@askexenow/exe-os 0.9.92 → 0.9.94

package/dist/bin/cli.js

@@ -2660,8 +2660,8 @@ function deriveMachineKey() {
 }
 function readMachineId() {
   try {
-    const { readFileSync: readFileSync37 } = __require("fs");
-    return readFileSync37("/etc/machine-id", "utf-8").trim();
+    const { readFileSync: readFileSync39 } = __require("fs");
+    return readFileSync39("/etc/machine-id", "utf-8").trim();
   } catch {
     return "";
   }
@@ -3751,8 +3751,8 @@ function findPackageRoot() {
 function getAvailableMemoryGB() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync19 } = __require("child_process");
-      const vmstat = execSync19("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync20 } = __require("child_process");
+      const vmstat = execSync20("vm_stat", { encoding: "utf8" });
       const pageSize = 16384;
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -5412,6 +5412,20 @@ async function ensureSchema() {
     });
   } catch {
   }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE tasks ADD COLUMN spawn_runtime TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE tasks ADD COLUMN spawn_model TEXT`,
+      args: []
+    });
+  } catch {
+  }
   await client.executeMultiple(`
     CREATE VIRTUAL TABLE IF NOT EXISTS conversations_fts USING fts5(
       content_text,
@@ -5663,6 +5677,22 @@ async function ensureSchema() {
     );
   } catch {
   }
+  for (const col of [
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT"
+  ]) {
+    try {
+      await client.execute(col);
+    } catch {
+    }
+  }
+  try {
+    await client.execute({
+      sql: `UPDATE memories SET valid_from = timestamp WHERE valid_from IS NULL`,
+      args: []
+    });
+  } catch {
+  }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN memory_type TEXT DEFAULT 'raw'`,
@@ -5705,6 +5735,13 @@ async function ensureSchema() {
     } catch {
     }
   }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE memories ADD COLUMN procedure_for TEXT`,
+      args: []
+    });
+  } catch {
+  }
   try {
     await client.execute({
       sql: `UPDATE tasks SET status = 'closed' WHERE status = 'done' AND result IS NOT NULL`,
@@ -6146,8 +6183,8 @@ async function validateLicense(apiKey, deviceId) {
 }
 function getCacheAgeMs() {
   try {
-    const { statSync: statSync8 } = __require("fs");
-    const s = statSync8(CACHE_PATH);
+    const { statSync: statSync9 } = __require("fs");
+    const s = statSync9(CACHE_PATH);
     return Date.now() - s.mtimeMs;
   } catch {
     return Infinity;
@@ -6321,7 +6358,7 @@ var init_license = __esm({
     LICENSE_PATH = path13.join(EXE_AI_DIR, "license.key");
     CACHE_PATH = path13.join(EXE_AI_DIR, "license-cache.json");
     DEVICE_ID_PATH = path13.join(EXE_AI_DIR, "device-id");
-    API_BASE = "https://askexe.com/cloud";
+    API_BASE = process.env.EXE_CLOUD_ENDPOINT ?? "https://askexe.com/cloud";
     RETRY_DELAY_MS = 500;
     LICENSE_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
@@ -8894,6 +8931,20 @@ var init_platform_procedures = __esm({
         priority: "p1",
         content: "Once per session (COO boot only, never repeat), call list_my_feature_requests to check if any previously filed feature requests have been shipped by AskExe. If any request has status 'shipped' with a shipped_version, surface it to the founder immediately: '\u{1F680} N feature(s) shipped \u2014 run exe-os update to get version X.Y.Z'. This is a one-time check at boot, not a recurring poll. If no requests exist or none are shipped, skip silently. If the MCP tool is unavailable or the network call fails, skip silently \u2014 this is informational, not blocking."
       },
+      // --- Tool guidance ---
+      {
+        title: "How to use company_actions \u2014 execute business actions through gateway connectors",
+        domain: "tools",
+        priority: "p2",
+        content: "The company_actions tool executes business actions through gateway connectors (e.g. send WhatsApp, trigger workflows, update CRM). It routes through the exe-gateway on the VPS. Actions are defined by the customer's gateway configuration \u2014 each connector (WhatsApp, Shopify, email, etc.) exposes specific actions. Use query_company_brain to find available data first, then company_actions to act on it. Requires gateway auth token. Read-only founders should NOT use this \u2014 it mutates external state."
+      },
+      // --- Release awareness ---
+      {
+        title: "What's New check \u2014 surface new features after update",
+        domain: "support",
+        priority: "p1",
+        content: "Once per session (COO boot only, never repeat), check if the installed exe-os version is newer than the last session. If it is, read the bundled release-notes.json (at the package root) and surface a brief summary to the founder: 'Updated to exe-os vX.Y.Z \u2014 N new features, M fixes.' List the top 3 features by name. This helps the founder know what they got from the update. If release-notes.json doesn't exist or the version hasn't changed, skip silently. Never repeat this check in the same session."
+      },
       // --- Platform vs Customer ownership ---
       {
         title: "What the platform provides vs what you customize",
@@ -8982,13 +9033,13 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 memory, decision, and search",
         domain: "tool-use",
         priority: "p1",
-        content: `memory(action="recall") / recall_my_memory: search your own memories (semantic + FTS). memory(action="ask_team") / ask_team_memory: search a colleague's memories by agent name. memory(action="store") / store_memory: persist a memory. memory(action="commit") / commit_memory: high-importance memory that survives consolidation. Requires summary. memory(action="search") / search_everything: unified search across memories, tasks, entities, conversations. memory(action="session_context") / get_session_context: temporal memory window. Requires session_id + target_timestamp. memory(action="consolidate") / consolidate_memories: merge duplicate/related memories. memory(action="cardinality") / get_memory_cardinality: count memories per agent. decision(action="store") / store_decision: record an architectural decision (domain, decision, rationale). decision(action="get") / get_decision: retrieve a past decision by domain or query.`
+        content: `memory(action="recall") / recall_my_memory: search your own memories (semantic + FTS). Supports as_of param for bi-temporal queries (what did I know at time X?), kind param to filter by memory type (decision, procedure, observation, raw, conversation, behavior). memory(action="ask_team") / ask_team_memory: search a colleague's memories by agent name. memory(action="store") / store_memory: persist a memory. Supports kind param and procedure_for domain tag for procedure-type memories. memory(action="commit") / commit_memory: high-importance memory that survives consolidation. Requires summary. memory(action="search") / search_everything: unified search across memories, tasks, entities, conversations. memory(action="session_context") / get_session_context: temporal memory window. Requires session_id + target_timestamp. memory(action="consolidate") / consolidate_memories: merge duplicate/related memories. memory(action="cardinality") / get_memory_cardinality: count memories per agent. memory(action="supersede") / supersede: replace an old memory with a new version (old_id + new text). decision(action="store") / store_decision: record an architectural decision (domain, decision, rationale). decision(action="get") / get_decision: retrieve a past decision by domain or query.`
       },
       {
         title: "MCP tools \u2014 task orchestration",
         domain: "tool-use",
         priority: "p1",
-        content: 'task(action="create") / create_task: dispatch work (title, assigned_to, context). The ONLY dispatch path. Auto-spawns session. task(action="list") / list_tasks: query tasks by status, assignee, project. task(action="get") / get_task: fetch full task details by task_id. task(action="update") / update_task: change status (in_progress, done, blocked, cancelled) + result summary. task(action="close") / close_task: finalize a reviewed task (COO only). task(action="checkpoint") / checkpoint_task: save progress state for crash recovery. task(action="resume") / resume_employee: re-spawn an employee session for an existing task.'
+        content: `task(action="create") / create_task: dispatch work (title, assigned_to, context). The ONLY dispatch path. Auto-spawns session. Supports spawn_runtime and spawn_model params to override the agent's default runtime/model for a specific task. task(action="list") / list_tasks: query tasks by status, assignee, project. task(action="get") / get_task: fetch full task details by task_id. task(action="update") / update_task: change status (in_progress, done, blocked, cancelled) + result summary. task(action="close") / close_task: finalize a reviewed task (COO only). task(action="checkpoint") / checkpoint_task: save progress state for crash recovery. task(action="resume") / resume_employee: re-spawn an employee session for an existing task.`
       },
       {
         title: "MCP tools \u2014 knowledge graph (GraphRAG)",
@@ -9018,7 +9069,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 admin, config, and operations",
         domain: "tool-use",
         priority: "p1",
-        content: 'config(action="list_employees"): view roster. config(action="agent_spend"): token usage per agent. config(action="daemon_health"): check exed status. config(action="license_status"): check license. config(action="cloud_sync"): force sync. config(action="memory_audit"): health check (dupes, null vectors). config(action="run_consolidation"): trigger memory consolidation. config(action="company_procedure", subaction="store|list|deactivate"): manage company procedures. config(action="global_procedure"): list all procedures (platform + company). config(action="create_trigger|list_triggers"): scheduled agent jobs. config(action="export_orchestration|import_orchestration"): portable org state. diagnostics(action="healthcheck|doctor|status_brief|check_update|cloud_status"): system diagnostics. mcp_ping(): daemon health + license status + tool usage stats.'
+        content: 'config(action="list_employees"): view roster. config(action="agent_spend"): token usage per agent. config(action="daemon_health"): check exed status. config(action="license_status"): check license. config(action="cloud_sync"): force sync. config(action="memory_audit"): health check (dupes, null vectors). config(action="run_consolidation"): trigger memory consolidation. config(action="company_procedure", subaction="store|list|deactivate"): manage company procedures. config(action="global_procedure"): list all procedures (platform + company). config(action="create_trigger|list_triggers"): scheduled agent jobs. config(action="export_orchestration|import_orchestration"): portable org state. diagnostics(action="healthcheck|doctor|status_brief|check_update|cloud_status"): system diagnostics. diagnostics(action="tool_search"): semantic tool discovery \u2014 find relevant MCP tools by natural language query. Returns top-K tools ranked by relevance. diagnostics(action="drift"): identity drift detection \u2014 score how far an agent has drifted from its role identity. Returns drift score + recommendations. mcp_ping(): daemon health + license status + tool usage stats.'
       }
     ];
     PLATFORM_PROCEDURE_TITLES = new Set(
@@ -9702,6 +9753,8 @@ async function writeMemory(record) {
     source_type: record.source_type ?? null,
     tier: record.tier ?? classifyTier(record),
     supersedes_id: record.supersedes_id ?? null,
+    valid_from: record.valid_from ?? record.timestamp,
+    invalid_at: record.invalid_at ?? null,
     draft: record.draft ? 1 : 0,
     memory_type: memoryType,
     trajectory: record.trajectory ? JSON.stringify(record.trajectory) : null,
@@ -9720,7 +9773,8 @@ async function writeMemory(record) {
     token_cost: record.token_cost ?? null,
     audience: record.audience ?? null,
     language_type: record.language_type ?? inferLanguageType(record),
-    parent_memory_id: record.parent_memory_id ?? null
+    parent_memory_id: record.parent_memory_id ?? null,
+    procedure_for: record.procedure_for ?? null
   };
   _pendingRecords.push(dbRow);
   orgBus.emit({
@@ -9775,6 +9829,8 @@ async function flushBatch() {
       const sourceType = row.source_type ?? null;
       const tier = row.tier ?? 3;
       const supersedesId = row.supersedes_id ?? null;
+      const validFrom = row.valid_from ?? row.timestamp;
+      const invalidAt = row.invalid_at ?? null;
       const draft = row.draft ? 1 : 0;
       const memoryType = row.memory_type ?? "raw";
       const trajectory = row.trajectory ?? null;
@@ -9794,15 +9850,16 @@ async function flushBatch() {
       const audience = row.audience ?? null;
       const languageType = row.language_type ?? null;
       const parentMemoryId = row.parent_memory_id ?? null;
+      const procedureFor = row.procedure_for ?? null;
       const cols = `id, agent_id, agent_role, session_id, timestamp,
                tool_name, project_name,
                has_error, raw_text, vector, version, task_id, importance, status,
                confidence, last_accessed,
                workspace_id, document_id, user_id, char_offset, page_number,
-               source_path, source_type, tier, supersedes_id, draft, memory_type, trajectory, content_hash,
+               source_path, source_type, tier, supersedes_id, valid_from, invalid_at, draft, memory_type, trajectory, content_hash,
                intent, outcome, domain, referenced_entities, retrieval_count,
                chain_position, review_status, context_window_pct, file_paths, commit_hash,
-               duration_ms, token_cost, audience, language_type, parent_memory_id`;
+               duration_ms, token_cost, audience, language_type, parent_memory_id, procedure_for`;
       const metaArgs = [
         intent,
         outcome,
@@ -9818,7 +9875,8 @@ async function flushBatch() {
         tokenCost,
         audience,
         languageType,
-        parentMemoryId
+        parentMemoryId,
+        procedureFor
       ];
       const baseArgs = [
         row.id,
@@ -9847,6 +9905,8 @@ async function flushBatch() {
         sourceType,
         tier,
         supersedesId,
+        validFrom,
+        invalidAt,
         draft,
         memoryType,
         trajectory,
@@ -9854,8 +9914,8 @@ async function flushBatch() {
       ];
       return {
         sql: hasVector ? `INSERT OR IGNORE INTO memories (${cols})
-              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, vector32(?), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)` : `INSERT OR IGNORE INTO memories (${cols})
-              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, vector32(?), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)` : `INSERT OR IGNORE INTO memories (${cols})
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         args: hasVector ? [...baseArgs, vectorToBlob(row.vector), ...sharedArgs, ...metaArgs] : [...baseArgs, ...sharedArgs, ...metaArgs]
       };
     };
@@ -9971,6 +10031,12 @@ async function searchMemories(queryVector, agentId, options) {
                AND vector IS NOT NULL${statusFilter}${draftFilter}
                AND COALESCE(confidence, 0.7) >= 0.3`;
   const args2 = [agentId];
+  if (options?.asOf) {
+    sql += ` AND (valid_from IS NULL OR valid_from <= ?) AND (invalid_at IS NULL OR invalid_at > ?)`;
+    args2.push(options.asOf, options.asOf);
+  } else {
+    sql += ` AND invalid_at IS NULL`;
+  }
   const scope = buildWikiScopeFilter(options, "");
   sql += scope.clause;
   args2.push(...scope.args);
@@ -12351,9 +12417,9 @@ Unclassified: ${unclassified}
 }
 async function exportBatches(options) {
   const fs8 = await import("fs");
-  const path56 = await import("path");
+  const path58 = await import("path");
   const client = getClient();
-  const outDir = path56.join(process.cwd(), "exe/output/classifications/input");
+  const outDir = path58.join(process.cwd(), "exe/output/classifications/input");
   fs8.mkdirSync(outDir, { recursive: true });
   const countResult = await client.execute({
     sql: "SELECT COUNT(*) as cnt FROM memories WHERE intent IS NULL AND outcome IS NULL AND domain IS NULL",
@@ -12377,7 +12443,7 @@ async function exportBatches(options) {
       const text = String(row.text || "").replace(/\n/g, " ");
       return JSON.stringify({ id: row.id, text });
     });
-    const batchFile = path56.join(outDir, `batch-${String(batchNum).padStart(4, "0")}.jsonl`);
+    const batchFile = path58.join(outDir, `batch-${String(batchNum).padStart(4, "0")}.jsonl`);
     fs8.writeFileSync(batchFile, lines.join("\n") + "\n");
     exported += batch.rows.length;
     offset += options.batchSize;
@@ -12393,7 +12459,7 @@ async function exportBatches(options) {
 }
 async function importClassifications(importDir) {
   const fs8 = await import("fs");
-  const path56 = await import("path");
+  const path58 = await import("path");
   const client = getClient();
   const files = fs8.readdirSync(importDir).filter((f) => f.endsWith(".jsonl")).sort();
   process.stderr.write(`[backfill-metadata] Found ${files.length} JSONL files to import from ${importDir}
@@ -12401,7 +12467,7 @@ async function importClassifications(importDir) {
   let imported = 0;
   let invalid = 0;
   for (const file of files) {
-    const lines = fs8.readFileSync(path56.join(importDir, file), "utf-8").split("\n").filter(Boolean);
+    const lines = fs8.readFileSync(path58.join(importDir, file), "utf-8").split("\n").filter(Boolean);
     for (const line of lines) {
       try {
         const rec = JSON.parse(line);
@@ -13572,8 +13638,8 @@ function logQueue(msg) {
   process.stderr.write(`[intercom-queue] ${msg}
 `);
   try {
-    const { appendFileSync: appendFileSync3 } = __require("fs");
-    appendFileSync3(INTERCOM_LOG, line);
+    const { appendFileSync: appendFileSync4 } = __require("fs");
+    appendFileSync4(INTERCOM_LOG, line);
   } catch {
   }
 }
@@ -14131,8 +14197,8 @@ ${scopeMismatchWarning}` : scopeMismatchWarning;
   const complexity = input.complexity ?? "standard";
   const sessionScope = earlySessionScope;
   await client.execute({
-    sql: `INSERT INTO tasks (id, title, assigned_to, assigned_by, project_name, priority, status, task_file, blocked_by, parent_task_id, reviewer, context, complexity, budget_tokens, budget_fallback_model, tokens_used, tokens_warned_at, session_scope, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    sql: `INSERT INTO tasks (id, title, assigned_to, assigned_by, project_name, priority, status, task_file, blocked_by, parent_task_id, reviewer, context, complexity, budget_tokens, budget_fallback_model, tokens_used, tokens_warned_at, session_scope, spawn_runtime, spawn_model, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
     args: [
       id,
       input.title,
@@ -14152,6 +14218,8 @@ ${scopeMismatchWarning}` : scopeMismatchWarning;
       0,
       null,
       sessionScope,
+      input.spawnRuntime ?? null,
+      input.spawnModel ?? null,
       now2,
       now2
     ]
@@ -14208,7 +14276,9 @@ ${input.context}
     budgetTokens: input.budgetTokens ?? null,
     budgetFallbackModel: input.budgetFallbackModel ?? null,
     tokensUsed: 0,
-    tokensWarnedAt: null
+    tokensWarnedAt: null,
+    spawnRuntime: input.spawnRuntime ?? null,
+    spawnModel: input.spawnModel ?? null
   };
 }
 async function listTasks(input) {
@@ -14258,7 +14328,9 @@ async function listTasks(input) {
     budgetTokens: r.budget_tokens !== null ? Number(r.budget_tokens) : null,
     budgetFallbackModel: r.budget_fallback_model !== null ? String(r.budget_fallback_model) : null,
     tokensUsed: Number(r.tokens_used ?? 0),
-    tokensWarnedAt: r.tokens_warned_at !== null ? Number(r.tokens_warned_at) : null
+    tokensWarnedAt: r.tokens_warned_at !== null ? Number(r.tokens_warned_at) : null,
+    spawnRuntime: r.spawn_runtime !== null && r.spawn_runtime !== void 0 ? String(r.spawn_runtime) : null,
+    spawnModel: r.spawn_model !== null && r.spawn_model !== void 0 ? String(r.spawn_model) : null
   }));
 }
 function isTmuxSessionAlive(identifier) {
@@ -15039,10 +15111,10 @@ async function disposeEmbedder() {
 async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync41 } = await import("fs");
-  const path56 = await import("path");
-  const modelPath = path56.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync41(modelPath)) {
+  const { existsSync: existsSync43 } = await import("fs");
+  const path58 = await import("path");
+  const modelPath = path58.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync43(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -15555,6 +15627,8 @@ async function updateTask(input) {
     budgetFallbackModel: row.budget_fallback_model !== void 0 && row.budget_fallback_model !== null ? String(row.budget_fallback_model) : null,
     tokensUsed: Number(row.tokens_used ?? 0),
     tokensWarnedAt: row.tokens_warned_at !== void 0 && row.tokens_warned_at !== null ? Number(row.tokens_warned_at) : null,
+    spawnRuntime: row.spawn_runtime !== void 0 && row.spawn_runtime !== null ? String(row.spawn_runtime) : null,
+    spawnModel: row.spawn_model !== void 0 && row.spawn_model !== null ? String(row.spawn_model) : null,
     nextTask
   };
 }
@@ -16050,6 +16124,7 @@ function resolveExeSession() {
   const mySession = getMySession();
   if (!mySession) return null;
   const fromSessionName = extractRootExe(mySession);
+  let candidate = null;
   try {
     const key = getSessionKey();
     const parentExe = getParentExe(key);
@@ -16060,13 +16135,47 @@ function resolveExeSession() {
           `[tmux-routing] WARN: cache says "${fromCache}" but session name says "${fromSessionName}". Trusting session name.
 `
         );
-        return fromSessionName;
+        candidate = fromSessionName;
+      } else {
+        candidate = fromCache;
       }
-      return fromCache;
     }
   } catch {
   }
-  return fromSessionName ?? mySession;
+  if (!candidate) {
+    candidate = fromSessionName ?? mySession;
+  }
+  if (candidate && isRootSession(candidate)) {
+    try {
+      const transport = getTransport();
+      const liveSessions = transport.listSessions();
+      if (!liveSessions.includes(candidate)) {
+        const liveRoots = liveSessions.filter((s) => isRootSession(s));
+        if (liveRoots.length === 1) {
+          process.stderr.write(
+            `[tmux-routing] WARN: resolved session "${candidate}" is dead. Using live coordinator "${liveRoots[0]}".
+`
+          );
+          return liveRoots[0];
+        } else if (liveRoots.length > 1) {
+          const base = candidate.replace(/\d+$/, "");
+          const match = liveRoots.find((s) => s.startsWith(base));
+          const chosen = match ?? liveRoots[0];
+          process.stderr.write(
+            `[tmux-routing] WARN: resolved session "${candidate}" is dead. ${liveRoots.length} live roots found, using "${chosen}".
+`
+          );
+          return chosen;
+        }
+        process.stderr.write(
+          `[tmux-routing] WARN: resolved session "${candidate}" is dead and no live coordinator found.
