@askexenow/exe-os 0.8.57 → 0.8.59

package/dist/bin/cli.js

@@ -13238,6 +13238,21 @@ var init_session_kill_telemetry = __esm({
 });
 
 // src/lib/tasks-crud.ts
+var tasks_crud_exports = {};
+__export(tasks_crud_exports, {
+  TASK_ALREADY_CLAIMED_PREFIX: () => TASK_ALREADY_CLAIMED_PREFIX,
+  checkStaleCompletion: () => checkStaleCompletion,
+  createTaskCore: () => createTaskCore,
+  deleteTaskCore: () => deleteTaskCore,
+  ensureArchitectureDoc: () => ensureArchitectureDoc,
+  ensureGitignoreExe: () => ensureGitignoreExe,
+  extractParentFromContext: () => extractParentFromContext,
+  listTasks: () => listTasks,
+  resolveTask: () => resolveTask,
+  slugify: () => slugify,
+  updateTaskStatus: () => updateTaskStatus,
+  writeCheckpoint: () => writeCheckpoint
+});
 import crypto6 from "crypto";
 import path19 from "path";
 import { execSync as execSync8 } from "child_process";
@@ -13713,13 +13728,20 @@ async function cleanupOrphanedReviews() {
   const client = getClient();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const r1 = await client.execute({
-    sql: `UPDATE tasks SET status = 'done', updated_at = ?
-          WHERE status = 'needs_review'
+    sql: `UPDATE tasks SET status = 'cancelled', updated_at = ?
+          WHERE status IN ('open', 'needs_review', 'in_progress')
           AND assigned_by = 'system'
           AND title LIKE 'Review:%'
           AND parent_task_id IN (SELECT id FROM tasks WHERE status IN ('done', 'cancelled'))`,
     args: [now]
   });
+  const r1b = await client.execute({
+    sql: `UPDATE tasks SET status = 'cancelled', updated_at = ?
+          WHERE status IN ('open', 'needs_review')
+          AND title LIKE 'Review:%completed%'
+          AND (parent_task_id IS NULL OR parent_task_id NOT IN (SELECT id FROM tasks WHERE status IN ('open', 'in_progress', 'needs_review', 'blocked')))`,
+    args: [now]
+  });
   const staleThreshold = new Date(Date.now() - 60 * 60 * 1e3).toISOString();
   const r2 = await client.execute({
     sql: `UPDATE tasks SET status = 'done', updated_at = ?
@@ -13728,10 +13750,10 @@ async function cleanupOrphanedReviews() {
           AND updated_at < ?`,
     args: [now, staleThreshold]
   });
-  const total = r1.rowsAffected + r2.rowsAffected;
+  const total = r1.rowsAffected + (r1b?.rowsAffected ?? 0) + r2.rowsAffected;
   if (total > 0) {
     process.stderr.write(
-      `[cleanup] Closed ${total} orphaned review(s): ${r1.rowsAffected} cascade + ${r2.rowsAffected} stale
+      `[cleanup] Closed ${total} orphaned review(s): ${r1.rowsAffected} cascade + ${r1b?.rowsAffected ?? 0} orphan + ${r2.rowsAffected} stale
 `
     );
   }
@@ -13847,7 +13869,6 @@ var init_tasks_review = __esm({
     init_config();
     init_employees();
     init_notifications();
-    init_tasks_crud();
     init_tmux_routing();
     init_session_key();
     init_state_bus();
@@ -19508,6 +19529,7 @@ var init_orchestrator = __esm({
     init_task_router();
     init_tmux_routing();
     init_task_scope();
+    init_tasks_crud();
     STALE_THRESHOLD_MS = 2 * 60 * 60 * 1e3;
     MultiAgentOrchestrator = class {
       config;
@@ -19544,6 +19566,26 @@ ${task.context}`,
           targetEmployee = routed.employee;
           routingScore = routed.score;
         }
+        try {
+          await createTaskCore({
+            title: task.title,
+            assignedTo: targetEmployee.name,
+            assignedBy: "exe",
+            projectName: task.projectName,
+            priority: task.priority,
+            context: task.context,
+            baseDir: this.config.projectDir,
+            skipDispatch: true
+          });
+        } catch (err) {
+          return {
+            employee: targetEmployee.name,
+            sessionName: "",
