@askexenow/exe-os 0.8.38 → 0.8.39

package/dist/index.js

@@ -461,6 +461,7 @@ async function ensureSchema() {
   const client = getRawClient();
   await client.execute("PRAGMA journal_mode = WAL");
   await client.execute("PRAGMA busy_timeout = 30000");
+  await client.execute("PRAGMA wal_autocheckpoint = 1000");
   try {
     await client.execute("PRAGMA libsql_vector_search_ef = 128");
   } catch {
@@ -1284,7 +1285,7 @@ __export(config_exports, {
   migrateConfig: () => migrateConfig,
   saveConfig: () => saveConfig
 });
-import { readFile, writeFile, mkdir } from "fs/promises";
+import { readFile, writeFile, mkdir, chmod } from "fs/promises";
 import { readFileSync as readFileSync3, existsSync as existsSync3, renameSync as renameSync2 } from "fs";
 import path4 from "path";
 import os4 from "os";
@@ -1410,6 +1411,9 @@ async function saveConfig(config2) {
   await mkdir(dir, { recursive: true });
   const configPath = path4.join(dir, "config.json");
   await writeFile(configPath, JSON.stringify(config2, null, 2) + "\n");
+  if (config2.cloud?.apiKey) {
+    await chmod(configPath, 384);
+  }
 }
 async function loadConfigFrom(configPath) {
   const raw = await readFile(configPath, "utf-8");
@@ -3958,12 +3962,13 @@ var init_memory = __esm({
 });
 
 // src/lib/keychain.ts
-import { readFile as readFile4, writeFile as writeFile5, unlink, mkdir as mkdir4, chmod } from "fs/promises";
+import { readFile as readFile4, writeFile as writeFile5, unlink, mkdir as mkdir4, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
 import path15 from "path";
+import os7 from "os";
 import crypto6 from "crypto";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path15.join(process.env.HOME ?? "/tmp", ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path15.join(os7.homedir(), ".exe-os");
 }
 function getKeyPath() {
   return path15.join(getKeyDir(), "master.key");
@@ -4264,6 +4269,28 @@ __export(store_exports, {
   vectorToBlob: () => vectorToBlob,
   writeMemory: () => writeMemory
 });
+function isBusyError2(err) {
+  if (err instanceof Error) {
+    const msg = err.message.toLowerCase();
+    return msg.includes("sqlite_busy") || msg.includes("database is locked");
+  }
+  return false;
+}
+async function retryOnBusy2(fn, label) {
+  for (let attempt = 0; attempt <= INIT_MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      if (!isBusyError2(err) || attempt === INIT_MAX_RETRIES) throw err;
+      process.stderr.write(
+        `[store] SQLITE_BUSY during ${label}, retry ${attempt + 1}/${INIT_MAX_RETRIES}
+`
+      );
+      await new Promise((r) => setTimeout(r, INIT_RETRY_DELAY_MS * (attempt + 1)));
+    }
+  }
+  throw new Error("unreachable");
+}
 async function initStore(options) {
   if (_flushTimer !== null) {
     clearInterval(_flushTimer);
@@ -4292,14 +4319,17 @@ async function initStore(options) {
     dbPath,
     encryptionKey: hexKey
   });
-  await ensureSchema();
+  await retryOnBusy2(() => ensureSchema(), "ensureSchema");
   try {
     const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
     initShardManager2(hexKey);
   } catch {
   }
   const client = getClient();
-  const vResult = await client.execute("SELECT MAX(version) as max_v FROM memories");
+  const vResult = await retryOnBusy2(
+    () => client.execute("SELECT MAX(version) as max_v FROM memories"),
+    "version-query"
+  );
   _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
 }
 function classifyTier(record) {
@@ -4679,7 +4709,7 @@ async function getMemoryCardinality(agentId) {
     return 0;
   }
 }
-var _pendingRecords, _batchSize, _flushIntervalMs, _flushTimer, _flushing, _nextVersion;
+var INIT_MAX_RETRIES, INIT_RETRY_DELAY_MS, _pendingRecords, _batchSize, _flushIntervalMs, _flushTimer, _flushing, _nextVersion;
 var init_store = __esm({
   "src/lib/store.ts"() {
     "use strict";
