@askexenow/exe-os 0.8.61 → 0.8.63

package/dist/bin/setup.js

@@ -263,6 +263,121 @@ var init_config = __esm({
   }
 });
 
+// src/lib/keychain.ts
+var keychain_exports = {};
+__export(keychain_exports, {
+  deleteMasterKey: () => deleteMasterKey,
+  exportMnemonic: () => exportMnemonic,
+  getMasterKey: () => getMasterKey,
+  importMnemonic: () => importMnemonic,
+  setMasterKey: () => setMasterKey
+});
+import { readFile as readFile2, writeFile as writeFile2, unlink, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import path2 from "path";
+import os2 from "os";
+function getKeyDir() {
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path2.join(os2.homedir(), ".exe-os");
+}
+function getKeyPath() {
+  return path2.join(getKeyDir(), "master.key");
+}
+async function tryKeytar() {
+  try {
+    return await import("keytar");
+  } catch {
+    return null;
+  }
+}
+async function getMasterKey() {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
+      if (stored) {
+        return Buffer.from(stored, "base64");
+      }
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (!existsSync2(keyPath)) {
+    return null;
+  }
+  try {
+    const content = await readFile2(keyPath, "utf-8");
+    return Buffer.from(content.trim(), "base64");
+  } catch {
+    return null;
+  }
+}
+async function setMasterKey(key) {
+  const b64 = key.toString("base64");
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      await keytar.setPassword(SERVICE, ACCOUNT, b64);
+      return;
+    } catch {
+    }
+  }
+  const dir = getKeyDir();
+  await mkdir2(dir, { recursive: true });
+  const keyPath = getKeyPath();
+  await writeFile2(keyPath, b64 + "\n", "utf-8");
+  await chmod2(keyPath, 384);
+}
+async function deleteMasterKey() {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      await keytar.deletePassword(SERVICE, ACCOUNT);
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (existsSync2(keyPath)) {
+    await unlink(keyPath);
+  }
+}
+async function loadBip39() {
+  try {
+    return await import("bip39");
+  } catch {
+    throw new Error(
+      "bip39 package not found. Run: npm install -g bip39\nOr reinstall exe-os: npm install -g @askexenow/exe-os"
+    );
+  }
+}
+async function exportMnemonic(key) {
+  if (key.length !== 32) {
+    throw new Error(`Key must be 32 bytes, got ${key.length}`);
+  }
+  const { entropyToMnemonic } = await loadBip39();
+  return entropyToMnemonic(key.toString("hex"));
+}
+async function importMnemonic(mnemonic) {
+  const trimmed = mnemonic.trim();
+  const words = trimmed.split(/\s+/);
+  if (words.length !== 24) {
+    throw new Error(`Expected 24 words, got ${words.length}`);
+  }
+  const { validateMnemonic, mnemonicToEntropy } = await loadBip39();
+  if (!validateMnemonic(trimmed)) {
+    throw new Error("Invalid mnemonic \u2014 check for typos or missing words");
+  }
+  const entropy = mnemonicToEntropy(trimmed);
+  return Buffer.from(entropy, "hex");
+}
+var SERVICE, ACCOUNT;
+var init_keychain = __esm({
+  "src/lib/keychain.ts"() {
+    "use strict";
+    SERVICE = "exe-mem";
+    ACCOUNT = "master-key";
+  }
+});
+
 // src/types/memory.ts
 var EMBEDDING_DIM;
 var init_memory = __esm({
@@ -650,10 +765,10 @@ async function disposeEmbedder() {
 async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync9 } = await import("fs");
-  const path9 = await import("path");
-  const modelPath = path9.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync9(modelPath)) {
+  const { existsSync: existsSync11 } = await import("fs");
+  const path11 = await import("path");
+  const modelPath = path11.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync11(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -1068,6 +1183,109 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
   }
 });
 
+// src/lib/crypto.ts
+var crypto_exports = {};
+__export(crypto_exports, {
+  decryptSyncBlob: () => decryptSyncBlob,
+  encryptSyncBlob: () => encryptSyncBlob,
+  initSyncCrypto: () => initSyncCrypto,
