@askexenow/exe-os 0.8.37 → 0.8.39

package/dist/hooks/summary-worker.js

@@ -79,6 +79,17 @@ var init_db_retry = __esm({
 });
 
 // src/lib/database.ts
+var database_exports = {};
+__export(database_exports, {
+  disposeDatabase: () => disposeDatabase,
+  disposeTurso: () => disposeTurso,
+  ensureSchema: () => ensureSchema,
+  getClient: () => getClient,
+  getRawClient: () => getRawClient,
+  initDatabase: () => initDatabase,
+  initTurso: () => initTurso,
+  isInitialized: () => isInitialized
+});
 import { createClient } from "@libsql/client";
 async function initDatabase(config) {
   if (_client) {
@@ -114,6 +125,7 @@ async function ensureSchema() {
   const client = getRawClient();
   await client.execute("PRAGMA journal_mode = WAL");
   await client.execute("PRAGMA busy_timeout = 30000");
+  await client.execute("PRAGMA wal_autocheckpoint = 1000");
   try {
     await client.execute("PRAGMA libsql_vector_search_ef = 128");
   } catch {
@@ -902,7 +914,14 @@ async function ensureSchema() {
     }
   }
 }
-var _client, _resilientClient, initTurso;
+async function disposeDatabase() {
+  if (_client) {
+    _client.close();
+    _client = null;
+    _resilientClient = null;
+  }
+}
+var _client, _resilientClient, initTurso, disposeTurso;
 var init_database = __esm({
   "src/lib/database.ts"() {
     "use strict";
@@ -910,6 +929,7 @@ var init_database = __esm({
     _client = null;
     _resilientClient = null;
     initTurso = initDatabase;
+    disposeTurso = disposeDatabase;
   }
 });
 
@@ -925,9 +945,10 @@ __export(keychain_exports, {
 import { readFile, writeFile, unlink, mkdir, chmod } from "fs/promises";
 import { existsSync } from "fs";
 import path from "path";
+import os from "os";
 import crypto from "crypto";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(process.env.HOME ?? "/tmp", ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
 }
 function getKeyPath() {
   return path.join(getKeyDir(), "master.key");
@@ -1075,15 +1096,15 @@ __export(config_exports, {
   migrateConfig: () => migrateConfig,
   saveConfig: () => saveConfig
 });
-import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
 import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
 import path2 from "path";
-import os from "os";
+import os2 from "os";
 function resolveDataDir() {
   if (process.env.EXE_OS_DIR) return process.env.EXE_OS_DIR;
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
-  const newDir = path2.join(os.homedir(), ".exe-os");
-  const legacyDir = path2.join(os.homedir(), ".exe-mem");
+  const newDir = path2.join(os2.homedir(), ".exe-os");
+  const legacyDir = path2.join(os2.homedir(), ".exe-mem");
   if (!existsSync2(newDir) && existsSync2(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
@@ -1170,7 +1191,7 @@ async function loadConfig() {
     normalizeAutoUpdate(migratedCfg);
     const config = { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db"), ...migratedCfg };
     if (config.dbPath.startsWith("~")) {
-      config.dbPath = config.dbPath.replace(/^~/, os.homedir());
+      config.dbPath = config.dbPath.replace(/^~/, os2.homedir());
     }
     return config;
   } catch {
@@ -1201,6 +1222,9 @@ async function saveConfig(config) {
   await mkdir2(dir, { recursive: true });
   const configPath = path2.join(dir, "config.json");
   await writeFile2(configPath, JSON.stringify(config, null, 2) + "\n");
+  if (config.cloud?.apiKey) {
+    await chmod2(configPath, 384);
+  }
 }
 async function loadConfigFrom(configPath) {
   const raw = await readFile2(configPath, "utf-8");
@@ -1316,7 +1340,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path3 from "path";
-import { existsSync as existsSync3, mkdirSync } from "fs";
