@askexenow/exe-os 0.8.37 → 0.8.39

package/dist/bin/exe-boot.js

@@ -42,7 +42,7 @@ __export(config_exports, {
   migrateConfig: () => migrateConfig,
   saveConfig: () => saveConfig
 });
-import { readFile, writeFile, mkdir } from "fs/promises";
+import { readFile, writeFile, mkdir, chmod } from "fs/promises";
 import { readFileSync, existsSync, renameSync } from "fs";
 import path from "path";
 import os from "os";
@@ -168,6 +168,9 @@ async function saveConfig(config) {
   await mkdir(dir, { recursive: true });
   const configPath = path.join(dir, "config.json");
   await writeFile(configPath, JSON.stringify(config, null, 2) + "\n");
+  if (config.cloud?.apiKey) {
+    await chmod(configPath, 384);
+  }
 }
 async function loadConfigFrom(configPath) {
   const raw = await readFile(configPath, "utf-8");
@@ -306,15 +309,20 @@ function isMultiInstance(agentName, employees) {
   if (!emp) return false;
   return MULTI_INSTANCE_ROLES.has(emp.role.toLowerCase());
 }
+function findExeBin() {
+  try {
+    return execSync(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
+  } catch {
+    return null;
+  }
+}
 function registerBinSymlinks(name) {
   const created = [];
   const skipped = [];
   const errors = [];
-  let exeBinPath;
-  try {
-    exeBinPath = execSync("which exe", { encoding: "utf-8" }).trim();
-  } catch {
-    errors.push("Could not find 'exe' in PATH");
+  const exeBinPath = findExeBin();
+  if (!exeBinPath) {
+    errors.push("Could not find 'exe-os' in PATH");
     return { created, skipped, errors };
   }
   const binDir = path2.dirname(exeBinPath);
@@ -449,6 +457,7 @@ async function ensureSchema() {
   const client = getRawClient();
   await client.execute("PRAGMA journal_mode = WAL");
   await client.execute("PRAGMA busy_timeout = 30000");
+  await client.execute("PRAGMA wal_autocheckpoint = 1000");
   try {
     await client.execute("PRAGMA libsql_vector_search_ef = 128");
   } catch {
@@ -1257,12 +1266,13 @@ __export(keychain_exports, {
   importMnemonic: () => importMnemonic,
   setMasterKey: () => setMasterKey
 });
-import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 import path3 from "path";
+import os2 from "os";
 import crypto from "crypto";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path3.join(process.env.HOME ?? "/tmp", ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path3.join(os2.homedir(), ".exe-os");
 }
 function getKeyPath() {
   return path3.join(getKeyDir(), "master.key");
@@ -1310,7 +1320,7 @@ async function setMasterKey(key) {
   await mkdir3(dir, { recursive: true });
   const keyPath = getKeyPath();
   await writeFile3(keyPath, b64 + "\n", "utf-8");
-  await chmod(keyPath, 384);
+  await chmod2(keyPath, 384);
 }
 async function deleteMasterKey() {
   const keytar = await tryKeytar();
@@ -1408,7 +1418,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path4 from "path";
-import { existsSync as existsSync4, mkdirSync } from "fs";
+import { existsSync as existsSync4, mkdirSync, readdirSync } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -1447,8 +1457,7 @@ function shardExists(projectName) {
 }
 function listShards() {
   if (!existsSync4(SHARDS_DIR)) return [];
-  const { readdirSync: readdirSync7 } = __require("fs");
-  return readdirSync7(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
+  return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
   await client.execute("PRAGMA journal_mode = WAL");
@@ -1637,6 +1646,28 @@ var init_shard_manager = __esm({
 });
 
 // src/lib/store.ts
+function isBusyError2(err) {
+  if (err instanceof Error) {
+    const msg = err.message.toLowerCase();
+    return msg.includes("sqlite_busy") || msg.includes("database is locked");
+  }
+  return false;
+}
+async function retryOnBusy2(fn, label) {
+  for (let attempt = 0; attempt <= INIT_MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      if (!isBusyError2(err) || attempt === INIT_MAX_RETRIES) throw err;
+      process.stderr.write(
+        `[store] SQLITE_BUSY during ${label}, retry ${attempt + 1}/${INIT_MAX_RETRIES}
+`
+      );
+      await new Promise((r) => setTimeout(r, INIT_RETRY_DELAY_MS * (attempt + 1)));
+    }
+  }
+  throw new Error("unreachable");
+}
 async function initStore(options) {
   if (_flushTimer !== null) {
     clearInterval(_flushTimer);
@@ -1665,17 +1696,20 @@ async function initStore(options) {
     dbPath,
     encryptionKey: hexKey
   });
-  await ensureSchema();