+            status: "failed",
+            routingScore,
+            error: `Task creation failed: ${err instanceof Error ? err.message : String(err)}`
+          };
+        }
         const result = ensureEmployee(
           targetEmployee.name,
           this.config.exeSession,
@@ -19831,7 +19873,17 @@ function useOrchestrator(enabled = true) {
   const spawnSession = useCallback5(
     async (agentId) => {
       try {
+        const { createTaskCore: createTaskCore2 } = await Promise.resolve().then(() => (init_tasks_crud(), tasks_crud_exports));
         const { ensureEmployee: ensureEmployee2 } = await Promise.resolve().then(() => (init_tmux_routing(), tmux_routing_exports));
+        await createTaskCore2({
+          title: `Session launched for ${agentId} (TUI)`,
+          assignedTo: agentId,
+          assignedBy: "exe",
+          projectName: "exe-os",
+          priority: "p2",
+          context: "Session spawned from TUI Sessions view. Agent will pick up any queued tasks via intercom.",
+          skipDispatch: true
+        });
         return ensureEmployee2(agentId, exeSessionRef.current, process.cwd());
       } catch {
         return null;

package/dist/bin/customer-readiness.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+
+// src/bin/customer-readiness.ts
+import { readFileSync, existsSync } from "fs";
+import { execSync } from "child_process";
+import path from "path";
+import { fileURLToPath } from "url";
+var __dirname = path.dirname(fileURLToPath(import.meta.url));
+var ROOT = path.resolve(__dirname, "../..");
+var pass = 0;
+var fail = 0;
+function test(name, fn) {
+  try {
+    const result = fn();
+    if (result === true || result === "pass") {
+      console.log(`  \x1B[32m\u2713\x1B[0m ${name}`);
+      pass++;
+    } else {
+      console.log(`  \x1B[31m\u2717\x1B[0m ${name}: ${result}`);
+      fail++;
+    }
+  } catch (err) {
+    console.log(`  \x1B[31m\u2717\x1B[0m ${name}: ${err instanceof Error ? err.message : String(err)}`);
+    fail++;
+  }
+}
+function readSrc(relPath) {
+  return readFileSync(path.join(ROOT, relPath), "utf8");
+}
+console.log("\n\x1B[1mCustomer Readiness Gate\x1B[0m\n");
+test("Mode 1 detection \u2014 bare exe-os shows guidance, not TUI", () => {
+  const cli = readSrc("src/bin/cli.ts");
+  if (!cli.includes("Mode 1 detected")) return "cli.ts missing Mode 1 detection";
+  if (!cli.includes("hasClaudeCode")) return "cli.ts missing Claude Code check";
+  return true;
+});
+test("Review orphans \u2014 no createTaskCore in review generation", () => {
+  const review = readSrc("src/lib/tasks-review.ts");
+  if (review.includes("createTaskCore(")) return "createTaskCore still called \u2014 will create orphan tasks";
+  return true;
+});
+test("Cloud sync \u2014 sqlSafe() protects all cloudPull functions", () => {
+  const sync = readSrc("src/lib/cloud-sync.ts");
+  if (!sync.includes("function sqlSafe")) return "sqlSafe() helper missing";
+  const count = (sync.match(/sqlSafe\(/g) || []).length;
+  if (count < 20) return `Only ${count} sqlSafe() usages (expected 20+)`;
+  return true;
+});
+test("Session scoping \u2014 task-scope.ts helper exists", () => {
+  if (!existsSync(path.join(ROOT, "src/lib/task-scope.ts"))) return "task-scope.ts missing";
+  const scope = readSrc("src/lib/task-scope.ts");
+  if (!scope.includes("sessionScopeFilter")) return "sessionScopeFilter not exported";
+  return true;
+});
+test("Session scoping \u2014 all task query files import scope helper", () => {
+  const taskFiles = execSync(
+    `grep -rl "FROM tasks" src/ --include="*.ts" --include="*.tsx"`,
+    { encoding: "utf8", cwd: ROOT }
+  ).trim().split("\n").filter(Boolean);