+  isSyncCryptoInitialized: () => isSyncCryptoInitialized
+});
+import crypto from "crypto";
+function initSyncCrypto(masterKey) {
+  if (masterKey.length !== 32) {
+    throw new Error(`Master key must be 32 bytes, got ${masterKey.length}`);
+  }
+  _syncKey = Buffer.from(
+    crypto.hkdfSync("sha256", masterKey, "", SYNC_HKDF_INFO, 32)
+  );
+}
+function isSyncCryptoInitialized() {
+  return _syncKey !== null;
+}
+function requireSyncKey() {
+  if (!_syncKey) {
+    throw new Error("Sync crypto not initialized. Call initSyncCrypto(masterKey) first.");
+  }
+  return _syncKey;
+}
+function encryptSyncBlob(data) {
+  const key = requireSyncKey();
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, encrypted, tag]).toString("base64");
+}
+function decryptSyncBlob(ciphertext) {
+  const key = requireSyncKey();
+  const combined = Buffer.from(ciphertext, "base64");
+  if (combined.length < IV_LENGTH + TAG_LENGTH) {
+    throw new Error("Sync blob too short to contain IV + tag");
+  }
+  const iv = combined.subarray(0, IV_LENGTH);
+  const tag = combined.subarray(combined.length - TAG_LENGTH);
+  const encrypted = combined.subarray(IV_LENGTH, combined.length - TAG_LENGTH);
+  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(encrypted), decipher.final()]);
+}
+var ALGORITHM, IV_LENGTH, TAG_LENGTH, SYNC_HKDF_INFO, _syncKey;
+var init_crypto = __esm({
+  "src/lib/crypto.ts"() {
+    "use strict";
+    ALGORITHM = "aes-256-gcm";
+    IV_LENGTH = 12;
+    TAG_LENGTH = 16;
+    SYNC_HKDF_INFO = "exe-mem-sync-v2";
+    _syncKey = null;
+  }
+});
+
+// src/lib/db-retry.ts
+var init_db_retry = __esm({
+  "src/lib/db-retry.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/database.ts
+import { createClient } from "@libsql/client";
+function getClient() {
+  if (!_resilientClient) {
+    throw new Error("Database client not initialized. Call initDatabase() first.");
+  }
+  return _resilientClient;
+}
+var _resilientClient;
+var init_database = __esm({
+  "src/lib/database.ts"() {
+    "use strict";
+    init_db_retry();
+    _resilientClient = null;
+  }
+});
+
+// src/lib/compress.ts
+import { brotliCompressSync, brotliDecompressSync, constants } from "zlib";
+function compress(input) {
+  if (input.length === 0) return Buffer.alloc(0);
+  return brotliCompressSync(input, {
+    params: {
+      [constants.BROTLI_PARAM_QUALITY]: 4
+    }
+  });
+}
+function decompress(input) {
+  if (input.length === 0) return Buffer.alloc(0);
+  return brotliDecompressSync(input);
+}
+var init_compress = __esm({
+  "src/lib/compress.ts"() {
+    "use strict";
+  }
+});
+
 // src/lib/employees.ts
 var employees_exports = {};
 __export(employees_exports, {
@@ -1205,27 +1423,989 @@ var init_employees = __esm({
   }
 });
 
-// src/lib/db-retry.ts
-var init_db_retry = __esm({
-  "src/lib/db-retry.ts"() {
-    "use strict";
-  }
+// src/lib/cloud-sync.ts
+var cloud_sync_exports = {};
+__export(cloud_sync_exports, {
+  assertSecureEndpoint: () => assertSecureEndpoint,
+  buildRosterBlob: () => buildRosterBlob,
+  cloudPull: () => cloudPull,
+  cloudPullBehaviors: () => cloudPullBehaviors,
+  cloudPullBlob: () => cloudPullBlob,
+  cloudPullConversations: () => cloudPullConversations,
+  cloudPullDocuments: () => cloudPullDocuments,
+  cloudPullGlobalProcedures: () => cloudPullGlobalProcedures,
+  cloudPullGraphRAG: () => cloudPullGraphRAG,
+  cloudPullRoster: () => cloudPullRoster,
+  cloudPullTasks: () => cloudPullTasks,
+  cloudPush: () => cloudPush,
+  cloudPushBehaviors: () => cloudPushBehaviors,
+  cloudPushBlob: () => cloudPushBlob,
+  cloudPushConversations: () => cloudPushConversations,
+  cloudPushDocuments: () => cloudPushDocuments,
+  cloudPushGlobalProcedures: () => cloudPushGlobalProcedures,
+  cloudPushGraphRAG: () => cloudPushGraphRAG,
+  cloudPushRoster: () => cloudPushRoster,
+  cloudPushTasks: () => cloudPushTasks,
+  cloudSync: () => cloudSync,
+  mergeConfig: () => mergeConfig,