@@ -4687,6 +4717,8 @@ var init_store = __esm({
     init_database();
     init_keychain();
     init_config();
+    INIT_MAX_RETRIES = 3;
+    INIT_RETRY_DELAY_MS = 1e3;
     _pendingRecords = [];
     _batchSize = 20;
     _flushIntervalMs = 1e4;
@@ -5079,7 +5111,8 @@ async function gqlRequest(query, variables) {
       "Content-Type": "application/json",
       Authorization: `Bearer ${config.apiToken}`
     },
-    body: JSON.stringify({ query, variables })
+    body: JSON.stringify({ query, variables }),
+    signal: AbortSignal.timeout(3e4)
   });
   if (!res.ok) {
     throw new Error(`CRM GraphQL request failed: ${res.status} ${res.statusText}`);
@@ -5307,6 +5340,10 @@ import path17 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function handleData(chunk) {
   _buffer += chunk.toString();
+  if (_buffer.length > MAX_BUFFER) {
+    _buffer = "";
+    return;
+  }
   let newlineIdx;
   while ((newlineIdx = _buffer.indexOf("\n")) !== -1) {
     const line = _buffer.slice(0, newlineIdx).trim();
@@ -5614,7 +5651,7 @@ function disconnectClient() {
     entry.resolve({ error: "Client disconnected" });
   }
 }
-var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, _socket, _connected, _buffer, _requestCount, HEALTH_CHECK_INTERVAL, _pending;
+var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, _socket, _connected, _buffer, _requestCount, HEALTH_CHECK_INTERVAL, _pending, MAX_BUFFER;
 var init_exe_daemon_client = __esm({
   "src/lib/exe-daemon-client.ts"() {
     "use strict";
@@ -5631,6 +5668,7 @@ var init_exe_daemon_client = __esm({
     _requestCount = 0;
     HEALTH_CHECK_INTERVAL = 100;
     _pending = /* @__PURE__ */ new Map();
+    MAX_BUFFER = 1e7;
   }
 });
 
@@ -5720,12 +5758,30 @@ async function wikiFetch(config2, path20, method = "GET", body) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS2);
   try {
-    const response = await fetch(url, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : void 0,
-      signal: controller.signal
-    });
+    let response;
+    try {
+      response = await fetch(url, {
+        method,
+        headers,
+        body: body ? JSON.stringify(body) : void 0,
+        signal: controller.signal
+      });
+    } catch {
+      clearTimeout(timeout);
+      const retryController = new AbortController();
+      const retryTimeout = setTimeout(() => retryController.abort(), REQUEST_TIMEOUT_MS2);
+      try {
+        await new Promise((r) => setTimeout(r, 500));
+        response = await fetch(url, {
+          method,
+          headers,
+          body: body ? JSON.stringify(body) : void 0,
+          signal: retryController.signal
+        });
+      } finally {
+        clearTimeout(retryTimeout);
+      }
+    }
     if (!response.ok) {
       throw new Error(`Wiki API ${method} ${path20}: ${response.status} ${response.statusText}`);
     }
@@ -9814,7 +9870,8 @@ var OllamaProvider = class {
     const res = await fetch(`${this.host}/api/chat`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(3e4)
     });
     if (!res.ok) {
       throw new Error(`Ollama API error: ${res.status} ${await res.text()}`);
@@ -10242,7 +10299,7 @@ var SignalAdapter = class {
     if (/^https?:\/\//i.test(trimmed)) {
       return trimmed.replace(/\/+$/, "");
     }
-    return `http://${trimmed}`.replace(/\/+$/, "");
+    return `https://${trimmed}`.replace(/\/+$/, "");
   }
   async connect(config2) {
     this.baseUrl = this.normalizeBaseUrl(
@@ -10664,9 +10721,15 @@ var WebChatAdapter = class {
     res.end(JSON.stringify({ error: "Not found" }));
   }
   async handleChatRequest(req, res) {
+    const MAX_BODY_SIZE = 1048576;
     let body = "";
     for await (const chunk of req) {
       body += chunk;
+      if (body.length > MAX_BODY_SIZE) {
+        res.writeHead(413, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Request body too large" }));
