@askexenow/exe-os 0.8.37 → 0.8.39

package/dist/bin/exe-session-cleanup.js

@@ -3,12 +3,6 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -123,6 +117,7 @@ async function ensureSchema() {
   const client = getRawClient();
   await client.execute("PRAGMA journal_mode = WAL");
   await client.execute("PRAGMA busy_timeout = 30000");
+  await client.execute("PRAGMA wal_autocheckpoint = 1000");
   try {
     await client.execute("PRAGMA libsql_vector_search_ef = 128");
   } catch {
@@ -938,15 +933,15 @@ __export(config_exports, {
   migrateConfig: () => migrateConfig,
   saveConfig: () => saveConfig
 });
-import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
 import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
 import path2 from "path";
-import os from "os";
+import os2 from "os";
 function resolveDataDir() {
   if (process.env.EXE_OS_DIR) return process.env.EXE_OS_DIR;
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
-  const newDir = path2.join(os.homedir(), ".exe-os");
-  const legacyDir = path2.join(os.homedir(), ".exe-mem");
+  const newDir = path2.join(os2.homedir(), ".exe-os");
+  const legacyDir = path2.join(os2.homedir(), ".exe-mem");
   if (!existsSync2(newDir) && existsSync2(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
@@ -1033,7 +1028,7 @@ async function loadConfig() {
     normalizeAutoUpdate(migratedCfg);
     const config = { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db"), ...migratedCfg };
     if (config.dbPath.startsWith("~")) {
-      config.dbPath = config.dbPath.replace(/^~/, os.homedir());
+      config.dbPath = config.dbPath.replace(/^~/, os2.homedir());
     }
     return config;
   } catch {
@@ -1064,6 +1059,9 @@ async function saveConfig(config) {
   await mkdir2(dir, { recursive: true });
   const configPath = path2.join(dir, "config.json");
   await writeFile2(configPath, JSON.stringify(config, null, 2) + "\n");
+  if (config.cloud?.apiKey) {
+    await chmod2(configPath, 384);
+  }
 }
 async function loadConfigFrom(configPath) {
   const raw = await readFile2(configPath, "utf-8");
@@ -1179,7 +1177,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path3 from "path";
-import { existsSync as existsSync3, mkdirSync } from "fs";
+import { existsSync as existsSync3, mkdirSync, readdirSync } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -1218,8 +1216,7 @@ function shardExists(projectName) {
 }
 function listShards() {
   if (!existsSync3(SHARDS_DIR)) return [];
-  const { readdirSync: readdirSync3 } = __require("fs");
-  return readdirSync3(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
+  return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
   await client.execute("PRAGMA journal_mode = WAL");
@@ -1458,6 +1455,10 @@ import path5 from "path";
 import { fileURLToPath } from "url";
 function handleData(chunk) {
   _buffer += chunk.toString();
+  if (_buffer.length > MAX_BUFFER) {
+    _buffer = "";
+    return;
+  }
   let newlineIdx;
   while ((newlineIdx = _buffer.indexOf("\n")) !== -1) {
     const line = _buffer.slice(0, newlineIdx).trim();
@@ -1765,7 +1766,7 @@ function disconnectClient() {
     entry.resolve({ error: "Client disconnected" });
   }
 }
-var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, _socket, _connected, _buffer, _requestCount, HEALTH_CHECK_INTERVAL, _pending;
+var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, _socket, _connected, _buffer, _requestCount, HEALTH_CHECK_INTERVAL, _pending, MAX_BUFFER;
 var init_exe_daemon_client = __esm({
   "src/lib/exe-daemon-client.ts"() {
     "use strict";
@@ -1782,6 +1783,7 @@ var init_exe_daemon_client = __esm({
     _requestCount = 0;
     HEALTH_CHECK_INTERVAL = 100;
     _pending = /* @__PURE__ */ new Map();
+    MAX_BUFFER = 1e7;
   }
 });
 
@@ -1884,10 +1886,10 @@ var init_employees = __esm({
 // src/lib/notifications.ts
 import crypto2 from "crypto";
 import path7 from "path";
-import os2 from "os";
+import os3 from "os";
 import {
   readFileSync as readFileSync4,
-  readdirSync,
+  readdirSync as readdirSync2,
   unlinkSync as unlinkSync2,
   existsSync as existsSync6,
   rmdirSync
@@ -2136,12 +2138,12 @@ var init_tasks_crud = __esm({
 