+  const exempt = ["close-task.ts", "tasks-review.ts", "tasks.ts", "cloud-sync.ts", "task-scope.ts", "database.ts"];
+  const unscoped = [];
+  for (const f of taskFiles) {
+    const basename = path.basename(f);
+    if (exempt.some((e) => basename === e)) continue;
+    const content = readFileSync(path.join(ROOT, f), "utf8");
+    if (!content.includes("task-scope") && !content.includes("sessionScopeFilter") && !content.includes("intentionally unscoped")) {
+      unscoped.push(f);
+    }
+  }
+  if (unscoped.length > 0) return `${unscoped.length} files missing scope: ${unscoped.slice(0, 3).join(", ")}`;
+  return true;
+});
+test("Platform procedures \u2014 shipped as code (not DB only)", () => {
+  const procs = readSrc("src/lib/platform-procedures.ts");
+  const count = (procs.match(/title:/g) || []).length;
+  if (count < 13) return `Only ${count} procedures (expected 13+)`;
+  if (!procs.includes("PLATFORM_PROCEDURE_TITLES")) return "Missing dedup set";
+  return true;
+});
+test("Platform procedures \u2014 customer procedures stay in DB", () => {
+  const global = readSrc("src/lib/global-procedures.ts");
+  if (!global.includes("PLATFORM_PROCEDURE_TITLES")) return "Not filtering platform titles from DB";
+  if (!global.includes("_platformCache")) return "No platform cache";
+  if (!global.includes("_customerCache")) return "No customer cache separation";
+  return true;
+});
+test("Backfill exclusive lock \u2014 only 1 backfill at a time", () => {
+  const gate = readSrc("src/lib/worker-gate.ts");
+  if (!gate.includes("tryAcquireBackfillLock")) return "Missing backfill lock";
+  if (!gate.includes("backfill.lock")) return "Missing lockfile path";
+  const bf = readSrc("src/bin/backfill-vectors.ts");
+  if (!bf.includes("tryAcquireBackfillLock")) return "backfill-vectors.ts not using lock";
+  return true;
+});
+test("Daemon restart \u2014 uses SIGKILL + kills orphans", () => {
+  const install = readSrc("src/bin/install.ts");
+  if (!install.includes("SIGKILL")) return "Still using SIGTERM";
+  if (!install.includes("pgrep")) return "No orphan kill via pgrep";
+  return true;
+});
+test("License self-heal \u2014 update mirrors cloud.apiKey to license.key", () => {
+  const update = readSrc("src/bin/update.ts");
+  if (!update.includes("mirrorLicenseKey")) return "update.ts missing license self-heal";
+  return true;
+});
+test("Golden path \u2014 orchestration model documented", () => {
+  if (!existsSync(path.join(ROOT, ".planning/ARCHITECTURE.md"))) return "ARCHITECTURE.md missing";
+  const arch = readFileSync(path.join(ROOT, ".planning/ARCHITECTURE.md"), "utf8");
+  if (!arch.includes("Orchestration Model")) return "Golden path section missing";
+  if (!arch.includes("create_task") || !arch.includes("Dispatch")) return "Dispatch rule missing";
+  return true;
+});
+test("No hardcoded 'yoshi'/'mari' in runtime task routing", () => {
+  const router = readSrc("src/lib/task-router.ts");
+  if (router.includes('"yoshi"') || router.includes("'yoshi'")) return "Hardcoded 'yoshi' in task-router.ts";
+  if (router.includes('"mari"') || router.includes("'mari'")) return "Hardcoded 'mari' in task-router.ts";
+  return true;
+});
+console.log(`
+\x1B[1m${pass + fail} tests: ${pass} passed, ${fail} failed\x1B[0m
+`);
+if (fail > 0) {
+  console.log("\x1B[31mCustomer readiness gate FAILED \u2014 do not publish.\x1B[0m\n");
+  process.exit(1);
+} else {
+  console.log("\x1B[32mCustomer readiness gate PASSED \u2014 safe to publish.\x1B[0m\n");
+}

package/dist/bin/exe-boot.js

@@ -3501,13 +3501,20 @@ async function cleanupOrphanedReviews() {
   const client = getClient();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const r1 = await client.execute({
-    sql: `UPDATE tasks SET status = 'done', updated_at = ?