+        return;
+      }
     }
     let parsed;
     try {
@@ -11146,12 +11209,12 @@ var SlackAdapter = class {
 // src/gateway/adapters/imessage.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
-import os7 from "os";
+import os8 from "os";
 import path18 from "path";
 var execFileAsync = promisify(execFile);
 var POLL_INTERVAL_MS = 5e3;
 var MESSAGES_DB_PATH = path18.join(
-  process.env.HOME ?? os7.homedir(),
+  process.env.HOME ?? os8.homedir(),
   "Library/Messages/chat.db"
 );
 var IMessageAdapter = class {
@@ -11997,8 +12060,9 @@ async function ensureCRMContact(info) {
 import { readFileSync as readFileSync12, writeFileSync as writeFileSync6, existsSync as existsSync14, mkdirSync as mkdirSync8 } from "fs";
 import { randomUUID as randomUUID14 } from "crypto";
 import path19 from "path";
-import os8 from "os";
-var TRIGGERS_PATH = path19.join(os8.homedir(), ".exe-os", "triggers.json");
+import os9 from "os";
+var TRIGGERS_PATH = path19.join(os9.homedir(), ".exe-os", "triggers.json");
+var GRAPH_API_VERSION = "v21.0";
 function substituteTemplate(template, record) {
   return template.replace(
     /\{\{(\w+(?:\.\w+)*)\}\}/g,
@@ -12076,7 +12140,7 @@ async function executeSendWhatsapp(params) {
   const message = params.message ?? params.text;
   if (!to || !message)
     throw new Error("send_whatsapp requires 'to' and 'message' params");
-  const url = `https://graph.facebook.com/v21.0/${account.phoneNumberId}/messages`;
+  const url = `https://graph.facebook.com/${GRAPH_API_VERSION}/${account.phoneNumberId}/messages`;
   const res = await fetch(url, {
     method: "POST",
     headers: {
@@ -12088,7 +12152,8 @@ async function executeSendWhatsapp(params) {
       to,
       type: "text",
       text: { body: message }
-    })
+    }),
+    signal: AbortSignal.timeout(3e4)
   });
   if (!res.ok) {
     const errBody = await res.text();

package/dist/lib/cloud-sync.js

@@ -6,7 +6,7 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 });
 
 // src/lib/cloud-sync.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync5, readdirSync, mkdirSync as mkdirSync2, appendFileSync } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync5, readdirSync, mkdirSync as mkdirSync2, appendFileSync, unlinkSync } from "fs";
 import path5 from "path";
 import { homedir } from "os";
 
@@ -80,7 +80,7 @@ import { execSync } from "child_process";
 import path2 from "path";
 
 // src/lib/config.ts
-import { readFile, writeFile, mkdir } from "fs/promises";
+import { readFile, writeFile, mkdir, chmod } from "fs/promises";
 import { readFileSync, existsSync, renameSync } from "fs";
 import path from "path";
 import os from "os";
@@ -187,15 +187,20 @@ async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
   await mkdir2(path2.dirname(employeesPath), { recursive: true });
   await writeFile2(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
 }
+function findExeBin() {
+  try {
+    return execSync(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
+  } catch {
+    return null;
+  }
+}
 function registerBinSymlinks(name) {
   const created = [];
   const skipped = [];
   const errors = [];
-  let exeBinPath;
-  try {
-    exeBinPath = execSync("which exe", { encoding: "utf-8" }).trim();
-  } catch {
-    errors.push("Could not find 'exe' in PATH");
+  const exeBinPath = findExeBin();
+  if (!exeBinPath) {
+    errors.push("Could not find 'exe-os' in PATH");
     return { created, skipped, errors };
   }
   const binDir = path2.dirname(exeBinPath);
@@ -232,6 +237,15 @@ var LICENSE_PATH = path3.join(EXE_AI_DIR, "license.key");
 var CACHE_PATH = path3.join(EXE_AI_DIR, "license-cache.json");
 var DEVICE_ID_PATH = path3.join(EXE_AI_DIR, "device-id");
 var API_BASE = "https://askexe.com/cloud";
+var RETRY_DELAY_MS = 500;