+`
+        );
+      }
+    } catch {
+    }
+  }
+  return candidate;
 }
 function isEmployeeAlive(sessionName) {
   return getTransport().isAlive(sessionName);
@@ -16468,7 +16577,12 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   }
   const spawnCwd = opts?.cwd ?? projectDir;
   const useExeAgent = !!(opts?.model && opts?.provider);
-  const agentRtConfig = getAgentRuntime(employeeName);
+  const baseRtConfig = getAgentRuntime(employeeName);
+  const agentRtConfig = {
+    ...baseRtConfig,
+    ...opts?.runtimeOverride ? { runtime: opts.runtimeOverride } : {},
+    ...opts?.modelOverride ? { model: opts.modelOverride } : {}
+  };
   const useCodex = !useExeAgent && agentRtConfig.runtime === "codex";
   const useOpencode = !useExeAgent && !useCodex && agentRtConfig.runtime === "opencode";
   const ccProvider = useExeAgent || useCodex || useOpencode ? DEFAULT_PROVIDER : detectActiveProvider();
@@ -18012,17 +18126,980 @@ var init_exe_rename = __esm({
   }
 });
 
+// src/lib/drift-probes.ts
+async function getRecentMemories(agentId, limit) {
+  try {
+    const { getClient: getClient2, isInitialized: isInitialized2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+    if (!isInitialized2()) return { count: 0, texts: [] };
+    const client = getClient2();
+    const result = await client.execute({
+      sql: `SELECT text FROM memories WHERE agent_id = ? ORDER BY created_at DESC LIMIT ?`,
+      args: [agentId, limit]
+    });
+    const texts = result.rows.map((r) => String(r.text ?? ""));
+    return { count: texts.length, texts };
+  } catch {
+    return { count: 0, texts: [] };
+  }
+}
+async function getDecisionCount(agentId) {
+  try {
+    const { getClient: getClient2, isInitialized: isInitialized2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+    if (!isInitialized2()) return 0;
+    const client = getClient2();
+    const result = await client.execute({
+      sql: `SELECT COUNT(*) as cnt FROM memories WHERE agent_id = ? AND memory_type = 'decision'`,
+      args: [agentId]
+    });
+    return Number(result.rows[0]?.cnt ?? 0);
+  } catch {
+    return 0;
+  }
+}
+function probeContinuity(ctx) {
+  const memCount = ctx.recentMemoryCount;
+  let score;
+  let detail;
+  if (memCount >= 20) {
+    score = 95;
+    detail = `${memCount} recent memories \u2014 strong continuity`;
+  } else if (memCount >= 10) {
+    score = 85;
+    detail = `${memCount} recent memories \u2014 adequate continuity`;
+  } else if (memCount >= 3) {
+    score = 70;
+    detail = `${memCount} recent memories \u2014 limited continuity`;
+  } else if (memCount >= 1) {
+    score = 50;
+    detail = `${memCount} recent memories \u2014 weak continuity`;
+  } else {
+    score = 30;
+    detail = "No recent memories \u2014 agent may lack session context";
+  }
+  if (ctx.storedDecisionCount > 0) {
+    score = Math.min(100, score + 5);
+    detail += ` (+${ctx.storedDecisionCount} decisions)`;
+  }
+  return { axis: "continuity", score, detail };
+}
+function probeConsistency(ctx) {
+  if (!ctx.identityBody || ctx.recentMemoryTexts.length === 0) {
+    return {
+      axis: "consistency",
+      score: ctx.identityBody ? 80 : 50,
+      detail: ctx.identityBody ? "No memories to check against identity" : "No identity file \u2014 cannot assess consistency"
+    };
+  }
+  const identityTerms = extractKeyTerms(ctx.identityBody);
+  if (identityTerms.length === 0) {
+    return { axis: "consistency", score: 75, detail: "Identity has no extractable key terms" };
+  }
+  const memoryText = ctx.recentMemoryTexts.join(" ").toLowerCase();
+  let matched = 0;
+  for (const term of identityTerms) {
+    if (memoryText.includes(term.toLowerCase())) matched++;
+  }
+  const ratio = matched / identityTerms.length;
+  const score = Math.round(50 + ratio * 50);
+  const detail = `${matched}/${identityTerms.length} identity terms found in recent memories`;
+  return { axis: "consistency", score, detail };
+}
+function probeRoleFidelity(ctx) {
+  const flags = [];
+  if (!ctx.identityBody) {
+    return {
+      axis: "role-fidelity",
+      score: 40,
+      detail: `No identity file for ${ctx.agent.name}`
+    };
+  }
+  let score = 100;
+  const identityLower = ctx.identityBody.toLowerCase();
+  const rosterRole = ctx.agent.role.toLowerCase();
+  if (!identityLower.includes(rosterRole)) {
+    score -= 15;
+    flags.push(`Identity does not mention role "${ctx.agent.role}"`);
+  }
+  if (!identityLower.includes(ctx.agent.name.toLowerCase())) {
+    score -= 10;
+    flags.push(`Identity does not mention agent name "${ctx.agent.name}"`);
+  }
+  const hasScopeBoundary = identityLower.includes("do not") || identityLower.includes("don't") || identityLower.includes("not your") || identityLower.includes("outside your") || identityLower.includes("you do not");
+  if (!hasScopeBoundary) {
+    score -= 10;
+    flags.push("Identity lacks explicit scope boundaries (what NOT to do)");
+  }
+  if (ctx.agent.systemPrompt) {
+    const promptTerms = extractKeyTerms(ctx.agent.systemPrompt);
+    const identityText = ctx.identityBody.toLowerCase();
+    let promptMatched = 0;
+    for (const term of promptTerms.slice(0, 20)) {
+      if (identityText.includes(term.toLowerCase())) promptMatched++;
+    }
+    const promptRatio = promptTerms.length > 0 ? promptMatched / Math.min(promptTerms.length, 20) : 1;
+    if (promptRatio < 0.3) {
+      score -= 15;
+      flags.push("Identity content diverges significantly from roster systemPrompt");
+    }
+  }
+  if (ctx.recentMemoryTexts.length > 5) {
+    const roleKeywords = extractRoleKeywords(ctx.agent.role);
+    const memoryText = ctx.recentMemoryTexts.join(" ").toLowerCase();
+    let domainHits = 0;
+    for (const kw of roleKeywords) {
+      if (memoryText.includes(kw)) domainHits++;
+    }
+    const domainRatio = roleKeywords.length > 0 ? domainHits / roleKeywords.length : 1;
+    if (domainRatio < 0.2) {
+      score -= 10;
+      flags.push(`Recent work shows little overlap with ${ctx.agent.role} domain keywords`);
+    }
+  }
+  score = Math.max(0, Math.min(100, score));
+  const detail = flags.length > 0 ? flags.join("; ") : "Identity aligns with roster definition";
+  return { axis: "role-fidelity", score, detail };
+}
+function probeWorldModel(ctx) {
+  if (!ctx.identityBody) {
+    return {
+      axis: "world-model",
+      score: 50,
+      detail: "No identity file \u2014 cannot assess org awareness"
+    };
+  }
+  const identityLower = ctx.identityBody.toLowerCase();
+  const flags = [];
+  let score = 100;
+  const otherAgents = ctx.allEmployees.filter((e) => e.name !== ctx.agent.name);
+  let mentionedAgents = 0;
+  for (const other of otherAgents) {
+    if (identityLower.includes(other.name.toLowerCase())) mentionedAgents++;
+  }
+  if (otherAgents.length > 0) {
+    const mentionRatio = mentionedAgents / otherAgents.length;
+    if (mentionRatio < 0.3) {
+      score -= 15;
+      flags.push(`Identity mentions ${mentionedAgents}/${otherAgents.length} team members`);
+    }
+  }
+  const hasReportingChain = identityLower.includes("report") || identityLower.includes("manager") || identityLower.includes("coo") || identityLower.includes("coordinator");
+  if (!hasReportingChain) {
+    score -= 10;
+    flags.push("Identity does not reference reporting chain");
+  }
+  const orgTerms = ["exe-os", "exe-wiki", "exe-crm", "askexe"];
+  let orgMentions = 0;
+  for (const term of orgTerms) {
+    if (identityLower.includes(term)) orgMentions++;
+  }
+  if (orgMentions === 0) {
+    score -= 5;
+    flags.push("Identity does not reference any org products");
+  }
+  score = Math.max(0, Math.min(100, score));
+  const detail = flags.length > 0 ? flags.join("; ") : "Identity reflects org structure";
+  return { axis: "world-model", score, detail };
+}
+function extractKeyTerms(text) {
+  const stopwords = /* @__PURE__ */ new Set([
+    "the",
+    "and",
+    "for",
+    "are",
+    "but",
+    "not",
+    "you",
+    "all",
+    "any",
+    "can",
+    "had",
+    "her",
+    "was",
+    "one",
+    "our",
+    "out",
+    "has",
+    "his",
+    "how",
+    "its",
+    "may",
+    "new",
+    "now",
+    "old",
+    "see",
+    "way",
+    "who",
+    "did",
+    "get",
+    "got",
+    "let",
+    "say",
+    "she",
+    "too",
+    "use",
+    "with",
+    "this",
+    "that",
+    "from",
+    "they",
+    "been",
+    "have",
+    "will",
+    "your",
+    "what",
+    "when",
+    "make",
+    "like",
+    "just",
+    "over",
+    "such",
+    "take",
+    "than",
+    "them",
+    "very",
+    "some",
+    "could",
+    "into",
+    "then",
+    "more",
+    "also",
+    "after",
+    "should",
+    "would",
+    "about",
+    "their",
+    "which",
+    "these",
+    "other",
+    "every",
+    "does",
+    "being",
+    "those",
+    "never",
+    "before",
+    "through"
+  ]);
+  const words = text.replace(/[^\w\s-]/g, " ").split(/\s+/).filter((w) => w.length > 3 && !stopwords.has(w.toLowerCase()));
+  return [...new Set(words.map((w) => w.toLowerCase()))].slice(0, 50);
+}
+function extractRoleKeywords(role) {
+  const roleKeywordMap = {
+    "coo": ["coordinate", "review", "status", "team", "task", "priority", "dispatch"],
+    "cto": ["architecture", "code", "technical", "system", "design", "review", "security"],
+    "cmo": ["marketing", "brand", "content", "design", "seo", "social", "campaign"],
+    "principal engineer": ["code", "implement", "test", "fix", "feature", "refactor", "build"],
+    "staff code reviewer": ["review", "code", "quality", "issue", "fix", "pattern"],
+    "content production specialist": ["video", "image", "render", "content", "produce", "media"],
+    "ai product lead": ["competitive", "analysis", "feature", "product", "research", "repo"]
+  };
+  const normalized = role.toLowerCase();
+  return roleKeywordMap[normalized] ?? normalized.split(/\s+/).filter((w) => w.length > 2);
+}
+async function runDriftProbes(options = {}) {
+  const employees = loadEmployeesSync();
+  const targetAgents = options.agentId ? employees.filter((e) => e.name === options.agentId) : employees;
+  if (targetAgents.length === 0) {
+    return [];
+  }
+  const axes = options.axes ?? ["continuity", "consistency", "role-fidelity", "world-model"];
+  const results = [];
+  for (const agent of targetAgents) {
+    const identity = getIdentity(agent.name);
+    const { count: memCount, texts: memTexts } = await getRecentMemories(agent.name, 50);
+    const decisionCount = await getDecisionCount(agent.name);
+    const ctx = {
+      agent,
+      identityBody: identity?.body ?? null,
+      identityRole: identity?.frontmatter.role ?? null,
+      recentMemoryCount: memCount,
+      recentMemoryTexts: memTexts,
+      storedDecisionCount: decisionCount,
+      allEmployees: employees
+    };
+    const probes = [];
+    const probeFns = {
+      continuity: probeContinuity,
+      consistency: probeConsistency,
+      "role-fidelity": probeRoleFidelity,
+      "world-model": probeWorldModel
+    };
+    for (const axis of axes) {
+      probes.push(probeFns[axis](ctx));
+    }
+    const scores = {
+      continuity: 0,
+      consistency: 0,
+      "role-fidelity": 0,
+      "world-model": 0
+    };
+    for (const probe of probes) {
+      scores[probe.axis] = probe.score;
+    }
+    const weights = {
+      continuity: 0.2,
+      consistency: 0.2,
+      "role-fidelity": 0.35,
+      "world-model": 0.25
+    };
+    let weightedSum = 0;
+    let weightTotal = 0;
+    for (const axis of axes) {
+      weightedSum += scores[axis] * weights[axis];
+      weightTotal += weights[axis];
+    }
+    const overall = Math.round(weightTotal > 0 ? weightedSum / weightTotal : 0);
+    const flags = [];
+    for (const probe of probes) {
+      if (probe.score < DRIFT_THRESHOLD) {
+        flags.push(`${probe.axis} at ${probe.score}% \u2014 ${probe.detail}`);
+      }
+    }
+    results.push({
+      agent: agent.name,
+      scores,
+      overall,
+      drifting: flags.length > 0,
+      flags
+    });
+  }
+  return results;
+}
+var DRIFT_THRESHOLD;
+var init_drift_probes = __esm({
+  "src/lib/drift-probes.ts"() {
+    "use strict";
+    init_identity();
+    init_employees();
+    DRIFT_THRESHOLD = 80;
+  }
+});
+
+// src/bin/exe-drift.ts
+var exe_drift_exports = {};
+__export(exe_drift_exports, {
+  runDrift: () => runDrift
+});
+function statusIcon(overall) {
+  if (overall >= 80) return "\x1B[32m\u{1F7E2} OK\x1B[0m";
+  if (overall >= 60) return "\x1B[33m\u{1F7E0} WARN\x1B[0m";
+  return "\x1B[31m\u{1F534} DRIFTING\x1B[0m";
+}
+function padRight(str, len) {
+  return str.length >= len ? str.slice(0, len) : str + " ".repeat(len - str.length);
+}
+function padLeft(str, len) {
+  return str.length >= len ? str : " ".repeat(len - str.length) + str;
+}
+function formatTable(results) {
+  const lines = [];
+  const header = padRight("Agent", 10) + AXES.map((a) => padLeft(AXIS_HEADERS[a], 9)).join("") + padLeft("Overall", 9) + "  Status";
+  lines.push(header);
+  lines.push("-".repeat(header.length + 10));
+  for (const r of results) {
+    const line = padRight(r.agent, 10) + AXES.map((a) => padLeft(String(r.scores[a]), 9)).join("") + padLeft(String(r.overall), 9) + "  " + statusIcon(r.overall);
+    lines.push(line);
+  }
+  return lines.join("\n");
+}
+async function runDrift(args2) {
+  const agentIdx = args2.indexOf("--agent");
+  const agentId = agentIdx >= 0 ? args2[agentIdx + 1] : void 0;
+  console.log("\nexe-os doctor --drift\n");
+  const results = await runDriftProbes({ agentId });
+  if (results.length === 0) {
+    console.log("No agents found. Run /exe-team to see available employees.");
+    return;
+  }
+  console.log(formatTable(results));
+  console.log();
+  const flagged = results.filter((r) => r.flags.length > 0);
+  if (flagged.length > 0) {
+    for (const r of flagged) {
+      for (const flag of r.flags) {
+        console.log(`\u26A0 ${r.agent}: ${flag}`);
+      }
+    }
+    console.log();
+  } else {
+    console.log("All agents within role-fidelity thresholds.\n");
+  }
+}
+var AXES, AXIS_HEADERS;
+var init_exe_drift = __esm({
+  "src/bin/exe-drift.ts"() {
+    "use strict";
+    init_drift_probes();
+    AXES = ["continuity", "consistency", "role-fidelity", "world-model"];
+    AXIS_HEADERS = {
+      continuity: "Cont.",
+      consistency: "Consist.",
+      "role-fidelity": "Role",
+      "world-model": "World"
+    };
+  }
+});
+
+// src/lib/mcp-transport-health.ts
+import { appendFileSync as appendFileSync3, closeSync as closeSync3, existsSync as existsSync30, mkdirSync as mkdirSync22, openSync as openSync3, readFileSync as readFileSync26, readSync, statSync as statSync7, writeFileSync as writeFileSync23 } from "fs";
+import path37 from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+function parsePositiveInt(value, fallback) {
+  if (!value) return fallback;
+  const parsed = Number.parseInt(value, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function readTailText(filePath, maxBytes) {
+  const stats = statSync7(filePath);
+  if (stats.size <= maxBytes) return readFileSync26(filePath, "utf8");
+  const fd = openSync3(filePath, "r");
+  try {
+    const buffer = Buffer.allocUnsafe(maxBytes);
+    readSync(fd, buffer, 0, maxBytes, stats.size - maxBytes);
+    const text = buffer.toString("utf8");
+    const firstNewline = text.indexOf("\n");
+    return firstNewline >= 0 ? text.slice(firstNewline + 1) : text;
+  } finally {
+    closeSync3(fd);
+  }
+}
+function readPackageVersion2() {
+  let dir = path37.dirname(fileURLToPath5(import.meta.url));
+  const { root } = path37.parse(dir);
+  while (dir !== root) {
+    const pkgPath = path37.join(dir, "package.json");
+    if (existsSync30(pkgPath)) {
+      try {
+        const parsed = JSON.parse(readFileSync26(pkgPath, "utf8"));
+        return parsed.version ?? "unknown";
+      } catch {
+        return "unknown";
+      }
+    }
+    dir = path37.dirname(dir);
+  }
+  return "unknown";
+}
+function parseMcpHttpEventLines(raw, limit = 200) {
+  const lines = raw.trim().split("\n").filter(Boolean).slice(-limit);
+  const events = [];
+  for (const line of lines) {
+    try {
+      events.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  return events;
+}
+function readMcpHttpEvents(limit = 200) {
+  if (!existsSync30(MCP_HTTP_EVENTS_PATH)) return [];
+  const raw = readTailText(MCP_HTTP_EVENTS_PATH, EVENT_READ_BYTES);
+  return parseMcpHttpEventLines(raw, limit);
+}
+function summarizeMcpTransport(events = readMcpHttpEvents()) {
+  const lastServerStartIndex = events.map((event) => event.message).lastIndexOf("server_started");
+  const scopedEvents = lastServerStartIndex >= 0 ? events.slice(lastServerStartIndex) : events;
+  const activeSessionEvent = [...scopedEvents].reverse().find((event) => typeof event.activeSessions === "number");
+  const successfulToolCalls = scopedEvents.filter((event) => event.message === "tool_call_ok");
+  const lastSuccessfulToolCall = successfulToolCalls.at(-1) ?? null;
+  const summary = {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    version: readPackageVersion2(),
+    scope: "local",
+    privacy: "metadata_only",
+    eventLogPath: MCP_HTTP_EVENTS_PATH,
+    activeSessions: activeSessionEvent?.activeSessions ?? null,
+    sessionsCreated: scopedEvents.filter((event) => event.message === "session_initialized").length,
+    sessionsClosed: scopedEvents.filter((event) => event.message === "session_closed").length,
+    missingSessionErrors: scopedEvents.filter((event) => event.message?.includes("missing MCP session")).length,
+    staleSessionErrors: scopedEvents.filter((event) => event.message?.includes("stale or unknown")).length,
+    transportErrors: scopedEvents.filter((event) => event.level === "warn" || event.level === "error").length,
+    lastSuccessfulHandshake: scopedEvents.filter((event) => event.message === "session_initialized").at(-1)?.timestamp ?? null,
+    lastSuccessfulToolCall: lastSuccessfulToolCall?.timestamp ?? null,
+    lastSuccessfulToolCallByRuntime: {},
+    lastSuccessfulToolCallByAgent: {},
+    lastSuccessfulToolCallByFamily: {},
+    activeSessionsByRuntime: {},
+    recentWarnings: scopedEvents.filter((event) => event.level === "warn" || event.level === "error").slice(-10),
+    remediation: [
+      "If MCP tools fail with missing/stale session, reconnect the MCP client (/mcp or restart the runtime).",
+      "Do not access the database directly; MCP is the only data interface.",
+      "Check get_daemon_health or exe-healthcheck for daemon/MCP endpoint status before retrying work."