 // src/lib/session-registry.ts
 import path9 from "path";
-import os3 from "os";
+import os4 from "os";
 var REGISTRY_PATH;
 var init_session_registry = __esm({
   "src/lib/session-registry.ts"() {
     "use strict";
-    REGISTRY_PATH = path9.join(os3.homedir(), ".exe-os", "session-registry.json");
+    REGISTRY_PATH = path9.join(os4.homedir(), ".exe-os", "session-registry.json");
   }
 });
 
@@ -2319,7 +2321,7 @@ var init_provider_table = __esm({
 // src/lib/intercom-queue.ts
 import { readFileSync as readFileSync6, writeFileSync, renameSync as renameSync2, existsSync as existsSync8, mkdirSync as mkdirSync2 } from "fs";
 import path10 from "path";
-import os4 from "os";
+import os5 from "os";
 function ensureDir() {
   const dir = path10.dirname(QUEUE_PATH);
   if (!existsSync8(dir)) mkdirSync2(dir, { recursive: true });
@@ -2359,9 +2361,9 @@ var QUEUE_PATH, TTL_MS, INTERCOM_LOG;
 var init_intercom_queue = __esm({
   "src/lib/intercom-queue.ts"() {
     "use strict";
-    QUEUE_PATH = path10.join(os4.homedir(), ".exe-os", "intercom-queue.json");
+    QUEUE_PATH = path10.join(os5.homedir(), ".exe-os", "intercom-queue.json");
     TTL_MS = 60 * 60 * 1e3;
-    INTERCOM_LOG = path10.join(os4.homedir(), ".exe-os", "intercom.log");
+    INTERCOM_LOG = path10.join(os5.homedir(), ".exe-os", "intercom.log");
   }
 });
 
@@ -2399,7 +2401,7 @@ var init_plan_limits = __esm({
 // src/lib/tmux-routing.ts
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync11, appendFileSync } from "fs";
 import path13 from "path";
-import os5 from "os";
+import os6 from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getParentExe(sessionKey) {
   try {
@@ -2522,10 +2524,10 @@ var init_tmux_routing = __esm({
     init_provider_table();
     init_intercom_queue();
     init_plan_limits();
-    SPAWN_LOCK_DIR = path13.join(os5.homedir(), ".exe-os", "spawn-locks");
-    SESSION_CACHE = path13.join(os5.homedir(), ".exe-os", "session-cache");
+    SPAWN_LOCK_DIR = path13.join(os6.homedir(), ".exe-os", "spawn-locks");
+    SESSION_CACHE = path13.join(os6.homedir(), ".exe-os", "session-cache");
     INTERCOM_DEBOUNCE_MS = 3e4;
-    INTERCOM_LOG2 = path13.join(os5.homedir(), ".exe-os", "intercom.log");
+    INTERCOM_LOG2 = path13.join(os6.homedir(), ".exe-os", "intercom.log");
     DEBOUNCE_FILE = path13.join(SESSION_CACHE, "intercom-debounce.json");
     DEBOUNCE_CLEANUP_AGE_MS = 5 * 60 * 1e3;
     BUSY_PATTERN = /[✻✽✶✳·].*…|Running…/;
@@ -2543,7 +2545,7 @@ __export(tasks_review_exports, {
   listPendingReviews: () => listPendingReviews
 });
 import path14 from "path";
-import { existsSync as existsSync12, readdirSync as readdirSync2, unlinkSync as unlinkSync3 } from "fs";
+import { existsSync as existsSync12, readdirSync as readdirSync3, unlinkSync as unlinkSync3 } from "fs";
 async function countPendingReviews() {
   const client = getClient();
   const result = await client.execute({
@@ -2755,7 +2757,7 @@ async function cleanupReviewFile(row, taskFile, _baseDir) {
   try {
     const cacheDir = path14.join(EXE_AI_DIR, "session-cache");
     if (existsSync12(cacheDir)) {
-      for (const f of readdirSync2(cacheDir)) {
+      for (const f of readdirSync3(cacheDir)) {
         if (f.startsWith("review-notified-")) {
           unlinkSync3(path14.join(cacheDir, f));
         }
@@ -3000,11 +3002,12 @@ init_database();
 import { readFile, writeFile, unlink, mkdir, chmod } from "fs/promises";
 import { existsSync } from "fs";
 import path from "path";
+import os from "os";
 import crypto from "crypto";
 var SERVICE = "exe-mem";
 var ACCOUNT = "master-key";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(process.env.HOME ?? "/tmp", ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
 }
 function getKeyPath() {
   return path.join(getKeyDir(), "master.key");
@@ -3041,6 +3044,30 @@ async function getMasterKey() {
 