+async function fetchRetry(url, init) {
+  try {
+    return await fetch(url, init);
+  } catch {
+    await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
+    return fetch(url, { ...init, signal: AbortSignal.timeout(1e4) });
+  }
+}
 var LICENSE_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
 4uj+UqeKCcvtgNHKmOK278HJaJcANe9xAeji8AFYu27q3WtzCi04pHudow==
@@ -323,7 +337,7 @@ function cacheResponse(token) {
 async function validateLicense(apiKey, deviceId) {
   const did = deviceId ?? loadDeviceId();
   try {
-    const res = await fetch(`${API_BASE}/auth/activate`, {
+    const res = await fetchRetry(`${API_BASE}/auth/activate`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ apiKey, deviceId: did }),
@@ -418,16 +432,50 @@ function logError(msg) {
 }
 var LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
 var FETCH_TIMEOUT_MS = 3e4;
+var PUSH_BATCH_SIZE = 5e3;
+var ROSTER_LOCK_PATH = path5.join(EXE_AI_DIR, "roster-merge.lock");
+var LOCK_STALE_MS = 3e4;
+async function withRosterLock(fn) {
+  if (existsSync5(ROSTER_LOCK_PATH)) {
+    try {
+      const ts = parseInt(readFileSync5(ROSTER_LOCK_PATH, "utf-8"), 10);
+      if (Date.now() - ts < LOCK_STALE_MS) {
+        throw new Error("Roster merge already in progress \u2014 another sync is running");
+      }
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("already in progress")) throw err;
+    }
+  }
+  writeFileSync2(ROSTER_LOCK_PATH, String(Date.now()));
+  try {
+    return await fn();
+  } finally {
+    try {
+      unlinkSync(ROSTER_LOCK_PATH);
+    } catch {
+    }
+  }
+}
 async function fetchWithRetry(url, init) {
-  const attempt = async () => {
-    const signal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
-    return fetch(url, { ...init, signal });
-  };
-  const resp = await attempt();
-  if (resp.status >= 500) {
-    return attempt();
+  const MAX_RETRIES = 3;
+  const BASE_DELAY_MS = 200;
+  let lastError;
+  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+    try {
+      const signal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
+      const resp = await fetch(url, { ...init, signal });
+      if (resp.status >= 500 && attempt < MAX_RETRIES) {
+        await new Promise((r) => setTimeout(r, BASE_DELAY_MS * Math.pow(2, attempt)));
+        continue;
+      }
+      return resp;
+    } catch (err) {
+      lastError = err;
+      if (attempt === MAX_RETRIES) throw err;
+      await new Promise((r) => setTimeout(r, BASE_DELAY_MS * Math.pow(2, attempt)));
+    }
   }
-  return resp;
+  throw lastError;
 }
 function assertSecureEndpoint(endpoint) {
   if (endpoint.startsWith("https://")) return;
@@ -455,10 +503,15 @@ async function cloudPush(records, maxVersion, config) {
       headers: {
         Authorization: `Bearer ${config.apiKey}`,
         "Content-Type": "application/json",
-        "X-Device-Id": loadDeviceId()
+        "X-Device-Id": loadDeviceId(),
+        "X-Expected-Version": String(maxVersion)
       },
       body: JSON.stringify({ version: maxVersion, blob })
     });
+    if (resp.status === 409) {
+      logError("[cloud-sync] PUSH VERSION CONFLICT \u2014 re-pull required before next push");
+      return false;
+    }
     return resp.ok;
   } catch (err) {
     logError(`[cloud-sync] PUSH FAILED: ${err instanceof Error ? err.message : String(err)}`);
@@ -545,18 +598,21 @@ async function cloudSync(config) {
     "SELECT value FROM sync_meta WHERE key = 'last_cloud_push_version'"
   );
   const lastPushVersion = pushMeta.rows.length > 0 ? Number(pushMeta.rows[0].value) : 0;
-  const recordsResult = await client.execute({
-    sql: `SELECT id, agent_id, agent_role, session_id, timestamp,
-                 tool_name, project_name, has_error, raw_text, version,
-                 author_device_id, scope
-          FROM memories
-          WHERE version > ?