+  await retryOnBusy2(() => ensureSchema(), "ensureSchema");
   try {
     const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
     initShardManager2(hexKey);
   } catch {
   }
   const client = getClient();
-  const vResult = await client.execute("SELECT MAX(version) as max_v FROM memories");
+  const vResult = await retryOnBusy2(
+    () => client.execute("SELECT MAX(version) as max_v FROM memories"),
+    "version-query"
+  );
   _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
 }
-var _pendingRecords, _batchSize, _flushIntervalMs, _flushTimer, _flushing, _nextVersion;
+var INIT_MAX_RETRIES, INIT_RETRY_DELAY_MS, _pendingRecords, _batchSize, _flushIntervalMs, _flushTimer, _flushing, _nextVersion;
 var init_store = __esm({
   "src/lib/store.ts"() {
     "use strict";
@@ -1683,6 +1717,8 @@ var init_store = __esm({
     init_database();
     init_keychain();
     init_config();
+    INIT_MAX_RETRIES = 3;
+    INIT_RETRY_DELAY_MS = 1e3;
     _pendingRecords = [];
     _batchSize = 20;
     _flushIntervalMs = 1e4;
@@ -1695,10 +1731,10 @@ var init_store = __esm({
 // src/lib/notifications.ts
 import crypto2 from "crypto";
 import path5 from "path";
-import os2 from "os";
+import os3 from "os";
 import {
   readFileSync as readFileSync3,
-  readdirSync,
+  readdirSync as readdirSync2,
   unlinkSync,
   existsSync as existsSync5,
   rmdirSync
@@ -1813,12 +1849,12 @@ async function markDoneTaskNotificationsAsRead() {
   }
 }
 async function migrateJsonNotifications() {
-  const base = process.env.EXE_OS_DIR || process.env.EXE_MEM_DIR || path5.join(os2.homedir(), ".exe-os");
+  const base = process.env.EXE_OS_DIR || process.env.EXE_MEM_DIR || path5.join(os3.homedir(), ".exe-os");
   const notifDir = path5.join(base, "notifications");
   if (!existsSync5(notifDir)) return 0;
   let migrated = 0;
   try {
-    const files = readdirSync(notifDir).filter((f) => f.endsWith(".json"));
+    const files = readdirSync2(notifDir).filter((f) => f.endsWith(".json"));
     if (files.length === 0) return 0;
     const client = getClient();
     for (const file of files) {
@@ -1846,7 +1882,7 @@ async function migrateJsonNotifications() {
       }
     }
     try {
-      const remaining = readdirSync(notifDir);
+      const remaining = readdirSync2(notifDir);
       if (remaining.length === 0) {
         rmdirSync(notifDir);
       }
@@ -1910,7 +1946,7 @@ __export(session_registry_exports, {
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3, existsSync as existsSync6 } from "fs";
 import { execSync as execSync4 } from "child_process";
 import path7 from "path";
-import os3 from "os";
+import os4 from "os";
 function registerSession(entry) {
   const dir = path7.dirname(REGISTRY_PATH);
   if (!existsSync6(dir)) {
@@ -1956,7 +1992,7 @@ var REGISTRY_PATH;
 var init_session_registry = __esm({
   "src/lib/session-registry.ts"() {
     "use strict";
-    REGISTRY_PATH = path7.join(os3.homedir(), ".exe-os", "session-registry.json");
+    REGISTRY_PATH = path7.join(os4.homedir(), ".exe-os", "session-registry.json");
   }
 });
 
@@ -2143,7 +2179,7 @@ var init_provider_table = __esm({
 // src/lib/intercom-queue.ts
 import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, renameSync as renameSync2, existsSync as existsSync7, mkdirSync as mkdirSync4 } from "fs";
 import path8 from "path";
-import os4 from "os";
+import os5 from "os";
 function ensureDir() {
   const dir = path8.dirname(QUEUE_PATH);
   if (!existsSync7(dir)) mkdirSync4(dir, { recursive: true });
@@ -2183,9 +2219,9 @@ var QUEUE_PATH, TTL_MS, INTERCOM_LOG;
 var init_intercom_queue = __esm({
   "src/lib/intercom-queue.ts"() {
     "use strict";
-    QUEUE_PATH = path8.join(os4.homedir(), ".exe-os", "intercom-queue.json");
+    QUEUE_PATH = path8.join(os5.homedir(), ".exe-os", "intercom-queue.json");
     TTL_MS = 60 * 60 * 1e3;
-    INTERCOM_LOG = path8.join(os4.homedir(), ".exe-os", "intercom.log");
+    INTERCOM_LOG = path8.join(os5.homedir(), ".exe-os", "intercom.log");
   }
 });
 
@@ -2202,12 +2238,22 @@ __export(license_exports, {
   loadLicense: () => loadLicense,
   mirrorLicenseKey: () => mirrorLicenseKey,
   saveLicense: () => saveLicense,
+  startLicenseRevalidation: () => startLicenseRevalidation,
+  stopLicenseRevalidation: () => stopLicenseRevalidation,
   validateLicense: () => validateLicense
 });
 import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync8, mkdirSync as mkdirSync5 } from "fs";