 // src/lib/store.ts
 init_config();
+var INIT_MAX_RETRIES = 3;
+var INIT_RETRY_DELAY_MS = 1e3;
+function isBusyError2(err) {
+  if (err instanceof Error) {
+    const msg = err.message.toLowerCase();
+    return msg.includes("sqlite_busy") || msg.includes("database is locked");
+  }
+  return false;
+}
+async function retryOnBusy2(fn, label) {
+  for (let attempt = 0; attempt <= INIT_MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      if (!isBusyError2(err) || attempt === INIT_MAX_RETRIES) throw err;
+      process.stderr.write(
+        `[store] SQLITE_BUSY during ${label}, retry ${attempt + 1}/${INIT_MAX_RETRIES}
+`
+      );
+      await new Promise((r) => setTimeout(r, INIT_RETRY_DELAY_MS * (attempt + 1)));
+    }
+  }
+  throw new Error("unreachable");
+}
 var _pendingRecords = [];
 var _batchSize = 20;
 var _flushIntervalMs = 1e4;
@@ -3075,14 +3102,17 @@ async function initStore(options) {
     dbPath,
     encryptionKey: hexKey
   });
-  await ensureSchema();
+  await retryOnBusy2(() => ensureSchema(), "ensureSchema");
   try {
     const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
     initShardManager2(hexKey);
   } catch {
   }
   const client = getClient();
-  const vResult = await client.execute("SELECT MAX(version) as max_v FROM memories");
+  const vResult = await retryOnBusy2(
+    () => client.execute("SELECT MAX(version) as max_v FROM memories"),
+    "version-query"
+  );
   _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
 }
 function classifyTier(record) {
@@ -3125,6 +3155,12 @@ async function writeMemory(record) {
     supersedes_id: record.supersedes_id ?? null
   };
   _pendingRecords.push(dbRow);
+  const MAX_PENDING = 1e3;
+  if (_pendingRecords.length > MAX_PENDING) {
+    const dropped = _pendingRecords.length - MAX_PENDING;
+    _pendingRecords = _pendingRecords.slice(-MAX_PENDING);
+    console.warn(`[store] Dropped ${dropped} oldest pending records (overflow)`);
+  }
   if (_flushTimer === null) {
     _flushTimer = setInterval(() => {
       void flushBatch();

package/dist/bin/exe-settings.js

@@ -2,7 +2,7 @@
 import { createInterface } from "readline";
 
 // src/lib/config.ts
-import { readFile, writeFile, mkdir } from "fs/promises";
+import { readFile, writeFile, mkdir, chmod } from "fs/promises";
 import { readFileSync, existsSync, renameSync } from "fs";
 import path from "path";
 import os from "os";
@@ -188,6 +188,9 @@ async function saveConfig(config) {
   await mkdir(dir, { recursive: true });
   const configPath = path.join(dir, "config.json");
   await writeFile(configPath, JSON.stringify(config, null, 2) + "\n");
+  if (config.cloud?.apiKey) {
+    await chmod(configPath, 384);
+  }
 }
 
 // src/lib/is-main.ts
@@ -204,6 +207,62 @@ function isMainModule(importMetaUrl) {
   }
 }
 