+import { existsSync as existsSync3, mkdirSync, readdirSync } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -1355,8 +1379,7 @@ function shardExists(projectName) {
 }
 function listShards() {
   if (!existsSync3(SHARDS_DIR)) return [];
-  const { readdirSync: readdirSync3 } = __require("fs");
-  return readdirSync3(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
+  return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
   await client.execute("PRAGMA journal_mode = WAL");
@@ -1564,15 +1587,20 @@ async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
   await mkdir3(path5.dirname(employeesPath), { recursive: true });
   await writeFile3(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
 }
+function findExeBin() {
+  try {
+    return execSync(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
+  } catch {
+    return null;
+  }
+}
 function registerBinSymlinks(name) {
   const created = [];
   const skipped = [];
   const errors = [];
-  let exeBinPath;
-  try {
-    exeBinPath = execSync("which exe", { encoding: "utf-8" }).trim();
-  } catch {
-    errors.push("Could not find 'exe' in PATH");
+  const exeBinPath = findExeBin();
+  if (!exeBinPath) {
+    errors.push("Could not find 'exe-os' in PATH");
     return { created, skipped, errors };
   }
   const binDir = path5.dirname(exeBinPath);
@@ -1613,6 +1641,14 @@ import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync6
 import { randomUUID } from "crypto";
 import path6 from "path";
 import { jwtVerify, importSPKI } from "jose";
+async function fetchRetry(url, init) {
+  try {
+    return await fetch(url, init);
+  } catch {
+    await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
+    return fetch(url, { ...init, signal: AbortSignal.timeout(1e4) });
+  }
+}
 function loadDeviceId() {
   const deviceJsonPath = path6.join(EXE_AI_DIR, "device.json");
   try {
@@ -1683,7 +1719,7 @@ function cacheResponse(token) {
 async function validateLicense(apiKey, deviceId) {
   const did = deviceId ?? loadDeviceId();
   try {
-    const res = await fetch(`${API_BASE}/auth/activate`, {
+    const res = await fetchRetry(`${API_BASE}/auth/activate`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ apiKey, deviceId: did }),
@@ -1718,14 +1754,23 @@ async function validateLicense(apiKey, deviceId) {
   } catch {
     const cached = await getCachedLicense();
     if (cached) return cached;
-    return FREE_LICENSE;
+    return { ...FREE_LICENSE, valid: false, error: "offline" };
+  }
+}
+function getCacheAgeMs() {
+  try {
+    const { statSync: statSync2 } = __require("fs");
+    const s = statSync2(CACHE_PATH);
+    return Date.now() - s.mtimeMs;
+  } catch {
+    return Infinity;
   }
 }
 async function checkLicense() {
   const key = loadLicense();
   if (!key) return FREE_LICENSE;
   const cached = await getCachedLicense();
-  if (cached) return cached;
+  if (cached && getCacheAgeMs() < CACHE_MAX_AGE_MS) return cached;
   const deviceId = loadDeviceId();
   return validateLicense(key, deviceId);
 }
@@ -1739,7 +1784,7 @@ function isFeatureAllowed(license, feature) {
       return license.plan === "team" || license.plan === "agency" || license.plan === "enterprise";
   }
 }
-var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, API_BASE, LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG, PLAN_LIMITS, FREE_LICENSE;
+var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, API_BASE, RETRY_DELAY_MS, LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG, PLAN_LIMITS, FREE_LICENSE, CACHE_MAX_AGE_MS;
 var init_license = __esm({
   "src/lib/license.ts"() {
     "use strict";
@@ -1748,6 +1793,7 @@ var init_license = __esm({
     CACHE_PATH = path6.join(EXE_AI_DIR, "license-cache.json");
     DEVICE_ID_PATH = path6.join(EXE_AI_DIR, "device-id");
     API_BASE = "https://askexe.com/cloud";
