bug_report is deferred/lazy-loaded, load it and call it. If it is unavailable in the live MCP surface, report 'create_bug_report unavailable in this session' and save a local report in exe/output \u2014 never claim the tool does not exist unless the live MCP surface was checked. If upstream delivery fails, call support_test (MCP) and include its result in the local report so AskExe can distinguish customer setup, license provisioning, and server intake issues; only ask the founder to run `exe-os support test` if MCP is disconnected/unavailable. Classify first: upstream_bug = reproducible exe-os/platform defect; customer_customization = identity, behavior, procedure, config, branding, workflow preference that belongs in customer-owned layers; emergency_hotfix = temporary local patch. For upstream bugs/emergency hotfixes include version, repro steps, expected/actual, files changed, workaround, and local diff summary. Avoid permanent platform-code patches unless founder approves; if a hotfix is unavoidable, document it in the bug report and re-check after npm update."
       },
+      {
+        title: "Bug report status check \u2014 surface available fixes on boot",
+        domain: "support",
+        priority: "p1",
+        content: "Once per session (COO boot only, never repeat), call list_my_bug_reports to check if any previously filed bug reports have been fixed by AskExe. If any report has status 'fixed' with a fixed_version, surface it to the founder immediately: '\u{1F527} N bug fix(es) available \u2014 run exe-os update to get version X.Y.Z'. This is a one-time check at boot, not a recurring poll. If no reports exist or none are fixed, skip silently. If the MCP tool is unavailable or the network call fails, skip silently \u2014 this is informational, not blocking."
+      },
+      {
+        title: "Feature request triage \u2014 upstream feature vs local customization",
+        domain: "support",
+        priority: "p0",
+        content: "When an agent or founder identifies a desired capability that exe-os does not yet provide, the COO (or equivalent coordinator) must decide: is this a local customization (identity, behavior, procedure, config, branding, workflow preference that can be configured in customer-owned layers) or an upstream feature request (a platform capability that requires changes to exe-os code, shipped via npm update)? Local customizations: implement immediately using store_behavior, update_identity, company_procedure, or config changes. Upstream features: use create_feature_request to submit to AskExe. Include use case, business impact, and current workaround. Do NOT ask the founder for permission to file a feature request \u2014 file it proactively when the need is clear."
+      },
+      {
+        title: "Feature request status check \u2014 surface shipped features on boot",
+        domain: "support",
+        priority: "p1",
+        content: "Once per session (COO boot only, never repeat), call list_my_feature_requests to check if any previously filed feature requests have been shipped by AskExe. If any request has status 'shipped' with a shipped_version, surface it to the founder immediately: '\u{1F680} N feature(s) shipped \u2014 run exe-os update to get version X.Y.Z'. This is a one-time check at boot, not a recurring poll. If no requests exist or none are shipped, skip silently. If the MCP tool is unavailable or the network call fails, skip silently \u2014 this is informational, not blocking."
+      },
       // --- Operations ---
       {
         title: "Managers must supervise deployed workers",
@@ -5666,7 +5702,7 @@ __export(project_name_exports, {
   _resetCache: () => _resetCache,
   getProjectName: () => getProjectName
 });
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 import path9 from "path";
 function getProjectName(cwd) {
   const dir = cwd ?? process.cwd();
@@ -5674,7 +5710,7 @@ function getProjectName(cwd) {
   try {
     let repoRoot;
     try {
-      const gitCommonDir = execSync3("git rev-parse --path-format=absolute --git-common-dir", {
+      const gitCommonDir = execSync4("git rev-parse --path-format=absolute --git-common-dir", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -5682,7 +5718,7 @@ function getProjectName(cwd) {
       }).trim();
       repoRoot = path9.dirname(gitCommonDir);
     } catch {
-      repoRoot = execSync3("git rev-parse --show-toplevel", {
+      repoRoot = execSync4("git rev-parse --show-toplevel", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -5716,14 +5752,14 @@ var file_grep_exports = {};
 __export(file_grep_exports, {
   grepProjectFiles: () => grepProjectFiles
 });
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 import { readFileSync as readFileSync5, readdirSync as readdirSync2, statSync as statSync4, existsSync as existsSync9 } from "fs";