+  mergeRosterFromRemote: () => mergeRosterFromRemote,
+  recordRosterDeletion: () => recordRosterDeletion
 });
-
-// src/lib/database.ts
-import { createClient } from "@libsql/client";
-function getClient() {
-  if (!_resilientClient) {
-    throw new Error("Database client not initialized. Call initDatabase() first.");
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync7, readdirSync, mkdirSync as mkdirSync2, appendFileSync, unlinkSync as unlinkSync3, openSync as openSync2, closeSync as closeSync2 } from "fs";
+import crypto2 from "crypto";
+import path7 from "path";
+import { homedir } from "os";
+function sqlSafe(v) {
+  return v === void 0 ? null : v;
+}
+function logError(msg) {
+  try {
+    const logPath = path7.join(homedir(), ".exe-os", "workers.log");
+    appendFileSync(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
+`);
+  } catch {
   }
-  return _resilientClient;
 }
-var _resilientClient;
-var init_database = __esm({
-  "src/lib/database.ts"() {
+async function withRosterLock(fn) {
+  try {
+    const fd = openSync2(ROSTER_LOCK_PATH, "wx");
+    closeSync2(fd);
+    writeFileSync2(ROSTER_LOCK_PATH, String(Date.now()));
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      try {
+        const ts = parseInt(readFileSync5(ROSTER_LOCK_PATH, "utf-8"), 10);
+        if (Date.now() - ts < LOCK_STALE_MS) {
+          throw new Error("Roster merge already in progress \u2014 another sync is running");
+        }
+        unlinkSync3(ROSTER_LOCK_PATH);
+        const fd = openSync2(ROSTER_LOCK_PATH, "wx");
+        closeSync2(fd);
+        writeFileSync2(ROSTER_LOCK_PATH, String(Date.now()));
+      } catch (retryErr) {
+        if (retryErr instanceof Error && retryErr.message.includes("already in progress")) throw retryErr;
+        throw new Error("Roster merge already in progress \u2014 another sync is running");
+      }
+    } else {
+      throw err;
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    try {
+      unlinkSync3(ROSTER_LOCK_PATH);
+    } catch {
+    }
+  }
+}
+async function fetchWithRetry(url, init) {
+  const MAX_RETRIES = 3;
+  const BASE_DELAY_MS = 200;
+  let lastError;
+  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+    try {
+      const signal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
+      const resp = await fetch(url, { ...init, signal });
+      if (resp && resp.status >= 500 && attempt < MAX_RETRIES) {
+        await new Promise((r) => setTimeout(r, BASE_DELAY_MS * Math.pow(2, attempt)));
+        continue;
+      }
+      return resp;
+    } catch (err) {
+      lastError = err;
+      if (attempt === MAX_RETRIES) throw err;
+      await new Promise((r) => setTimeout(r, BASE_DELAY_MS * Math.pow(2, attempt)));
+    }
+  }
+  throw lastError;
+}
+function assertSecureEndpoint(endpoint) {
+  if (endpoint.startsWith("https://")) return;
+  if (endpoint.startsWith("http://")) {
+    try {
+      const parsed = new URL(endpoint);
+      if (LOCALHOST_PATTERNS.test(parsed.hostname)) return;
+    } catch {
+      return;
+    }
+    throw new Error(
+      `Insecure cloud endpoint rejected: "${endpoint}". Use https:// for remote hosts. Plain http:// is only allowed for localhost.`
+    );
+  }
+}
+async function cloudPush(records, maxVersion, config) {
+  if (records.length === 0) return true;
+  assertSecureEndpoint(config.endpoint);
+  try {
+    const json = JSON.stringify(records);
+    const compressed = compress(Buffer.from(json, "utf8"));
+    const blob = encryptSyncBlob(compressed);
+    const resp = await fetchWithRetry(`${config.endpoint}/sync/push`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Device-Id": loadDeviceId(),
+        "X-Expected-Version": String(maxVersion)
+      },
+      body: JSON.stringify({ version: maxVersion, blob })
+    });
+    if (resp == null) {
+      logError("[cloud-sync] PUSH FAILED: no response from server");
+      return false;
+    }
+    if (resp.status === 409) {