+    ]
+  };
+  const createdBySession = /* @__PURE__ */ new Map();
+  for (const event of scopedEvents) {
+    if (event.message === "session_initialized" && event.sessionId) createdBySession.set(event.sessionId, event);
+    if ((event.message === "session_closed" || event.message === "session_expired") && event.sessionId) {
+      createdBySession.delete(event.sessionId);
+    }
+  }
+  for (const event of createdBySession.values()) {
+    const runtime = event.runtime ?? "Unknown";
+    summary.activeSessionsByRuntime[runtime] = (summary.activeSessionsByRuntime[runtime] ?? 0) + 1;
+  }
+  for (const event of successfulToolCalls) {
+    if (event.runtime) summary.lastSuccessfulToolCallByRuntime[event.runtime] = event.timestamp ?? "";
+    if (event.agentId) summary.lastSuccessfulToolCallByAgent[event.agentId] = event.timestamp ?? "";
+    if (event.toolFamily) summary.lastSuccessfulToolCallByFamily[event.toolFamily] = event.timestamp ?? "";
+  }
+  return summary;
+}
+var MCP_HTTP_EVENTS_PATH, MCP_MONITOR_DIR, MCP_TRANSPORT_SUMMARY_PATH, DEFAULT_EVENT_READ_BYTES, DEFAULT_EVENT_MAX_BYTES, EVENT_READ_BYTES, EVENT_MAX_BYTES;
+var init_mcp_transport_health = __esm({
+  "src/lib/mcp-transport-health.ts"() {
+    "use strict";
+    init_config();
+    MCP_HTTP_EVENTS_PATH = path37.join(EXE_AI_DIR, "mcp-http-events.jsonl");
+    MCP_MONITOR_DIR = path37.join(EXE_AI_DIR, "monitor");
+    MCP_TRANSPORT_SUMMARY_PATH = path37.join(MCP_MONITOR_DIR, "mcp-transport-summary.json");
+    DEFAULT_EVENT_READ_BYTES = 256 * 1024;
+    DEFAULT_EVENT_MAX_BYTES = 1024 * 1024;
+    EVENT_READ_BYTES = parsePositiveInt(process.env.EXE_MCP_HTTP_EVENT_READ_BYTES, DEFAULT_EVENT_READ_BYTES);
+    EVENT_MAX_BYTES = parsePositiveInt(process.env.EXE_MCP_HTTP_EVENT_MAX_BYTES, DEFAULT_EVENT_MAX_BYTES);
+  }
+});
+
+// src/bin/exe-healthcheck.ts
+import { existsSync as existsSync31, readFileSync as readFileSync27, readdirSync as readdirSync9 } from "fs";
+import path38 from "path";
+import { execSync as execSync14 } from "child_process";
+import { fileURLToPath as fileURLToPath6 } from "url";
+function findPackageRoot2() {
+  let dir = path38.dirname(fileURLToPath6(import.meta.url));
+  const { root } = path38.parse(dir);
+  while (dir !== root) {
+    if (existsSync31(path38.join(dir, "package.json"))) return dir;
+    dir = path38.dirname(dir);
+  }
+  throw new Error("Cannot find package root");
+}
+function checkBuildIntegrity(pkgRoot) {
+  const results = [];
+  const tsupConfig = path38.join(pkgRoot, "tsup.config.ts");
+  if (!existsSync31(tsupConfig)) {
+    return [{ name: "build/tsup-config", pass: false, detail: "tsup.config.ts not found" }];
+  }
+  const configContent = readFileSync27(tsupConfig, "utf-8");
+  const entryMatches = configContent.matchAll(/"([^"]+)":\s*"src\//g);
+  const missing = [];
+  let total = 0;
+  for (const match of entryMatches) {
+    const outputKey = match[1];
+    const expectedPath = path38.join(pkgRoot, "dist", `${outputKey}.js`);
+    total++;
+    if (!existsSync31(expectedPath)) {
+      missing.push(`dist/${outputKey}.js`);
+    }
+  }
+  if (missing.length > 0) {
+    results.push({
+      name: "build/entry-points",
+      pass: false,
+      detail: `${missing.length}/${total} entry points missing:
+    ${missing.join("\n    ")}`
+    });
+  } else {
+    results.push({
+      name: "build/entry-points",
+      pass: true,
+      detail: `${total} entry points verified`
+    });
+  }
+  return results;
+}
+function checkEmbedPipeline(pkgRoot) {
+  const results = [];
+  const daemonPath = path38.join(pkgRoot, "dist", "lib", "exe-daemon.js");
+  if (!existsSync31(daemonPath)) {
+    results.push({
+      name: "exed/daemon-exists",
+      pass: false,
+      detail: `exe-daemon.js not found at ${daemonPath}`
+    });
+    return results;
+  }
+  results.push({ name: "exed/daemon-exists", pass: true, detail: "dist/lib/exe-daemon.js exists" });
+  const entryDirs = ["dist/hooks", "dist/bin", "dist/mcp"];
+  for (const dir of entryDirs) {
+    const fullDir = path38.join(pkgRoot, dir);
+    if (!existsSync31(fullDir)) continue;
+    let walkDir2 = fullDir;
+    const { root } = path38.parse(walkDir2);
+    let foundRoot = null;
+    while (walkDir2 !== root) {
+      if (existsSync31(path38.join(walkDir2, "package.json"))) {
+        foundRoot = walkDir2;
+        break;
+      }
+      walkDir2 = path38.dirname(walkDir2);
+    }
+    if (!foundRoot) {
+      results.push({
+        name: `exed/reachable-from-${dir}`,
+        pass: false,
+        detail: `Cannot find package root from ${dir}`
+      });
+      continue;
+    }
+    const resolvedDaemon = path38.join(foundRoot, "dist", "lib", "exe-daemon.js");
+    const reachable = existsSync31(resolvedDaemon);
+    results.push({
+      name: `exed/reachable-from-${dir}`,
+      pass: reachable,
+      detail: reachable ? `Resolves to ${resolvedDaemon}` : `NOT FOUND: ${resolvedDaemon}`
+    });
+  }
+  return results;
+}
+function checkTaskSystem(pkgRoot) {
+  const results = [];
+  const scannerPath = path38.join(pkgRoot, "dist", "bin", "scan-tasks.js");
+  if (!existsSync31(scannerPath)) {
+    results.push({ name: "tasks/scanner", pass: false, detail: "scan-tasks.js not found" });
+    return results;
+  }
+  try {
+    execSync14(`node "${scannerPath}" /tmp/nonexistent-healthcheck-test --format=json 2>/dev/null`, {
+      timeout: 1e4,
+      encoding: "utf-8"
+    });
+    results.push({ name: "tasks/scanner", pass: true, detail: "scan-tasks.js runs without import errors" });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Cannot find module") || msg.includes("ERR_MODULE_NOT_FOUND") || msg.includes("SyntaxError")) {
+      results.push({ name: "tasks/scanner", pass: false, detail: `Import error: ${msg.slice(0, 200)}` });
+    } else {
+      results.push({ name: "tasks/scanner", pass: true, detail: "scan-tasks.js runs (no import errors)" });
+    }
+  }
+  return results;
+}
+function checkWorkerSpawning(pkgRoot) {
+  const results = [];
+  const workerPath = path38.join(pkgRoot, "dist", "hooks", "ingest-worker.js");
+  if (!existsSync31(workerPath)) {
+    results.push({ name: "workers/ingest-worker", pass: false, detail: "ingest-worker.js not found" });
+    return results;
+  }
+  try {
+    execSync14(`node --check "${workerPath}" 2>&1`, { timeout: 1e4, encoding: "utf-8" });
+    results.push({ name: "workers/ingest-worker", pass: true, detail: "ingest-worker.js parses OK" });
+  } catch (err) {
+    results.push({
+      name: "workers/ingest-worker",
+      pass: false,
+      detail: `Parse error: ${err instanceof Error ? err.message.slice(0, 200) : String(err)}`
+    });
+  }
+  const hooksDir = path38.join(pkgRoot, "dist", "hooks");
+  if (existsSync31(hooksDir)) {
+    const hookFiles = readdirSync9(hooksDir).filter((f) => f.endsWith(".js") && !f.endsWith(".js.map"));
+    let hooksPassed = 0;
+    const hooksFailed = [];
+    for (const hook of hookFiles) {
+      try {
+        execSync14(`node --check "${path38.join(hooksDir, hook)}" 2>&1`, { timeout: 1e4, encoding: "utf-8" });
+        hooksPassed++;
+      } catch {
+        hooksFailed.push(hook);
+      }
+    }
+    if (hooksFailed.length > 0) {
+      results.push({
+        name: "workers/hooks-parse",
+        pass: false,
+        detail: `${hooksFailed.length}/${hookFiles.length} hooks fail to parse: ${hooksFailed.join(", ")}`
+      });
+    } else {
+      results.push({
+        name: "workers/hooks-parse",
+        pass: true,
+        detail: `${hooksPassed} hook entry points parse OK`
+      });
+    }
+  }
+  return results;
+}
+function checkMcpTransport() {
+  const results = [];
+  const pidPath = path38.join(EXE_AI_DIR, "exed.pid");
+  const tokenPath = path38.join(EXE_AI_DIR, "exed.token");
+  let daemonAlive = false;
+  if (existsSync31(pidPath)) {
+    try {
+      const pid = parseInt(readFileSync27(pidPath, "utf8").trim(), 10);
+      process.kill(pid, 0);
+      daemonAlive = true;
+      results.push({ name: "mcp/daemon-process", pass: true, detail: `exed process alive (pid ${pid})` });
+    } catch {
+      results.push({ name: "mcp/daemon-process", pass: false, detail: "exed.pid exists but process is not alive; restart exe-os/exed" });
+    }
+  } else {
+    results.push({ name: "mcp/daemon-process", pass: false, detail: "No exed.pid found; daemon is not running" });
+  }
+  if (daemonAlive && existsSync31(tokenPath)) {
+    try {
+      const token = readFileSync27(tokenPath, "utf8").trim();
+      const response = execSync14(
+        `curl -sS -i -m 2 -H "Authorization: Bearer ${token}" -H 'Accept: application/json, text/event-stream' http://127.0.0.1:48739/mcp`,
+        { encoding: "utf8", timeout: 3e3 }
+      );
+      const jsonRpcError = response.includes("Content-Type: application/json") && response.includes("missing MCP session");
+      results.push({
+        name: "mcp/http-endpoint",
+        pass: jsonRpcError,
+        detail: jsonRpcError ? "MCP HTTP endpoint reachable; missing-session probe returns JSON-RPC (expected)" : "MCP HTTP endpoint reachable but did not return expected JSON-RPC missing-session response"
+      });
+    } catch (err) {
+      results.push({
+        name: "mcp/http-endpoint",
+        pass: false,
+        detail: `MCP HTTP endpoint not reachable: ${err instanceof Error ? err.message.slice(0, 180) : String(err)}`
+      });
+    }
+  } else if (daemonAlive) {
+    results.push({ name: "mcp/http-endpoint", pass: false, detail: "Daemon is alive but exed.token is missing; cannot probe MCP HTTP" });
+  }
+  const events = readMcpHttpEvents(200);
+  const summary = summarizeMcpTransport(events);
+  results.push({
+    name: "mcp/local-event-log",
+    pass: true,
+    detail: `${events.length} recent event(s); activeSessions=${summary.activeSessions ?? "unknown"}; lastHandshake=${summary.lastSuccessfulHandshake ?? "none"}; lastTool=${summary.lastSuccessfulToolCall ?? "none"}`
+  });
+  results.push({
+    name: "mcp/monitor-summary",
+    pass: true,
+    detail: `Privacy-safe local monitor summary: ${path38.join(EXE_AI_DIR, "monitor", "mcp-transport-summary.json")}`
+  });
+  return results;
+}
+function checkClaudeCodeInstall() {
+  const results = [];
+  const execPath = process.env.CLAUDE_CODE_EXECPATH ?? "";
+  if (execPath.length > 0 && (execPath.includes("claude/versions/") || execPath.includes("claude.exe") || execPath.includes("claude-native"))) {
+    results.push({
+      name: "cc/execpath-clean",
+      pass: false,
+      detail: `CLAUDE_CODE_EXECPATH points to native binary: "${execPath}" \u2014 20K phantom billing risk. Unset it: unset CLAUDE_CODE_EXECPATH`
+    });
+  } else {
+    results.push({
+      name: "cc/execpath-clean",
+      pass: true,
+      detail: execPath ? `CLAUDE_CODE_EXECPATH=${execPath} (node runtime, OK)` : "CLAUDE_CODE_EXECPATH is unset"
+    });
+  }
+  try {
+    const claudePath = execSync14("which claude 2>/dev/null || true", { encoding: "utf8", timeout: 5e3 }).trim();
+    if (!claudePath) {
+      results.push({
+        name: "cc/cli-binary",
+        pass: false,
+        detail: "claude not found in PATH"
+      });
+    } else {
+      let resolved = claudePath;
+      try {
+        resolved = execSync14(`readlink -f "${claudePath}" 2>/dev/null || readlink "${claudePath}" 2>/dev/null || echo "${claudePath}"`, {
+          encoding: "utf8",
+          timeout: 5e3
+        }).trim();
+      } catch {
+      }
+      if (resolved.includes("bin/claude.exe") || resolved.includes("bin/claude-native")) {
+        results.push({
+          name: "cc/cli-binary",
+          pass: false,
+          detail: `claude resolves to native binary: ${resolved}. Should be cli.js. Run: npm install -g @anthropic-ai/claude-code@2.1.98`
+        });
+      } else {
+        results.push({
+          name: "cc/cli-binary",
+          pass: true,
+          detail: `claude resolves to: ${resolved}`
+        });
+      }
+    }
+  } catch {
+    results.push({
+      name: "cc/cli-binary",
+      pass: false,
+      detail: "Failed to check claude binary path"
+    });
+  }
+  const versionsDir = path38.join(
+    process.env.HOME ?? process.env.USERPROFILE ?? "",
+    ".local",
+    "share",
+    "claude",
+    "versions"
+  );
+  if (existsSync31(versionsDir)) {
+    try {
+      const entries = readdirSync9(versionsDir);
+      if (entries.length > 0) {
+        results.push({
+          name: "cc/native-cache-clean",
+          pass: false,
+          detail: `${entries.length} cached native version(s) found in ${versionsDir}: ${entries.slice(0, 3).join(", ")}${entries.length > 3 ? "..." : ""}. Remove: rm -rf "${versionsDir}"`
+        });
+      } else {
+        results.push({
+          name: "cc/native-cache-clean",
+          pass: true,
+          detail: `${versionsDir} is empty`
+        });
+      }
+    } catch {
+      results.push({
+        name: "cc/native-cache-clean",
+        pass: true,
+        detail: `${versionsDir} not readable (OK)`
+      });
+    }
+  } else {
+    results.push({
+      name: "cc/native-cache-clean",
+      pass: true,
+      detail: `${versionsDir} does not exist`
+    });
+  }
+  const disableOld = process.env.DISABLE_AUTOUPDATER === "1";
+  const disableNew = process.env.CLAUDE_CODE_AUTOUPDATER_DISABLED === "1";
+  if (!disableOld && !disableNew) {
+    results.push({
+      name: "cc/autoupdater-disabled",
+      pass: false,
+      detail: "Neither DISABLE_AUTOUPDATER=1 nor CLAUDE_CODE_AUTOUPDATER_DISABLED=1 is set. Auto-updater may install infected native binary. Export both in your shell profile."
+    });
+  } else {
+    const which = [
+      disableOld ? "DISABLE_AUTOUPDATER=1" : null,
+      disableNew ? "CLAUDE_CODE_AUTOUPDATER_DISABLED=1" : null
+    ].filter(Boolean).join(" + ");
+    results.push({
+      name: "cc/autoupdater-disabled",
+      pass: true,
+      detail: `Auto-updater disabled via ${which}`
+    });
+  }
+  try {
+    const ccVersion = execSync14("claude --version 2>/dev/null || echo unknown", {
+      encoding: "utf8",
+      timeout: 5e3
+    }).trim();
+    const versionMatch = ccVersion.match(/(\d+\.\d+\.\d+)/);
+    if (versionMatch) {
+      const ver = versionMatch[1];
+      const [, minor] = ver.split(".").map(Number);
+      const isRisky = minor !== void 0 && minor >= 1 && parseInt(ver.split(".")[2] ?? "0") >= 119;
+      results.push({
+        name: "cc/version",
+        pass: !isRisky,
+        detail: isRisky ? `CC version ${ver} \u2014 \u22652.1.119 ships native binary only. Pin: npm install -g @anthropic-ai/claude-code@2.1.98` : `CC version ${ver}`
+      });
+    }
+  } catch {
+  }
+  return results;
+}
+function runHealthCheck() {
+  const pkgRoot = findPackageRoot2();
+  const results = [
+    ...checkBuildIntegrity(pkgRoot),
+    ...checkEmbedPipeline(pkgRoot),
+    ...checkTaskSystem(pkgRoot),
+    ...checkWorkerSpawning(pkgRoot),
+    ...checkMcpTransport(),
+    ...checkClaudeCodeInstall()
+  ];
+  const passed = results.filter((r) => r.pass).length;
+  const failed = results.filter((r) => !r.pass).length;
+  return { results, passed, failed };
+}
+var init_exe_healthcheck = __esm({
+  "src/bin/exe-healthcheck.ts"() {
+    "use strict";
+    init_is_main();
+    init_config();
+    init_mcp_transport_health();
+    if (isMainModule(import.meta.url) && (process.argv[1] ?? "").includes("exe-healthcheck")) {
+      const { results, passed, failed } = runHealthCheck();
+      console.log("\n  exe-os Health Check\n");
+      for (const r of results) {
+        const icon = r.pass ? "\x1B[32m\u2713\x1B[0m" : "\x1B[31m\u2717\x1B[0m";
+        console.log(`  ${icon} ${r.name}`);
+        console.log(`    ${r.detail}`);
+      }
+      console.log(`
+  ${passed} passed, ${failed} failed
+`);
+      process.exit(failed > 0 ? 1 : 0);
+    }
+  }
+});
+
+// src/bin/cc-doctor.ts
+var cc_doctor_exports = {};
+__export(cc_doctor_exports, {
+  runCcDoctor: () => runCcDoctor
+});
+function formatResult(r) {
+  const icon = r.pass ? "\x1B[32m\u2713\x1B[0m" : "\x1B[31m\u2717\x1B[0m";
+  const label = LABELS[r.name] ?? r.name;
+  return `${icon} ${label}: ${r.detail}`;
+}
+function runCcDoctor() {
+  const results = checkClaudeCodeInstall();
+  const passed = results.filter((r) => r.pass).length;
+  const failed = results.filter((r) => !r.pass).length;
+  return { results, passed, failed };
+}
+var LABELS;
+var init_cc_doctor = __esm({
+  "src/bin/cc-doctor.ts"() {
+    "use strict";
+    init_exe_healthcheck();
+    init_is_main();
+    LABELS = {
+      "cc/execpath-clean": "EXECPATH",
+      "cc/cli-binary": "Symlink",
+      "cc/native-cache-clean": "Native cache",
+      "cc/autoupdater-disabled": "Auto-updater",
+      "cc/version": "Version"
+    };
+    if (isMainModule(import.meta.url) && (process.argv[1] ?? "").includes("cc-doctor")) {
+      const { results, passed, failed } = runCcDoctor();
+      console.log("\n  CC Install Health Check\n");
+      for (const r of results) {
+        console.log(`  ${formatResult(r)}`);
+      }
+      if (failed === 0) {
+        console.log(`
+  \x1B[32mStatus: CLEAN\x1B[0m \u2014 no 20K billing risk (${passed} checks passed)
+`);
+      } else {
+        console.log(`
+  \x1B[31mStatus: ${failed} ISSUE${failed > 1 ? "S" : ""} FOUND\x1B[0m \u2014 ${passed} passed, ${failed} failed`);
+        console.log("  Fix: npm install -g @anthropic-ai/claude-code@2.1.98\n");
+      }
+      process.exit(failed > 0 ? 1 : 0);
+    }
+  }
+});
+
 // src/lib/model-downloader.ts
-import { createWriteStream, createReadStream as createReadStream2, existsSync as existsSync30, unlinkSync as unlinkSync14, renameSync as renameSync7 } from "fs";
+import { createWriteStream, createReadStream as createReadStream2, existsSync as existsSync32, unlinkSync as unlinkSync14, renameSync as renameSync7 } from "fs";
 import { mkdir as mkdir6 } from "fs/promises";
 import { createHash as createHash6 } from "crypto";
-import path37 from "path";
+import path39 from "path";
 async function downloadModel(opts) {
   const { destDir, onProgress, fetchFn = globalThis.fetch } = opts;
-  const destPath = path37.join(destDir, LOCAL_FILENAME);
+  const destPath = path39.join(destDir, LOCAL_FILENAME);
   const tmpPath = destPath + ".tmp";
   await mkdir6(destDir, { recursive: true });
-  if (existsSync30(destPath)) {
+  if (existsSync32(destPath)) {
     const hash = await fileHash(destPath);
     if (hash === EXPECTED_SHA256) {
       return destPath;
@@ -18034,7 +19111,7 @@ async function downloadModel(opts) {
   let downloaded = 0;
   for (let attempt = 1; attempt <= MAX_RETRIES4; attempt++) {
     try {
-      if (existsSync30(tmpPath)) unlinkSync14(tmpPath);
+      if (existsSync32(tmpPath)) unlinkSync14(tmpPath);
       const response = await fetchFn(GGUF_URL, {
         redirect: "follow",
         signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
@@ -18079,7 +19156,7 @@ async function downloadModel(opts) {
         process.stderr.write(`
 Download attempt ${attempt} failed, retrying...
