@askexenow/exe-os 0.8.32 → 0.8.36

package/dist/bin/exe-link.js

@@ -1,10 +1,942 @@
 #!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
 }) : x)(function(x) {
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/lib/config.ts
+var config_exports = {};
+__export(config_exports, {
+  CONFIG_MIGRATIONS: () => CONFIG_MIGRATIONS,
+  CONFIG_PATH: () => CONFIG_PATH,
+  CURRENT_CONFIG_VERSION: () => CURRENT_CONFIG_VERSION,
+  DB_PATH: () => DB_PATH,
+  EXE_AI_DIR: () => EXE_AI_DIR,
+  LEGACY_LANCE_PATH: () => LEGACY_LANCE_PATH,
+  MODELS_DIR: () => MODELS_DIR,
+  loadConfig: () => loadConfig,
+  loadConfigFrom: () => loadConfigFrom,
+  loadConfigSync: () => loadConfigSync,
+  migrateConfig: () => migrateConfig,
+  saveConfig: () => saveConfig
+});
+import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
+import path2 from "path";
+import os from "os";
+function resolveDataDir() {
+  if (process.env.EXE_OS_DIR) return process.env.EXE_OS_DIR;
+  if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
+  const newDir = path2.join(os.homedir(), ".exe-os");
+  const legacyDir = path2.join(os.homedir(), ".exe-mem");
+  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
+    try {
+      renameSync(legacyDir, newDir);
+      process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
+`);
+    } catch {
+      return legacyDir;
+    }
+  }
+  return newDir;
+}
+function migrateLegacyConfig(raw) {
+  if ("r2" in raw) {
+    process.stderr.write(
+      "[exe-os] Warning: config.json contains deprecated 'r2' field from v1.0. R2 sync has been replaced in v1.1. The 'r2' field will be ignored.\n"
+    );
+    delete raw.r2;
+  }
+  if ("syncIntervalMs" in raw) {
+    delete raw.syncIntervalMs;
+  }
+  return raw;
+}
+function migrateConfig(raw) {
+  const fromVersion = typeof raw.config_version === "number" ? raw.config_version : 0;
+  let currentVersion = fromVersion;
+  let migrated = false;
+  if (currentVersion > CURRENT_CONFIG_VERSION) {
+    return { config: raw, migrated: false, fromVersion };
+  }
+  for (const migration of CONFIG_MIGRATIONS) {
+    if (currentVersion === migration.from && migration.to <= CURRENT_CONFIG_VERSION) {
+      raw = migration.migrate(raw);
+      currentVersion = migration.to;
+      migrated = true;
+    }
+  }
+  return { config: raw, migrated, fromVersion };
+}
+function normalizeScalingRoadmap(raw) {
+  const defaultAuto = DEFAULT_CONFIG.scalingRoadmap.rerankerAutoTrigger;
+  const userRoadmap = raw.scalingRoadmap ?? {};
+  const userAuto = userRoadmap.rerankerAutoTrigger ?? {};
+  if (userAuto.enabled === void 0 && raw.rerankerEnabled !== void 0) {
+    userAuto.enabled = raw.rerankerEnabled;
+  }
+  raw.scalingRoadmap = {
+    ...userRoadmap,
+    rerankerAutoTrigger: { ...defaultAuto, ...userAuto }
+  };
+}
+function normalizeSessionLifecycle(raw) {
+  const defaultSL = DEFAULT_CONFIG.sessionLifecycle;
+  const userSL = raw.sessionLifecycle ?? {};
+  raw.sessionLifecycle = { ...defaultSL, ...userSL };
+}
+function normalizeAutoUpdate(raw) {
+  const defaultAU = DEFAULT_CONFIG.autoUpdate;
+  const userAU = raw.autoUpdate ?? {};
+  raw.autoUpdate = { ...defaultAU, ...userAU };
+}
+async function loadConfig() {
+  const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
+  await mkdir2(dir, { recursive: true });
+  const configPath = path2.join(dir, "config.json");
+  if (!existsSync2(configPath)) {
+    return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
+  }
+  const raw = await readFile2(configPath, "utf-8");
+  try {
+    let parsed = JSON.parse(raw);
+    parsed = migrateLegacyConfig(parsed);
+    const { config: migratedCfg, migrated, fromVersion } = migrateConfig(parsed);
+    if (migrated) {
+      process.stderr.write(`[exe-os] Config migrated from v${fromVersion} to v${migratedCfg.config_version}
+`);
+      try {