+    RETRY_DELAY_MS = 500;
     LICENSE_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
 4uj+UqeKCcvtgNHKmOK278HJaJcANe9xAeji8AFYu27q3WtzCi04pHudow==
@@ -1769,6 +1815,7 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
       employeeLimit: 1,
       memoryLimit: 5e3
     };
+    CACHE_MAX_AGE_MS = 36e5;
   }
 });
 
@@ -1906,6 +1953,10 @@ import path8 from "path";
 import { fileURLToPath } from "url";
 function handleData(chunk) {
   _buffer += chunk.toString();
+  if (_buffer.length > MAX_BUFFER) {
+    _buffer = "";
+    return;
+  }
   let newlineIdx;
   while ((newlineIdx = _buffer.indexOf("\n")) !== -1) {
     const line = _buffer.slice(0, newlineIdx).trim();
@@ -2213,7 +2264,7 @@ function disconnectClient() {
     entry.resolve({ error: "Client disconnected" });
   }
 }
-var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, _socket, _connected, _buffer, _requestCount, HEALTH_CHECK_INTERVAL, _pending;
+var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, _socket, _connected, _buffer, _requestCount, HEALTH_CHECK_INTERVAL, _pending, MAX_BUFFER;
 var init_exe_daemon_client = __esm({
   "src/lib/exe-daemon-client.ts"() {
     "use strict";
@@ -2230,6 +2281,7 @@ var init_exe_daemon_client = __esm({
     _requestCount = 0;
     HEALTH_CHECK_INTERVAL = 100;
     _pending = /* @__PURE__ */ new Map();
+    MAX_BUFFER = 1e7;
   }
 });
 
@@ -2271,8 +2323,8 @@ async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
   const { existsSync: existsSync11 } = await import("fs");
-  const path11 = await import("path");
-  const modelPath = path11.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  const path12 = await import("path");
+  const modelPath = path12.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
   if (!existsSync11(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
@@ -2383,6 +2435,7 @@ var init_compress = __esm({
 // src/lib/cloud-sync.ts
 var cloud_sync_exports = {};
 __export(cloud_sync_exports, {
+  assertSecureEndpoint: () => assertSecureEndpoint,
   buildRosterBlob: () => buildRosterBlob,
   cloudPull: () => cloudPull,
   cloudPullBehaviors: () => cloudPullBehaviors,
@@ -2402,9 +2455,10 @@ __export(cloud_sync_exports, {
   cloudPushTasks: () => cloudPushTasks,
   cloudSync: () => cloudSync,
   mergeConfig: () => mergeConfig,
-  mergeRosterFromRemote: () => mergeRosterFromRemote
+  mergeRosterFromRemote: () => mergeRosterFromRemote,
+  recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, existsSync as existsSync9, readdirSync as readdirSync2, mkdirSync as mkdirSync3, appendFileSync } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, existsSync as existsSync9, readdirSync as readdirSync3, mkdirSync as mkdirSync3, appendFileSync, unlinkSync as unlinkSync3 } from "fs";
 import path9 from "path";
 import { homedir } from "os";
 function logError(msg) {
@@ -2415,16 +2469,47 @@ function logError(msg) {
   } catch {
   }
 }
+async function withRosterLock(fn) {
+  if (existsSync9(ROSTER_LOCK_PATH)) {
+    try {
+      const ts = parseInt(readFileSync7(ROSTER_LOCK_PATH, "utf-8"), 10);
+      if (Date.now() - ts < LOCK_STALE_MS) {
+        throw new Error("Roster merge already in progress \u2014 another sync is running");
+      }
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("already in progress")) throw err;
+    }
+  }
+  writeFileSync2(ROSTER_LOCK_PATH, String(Date.now()));
+  try {
+    return await fn();
+  } finally {
+    try {
+      unlinkSync3(ROSTER_LOCK_PATH);
+    } catch {
+    }
+  }
+}
 async function fetchWithRetry(url, init) {
-  const attempt = async () => {
-    const signal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
-    return fetch(url, { ...init, signal });
-  };
-  const resp = await attempt();