 `);
-        if (existsSync30(tmpPath)) unlinkSync14(tmpPath);
+        if (existsSync32(tmpPath)) unlinkSync14(tmpPath);
       }
     }
   }
@@ -18656,38 +19733,38 @@ __export(session_wrappers_exports, {
   generateSessionWrappers: () => generateSessionWrappers
 });
 import {
-  existsSync as existsSync31,
-  readFileSync as readFileSync26,
-  writeFileSync as writeFileSync23,
-  mkdirSync as mkdirSync22,
+  existsSync as existsSync33,
+  readFileSync as readFileSync28,
+  writeFileSync as writeFileSync24,
+  mkdirSync as mkdirSync23,
   chmodSync as chmodSync4,
-  readdirSync as readdirSync9,
+  readdirSync as readdirSync10,
   unlinkSync as unlinkSync15
 } from "fs";
-import { execSync as execSync14 } from "child_process";
-import path38 from "path";
+import { execSync as execSync15 } from "child_process";
+import path40 from "path";
 import { homedir as homedir5 } from "os";
 function generateSessionWrappers(packageRoot, homeDir) {
   const home = homeDir ?? homedir5();
-  const binDir = path38.join(home, ".exe-os", "bin");
-  const rosterPath = path38.join(home, ".exe-os", "exe-employees.json");
+  const binDir = path40.join(home, ".exe-os", "bin");
+  const rosterPath = path40.join(home, ".exe-os", "exe-employees.json");
   const shouldMirrorToGlobalBin = homeDir === void 0;
-  mkdirSync22(binDir, { recursive: true });
-  const exeStartDst = path38.join(binDir, "exe-start");
+  mkdirSync23(binDir, { recursive: true });
+  const exeStartDst = path40.join(binDir, "exe-start");
   const candidates = [
-    path38.join(packageRoot, "dist", "bin", "exe-start.sh"),
-    path38.join(packageRoot, "src", "bin", "exe-start.sh")
+    path40.join(packageRoot, "dist", "bin", "exe-start.sh"),
+    path40.join(packageRoot, "src", "bin", "exe-start.sh")
   ];
   for (const src of candidates) {
-    if (existsSync31(src)) {
-      writeFileSync23(exeStartDst, readFileSync26(src));
+    if (existsSync33(src)) {
+      writeFileSync24(exeStartDst, readFileSync28(src));
       chmodSync4(exeStartDst, 493);
       break;
     }
   }
   let employees = [];
   try {
-    employees = JSON.parse(readFileSync26(rosterPath, "utf8"));
+    employees = JSON.parse(readFileSync28(rosterPath, "utf8"));
   } catch {
     return { created: 0, pathConfigured: false };
   }
@@ -18695,11 +19772,11 @@ function generateSessionWrappers(packageRoot, homeDir) {
     return { created: 0, pathConfigured: false };
   }
   try {
-    for (const f of readdirSync9(binDir)) {
+    for (const f of readdirSync10(binDir)) {
       if (f === "exe-start") continue;
-      const fPath = path38.join(binDir, f);
+      const fPath = path40.join(binDir, f);
       try {
-        const content = readFileSync26(fPath, "utf8");
+        const content = readFileSync28(fPath, "utf8");
         if (content.includes("exe-start")) {
           unlinkSync15(fPath);
         }
@@ -18715,36 +19792,36 @@ exec "${exeStartDst}" "$0" "$@"
   const globalBinDir = shouldMirrorToGlobalBin ? resolveGlobalBinDir() : null;
   for (const emp of employees) {
     for (let n = 1; n <= MAX_N; n++) {
-      writeWrapper(path38.join(binDir, `${emp.name}${n}`), wrapperContent);
+      writeWrapper(path40.join(binDir, `${emp.name}${n}`), wrapperContent);
       if (globalBinDir) {
-        writeWrapper(path38.join(globalBinDir, `${emp.name}${n}`), wrapperContent);
+        writeWrapper(path40.join(globalBinDir, `${emp.name}${n}`), wrapperContent);
       }
       created++;
-      writeWrapper(path38.join(binDir, `${emp.name}${n}-codex`), wrapperContent);
+      writeWrapper(path40.join(binDir, `${emp.name}${n}-codex`), wrapperContent);
       if (globalBinDir) {
-        writeWrapper(path38.join(globalBinDir, `${emp.name}${n}-codex`), wrapperContent);
+        writeWrapper(path40.join(globalBinDir, `${emp.name}${n}-codex`), wrapperContent);
       }
       created++;
     }
   }
   const codexLauncherCandidates = [
-    path38.join(packageRoot, "dist", "bin", "exe-start-codex.js"),
-    path38.join(packageRoot, "src", "bin", "exe-start-codex.ts")
+    path40.join(packageRoot, "dist", "bin", "exe-start-codex.js"),
+    path40.join(packageRoot, "src", "bin", "exe-start-codex.ts")
   ];
   let codexLauncher = null;
   for (const c of codexLauncherCandidates) {
-    if (existsSync31(c)) {
+    if (existsSync33(c)) {
       codexLauncher = c;
       break;
     }
   }
   if (codexLauncher) {
     for (const emp of employees) {
-      const wrapperPath = path38.join(binDir, `${emp.name}-codex`);
+      const wrapperPath = path40.join(binDir, `${emp.name}-codex`);
       const content = `#!/bin/bash
 exec node "${codexLauncher}" --agent ${emp.name} "$@"
 `;
-      writeFileSync23(wrapperPath, content);
+      writeFileSync24(wrapperPath, content);
       chmodSync4(wrapperPath, 493);
       created++;
     }
@@ -18754,20 +19831,20 @@ exec node "${codexLauncher}" --agent ${emp.name} "$@"
 }
 function writeWrapper(wrapperPath, content) {
   try {
-    writeFileSync23(wrapperPath, content);
+    writeFileSync24(wrapperPath, content);
     chmodSync4(wrapperPath, 493);
   } catch {
   }
 }
 function resolveGlobalBinDir() {
   try {
-    const exeOsPath = execSync14("command -v exe-os", { encoding: "utf8", timeout: 3e3 }).trim().split("\n")[0];
-    if (exeOsPath) return path38.dirname(exeOsPath);
+    const exeOsPath = execSync15("command -v exe-os", { encoding: "utf8", timeout: 3e3 }).trim().split("\n")[0];
+    if (exeOsPath) return path40.dirname(exeOsPath);
   } catch {
   }
   try {
-    const prefix = execSync14("npm prefix -g", { encoding: "utf8", timeout: 3e3 }).trim();
-    if (prefix) return path38.join(prefix, "bin");
+    const prefix = execSync15("npm prefix -g", { encoding: "utf8", timeout: 3e3 }).trim();
+    if (prefix) return path40.join(prefix, "bin");
   } catch {
   }
   return null;
@@ -18783,24 +19860,24 @@ export PATH="${binDir}:$PATH"
   const shell = process.env.SHELL ?? "/bin/bash";
   const profilePaths = [];
   if (shell.includes("zsh")) {
-    profilePaths.push(path38.join(home, ".zshrc"));
+    profilePaths.push(path40.join(home, ".zshrc"));
   } else if (shell.includes("bash")) {
-    profilePaths.push(path38.join(home, ".bashrc"));
-    profilePaths.push(path38.join(home, ".bash_profile"));
+    profilePaths.push(path40.join(home, ".bashrc"));
+    profilePaths.push(path40.join(home, ".bash_profile"));
   } else {
-    profilePaths.push(path38.join(home, ".profile"));
+    profilePaths.push(path40.join(home, ".profile"));
   }
   for (const profilePath of profilePaths) {
     try {
       let content = "";
       try {
-        content = readFileSync26(profilePath, "utf8");
+        content = readFileSync28(profilePath, "utf8");
       } catch {
       }
       if (content.includes(".exe-os/bin")) {
         return false;
       }
-      writeFileSync23(profilePath, content + exportLine);
+      writeFileSync24(profilePath, content + exportLine);
       return true;
     } catch {
       continue;
@@ -18823,36 +19900,36 @@ __export(setup_wizard_exports, {
   validateModel: () => validateModel
 });
 import crypto13 from "crypto";
-import { existsSync as existsSync32, mkdirSync as mkdirSync23, readFileSync as readFileSync27, writeFileSync as writeFileSync24, unlinkSync as unlinkSync16 } from "fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync24, readFileSync as readFileSync29, writeFileSync as writeFileSync25, unlinkSync as unlinkSync16 } from "fs";
 import os19 from "os";
-import path39 from "path";
+import path41 from "path";
 import { createInterface as createInterface4 } from "readline";
-function findPackageRoot2() {
-  let dir = path39.dirname(new URL(import.meta.url).pathname);
-  const root = path39.parse(dir).root;
+function findPackageRoot3() {
+  let dir = path41.dirname(new URL(import.meta.url).pathname);
+  const root = path41.parse(dir).root;
   while (dir !== root) {
-    const pkgPath = path39.join(dir, "package.json");
-    if (existsSync32(pkgPath)) {
+    const pkgPath = path41.join(dir, "package.json");
+    if (existsSync34(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync27(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync29(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
       } catch {
       }
     }
-    dir = path39.dirname(dir);
+    dir = path41.dirname(dir);
   }
   return null;
 }
 function loadSetupState() {
   try {
-    return JSON.parse(readFileSync27(SETUP_STATE_PATH, "utf8"));
+    return JSON.parse(readFileSync29(SETUP_STATE_PATH, "utf8"));
   } catch {
     return { completedSteps: [], startedAt: (/* @__PURE__ */ new Date()).toISOString() };
   }
 }
 function saveSetupState(state) {
-  mkdirSync23(path39.dirname(SETUP_STATE_PATH), { recursive: true });
-  writeFileSync24(SETUP_STATE_PATH, JSON.stringify(state, null, 2));
+  mkdirSync24(path41.dirname(SETUP_STATE_PATH), { recursive: true });
+  writeFileSync25(SETUP_STATE_PATH, JSON.stringify(state, null, 2));
 }
 function clearSetupState() {
   try {
@@ -18873,8 +19950,8 @@ function ask3(rl, prompt) {
 function getAvailableMemoryGB2() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync19 } = __require("child_process");
-      const vmstat = execSync19("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync20 } = __require("child_process");
+      const vmstat = execSync20("vm_stat", { encoding: "utf8" });
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const pageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : 16384;
       const free = vmstat.match(/Pages free:\s+(\d+)/);
@@ -18902,10 +19979,10 @@ async function validateModel(log) {
   if (totalGB <= 8 || isLowMemory()) {
     log(`System memory: ${totalGB.toFixed(0)}GB total, ${freeGB.toFixed(1)}GB free`);
     log("Skipping in-memory model validation (low memory \u2014 will validate on first use).");
-    const modelPath = path39.join(MODELS_DIR, LOCAL_FILENAME);
-    if (existsSync32(modelPath)) {
-      const { statSync: statSync8 } = await import("fs");
-      const size = statSync8(modelPath).size;
+    const modelPath = path41.join(MODELS_DIR, LOCAL_FILENAME);
+    if (existsSync34(modelPath)) {
+      const { statSync: statSync9 } = await import("fs");
+      const size = statSync9(modelPath).size;
       if (size > 300 * 1e6) {
         log(`Model file verified (${(size / 1e6).toFixed(0)} MB).`);
         return;
@@ -18998,7 +20075,7 @@ async function runSetupWizard(opts = {}) {
     if (state.completedSteps.length > 0) {
       log(`Resuming setup from step ${Math.max(...state.completedSteps) + 1}...`);
     }
-    if (existsSync32(LEGACY_LANCE_PATH)) {
+    if (existsSync34(LEGACY_LANCE_PATH)) {
       log("\u26A0 Found v1.0 LanceDB at ~/.exe-os/local.lance");
       log("  v1.1 uses libSQL (SQLite). Your existing memories are not automatically migrated.");
       log("  The old directory will not be modified or deleted.");
@@ -19189,10 +20266,10 @@ async function runSetupWizard(opts = {}) {
       await saveConfig(config);
       log("");
       try {
-        const claudeJsonPath = path39.join(os19.homedir(), ".claude.json");
+        const claudeJsonPath = path41.join(os19.homedir(), ".claude.json");
         let claudeJson = {};
         try {
-          claudeJson = JSON.parse(readFileSync27(claudeJsonPath, "utf8"));
+          claudeJson = JSON.parse(readFileSync29(claudeJsonPath, "utf8"));
         } catch {
         }
         if (!claudeJson.projects) claudeJson.projects = {};
@@ -19201,7 +20278,7 @@ async function runSetupWizard(opts = {}) {
           if (!projects[dir]) projects[dir] = {};
           projects[dir].hasTrustDialogAccepted = true;
         }
-        writeFileSync24(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
+        writeFileSync25(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
       } catch {
       }
       state.completedSteps.push(5);
@@ -19215,7 +20292,7 @@ async function runSetupWizard(opts = {}) {
       const prefs = { ...existingPrefs };
       log("=== Config Defaults ===");
       log("");
-      const ghosttyDetected = existsSync32(path39.join(os19.homedir(), ".config", "ghostty")) || existsSync32(path39.join(os19.homedir(), "Library", "Application Support", "com.mitchellh.ghostty"));
+      const ghosttyDetected = existsSync34(path41.join(os19.homedir(), ".config", "ghostty")) || existsSync34(path41.join(os19.homedir(), "Library", "Application Support", "com.mitchellh.ghostty"));
       if (ghosttyDetected) {
         const ghosttyAnswer = await ask3(rl, "Detected Ghostty terminal. Use exe-os Ghostty defaults? (Y/n) ");
         prefs.ghostty = ghosttyAnswer.toLowerCase() !== "n";
@@ -19262,7 +20339,7 @@ async function runSetupWizard(opts = {}) {
       let missingIdentities = [];
       for (const emp of roster) {
         const idPath = identityPath2(emp.name);
-        if (!existsSync32(idPath)) {
+        if (!existsSync34(idPath)) {
           missingIdentities.push(emp.name);
         }
       }
@@ -19294,7 +20371,7 @@ async function runSetupWizard(opts = {}) {
           }
           missingIdentities = [];
           for (const emp of roster) {
-            if (!existsSync32(identityPath2(emp.name))) {
+            if (!existsSync34(identityPath2(emp.name))) {
               missingIdentities.push(emp.name);
             }
           }
@@ -19312,7 +20389,7 @@ async function runSetupWizard(opts = {}) {
       }
       try {
         const { generateSessionWrappers: generateSessionWrappers2 } = await Promise.resolve().then(() => (init_session_wrappers(), session_wrappers_exports));
-        const pkgRoot = findPackageRoot2();
+        const pkgRoot = findPackageRoot3();
         if (pkgRoot) {
           const wrapResult = generateSessionWrappers2(pkgRoot);
           if (wrapResult.created > 0) {
@@ -19353,9 +20430,9 @@ async function runSetupWizard(opts = {}) {
       const cooIdentityContent = getIdentityTemplate("coo");
       if (cooIdentityContent) {
         const cooIdPath = identityPath2(cooName);
-        mkdirSync23(path39.dirname(cooIdPath), { recursive: true });
+        mkdirSync24(path41.dirname(cooIdPath), { recursive: true });
         const replaced = cooIdentityContent.replace(/agent_id:\s*exe/g, `agent_id: ${cooName}`).replace(/\$\{agent_id\}/g, cooName);
-        writeFileSync24(cooIdPath, replaced, "utf-8");
+        writeFileSync25(cooIdPath, replaced, "utf-8");
       }
       registerBinSymlinks2(cooName);
       createdEmployees.push({ name: cooName, role: "COO" });
@@ -19471,9 +20548,9 @@ async function runSetupWizard(opts = {}) {
         const ctoIdentityContent = getIdentityTemplate("cto");
         if (ctoIdentityContent) {
           const ctoIdPath = identityPath2(ctoName);
-          mkdirSync23(path39.dirname(ctoIdPath), { recursive: true });
+          mkdirSync24(path41.dirname(ctoIdPath), { recursive: true });
           const replaced = ctoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${ctoName}`).replace(/\$\{agent_id\}/g, ctoName);
-          writeFileSync24(ctoIdPath, replaced, "utf-8");
+          writeFileSync25(ctoIdPath, replaced, "utf-8");
         }
         registerBinSymlinks2(ctoName);
         createdEmployees.push({ name: ctoName, role: "CTO" });
@@ -19494,9 +20571,9 @@ async function runSetupWizard(opts = {}) {
         const cmoIdentityContent = getIdentityTemplate("cmo");
         if (cmoIdentityContent) {
           const cmoIdPath = identityPath2(cmoName);
-          mkdirSync23(path39.dirname(cmoIdPath), { recursive: true });
+          mkdirSync24(path41.dirname(cmoIdPath), { recursive: true });
           const replaced = cmoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${cmoName}`).replace(/\$\{agent_id\}/g, cmoName);
-          writeFileSync24(cmoIdPath, replaced, "utf-8");
+          writeFileSync25(cmoIdPath, replaced, "utf-8");
         }
         registerBinSymlinks2(cmoName);
         createdEmployees.push({ name: cmoName, role: "CMO" });
@@ -19512,14 +20589,14 @@ async function runSetupWizard(opts = {}) {
     if (!pairingRosterPulled) {
       try {
         const { generateSessionWrappers: generateSessionWrappers2 } = await Promise.resolve().then(() => (init_session_wrappers(), session_wrappers_exports));
-        const pkgRoot = findPackageRoot2();
+        const pkgRoot = findPackageRoot3();
         if (pkgRoot) {
           const wrapResult = generateSessionWrappers2(pkgRoot);
           if (wrapResult.created > 0) {
             log(`Session shortcuts generated (${cooName}1, ${cooName}2, ...)`);
           }
           if (wrapResult.pathConfigured) {
-            const binDir = path39.join(os19.homedir(), ".exe-os", "bin");
+            const binDir = path41.join(os19.homedir(), ".exe-os", "bin");
             process.env.PATH = `${binDir}:${process.env.PATH ?? ""}`;
             pathJustConfigured = true;
           }
@@ -19559,10 +20636,10 @@ async function runSetupWizard(opts = {}) {
       log("Team: " + createdEmployees.map((e) => `${e.name} (${e.role})`).join(", "));
     }
     let version = "";
-    const pkgRoot2 = findPackageRoot2();
+    const pkgRoot2 = findPackageRoot3();
     if (pkgRoot2) {
       try {
-        version = JSON.parse(readFileSync27(path39.join(pkgRoot2, "package.json"), "utf-8")).version;
+        version = JSON.parse(readFileSync29(path41.join(pkgRoot2, "package.json"), "utf-8")).version;
       } catch {
       }
     }
@@ -19601,46 +20678,46 @@ var init_setup_wizard = __esm({
     init_config();
     init_keychain();
     init_model_downloader();
-    SETUP_STATE_PATH = path39.join(os19.homedir(), ".exe-os", "setup-state.json");
+    SETUP_STATE_PATH = path41.join(os19.homedir(), ".exe-os", "setup-state.json");
   }
 });
 
 // src/lib/update-backup.ts
 import { copyFile, readFile as readFile6, readdir as readdir3, writeFile as writeFile7, rm as rm2, mkdir as mkdir7, cp } from "fs/promises";
-import { existsSync as existsSync33 } from "fs";
-import path40 from "path";
+import { existsSync as existsSync35 } from "fs";
+import path42 from "path";
 import os20 from "os";
 function resolveDataDir2() {
   if (process.env.EXE_OS_DIR) return process.env.EXE_OS_DIR;
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
-  return path40.join(os20.homedir(), ".exe-os");
+  return path42.join(os20.homedir(), ".exe-os");
 }
 function externalBackupTargets(homeDir) {
   return [
-    { name: "claude.json", path: path40.join(homeDir, ".claude.json") },
-    { name: "claude-settings.json", path: path40.join(homeDir, ".claude", "settings.json") },
-    { name: "claude-CLAUDE.md", path: path40.join(homeDir, ".claude", "CLAUDE.md") },
-    { name: "tmux.conf", path: path40.join(homeDir, ".tmux.conf") },
-    { name: "zshrc", path: path40.join(homeDir, ".zshrc") },
-    { name: "bashrc", path: path40.join(homeDir, ".bashrc") },
-    { name: "ghostty-config", path: path40.join(homeDir, ".config", "ghostty", "config") },
-    { name: "codex-config.toml", path: path40.join(homeDir, ".codex", "config.toml") },
-    { name: "codex-hooks.json", path: path40.join(homeDir, ".codex", "hooks.json") },
-    { name: "opencode-config.json", path: path40.join(homeDir, ".config", "opencode", "opencode.json") }
+    { name: "claude.json", path: path42.join(homeDir, ".claude.json") },
+    { name: "claude-settings.json", path: path42.join(homeDir, ".claude", "settings.json") },
+    { name: "claude-CLAUDE.md", path: path42.join(homeDir, ".claude", "CLAUDE.md") },
+    { name: "tmux.conf", path: path42.join(homeDir, ".tmux.conf") },
+    { name: "zshrc", path: path42.join(homeDir, ".zshrc") },
+    { name: "bashrc", path: path42.join(homeDir, ".bashrc") },
+    { name: "ghostty-config", path: path42.join(homeDir, ".config", "ghostty", "config") },
+    { name: "codex-config.toml", path: path42.join(homeDir, ".codex", "config.toml") },
+    { name: "codex-hooks.json", path: path42.join(homeDir, ".codex", "hooks.json") },
+    { name: "opencode-config.json", path: path42.join(homeDir, ".config", "opencode", "opencode.json") }
   ];
 }
 async function createUpdateBackup(currentVersion, dataDir2, homeDir = os20.homedir()) {
   const dir = dataDir2 ?? resolveDataDir2();
-  const backupDir = path40.join(dir, BACKUP_DIR_NAME);
-  if (existsSync33(backupDir)) {
+  const backupDir = path42.join(dir, BACKUP_DIR_NAME);
+  if (existsSync35(backupDir)) {
     await rm2(backupDir, { recursive: true, force: true });
   }
   await mkdir7(backupDir, { recursive: true });
   const backedUpFiles = [];
   for (const target of BACKUP_TARGETS) {
-    const src = path40.join(dir, target.name);
-    if (!existsSync33(src)) continue;
-    const dest = path40.join(backupDir, target.name);
+    const src = path42.join(dir, target.name);
+    if (!existsSync35(src)) continue;
+    const dest = path42.join(backupDir, target.name);
     if (target.type === "file") {
       await copyFile(src, dest);
     } else {
@@ -19651,18 +20728,18 @@ async function createUpdateBackup(currentVersion, dataDir2, homeDir = os20.homed
   const entries = await readdir3(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && entry.name.endsWith(".db") && entry.name !== BACKUP_DIR_NAME) {
-      const src = path40.join(dir, entry.name);
-      const dest = path40.join(backupDir, entry.name);
+      const src = path42.join(dir, entry.name);
+      const dest = path42.join(backupDir, entry.name);
       await copyFile(src, dest);
       backedUpFiles.push(entry.name);
     }
   }
   const externalFiles = [];
-  const externalDir = path40.join(backupDir, "external");
+  const externalDir = path42.join(backupDir, "external");
   for (const target of externalBackupTargets(homeDir)) {
-    if (!existsSync33(target.path)) continue;
+    if (!existsSync35(target.path)) continue;
     await mkdir7(externalDir, { recursive: true });
-    await copyFile(target.path, path40.join(externalDir, target.name));
+    await copyFile(target.path, path42.join(externalDir, target.name));
     externalFiles.push(target);
   }
   const manifest = {
@@ -19672,16 +20749,16 @@ async function createUpdateBackup(currentVersion, dataDir2, homeDir = os20.homed
     ...externalFiles.length > 0 ? { externalFiles } : {}
   };
   await writeFile7(
-    path40.join(backupDir, "manifest.json"),
+    path42.join(backupDir, "manifest.json"),
     JSON.stringify(manifest, null, 2) + "\n"
   );
   return manifest;
 }
 async function restoreFromBackup(dataDir2) {
   const dir = dataDir2 ?? resolveDataDir2();
-  const backupDir = path40.join(dir, BACKUP_DIR_NAME);
-  const manifestPath = path40.join(backupDir, "manifest.json");
-  if (!existsSync33(manifestPath)) {
+  const backupDir = path42.join(dir, BACKUP_DIR_NAME);
+  const manifestPath = path42.join(backupDir, "manifest.json");
+  if (!existsSync35(manifestPath)) {
     throw new Error(
       `No backup found at ${backupDir}. Nothing to restore.`
     );
@@ -19690,9 +20767,9 @@ async function restoreFromBackup(dataDir2) {
     await readFile6(manifestPath, "utf-8")
   );
   for (const fileName of manifest.files) {
-    const src = path40.join(backupDir, fileName);
-    const dest = path40.join(dir, fileName);
-    if (!existsSync33(src)) continue;
+    const src = path42.join(backupDir, fileName);
+    const dest = path42.join(dir, fileName);
+    if (!existsSync35(src)) continue;
     const stat2 = await import("fs/promises").then((m) => m.stat(src));
     if (stat2.isDirectory()) {
       await cp(src, dest, { recursive: true, force: true });
@@ -19701,17 +20778,17 @@ async function restoreFromBackup(dataDir2) {
     }
   }
   for (const external of manifest.externalFiles ?? []) {
-    const src = path40.join(backupDir, "external", external.name);