+        await writeFile2(configPath, JSON.stringify(migratedCfg, null, 2) + "\n");
+      } catch {
+      }
+    }
+    normalizeScalingRoadmap(migratedCfg);
+    normalizeSessionLifecycle(migratedCfg);
+    normalizeAutoUpdate(migratedCfg);
+    const config = { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db"), ...migratedCfg };
+    if (config.dbPath.startsWith("~")) {
+      config.dbPath = config.dbPath.replace(/^~/, os.homedir());
+    }
+    return config;
+  } catch {
+    return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
+  }
+}
+function loadConfigSync() {
+  const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
+  const configPath = path2.join(dir, "config.json");
+  if (!existsSync2(configPath)) {
+    return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
+  }
+  try {
+    const raw = readFileSync(configPath, "utf-8");
+    let parsed = JSON.parse(raw);
+    parsed = migrateLegacyConfig(parsed);
+    const { config: migratedCfg } = migrateConfig(parsed);
+    normalizeScalingRoadmap(migratedCfg);
+    normalizeSessionLifecycle(migratedCfg);
+    normalizeAutoUpdate(migratedCfg);
+    return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db"), ...migratedCfg };
+  } catch {
+    return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
+  }
+}
+async function saveConfig(config) {
+  const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
+  await mkdir2(dir, { recursive: true });
+  const configPath = path2.join(dir, "config.json");
+  await writeFile2(configPath, JSON.stringify(config, null, 2) + "\n");
+}
+async function loadConfigFrom(configPath) {
+  const raw = await readFile2(configPath, "utf-8");
+  try {
+    let parsed = JSON.parse(raw);
+    parsed = migrateLegacyConfig(parsed);
+    const { config: migratedCfg } = migrateConfig(parsed);
+    normalizeScalingRoadmap(migratedCfg);
+    normalizeSessionLifecycle(migratedCfg);
+    normalizeAutoUpdate(migratedCfg);
+    return { ...DEFAULT_CONFIG, ...migratedCfg };
+  } catch {
+    return { ...DEFAULT_CONFIG };
+  }
+}
+var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CONFIG_VERSION, DEFAULT_CONFIG, CONFIG_MIGRATIONS;
+var init_config = __esm({
+  "src/lib/config.ts"() {
+    "use strict";
+    EXE_AI_DIR = resolveDataDir();
+    DB_PATH = path2.join(EXE_AI_DIR, "memories.db");
+    MODELS_DIR = path2.join(EXE_AI_DIR, "models");
+    CONFIG_PATH = path2.join(EXE_AI_DIR, "config.json");
+    LEGACY_LANCE_PATH = path2.join(EXE_AI_DIR, "local.lance");
+    CURRENT_CONFIG_VERSION = 1;
+    DEFAULT_CONFIG = {
+      config_version: CURRENT_CONFIG_VERSION,
+      dbPath: DB_PATH,
+      modelFile: "jina-embeddings-v5-small-q4_k_m.gguf",
+      embeddingDim: 1024,
+      batchSize: 20,
+      flushIntervalMs: 1e4,
+      autoIngestion: true,
+      autoRetrieval: true,
+      searchMode: "hybrid",
+      hookSearchMode: "hybrid",
+      fileGrepEnabled: true,
+      splashEffect: true,
+      consolidationEnabled: true,
+      consolidationIntervalMs: 6 * 60 * 60 * 1e3,
+      consolidationModel: "claude-haiku-4-5-20251001",
+      consolidationMaxCallsPerRun: 20,
+      selfQueryRouter: true,
+      selfQueryModel: "claude-haiku-4-5-20251001",
+      rerankerEnabled: true,
+      scalingRoadmap: {
+        rerankerAutoTrigger: {
+          enabled: true,
+          broadQueryMinCardinality: 5e4,
+          fetchTopK: 150,
+          returnTopK: 5
+        }
+      },
+      graphRagEnabled: true,
+      wikiEnabled: false,
+      wikiUrl: "",
+      wikiApiKey: "",
+      wikiSyncIntervalMs: 30 * 60 * 1e3,
+      wikiWorkspaceMapping: {
+        exe: "Executive",
+        yoshi: "Engineering",
+        mari: "Marketing",
+        tom: "Engineering",
+        sasha: "Production"
+      },
+      wikiAutoUpdate: true,
+      wikiAutoUpdateThreshold: 0.5,
+      wikiAutoUpdateCreateNew: true,
+      skillLearning: true,