-  if (resp.status >= 500) {
-    return attempt();
+  const MAX_RETRIES2 = 3;
+  const BASE_DELAY_MS2 = 200;
+  let lastError;
+  for (let attempt = 0; attempt <= MAX_RETRIES2; attempt++) {
+    try {
+      const signal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
+      const resp = await fetch(url, { ...init, signal });
+      if (resp.status >= 500 && attempt < MAX_RETRIES2) {
+        await new Promise((r) => setTimeout(r, BASE_DELAY_MS2 * Math.pow(2, attempt)));
+        continue;
+      }
+      return resp;
+    } catch (err) {
+      lastError = err;
+      if (attempt === MAX_RETRIES2) throw err;
+      await new Promise((r) => setTimeout(r, BASE_DELAY_MS2 * Math.pow(2, attempt)));
+    }
   }
-  return resp;
+  throw lastError;
 }
 function assertSecureEndpoint(endpoint) {
   if (endpoint.startsWith("https://")) return;
@@ -2452,10 +2537,15 @@ async function cloudPush(records, maxVersion, config) {
       headers: {
         Authorization: `Bearer ${config.apiKey}`,
         "Content-Type": "application/json",
-        "X-Device-Id": loadDeviceId()
+        "X-Device-Id": loadDeviceId(),
+        "X-Expected-Version": String(maxVersion)
       },
       body: JSON.stringify({ version: maxVersion, blob })
     });
+    if (resp.status === 409) {
+      logError("[cloud-sync] PUSH VERSION CONFLICT \u2014 re-pull required before next push");
+      return false;
+    }
     return resp.ok;
   } catch (err) {
     logError(`[cloud-sync] PUSH FAILED: ${err instanceof Error ? err.message : String(err)}`);
@@ -2542,18 +2632,21 @@ async function cloudSync(config) {
     "SELECT value FROM sync_meta WHERE key = 'last_cloud_push_version'"
   );
   const lastPushVersion = pushMeta.rows.length > 0 ? Number(pushMeta.rows[0].value) : 0;
-  const recordsResult = await client.execute({
-    sql: `SELECT id, agent_id, agent_role, session_id, timestamp,
-                 tool_name, project_name, has_error, raw_text, version,
-                 author_device_id, scope
-          FROM memories
-          WHERE version > ?
-            AND (scope IS NULL OR scope != 'personal')
-          ORDER BY version ASC`,
-    args: [lastPushVersion]
-  });
   let pushed = 0;
-  if (recordsResult.rows.length > 0) {
+  let batchCursor = lastPushVersion;
+  while (true) {
+    const recordsResult = await client.execute({
+      sql: `SELECT id, agent_id, agent_role, session_id, timestamp,
+                   tool_name, project_name, has_error, raw_text, version,
+                   author_device_id, scope
+            FROM memories
+            WHERE version > ?
+              AND (scope IS NULL OR scope != 'personal')
+            ORDER BY version ASC
+            LIMIT ?`,
+      args: [batchCursor, PUSH_BATCH_SIZE]
+    });
+    if (recordsResult.rows.length === 0) break;
     const records = recordsResult.rows.map((row) => ({
       id: row.id,
       agent_id: row.agent_id,
@@ -2570,13 +2663,14 @@ async function cloudSync(config) {
     }));
     const maxVersion = Number(records[records.length - 1].version);
     const pushOk = await cloudPush(records, maxVersion, config);
-    if (pushOk) {
-      await client.execute({
-        sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_push_version', ?)",
-        args: [String(maxVersion)]
-      });
-      pushed = records.length;
-    }
+    if (!pushOk) break;
+    await client.execute({
+      sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_push_version', ?)",
+      args: [String(maxVersion)]
+    });
+    pushed += records.length;
+    batchCursor = maxVersion;
+    if (recordsResult.rows.length < PUSH_BATCH_SIZE) break;
   }
   try {
     await cloudPushRoster(config);
@@ -2658,6 +2752,27 @@ async function cloudSync(config) {