-    if (!existsSync33(src)) continue;
-    await mkdir7(path40.dirname(external.path), { recursive: true });
+    const src = path42.join(backupDir, "external", external.name);
+    if (!existsSync35(src)) continue;
+    await mkdir7(path42.dirname(external.path), { recursive: true });
     await copyFile(src, external.path);
   }
   return manifest;
 }
 async function deleteBackup(dataDir2) {
   const dir = dataDir2 ?? resolveDataDir2();
-  const backupDir = path40.join(dir, BACKUP_DIR_NAME);
-  if (existsSync33(backupDir)) {
+  const backupDir = path42.join(dir, BACKUP_DIR_NAME);
+  if (existsSync35(backupDir)) {
     await rm2(backupDir, { recursive: true, force: true });
   }
 }
@@ -19735,17 +20812,17 @@ var init_update_backup = __esm({
 });
 
 // src/lib/update-check.ts
-import { execSync as execSync15 } from "child_process";
-import { readFileSync as readFileSync28 } from "fs";
-import path41 from "path";
+import { execSync as execSync16 } from "child_process";
+import { readFileSync as readFileSync30 } from "fs";
+import path43 from "path";
 function getLocalVersion(packageRoot) {
-  const pkgPath = path41.join(packageRoot, "package.json");
-  const pkg = JSON.parse(readFileSync28(pkgPath, "utf-8"));
+  const pkgPath = path43.join(packageRoot, "package.json");
+  const pkg = JSON.parse(readFileSync30(pkgPath, "utf-8"));
   return pkg.version;
 }
 function getRemoteVersion() {
   try {
-    const output2 = execSync15("npm view @askexenow/exe-os version", {
+    const output2 = execSync16("npm view @askexenow/exe-os version", {
       encoding: "utf-8",
       timeout: 15e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -19784,7 +20861,7 @@ __export(update_exports, {
   getRemoteVersion: () => getRemoteVersion,
   runUpdate: () => runUpdate
 });
-import { execSync as execSync16 } from "child_process";
+import { execSync as execSync17 } from "child_process";
 import { createInterface as createInterface5 } from "readline";
 async function runRestore() {
   console.log("\n\u{1F504} Restoring from update backup...");
@@ -19795,7 +20872,7 @@ async function runRestore() {
     console.log(`
 \u{1F4E5} Reinstalling @askexenow/exe-os@${manifest.version}...`);
     try {
-      execSync16(`npm install -g @askexenow/exe-os@${manifest.version}`, {
+      execSync17(`npm install -g @askexenow/exe-os@${manifest.version}`, {
         stdio: ["pipe", "pipe", "inherit"],
         timeout: 3e5
       });
@@ -19876,7 +20953,7 @@ async function runUpdate(cliArgs) {
   }
   console.log("\u{1F9F9} Clearing npm cache...");
   try {
-    execSync16("npm cache clean --force", { stdio: "pipe" });
+    execSync17("npm cache clean --force", { stdio: "pipe" });
     console.log("   Done");
   } catch {
     console.log("   Skipped (non-critical)");
@@ -19884,7 +20961,7 @@ async function runUpdate(cliArgs) {
   console.log("\u{1F4E5} Installing @askexenow/exe-os@latest...");
   console.log("   This may take a minute...\n");
   try {
-    execSync16("npm install -g @askexenow/exe-os@latest", {
+    execSync17("npm install -g @askexenow/exe-os@latest", {
       stdio: ["pipe", "pipe", "inherit"],
       timeout: 3e5
     });
@@ -19902,7 +20979,7 @@ async function runUpdate(cliArgs) {
     newVersion = getLocalVersion(packageRoot);
   } catch {
     try {
-      const out = execSync16("npm list -g @askexenow/exe-os --depth=0 2>/dev/null", { encoding: "utf8" });
+      const out = execSync17("npm list -g @askexenow/exe-os --depth=0 2>/dev/null", { encoding: "utf8" });
       const match = out.match(/@askexenow\/exe-os@(\S+)/);
       newVersion = match?.[1] ?? "unknown";
     } catch {
@@ -19931,7 +21008,7 @@ async function runUpdate(cliArgs) {
   }
   console.log("\u{1F527} Re-registering MCP, hooks, wrappers, and daemon...");
   try {
-    execSync16("exe-os-install --global", {
+    execSync17("exe-os-install --global", {
       stdio: ["pipe", "inherit", "inherit"],
       timeout: 3e5
     });
@@ -19966,7 +21043,7 @@ async function runUpdate(cliArgs) {
   }
   try {
     console.log("\u{1FA7A} Checking AskExe support intake...");
-    execSync16("exe-os support health", {
+    execSync17("exe-os support health", {
       stdio: ["pipe", "inherit", "inherit"],
       timeout: 3e4
     });
@@ -19994,11 +21071,11 @@ var init_update = __esm({
 // src/lib/stack-update.ts
 import { execFileSync as execFileSync4, spawnSync } from "child_process";
 import { createVerify, randomBytes as randomBytes2, verify as verifySignature } from "crypto";
-import { copyFileSync as copyFileSync5, existsSync as existsSync34, mkdirSync as mkdirSync24, readdirSync as readdirSync10, readFileSync as readFileSync29, renameSync as renameSync8, writeFileSync as writeFileSync25 } from "fs";
+import { copyFileSync as copyFileSync5, existsSync as existsSync36, mkdirSync as mkdirSync25, readdirSync as readdirSync11, readFileSync as readFileSync31, renameSync as renameSync8, writeFileSync as writeFileSync26 } from "fs";
 import http from "http";
 import https from "https";
-import path42 from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import path44 from "path";
+import { fileURLToPath as fileURLToPath7 } from "url";
 function isSignedEnvelope(value) {
   return !!value && typeof value === "object" && "manifest" in value && "signature" in value;
 }
@@ -20032,21 +21109,21 @@ function stableJson(value) {
   return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${stableJson(obj[key])}`).join(",")}}`;
 }
 function findLatestBackupEnvFile(envFile) {
-  const backupDir = path42.join(path42.dirname(envFile), ".exe-stack-backups");
-  if (!existsSync34(backupDir)) return null;
-  const backups = readdirSync10(backupDir).filter((name) => name.startsWith("env-") && name.endsWith(".bak")).sort();
+  const backupDir = path44.join(path44.dirname(envFile), ".exe-stack-backups");
+  if (!existsSync36(backupDir)) return null;
+  const backups = readdirSync11(backupDir).filter((name) => name.startsWith("env-") && name.endsWith(".bak")).sort();
   const latest = backups.at(-1);
-  return latest ? path42.join(backupDir, latest) : null;
+  return latest ? path44.join(backupDir, latest) : null;
 }
 async function rollbackStackUpdate(options) {
   const exec2 = options.exec ?? defaultExec;
-  const backupEnvFile = options.lockFile && existsSync34(options.lockFile) ? JSON.parse(readFileSync29(options.lockFile, "utf8")).backupEnvFile : void 0;
-  const rollbackEnv = backupEnvFile && existsSync34(backupEnvFile) ? backupEnvFile : findLatestBackupEnvFile(options.envFile);
+  const backupEnvFile = options.lockFile && existsSync36(options.lockFile) ? JSON.parse(readFileSync31(options.lockFile, "utf8")).backupEnvFile : void 0;
+  const rollbackEnv = backupEnvFile && existsSync36(backupEnvFile) ? backupEnvFile : findLatestBackupEnvFile(options.envFile);
   if (!rollbackEnv) throw new Error(`No stack backup env found beside ${options.envFile}`);
-  writeFileSync25(options.envFile, readFileSync29(rollbackEnv), { mode: 384 });
+  writeFileSync26(options.envFile, readFileSync31(rollbackEnv), { mode: 384 });
   const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
   exec2("docker", [...composeArgs, "up", "-d"]);
-  return { status: "rolled_back", targetVersion: "previous", changes: [], backupEnvFile: rollbackEnv, lockFile: options.lockFile ?? path42.join(path42.dirname(options.envFile), ".exe-stack-lock.json") };
+  return { status: "rolled_back", targetVersion: "previous", changes: [], backupEnvFile: rollbackEnv, lockFile: options.lockFile ?? path44.join(path44.dirname(options.envFile), ".exe-stack-lock.json") };
 }
 function parseStackManifest(raw, publicKey) {
   const parsedRaw = JSON.parse(raw);
@@ -20071,7 +21148,7 @@ function parseStackManifest(raw, publicKey) {
 }
 async function loadStackManifest(ref, fetchText = defaultFetchText, publicKey, authToken) {
   if (/^https?:\/\//.test(ref)) return parseStackManifest(await fetchTextWithAuth(ref, fetchText, authToken), publicKey);
-  return parseStackManifest(readFileSync29(ref, "utf8"), publicKey);
+  return parseStackManifest(readFileSync31(ref, "utf8"), publicKey);
 }
 async function fetchTextWithAuth(ref, fetchText, authToken) {
   if (!authToken || fetchText !== defaultFetchText) return fetchText(ref);
@@ -20200,9 +21277,9 @@ Emergency override requires --break-glass <reason> and writes an audit file.`
 function writeBreakGlassAudit(plan, issues, options) {
   const now2 = options.now ?? (() => /* @__PURE__ */ new Date());
   const stamp = now2().toISOString().replace(/[:.]/g, "-");
-  const defaultDir = existsSync34("exe/output") ? "exe/output" : path42.dirname(options.envFile ?? ".");
-  const auditFile = options.breakGlassAuditFile ?? path42.join(defaultDir, `stack-update-break-glass-${stamp}.md`);
-  mkdirSync24(path42.dirname(auditFile), { recursive: true });
+  const defaultDir = existsSync36("exe/output") ? "exe/output" : path44.dirname(options.envFile ?? ".");
+  const auditFile = options.breakGlassAuditFile ?? path44.join(defaultDir, `stack-update-break-glass-${stamp}.md`);
+  mkdirSync25(path44.dirname(auditFile), { recursive: true });
   const body = [
     `# Stack Update Break-Glass Audit \u2014 ${now2().toISOString()}`,
     "",
@@ -20216,7 +21293,7 @@ function writeBreakGlassAudit(plan, issues, options) {
     "Return this deployment to the standard pinned GHCR image path immediately after the emergency is resolved.",
     ""
   ].join("\n");
-  writeFileSync25(auditFile, body, { mode: 384 });
+  writeFileSync26(auditFile, body, { mode: 384 });
   console.warn(`[stack-update] BREAK-GLASS deploy override recorded: ${auditFile}`);
 }
 function assertBreakingChangesAllowed(plan, allowedIds) {
@@ -20242,26 +21319,26 @@ function shellSucceeds(command) {
   return res.status === 0;
 }
 function resolvePackageRoot2() {
-  const here = path42.dirname(fileURLToPath5(import.meta.url));
+  const here = path44.dirname(fileURLToPath7(import.meta.url));
   const candidates = [
-    path42.resolve(here, "..", ".."),
-    path42.resolve(here, ".."),
+    path44.resolve(here, "..", ".."),
+    path44.resolve(here, ".."),
     process.cwd()
   ];
   for (const c of candidates) {
-    if (existsSync34(path42.join(c, "package.json")) && existsSync34(path42.join(c, "deploy", "compose", "docker-compose.yml"))) return c;
+    if (existsSync36(path44.join(c, "package.json")) && existsSync36(path44.join(c, "deploy", "compose", "docker-compose.yml"))) return c;
   }
   return process.cwd();
 }
 function copyTemplateIfMissing(srcRel, dest, created) {
-  if (existsSync34(dest)) return;
-  const src = path42.join(resolvePackageRoot2(), srcRel);
-  if (!existsSync34(src)) throw new Error(`Missing packaged stack template: ${srcRel}. Reinstall/update exe-os and retry.`);
+  if (existsSync36(dest)) return;
+  const src = path44.join(resolvePackageRoot2(), srcRel);
+  if (!existsSync36(src)) throw new Error(`Missing packaged stack template: ${srcRel}. Reinstall/update exe-os and retry.`);
   try {
-    mkdirSync24(path42.dirname(dest), { recursive: true });
+    mkdirSync25(path44.dirname(dest), { recursive: true });
   } catch (err) {
     if (err.code === "EACCES") {
-      const dir = path42.dirname(dest);
+      const dir = path44.dirname(dest);
       throw new Error(
         `Permission denied creating ${dir}. Run this first:
 
@@ -20277,8 +21354,8 @@ Then re-run stack-update.`
 }
 function installDockerUbuntu(exec2) {
   if (process.platform !== "linux") throw new Error("Docker auto-install is only supported on Linux. Install Docker manually, then retry.");
-  if (!existsSync34("/etc/os-release")) throw new Error("Cannot detect Linux distro; install Docker manually, then retry.");
-  const osRelease = readFileSync29("/etc/os-release", "utf8");
+  if (!existsSync36("/etc/os-release")) throw new Error("Cannot detect Linux distro; install Docker manually, then retry.");
+  const osRelease = readFileSync31("/etc/os-release", "utf8");
   if (!/ID=(ubuntu|debian)|ID_LIKE=.*debian/.test(osRelease)) {
     throw new Error("Docker auto-install currently supports Ubuntu/Debian only. Install Docker manually, then retry.");
   }
@@ -20315,7 +21392,7 @@ function hydrateEnv(raw, opts) {
   for (const [key, value] of env.entries()) {
     if (!/CHANGEME/.test(value)) continue;
     if (key === "EXE_LICENSE_KEY" && license) replacements[key] = license;
-    else if (key === "MONITOR_AGENT_KEY") continue;
+    else if (key === "MONITOR_AGENT_TOKEN" || key === "MONITOR_AGENT_KEY") continue;
     else if (key === "EXE_GATEWAY_WS_RELAY_AUTH_TOKEN") replacements[key] = randomHexSecret(24);
     else if (key.endsWith("_PASSWORD")) replacements[key] = randomSecret(24);
     else if (key.endsWith("_TOKEN")) replacements[key] = randomHexSecret(32);
@@ -20327,6 +21404,45 @@ function hydrateEnv(raw, opts) {
   const remaining = [...parseEnv(next).entries()].filter(([, value]) => /CHANGEME/.test(value)).map(([key, value]) => `${key}=${value}`);
   return { raw: next, hadPlaceholders: /CHANGEME/.test(raw), remaining: [...new Set(remaining)] };
 }
+async function pairMonitorAgent(hubUrl, licenseKey, domain, envFile) {
+  if (!hubUrl || !licenseKey || !domain) {
+    return { paired: false, error: "Missing hubUrl, licenseKey, or domain for monitor pairing" };
+  }
+  const registrationUrl = `${hubUrl.replace(/\/+$/, "")}/api/register-agent`;
+  try {
+    const res = await fetch(registrationUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${licenseKey}`
+      },
+      body: JSON.stringify({ name: domain, host: domain, port: 45876 }),
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      return { paired: false, error: `Monitor hub returned HTTP ${res.status}: ${body}` };
+    }
+    const data = await res.json();
+    if (!data.token || !data.key) {
+      return { paired: false, error: "Monitor hub response missing token or key" };
+    }
+    if (existsSync36(envFile)) {
+      const envRaw = readFileSync31(envFile, "utf8");
+      const patched = patchEnv(envRaw, {
+        MONITOR_AGENT_TOKEN: data.token,
+        MONITOR_AGENT_KEY: data.key
+      });
+      if (patched !== envRaw) {
+        writeFileSync26(envFile, patched, { mode: 384 });
+      }
+    }
+    return { paired: true, systemName: data.name ?? domain };
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    return { paired: false, error: `Monitor hub unreachable: ${reason}` };
+  }
+}
 function bootstrapStackHost(options) {
   const exec2 = options.exec ?? defaultExec;
   const createdFiles = [];
@@ -20341,26 +21457,26 @@ function bootstrapStackHost(options) {
   }
   copyTemplateIfMissing("deploy/compose/docker-compose.yml", options.composeFile, createdFiles);
   copyTemplateIfMissing("deploy/compose/.env.customer.example", options.envFile, createdFiles);
-  const brandingDest = path42.join(path42.dirname(options.envFile), "branding.json");
-  copyTemplateIfMissing("deploy/compose/gateway.json", path42.join(path42.dirname(options.envFile), "gateway.json"), createdFiles);
-  if (!existsSync34(brandingDest)) writeFileSync25(brandingDest, JSON.stringify({ brandName: "Hygo", productName: "Hygo OS" }, null, 2) + "\n", { mode: 384 });
+  const brandingDest = path44.join(path44.dirname(options.envFile), "branding.json");
+  copyTemplateIfMissing("deploy/compose/gateway.json", path44.join(path44.dirname(options.envFile), "gateway.json"), createdFiles);
+  if (!existsSync36(brandingDest)) writeFileSync26(brandingDest, JSON.stringify({ brandName: "Hygo", productName: "Hygo OS" }, null, 2) + "\n", { mode: 384 });
   let envHadPlaceholders = false;
   let envRemainingPlaceholders = [];
-  if (existsSync34(options.envFile)) {
-    const envRaw = readFileSync29(options.envFile, "utf8");
+  if (existsSync36(options.envFile)) {
+    const envRaw = readFileSync31(options.envFile, "utf8");
     const hydrated = hydrateEnv(envRaw, options);
     envHadPlaceholders = hydrated.hadPlaceholders;
     envRemainingPlaceholders = hydrated.remaining;
     if (hydrated.raw !== envRaw) {
-      writeFileSync25(options.envFile, hydrated.raw, { mode: 384 });
+      writeFileSync26(options.envFile, hydrated.raw, { mode: 384 });
       actions.push("hydrate_env_secrets");
     }
   }
   return {
     dockerInstalled,
     dockerComposeInstalled,
-    composeFileExists: existsSync34(options.composeFile),
-    envFileExists: existsSync34(options.envFile),
+    composeFileExists: existsSync36(options.composeFile),
+    envFileExists: existsSync36(options.envFile),
     envHadPlaceholders,
     envRemainingPlaceholders,
     licensePresent: !!(options.licenseKey || process.env.EXE_LICENSE_KEY || loadLicense()),
@@ -20399,35 +21515,51 @@ async function runStackUpdate(options) {
     const report = bootstrapStackHost({ ...options, installDocker: options.installDocker ?? !!options.yes });
     if (!options.dryRun) assertHostReadyForApply(report);
   }
+  const hubUrl = options.monitorHubUrl || parseEnv(readFileSync31(options.envFile, "utf8")).get("MONITOR_HUB_URL") || "";
+  const pairLicense = options.licenseKey || process.env.EXE_LICENSE_KEY || loadLicense() || "";
+  const pairDomain = options.domain || process.env.EXE_STACK_DOMAIN || process.env.CUSTOMER_DOMAIN || "";
+  if (hubUrl && pairLicense && pairDomain) {
+    const envBefore = readFileSync31(options.envFile, "utf8");
+    const hasPlaceholder = /CHANGEME/.test(parseEnv(envBefore).get("MONITOR_AGENT_TOKEN") ?? "");
+    if (hasPlaceholder) {
+      const pair = options.pairMonitor ? options.pairMonitor(hubUrl, pairLicense, pairDomain, options.envFile) : pairMonitorAgent(hubUrl, pairLicense, pairDomain, options.envFile);
+      const result = await pair;
+      if (result.paired) {
+        console.log(`[stack-update] Monitor agent paired: ${result.systemName}`);
+      } else {
+        console.warn(`[stack-update] Monitor pairing skipped: ${result.error}`);
+      }
+    }
+  }
   const manifest = await loadStackManifest(options.manifestRef, options.fetchText, options.manifestPublicKey, options.manifestAuthToken);
-  const envRaw = readFileSync29(options.envFile, "utf8");
+  const envRaw = readFileSync31(options.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, options.targetVersion);
   assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
   assertDeploymentScopeAllowed(plan, options.deploymentPersona ?? "customer");
   const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
-  const composeRaw = readFileSync29(options.composeFile, "utf8");
+  const composeRaw = readFileSync31(options.composeFile, "utf8");
   assertProductionDeployGate(plan, plannedEnvRaw, composeRaw, {
     breakGlassReason: options.breakGlassReason,
     breakGlassAuditFile: options.breakGlassAuditFile,
     now: now2,
     envFile: options.envFile
   });
-  const lockFile = options.lockFile ?? path42.join(path42.dirname(options.envFile), ".exe-stack-lock.json");
+  const lockFile = options.lockFile ?? path44.join(path44.dirname(options.envFile), ".exe-stack-lock.json");
   const previousVersion = readCurrentStackVersion(lockFile);
   const containersRunning = plan.changes.length === 0 ? areStackContainersRunning(options.composeFile, options.envFile) : true;
   if (options.dryRun || plan.changes.length === 0 && containersRunning) {
     return { status: "planned", targetVersion: plan.targetVersion, changes: plan.changes, lockFile };
   }
   await postDeployAudit(options, "started", plan.targetVersion, previousVersion);
-  const backupDir = path42.join(path42.dirname(options.envFile), ".exe-stack-backups");
-  mkdirSync24(backupDir, { recursive: true });
+  const backupDir = path44.join(path44.dirname(options.envFile), ".exe-stack-backups");
+  mkdirSync25(backupDir, { recursive: true });
   const stamp = now2().toISOString().replace(/[:.]/g, "-");
-  const backupEnvFile = path42.join(backupDir, `env-${stamp}.bak`);
-  writeFileSync25(backupEnvFile, envRaw, { mode: 384 });
+  const backupEnvFile = path44.join(backupDir, `env-${stamp}.bak`);
+  writeFileSync26(backupEnvFile, envRaw, { mode: 384 });
   const updates = Object.fromEntries(plan.changes.map((c) => [c.key, c.after]));
   const patched = patchEnv(envRaw, updates);
   const tmp = `${options.envFile}.tmp-${process.pid}`;
-  writeFileSync25(tmp, patched, { mode: 384 });
+  writeFileSync26(tmp, patched, { mode: 384 });
   renameSync8(tmp, options.envFile);
   const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
   let registryForLogout;
@@ -20440,11 +21572,11 @@ async function runStackUpdate(options) {
     exec2("docker", [...composeArgs, "pull"]);
     exec2("docker", [...composeArgs, "up", "-d"]);
     await verifyReleaseHealth(plan.release, options.healthRetries ?? 12, options.healthDelayMs ?? 5e3);
-    writeFileSync25(lockFile, JSON.stringify({ stackVersion: plan.targetVersion, updatedAt: now2().toISOString(), backupEnvFile, services: plan.release.services }, null, 2) + "\n");
+    writeFileSync26(lockFile, JSON.stringify({ stackVersion: plan.targetVersion, updatedAt: now2().toISOString(), backupEnvFile, services: plan.release.services }, null, 2) + "\n");
     await postDeployAudit(options, "success", plan.targetVersion, previousVersion, void 0, { changes: plan.changes.length });
     return { status: "updated", targetVersion: plan.targetVersion, changes: plan.changes, backupEnvFile, lockFile };
   } catch (err) {
-    writeFileSync25(options.envFile, envRaw, { mode: 384 });
+    writeFileSync26(options.envFile, envRaw, { mode: 384 });
     try {
       exec2("docker", [...composeArgs, "up", "-d"]);
     } catch {
@@ -20475,9 +21607,9 @@ async function fetchImageCredentials(options) {
   return await res.json();
 }
 function readCurrentStackVersion(lockFile) {
-  if (!existsSync34(lockFile)) return void 0;
+  if (!existsSync36(lockFile)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync29(lockFile, "utf8"));
+    const parsed = JSON.parse(readFileSync31(lockFile, "utf8"));
     return parsed.stackVersion;
   } catch {
     return void 0;
@@ -20565,13 +21697,13 @@ async function defaultPostJson(url, body, authToken) {
   if (!res.ok) throw new Error(`Failed to POST ${url}: HTTP ${res.status}`);
 }
 function defaultStackPaths() {
-  const cwdCompose = path42.resolve("docker-compose.yml");
-  const cwdEnv = path42.resolve(".env");
-  const packagedManifest = path42.join(resolvePackageRoot2(), "deploy", "stack-manifests", "v0.9.json");
-  const manifestRef = process.env.EXE_STACK_MANIFEST || (existsSync34(packagedManifest) ? packagedManifest : "https://update.askexe.com/stack-manifest.json");
+  const cwdCompose = path44.resolve("docker-compose.yml");
+  const cwdEnv = path44.resolve(".env");
+  const packagedManifest = path44.join(resolvePackageRoot2(), "deploy", "stack-manifests", "v0.9.json");
+  const manifestRef = process.env.EXE_STACK_MANIFEST || (existsSync36(packagedManifest) ? packagedManifest : "https://update.askexe.com/stack-manifest.json");
   return {
-    composeFile: process.env.EXE_STACK_COMPOSE_FILE || (existsSync34(cwdCompose) ? cwdCompose : "/opt/exe-stack/docker-compose.yml"),
-    envFile: process.env.EXE_STACK_ENV_FILE || (existsSync34(cwdEnv) ? cwdEnv : "/opt/exe-stack/.env"),
+    composeFile: process.env.EXE_STACK_COMPOSE_FILE || (existsSync36(cwdCompose) ? cwdCompose : "/opt/exe-stack/docker-compose.yml"),
+    envFile: process.env.EXE_STACK_ENV_FILE || (existsSync36(cwdEnv) ? cwdEnv : "/opt/exe-stack/.env"),
     manifestRef,
     // Only call update.askexe.com if explicitly configured or if a remote manifest was requested.
     // Packaged manifests keep cold-start installs unblocked even before update-service entitlements are provisioned.