+      skillThreshold: 3,
+      skillModel: "claude-haiku-4-5-20251001",
+      exeHeartbeat: {
+        enabled: true,
+        intervalSeconds: 60,
+        staleInProgressThresholdHours: 2
+      },
+      sessionLifecycle: {
+        idleKillEnabled: true,
+        idleKillTicksRequired: 3,
+        idleKillIntercomAckWindowMs: 1e4,
+        maxAutoInstances: 10
+      },
+      autoUpdate: {
+        checkOnBoot: true,
+        autoInstall: false,
+        checkIntervalMs: 24 * 60 * 60 * 1e3
+      }
+    };
+    CONFIG_MIGRATIONS = [
+      {
+        from: 0,
+        to: 1,
+        migrate: (cfg) => {
+          cfg.config_version = 1;
+          return cfg;
+        }
+      }
+    ];
+  }
+});
+
+// src/lib/crypto.ts
+var crypto_exports = {};
+__export(crypto_exports, {
+  decryptSyncBlob: () => decryptSyncBlob,
+  encryptSyncBlob: () => encryptSyncBlob,
+  initSyncCrypto: () => initSyncCrypto,
+  isSyncCryptoInitialized: () => isSyncCryptoInitialized
+});
+import crypto2 from "crypto";
+function initSyncCrypto(masterKey) {
+  if (masterKey.length !== 32) {
+    throw new Error(`Master key must be 32 bytes, got ${masterKey.length}`);
+  }
+  _syncKey = Buffer.from(
+    crypto2.hkdfSync("sha256", masterKey, "", SYNC_HKDF_INFO, 32)
+  );
+}
+function isSyncCryptoInitialized() {
+  return _syncKey !== null;
+}
+function requireSyncKey() {
+  if (!_syncKey) {
+    throw new Error("Sync crypto not initialized. Call initSyncCrypto(masterKey) first.");
+  }
+  return _syncKey;
+}
+function encryptSyncBlob(data) {
+  const key = requireSyncKey();
+  const iv = crypto2.randomBytes(IV_LENGTH);
+  const cipher = crypto2.createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, encrypted, tag]).toString("base64");
+}
+function decryptSyncBlob(ciphertext) {
+  const key = requireSyncKey();
+  const combined = Buffer.from(ciphertext, "base64");
+  if (combined.length < IV_LENGTH + TAG_LENGTH) {
+    throw new Error("Sync blob too short to contain IV + tag");
+  }
+  const iv = combined.subarray(0, IV_LENGTH);
+  const tag = combined.subarray(combined.length - TAG_LENGTH);
+  const encrypted = combined.subarray(IV_LENGTH, combined.length - TAG_LENGTH);
+  const decipher = crypto2.createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(encrypted), decipher.final()]);
+}
+var ALGORITHM, IV_LENGTH, TAG_LENGTH, SYNC_HKDF_INFO, _syncKey;
+var init_crypto = __esm({
+  "src/lib/crypto.ts"() {
+    "use strict";
+    ALGORITHM = "aes-256-gcm";
+    IV_LENGTH = 12;
+    TAG_LENGTH = 16;
+    SYNC_HKDF_INFO = "exe-mem-sync-v2";
+    _syncKey = null;
+  }
+});
+
+// src/lib/db-retry.ts
+var init_db_retry = __esm({
+  "src/lib/db-retry.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/database.ts
+import { createClient } from "@libsql/client";
+function getClient() {
+  if (!_resilientClient) {
+    throw new Error("Database client not initialized. Call initDatabase() first.");
+  }
+  return _resilientClient;
+}
+var _resilientClient;
+var init_database = __esm({
+  "src/lib/database.ts"() {
+    "use strict";
+    init_db_retry();
+    _resilientClient = null;
+  }
+});
+
+// src/lib/compress.ts
+import { brotliCompressSync, brotliDecompressSync, constants } from "zlib";
+function compress(input) {
+  if (input.length === 0) return Buffer.alloc(0);
+  return brotliCompressSync(input, {
+    params: {
+      [constants.BROTLI_PARAM_QUALITY]: 4
+    }
+  });
+}
+function decompress(input) {
+  if (input.length === 0) return Buffer.alloc(0);
+  return brotliDecompressSync(input);
+}
+var init_compress = __esm({
+  "src/lib/compress.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/employees.ts
+import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3 } from "fs/promises";
+import { existsSync as existsSync3, symlinkSync, readlinkSync, readFileSync as readFileSync2 } from "fs";