-          WHERE status = 'needs_review'
+    sql: `UPDATE tasks SET status = 'cancelled', updated_at = ?
+          WHERE status IN ('open', 'needs_review', 'in_progress')
           AND assigned_by = 'system'
           AND title LIKE 'Review:%'
           AND parent_task_id IN (SELECT id FROM tasks WHERE status IN ('done', 'cancelled'))`,
     args: [now]
   });
+  const r1b = await client.execute({
+    sql: `UPDATE tasks SET status = 'cancelled', updated_at = ?
+          WHERE status IN ('open', 'needs_review')
+          AND title LIKE 'Review:%completed%'
+          AND (parent_task_id IS NULL OR parent_task_id NOT IN (SELECT id FROM tasks WHERE status IN ('open', 'in_progress', 'needs_review', 'blocked')))`,
+    args: [now]
+  });
   const staleThreshold = new Date(Date.now() - 60 * 60 * 1e3).toISOString();
   const r2 = await client.execute({
     sql: `UPDATE tasks SET status = 'done', updated_at = ?
@@ -3516,10 +3523,10 @@ async function cleanupOrphanedReviews() {
           AND updated_at < ?`,
     args: [now, staleThreshold]
   });
-  const total = r1.rowsAffected + r2.rowsAffected;
+  const total = r1.rowsAffected + (r1b?.rowsAffected ?? 0) + r2.rowsAffected;
   if (total > 0) {
     process.stderr.write(
-      `[cleanup] Closed ${total} orphaned review(s): ${r1.rowsAffected} cascade + ${r2.rowsAffected} stale
+      `[cleanup] Closed ${total} orphaned review(s): ${r1.rowsAffected} cascade + ${r1b?.rowsAffected ?? 0} orphan + ${r2.rowsAffected} stale
 `
     );
   }
@@ -3635,7 +3642,6 @@ var init_tasks_review = __esm({
     init_config();
     init_employees();
     init_notifications();
-    init_tasks_crud();
     init_tmux_routing();
     init_session_key();
     init_state_bus();
@@ -5709,6 +5715,9 @@ import { readFileSync as readFileSync12, writeFileSync as writeFileSync8, exists
 import crypto8 from "crypto";
 import path19 from "path";
 import { homedir } from "os";
+function sqlSafe(v) {
+  return v === void 0 ? null : v;
+}
 function logError(msg) {
   try {
     const logPath = path19.join(homedir(), ".exe-os", "workers.log");
@@ -5879,18 +5888,18 @@ async function cloudSync(config) {
              author_device_id, scope)
             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       args: [
-        rec.id ?? null,
-        rec.agent_id ?? null,
-        rec.agent_role ?? null,
-        rec.session_id ?? null,
-        rec.timestamp ?? null,
-        rec.tool_name ?? null,
-        rec.project_name ?? null,
-        rec.has_error ?? 0,
-        rec.raw_text ?? "",
-        rec.version ?? 0,
-        rec.author_device_id ?? null,
-        rec.scope ?? "business"
+        sqlSafe(rec.id),
+        sqlSafe(rec.agent_id),
+        sqlSafe(rec.agent_role),
+        sqlSafe(rec.session_id),
+        sqlSafe(rec.timestamp),
+        sqlSafe(rec.tool_name),
+        sqlSafe(rec.project_name),
+        sqlSafe(rec.has_error ?? 0),
+        sqlSafe(rec.raw_text ?? ""),
+        sqlSafe(rec.version ?? 0),
+        sqlSafe(rec.author_device_id),
+        sqlSafe(rec.scope ?? "business")
       ]
     }));
     await client.batch(stmts, "write");
@@ -6311,14 +6320,14 @@ async function cloudPullGlobalProcedures(config) {