@@ -20585,8 +21717,8 @@ function defaultStackPaths() {
 }
 function loadDefaultPublicKey() {
   if (process.env.EXE_STACK_PUBLIC_KEY) return process.env.EXE_STACK_PUBLIC_KEY;
-  if (process.env.EXE_STACK_PUBLIC_KEY_FILE && existsSync34(process.env.EXE_STACK_PUBLIC_KEY_FILE)) {
-    return readFileSync29(process.env.EXE_STACK_PUBLIC_KEY_FILE, "utf8");
+  if (process.env.EXE_STACK_PUBLIC_KEY_FILE && existsSync36(process.env.EXE_STACK_PUBLIC_KEY_FILE)) {
+    return readFileSync31(process.env.EXE_STACK_PUBLIC_KEY_FILE, "utf8");
   }
   return void 0;
 }
@@ -20604,7 +21736,7 @@ var stack_update_exports = {};
 __export(stack_update_exports, {
   runStackUpdateCli: () => main7
 });
-import { readFileSync as readFileSync30 } from "fs";
+import { readFileSync as readFileSync32 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
 function parseArgs4(args2) {
   const defaults = defaultStackPaths();
@@ -20638,8 +21770,8 @@ function parseArgs4(args2) {
     else if (arg === "--env-file" || arg === "--stack-env-file") opts.envFile = next();
     else if (arg.startsWith("--env-file=") || arg.startsWith("--stack-env-file=")) opts.envFile = arg.split("=").slice(1).join("=");
     else if (arg === "--lock-file") opts.lockFile = next();
-    else if (arg === "--public-key") opts.manifestPublicKey = readFileSync30(next(), "utf8");
-    else if (arg.startsWith("--public-key=")) opts.manifestPublicKey = readFileSync30(arg.split("=").slice(1).join("="), "utf8");
+    else if (arg === "--public-key") opts.manifestPublicKey = readFileSync32(next(), "utf8");
+    else if (arg.startsWith("--public-key=")) opts.manifestPublicKey = readFileSync32(arg.split("=").slice(1).join("="), "utf8");
     else if (arg === "--auth-token") opts.manifestAuthToken = next();
     else if (arg.startsWith("--auth-token=")) opts.manifestAuthToken = arg.split("=").slice(1).join("=");
     else if (arg === "--auth-token-env") opts.manifestAuthToken = process.env[next()] ?? "";
@@ -20844,11 +21976,11 @@ async function main7(args2 = process.argv.slice(2)) {
     if (!opts.check && !opts.dryRun) assertHostReadyForApply(hostReport);
   }
   const manifest = await loadStackManifest(opts.manifestRef, void 0, opts.manifestPublicKey, opts.manifestAuthToken);
-  const envRaw = readFileSync30(opts.envFile, "utf8");
+  const envRaw = readFileSync32(opts.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, opts.targetVersion);
   assertDeploymentScopeAllowed(plan, opts.deploymentPersona);
   const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
-  assertProductionDeployGate(plan, plannedEnvRaw, readFileSync30(opts.composeFile, "utf8"), {
+  assertProductionDeployGate(plan, plannedEnvRaw, readFileSync32(opts.composeFile, "utf8"), {
     breakGlassReason: opts.breakGlassReason,
     breakGlassAuditFile: opts.breakGlassAuditFile,
     envFile: opts.envFile
@@ -25450,8 +26582,8 @@ var init_ErrorOverview = __esm({
     "use strict";
     init_Box();
     init_Text();
-    cleanupPath = (path56) => {
-      return path56?.replace(`file://${cwd()}/`, "");
+    cleanupPath = (path58) => {
+      return path58?.replace(`file://${cwd()}/`, "");
     };
     stackUtils = new StackUtils({
       cwd: cwd(),
@@ -27555,13 +28687,13 @@ __export(tmux_status_exports, {
   parseActivity: () => parseActivity,
   parseContextPercentage: () => parseContextPercentage
 });
-import { execSync as execSync17 } from "child_process";
+import { execSync as execSync18 } from "child_process";
 function inTmux() {
   if (process.env.TMUX || process.env.TMUX_PANE) return true;
   const term = process.env.TERM ?? "";
   if (term.startsWith("tmux") || term.startsWith("screen")) return true;
   try {
-    execSync17("tmux display-message -p '#{session_name}' 2>/dev/null", {
+    execSync18("tmux display-message -p '#{session_name}' 2>/dev/null", {
       encoding: "utf8",
       timeout: 2e3
     });
@@ -27571,12 +28703,12 @@ function inTmux() {
   try {
     let pid = process.ppid;
     for (let depth = 0; depth < 8 && pid > 1; depth++) {
-      const comm = execSync17(`ps -p ${pid} -o comm= 2>/dev/null`, {
+      const comm = execSync18(`ps -p ${pid} -o comm= 2>/dev/null`, {
         encoding: "utf8",
         timeout: 1e3
       }).trim();
       if (/tmux/.test(comm)) return true;
-      const ppid = execSync17(`ps -p ${pid} -o ppid= 2>/dev/null`, {
+      const ppid = execSync18(`ps -p ${pid} -o ppid= 2>/dev/null`, {
         encoding: "utf8",
         timeout: 1e3
       }).trim();
@@ -27589,7 +28721,7 @@ function inTmux() {
 }
 function listTmuxSessions() {
   try {
-    const out = execSync17("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
+    const out = execSync18("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
       encoding: "utf8",
       timeout: 3e3
     });
@@ -27600,7 +28732,7 @@ function listTmuxSessions() {
 }
 function capturePaneLines(windowName, lines = 10) {
   try {
-    const out = execSync17(
+    const out = execSync18(
       `tmux capture-pane -t ${JSON.stringify(windowName)} -p 2>/dev/null | tail -${lines}`,
       { encoding: "utf8", timeout: 3e3 }
     );
@@ -27611,7 +28743,7 @@ function capturePaneLines(windowName, lines = 10) {
 }
 function getPaneCwd(windowName) {
   try {
-    const out = execSync17(
+    const out = execSync18(
       `tmux display-message -t ${JSON.stringify(windowName)} -p '#{pane_current_path}' 2>/dev/null`,
       { encoding: "utf8", timeout: 3e3 }
     );
@@ -27622,7 +28754,7 @@ function getPaneCwd(windowName) {
 }
 function projectFromPath(dir) {
   try {
-    const root = execSync17("git -C " + JSON.stringify(dir) + " rev-parse --show-toplevel 2>/dev/null", {
+    const root = execSync18("git -C " + JSON.stringify(dir) + " rev-parse --show-toplevel 2>/dev/null", {
       encoding: "utf8",
       timeout: 3e3
     }).trim();
@@ -27691,7 +28823,7 @@ function getEmployeeStatuses(employeeNames) {
     }
     let paneAlive = true;
     try {
-      const paneStatus = execSync17(
+      const paneStatus = execSync18(
         `tmux list-panes -t ${JSON.stringify(sessionName)} -F '#{pane_dead}' 2>/dev/null`,
         { encoding: "utf8", timeout: 3e3 }
       ).trim();
@@ -27859,11 +28991,11 @@ function Footer() {
       } catch {
       }
       try {
-        const { existsSync: existsSync41 } = await import("fs");
+        const { existsSync: existsSync43 } = await import("fs");
         const { join } = await import("path");
         const home = process.env.HOME ?? "";
         const pidPath = join(home, ".exe-os", "exed.pid");
-        setDaemon(existsSync41(pidPath) ? "running" : "stopped");
+        setDaemon(existsSync43(pidPath) ? "running" : "stopped");
       } catch {
         setDaemon("unknown");
       }
@@ -27881,8 +29013,8 @@ function Footer() {
           setSessions(allSessions.length);
           if (!currentSession) {
             try {
-              const { execSync: execSync19 } = await import("child_process");
-              const name = execSync19("tmux display-message -p '#{session_name}' 2>/dev/null", {
+              const { execSync: execSync20 } = await import("child_process");
+              const name = execSync20("tmux display-message -p '#{session_name}' 2>/dev/null", {
                 encoding: "utf8",
                 timeout: 2e3
               }).trim();
@@ -29914,10 +31046,10 @@ var init_hooks = __esm({
 });
 
 // src/runtime/safety-checks.ts
-import path43 from "path";
+import path45 from "path";
 import os21 from "os";
 function checkPathSafety(filePath) {
-  const resolved = path43.resolve(filePath);
+  const resolved = path45.resolve(filePath);
   for (const { pattern, reason } of BYPASS_IMMUNE_PATTERNS) {
     const matches = typeof pattern === "function" ? pattern(resolved) : pattern.test(resolved);
     if (matches) {
@@ -29927,7 +31059,7 @@ function checkPathSafety(filePath) {
   return { safe: true, bypassImmune: true };
 }
 function checkReadPathSafety(filePath) {
-  const resolved = path43.resolve(filePath);
+  const resolved = path45.resolve(filePath);
   const credPatterns = BYPASS_IMMUNE_PATTERNS.filter(
     (p) => typeof p.pattern !== "function" && (p.reason.includes("secrets") || p.reason.includes("Private key") || p.reason.includes("Credential"))
   );
@@ -29953,11 +31085,11 @@ var init_safety_checks = __esm({
         reason: "Git config can set hooks and command execution"
       },
       {
-        pattern: (p) => p.startsWith(path43.join(HOME, ".claude")),
+        pattern: (p) => p.startsWith(path45.join(HOME, ".claude")),
         reason: "Claude configuration files are protected"
       },
       {
-        pattern: (p) => p.startsWith(path43.join(HOME, ".exe-os")),
+        pattern: (p) => p.startsWith(path45.join(HOME, ".exe-os")),
         reason: "exe-os configuration files are protected"
       },
       {
@@ -29974,7 +31106,7 @@ var init_safety_checks = __esm({
       },
       {
         pattern: (p) => {
-          const name = path43.basename(p);
+          const name = path45.basename(p);
           return [".bashrc", ".zshrc", ".profile", ".bash_profile", ".zprofile", ".zshenv"].includes(name);
         },
         reason: "Shell configuration files can execute arbitrary code on login"
@@ -30001,7 +31133,7 @@ __export(file_read_exports, {
   FileReadTool: () => FileReadTool
 });
 import fs3 from "fs/promises";
-import path44 from "path";
+import path46 from "path";
 import { z } from "zod";
 function isBinary(buf) {
   for (let i = 0; i < buf.length; i++) {
@@ -30037,7 +31169,7 @@ var init_file_read = __esm({
         return { behavior: "allow" };
       },
       async call(input, context) {
-        const filePath = path44.isAbsolute(input.file_path) ? input.file_path : path44.resolve(context.cwd, input.file_path);
+        const filePath = path46.isAbsolute(input.file_path) ? input.file_path : path46.resolve(context.cwd, input.file_path);
         let stat2;
         try {
           stat2 = await fs3.stat(filePath);
@@ -30077,7 +31209,7 @@ __export(glob_exports, {
   GlobTool: () => GlobTool
 });
 import fs4 from "fs/promises";
-import path45 from "path";
+import path47 from "path";
 import { z as z2 } from "zod";
 async function walkDir(dir, maxDepth = 10) {
   const results = [];
@@ -30093,7 +31225,7 @@ async function walkDir(dir, maxDepth = 10) {
       if (entry.isDirectory() && (entry.name === "node_modules" || entry.name === ".git")) {
         continue;
       }
-      const fullPath = path45.join(current, entry.name);
+      const fullPath = path47.join(current, entry.name);
       if (entry.isDirectory()) {
         await walk(fullPath, depth + 1);
       } else {
@@ -30127,11 +31259,11 @@ var init_glob = __esm({
       inputSchema: inputSchema2,
       isReadOnly: true,
       async call(input, context) {
-        const baseDir = input.path ? path45.isAbsolute(input.path) ? input.path : path45.resolve(context.cwd, input.path) : context.cwd;
+        const baseDir = input.path ? path47.isAbsolute(input.path) ? input.path : path47.resolve(context.cwd, input.path) : context.cwd;
         try {
           const entries = await walkDir(baseDir);
           const matched = entries.filter(
-            (e) => simpleGlobMatch(path45.relative(baseDir, e.path), input.pattern)
+            (e) => simpleGlobMatch(path47.relative(baseDir, e.path), input.pattern)
           );
           matched.sort((a, b) => b.mtime - a.mtime);
           if (matched.length === 0) {
@@ -30157,7 +31289,7 @@ __export(grep_exports, {
 });
 import { spawn as spawn2 } from "child_process";
 import fs5 from "fs/promises";
-import path46 from "path";
+import path48 from "path";
 import { z as z3 } from "zod";
 function runRipgrep(input, searchPath, context) {
   return new Promise((resolve, reject) => {
@@ -30211,7 +31343,7 @@ async function nodeGrep(input, searchPath) {
     }
     for (const entry of entries) {
       if (entry.name === "node_modules" || entry.name === ".git") continue;
-      const fullPath = path46.join(dir, entry.name);
+      const fullPath = path48.join(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(fullPath);
       } else {
@@ -30257,7 +31389,7 @@ var init_grep = __esm({
       inputSchema: inputSchema3,
       isReadOnly: true,
       async call(input, context) {
-        const searchPath = input.path ? path46.isAbsolute(input.path) ? input.path : path46.resolve(context.cwd, input.path) : context.cwd;
+        const searchPath = input.path ? path48.isAbsolute(input.path) ? input.path : path48.resolve(context.cwd, input.path) : context.cwd;
         try {
           const result = await runRipgrep(input, searchPath, context);
           return result;
@@ -30282,7 +31414,7 @@ __export(file_write_exports, {
   FileWriteTool: () => FileWriteTool
 });
 import fs6 from "fs/promises";
-import path47 from "path";
+import path49 from "path";
 import { z as z4 } from "zod";
 var inputSchema4, FileWriteTool;
 var init_file_write = __esm({
@@ -30310,8 +31442,8 @@ var init_file_write = __esm({
         return { behavior: "allow" };
       },
       async call(input, context) {
-        const filePath = path47.isAbsolute(input.file_path) ? input.file_path : path47.resolve(context.cwd, input.file_path);
-        const dir = path47.dirname(filePath);
+        const filePath = path49.isAbsolute(input.file_path) ? input.file_path : path49.resolve(context.cwd, input.file_path);
+        const dir = path49.dirname(filePath);
         await fs6.mkdir(dir, { recursive: true });
         await fs6.writeFile(filePath, input.content, "utf-8");
         return {
@@ -30329,7 +31461,7 @@ __export(file_edit_exports, {
   FileEditTool: () => FileEditTool
 });
 import fs7 from "fs/promises";
-import path48 from "path";
+import path50 from "path";
 import { z as z5 } from "zod";
 function countOccurrences(haystack, needle) {
   let count = 0;
@@ -30370,7 +31502,7 @@ var init_file_edit = __esm({
         return { behavior: "allow" };
       },
       async call(input, context) {
-        const filePath = path48.isAbsolute(input.file_path) ? input.file_path : path48.resolve(context.cwd, input.file_path);
+        const filePath = path50.isAbsolute(input.file_path) ? input.file_path : path50.resolve(context.cwd, input.file_path);
         let content;
         try {
           content = await fs7.readFile(filePath, "utf-8");
@@ -30612,7 +31744,7 @@ var init_bash = __esm({
 // src/tui/views/CommandCenter.tsx
 import { useState as useState6, useEffect as useEffect8, useMemo as useMemo4, useCallback as useCallback4, useRef as useRef4 } from "react";
 import TextInput from "ink-text-input";
-import path49 from "path";
+import path51 from "path";
 import { homedir as homedir6 } from "os";
 import { Fragment as Fragment2, jsx as jsx7, jsxs as jsxs5 } from "react/jsx-runtime";
 function CommandCenterView({
@@ -30647,15 +31779,15 @@ function CommandCenterView({
         const { createPermissionsFromPreset: createPermissionsFromPreset2, EMPLOYEE_PERMISSIONS: EMPLOYEE_PERMISSIONS2 } = await Promise.resolve().then(() => (init_permissions(), permissions_exports));
         const { getPresetByRole: getPresetByRole2 } = await Promise.resolve().then(() => (init_permission_presets(), permission_presets_exports));
         const { createDefaultHooks: createDefaultHooks2 } = await Promise.resolve().then(() => (init_hooks(), hooks_exports));
-        const { readFileSync: readFileSync37, existsSync: existsSync41 } = await import("fs");
+        const { readFileSync: readFileSync39, existsSync: existsSync43 } = await import("fs");
         const { join } = await import("path");
         const { homedir: homedir8 } = await import("os");
         const configPath = join(homedir8(), ".exe-os", "config.json");
         let failoverChain = ["anthropic", "opencode", "gemini", "openai"];
         let providerConfigs = {};
-        if (existsSync41(configPath)) {
+        if (existsSync43(configPath)) {
           try {
-            const raw = JSON.parse(readFileSync37(configPath, "utf8"));
+            const raw = JSON.parse(readFileSync39(configPath, "utf8"));
             if (Array.isArray(raw.failoverChain)) failoverChain = raw.failoverChain;
             if (raw.providers && typeof raw.providers === "object") {
               providerConfigs = raw.providers;
@@ -30716,7 +31848,7 @@ function CommandCenterView({
           const markerDir = join(homedir8(), ".exe-os", "session-cache");
           const agentFiles = (await import("fs")).readdirSync(markerDir).filter((f) => f.startsWith("active-agent-"));
           for (const f of agentFiles) {
-            const data = JSON.parse(readFileSync37(join(markerDir, f), "utf8"));
+            const data = JSON.parse(readFileSync39(join(markerDir, f), "utf8"));
             if (data.agentRole) {
               agentRole = data.agentRole;
               break;
@@ -30861,7 +31993,7 @@ function CommandCenterView({
       const demoEntries = DEMO_PROJECTS.map((p) => ({
         projectName: p.projectName,
         exeSession: p.exeSession,
-        projectDir: path49.join(homedir6(), p.projectName),
+        projectDir: path51.join(homedir6(), p.projectName),
         employeeCount: p.employees.length,
         activeCount: p.employees.filter((e) => e.status === "active").length,
         memoryCount: p.employees.length * 4e3,
@@ -30899,7 +32031,7 @@ function CommandCenterView({
         const { listSessions: listSessions2 } = await Promise.resolve().then(() => (init_session_registry(), session_registry_exports));
         const { listTmuxSessions: listTmuxSessions2, inTmux: inTmux2 } = await Promise.resolve().then(() => (init_tmux_status(), tmux_status_exports));
         const { loadEmployees: loadEmployees2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
-        const { existsSync: existsSync41 } = await import("fs");
+        const { existsSync: existsSync43 } = await import("fs");
         const { join } = await import("path");
         const client = getClient2();
         if (!client) {
@@ -30970,7 +32102,7 @@ function CommandCenterView({
           }
           const memoryCount = memoryCounts.get(name) ?? 0;
           const openTaskCount = openTaskCounts.get(name) ?? 0;
-          const hasGit = projectDir ? existsSync41(join(projectDir, ".git")) : false;
+          const hasGit = projectDir ? existsSync43(join(projectDir, ".git")) : false;
           const type = hasGit ? "code" : memoryCount > 0 ? "code" : "automation";
           projectList.push({
             projectName: name,
@@ -30995,7 +32127,7 @@ function CommandCenterView({
         setHealth((h) => ({ ...h, memories: Number(totalResult.rows[0]?.cnt ?? 0) }));
         try {
           const pidPath = join(process.env.HOME ?? "", ".exe-os", "exed.pid");
-          setHealth((h) => ({ ...h, daemon: existsSync41(pidPath) ? "running" : "stopped" }));
+          setHealth((h) => ({ ...h, daemon: existsSync43(pidPath) ? "running" : "stopped" }));
         } catch {
         }
         const activityResult = await client.execute(
@@ -31236,8 +32368,8 @@ function TmuxPane({ sessionName, employeeName, employeeRole, projectName, onDeta
     }
     const capture = () => {
       try {
-        const { execSync: execSync19 } = __require("child_process");
-        const output2 = execSync19(
+        const { execSync: execSync20 } = __require("child_process");
+        const output2 = execSync20(
           `tmux capture-pane -t ${JSON.stringify(sessionName)} -p -e 2>/dev/null | tail -${CAPTURE_LINES}`,
           { encoding: "utf8", timeout: 3e3 }
         );
@@ -31261,8 +32393,8 @@ function TmuxPane({ sessionName, employeeName, employeeRole, projectName, onDeta
     if (key.return) {
       if (!demo && inputBuffer.trim()) {
         try {
-          const { execSync: execSync19 } = __require("child_process");
-          execSync19(
+          const { execSync: execSync20 } = __require("child_process");
+          execSync20(
             `tmux send-keys -t ${JSON.stringify(sessionName)} ${JSON.stringify(inputBuffer)} Enter`,
             { timeout: 2e3 }
           );
@@ -31270,8 +32402,8 @@ function TmuxPane({ sessionName, employeeName, employeeRole, projectName, onDeta
         }
       } else if (!demo) {
         try {
-          const { execSync: execSync19 } = __require("child_process");
-          execSync19(`tmux send-keys -t ${JSON.stringify(sessionName)} Enter`, { timeout: 2e3 });
+          const { execSync: execSync20 } = __require("child_process");
+          execSync20(`tmux send-keys -t ${JSON.stringify(sessionName)} Enter`, { timeout: 2e3 });
         } catch {
         }
       }
@@ -31751,12 +32883,12 @@ function useOrchestrator(enabled = true) {
           searchFn: async () => [],
           autoApproveP2: true
         });
-        await runHealthCheck();
+        await runHealthCheck2();
       } catch {
         setIsLoading(false);
       }
     }
-    async function runHealthCheck() {
+    async function runHealthCheck2() {
       if (cancelled || !orchestratorRef.current) return;
       try {
         const health = await orchestratorRef.current.healthCheck();
@@ -31785,7 +32917,7 @@ function useOrchestrator(enabled = true) {
       setIsLoading(false);
     }
     init();
-    const timer = setInterval(runHealthCheck, TICK_INTERVAL_MS);
+    const timer = setInterval(runHealthCheck2, TICK_INTERVAL_MS);
     return () => {
       cancelled = true;
       clearInterval(timer);
@@ -31865,7 +32997,7 @@ var init_useOrchestrator = __esm({
 
 // src/tui/views/Sessions.tsx
 import React19, { useState as useState9, useEffect as useEffect11, useCallback as useCallback6 } from "react";
-import path50 from "path";
+import path52 from "path";
 import { homedir as homedir7 } from "os";
 import { jsx as jsx9, jsxs as jsxs7 } from "react/jsx-runtime";
 function isCoordinatorEntry(entry) {
@@ -31903,7 +33035,7 @@ function SessionsView({
     if (demo) {
       setProjects(DEMO_PROJECTS.map((p) => ({
         ...p,
-        projectDir: path50.join(homedir7(), p.projectName),
+        projectDir: path52.join(homedir7(), p.projectName),
         employees: p.employees.map((e) => ({ ...e, attached: e.status === "active" }))
       })));
       return;
@@ -31958,12 +33090,12 @@ function SessionsView({
           return;
         }
       } else {
-        const { execSync: execSync19 } = await import("child_process");
+        const { execSync: execSync20 } = await import("child_process");
         const dir = projectDir || process.cwd();
-        execSync19(`tmux new-session -d -s ${JSON.stringify(entry.sessionName)} -c ${JSON.stringify(dir)}`, { timeout: 5e3 });
-        execSync19(`tmux send-keys -t ${JSON.stringify(entry.sessionName)} "claude --dangerously-skip-permissions" Enter`, { timeout: 3e3 });
+        execSync20(`tmux new-session -d -s ${JSON.stringify(entry.sessionName)} -c ${JSON.stringify(dir)}`, { timeout: 5e3 });
+        execSync20(`tmux send-keys -t ${JSON.stringify(entry.sessionName)} "claude --dangerously-skip-permissions" Enter`, { timeout: 3e3 });
         await new Promise((r) => setTimeout(r, 3e3));
-        execSync19(`tmux send-keys -t ${JSON.stringify(entry.sessionName)} "/exe" Enter`, { timeout: 3e3 });