+import { execSync } from "child_process";
+import path3 from "path";
+async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
+  if (!existsSync3(employeesPath)) {
+    return [];
+  }
+  const raw = await readFile3(employeesPath, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return [];
+  }
+}
+async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
+  await mkdir3(path3.dirname(employeesPath), { recursive: true });
+  await writeFile3(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
+}
+function registerBinSymlinks(name) {
+  const created = [];
+  const skipped = [];
+  const errors = [];
+  let exeBinPath;
+  try {
+    exeBinPath = execSync("which exe", { encoding: "utf-8" }).trim();
+  } catch {
+    errors.push("Could not find 'exe' in PATH");
+    return { created, skipped, errors };
+  }
+  const binDir = path3.dirname(exeBinPath);
+  let target;
+  try {
+    target = readlinkSync(exeBinPath);
+  } catch {
+    errors.push("Could not read 'exe' symlink");
+    return { created, skipped, errors };
+  }
+  for (const suffix of ["", "-opencode"]) {
+    const linkName = `${name}${suffix}`;
+    const linkPath = path3.join(binDir, linkName);
+    if (existsSync3(linkPath)) {
+      skipped.push(linkName);
+      continue;
+    }
+    try {
+      symlinkSync(target, linkPath);
+      created.push(linkName);
+    } catch (err) {
+      errors.push(`${linkName}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return { created, skipped, errors };
+}
+var EMPLOYEES_PATH;
+var init_employees = __esm({
+  "src/lib/employees.ts"() {
+    "use strict";
+    init_config();
+    EMPLOYEES_PATH = path3.join(EXE_AI_DIR, "exe-employees.json");
+  }
+});
+
+// src/lib/license.ts
+import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync4, mkdirSync } from "fs";
+import { randomUUID } from "crypto";
+import path4 from "path";
+import { jwtVerify, importSPKI } from "jose";
+function loadDeviceId() {
+  const deviceJsonPath = path4.join(EXE_AI_DIR, "device.json");
+  try {
+    if (existsSync4(deviceJsonPath)) {
+      const data = JSON.parse(readFileSync3(deviceJsonPath, "utf8"));
+      if (data.deviceId) return data.deviceId;
+    }
+  } catch {
+  }
+  try {
+    if (existsSync4(DEVICE_ID_PATH)) {
+      const id2 = readFileSync3(DEVICE_ID_PATH, "utf8").trim();
+      if (id2) return id2;
+    }
+  } catch {
+  }
+  const id = randomUUID();
+  mkdirSync(EXE_AI_DIR, { recursive: true });
+  writeFileSync(DEVICE_ID_PATH, id, "utf8");
+  return id;
+}
+function loadLicense() {
+  try {
+    if (!existsSync4(LICENSE_PATH)) return null;
+    return readFileSync3(LICENSE_PATH, "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+async function verifyLicenseJwt(token) {
+  try {
+    const key = await importSPKI(LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG);
+    const { payload } = await jwtVerify(token, key, {
+      algorithms: [LICENSE_JWT_ALG]
+    });
+    const plan = payload.plan ?? "free";
+    const email = payload.sub ?? "";
+    const limits = PLAN_LIMITS[plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: true,
+      plan,
+      email,
+      expiresAt: payload.exp ? new Date(payload.exp * 1e3).toISOString() : null,
+      deviceLimit: limits.devices,
+      employeeLimit: limits.employees,
+      memoryLimit: limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+async function getCachedLicense() {
+  try {
+    if (!existsSync4(CACHE_PATH)) return null;
+    const raw = JSON.parse(readFileSync3(CACHE_PATH, "utf8"));
+    if (!raw.token || typeof raw.token !== "string") return null;
+    return await verifyLicenseJwt(raw.token);
+  } catch {
+    return null;
+  }
+}
+function cacheResponse(token) {
+  try {
+    writeFileSync(CACHE_PATH, JSON.stringify({ token }), "utf8");
+  } catch {
+  }
+}
+async function validateLicense(apiKey, deviceId) {