             updated_at = excluded.updated_at
           WHERE excluded.updated_at > global_procedures.updated_at`,
     args: [
-      p.id ?? null,
-      p.title ?? null,
-      p.content ?? null,
-      p.priority ?? "p0",
-      p.domain ?? null,
-      p.active ?? 1,
-      p.created_at ?? null,
-      p.updated_at ?? null
+      sqlSafe(p.id),
+      sqlSafe(p.title),
+      sqlSafe(p.content),
+      sqlSafe(p.priority ?? "p0"),
+      sqlSafe(p.domain),
+      sqlSafe(p.active ?? 1),
+      sqlSafe(p.created_at),
+      sqlSafe(p.updated_at)
     ]
   }));
   await client.batch(stmts, "write");
@@ -6348,7 +6357,7 @@ async function cloudPullBehaviors(config) {
     const existing = await client.execute({
       sql: `SELECT COUNT(*) as cnt FROM behaviors
             WHERE agent_id = ? AND content = ?`,
-      args: [behavior.agent_id ?? null, behavior.content ?? null]
+      args: [sqlSafe(behavior.agent_id), sqlSafe(behavior.content)]
     });
     if (Number(existing.rows[0]?.cnt) > 0) continue;
     await client.execute({
@@ -6356,15 +6365,15 @@ async function cloudPullBehaviors(config) {
             (id, agent_id, project_name, domain, content, active, priority, created_at, updated_at)
             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       args: [
-        behavior.id ?? null,
-        behavior.agent_id ?? null,
-        behavior.project_name ?? null,
-        behavior.domain ?? null,
-        behavior.content ?? null,
-        behavior.active ?? 1,
-        behavior.priority ?? "p1",
-        behavior.created_at ?? null,
-        behavior.updated_at ?? null
+        sqlSafe(behavior.id),
+        sqlSafe(behavior.agent_id),
+        sqlSafe(behavior.project_name),
+        sqlSafe(behavior.domain),
+        sqlSafe(behavior.content),
+        sqlSafe(behavior.active ?? 1),
+        sqlSafe(behavior.priority ?? "p1"),
+        sqlSafe(behavior.created_at),
+        sqlSafe(behavior.updated_at)
       ]
     });
     pulled++;
@@ -6412,7 +6421,7 @@ async function cloudPullGraphRAG(config) {
     const stmts = blob.entities.map((e) => ({
       sql: `INSERT OR IGNORE INTO entities (id, name, type, first_seen, last_seen, properties)
             VALUES (?, ?, ?, ?, ?, ?)`,
-      args: [e.id, e.name, e.type, e.first_seen, e.last_seen, e.properties ?? "{}"]
+      args: [sqlSafe(e.id), sqlSafe(e.name), sqlSafe(e.type), sqlSafe(e.first_seen), sqlSafe(e.last_seen), sqlSafe(e.properties ?? "{}")]
     }));
     await client.batch(stmts, "write");
     pulled += stmts.length;
@@ -6423,15 +6432,15 @@ async function cloudPullGraphRAG(config) {
             (id, source_entity_id, target_entity_id, type, weight, timestamp, properties, confidence, confidence_label)
             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       args: [
-        r.id,
-        r.source_entity_id,
-        r.target_entity_id,
-        r.type,
-        r.weight ?? 1,
-        r.timestamp,
-        r.properties ?? "{}",
-        r.confidence ?? 1,
-        r.confidence_label ?? "extracted"
+        sqlSafe(r.id),
+        sqlSafe(r.source_entity_id),
+        sqlSafe(r.target_entity_id),
+        sqlSafe(r.type),
+        sqlSafe(r.weight ?? 1),
+        sqlSafe(r.timestamp),