     documents: documentsResult
   };
 }
+function recordRosterDeletion(name) {
+  let deletions = [];
+  try {
+    if (existsSync9(ROSTER_DELETIONS_PATH)) {
+      deletions = JSON.parse(readFileSync7(ROSTER_DELETIONS_PATH, "utf-8"));
+    }
+  } catch {
+  }
+  if (!deletions.includes(name)) deletions.push(name);
+  writeFileSync2(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
+}
+function consumeRosterDeletions() {
+  try {
+    if (!existsSync9(ROSTER_DELETIONS_PATH)) return [];
+    const deletions = JSON.parse(readFileSync7(ROSTER_DELETIONS_PATH, "utf-8"));
+    writeFileSync2(ROSTER_DELETIONS_PATH, "[]");
+    return deletions;
+  } catch {
+    return [];
+  }
+}
 function buildRosterBlob(paths) {
   const rosterPath = paths?.rosterPath ?? path9.join(EXE_AI_DIR, "exe-employees.json");
   const identityDir = paths?.identityDir ?? path9.join(EXE_AI_DIR, "identity");
@@ -2671,7 +2786,7 @@ function buildRosterBlob(paths) {
   }
   const identities = {};
   if (existsSync9(identityDir)) {
-    for (const file of readdirSync2(identityDir).filter((f) => f.endsWith(".md"))) {
+    for (const file of readdirSync3(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
         identities[file] = readFileSync7(path9.join(identityDir, file), "utf-8");
       } catch {
@@ -2685,9 +2800,10 @@ function buildRosterBlob(paths) {
     } catch {
     }
   }
-  const content = JSON.stringify({ roster, identities, config });
+  const deletedNames = consumeRosterDeletions();
+  const content = JSON.stringify({ roster, identities, config, deletedNames });
   const hash = Buffer.from(content).length;
-  return { roster, identities, config, version: hash };
+  return { roster, identities, config, deletedNames, version: hash };
 }
 async function cloudPushRoster(config) {
   assertSecureEndpoint(config.endpoint);
@@ -2770,38 +2886,50 @@ function mergeConfig(remoteConfig, configPath) {
   writeFileSync2(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
 }
 async function mergeRosterFromRemote(remote, paths) {
-  const rosterPath = paths?.rosterPath ?? void 0;
-  const identityDir = paths?.identityDir ?? path9.join(EXE_AI_DIR, "identity");
-  const localEmployees = await loadEmployees(rosterPath);
-  const localNames = new Set(localEmployees.map((e) => e.name));
-  let added = 0;
-  for (const remoteEmp of remote.roster) {
-    if (localNames.has(remoteEmp.name)) continue;
-    localEmployees.push(remoteEmp);
-    localNames.add(remoteEmp.name);
-    added++;
-    if (remote.identities[`${remoteEmp.name}.md`]) {
-      if (!existsSync9(identityDir)) mkdirSync3(identityDir, { recursive: true });
-      const idPath = path9.join(identityDir, `${remoteEmp.name}.md`);
-      if (!existsSync9(idPath)) {
-        writeFileSync2(idPath, remote.identities[`${remoteEmp.name}.md`], "utf-8");
+  return withRosterLock(async () => {
+    const rosterPath = paths?.rosterPath ?? void 0;
+    const identityDir = paths?.identityDir ?? path9.join(EXE_AI_DIR, "identity");
+    const localEmployees = await loadEmployees(rosterPath);
+    const localNames = new Set(localEmployees.map((e) => e.name));
+    let added = 0;
+    for (const remoteEmp of remote.roster) {
+      if (localNames.has(remoteEmp.name)) continue;
+      localEmployees.push(remoteEmp);
+      localNames.add(remoteEmp.name);
+      added++;
+      if (remote.identities[`${remoteEmp.name}.md`]) {
+        if (!existsSync9(identityDir)) mkdirSync3(identityDir, { recursive: true });
+        const idPath = path9.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync9(idPath)) {
+          writeFileSync2(idPath, remote.identities[`${remoteEmp.name}.md`], "utf-8");
+        }
+      }
+      try {
+        registerBinSymlinks(remoteEmp.name);
+      } catch {
       }