 import { randomUUID } from "crypto";
 import path9 from "path";
 import { jwtVerify, importSPKI } from "jose";
+async function fetchRetry(url, init) {
+  try {
+    return await fetch(url, init);
+  } catch {
+    await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
+    return fetch(url, { ...init, signal: AbortSignal.timeout(1e4) });
+  }
+}
 function loadDeviceId() {
   const deviceJsonPath = path9.join(EXE_AI_DIR, "device.json");
   try {
@@ -2239,7 +2285,7 @@ function loadLicense() {
 }
 function saveLicense(apiKey) {
   mkdirSync5(EXE_AI_DIR, { recursive: true });
-  writeFileSync4(LICENSE_PATH, apiKey.trim(), "utf8");
+  writeFileSync4(LICENSE_PATH, apiKey.trim(), { encoding: "utf8", mode: 384 });
 }
 async function verifyLicenseJwt(token) {
   try {
@@ -2291,7 +2337,7 @@ function cacheResponse(token) {
 async function validateLicense(apiKey, deviceId) {
   const did = deviceId ?? loadDeviceId();
   try {
-    const res = await fetch(`${API_BASE}/auth/activate`, {
+    const res = await fetchRetry(`${API_BASE}/auth/activate`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ apiKey, deviceId: did }),
@@ -2326,14 +2372,23 @@ async function validateLicense(apiKey, deviceId) {
   } catch {
     const cached = await getCachedLicense();
     if (cached) return cached;
-    return FREE_LICENSE;
+    return { ...FREE_LICENSE, valid: false, error: "offline" };
+  }
+}
+function getCacheAgeMs() {
+  try {
+    const { statSync: statSync2 } = __require("fs");
+    const s = statSync2(CACHE_PATH);
+    return Date.now() - s.mtimeMs;
+  } catch {
+    return Infinity;
   }
 }
 async function checkLicense() {
   const key = loadLicense();
   if (!key) return FREE_LICENSE;
   const cached = await getCachedLicense();
-  if (cached) return cached;
+  if (cached && getCacheAgeMs() < CACHE_MAX_AGE_MS) return cached;
   const deviceId = loadDeviceId();
   return validateLicense(key, deviceId);
 }
@@ -2373,7 +2428,7 @@ async function assertVpsLicense(opts) {
   let explicitRejection = false;
   let transientFailure = false;
   try {
-    const res = await fetch(`${API_BASE}/auth/activate`, {
+    const res = await fetchRetry(`${API_BASE}/auth/activate`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ apiKey, deviceId }),
@@ -2454,7 +2509,28 @@ async function assertVpsLicense(opts) {
     `License validation unreachable for more than ${graceDays} days. Restore network connectivity to https://askexe.com/cloud and retry. This VPS image refuses to boot after the offline grace window.`
   );
 }
-var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, API_BASE, LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG, PLAN_LIMITS, FREE_LICENSE;
+function startLicenseRevalidation(intervalMs = 36e5) {
+  if (_revalTimer) return;
+  _revalTimer = setInterval(async () => {
+    try {
+      const license = await checkLicense();
+      if (!license.valid) {
+        process.stderr.write("[exe-os] License expired or invalid \u2014 features may be restricted\n");
+      }
+    } catch {
+    }
+  }, intervalMs);
+  if (_revalTimer && typeof _revalTimer === "object" && "unref" in _revalTimer) {
+    _revalTimer.unref();
+  }
+}
+function stopLicenseRevalidation() {
+  if (_revalTimer) {
+    clearInterval(_revalTimer);
+    _revalTimer = null;
+  }
+}
+var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, API_BASE, RETRY_DELAY_MS, LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG, PLAN_LIMITS, FREE_LICENSE, CACHE_MAX_AGE_MS, _revalTimer;
 var init_license = __esm({
   "src/lib/license.ts"() {
     "use strict";
@@ -2463,6 +2539,7 @@ var init_license = __esm({
     CACHE_PATH = path9.join(EXE_AI_DIR, "license-cache.json");
     DEVICE_ID_PATH = path9.join(EXE_AI_DIR, "device-id");
     API_BASE = "https://askexe.com/cloud";
+    RETRY_DELAY_MS = 500;
     LICENSE_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
 4uj+UqeKCcvtgNHKmOK278HJaJcANe9xAeji8AFYu27q3WtzCi04pHudow==
@@ -2484,6 +2561,8 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
       employeeLimit: 1,
       memoryLimit: 5e3
     };
+    CACHE_MAX_AGE_MS = 36e5;
+    _revalTimer = null;
   }
 });
 
@@ -2577,7 +2656,7 @@ var init_plan_limits = __esm({
 import { execFileSync as execFileSync2, execSync as execSync6 } from "child_process";
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6, existsSync as existsSync10, appendFileSync } from "fs";
 import path11 from "path";