-            AND (scope IS NULL OR scope != 'personal')
-          ORDER BY version ASC`,
-    args: [lastPushVersion]
-  });
   let pushed = 0;
-  if (recordsResult.rows.length > 0) {
+  let batchCursor = lastPushVersion;
+  while (true) {
+    const recordsResult = await client.execute({
+      sql: `SELECT id, agent_id, agent_role, session_id, timestamp,
+                   tool_name, project_name, has_error, raw_text, version,
+                   author_device_id, scope
+            FROM memories
+            WHERE version > ?
+              AND (scope IS NULL OR scope != 'personal')
+            ORDER BY version ASC
+            LIMIT ?`,
+      args: [batchCursor, PUSH_BATCH_SIZE]
+    });
+    if (recordsResult.rows.length === 0) break;
     const records = recordsResult.rows.map((row) => ({
       id: row.id,
       agent_id: row.agent_id,
@@ -573,13 +629,14 @@ async function cloudSync(config) {
     }));
     const maxVersion = Number(records[records.length - 1].version);
     const pushOk = await cloudPush(records, maxVersion, config);
-    if (pushOk) {
-      await client.execute({
-        sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_push_version', ?)",
-        args: [String(maxVersion)]
-      });
-      pushed = records.length;
-    }
+    if (!pushOk) break;
+    await client.execute({
+      sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_push_version', ?)",
+      args: [String(maxVersion)]
+    });
+    pushed += records.length;
+    batchCursor = maxVersion;
+    if (recordsResult.rows.length < PUSH_BATCH_SIZE) break;
   }
   try {
     await cloudPushRoster(config);
@@ -661,6 +718,28 @@ async function cloudSync(config) {
     documents: documentsResult
   };
 }
+var ROSTER_DELETIONS_PATH = path5.join(EXE_AI_DIR, "roster-deletions.json");
+function recordRosterDeletion(name) {
+  let deletions = [];
+  try {
+    if (existsSync5(ROSTER_DELETIONS_PATH)) {
+      deletions = JSON.parse(readFileSync5(ROSTER_DELETIONS_PATH, "utf-8"));
+    }
+  } catch {
+  }
+  if (!deletions.includes(name)) deletions.push(name);
+  writeFileSync2(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
+}
+function consumeRosterDeletions() {
+  try {
+    if (!existsSync5(ROSTER_DELETIONS_PATH)) return [];
+    const deletions = JSON.parse(readFileSync5(ROSTER_DELETIONS_PATH, "utf-8"));
+    writeFileSync2(ROSTER_DELETIONS_PATH, "[]");
+    return deletions;
+  } catch {
+    return [];
+  }
+}
 function buildRosterBlob(paths) {
   const rosterPath = paths?.rosterPath ?? path5.join(EXE_AI_DIR, "exe-employees.json");
   const identityDir = paths?.identityDir ?? path5.join(EXE_AI_DIR, "identity");
@@ -688,9 +767,10 @@ function buildRosterBlob(paths) {
     } catch {
     }
   }
-  const content = JSON.stringify({ roster, identities, config });
+  const deletedNames = consumeRosterDeletions();
+  const content = JSON.stringify({ roster, identities, config, deletedNames });
   const hash = Buffer.from(content).length;
-  return { roster, identities, config, version: hash };
+  return { roster, identities, config, deletedNames, version: hash };
 }
 async function cloudPushRoster(config) {
   assertSecureEndpoint(config.endpoint);
@@ -773,38 +853,50 @@ function mergeConfig(remoteConfig, configPath) {
   writeFileSync2(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
 }