 import path10 from "path";
 import crypto2 from "crypto";
 function hasRipgrep() {
   if (_hasRg === null) {
     try {
-      execSync4("rg --version", { stdio: "ignore", timeout: 2e3 });
+      execSync5("rg --version", { stdio: "ignore", timeout: 2e3 });
       _hasRg = true;
     } catch {
       _hasRg = false;
@@ -5789,7 +5825,7 @@ function grepWithRipgrep(pattern, projectRoot, patterns) {
   const globs = (patterns ?? DEFAULT_PATTERNS).map((p) => `--glob '${p}'`).join(" ");
   const excludes = EXCLUDE_DIRS.map((d) => `--glob '!${d}'`).join(" ");
   const cmd = `rg -i -c --hidden --no-config --no-ignore '${pattern.replace(/'/g, "\\'")}' . ${globs} ${excludes} --max-filesize ${MAX_FILE_SIZE} 2>/dev/null || true`;
-  const output = execSync4(cmd, {
+  const output = execSync5(cmd, {
     cwd: projectRoot,
     encoding: "utf8",
     timeout: 3e3,
@@ -5804,12 +5840,12 @@ function grepWithRipgrep(pattern, projectRoot, patterns) {
     const matchCount = parseInt(line.slice(colonIdx + 1));
     if (isNaN(matchCount) || matchCount === 0) continue;
     try {
-      const firstMatch = execSync4(
+      const firstMatch = execSync5(
         `rg -i -n --hidden '${pattern.replace(/'/g, "\\'")}' '${filePath}' --max-count 1 2>/dev/null | head -1`,
         { cwd: projectRoot, encoding: "utf8", timeout: 1e3 }
       ).trim();
       const lineNum = parseInt(firstMatch.split(":")[0] ?? "1");
-      const totalLines = execSync4(`wc -l < '${filePath}'`, {
+      const totalLines = execSync5(`wc -l < '${filePath}'`, {
         cwd: projectRoot,
         encoding: "utf8",
         timeout: 1e3

package/dist/bin/exe-session-cleanup.js

@@ -1090,7 +1090,7 @@ var init_daemon_auth = __esm({
 // src/lib/exe-daemon-client.ts
 import net from "net";
 import os4 from "os";
-import { spawn } from "child_process";
+import { spawn, execSync as execSync2 } from "child_process";
 import { randomUUID } from "crypto";
 import { existsSync as existsSync5, unlinkSync as unlinkSync2, readFileSync as readFileSync4, openSync, closeSync, statSync } from "fs";
 import path5 from "path";
@@ -1120,6 +1120,14 @@ function handleData(chunk) {
     }
   }
 }
+function isZombie(pid) {
+  try {
+    const state = execSync2(`ps -p ${pid} -o state=`, { encoding: "utf8", timeout: 2e3 }).trim();
+    return state.startsWith("Z");
+  } catch {
+    return false;
+  }
+}
 function cleanupStaleFiles() {
   if (existsSync5(PID_PATH)) {
     try {
@@ -1127,7 +1135,11 @@ function cleanupStaleFiles() {
       if (pid > 0) {
         try {
           process.kill(pid, 0);
-          return;
+          if (!isZombie(pid)) {
+            return;
+          }
+          process.stderr.write(`[exed-client] PID ${pid} is a zombie \u2014 cleaning up stale files
+`);
         } catch {
         }
       }
@@ -1155,8 +1167,8 @@ function findPackageRoot() {
 function getAvailableMemoryGB() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync11 } = __require("child_process");
-      const vmstat = execSync11("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync12 } = __require("child_process");
+      const vmstat = execSync12("vm_stat", { encoding: "utf8" });
       const pageSize = 16384;
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -3091,6 +3103,12 @@ async function disposeDatabase() {
     clearInterval(_walCheckpointTimer);
     _walCheckpointTimer = null;
   }
+  if (_client) {
+    try {
+      await _client.execute("PRAGMA wal_checkpoint(PASSIVE)");
+    } catch {
+    }
+  }
   if (_daemonClient) {
     _daemonClient.close();
     _daemonClient = null;
@@ -3127,7 +3145,7 @@ var init_database = __esm({
 // src/lib/keychain.ts
 import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync6, statSync as statSync2 } from "fs";
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 import path6 from "path";
 import os5 from "os";
 function getKeyDir() {
@@ -3144,13 +3162,13 @@ function linuxSecretAvailable() {
   if (process.platform !== "linux") return false;
   if (linuxSecretAvailability !== null) return linuxSecretAvailability;
   try {
-    execSync2("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
+    execSync3("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
   } catch {
     linuxSecretAvailability = false;
     return false;
   }
   try {
-    execSync2("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
+    execSync3("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
     linuxSecretAvailability = true;
   } catch {
     linuxSecretAvailability = false;
@@ -3174,7 +3192,7 @@ function macKeychainGet(service = SERVICE) {
   if (!nativeKeychainAllowed()) return null;
   if (process.platform !== "darwin") return null;
   try {
-    return execSync2(