+        execSync20(`tmux send-keys -t ${JSON.stringify(entry.sessionName)} "/exe" Enter`, { timeout: 3e3 });
       }
       const updated = { ...entry, status: "active", activity: "Starting...", attached: false };
       setViewingEmployee(updated);
@@ -32066,7 +33198,7 @@ function SessionsView({
         const { listTmuxSessions: listTmuxSessions2, inTmux: inTmux2, capturePaneLines: capturePaneLines2, parseActivity: parseActivity2 } = await Promise.resolve().then(() => (init_tmux_status(), tmux_status_exports));
         const { getCoordinatorName: getCoordinatorName2, isCoordinatorRole: isCoordinatorRole2, loadEmployees: loadEmployees2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
         const { isExeSession: isExeSession2 } = await Promise.resolve().then(() => (init_tmux_routing(), tmux_routing_exports));
-        const { execSync: execSync19 } = await import("child_process");
+        const { execSync: execSync20 } = await import("child_process");
         if (!inTmux2()) {
           setTmuxAvailable(false);
           setProjects([]);
@@ -32075,7 +33207,7 @@ function SessionsView({
         setTmuxAvailable(true);
         const attachedMap = /* @__PURE__ */ new Map();
         try {
-          const out = execSync19("tmux list-sessions -F '#{session_name}:#{session_attached}' 2>/dev/null", {
+          const out = execSync20("tmux list-sessions -F '#{session_name}:#{session_attached}' 2>/dev/null", {
             encoding: "utf8",
             timeout: 3e3
           });
@@ -33111,19 +34243,19 @@ function upsertConversation(conversations, platform, senderId, message) {
 async function loadGatewayConfig() {
   const state = { running: false, port: 3100, adapters: [], agents: [], gatewayUrl: "" };
   try {
-    const { execSync: execSync19 } = await import("child_process");
-    const ps = execSync19("pgrep -f exe-gateway 2>/dev/null", { encoding: "utf8", timeout: 3e3 });
+    const { execSync: execSync20 } = await import("child_process");
+    const ps = execSync20("pgrep -f exe-gateway 2>/dev/null", { encoding: "utf8", timeout: 3e3 });
     state.running = ps.trim().length > 0;
   } catch {
     state.running = false;
   }
   try {
-    const { existsSync: existsSync41, readFileSync: readFileSync37 } = await import("fs");
+    const { existsSync: existsSync43, readFileSync: readFileSync39 } = await import("fs");
     const { join } = await import("path");
     const home = process.env.HOME ?? "";
     const configPath = join(home, ".exe-os", "gateway.json");
-    if (existsSync41(configPath)) {
-      const raw = JSON.parse(readFileSync37(configPath, "utf8"));
+    if (existsSync43(configPath)) {
+      const raw = JSON.parse(readFileSync39(configPath, "utf8"));
       state.port = raw.port ?? 3100;
       state.gatewayUrl = raw.gatewayUrl ?? "";
       if (raw.adapters) {
@@ -33589,10 +34721,10 @@ var init_Gateway = __esm({
 });
 
 // src/tui/utils/agent-status.ts
-import { execSync as execSync18 } from "child_process";
+import { execSync as execSync19 } from "child_process";
 function getAgentStatus(agentId) {
   try {
-    const sessions = execSync18("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
+    const sessions = execSync19("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
       encoding: "utf8",
       timeout: 2e3
     }).trim().split("\n");
@@ -33603,7 +34735,7 @@ function getAgentStatus(agentId) {
       return /^\d?-/.test(suffix) || /^\d+$/.test(suffix);
     });
     if (!agentSession) return { label: "offline", color: "gray" };
-    const pane = execSync18(`tmux capture-pane -t "${agentSession}" -p 2>/dev/null | tail -3`, {
+    const pane = execSync19(`tmux capture-pane -t "${agentSession}" -p 2>/dev/null | tail -3`, {
       encoding: "utf8",
       timeout: 2e3
     });
@@ -33721,12 +34853,12 @@ function TeamView({ onBack, onViewSessions }) {
         setMembers(teamData);
         setDbError(null);
         try {
-          const { existsSync: existsSync41, readFileSync: readFileSync37 } = await import("fs");
+          const { existsSync: existsSync43, readFileSync: readFileSync39 } = await import("fs");
           const { join } = await import("path");
           const home = process.env.HOME ?? "";
           const gatewayConfig = join(home, ".exe-os", "gateway.json");
-          if (existsSync41(gatewayConfig)) {
-            const raw = JSON.parse(readFileSync37(gatewayConfig, "utf8"));
+          if (existsSync43(gatewayConfig)) {
+            const raw = JSON.parse(readFileSync39(gatewayConfig, "utf8"));
             if (raw.agents && raw.agents.length > 0) {
               setExternals(raw.agents.map((a) => ({
                 name: a.name,
@@ -33906,8 +35038,8 @@ __export(wiki_client_exports, {
   listDocuments: () => listDocuments,
   listWorkspaces: () => listWorkspaces
 });
-async function wikiFetch(config, path56, method = "GET", body) {
-  const url = `${config.baseUrl}/api/v1${path56}`;
+async function wikiFetch(config, path58, method = "GET", body) {
+  const url = `${config.baseUrl}/api/v1${path58}`;
   const headers = {
     Authorization: `Bearer ${config.apiKey}`,
     "Content-Type": "application/json"
@@ -33940,7 +35072,7 @@ async function wikiFetch(config, path56, method = "GET", body) {
       }
     }
     if (!response.ok) {
-      throw new Error(`Wiki API ${method} ${path56}: ${response.status} ${response.statusText}`);
+      throw new Error(`Wiki API ${method} ${path58}: ${response.status} ${response.statusText}`);
     }
     return response.json();
   } finally {
@@ -34526,20 +35658,20 @@ function SettingsView({ onBack }) {
       };
     });
     try {
-      const { execSync: execSync19 } = await import("child_process");
-      execSync19("curl -s --max-time 1 http://localhost:11434/api/tags", { timeout: 2e3 });
+      const { execSync: execSync20 } = await import("child_process");
+      execSync20("curl -s --max-time 1 http://localhost:11434/api/tags", { timeout: 2e3 });
       providerList.push({ name: "Ollama", configured: true, detail: "localhost:11434" });
     } catch {
       providerList.push({ name: "Ollama", configured: false, detail: "not running" });
     }
     setProviders(providerList);
     try {
-      const { existsSync: existsSync41 } = await import("fs");
+      const { existsSync: existsSync43 } = await import("fs");
       const { join } = await import("path");
       const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
       const cfg = await loadConfig2();
       const home = process.env.HOME ?? "";
-      const hasKey = existsSync41(join(home, ".exe-os", "master.key"));
+      const hasKey = existsSync43(join(home, ".exe-os", "master.key"));
       if (cfg.cloud) {
         setCloud({
           configured: true,
@@ -34552,22 +35684,22 @@ function SettingsView({ onBack }) {
       const pidPath = join(home, ".exe-os", "exed.pid");
       let daemon = "unknown";
       try {
-        daemon = existsSync41(pidPath) ? "running" : "stopped";
+        daemon = existsSync43(pidPath) ? "running" : "stopped";
       } catch {
       }
       let version = "unknown";
       try {
-        const { readFileSync: readFileSync37 } = await import("fs");
+        const { readFileSync: readFileSync39 } = await import("fs");
         const { createRequire: createRequire3 } = await import("module");
         const require2 = createRequire3(import.meta.url);
         const pkgPath = require2.resolve("@askexenow/exe-os/package.json");
-        const pkg = JSON.parse(readFileSync37(pkgPath, "utf8"));
+        const pkg = JSON.parse(readFileSync39(pkgPath, "utf8"));
         version = pkg.version;
       } catch {
         try {
-          const { readFileSync: readFileSync37 } = await import("fs");
+          const { readFileSync: readFileSync39 } = await import("fs");
           const { join: joinPath } = await import("path");
-          const pkg = JSON.parse(readFileSync37(joinPath(process.cwd(), "package.json"), "utf8"));
+          const pkg = JSON.parse(readFileSync39(joinPath(process.cwd(), "package.json"), "utf8"));
           version = pkg.version;
         } catch {
         }
@@ -35426,18 +36558,18 @@ __export(code_context_index_exports, {
   traceCodeSymbol: () => traceCodeSymbol
 });
 import crypto14 from "crypto";
-import path51 from "path";
-import { existsSync as existsSync36, mkdirSync as mkdirSync25, readFileSync as readFileSync32, readdirSync as readdirSync11, statSync as statSync7, writeFileSync as writeFileSync26 } from "fs";
+import path53 from "path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync26, readFileSync as readFileSync34, readdirSync as readdirSync12, statSync as statSync8, writeFileSync as writeFileSync27 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
 function vectorStorePath(projectRoot) {
   const rootHash = hashText(projectRoot).slice(0, 16);
-  return path51.join(indexDir(), `${rootHash}.vectors.json`);
+  return path53.join(indexDir(), `${rootHash}.vectors.json`);
 }
 function loadVectorStore(projectRoot) {
   const file = vectorStorePath(projectRoot);
-  if (!existsSync36(file)) return null;
+  if (!existsSync38(file)) return null;
   try {
-    const parsed = JSON.parse(readFileSync32(file, "utf8"));
+    const parsed = JSON.parse(readFileSync34(file, "utf8"));
     if (parsed.version !== VECTOR_STORE_VERSION) return null;
     return parsed;
   } catch {
@@ -35445,7 +36577,7 @@ function loadVectorStore(projectRoot) {
   }
 }
 function saveVectorStore(projectRoot, store) {
-  writeFileSync26(vectorStorePath(projectRoot), JSON.stringify(store));
+  writeFileSync27(vectorStorePath(projectRoot), JSON.stringify(store));
 }
 function cosineSimilarity(a, b) {
   let dot = 0, normA = 0, normB = 0;
@@ -35501,20 +36633,20 @@ async function embedSymbols(index) {
   return store;
 }
 function normalizeProjectRoot(projectRoot) {
-  return path51.resolve(projectRoot || process.cwd());
+  return path53.resolve(projectRoot || process.cwd());
 }
 function hashText(text) {
   return crypto14.createHash("sha256").update(text).digest("hex");
 }
 function indexDir() {
-  const dir = path51.join(EXE_AI_DIR, "code-context");
-  mkdirSync25(dir, { recursive: true });
+  const dir = path53.join(EXE_AI_DIR, "code-context");
+  mkdirSync26(dir, { recursive: true });
   return dir;
 }
 function getCodeContextIndexPath(projectRoot) {
   const root = normalizeProjectRoot(projectRoot);
   const rootHash = hashText(root).slice(0, 16);
-  return path51.join(indexDir(), `${rootHash}.json`);
+  return path53.join(indexDir(), `${rootHash}.json`);
 }
 function currentBranch(projectRoot) {
   const result = spawnSync3("git", ["branch", "--show-current"], { cwd: projectRoot, encoding: "utf8", timeout: 2e3 });
@@ -35526,9 +36658,9 @@ function shouldIgnore(relPath) {
   return parts.some((part) => IGNORE_SEGMENTS.has(part));
 }
 function listRecursive(projectRoot, dir = projectRoot, out = []) {
-  for (const entry of readdirSync11(dir, { withFileTypes: true })) {
-    const abs = path51.join(dir, entry.name);
-    const rel = path51.relative(projectRoot, abs).replaceAll(path51.sep, "/");
+  for (const entry of readdirSync12(dir, { withFileTypes: true })) {
+    const abs = path53.join(dir, entry.name);
+    const rel = path53.relative(projectRoot, abs).replaceAll(path53.sep, "/");
     if (shouldIgnore(rel)) continue;
     if (entry.isDirectory()) listRecursive(projectRoot, abs, out);
     else if (entry.isFile()) out.push(rel);
@@ -35544,7 +36676,7 @@ function listCodeFiles(projectRoot, maxFiles) {
     const rg = spawnSync3("rg", ["--files"], { cwd: projectRoot, encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024 * 16 });
     files = rg.status === 0 && rg.stdout.trim() ? rg.stdout.split("\n").map((s) => s.trim()).filter(Boolean) : listRecursive(projectRoot);
   }
-  return files.map((file) => file.replaceAll(path51.sep, "/")).filter((file) => isChunkable(file) && !shouldIgnore(file)).slice(0, maxFiles).sort();
+  return files.map((file) => file.replaceAll(path53.sep, "/")).filter((file) => isChunkable(file) && !shouldIgnore(file)).slice(0, maxFiles).sort();
 }
 function parseImportPaths(importText) {
   const paths = [];
@@ -35557,13 +36689,13 @@ function parseImportPaths(importText) {
 }
 function resolveImport(fromFile, importPath, allFiles) {
   if (!importPath.startsWith(".")) return null;
-  const base = path51.posix.normalize(path51.posix.join(path51.posix.dirname(fromFile.replaceAll(path51.sep, "/")), importPath));
+  const base = path53.posix.normalize(path53.posix.join(path53.posix.dirname(fromFile.replaceAll(path53.sep, "/")), importPath));
   const withoutKnownExt = base.replace(/\.(?:[a-z0-9]+)$/i, "");
   const candidates = [base];
   for (const ext of ["ts", "tsx", "js", "jsx", "py", "rs", "go", "java", "cs", "cpp", "c", "rb", "php", "swift", "kt", "scala", "sql", "md", "json", "yaml", "yml"]) {
     candidates.push(`${withoutKnownExt}.${ext}`, `${base}.${ext}`);
   }
-  for (const indexName of ["index.ts", "index.tsx", "index.js", "mod.rs", "__init__.py"]) candidates.push(path51.posix.join(base, indexName));
+  for (const indexName of ["index.ts", "index.tsx", "index.js", "mod.rs", "__init__.py"]) candidates.push(path53.posix.join(base, indexName));
   return candidates.find((candidate) => allFiles.has(candidate)) ?? null;
 }
 function symbolId(filePath, chunk) {
@@ -35571,9 +36703,9 @@ function symbolId(filePath, chunk) {
 }
 function loadIndex(projectRoot) {
   const file = getCodeContextIndexPath(projectRoot);
-  if (!existsSync36(file)) return null;
+  if (!existsSync38(file)) return null;
   try {
-    const parsed = JSON.parse(readFileSync32(file, "utf8"));
+    const parsed = JSON.parse(readFileSync34(file, "utf8"));
     if (parsed.version !== INDEX_VERSION || parsed.projectRoot !== projectRoot) return null;
     return parsed;
   } catch {
@@ -35581,20 +36713,20 @@ function loadIndex(projectRoot) {
   }
 }
 function saveIndex(index) {
-  writeFileSync26(getCodeContextIndexPath(index.projectRoot), JSON.stringify(index, null, 2));
+  writeFileSync27(getCodeContextIndexPath(index.projectRoot), JSON.stringify(index, null, 2));
 }
 function buildFileRecord(projectRoot, relPath, allFiles, previous) {
-  const absPath = path51.join(projectRoot, relPath);
+  const absPath = path53.join(projectRoot, relPath);
   let stat2;
   try {
-    stat2 = statSync7(absPath);
+    stat2 = statSync8(absPath);
   } catch {
     return { record: null, reused: false };
   }
   if (!stat2.isFile()) return { record: null, reused: false };
   const language = languageForFile(relPath);
   if (!language || !isChunkable(relPath)) return { record: null, reused: false };
-  const source = readFileSync32(absPath, "utf8");
+  const source = readFileSync34(absPath, "utf8");
   const hash = hashText(source);
   if (previous && previous.hash === hash && previous.mtimeMs === stat2.mtimeMs && previous.size === stat2.size && previous.language === language) {
     return { record: previous, reused: true };
@@ -35622,13 +36754,13 @@ function buildCodeContextIndex(options = {}) {
   const branch = currentBranch(projectRoot);
   const previous = options.force ? null : loadIndex(projectRoot);
   const files = listCodeFiles(projectRoot, maxFiles);
-  const allFiles = new Set(files.map((file) => file.replaceAll(path51.sep, "/")));
+  const allFiles = new Set(files.map((file) => file.replaceAll(path53.sep, "/")));
   const fileRecords = {};
   let rebuiltFiles = 0;
   let reusedFiles = 0;
   let skippedFiles = 0;
   for (const rel of files) {
-    const normalized = rel.replaceAll(path51.sep, "/");
+    const normalized = rel.replaceAll(path53.sep, "/");
     const { record, reused } = buildFileRecord(projectRoot, normalized, allFiles, previous?.files[normalized]);
     if (record) {
       fileRecords[normalized] = record;
@@ -35657,11 +36789,11 @@ function loadOrBuildCodeContextIndex(options = {}) {
     if (loaded) {
       const currentFiles = listCodeFiles(projectRoot, options.maxFiles ?? DEFAULT_MAX_FILES);
       const unchanged = currentFiles.every((rel) => {
-        const normalized = rel.replaceAll(path51.sep, "/");
+        const normalized = rel.replaceAll(path53.sep, "/");
         const existing = loaded.files[normalized];
         if (!existing) return false;
         try {
-          const stat2 = statSync7(path51.join(projectRoot, normalized));
+          const stat2 = statSync8(path53.join(projectRoot, normalized));
           return stat2.mtimeMs === existing.mtimeMs && stat2.size === existing.size;
         } catch {
           return false;
@@ -35714,9 +36846,9 @@ function globToRegex(pattern) {
 }
 function matchesPath(filePath, patterns) {
   if (!patterns || patterns.length === 0) return true;
-  const normalized = filePath.replaceAll(path51.sep, "/");
+  const normalized = filePath.replaceAll(path53.sep, "/");
   return patterns.some((pattern) => {
-    const p = pattern.replaceAll(path51.sep, "/").replace(/^\.\//, "");
+    const p = pattern.replaceAll(path53.sep, "/").replace(/^\.\//, "");
     return normalized === p || normalized.startsWith(`${p}/`) || normalized.endsWith(p) || globToRegex(p).test(normalized);
   });
 }
@@ -35909,7 +37041,7 @@ function traceCodeSymbol(symbolName, options = {}) {
 }
 function resolveTargetFile(index, input) {
   if (input.filePath) {
-    const normalized = input.filePath.replaceAll(path51.sep, "/").replace(/^\.\//, "");
+    const normalized = input.filePath.replaceAll(path53.sep, "/").replace(/^\.\//, "");
     if (index.files[normalized]) return { filePath: normalized, target: normalized };
     const suffix = Object.keys(index.files).find((file) => file.endsWith(normalized));
     if (suffix) return { filePath: suffix, target: input.filePath };
@@ -35939,7 +37071,7 @@ function analyzeBlastRadius(input) {
       }
     }
   }
-  const targetBase = path51.basename(target.filePath).replace(/\.[^.]+$/, "").toLowerCase();
+  const targetBase = path53.basename(target.filePath).replace(/\.[^.]+$/, "").toLowerCase();
   const symbolLower = input.symbol?.toLowerCase();
   const tests = Object.keys(index.files).filter((file) => {
     const lower = file.toLowerCase();
@@ -36176,16 +37308,16 @@ __export(installer_exports2, {
   verifyOpenCodeHooks: () => verifyOpenCodeHooks
 });
 import { readFile as readFile7, writeFile as writeFile8, mkdir as mkdir8 } from "fs/promises";
-import { existsSync as existsSync37, readFileSync as readFileSync33 } from "fs";
-import path52 from "path";
+import { existsSync as existsSync39, readFileSync as readFileSync35 } from "fs";
+import path54 from "path";
 import os22 from "os";
 async function registerOpenCodeMcp(packageRoot, homeDir = os22.homedir()) {
   void packageRoot;
-  const configDir = path52.join(homeDir, ".config", "opencode");
-  const configPath = path52.join(configDir, "opencode.json");
+  const configDir = path54.join(homeDir, ".config", "opencode");
+  const configPath = path54.join(configDir, "opencode.json");
   await mkdir8(configDir, { recursive: true });
   let config = {};
-  if (existsSync37(configPath)) {
+  if (existsSync39(configPath)) {
     try {
       config = JSON.parse(await readFile7(configPath, "utf-8"));
     } catch {
@@ -36213,14 +37345,14 @@ async function registerOpenCodeMcp(packageRoot, homeDir = os22.homedir()) {
   return true;
 }
 async function installOpenCodePlugin(packageRoot, homeDir = os22.homedir()) {
-  const pluginDir = path52.join(homeDir, ".config", "opencode", "plugins");
-  const pluginPath = path52.join(pluginDir, "exe-os.mjs");
+  const pluginDir = path54.join(homeDir, ".config", "opencode", "plugins");
+  const pluginPath = path54.join(pluginDir, "exe-os.mjs");
   await mkdir8(pluginDir, { recursive: true });
   const pluginContent = PLUGIN_TEMPLATE.replace(
     /__PACKAGE_ROOT__/g,
     packageRoot.replace(/\\/g, "\\\\")
   );
-  if (existsSync37(pluginPath)) {
+  if (existsSync39(pluginPath)) {
     const existing = await readFile7(pluginPath, "utf-8");
     if (existing === pluginContent) {
       return false;
@@ -36230,18 +37362,18 @@ async function installOpenCodePlugin(packageRoot, homeDir = os22.homedir()) {
   return true;
 }
 function verifyOpenCodeHooks(homeDir = os22.homedir()) {
-  const configPath = path52.join(homeDir, ".config", "opencode", "opencode.json");
-  const pluginPath = path52.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
-  if (!existsSync37(configPath)) return false;
+  const configPath = path54.join(homeDir, ".config", "opencode", "opencode.json");
+  const pluginPath = path54.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
+  if (!existsSync39(configPath)) return false;
   try {
-    const config = JSON.parse(readFileSync33(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync35(configPath, "utf-8"));
     if (!config.mcp?.["exe-os"]?.enabled) return false;
   } catch {
     return false;
   }
-  if (!existsSync37(pluginPath)) return false;
+  if (!existsSync39(pluginPath)) return false;
   try {
-    const plugin = readFileSync33(pluginPath, "utf-8");
+    const plugin = readFileSync35(pluginPath, "utf-8");
     if (!plugin.includes(EXE_HOOK_FILES.postToolCombined)) return false;
     if (textHasLegacySplitPostToolHook(plugin)) return false;
   } catch {
@@ -36283,19 +37415,19 @@ __export(installer_exports3, {
   verifyCodexHooks: () => verifyCodexHooks
 });
 import { readFile as readFile8, writeFile as writeFile9, mkdir as mkdir9 } from "fs/promises";
-import { existsSync as existsSync38, readFileSync as readFileSync34 } from "fs";
-import path53 from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync36 } from "fs";
+import path55 from "path";
 import os23 from "os";
 async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
-  const codexDir = path53.join(homeDir, ".codex");
-  const hooksPath = path53.join(codexDir, "hooks.json");
-  const logsDir = path53.join(homeDir, ".exe-os", "logs");
-  const hookLogPath = path53.join(logsDir, "hooks.log");
+  const codexDir = path55.join(homeDir, ".codex");
+  const hooksPath = path55.join(codexDir, "hooks.json");
+  const logsDir = path55.join(homeDir, ".exe-os", "logs");
+  const hookLogPath = path55.join(logsDir, "hooks.log");
   const logSuffix = ` 2>> "${hookLogPath}"`;
   await mkdir9(codexDir, { recursive: true });
   await mkdir9(logsDir, { recursive: true });
   let hooksJson = {};
-  if (existsSync38(hooksPath)) {
+  if (existsSync40(hooksPath)) {
     try {
       hooksJson = JSON.parse(await readFile8(hooksPath, "utf-8"));
     } catch {
@@ -36315,7 +37447,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
             // Combined hook: runs ingest + error-recall in one Node process.
             // Eliminates a cold-start cycle per tool call (~3-6s savings on Codex).
             type: "command",
-            command: `node "${path53.join(packageRoot, "dist", "hooks", "post-tool-combined.js")}"${logSuffix}`
+            command: `node "${path55.join(packageRoot, "dist", "hooks", "post-tool-combined.js")}"${logSuffix}`
           }
         ]
       },
@@ -36329,7 +37461,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
             // Single hook: prompt-submit handles memory retrieval + entity boost.