+  const did = deviceId ?? loadDeviceId();
+  try {
+    const res = await fetch(`${API_BASE}/auth/activate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ apiKey, deviceId: did }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (res.ok) {
+      const data = await res.json();
+      if (data.error === "device_limit_exceeded") {
+        const cached2 = await getCachedLicense();
+        if (cached2) return cached2;
+        return { ...FREE_LICENSE, valid: false, plan: "free" };
+      }
+      if (data.token) {
+        cacheResponse(data.token);
+        const verified = await verifyLicenseJwt(data.token);
+        if (verified) return verified;
+      }
+      const limits = PLAN_LIMITS[data.plan] ?? PLAN_LIMITS.free;
+      return {
+        valid: data.valid,
+        plan: data.plan,
+        email: data.email,
+        expiresAt: data.expiresAt,
+        deviceLimit: limits.devices,
+        employeeLimit: limits.employees,
+        memoryLimit: limits.memories
+      };
+    }
+    const cached = await getCachedLicense();
+    if (cached) return cached;
+    return { ...FREE_LICENSE, valid: false, plan: "free" };
+  } catch {
+    const cached = await getCachedLicense();
+    if (cached) return cached;
+    return FREE_LICENSE;
+  }
+}
+async function checkLicense() {
+  const key = loadLicense();
+  if (!key) return FREE_LICENSE;
+  const cached = await getCachedLicense();
+  if (cached) return cached;
+  const deviceId = loadDeviceId();
+  return validateLicense(key, deviceId);
+}
+function isFeatureAllowed(license, feature) {
+  switch (feature) {
+    case "cloud_sync":
+    case "external_agents":
+    case "wiki":
+      return license.plan !== "free";
+    case "unlimited_employees":
+      return license.plan === "team" || license.plan === "agency" || license.plan === "enterprise";
+  }
+}
+var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, API_BASE, LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG, PLAN_LIMITS, FREE_LICENSE;
+var init_license = __esm({
+  "src/lib/license.ts"() {
+    "use strict";
+    init_config();
+    LICENSE_PATH = path4.join(EXE_AI_DIR, "license.key");
+    CACHE_PATH = path4.join(EXE_AI_DIR, "license-cache.json");
+    DEVICE_ID_PATH = path4.join(EXE_AI_DIR, "device-id");
+    API_BASE = "https://askexe.com/cloud";
+    LICENSE_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
+4uj+UqeKCcvtgNHKmOK278HJaJcANe9xAeji8AFYu27q3WtzCi04pHudow==
+-----END PUBLIC KEY-----`;
+    LICENSE_JWT_ALG = "ES256";
+    PLAN_LIMITS = {
+      free: { devices: 1, employees: 1, memories: 5e3 },
+      pro: { devices: 2, employees: 5, memories: 1e5 },
+      team: { devices: 10, employees: 20, memories: 1e6 },
+      agency: { devices: 50, employees: 100, memories: 1e7 },
+      enterprise: { devices: -1, employees: -1, memories: -1 }
+    };
+    FREE_LICENSE = {
+      valid: true,
+      plan: "free",
+      email: "",
+      expiresAt: null,
+      deviceLimit: 1,
+      employeeLimit: 1,
+      memoryLimit: 5e3
+    };
+  }
+});
+
+// src/lib/plan-limits.ts
+import { readFileSync as readFileSync4, existsSync as existsSync5 } from "fs";
+import path5 from "path";
+async function assertFeature(feature) {
+  const license = await checkLicense();
+  if (!isFeatureAllowed(license, feature)) {
+    throw new PlanLimitError(
+      `Feature "${feature}" requires a paid plan. Current plan: ${license.plan}. Upgrade at https://askexe.com.`
+    );
+  }
+}
+var PlanLimitError, CACHE_PATH2;
+var init_plan_limits = __esm({
+  "src/lib/plan-limits.ts"() {
+    "use strict";
+    init_database();
+    init_employees();
+    init_license();
+    init_config();
+    PlanLimitError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "PlanLimitError";
+      }
+    };
+    CACHE_PATH2 = path5.join(EXE_AI_DIR, "license-cache.json");
+  }
+});
+
+// src/lib/cloud-sync.ts