+    return execSync3(
       `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
@@ -3187,13 +3205,13 @@ function macKeychainSet(value, service = SERVICE) {
   if (process.platform !== "darwin") return false;
   try {
     try {
-      execSync2(
+      execSync3(
         `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
         { timeout: 5e3 }
       );
     } catch {
     }
-    execSync2(
+    execSync3(
       `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
       { timeout: 5e3 }
     );
@@ -3206,7 +3224,7 @@ function macKeychainDelete(service = SERVICE) {
   if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "darwin") return false;
   try {
-    execSync2(
+    execSync3(
       `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
@@ -3218,7 +3236,7 @@ function macKeychainDelete(service = SERVICE) {
 function linuxSecretGet(service = SERVICE) {
   if (!linuxSecretAvailable()) return null;
   try {
-    return execSync2(
+    return execSync3(
       `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
@@ -3229,7 +3247,7 @@ function linuxSecretGet(service = SERVICE) {
 function linuxSecretSet(value, service = SERVICE) {
   if (!linuxSecretAvailable()) return false;
   try {
-    execSync2(
+    execSync3(
       `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
@@ -3242,7 +3260,7 @@ function linuxSecretDelete(service = SERVICE) {
   if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "linux") return false;
   try {
-    execSync2(
+    execSync3(
       `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
@@ -4179,6 +4197,24 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "When an agent encounters a suspected Exe OS bug, update breakage, MCP/tool failure, installer issue, memory/orchestration defect, or customer-local patch need, it MUST use create_bug_report. Do this before or alongside any local workaround so the report reaches AskExe support directly via the customer's license. Do NOT ask the founder for permission to file a required bug report. If create_bug_report is deferred/lazy-loaded, load it and call it. If it is unavailable in the live MCP surface, report 'create_bug_report unavailable in this session' and save a local report in exe/output \u2014 never claim the tool does not exist unless the live MCP surface was checked. If upstream delivery fails, call support_test (MCP) and include its result in the local report so AskExe can distinguish customer setup, license provisioning, and server intake issues; only ask the founder to run `exe-os support test` if MCP is disconnected/unavailable. Classify first: upstream_bug = reproducible exe-os/platform defect; customer_customization = identity, behavior, procedure, config, branding, workflow preference that belongs in customer-owned layers; emergency_hotfix = temporary local patch. For upstream bugs/emergency hotfixes include version, repro steps, expected/actual, files changed, workaround, and local diff summary. Avoid permanent platform-code patches unless founder approves; if a hotfix is unavoidable, document it in the bug report and re-check after npm update."
       },
+      {
+        title: "Bug report status check \u2014 surface available fixes on boot",
+        domain: "support",
+        priority: "p1",
+        content: "Once per session (COO boot only, never repeat), call list_my_bug_reports to check if any previously filed bug reports have been fixed by AskExe. If any report has status 'fixed' with a fixed_version, surface it to the founder immediately: '\u{1F527} N bug fix(es) available \u2014 run exe-os update to get version X.Y.Z'. This is a one-time check at boot, not a recurring poll. If no reports exist or none are fixed, skip silently. If the MCP tool is unavailable or the network call fails, skip silently \u2014 this is informational, not blocking."
+      },
+      {
+        title: "Feature request triage \u2014 upstream feature vs local customization",
+        domain: "support",
+        priority: "p0",
+        content: "When an agent or founder identifies a desired capability that exe-os does not yet provide, the COO (or equivalent coordinator) must decide: is this a local customization (identity, behavior, procedure, config, branding, workflow preference that can be configured in customer-owned layers) or an upstream feature request (a platform capability that requires changes to exe-os code, shipped via npm update)? Local customizations: implement immediately using store_behavior, update_identity, company_procedure, or config changes. Upstream features: use create_feature_request to submit to AskExe. Include use case, business impact, and current workaround. Do NOT ask the founder for permission to file a feature request \u2014 file it proactively when the need is clear."