     }
-    try {
-      registerBinSymlinks(remoteEmp.name);
-    } catch {
+    let removed = 0;
+    if (remote.deletedNames && remote.deletedNames.length > 0) {
+      const toRemove = new Set(remote.deletedNames);
+      const filtered = localEmployees.filter((e) => !toRemove.has(e.name));
+      removed = localEmployees.length - filtered.length;
+      if (removed > 0) {
+        localEmployees.length = 0;
+        localEmployees.push(...filtered);
+      }
     }
-  }
-  if (added > 0) {
-    await saveEmployees(localEmployees, rosterPath);
-  }
-  if (remote.config && Object.keys(remote.config).length > 0) {
-    try {
-      mergeConfig(remote.config, paths?.configPath);
-    } catch {
+    if (added > 0 || removed > 0) {
+      await saveEmployees(localEmployees, rosterPath);
     }
-  }
-  return { added };
+    if (remote.config && Object.keys(remote.config).length > 0) {
+      try {
+        mergeConfig(remote.config, paths?.configPath);
+      } catch {
+      }
+    }
+    return { added };
+  });
 }
 async function cloudPushBlob(route, data, metaKey, config) {
   if (data.length === 0) return { ok: true };
@@ -2869,7 +2997,7 @@ async function cloudPullBlob(route, config) {
 }
 async function cloudPushBehaviors(config) {
   const client = getClient();
-  const result = await client.execute("SELECT * FROM behaviors");
+  const result = await client.execute("SELECT * FROM behaviors LIMIT 10000");
   const rows = result.rows;
   const { ok } = await cloudPushBlob(
     "/sync/push-behaviors",
@@ -2917,13 +3045,13 @@ async function cloudPullBehaviors(config) {
 async function cloudPushGraphRAG(config) {
   const client = getClient();
   const [entities, relationships, aliases, entityMems, relMems, hyperedges, hyperedgeNodes] = await Promise.all([
-    client.execute("SELECT * FROM entities"),
-    client.execute("SELECT * FROM relationships"),
-    client.execute("SELECT * FROM entity_aliases"),
-    client.execute("SELECT * FROM entity_memories"),
-    client.execute("SELECT * FROM relationship_memories"),
-    client.execute("SELECT * FROM hyperedges"),
-    client.execute("SELECT * FROM hyperedge_nodes")
+    client.execute("SELECT * FROM entities LIMIT 50000"),
+    client.execute("SELECT * FROM relationships LIMIT 50000"),
+    client.execute("SELECT * FROM entity_aliases LIMIT 50000"),
+    client.execute("SELECT * FROM entity_memories LIMIT 50000"),
+    client.execute("SELECT * FROM relationship_memories LIMIT 50000"),
+    client.execute("SELECT * FROM hyperedges LIMIT 50000"),
+    client.execute("SELECT * FROM hyperedge_nodes LIMIT 50000")
   ]);
   const blob = {
     entities: entities.rows,
@@ -3025,7 +3153,7 @@ async function cloudPullGraphRAG(config) {
 }
 async function cloudPushTasks(config) {
   const client = getClient();
-  const result = await client.execute("SELECT * FROM tasks");
+  const result = await client.execute("SELECT * FROM tasks LIMIT 10000");
   const rows = result.rows;
   const { ok } = await cloudPushBlob(
     "/sync/push-tasks",
@@ -3071,7 +3199,7 @@ async function cloudPullTasks(config) {
 }
 async function cloudPushConversations(config) {
   const client = getClient();
-  const result = await client.execute("SELECT * FROM conversations");
+  const result = await client.execute("SELECT * FROM conversations LIMIT 50000");
   const rows = result.rows;
   const { ok } = await cloudPushBlob(
     "/sync/push-conversations",
@@ -3121,8 +3249,8 @@ async function cloudPullConversations(config) {
 async function cloudPushDocuments(config) {
   const client = getClient();
   const [workspaces, documents] = await Promise.all([
-    client.execute("SELECT * FROM workspaces"),
-    client.execute("SELECT * FROM documents")
+    client.execute("SELECT * FROM workspaces LIMIT 1000"),