+var cloud_sync_exports = {};
+__export(cloud_sync_exports, {
+  buildRosterBlob: () => buildRosterBlob,
+  cloudPull: () => cloudPull,
+  cloudPullRoster: () => cloudPullRoster,
+  cloudPush: () => cloudPush,
+  cloudPushRoster: () => cloudPushRoster,
+  cloudSync: () => cloudSync,
+  mergeRosterFromRemote: () => mergeRosterFromRemote
+});
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync6, readdirSync, mkdirSync as mkdirSync2, appendFileSync } from "fs";
+import path6 from "path";
+import { homedir } from "os";
+function logError(msg) {
+  try {
+    const logPath = path6.join(homedir(), ".exe-os", "workers.log");
+    appendFileSync(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
+`);
+  } catch {
+  }
+}
+function assertSecureEndpoint(endpoint) {
+  if (endpoint.startsWith("https://")) return;
+  if (endpoint.startsWith("http://")) {
+    try {
+      const parsed = new URL(endpoint);
+      if (LOCALHOST_PATTERNS.test(parsed.hostname)) return;
+    } catch {
+      return;
+    }
+    throw new Error(
+      `Insecure cloud endpoint rejected: "${endpoint}". Use https:// for remote hosts. Plain http:// is only allowed for localhost.`
+    );
+  }
+}
+async function cloudPush(records, maxVersion, config) {
+  if (records.length === 0) return true;
+  assertSecureEndpoint(config.endpoint);
+  try {
+    const json = JSON.stringify(records);
+    const compressed = compress(Buffer.from(json, "utf8"));
+    const blob = encryptSyncBlob(compressed);
+    const resp = await fetch(`${config.endpoint}/sync/push`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Device-Id": loadDeviceId()
+      },
+      body: JSON.stringify({ version: maxVersion, blob })
+    });
+    return resp.ok;
+  } catch (err) {
+    logError(`[cloud-sync] PUSH FAILED: ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+}
+async function cloudPull(sinceVersion, config) {
+  assertSecureEndpoint(config.endpoint);
+  try {
+    const response = await fetch(`${config.endpoint}/sync/pull`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Device-Id": loadDeviceId()
+      },
+      body: JSON.stringify({ since_version: sinceVersion })
+    });
+    if (!response.ok) return { records: [], maxVersion: sinceVersion };
+    const data = await response.json();
+    const allRecords = [];
+    for (const { blob } of data.blobs ?? []) {
+      try {
+        const compressed = decryptSyncBlob(blob);
+        const json = decompress(compressed).toString("utf8");
+        const records = JSON.parse(json);
+        allRecords.push(...records);
+      } catch {
+        continue;
+      }
+    }
+    return { records: allRecords, maxVersion: data.max_version ?? sinceVersion };
+  } catch (err) {
+    logError(`[cloud-sync] PULL FAILED: ${err instanceof Error ? err.message : String(err)}`);
+    return { records: [], maxVersion: sinceVersion };
+  }
+}
+async function cloudSync(config) {
+  await assertFeature("cloud_sync");
+  let client;
+  try {
+    client = getClient();
+  } catch {
+    throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
+  }
+  const pullMeta = await client.execute(
+    "SELECT value FROM sync_meta WHERE key = 'last_cloud_pull_version'"
+  );
+  const lastPullVersion = pullMeta.rows.length > 0 ? Number(pullMeta.rows[0].value) : 0;
+  const pullResult = await cloudPull(lastPullVersion, config);
+  let pulled = 0;
+  if (pullResult.records.length > 0) {
+    const stmts = pullResult.records.map((rec) => ({
+      sql: `INSERT OR REPLACE INTO memories
+            (id, agent_id, agent_role, session_id, timestamp,
+             tool_name, project_name, has_error, raw_text, version,
+             author_device_id, scope)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        rec.id,
+        rec.agent_id,
+        rec.agent_role,
+        rec.session_id,
+        rec.timestamp,
+        rec.tool_name,