+      },
+      {
+        title: "Feature request status check \u2014 surface shipped features on boot",
+        domain: "support",
+        priority: "p1",
+        content: "Once per session (COO boot only, never repeat), call list_my_feature_requests to check if any previously filed feature requests have been shipped by AskExe. If any request has status 'shipped' with a shipped_version, surface it to the founder immediately: '\u{1F680} N feature(s) shipped \u2014 run exe-os update to get version X.Y.Z'. This is a one-time check at boot, not a recurring poll. If no requests exist or none are shipped, skip silently. If the MCP tool is unavailable or the network call fails, skip silently \u2014 this is informational, not blocking."
+      },
       // --- Operations ---
       {
         title: "Managers must supervise deployed workers",
@@ -5453,7 +5489,7 @@ var init_session_registry = __esm({
 });
 
 // src/lib/session-key.ts
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 function normalizeCommand(command) {
   const trimmed = command.trim().toLowerCase();
   const parts = trimmed.split(/[\\/]/);
@@ -5472,7 +5508,7 @@ function resolveRuntimeProcess() {
   let pid = process.ppid;
   for (let i = 0; i < 10; i++) {
     try {
-      const info = execSync3(`ps -p ${pid} -o ppid=,comm=`, {
+      const info = execSync4(`ps -p ${pid} -o ppid=,comm=`, {
         encoding: "utf8",
         timeout: 2e3
       }).trim();
@@ -5638,14 +5674,14 @@ var init_transport = __esm({
 });
 
 // src/lib/cc-agent-support.ts
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 function _resetCcAgentSupportCache() {
   _cachedSupport = null;
 }
 function claudeSupportsAgentFlag() {
   if (_cachedSupport !== null) return _cachedSupport;
   try {
-    const helpOutput = execSync4("claude --help 2>&1", {
+    const helpOutput = execSync5("claude --help 2>&1", {
       encoding: "utf-8",
       timeout: 5e3
     });
@@ -6158,7 +6194,7 @@ var init_session_kill_telemetry = __esm({
 });
 
 // src/lib/project-name.ts
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync6 } from "child_process";
 import path15 from "path";
 function getProjectName(cwd) {
   const dir = cwd ?? process.cwd();
@@ -6166,7 +6202,7 @@ function getProjectName(cwd) {
   try {
     let repoRoot;
     try {
-      const gitCommonDir = execSync5("git rev-parse --path-format=absolute --git-common-dir", {
+      const gitCommonDir = execSync6("git rev-parse --path-format=absolute --git-common-dir", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -6174,7 +6210,7 @@ function getProjectName(cwd) {
       }).trim();
       repoRoot = path15.dirname(gitCommonDir);
     } catch {
-      repoRoot = execSync5("git rev-parse --show-toplevel", {
+      repoRoot = execSync6("git rev-parse --show-toplevel", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -6281,7 +6317,7 @@ __export(tasks_crud_exports, {
 import crypto4 from "crypto";
 import path16 from "path";
 import os11 from "os";
-import { execSync as execSync6 } from "child_process";
+import { execSync as execSync7 } from "child_process";
 import { mkdir as mkdir4, writeFile as writeFile4, appendFile } from "fs/promises";
 import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
 async function writeCheckpoint(input) {
@@ -6626,14 +6662,14 @@ function isTmuxSessionAlive(identifier) {
   if (!identifier || identifier === "unknown") return true;
   try {
     if (identifier.startsWith("%")) {
-      const output = execSync6("tmux list-panes -a -F '#{pane_id}'", {
+      const output = execSync7("tmux list-panes -a -F '#{pane_id}'", {
         timeout: 2e3,
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"]
       });
       return output.split("\n").some((l) => l.trim() === identifier);