-import os5 from "os";
+import os6 from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { unlinkSync as unlinkSync3 } from "fs";
 function spawnLockPath(sessionName) {
@@ -2882,7 +2961,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   const transport = getTransport();
   const sessionName = employeeSessionName(employeeName, exeSession, opts?.instance);
   const instanceLabel = opts?.instance != null && opts.instance > 0 ? `${employeeName}${opts.instance}` : employeeName;
-  const logDir = path11.join(os5.homedir(), ".exe-os", "session-logs");
+  const logDir = path11.join(os6.homedir(), ".exe-os", "session-logs");
   const logFile = path11.join(logDir, `${instanceLabel}-${Date.now()}.log`);
   if (!existsSync10(logDir)) {
     mkdirSync6(logDir, { recursive: true });
@@ -2898,7 +2977,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   } catch {
   }
   try {
-    const claudeJsonPath = path11.join(os5.homedir(), ".claude.json");
+    const claudeJsonPath = path11.join(os6.homedir(), ".claude.json");
     let claudeJson = {};
     try {
       claudeJson = JSON.parse(readFileSync9(claudeJsonPath, "utf8"));
@@ -2913,7 +2992,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   } catch {
   }
   try {
-    const settingsDir = path11.join(os5.homedir(), ".claude", "projects");
+    const settingsDir = path11.join(os6.homedir(), ".claude", "projects");
     const normalizedKey = (opts?.cwd ?? projectDir).replace(/\//g, "-").replace(/^-/, "");
     const projSettingsDir = path11.join(settingsDir, normalizedKey);
     const settingsPath = path11.join(projSettingsDir, "settings.json");
@@ -2961,7 +3040,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   let legacyFallbackWarned = false;
   if (!useExeAgent && !useBinSymlink) {
     const identityPath = path11.join(
-      os5.homedir(),
+      os6.homedir(),
       ".exe-os",
       "identity",
       `${employeeName}.md`
@@ -2991,7 +3070,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   }
   let sessionContextFlag = "";
   try {
-    const ctxDir = path11.join(os5.homedir(), ".exe-os", "session-cache");
+    const ctxDir = path11.join(os6.homedir(), ".exe-os", "session-cache");
     mkdirSync6(ctxDir, { recursive: true });
     const ctxFile = path11.join(ctxDir, `session-context-${sessionName}.md`);
     const ctxContent = [
@@ -3102,11 +3181,11 @@ var init_tmux_routing = __esm({
     init_provider_table();
     init_intercom_queue();
     init_plan_limits();
-    SPAWN_LOCK_DIR = path11.join(os5.homedir(), ".exe-os", "spawn-locks");
-    SESSION_CACHE = path11.join(os5.homedir(), ".exe-os", "session-cache");
+    SPAWN_LOCK_DIR = path11.join(os6.homedir(), ".exe-os", "spawn-locks");
+    SESSION_CACHE = path11.join(os6.homedir(), ".exe-os", "session-cache");
     BEHAVIORS_EXPORT_TIMEOUT_MS = 1e4;
     INTERCOM_DEBOUNCE_MS = 3e4;
-    INTERCOM_LOG2 = path11.join(os5.homedir(), ".exe-os", "intercom.log");
+    INTERCOM_LOG2 = path11.join(os6.homedir(), ".exe-os", "intercom.log");
     DEBOUNCE_FILE = path11.join(SESSION_CACHE, "intercom-debounce.json");
     DEBOUNCE_CLEANUP_AGE_MS = 5 * 60 * 1e3;
     BUSY_PATTERN = /[✻✽✶✳·].*…|Running…/;
@@ -3124,7 +3203,7 @@ __export(task_scanner_exports, {
   formatText: () => formatText,
   scanAgentTasks: () => scanAgentTasks
 });
-import { readdirSync as readdirSync3, readFileSync as readFileSync10, existsSync as existsSync11, statSync } from "fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync10, existsSync as existsSync11, statSync } from "fs";
 import { execSync as execSync7 } from "child_process";
 import path12 from "path";
 function getProjectRoot() {
@@ -3146,7 +3225,7 @@ function scanAgentTasks(agentId) {
   let total = 0;
   if (!existsSync11(taskDir)) return { open, inProgress, done, total };
   try {
-    const files = readdirSync3(taskDir).filter((f) => f.endsWith(".md"));
+    const files = readdirSync4(taskDir).filter((f) => f.endsWith(".md"));
     total = files.length;
     for (const f of files) {
       try {
@@ -3702,7 +3781,7 @@ var init_tasks_crud = __esm({
 
 // src/lib/tasks-review.ts
 import path15 from "path";
-import { existsSync as existsSync13, readdirSync as readdirSync4, unlinkSync as unlinkSync4 } from "fs";
+import { existsSync as existsSync13, readdirSync as readdirSync5, unlinkSync as unlinkSync4 } from "fs";
 async function countPendingReviews() {
   const client = getClient();
   const result = await client.execute({