 async function mergeRosterFromRemote(remote, paths) {
-  const rosterPath = paths?.rosterPath ?? void 0;
-  const identityDir = paths?.identityDir ?? path5.join(EXE_AI_DIR, "identity");
-  const localEmployees = await loadEmployees(rosterPath);
-  const localNames = new Set(localEmployees.map((e) => e.name));
-  let added = 0;
-  for (const remoteEmp of remote.roster) {
-    if (localNames.has(remoteEmp.name)) continue;
-    localEmployees.push(remoteEmp);
-    localNames.add(remoteEmp.name);
-    added++;
-    if (remote.identities[`${remoteEmp.name}.md`]) {
-      if (!existsSync5(identityDir)) mkdirSync2(identityDir, { recursive: true });
-      const idPath = path5.join(identityDir, `${remoteEmp.name}.md`);
-      if (!existsSync5(idPath)) {
-        writeFileSync2(idPath, remote.identities[`${remoteEmp.name}.md`], "utf-8");
+  return withRosterLock(async () => {
+    const rosterPath = paths?.rosterPath ?? void 0;
+    const identityDir = paths?.identityDir ?? path5.join(EXE_AI_DIR, "identity");
+    const localEmployees = await loadEmployees(rosterPath);
+    const localNames = new Set(localEmployees.map((e) => e.name));
+    let added = 0;
+    for (const remoteEmp of remote.roster) {
+      if (localNames.has(remoteEmp.name)) continue;
+      localEmployees.push(remoteEmp);
+      localNames.add(remoteEmp.name);
+      added++;
+      if (remote.identities[`${remoteEmp.name}.md`]) {
+        if (!existsSync5(identityDir)) mkdirSync2(identityDir, { recursive: true });
+        const idPath = path5.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync5(idPath)) {
+          writeFileSync2(idPath, remote.identities[`${remoteEmp.name}.md`], "utf-8");
+        }
+      }
+      try {
+        registerBinSymlinks(remoteEmp.name);
+      } catch {
       }
     }
-    try {
-      registerBinSymlinks(remoteEmp.name);
-    } catch {
+    let removed = 0;
+    if (remote.deletedNames && remote.deletedNames.length > 0) {
+      const toRemove = new Set(remote.deletedNames);
+      const filtered = localEmployees.filter((e) => !toRemove.has(e.name));
+      removed = localEmployees.length - filtered.length;
+      if (removed > 0) {
+        localEmployees.length = 0;
+        localEmployees.push(...filtered);
+      }
     }
-  }
-  if (added > 0) {
-    await saveEmployees(localEmployees, rosterPath);
-  }
-  if (remote.config && Object.keys(remote.config).length > 0) {
-    try {
-      mergeConfig(remote.config, paths?.configPath);
-    } catch {
+    if (added > 0 || removed > 0) {
+      await saveEmployees(localEmployees, rosterPath);
     }
-  }
-  return { added };
+    if (remote.config && Object.keys(remote.config).length > 0) {
+      try {
+        mergeConfig(remote.config, paths?.configPath);
+      } catch {
+      }
+    }
+    return { added };
+  });
 }
 async function cloudPushBlob(route, data, metaKey, config) {
   if (data.length === 0) return { ok: true };
@@ -872,7 +964,7 @@ async function cloudPullBlob(route, config) {
 }
 async function cloudPushBehaviors(config) {
   const client = getClient();
-  const result = await client.execute("SELECT * FROM behaviors");
+  const result = await client.execute("SELECT * FROM behaviors LIMIT 10000");
   const rows = result.rows;
   const { ok } = await cloudPushBlob(
     "/sync/push-behaviors",
@@ -920,13 +1012,13 @@ async function cloudPullBehaviors(config) {