     } else {
-      execSync6(`tmux has-session -t ${JSON.stringify(identifier)}`, {
+      execSync7(`tmux has-session -t ${JSON.stringify(identifier)}`, {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -6642,7 +6678,7 @@ function isTmuxSessionAlive(identifier) {
   } catch {
     if (identifier.startsWith("%")) return true;
     try {
-      execSync6("tmux list-sessions", {
+      execSync7("tmux list-sessions", {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -6657,12 +6693,12 @@ function checkStaleCompletion(taskContext, taskCreatedAt) {
   if (!DELEGATION_KEYWORDS.test(taskContext)) return null;
   try {
     const since = new Date(taskCreatedAt).toISOString();
-    const branch = execSync6(
+    const branch = execSync7(
       "git rev-parse --abbrev-ref HEAD 2>/dev/null",
       { encoding: "utf8", timeout: 3e3 }
     ).trim();
     const branchArg = branch && branch !== "HEAD" ? branch : "";
-    const commitCount = execSync6(
+    const commitCount = execSync7(
       `git log --oneline --since="${since}" ${branchArg} 2>/dev/null | wc -l`,
       { encoding: "utf8", timeout: 5e3 }
     ).trim();
@@ -8261,7 +8297,7 @@ __export(tmux_routing_exports, {
   spawnEmployee: () => spawnEmployee,
   verifyPaneAtCapacity: () => verifyPaneAtCapacity
 });
-import { execFileSync as execFileSync2, execSync as execSync7 } from "child_process";
+import { execFileSync as execFileSync2, execSync as execSync8 } from "child_process";
 import { readFileSync as readFileSync12, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8, existsSync as existsSync17, appendFileSync, readdirSync as readdirSync4 } from "fs";
 import path20 from "path";
 import os12 from "os";
@@ -8982,7 +9018,7 @@ function spawnEmployee(employeeName, exeSession2, projectDir, opts) {
   let booted = false;
   for (let i = 0; i < 30; i++) {
     try {
-      execSync7("sleep 0.5");
+      execSync8("sleep 0.5");
     } catch {
     }
     try {
@@ -9100,7 +9136,7 @@ __export(git_task_sweep_exports, {
   matchScore: () => matchScore,
   sweepTasks: () => sweepTasks
 });
-import { execSync as execSync8 } from "child_process";
+import { execSync as execSync9 } from "child_process";
 function extractKeywords(text) {
   return text.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length >= 3 && !STOP_WORDS.has(w));
 }
@@ -9129,7 +9165,7 @@ function matchScore(task, commitMessage, changedFiles) {
 function getRecentCommits(limit = DEFAULT_COMMIT_LIMIT) {
   try {
     const SEPARATOR = "<<SEP>>";
-    const output = execSync8(
+    const output = execSync9(
       `git log --format="%h${SEPARATOR}%s${SEPARATOR}%aI" --name-only -n ${limit} -z`,
       { encoding: "utf8", timeout: 1e4 }
     );
@@ -9320,12 +9356,12 @@ __export(worktree_exports, {
   worktreeBranch: () => worktreeBranch,
   worktreePath: () => worktreePath
 });
-import { execSync as execSync9 } from "child_process";
+import { execSync as execSync10 } from "child_process";
 import { existsSync as existsSync18, readFileSync as readFileSync13, appendFileSync as appendFileSync2, mkdirSync as mkdirSync9, realpathSync } from "fs";
 import path21 from "path";
 function getGitRoot(dir) {
   try {
-    const root = execSync9("git rev-parse --show-toplevel", {
+    const root = execSync10("git rev-parse --show-toplevel", {
       cwd: dir,
       encoding: "utf-8",
       timeout: GIT_TIMEOUT_MS,
@@ -9338,7 +9374,7 @@ function getGitRoot(dir) {
 }
 function getMainRepoRoot(dir) {
   try {
-    const commonDir = execSync9(
+    const commonDir = execSync10(
       "git rev-parse --path-format=absolute --git-common-dir",
       { cwd: dir, encoding: "utf-8", timeout: GIT_TIMEOUT_MS, stdio: ["pipe", "pipe", "pipe"] }
     ).trim();