@@ -3824,7 +3903,7 @@ async function cleanupReviewFile(row, taskFile, _baseDir) {
   try {
     const cacheDir = path15.join(EXE_AI_DIR, "session-cache");
     if (existsSync13(cacheDir)) {
-      for (const f of readdirSync4(cacheDir)) {
+      for (const f of readdirSync5(cacheDir)) {
         if (f.startsWith("review-notified-")) {
           unlinkSync4(path15.join(cacheDir, f));
         }
@@ -4707,6 +4786,7 @@ var init_compress = __esm({
 // src/lib/cloud-sync.ts
 var cloud_sync_exports = {};
 __export(cloud_sync_exports, {
+  assertSecureEndpoint: () => assertSecureEndpoint,
   buildRosterBlob: () => buildRosterBlob,
   cloudPull: () => cloudPull,
   cloudPullBehaviors: () => cloudPullBehaviors,
@@ -4726,9 +4806,10 @@ __export(cloud_sync_exports, {
   cloudPushTasks: () => cloudPushTasks,
   cloudSync: () => cloudSync,
   mergeConfig: () => mergeConfig,
-  mergeRosterFromRemote: () => mergeRosterFromRemote
+  mergeRosterFromRemote: () => mergeRosterFromRemote,
+  recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync7, existsSync as existsSync14, readdirSync as readdirSync5, mkdirSync as mkdirSync8, appendFileSync as appendFileSync2 } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync7, existsSync as existsSync14, readdirSync as readdirSync6, mkdirSync as mkdirSync8, appendFileSync as appendFileSync2, unlinkSync as unlinkSync6 } from "fs";
 import path18 from "path";
 import { homedir } from "os";
 function logError(msg) {
@@ -4739,16 +4820,47 @@ function logError(msg) {
   } catch {
   }
 }
+async function withRosterLock(fn) {
+  if (existsSync14(ROSTER_LOCK_PATH)) {
+    try {
+      const ts = parseInt(readFileSync12(ROSTER_LOCK_PATH, "utf-8"), 10);
+      if (Date.now() - ts < LOCK_STALE_MS) {
+        throw new Error("Roster merge already in progress \u2014 another sync is running");
+      }
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("already in progress")) throw err;
+    }
+  }
+  writeFileSync7(ROSTER_LOCK_PATH, String(Date.now()));
+  try {
+    return await fn();
+  } finally {
+    try {
+      unlinkSync6(ROSTER_LOCK_PATH);
+    } catch {
+    }
+  }
+}
 async function fetchWithRetry(url, init) {
-  const attempt = async () => {
-    const signal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
-    return fetch(url, { ...init, signal });
-  };
-  const resp = await attempt();
-  if (resp.status >= 500) {
-    return attempt();
+  const MAX_RETRIES2 = 3;
+  const BASE_DELAY_MS2 = 200;
+  let lastError;
+  for (let attempt = 0; attempt <= MAX_RETRIES2; attempt++) {
+    try {
+      const signal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
+      const resp = await fetch(url, { ...init, signal });
+      if (resp.status >= 500 && attempt < MAX_RETRIES2) {
+        await new Promise((r) => setTimeout(r, BASE_DELAY_MS2 * Math.pow(2, attempt)));
+        continue;
+      }
+      return resp;
+    } catch (err) {
+      lastError = err;
+      if (attempt === MAX_RETRIES2) throw err;
+      await new Promise((r) => setTimeout(r, BASE_DELAY_MS2 * Math.pow(2, attempt)));
+    }
   }
-  return resp;
+  throw lastError;
 }
 function assertSecureEndpoint(endpoint) {
   if (endpoint.startsWith("https://")) return;
@@ -4776,10 +4888,15 @@ async function cloudPush(records, maxVersion, config) {
       headers: {
         Authorization: `Bearer ${config.apiKey}`,
         "Content-Type": "application/json",
-        "X-Device-Id": loadDeviceId()
+        "X-Device-Id": loadDeviceId(),
+        "X-Expected-Version": String(maxVersion)
       },
       body: JSON.stringify({ version: maxVersion, blob })
     });
+    if (resp.status === 409) {
+      logError("[cloud-sync] PUSH VERSION CONFLICT \u2014 re-pull required before next push");
+      return false;
+    }
     return resp.ok;
   } catch (err) {
     logError(`[cloud-sync] PUSH FAILED: ${err instanceof Error ? err.message : String(err)}`);
@@ -4866,18 +4983,21 @@ async function cloudSync(config) {
     "SELECT value FROM sync_meta WHERE key = 'last_cloud_push_version'"
   );
   const lastPushVersion = pushMeta.rows.length > 0 ? Number(pushMeta.rows[0].value) : 0;
-  const recordsResult = await client.execute({
-    sql: `SELECT id, agent_id, agent_role, session_id, timestamp,
-                 tool_name, project_name, has_error, raw_text, version,
-                 author_device_id, scope
-          FROM memories
-          WHERE version > ?