 async function cloudPushGraphRAG(config) {
   const client = getClient();
   const [entities, relationships, aliases, entityMems, relMems, hyperedges, hyperedgeNodes] = await Promise.all([
-    client.execute("SELECT * FROM entities"),
-    client.execute("SELECT * FROM relationships"),
-    client.execute("SELECT * FROM entity_aliases"),
-    client.execute("SELECT * FROM entity_memories"),
-    client.execute("SELECT * FROM relationship_memories"),
-    client.execute("SELECT * FROM hyperedges"),
-    client.execute("SELECT * FROM hyperedge_nodes")
+    client.execute("SELECT * FROM entities LIMIT 50000"),
+    client.execute("SELECT * FROM relationships LIMIT 50000"),
+    client.execute("SELECT * FROM entity_aliases LIMIT 50000"),
+    client.execute("SELECT * FROM entity_memories LIMIT 50000"),
+    client.execute("SELECT * FROM relationship_memories LIMIT 50000"),
+    client.execute("SELECT * FROM hyperedges LIMIT 50000"),
+    client.execute("SELECT * FROM hyperedge_nodes LIMIT 50000")
   ]);
   const blob = {
     entities: entities.rows,
@@ -1028,7 +1120,7 @@ async function cloudPullGraphRAG(config) {
 }
 async function cloudPushTasks(config) {
   const client = getClient();
-  const result = await client.execute("SELECT * FROM tasks");
+  const result = await client.execute("SELECT * FROM tasks LIMIT 10000");
   const rows = result.rows;
   const { ok } = await cloudPushBlob(
     "/sync/push-tasks",
@@ -1074,7 +1166,7 @@ async function cloudPullTasks(config) {
 }
 async function cloudPushConversations(config) {
   const client = getClient();
-  const result = await client.execute("SELECT * FROM conversations");
+  const result = await client.execute("SELECT * FROM conversations LIMIT 50000");
   const rows = result.rows;
   const { ok } = await cloudPushBlob(
     "/sync/push-conversations",
@@ -1124,8 +1216,8 @@ async function cloudPullConversations(config) {
 async function cloudPushDocuments(config) {
   const client = getClient();
   const [workspaces, documents] = await Promise.all([
-    client.execute("SELECT * FROM workspaces"),
-    client.execute("SELECT * FROM documents")
+    client.execute("SELECT * FROM workspaces LIMIT 1000"),
+    client.execute("SELECT * FROM documents LIMIT 10000")
   ]);
   const blob = {
     workspaces: workspaces.rows,
@@ -1179,6 +1271,7 @@ async function cloudPullDocuments(config) {
   return { pulled };
 }
 export {
+  assertSecureEndpoint,
   buildRosterBlob,
   cloudPull,
   cloudPullBehaviors,
@@ -1198,5 +1291,6 @@ export {
   cloudPushTasks,
   cloudSync,
   mergeConfig,
-  mergeRosterFromRemote
+  mergeRosterFromRemote,
+  recordRosterDeletion
 };

package/dist/lib/config.js

@@ -1,5 +1,5 @@
 // src/lib/config.ts
-import { readFile, writeFile, mkdir } from "fs/promises";
+import { readFile, writeFile, mkdir, chmod } from "fs/promises";
 import { readFileSync, existsSync, renameSync } from "fs";
 import path from "path";
 import os from "os";
@@ -204,6 +204,9 @@ async function saveConfig(config) {
   await mkdir(dir, { recursive: true });
   const configPath = path.join(dir, "config.json");
   await writeFile(configPath, JSON.stringify(config, null, 2) + "\n");
+  if (config.cloud?.apiKey) {
+    await chmod(configPath, 384);
+  }
 }
 async function loadConfigFrom(configPath) {
   const raw = await readFile(configPath, "utf-8");