+        sqlSafe(r.properties ?? "{}"),
+        sqlSafe(r.confidence ?? 1),
+        sqlSafe(r.confidence_label ?? "extracted")
       ]
     }));
     await client.batch(stmts, "write");
@@ -6440,7 +6449,7 @@ async function cloudPullGraphRAG(config) {
   if (blob.entity_aliases.length > 0) {
     const stmts = blob.entity_aliases.map((a) => ({
       sql: `INSERT OR IGNORE INTO entity_aliases (alias, canonical_entity_id) VALUES (?, ?)`,
-      args: [a.alias, a.canonical_entity_id]
+      args: [sqlSafe(a.alias), sqlSafe(a.canonical_entity_id)]
     }));
     await client.batch(stmts, "write");
     pulled += stmts.length;
@@ -6448,7 +6457,7 @@ async function cloudPullGraphRAG(config) {
   if (blob.entity_memories.length > 0) {
     const stmts = blob.entity_memories.map((em) => ({
       sql: `INSERT OR IGNORE INTO entity_memories (entity_id, memory_id) VALUES (?, ?)`,
-      args: [em.entity_id, em.memory_id]
+      args: [sqlSafe(em.entity_id), sqlSafe(em.memory_id)]
     }));
     await client.batch(stmts, "write");
     pulled += stmts.length;
@@ -6456,7 +6465,7 @@ async function cloudPullGraphRAG(config) {
   if (blob.relationship_memories.length > 0) {
     const stmts = blob.relationship_memories.map((rm) => ({
       sql: `INSERT OR IGNORE INTO relationship_memories (relationship_id, memory_id) VALUES (?, ?)`,
-      args: [rm.relationship_id, rm.memory_id]
+      args: [sqlSafe(rm.relationship_id), sqlSafe(rm.memory_id)]
     }));
     await client.batch(stmts, "write");
     pulled += stmts.length;
@@ -6465,7 +6474,7 @@ async function cloudPullGraphRAG(config) {
     const stmts = blob.hyperedges.map((h) => ({
       sql: `INSERT OR IGNORE INTO hyperedges (id, label, relation, confidence, timestamp)
             VALUES (?, ?, ?, ?, ?)`,
-      args: [h.id, h.label, h.relation, h.confidence ?? 1, h.timestamp]
+      args: [sqlSafe(h.id), sqlSafe(h.label), sqlSafe(h.relation), sqlSafe(h.confidence ?? 1), sqlSafe(h.timestamp)]
     }));
     await client.batch(stmts, "write");
     pulled += stmts.length;
@@ -6473,7 +6482,7 @@ async function cloudPullGraphRAG(config) {
   if (blob.hyperedge_nodes.length > 0) {
     const stmts = blob.hyperedge_nodes.map((hn) => ({
       sql: `INSERT OR IGNORE INTO hyperedge_nodes (hyperedge_id, entity_id) VALUES (?, ?)`,
-      args: [hn.hyperedge_id, hn.entity_id]
+      args: [sqlSafe(hn.hyperedge_id), sqlSafe(hn.entity_id)]
     }));
     await client.batch(stmts, "write");
     pulled += stmts.length;
@@ -6505,22 +6514,22 @@ async function cloudPullTasks(config) {
            blocked_by, parent_task_id, budget_tokens, budget_fallback_model, tokens_used, tokens_warned_at)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
     args: [
-      t.id ?? null,
-      t.title ?? null,
-      t.assigned_to ?? null,
-      t.assigned_by ?? null,
-      t.project_name ?? null,
-      t.priority ?? "p1",
-      t.status ?? "open",
-      t.task_file ?? null,
-      t.created_at ?? null,
-      t.updated_at ?? null,
-      t.blocked_by ?? null,
-      t.parent_task_id ?? null,
-      t.budget_tokens ?? null,
-      t.budget_fallback_model ?? null,
-      t.tokens_used ?? 0,
-      t.tokens_warned_at ?? null