+    client.execute("SELECT * FROM documents LIMIT 10000")
   ]);
   const blob = {
     workspaces: workspaces.rows,
@@ -3175,7 +3303,7 @@ async function cloudPullDocuments(config) {
   }
   return { pulled };
 }
-var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS;
+var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, ROSTER_DELETIONS_PATH;
 var init_cloud_sync = __esm({
   "src/lib/cloud-sync.ts"() {
     "use strict";
@@ -3188,6 +3316,68 @@ var init_cloud_sync = __esm({
     init_employees();
     LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
     FETCH_TIMEOUT_MS = 3e4;
+    PUSH_BATCH_SIZE = 5e3;
+    ROSTER_LOCK_PATH = path9.join(EXE_AI_DIR, "roster-merge.lock");
+    LOCK_STALE_MS = 3e4;
+    ROSTER_DELETIONS_PATH = path9.join(EXE_AI_DIR, "roster-deletions.json");
+  }
+});
+
+// src/lib/worker-gate.ts
+var worker_gate_exports = {};
+__export(worker_gate_exports, {
+  MAX_CONCURRENT_WORKERS: () => MAX_CONCURRENT_WORKERS,
+  cleanupWorkerPid: () => cleanupWorkerPid,
+  registerWorkerPid: () => registerWorkerPid,
+  tryAcquireWorkerSlot: () => tryAcquireWorkerSlot
+});
+import { readdirSync as readdirSync4, writeFileSync as writeFileSync3, unlinkSync as unlinkSync4, mkdirSync as mkdirSync4 } from "fs";
+import path10 from "path";
+function tryAcquireWorkerSlot() {
+  try {
+    mkdirSync4(WORKER_PID_DIR, { recursive: true });
+    const files = readdirSync4(WORKER_PID_DIR);
+    let alive = 0;
+    for (const f of files) {
+      if (!f.endsWith(".pid")) continue;
+      const dashIdx = f.lastIndexOf("-");
+      const pid = parseInt(f.slice(dashIdx + 1).replace(".pid", ""), 10);
+      if (isNaN(pid)) continue;
+      try {
+        process.kill(pid, 0);
+        alive++;
+      } catch {
+        try {
+          unlinkSync4(path10.join(WORKER_PID_DIR, f));
+        } catch {
+        }
+      }
+    }
+    return alive < MAX_CONCURRENT_WORKERS;
+  } catch {
+    return true;
+  }
+}
+function registerWorkerPid(pid) {
+  try {
+    mkdirSync4(WORKER_PID_DIR, { recursive: true });
+    writeFileSync3(path10.join(WORKER_PID_DIR, `worker-${pid}.pid`), String(pid));
+  } catch {
+  }
+}
+function cleanupWorkerPid() {
+  try {
+    unlinkSync4(path10.join(WORKER_PID_DIR, `worker-${process.pid}.pid`));
+  } catch {
+  }
+}
+var WORKER_PID_DIR, MAX_CONCURRENT_WORKERS;
+var init_worker_gate = __esm({
+  "src/lib/worker-gate.ts"() {
+    "use strict";
+    init_config();
+    WORKER_PID_DIR = path10.join(EXE_AI_DIR, "worker-pids");
+    MAX_CONCURRENT_WORKERS = 3;
   }
 });
 
@@ -3196,6 +3386,30 @@ init_memory();
 init_database();
 init_keychain();
 init_config();
+var INIT_MAX_RETRIES = 3;
+var INIT_RETRY_DELAY_MS = 1e3;
+function isBusyError2(err) {
+  if (err instanceof Error) {
+    const msg = err.message.toLowerCase();
+    return msg.includes("sqlite_busy") || msg.includes("database is locked");
+  }
+  return false;
+}
+async function retryOnBusy2(fn, label) {
+  for (let attempt = 0; attempt <= INIT_MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      if (!isBusyError2(err) || attempt === INIT_MAX_RETRIES) throw err;
+      process.stderr.write(
+        `[store] SQLITE_BUSY during ${label}, retry ${attempt + 1}/${INIT_MAX_RETRIES}
+`
+      );
+      await new Promise((r) => setTimeout(r, INIT_RETRY_DELAY_MS * (attempt + 1)));
+    }
+  }
+  throw new Error("unreachable");
+}
 var _pendingRecords = [];
 var _batchSize = 20;
 var _flushIntervalMs = 1e4;
@@ -3230,14 +3444,17 @@ async function initStore(options) {
     dbPath,
     encryptionKey: hexKey
   });
-  await ensureSchema();
+  await retryOnBusy2(() => ensureSchema(), "ensureSchema");
   try {
     const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
     initShardManager2(hexKey);