-            AND (scope IS NULL OR scope != 'personal')
-          ORDER BY version ASC`,
-    args: [lastPushVersion]
-  });
   let pushed = 0;
-  if (recordsResult.rows.length > 0) {
+  let batchCursor = lastPushVersion;
+  while (true) {
+    const recordsResult = await client.execute({
+      sql: `SELECT id, agent_id, agent_role, session_id, timestamp,
+                   tool_name, project_name, has_error, raw_text, version,
+                   author_device_id, scope
+            FROM memories
+            WHERE version > ?
+              AND (scope IS NULL OR scope != 'personal')
+            ORDER BY version ASC
+            LIMIT ?`,
+      args: [batchCursor, PUSH_BATCH_SIZE]
+    });
+    if (recordsResult.rows.length === 0) break;
     const records = recordsResult.rows.map((row) => ({
       id: row.id,
       agent_id: row.agent_id,
@@ -4894,13 +5014,14 @@ async function cloudSync(config) {
     }));
     const maxVersion = Number(records[records.length - 1].version);
     const pushOk = await cloudPush(records, maxVersion, config);
-    if (pushOk) {
-      await client.execute({
-        sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_push_version', ?)",
-        args: [String(maxVersion)]
-      });
-      pushed = records.length;
-    }
+    if (!pushOk) break;
+    await client.execute({
+      sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_push_version', ?)",
+      args: [String(maxVersion)]
+    });
+    pushed += records.length;
+    batchCursor = maxVersion;
+    if (recordsResult.rows.length < PUSH_BATCH_SIZE) break;
   }
   try {
     await cloudPushRoster(config);
@@ -4982,6 +5103,27 @@ async function cloudSync(config) {
     documents: documentsResult
   };
 }
+function recordRosterDeletion(name) {
+  let deletions = [];
+  try {
+    if (existsSync14(ROSTER_DELETIONS_PATH)) {
+      deletions = JSON.parse(readFileSync12(ROSTER_DELETIONS_PATH, "utf-8"));
+    }
+  } catch {
+  }
+  if (!deletions.includes(name)) deletions.push(name);
+  writeFileSync7(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
+}
+function consumeRosterDeletions() {
+  try {
+    if (!existsSync14(ROSTER_DELETIONS_PATH)) return [];
+    const deletions = JSON.parse(readFileSync12(ROSTER_DELETIONS_PATH, "utf-8"));
+    writeFileSync7(ROSTER_DELETIONS_PATH, "[]");
+    return deletions;
+  } catch {
+    return [];
+  }
+}
 function buildRosterBlob(paths) {
   const rosterPath = paths?.rosterPath ?? path18.join(EXE_AI_DIR, "exe-employees.json");
   const identityDir = paths?.identityDir ?? path18.join(EXE_AI_DIR, "identity");
@@ -4995,7 +5137,7 @@ function buildRosterBlob(paths) {
   }
   const identities = {};
   if (existsSync14(identityDir)) {
-    for (const file of readdirSync5(identityDir).filter((f) => f.endsWith(".md"))) {
+    for (const file of readdirSync6(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
         identities[file] = readFileSync12(path18.join(identityDir, file), "utf-8");
       } catch {
@@ -5009,9 +5151,10 @@ function buildRosterBlob(paths) {
     } catch {
     }
   }
-  const content = JSON.stringify({ roster, identities, config });
+  const deletedNames = consumeRosterDeletions();
+  const content = JSON.stringify({ roster, identities, config, deletedNames });
   const hash = Buffer.from(content).length;
-  return { roster, identities, config, version: hash };
+  return { roster, identities, config, deletedNames, version: hash };
 }
 async function cloudPushRoster(config) {
   assertSecureEndpoint(config.endpoint);
@@ -5094,38 +5237,50 @@ function mergeConfig(remoteConfig, configPath) {
   writeFileSync7(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
 }
 async function mergeRosterFromRemote(remote, paths) {
-  const rosterPath = paths?.rosterPath ?? void 0;
-  const identityDir = paths?.identityDir ?? path18.join(EXE_AI_DIR, "identity");
-  const localEmployees = await loadEmployees(rosterPath);
-  const localNames = new Set(localEmployees.map((e) => e.name));
-  let added = 0;
-  for (const remoteEmp of remote.roster) {
-    if (localNames.has(remoteEmp.name)) continue;
-    localEmployees.push(remoteEmp);
-    localNames.add(remoteEmp.name);
-    added++;
-    if (remote.identities[`${remoteEmp.name}.md`]) {
-      if (!existsSync14(identityDir)) mkdirSync8(identityDir, { recursive: true });
-      const idPath = path18.join(identityDir, `${remoteEmp.name}.md`);
-      if (!existsSync14(idPath)) {
-        writeFileSync7(idPath, remote.identities[`${remoteEmp.name}.md`], "utf-8");
+  return withRosterLock(async () => {
+    const rosterPath = paths?.rosterPath ?? void 0;
+    const identityDir = paths?.identityDir ?? path18.join(EXE_AI_DIR, "identity");