+// src/lib/cloud-sync.ts
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync5, readdirSync, mkdirSync as mkdirSync2, appendFileSync, unlinkSync } from "fs";
+import path5 from "path";
+import { homedir } from "os";
+
+// src/lib/database.ts
+import { createClient } from "@libsql/client";
+
+// src/lib/crypto.ts
+import crypto from "crypto";
+
+// src/lib/compress.ts
+import { brotliCompressSync, brotliDecompressSync, constants } from "zlib";
+
+// src/lib/plan-limits.ts
+import { readFileSync as readFileSync4, existsSync as existsSync4 } from "fs";
+import path4 from "path";
+
+// src/lib/employees.ts
+import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { existsSync as existsSync2, symlinkSync, readlinkSync, readFileSync as readFileSync2 } from "fs";
+import { execSync } from "child_process";
+import path2 from "path";
+var EMPLOYEES_PATH = path2.join(EXE_AI_DIR, "exe-employees.json");
+
+// src/lib/license.ts
+import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync3, mkdirSync } from "fs";
+import { randomUUID } from "crypto";
+import path3 from "path";
+import { jwtVerify, importSPKI } from "jose";
+var LICENSE_PATH = path3.join(EXE_AI_DIR, "license.key");
+var CACHE_PATH = path3.join(EXE_AI_DIR, "license-cache.json");
+var DEVICE_ID_PATH = path3.join(EXE_AI_DIR, "device-id");
+
+// src/lib/plan-limits.ts
+var CACHE_PATH2 = path4.join(EXE_AI_DIR, "license-cache.json");
+
+// src/lib/cloud-sync.ts
+var LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
+var ROSTER_LOCK_PATH = path5.join(EXE_AI_DIR, "roster-merge.lock");
+function assertSecureEndpoint(endpoint) {
+  if (endpoint.startsWith("https://")) return;
+  if (endpoint.startsWith("http://")) {
+    try {
+      const parsed = new URL(endpoint);
+      if (LOCALHOST_PATTERNS.test(parsed.hostname)) return;
+    } catch {
+      return;
+    }
+    throw new Error(
+      `Insecure cloud endpoint rejected: "${endpoint}". Use https:// for remote hosts. Plain http:// is only allowed for localhost.`
+    );
+  }
+}
+var ROSTER_DELETIONS_PATH = path5.join(EXE_AI_DIR, "roster-deletions.json");
+
 // src/bin/exe-settings.ts
 function label(value) {
   return value ? "ON" : "OFF";
@@ -315,9 +374,11 @@ async function main() {
                 const endpoint = ep.trim() || "https://askexe.com/cloud";
                 console.log("  Validating...");
                 try {
+                  assertSecureEndpoint(endpoint);
                   const resp = await fetch(`${endpoint}/auth/verify`, {
                     method: "POST",
-                    headers: { "Authorization": `Bearer ${key}`, "Content-Type": "application/json" }
+                    headers: { "Authorization": `Bearer ${key}`, "Content-Type": "application/json" },
+                    signal: AbortSignal.timeout(3e4)
                   });
                   if (resp.ok) {
                     config.cloud = { apiKey: key, endpoint };

package/dist/bin/exe-status.js

@@ -1,12 +1,6 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -16,7 +10,7 @@ var __export = (target, all) => {
 };
 
 // src/lib/config.ts
-import { readFile, writeFile, mkdir } from "fs/promises";
+import { readFile, writeFile, mkdir, chmod } from "fs/promises";
 import { readFileSync, existsSync, renameSync } from "fs";
 import path from "path";
 import os from "os";
@@ -218,7 +212,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path4 from "path";
-import { existsSync as existsSync4, mkdirSync } from "fs";
+import { existsSync as existsSync4, mkdirSync, readdirSync } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -257,7 +251,6 @@ function shardExists(projectName) {
 }
 function listShards() {
   if (!existsSync4(SHARDS_DIR)) return [];
-  const { readdirSync } = __require("fs");
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
@@ -552,6 +545,7 @@ async function ensureSchema() {
   const client = getRawClient();
   await client.execute("PRAGMA journal_mode = WAL");
   await client.execute("PRAGMA busy_timeout = 30000");
+  await client.execute("PRAGMA wal_autocheckpoint = 1000");
   try {
     await client.execute("PRAGMA libsql_vector_search_ef = 128");
   } catch {
@@ -1342,14 +1336,15 @@ async function ensureSchema() {
 }
 
 // src/lib/keychain.ts
-import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 import path3 from "path";
+import os2 from "os";
 import crypto from "crypto";
 var SERVICE = "exe-mem";
 var ACCOUNT = "master-key";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path3.join(process.env.HOME ?? "/tmp", ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path3.join(os2.homedir(), ".exe-os");
 }
 function getKeyPath() {
   return path3.join(getKeyDir(), "master.key");
@@ -1386,6 +1381,30 @@ async function getMasterKey() {
 