             // exe-heartbeat-hook is CC-specific (intercom) — omitted on Codex.
             type: "command",
-            command: `node "${path53.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
+            command: `node "${path55.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
           }
         ]
       },
@@ -36341,7 +37473,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path53.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
+            command: `node "${path55.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
           }
         ]
       },
@@ -36354,7 +37486,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path53.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
+            command: `node "${path55.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
           }
         ]
       },
@@ -36403,10 +37535,10 @@ async function mergeCodexHooks(packageRoot, homeDir = os23.homedir()) {
   return { added, skipped };
 }
 function verifyCodexHooks(homeDir = os23.homedir()) {
-  const hooksPath = path53.join(homeDir, ".codex", "hooks.json");
-  if (!existsSync38(hooksPath)) return false;
+  const hooksPath = path55.join(homeDir, ".codex", "hooks.json");
+  if (!existsSync40(hooksPath)) return false;
   try {
-    const hooksJson = JSON.parse(readFileSync34(hooksPath, "utf-8"));
+    const hooksJson = JSON.parse(readFileSync36(hooksPath, "utf-8"));
     if (!hooksJson.hooks) return false;
     const required = ["PostToolUse", "UserPromptSubmit", "Stop", "PreToolUse"];
     for (const event of required) {
@@ -36438,11 +37570,11 @@ function verifyCodexHooks(homeDir = os23.homedir()) {
 async function installCodexStatusLine(homeDir = os23.homedir()) {
   const prefs = loadPreferences(homeDir);
   if (prefs.codexStatusLine === false) return "opted-out";
-  const codexDir = path53.join(homeDir, ".codex");
-  const configPath = path53.join(codexDir, "config.toml");
+  const codexDir = path55.join(homeDir, ".codex");
+  const configPath = path55.join(codexDir, "config.toml");
   await mkdir9(codexDir, { recursive: true });
   let content = "";
-  if (existsSync38(configPath)) {
+  if (existsSync40(configPath)) {
     content = await readFile8(configPath, "utf-8");
     if (/\[tui\][\s\S]*?status_line\s*=/.test(content)) {
       return "already-configured";
@@ -36494,12 +37626,12 @@ ${line}
   return { content: next, changed: next !== sectionContent };
 }
 async function registerCodexMcpServer(packageRoot, homeDir = os23.homedir()) {
-  const codexDir = path53.join(homeDir, ".codex");
-  const configPath = path53.join(codexDir, "config.toml");
+  const codexDir = path55.join(homeDir, ".codex");
+  const configPath = path55.join(codexDir, "config.toml");
   void packageRoot;
   await mkdir9(codexDir, { recursive: true });
   let content = "";
-  if (existsSync38(configPath)) {
+  if (existsSync40(configPath)) {
     content = await readFile8(configPath, "utf-8");
   }
   const sectionHeader = "[mcp_servers.exe-os]";
@@ -36524,10 +37656,10 @@ async function registerCodexMcpServer(packageRoot, homeDir = os23.homedir()) {
   return "registered";
 }
 async function ensureCodexHooksFeature(homeDir = os23.homedir()) {
-  const configPath = path53.join(homeDir, ".codex", "config.toml");
-  await mkdir9(path53.join(homeDir, ".codex"), { recursive: true });
+  const configPath = path55.join(homeDir, ".codex", "config.toml");
+  await mkdir9(path55.join(homeDir, ".codex"), { recursive: true });
   let content = "";
-  if (existsSync38(configPath)) {
+  if (existsSync40(configPath)) {
     content = await readFile8(configPath, "utf-8");
   }
   if (/\[features\][\s\S]*?codex_hooks\s*=\s*true/.test(content)) {
@@ -36602,32 +37734,32 @@ __export(mcp_diagnostics_exports, {
   diagnoseClaudeMcpConfig: () => diagnoseClaudeMcpConfig,
   formatMcpDiagnosticReport: () => formatMcpDiagnosticReport
 });
-import { existsSync as existsSync39, readFileSync as readFileSync35 } from "fs";
-import path54 from "path";
+import { existsSync as existsSync41, readFileSync as readFileSync37 } from "fs";
+import path56 from "path";
 import os24 from "os";
 function readJson(filePath) {
-  if (!existsSync39(filePath)) return null;
+  if (!existsSync41(filePath)) return null;
   try {
-    return JSON.parse(readFileSync35(filePath, "utf8"));
+    return JSON.parse(readFileSync37(filePath, "utf8"));
   } catch {
     return null;
   }
 }
 function pathApplies2(projectPath, cwd2) {
-  const project = path54.resolve(projectPath);
-  const current = path54.resolve(cwd2);
-  return current === project || current.startsWith(project + path54.sep);
+  const project = path56.resolve(projectPath);
+  const current = path56.resolve(cwd2);
+  return current === project || current.startsWith(project + path56.sep);
 }
 function findAncestorMcpJsons2(cwd2, homeDir) {
   const files = [];
-  let dir = path54.resolve(cwd2);
-  const root = path54.parse(dir).root;
-  const stop = path54.resolve(homeDir);
+  let dir = path56.resolve(cwd2);
+  const root = path56.parse(dir).root;
+  const stop = path56.resolve(homeDir);
   while (dir !== root) {
-    const candidate = path54.join(dir, ".mcp.json");
-    if (existsSync39(candidate)) files.push(candidate);
+    const candidate = path56.join(dir, ".mcp.json");
+    if (existsSync41(candidate)) files.push(candidate);
     if (dir === stop) break;
-    dir = path54.dirname(dir);
+    dir = path56.dirname(dir);
   }
   return files;
 }
@@ -36644,8 +37776,8 @@ function serverAllowedByPermissions(serverName, prefixes) {
   return prefixes.has(serverName) || prefixes.has(serverName.replace(/-/g, "_"));
 }
 function diagnoseClaudeMcpConfig(homeDir = os24.homedir(), cwd2 = process.cwd(), env = process.env) {
-  const claudeJsonPath = path54.join(homeDir, ".claude.json");
-  const settingsPath = path54.join(homeDir, ".claude", "settings.json");
+  const claudeJsonPath = path56.join(homeDir, ".claude.json");
+  const settingsPath = path56.join(homeDir, ".claude", "settings.json");
   const claudeJson = readJson(claudeJsonPath);
   const settings = readJson(settingsPath);
   const issues = [];
@@ -36765,7 +37897,7 @@ function diagnoseClaudeMcpConfig(homeDir = os24.homedir(), cwd2 = process.cwd(),
     });
   }
   return {
-    cwd: path54.resolve(cwd2),
+    cwd: path56.resolve(cwd2),
     globalServers,
     projectServers: projectServers.sort((a, b) => a.name.localeCompare(b.name)),
     mcpJsonServers: mcpJsonServers.sort((a, b) => a.name.localeCompare(b.name)),
@@ -36802,14 +37934,14 @@ var init_mcp_diagnostics = __esm({
 });
 
 // src/bin/cli.ts
-import { existsSync as existsSync40, readFileSync as readFileSync36, writeFileSync as writeFileSync27, readdirSync as readdirSync12, rmSync as rmSync2 } from "fs";
-import path55 from "path";
+import { existsSync as existsSync42, readFileSync as readFileSync38, writeFileSync as writeFileSync28, readdirSync as readdirSync13, rmSync as rmSync2 } from "fs";
+import path57 from "path";
 import os25 from "os";
 var args = process.argv.slice(2);
 if (args.includes("--version") || args.includes("-v")) {
   try {
-    const pkgPath = path55.join(path55.dirname(new URL(import.meta.url).pathname), "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync36(pkgPath, "utf8"));
+    const pkgPath = path57.join(path57.dirname(new URL(import.meta.url).pathname), "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync38(pkgPath, "utf8"));
     console.log(pkg.version);
   } catch {
     console.log("unknown");
@@ -37020,6 +38152,23 @@ ID: ${result.id}`);
   await runRename();
 } else if (args[0] === "--activate" || args[0] === "activate") {
   await runActivate(args[1]);
+} else if (args[0] === "doctor") {
+  if (args.includes("--drift")) {
+    const { runDrift: runDrift2 } = await Promise.resolve().then(() => (init_exe_drift(), exe_drift_exports));
+    await runDrift2(args.slice(1));
+  } else {
+    const { runCcDoctor: runCcDoctor2 } = await Promise.resolve().then(() => (init_cc_doctor(), cc_doctor_exports));
+    const { results, failed } = runCcDoctor2();
+    console.log("\n  exe-os doctor\n");
+    for (const r of results) {
+      const icon = r.pass ? "\x1B[32m\u2713\x1B[0m" : "\x1B[31m\u2717\x1B[0m";
+      console.log(`  ${icon} ${r.name}: ${r.detail}`);
+    }
+    console.log(failed === 0 ? "\n  \x1B[32mAll checks passed\x1B[0m\n" : `
+  \x1B[31m${failed} issue(s) found\x1B[0m
+`);
+    process.exit(failed > 0 ? 1 : 0);
+  }
 } else if (args[0] === "setup" || args[0] === "-setup" || args[0] === "--setup") {
   const { runSetupWizard: runSetupWizard2 } = await Promise.resolve().then(() => (init_setup_wizard(), setup_wizard_exports));
   await runSetupWizard2({ skipModel: args.includes("--skip-model") });
@@ -37037,11 +38186,11 @@ ID: ${result.id}`);
   });
   await init_App2().then(() => App_exports);
 } else {
-  const claudeDir = path55.join(os25.homedir(), ".claude");
-  const settingsPath = path55.join(claudeDir, "settings.json");
-  const hasClaudeCode = existsSync40(settingsPath) && (() => {
+  const claudeDir = path57.join(os25.homedir(), ".claude");
+  const settingsPath = path57.join(claudeDir, "settings.json");
+  const hasClaudeCode = existsSync42(settingsPath) && (() => {
     try {
-      const raw = readFileSync36(settingsPath, "utf8");
+      const raw = readFileSync38(settingsPath, "utf8");
       return raw.includes("exe-os") || raw.includes("exe-mem");
     } catch {
       return false;
@@ -37051,9 +38200,9 @@ ID: ${result.id}`);
     const { DEFAULT_COORDINATOR_TEMPLATE_NAME: DEFAULT_COORDINATOR_TEMPLATE_NAME2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
     let cooName = DEFAULT_COORDINATOR_TEMPLATE_NAME2;
     try {
-      const rosterPath = path55.join(os25.homedir(), ".exe-os", "exe-employees.json");
-      if (existsSync40(rosterPath)) {
-        const roster = JSON.parse(readFileSync36(rosterPath, "utf8"));
+      const rosterPath = path57.join(os25.homedir(), ".exe-os", "exe-employees.json");
+      if (existsSync42(rosterPath)) {
+        const roster = JSON.parse(readFileSync38(rosterPath, "utf8"));
         const coo = roster.find((e) => e.role === "COO");
         if (coo) cooName = coo.name;
       }
@@ -37206,14 +38355,14 @@ async function runCodexInstall() {
 }
 async function runClaudeCheck() {
   const { detectMcpNameCollisions: detectMcpNameCollisions2 } = await Promise.resolve().then(() => (init_installer(), installer_exports));
-  const claudeDir = path55.join(os25.homedir(), ".claude");
-  const settingsPath = path55.join(claudeDir, "settings.json");
-  const claudeJsonPath = path55.join(os25.homedir(), ".claude.json");
+  const claudeDir = path57.join(os25.homedir(), ".claude");
+  const settingsPath = path57.join(claudeDir, "settings.json");
+  const claudeJsonPath = path57.join(os25.homedir(), ".claude.json");
   let ok = true;
-  if (existsSync40(settingsPath)) {
+  if (existsSync42(settingsPath)) {
     let settings;
     try {
-      settings = JSON.parse(readFileSync36(settingsPath, "utf8"));
+      settings = JSON.parse(readFileSync38(settingsPath, "utf8"));
     } catch {
       console.log("\x1B[31m\u2717\x1B[0m settings.json is malformed (invalid JSON)");
       ok = false;
@@ -37239,10 +38388,10 @@ async function runClaudeCheck() {
     console.log("\x1B[31m\u2717\x1B[0m settings.json not found");
     ok = false;
   }
-  if (existsSync40(claudeJsonPath)) {
+  if (existsSync42(claudeJsonPath)) {
     let claudeJson;
     try {
-      claudeJson = JSON.parse(readFileSync36(claudeJsonPath, "utf8"));
+      claudeJson = JSON.parse(readFileSync38(claudeJsonPath, "utf8"));
     } catch {
       console.log("\x1B[31m\u2717\x1B[0m claude.json is malformed (invalid JSON)");
       ok = false;
@@ -37275,8 +38424,8 @@ async function runClaudeCheck() {
   } else {
     console.log("\x1B[32m\u2713\x1B[0m No .mcp.json/project MCP name collisions detected");
   }
-  const skillsDir = path55.join(claudeDir, "skills");
-  if (existsSync40(skillsDir)) {
+  const skillsDir = path57.join(claudeDir, "skills");
+  if (existsSync42(skillsDir)) {
     console.log("\x1B[32m\u2713\x1B[0m Slash skills directory exists");
   } else {
     console.log("\x1B[31m\u2717\x1B[0m Slash skills directory missing");
@@ -37300,16 +38449,16 @@ async function runClaudeUninstall(flags = []) {
   const dryRun = flags.includes("--dry-run");
   const purge = flags.includes("--purge");
   const homeDir = os25.homedir();
-  const claudeDir = path55.join(homeDir, ".claude");
-  const settingsPath = path55.join(claudeDir, "settings.json");
-  const claudeJsonPath = path55.join(homeDir, ".claude.json");
-  const exeOsDir = path55.join(homeDir, ".exe-os");
+  const claudeDir = path57.join(homeDir, ".claude");
+  const settingsPath = path57.join(claudeDir, "settings.json");
+  const claudeJsonPath = path57.join(homeDir, ".claude.json");
+  const exeOsDir = path57.join(homeDir, ".exe-os");
   let removed = 0;
   const log = (msg) => console.log(dryRun ? `[dry-run] ${msg}` : msg);
   let settings = {};
-  if (existsSync40(settingsPath)) {
+  if (existsSync42(settingsPath)) {
     try {
-      settings = JSON.parse(readFileSync36(settingsPath, "utf8"));
+      settings = JSON.parse(readFileSync38(settingsPath, "utf8"));
     } catch {
       console.error("Your ~/.claude/settings.json appears malformed.");
       if (purge) {
@@ -37347,15 +38496,15 @@ async function runClaudeUninstall(flags = []) {
         permCount = before - settings.permissions.allow.length;
       }
       if (!dryRun) {
-        writeFileSync27(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+        writeFileSync28(settingsPath, JSON.stringify(settings, null, 2) + "\n");
       }
       log("\u2713 Removed exe-os hooks from settings.json");
       if (permCount > 0) log(`\u2713 Removed ${permCount} MCP permission entries`);
       removed++;
     }
   }
-  if (existsSync40(claudeJsonPath)) {
-    const raw = readFileSync36(claudeJsonPath, "utf8");
+  if (existsSync42(claudeJsonPath)) {
+    const raw = readFileSync38(claudeJsonPath, "utf8");
     if (raw.length > 1e6) {
       console.error("claude.json exceeds 1 MB \u2014 skipping parse.");
     } else {
@@ -37376,7 +38525,7 @@ async function runClaudeUninstall(flags = []) {
         }
         if (removedMcp) {
           if (!dryRun) {
-            writeFileSync27(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
+            writeFileSync28(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
           }
           log("\u2713 Removed exe-os MCP server from claude.json");
           removed++;
@@ -37384,14 +38533,14 @@ async function runClaudeUninstall(flags = []) {
       }
     }
   }
-  const skillsDir = path55.join(claudeDir, "skills");
-  if (existsSync40(skillsDir)) {
+  const skillsDir = path57.join(claudeDir, "skills");
+  if (existsSync42(skillsDir)) {
     let skillCount = 0;
     try {
-      const entries = readdirSync12(skillsDir);
+      const entries = readdirSync13(skillsDir);
       for (const entry of entries) {
         if (entry.startsWith("exe")) {
-          const fullPath = path55.join(skillsDir, entry);
+          const fullPath = path57.join(skillsDir, entry);
           if (!dryRun) rmSync2(fullPath, { recursive: true, force: true });
           skillCount++;
         }
@@ -37403,30 +38552,30 @@ async function runClaudeUninstall(flags = []) {
       removed++;
     }
   }
-  const claudeMdPath = path55.join(claudeDir, "CLAUDE.md");
-  if (existsSync40(claudeMdPath)) {
-    const content = readFileSync36(claudeMdPath, "utf8");
+  const claudeMdPath = path57.join(claudeDir, "CLAUDE.md");
+  if (existsSync42(claudeMdPath)) {
+    const content = readFileSync38(claudeMdPath, "utf8");
     const startMarker = "<!-- exe-os:orchestration-start -->";
     const endMarker = "<!-- exe-os:orchestration-end -->";
     const startIdx = content.indexOf(startMarker);
     const endIdx = content.indexOf(endMarker);
     if (startIdx !== -1 && endIdx !== -1) {
       const cleaned = (content.slice(0, startIdx) + content.slice(endIdx + endMarker.length)).replace(/\n{3,}/g, "\n\n").trim() + "\n";
-      if (!dryRun) writeFileSync27(claudeMdPath, cleaned);
+      if (!dryRun) writeFileSync28(claudeMdPath, cleaned);
       log("\u2713 Removed orchestration block from CLAUDE.md");
       removed++;
     }
   }
-  const agentsDir = path55.join(claudeDir, "agents");
-  if (existsSync40(agentsDir)) {
+  const agentsDir = path57.join(claudeDir, "agents");
+  if (existsSync42(agentsDir)) {
     let agentCount = 0;
     try {
-      const entries = readdirSync12(agentsDir).filter((f) => f.endsWith(".md"));
+      const entries = readdirSync13(agentsDir).filter((f) => f.endsWith(".md"));
       let knownNames = /* @__PURE__ */ new Set();
-      const rosterPath = path55.join(exeOsDir, "exe-employees.json");
-      if (existsSync40(rosterPath)) {
+      const rosterPath = path57.join(exeOsDir, "exe-employees.json");
+      if (existsSync42(rosterPath)) {
         try {
-          const roster = JSON.parse(readFileSync36(rosterPath, "utf8"));
+          const roster = JSON.parse(readFileSync38(rosterPath, "utf8"));
           knownNames = new Set(roster.map((e) => e.name));
         } catch {
         }
@@ -37434,7 +38583,7 @@ async function runClaudeUninstall(flags = []) {
       for (const entry of entries) {
         const name = entry.replace(/\.md$/, "");
         if (knownNames.has(name)) {
-          if (!dryRun) rmSync2(path55.join(agentsDir, entry), { force: true });
+          if (!dryRun) rmSync2(path57.join(agentsDir, entry), { force: true });
           agentCount++;
         }
       }
@@ -37445,16 +38594,16 @@ async function runClaudeUninstall(flags = []) {
       removed++;
     }
   }
-  const projectsDir = path55.join(claudeDir, "projects");
-  if (existsSync40(projectsDir)) {
+  const projectsDir = path57.join(claudeDir, "projects");
+  if (existsSync42(projectsDir)) {
     let projectCount = 0;
     try {
-      const projects = readdirSync12(projectsDir);
+      const projects = readdirSync13(projectsDir);
       for (const proj of projects) {
-        const projSettings = path55.join(projectsDir, proj, "settings.json");
-        if (!existsSync40(projSettings)) continue;
+        const projSettings = path57.join(projectsDir, proj, "settings.json");
+        if (!existsSync42(projSettings)) continue;
         try {
-          const pSettings = JSON.parse(readFileSync36(projSettings, "utf8"));
+          const pSettings = JSON.parse(readFileSync38(projSettings, "utf8"));
           let changed = false;
           if (Array.isArray(pSettings.permissions?.allow)) {
             const before = pSettings.permissions.allow.length;
@@ -37464,7 +38613,7 @@ async function runClaudeUninstall(flags = []) {
             if (pSettings.permissions.allow.length < before) changed = true;
           }
           if (changed && !dryRun) {
-            writeFileSync27(projSettings, JSON.stringify(pSettings, null, 2) + "\n");
+            writeFileSync28(projSettings, JSON.stringify(pSettings, null, 2) + "\n");
           }
           if (changed) projectCount++;
         } catch {
@@ -37478,28 +38627,28 @@ async function runClaudeUninstall(flags = []) {
     }
   }
   try {
-    const { execSync: execSync19 } = await import("child_process");
+    const { execSync: execSync20 } = await import("child_process");
     const findExeBin3 = () => {
       try {
-        return execSync19(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
+        return execSync20(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
       } catch {
         return null;
       }
     };
     const exeBinPath = findExeBin3();
     if (!exeBinPath) throw new Error("exe-os not found in PATH");
-    const binDir = path55.dirname(exeBinPath);
+    const binDir = path57.dirname(exeBinPath);
     let symlinkCount = 0;
-    const rosterPath = path55.join(exeOsDir, "exe-employees.json");
-    if (existsSync40(rosterPath)) {
-      const roster = JSON.parse(readFileSync36(rosterPath, "utf8"));
+    const rosterPath = path57.join(exeOsDir, "exe-employees.json");
+    if (existsSync42(rosterPath)) {
+      const roster = JSON.parse(readFileSync38(rosterPath, "utf8"));
       const { DEFAULT_COORDINATOR_TEMPLATE_NAME: DEFAULT_COORDINATOR_TEMPLATE_NAME2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
       const coordinatorName = roster.find((e) => e.role?.toLowerCase() === "coo")?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME2;
       for (const emp of roster) {
         if (emp.name === coordinatorName) continue;
         for (const suffix of ["", "-opencode"]) {
-          const linkPath = path55.join(binDir, `${emp.name}${suffix}`);
-          if (existsSync40(linkPath)) {
+          const linkPath = path57.join(binDir, `${emp.name}${suffix}`);
+          if (existsSync42(linkPath)) {
             if (!dryRun) rmSync2(linkPath, { force: true });
             symlinkCount++;
           }
@@ -37512,7 +38661,7 @@ async function runClaudeUninstall(flags = []) {
     }
   } catch {
   }
-  if (purge && existsSync40(exeOsDir)) {
+  if (purge && existsSync42(exeOsDir)) {
     if (!dryRun) {
       process.stdout.write("\x1B[33m\u26A0 This will delete all memories, identities, and agent data.\x1B[0m\n");
       process.stdout.write("  Removing ~/.exe-os...\n");
@@ -37537,7 +38686,7 @@ async function checkForUpdateOnBoot() {
     const config = await loadConfig2();
     if (!config.autoUpdate.checkOnBoot) return;
     const { checkForUpdate: checkForUpdate2 } = await Promise.resolve().then(() => (init_update(), update_exports));
-    const packageRoot = path55.resolve(
+    const packageRoot = path57.resolve(
       new URL("../..", import.meta.url).pathname
     );
     const result = checkForUpdate2(packageRoot);
@@ -37598,7 +38747,7 @@ async function runActivate(key) {
       const idTemplate = getIdentityTemplate(identityKey);
       if (idTemplate) {
         const idPath = identityPath2(name);
-        const dir = path55.dirname(idPath);
+        const dir = path57.dirname(idPath);
         if (!fs8.existsSync(dir)) fs8.mkdirSync(dir, { recursive: true });
         fs8.writeFileSync(idPath, idTemplate.replace(/^agent_id: \w+/m, `agent_id: ${name}`), "utf-8");
       }