+        rec.project_name,
+        rec.has_error,
+        rec.raw_text,
+        rec.version,
+        rec.author_device_id ?? null,
+        rec.scope ?? "business"
+      ]
+    }));
+    await client.batch(stmts, "write");
+    pulled = pullResult.records.length;
+  }
+  if (pullResult.maxVersion > lastPullVersion) {
+    await client.execute({
+      sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_pull_version', ?)",
+      args: [String(pullResult.maxVersion)]
+    });
+  }
+  const pushMeta = await client.execute(
+    "SELECT value FROM sync_meta WHERE key = 'last_cloud_push_version'"
+  );
+  const lastPushVersion = pushMeta.rows.length > 0 ? Number(pushMeta.rows[0].value) : 0;
+  const recordsResult = await client.execute({
+    sql: `SELECT id, agent_id, agent_role, session_id, timestamp,
+                 tool_name, project_name, has_error, raw_text, version,
+                 author_device_id, scope
+          FROM memories
+          WHERE version > ?
+            AND (scope IS NULL OR scope != 'personal')
+          ORDER BY version ASC`,
+    args: [lastPushVersion]
+  });
+  let pushed = 0;
+  if (recordsResult.rows.length > 0) {
+    const records = recordsResult.rows.map((row) => ({
+      id: row.id,
+      agent_id: row.agent_id,
+      agent_role: row.agent_role,
+      session_id: row.session_id,
+      timestamp: row.timestamp,
+      tool_name: row.tool_name,
+      project_name: row.project_name,
+      has_error: row.has_error,
+      raw_text: row.raw_text,
+      version: row.version,
+      author_device_id: row.author_device_id,
+      scope: row.scope
+    }));
+    const maxVersion = Number(records[records.length - 1].version);
+    const pushOk = await cloudPush(records, maxVersion, config);
+    if (pushOk) {
+      await client.execute({
+        sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_push_version', ?)",
+        args: [String(maxVersion)]
+      });
+      pushed = records.length;
+    }
+  }
+  try {
+    await cloudPushRoster(config);
+  } catch (err) {
+    process.stderr.write(`[cloud-sync] Roster push warning: ${err instanceof Error ? err.message : String(err)}
+`);
+  }
+  try {
+    await cloudPullRoster(config);
+  } catch (err) {
+    process.stderr.write(`[cloud-sync] Roster pull warning: ${err instanceof Error ? err.message : String(err)}
+`);
+  }
+  return { pushed, pulled };
+}
+function buildRosterBlob(paths) {
+  const rosterPath = paths?.rosterPath ?? path6.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path6.join(EXE_AI_DIR, "identity");
+  let roster = [];
+  if (existsSync6(rosterPath)) {
+    try {
+      roster = JSON.parse(readFileSync5(rosterPath, "utf-8"));
+    } catch {
+    }
+  }
+  const identities = {};
+  if (existsSync6(identityDir)) {
+    for (const file of readdirSync(identityDir).filter((f) => f.endsWith(".md"))) {
+      try {
+        identities[file] = readFileSync5(path6.join(identityDir, file), "utf-8");
+      } catch {
+      }
+    }
+  }
+  const content = JSON.stringify({ roster, identities });
+  const hash = Buffer.from(content).length;
+  return { roster, identities, version: hash };
+}
+async function cloudPushRoster(config) {
+  assertSecureEndpoint(config.endpoint);
+  const blob = buildRosterBlob();
+  if (blob.roster.length === 0) return true;
+  try {
+    const client = getClient();
+    const meta = await client.execute(
+      "SELECT value FROM sync_meta WHERE key = 'last_roster_push_version'"
+    );
+    const lastVersion = meta.rows.length > 0 ? Number(meta.rows[0].value) : 0;
+    if (blob.version === lastVersion) return true;
+  } catch {
+  }
+  try {
+    const json = JSON.stringify(blob);
+    const compressed = compress(Buffer.from(json, "utf8"));
+    const encrypted = encryptSyncBlob(compressed);