 // src/lib/store.ts
 init_config();
+var INIT_MAX_RETRIES = 3;
+var INIT_RETRY_DELAY_MS = 1e3;
+function isBusyError2(err) {
+  if (err instanceof Error) {
+    const msg = err.message.toLowerCase();
+    return msg.includes("sqlite_busy") || msg.includes("database is locked");
+  }
+  return false;
+}
+async function retryOnBusy2(fn, label) {
+  for (let attempt = 0; attempt <= INIT_MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      if (!isBusyError2(err) || attempt === INIT_MAX_RETRIES) throw err;
+      process.stderr.write(
+        `[store] SQLITE_BUSY during ${label}, retry ${attempt + 1}/${INIT_MAX_RETRIES}
+`
+      );
+      await new Promise((r) => setTimeout(r, INIT_RETRY_DELAY_MS * (attempt + 1)));
+    }
+  }
+  throw new Error("unreachable");
+}
 var _pendingRecords = [];
 var _batchSize = 20;
 var _flushIntervalMs = 1e4;
@@ -1420,14 +1439,17 @@ async function initStore(options) {
     dbPath,
     encryptionKey: hexKey
   });
-  await ensureSchema();
+  await retryOnBusy2(() => ensureSchema(), "ensureSchema");
   try {
     const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
     initShardManager2(hexKey);
   } catch {
   }
   const client = getClient();
-  const vResult = await client.execute("SELECT MAX(version) as max_v FROM memories");
+  const vResult = await retryOnBusy2(
+    () => client.execute("SELECT MAX(version) as max_v FROM memories"),
+    "version-query"
+  );
   _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
 }
 

package/dist/bin/exe-team.js

@@ -1,12 +1,6 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -16,7 +10,7 @@ var __export = (target, all) => {
 };
 
 // src/lib/config.ts
-import { readFile, writeFile, mkdir } from "fs/promises";
+import { readFile, writeFile, mkdir, chmod } from "fs/promises";
 import { readFileSync, existsSync, renameSync } from "fs";
 import path from "path";
 import os from "os";
@@ -218,7 +212,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path4 from "path";
-import { existsSync as existsSync4, mkdirSync } from "fs";
+import { existsSync as existsSync4, mkdirSync, readdirSync } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -257,7 +251,6 @@ function shardExists(projectName) {
 }
 function listShards() {
   if (!existsSync4(SHARDS_DIR)) return [];
-  const { readdirSync } = __require("fs");
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
@@ -552,6 +545,7 @@ async function ensureSchema() {
   const client = getRawClient();
   await client.execute("PRAGMA journal_mode = WAL");
   await client.execute("PRAGMA busy_timeout = 30000");
+  await client.execute("PRAGMA wal_autocheckpoint = 1000");
   try {
     await client.execute("PRAGMA libsql_vector_search_ef = 128");
   } catch {
@@ -1342,14 +1336,15 @@ async function ensureSchema() {
 }
 
 // src/lib/keychain.ts
-import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 import path3 from "path";
+import os2 from "os";
 import crypto from "crypto";
 var SERVICE = "exe-mem";
 var ACCOUNT = "master-key";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path3.join(process.env.HOME ?? "/tmp", ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path3.join(os2.homedir(), ".exe-os");
 }
 function getKeyPath() {
   return path3.join(getKeyDir(), "master.key");
@@ -1386,6 +1381,30 @@ async function getMasterKey() {
 
 // src/lib/store.ts
 init_config();
+var INIT_MAX_RETRIES = 3;
+var INIT_RETRY_DELAY_MS = 1e3;
+function isBusyError2(err) {
+  if (err instanceof Error) {
+    const msg = err.message.toLowerCase();
+    return msg.includes("sqlite_busy") || msg.includes("database is locked");
+  }
+  return false;
+}
+async function retryOnBusy2(fn, label) {
+  for (let attempt = 0; attempt <= INIT_MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      if (!isBusyError2(err) || attempt === INIT_MAX_RETRIES) throw err;
+      process.stderr.write(
+        `[store] SQLITE_BUSY during ${label}, retry ${attempt + 1}/${INIT_MAX_RETRIES}
+`
+      );
+      await new Promise((r) => setTimeout(r, INIT_RETRY_DELAY_MS * (attempt + 1)));
+    }
+  }
+  throw new Error("unreachable");
+}
 var _pendingRecords = [];
 var _batchSize = 20;
 var _flushIntervalMs = 1e4;
@@ -1420,14 +1439,17 @@ async function initStore(options) {
     dbPath,
     encryptionKey: hexKey
   });
-  await ensureSchema();
+  await retryOnBusy2(() => ensureSchema(), "ensureSchema");
   try {
     const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
     initShardManager2(hexKey);
   } catch {
   }
   const client = getClient();
-  const vResult = await client.execute("SELECT MAX(version) as max_v FROM memories");
+  const vResult = await retryOnBusy2(
+    () => client.execute("SELECT MAX(version) as max_v FROM memories"),
+    "version-query"
+  );
   _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
 }