   } catch {
   }
   const client = getClient();
-  const vResult = await client.execute("SELECT MAX(version) as max_v FROM memories");
+  const vResult = await retryOnBusy2(
+    () => client.execute("SELECT MAX(version) as max_v FROM memories"),
+    "version-query"
+  );
   _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
 }
 function classifyTier(record) {
@@ -3280,6 +3497,12 @@ async function writeMemory(record) {
     supersedes_id: record.supersedes_id ?? null
   };
   _pendingRecords.push(dbRow);
+  const MAX_PENDING = 1e3;
+  if (_pendingRecords.length > MAX_PENDING) {
+    const dropped = _pendingRecords.length - MAX_PENDING;
+    _pendingRecords = _pendingRecords.slice(-MAX_PENDING);
+    console.warn(`[store] Dropped ${dropped} oldest pending records (overflow)`);
+  }
   if (_flushTimer === null) {
     _flushTimer = setInterval(() => {
       void flushBatch();
@@ -3436,10 +3659,10 @@ import crypto4 from "crypto";
 init_database();
 import crypto2 from "crypto";
 import path4 from "path";
-import os2 from "os";
+import os3 from "os";
 import {
   readFileSync as readFileSync2,
-  readdirSync,
+  readdirSync as readdirSync2,
   unlinkSync,
   existsSync as existsSync4,
   rmdirSync
@@ -3471,8 +3694,8 @@ async function writeNotification(notification) {
 
 // src/adapters/claude/hooks/summary-worker.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, openSync as openSync2, closeSync as closeSync2 } from "fs";
-import path10 from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, openSync as openSync2, closeSync as closeSync2 } from "fs";
+import path11 from "path";
 async function main() {
   const agentId = process.env.AGENT_ID ?? "default";
   const agentRole = process.env.AGENT_ROLE ?? "employee";
@@ -3596,16 +3819,16 @@ async function main() {
   }
   try {
     const { EXE_AI_DIR: EXE_AI_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-    const flagPath = path10.join(EXE_AI_DIR2, "session-cache", "needs-backfill");
+    const flagPath = path11.join(EXE_AI_DIR2, "session-cache", "needs-backfill");
     if (existsSync10(flagPath)) {
       const { spawn: spawn2 } = await import("child_process");
       const { fileURLToPath: fileURLToPath2 } = await import("url");
       const thisFile = fileURLToPath2(import.meta.url);
-      const backfillPath = path10.resolve(path10.dirname(thisFile), "backfill-vectors.js");
+      const backfillPath = path11.resolve(path11.dirname(thisFile), "backfill-vectors.js");
       if (existsSync10(backfillPath)) {
         const { EXE_AI_DIR: exeDir2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-        const bLogPath = path10.join(exeDir2, "workers.log");
-        mkdirSync4(path10.dirname(bLogPath), { recursive: true });
+        const bLogPath = path11.join(exeDir2, "workers.log");
+        mkdirSync5(path11.dirname(bLogPath), { recursive: true });
         const bLogFd = openSync2(bLogPath, "a");
         const child = spawn2(process.execPath, [backfillPath], {
           detached: true,
@@ -3678,9 +3901,19 @@ async function main() {
       process.stderr.write("[summary-worker] orphan scan failed: " + (err instanceof Error ? err.message : String(err)) + "\n");
     }
   }
+  try {
+    const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+    await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");
+  } catch {
+  }
 }
 main().catch((err) => {
   process.stderr.write("[summary-worker] FATAL: " + (err instanceof Error ? err.message : String(err)) + "\n");
-}).finally(() => {
+}).finally(async () => {
+  try {
+    const { cleanupWorkerPid: cleanupWorkerPid2 } = await Promise.resolve().then(() => (init_worker_gate(), worker_gate_exports));
+    cleanupWorkerPid2();
+  } catch {
+  }
   process.exit(0);
 });