+    const resp = await fetch(`${config.endpoint}/sync/push-roster`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Device-Id": loadDeviceId()
+      },
+      body: JSON.stringify({ blob: encrypted })
+    });
+    if (resp.ok) {
+      try {
+        const client = getClient();
+        await client.execute({
+          sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_roster_push_version', ?)",
+          args: [String(blob.version)]
+        });
+      } catch {
+      }
+    }
+    return resp.ok;
+  } catch (err) {
+    process.stderr.write(`[cloud-sync] ROSTER PUSH FAILED: ${err instanceof Error ? err.message : String(err)}
+`);
+    return false;
+  }
+}
+async function cloudPullRoster(config) {
+  assertSecureEndpoint(config.endpoint);
+  try {
+    const resp = await fetch(`${config.endpoint}/sync/pull-roster`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "X-Device-Id": loadDeviceId()
+      }
+    });
+    if (!resp.ok) return { added: 0 };
+    const data = await resp.json();
+    if (!data.blob) return { added: 0 };
+    const compressed = decryptSyncBlob(data.blob);
+    const json = decompress(compressed).toString("utf8");
+    const remote = JSON.parse(json);
+    return mergeRosterFromRemote(remote);
+  } catch (err) {
+    process.stderr.write(`[cloud-sync] ROSTER PULL FAILED: ${err instanceof Error ? err.message : String(err)}
+`);
+    return { added: 0 };
+  }
+}
+async function mergeRosterFromRemote(remote, paths) {
+  const rosterPath = paths?.rosterPath ?? void 0;
+  const identityDir = paths?.identityDir ?? path6.join(EXE_AI_DIR, "identity");
+  const localEmployees = await loadEmployees(rosterPath);
+  const localNames = new Set(localEmployees.map((e) => e.name));
+  let added = 0;
+  for (const remoteEmp of remote.roster) {
+    if (localNames.has(remoteEmp.name)) continue;
+    localEmployees.push(remoteEmp);
+    localNames.add(remoteEmp.name);
+    added++;
+    if (remote.identities[`${remoteEmp.name}.md`]) {
+      if (!existsSync6(identityDir)) mkdirSync2(identityDir, { recursive: true });
+      const idPath = path6.join(identityDir, `${remoteEmp.name}.md`);
+      if (!existsSync6(idPath)) {
+        writeFileSync2(idPath, remote.identities[`${remoteEmp.name}.md`], "utf-8");
+      }
+    }
+    try {
+      registerBinSymlinks(remoteEmp.name);
+    } catch {
+    }
+  }
+  if (added > 0) {
+    await saveEmployees(localEmployees, rosterPath);
+  }
+  return { added };
+}
+var LOCALHOST_PATTERNS;
+var init_cloud_sync = __esm({
+  "src/lib/cloud-sync.ts"() {
+    "use strict";
+    init_database();
+    init_crypto();
+    init_compress();
+    init_plan_limits();
+    init_license();
+    init_config();
+    init_employees();
+    LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
+  }
+});
 
 // src/bin/exe-link.ts
 import { createInterface } from "readline";
@@ -169,6 +1101,20 @@ async function main() {
       const key = importMnemonic(mnemonic);
       await setMasterKey(key);
       console.log("Master key imported and stored securely.");
+      try {
+        const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+        const { initSyncCrypto: initSyncCrypto2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
+        const { cloudPullRoster: cloudPullRoster2 } = await Promise.resolve().then(() => (init_cloud_sync(), cloud_sync_exports));
+        const config = await loadConfig2();
+        if (config.cloud?.apiKey && config.cloud?.endpoint) {
+          initSyncCrypto2(key);
+          const result = await cloudPullRoster2({ apiKey: config.cloud.apiKey, endpoint: config.cloud.endpoint });
+          if (result.added > 0) {
+            console.log(`Pulled ${result.added} employee(s) from Exe Cloud.`);
+          }
+        }
+      } catch {
+      }
       console.log("Run /exe-setup to configure sync and download the embedding model.");
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));