@@ -9369,7 +9405,7 @@ function ensureWorktree(projectDir, employeeName, instance) {
   mkdirSync9(worktreesDir, { recursive: true });
   ensureGitignoreEntry(repoRoot, "/.worktrees/");
   try {
-    execSync9("git worktree prune", {
+    execSync10("git worktree prune", {
       cwd: repoRoot,
       encoding: "utf-8",
       timeout: GIT_TIMEOUT_MS,
@@ -9380,14 +9416,14 @@ function ensureWorktree(projectDir, employeeName, instance) {
   const branchExists = branchExistsLocally(repoRoot, branch);
   try {
     if (branchExists) {
-      execSync9(`git worktree add "${wtPath}" "${branch}"`, {
+      execSync10(`git worktree add "${wtPath}" "${branch}"`, {
         cwd: repoRoot,
         encoding: "utf-8",
         timeout: GIT_TIMEOUT_MS,
         stdio: ["pipe", "pipe", "pipe"]
       });
     } else {
-      execSync9(`git worktree add "${wtPath}" -b "${branch}" HEAD`, {
+      execSync10(`git worktree add "${wtPath}" -b "${branch}" HEAD`, {
         cwd: repoRoot,
         encoding: "utf-8",
         timeout: GIT_TIMEOUT_MS,
@@ -9405,7 +9441,7 @@ function ensureWorktree(projectDir, employeeName, instance) {
 }
 function isWorktreeDirty(wtPath) {
   try {
-    const status = execSync9("git status --porcelain", {
+    const status = execSync10("git status --porcelain", {
       cwd: wtPath,
       encoding: "utf-8",
       timeout: GIT_TIMEOUT_MS,
@@ -9435,7 +9471,7 @@ function cleanupWorktree(projectDir, employeeName, instance) {
     return { cleaned: false, reason: `branch ${branch} not merged into ${mainBranch}` };
   }
   try {
-    execSync9(`git worktree remove "${wtPath}"`, {
+    execSync10(`git worktree remove "${wtPath}"`, {
       cwd: repoRoot,
       encoding: "utf-8",
       timeout: GIT_TIMEOUT_MS,
@@ -9448,7 +9484,7 @@ function cleanupWorktree(projectDir, employeeName, instance) {
     };
   }
   try {
-    execSync9(`git branch -d "${branch}"`, {
+    execSync10(`git branch -d "${branch}"`, {
       cwd: repoRoot,
       encoding: "utf-8",
       timeout: GIT_TIMEOUT_MS,
@@ -9460,7 +9496,7 @@ function cleanupWorktree(projectDir, employeeName, instance) {
 }
 function branchExistsLocally(repoRoot, branch) {
   try {
-    execSync9(`git rev-parse --verify "refs/heads/${branch}"`, {
+    execSync10(`git rev-parse --verify "refs/heads/${branch}"`, {
       cwd: repoRoot,
       encoding: "utf-8",
       timeout: GIT_TIMEOUT_MS,
@@ -9479,7 +9515,7 @@ function detectMainBranch(repoRoot) {
 }
 function isBranchMerged(repoRoot, branch, into) {
   try {
-    const merged = execSync9(`git branch --merged "${into}"`, {
+    const merged = execSync10(`git branch --merged "${into}"`, {
       cwd: repoRoot,
       encoding: "utf-8",
       timeout: GIT_TIMEOUT_MS,
@@ -9526,7 +9562,7 @@ init_database();
 init_task_scope();
 init_project_name();
 import crypto7 from "crypto";
-import { execSync as execSync10 } from "child_process";
+import { execSync as execSync11 } from "child_process";
 var agentName = process.argv[2];
 var exeSession = process.argv[3];
 if (!agentName) process.exit(0);
@@ -9702,7 +9738,7 @@ try {
     }
     const msg = `session-ended: ${agentName} session terminated. ${parts.join(". ")}`;
     try {
-      execSync10(`tmux send-keys -t ${JSON.stringify(exeSession)} ${JSON.stringify(msg)} Enter`, {
+      execSync11(`tmux send-keys -t ${JSON.stringify(exeSession)} ${JSON.stringify(msg)} Enter`, {
         timeout: 3e3
       });
     } catch {
@@ -9718,6 +9754,11 @@ try {
   }
 } catch {
 }
+try {
+  const client = getClient();
+  await client.execute("PRAGMA wal_checkpoint(PASSIVE)");
+} catch {
+}
 try {
   const { cleanupWorktree: cleanupWorktree2 } = await Promise.resolve().then(() => (init_worktree(), worktree_exports));
   const cleanup = cleanupWorktree2(process.cwd(), agentName);