+      sqlSafe(t.id),
+      sqlSafe(t.title),
+      sqlSafe(t.assigned_to),
+      sqlSafe(t.assigned_by),
+      sqlSafe(t.project_name),
+      sqlSafe(t.priority ?? "p1"),
+      sqlSafe(t.status ?? "open"),
+      sqlSafe(t.task_file),
+      sqlSafe(t.created_at),
+      sqlSafe(t.updated_at),
+      sqlSafe(t.blocked_by),
+      sqlSafe(t.parent_task_id),
+      sqlSafe(t.budget_tokens),
+      sqlSafe(t.budget_fallback_model),
+      sqlSafe(t.tokens_used ?? 0),
+      sqlSafe(t.tokens_warned_at)
     ]
   }));
   await client.batch(stmts, "write");
@@ -6552,24 +6561,24 @@ async function cloudPullConversations(config) {
            content_metadata, agent_response, agent_name, timestamp, ingested_at)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
     args: [
-      c.id ?? null,
-      c.platform ?? null,
-      c.external_id ?? null,
-      c.sender_id ?? null,
-      c.sender_name ?? null,
-      c.sender_phone ?? null,
-      c.sender_email ?? null,
-      c.recipient_id ?? null,
-      c.channel_id ?? null,
-      c.thread_id ?? null,
-      c.reply_to_id ?? null,
-      c.content_text ?? null,
-      c.content_media ?? null,
-      c.content_metadata ?? null,
-      c.agent_response ?? null,
-      c.agent_name ?? null,
-      c.timestamp ?? null,
-      c.ingested_at ?? null
+      sqlSafe(c.id),
+      sqlSafe(c.platform),
+      sqlSafe(c.external_id),
+      sqlSafe(c.sender_id),
+      sqlSafe(c.sender_name),
+      sqlSafe(c.sender_phone),
+      sqlSafe(c.sender_email),
+      sqlSafe(c.recipient_id),
+      sqlSafe(c.channel_id),
+      sqlSafe(c.thread_id),
+      sqlSafe(c.reply_to_id),
+      sqlSafe(c.content_text),
+      sqlSafe(c.content_media),
+      sqlSafe(c.content_metadata),
+      sqlSafe(c.agent_response),
+      sqlSafe(c.agent_name),
+      sqlSafe(c.timestamp),
+      sqlSafe(c.ingested_at)
     ]
   }));
   await client.batch(stmts, "write");
@@ -6606,7 +6615,7 @@ async function cloudPullDocuments(config) {
     const stmts = blob.workspaces.map((w) => ({
       sql: `INSERT OR IGNORE INTO workspaces (id, slug, name, owner_agent_id, created_at, metadata)
             VALUES (?, ?, ?, ?, ?, ?)`,
-      args: [w.id, w.slug, w.name, w.owner_agent_id ?? null, w.created_at, w.metadata ?? null]
+      args: [sqlSafe(w.id), sqlSafe(w.slug), sqlSafe(w.name), sqlSafe(w.owner_agent_id), sqlSafe(w.created_at), sqlSafe(w.metadata)]
     }));
     await client.batch(stmts, "write");
     pulled += stmts.length;
@@ -6617,14 +6626,14 @@ async function cloudPullDocuments(config) {
             (id, workspace_id, filename, mime, source_type, user_id, uploaded_at, metadata)
             VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
       args: [
-        d.id,
-        d.workspace_id,
-        d.filename,
-        d.mime ?? null,
-        d.source_type ?? null,
-        d.user_id ?? null,
-        d.uploaded_at,
-        d.metadata ?? null
+        sqlSafe(d.id),
+        sqlSafe(d.workspace_id),
+        sqlSafe(d.filename),
+        sqlSafe(d.mime),
+        sqlSafe(d.source_type),
+        sqlSafe(d.user_id),
+        sqlSafe(d.uploaded_at),
+        sqlSafe(d.metadata)
       ]
     }));
     await client.batch(stmts, "write");