+    const localEmployees = await loadEmployees(rosterPath);
+    const localNames = new Set(localEmployees.map((e) => e.name));
+    let added = 0;
+    for (const remoteEmp of remote.roster) {
+      if (localNames.has(remoteEmp.name)) continue;
+      localEmployees.push(remoteEmp);
+      localNames.add(remoteEmp.name);
+      added++;
+      if (remote.identities[`${remoteEmp.name}.md`]) {
+        if (!existsSync14(identityDir)) mkdirSync8(identityDir, { recursive: true });
+        const idPath = path18.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync14(idPath)) {
+          writeFileSync7(idPath, remote.identities[`${remoteEmp.name}.md`], "utf-8");
+        }
+      }
+      try {
+        registerBinSymlinks(remoteEmp.name);
+      } catch {
       }
     }
-    try {
-      registerBinSymlinks(remoteEmp.name);
-    } catch {
+    let removed = 0;
+    if (remote.deletedNames && remote.deletedNames.length > 0) {
+      const toRemove = new Set(remote.deletedNames);
+      const filtered = localEmployees.filter((e) => !toRemove.has(e.name));
+      removed = localEmployees.length - filtered.length;
+      if (removed > 0) {
+        localEmployees.length = 0;
+        localEmployees.push(...filtered);
+      }
     }
-  }
-  if (added > 0) {
-    await saveEmployees(localEmployees, rosterPath);
-  }
-  if (remote.config && Object.keys(remote.config).length > 0) {
-    try {
-      mergeConfig(remote.config, paths?.configPath);
-    } catch {
+    if (added > 0 || removed > 0) {
+      await saveEmployees(localEmployees, rosterPath);
     }
-  }
-  return { added };
+    if (remote.config && Object.keys(remote.config).length > 0) {
+      try {
+        mergeConfig(remote.config, paths?.configPath);
+      } catch {
+      }
+    }
+    return { added };
+  });
 }
 async function cloudPushBlob(route, data, metaKey, config) {
   if (data.length === 0) return { ok: true };
@@ -5193,7 +5348,7 @@ async function cloudPullBlob(route, config) {
 }
 async function cloudPushBehaviors(config) {
   const client = getClient();
-  const result = await client.execute("SELECT * FROM behaviors");
+  const result = await client.execute("SELECT * FROM behaviors LIMIT 10000");
   const rows = result.rows;
   const { ok } = await cloudPushBlob(
     "/sync/push-behaviors",
@@ -5241,13 +5396,13 @@ async function cloudPullBehaviors(config) {
 async function cloudPushGraphRAG(config) {
   const client = getClient();
   const [entities, relationships, aliases, entityMems, relMems, hyperedges, hyperedgeNodes] = await Promise.all([
-    client.execute("SELECT * FROM entities"),
-    client.execute("SELECT * FROM relationships"),
-    client.execute("SELECT * FROM entity_aliases"),
-    client.execute("SELECT * FROM entity_memories"),
-    client.execute("SELECT * FROM relationship_memories"),
-    client.execute("SELECT * FROM hyperedges"),
-    client.execute("SELECT * FROM hyperedge_nodes")
+    client.execute("SELECT * FROM entities LIMIT 50000"),
+    client.execute("SELECT * FROM relationships LIMIT 50000"),
+    client.execute("SELECT * FROM entity_aliases LIMIT 50000"),
+    client.execute("SELECT * FROM entity_memories LIMIT 50000"),
+    client.execute("SELECT * FROM relationship_memories LIMIT 50000"),
+    client.execute("SELECT * FROM hyperedges LIMIT 50000"),
+    client.execute("SELECT * FROM hyperedge_nodes LIMIT 50000")
   ]);
   const blob = {
     entities: entities.rows,
@@ -5349,7 +5504,7 @@ async function cloudPullGraphRAG(config) {
 }
 async function cloudPushTasks(config) {
   const client = getClient();
-  const result = await client.execute("SELECT * FROM tasks");
+  const result = await client.execute("SELECT * FROM tasks LIMIT 10000");
   const rows = result.rows;
   const { ok } = await cloudPushBlob(
     "/sync/push-tasks",
@@ -5395,7 +5550,7 @@ async function cloudPullTasks(config) {
 }
 async function cloudPushConversations(config) {
   const client = getClient();
-  const result = await client.execute("SELECT * FROM conversations");
+  const result = await client.execute("SELECT * FROM conversations LIMIT 50000");
   const rows = result.rows;
   const { ok } = await cloudPushBlob(
     "/sync/push-conversations",
@@ -5445,8 +5600,8 @@ async function cloudPullConversations(config) {
 async function cloudPushDocuments(config) {
   const client = getClient();
   const [workspaces, documents] = await Promise.all([
-    client.execute("SELECT * FROM workspaces"),
-    client.execute("SELECT * FROM documents")
+    client.execute("SELECT * FROM workspaces LIMIT 1000"),
+    client.execute("SELECT * FROM documents LIMIT 10000")
   ]);
   const blob = {
     workspaces: workspaces.rows,
@@ -5499,7 +5654,7 @@ async function cloudPullDocuments(config) {
   }
   return { pulled };
 }
-var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS;
+var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, ROSTER_DELETIONS_PATH;
 var init_cloud_sync = __esm({
   "src/lib/cloud-sync.ts"() {
     "use strict";
@@ -5512,6 +5667,10 @@ var init_cloud_sync = __esm({
     init_employees();
     LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
     FETCH_TIMEOUT_MS = 3e4;
+    PUSH_BATCH_SIZE = 5e3;
+    ROSTER_LOCK_PATH = path18.join(EXE_AI_DIR, "roster-merge.lock");
+    LOCK_STALE_MS = 3e4;
+    ROSTER_DELETIONS_PATH = path18.join(EXE_AI_DIR, "roster-deletions.json");
   }
 });
 
@@ -5695,8 +5854,8 @@ var init_schedules = __esm({
 init_employees();
 import path19 from "path";
 import { mkdir as mkdir5, writeFile as writeFile6 } from "fs/promises";
-import { existsSync as existsSync15, readFileSync as readFileSync13, readdirSync as readdirSync6, unlinkSync as unlinkSync6 } from "fs";
-import os6 from "os";
+import { existsSync as existsSync15, readFileSync as readFileSync13, readdirSync as readdirSync7, unlinkSync as unlinkSync7 } from "fs";
+import os7 from "os";
 
 // src/lib/employee-templates.ts
 var DEFAULT_EXE = {
@@ -6034,7 +6193,7 @@ init_notifications();
 
 // src/adapters/claude/active-agent.ts
 init_config();
-import { readFileSync as readFileSync4, writeFileSync, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2, readdirSync as readdirSync2 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2, readdirSync as readdirSync3 } from "fs";
 import { execSync as execSync3 } from "child_process";
 import path6 from "path";
 
@@ -6144,18 +6303,18 @@ async function boot(options) {
     } catch {
     }
     try {
-      const { readdirSync: readdirSync7, readFileSync: readFs } = await import("fs");
+      const { readdirSync: readdirSync8, readFileSync: readFs } = await import("fs");
       const { STATUS_RE: STATUS_RE2, PRIORITY_RE: PRIORITY_RE2, TITLE_RE: TITLE_RE2 } = await Promise.resolve().then(() => (init_task_scanner(), task_scanner_exports));
       const { getProjectName: getProjectName2 } = await Promise.resolve().then(() => (init_project_name(), project_name_exports));
       const exeDir = "exe";
-      const entries = readdirSync7(exeDir, { withFileTypes: true });
+      const entries = readdirSync8(exeDir, { withFileTypes: true });
       const employeeDirs = entries.filter((e) => e.isDirectory() && !["output", "research"].includes(e.name));
       for (const dir of employeeDirs) {
         const employee = dir.name;
         const taskDir = path19.join(exeDir, employee);
         let files;
         try {
-          files = readdirSync7(taskDir).filter((f) => f.endsWith(".md"));
+          files = readdirSync8(taskDir).filter((f) => f.endsWith(".md"));
         } catch {
           continue;
         }
@@ -6249,10 +6408,10 @@ async function boot(options) {
     try {
       const exeExeDir = path19.join(process.cwd(), "exe", "exe");
       if (existsSync15(exeExeDir)) {
-        for (const f of readdirSync6(exeExeDir)) {
+        for (const f of readdirSync7(exeExeDir)) {
           if (f.startsWith("review-") && f.endsWith(".md")) {
             try {
-              unlinkSync6(path19.join(exeExeDir, f));
+              unlinkSync7(path19.join(exeExeDir, f));
             } catch {
             }
           }
@@ -6762,7 +6921,7 @@ async function boot(options) {
   ]);
   try {
     const configPath = path19.join(
-      process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path19.join(os6.homedir(), ".exe-os"),
+      process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path19.join(os7.homedir(), ".exe-os"),
       "config.json"
     );
     if (existsSync15(configPath)) {
@@ -6854,8 +7013,8 @@ async function boot(options) {
       try {
         const flagPath = path19.join(EXE_AI_DIR, "session-cache", "needs-backfill");
         if (existsSync15(flagPath)) {
-          const { unlinkSync: unlinkSync7 } = await import("fs");
-          unlinkSync7(flagPath);
+          const { unlinkSync: unlinkSync8 } = await import("fs");
+          unlinkSync8(flagPath);
         }
       } catch {
       }
@@ -6956,7 +7115,7 @@ ${brief}`;
   console.log(brief);
   try {
     const configPath2 = path19.join(
-      process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path19.join(os6.homedir(), ".exe-os"),
+      process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path19.join(os7.homedir(), ".exe-os"),
       "config.json"
     );
     if (existsSync15(configPath2)) {