+      logError("[cloud-sync] PUSH VERSION CONFLICT \u2014 re-pull required before next push");
+      return false;
+    }
+    return resp.ok;
+  } catch (err) {
+    logError(`[cloud-sync] PUSH FAILED: ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+}
+async function cloudPull(sinceVersion, config) {
+  assertSecureEndpoint(config.endpoint);
+  try {
+    const response = await fetchWithRetry(`${config.endpoint}/sync/pull`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Device-Id": loadDeviceId()
+      },
+      body: JSON.stringify({ since_version: sinceVersion })
+    });
+    if (response == null) {
+      logError("[cloud-sync] PULL FAILED: no response from server");
+      return { records: [], maxVersion: sinceVersion };
+    }
+    if (!response.ok) return { records: [], maxVersion: sinceVersion };
+    const data = await response.json();
+    const allRecords = [];
+    for (const { blob } of data.blobs ?? []) {
+      try {
+        const compressed = decryptSyncBlob(blob);
+        const json = decompress(compressed).toString("utf8");
+        const records = JSON.parse(json);
+        allRecords.push(...records);
+      } catch {
+        continue;
+      }
+    }
+    return { records: allRecords, maxVersion: data.max_version ?? sinceVersion };
+  } catch (err) {
+    logError(`[cloud-sync] PULL FAILED: ${err instanceof Error ? err.message : String(err)}`);
+    return { records: [], maxVersion: sinceVersion };
+  }
+}
+async function cloudSync(config) {
+  let client;
+  try {
+    client = getClient();
+  } catch {
+    throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
+  }
+  try {
+    await client.execute(
+      "CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)"
+    );
+  } catch (e) {
+    logError(`[cloud-sync] sync_meta CREATE failed: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  const pullMeta = await client.execute(
+    "SELECT value FROM sync_meta WHERE key = 'last_cloud_pull_version'"
+  );
+  const lastPullVersion = pullMeta.rows.length > 0 ? Number(pullMeta.rows[0].value) : 0;
+  const pullResult = await cloudPull(lastPullVersion, config);
+  let pulled = 0;
+  if (pullResult.records.length > 0) {
+    const stmts = pullResult.records.map((rec) => ({
+      sql: `INSERT OR REPLACE INTO memories
+            (id, agent_id, agent_role, session_id, timestamp,
+             tool_name, project_name, has_error, raw_text, version,
+             author_device_id, scope)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        sqlSafe(rec.id),
+        sqlSafe(rec.agent_id),
+        sqlSafe(rec.agent_role),
+        sqlSafe(rec.session_id),
+        sqlSafe(rec.timestamp),
+        sqlSafe(rec.tool_name),
+        sqlSafe(rec.project_name),
+        sqlSafe(rec.has_error ?? 0),
+        sqlSafe(rec.raw_text ?? ""),
+        sqlSafe(rec.version ?? 0),
+        sqlSafe(rec.author_device_id),
+        sqlSafe(rec.scope ?? "business")
+      ]
+    }));
+    await client.batch(stmts, "write");
+    pulled = pullResult.records.length;
+  }
+  if (pullResult.maxVersion > lastPullVersion) {
+    await client.execute({
+      sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_pull_version', ?)",
+      args: [String(pullResult.maxVersion)]
+    });
+  }
+  const pushMeta = await client.execute(
+    "SELECT value FROM sync_meta WHERE key = 'last_cloud_push_version'"
+  );
+  const lastPushVersion = pushMeta.rows.length > 0 ? Number(pushMeta.rows[0].value) : 0;
+  let pushed = 0;
+  let batchCursor = lastPushVersion;
+  while (true) {
+    const recordsResult = await client.execute({
+      sql: `SELECT id, agent_id, agent_role, session_id, timestamp,
+                   tool_name, project_name, has_error, raw_text, version,
+                   author_device_id, scope
+            FROM memories
+            WHERE version > ?
+              AND (scope IS NULL OR scope != 'personal')
+            ORDER BY version ASC
+            LIMIT ?`,
+      args: [batchCursor, PUSH_BATCH_SIZE]
+    });
+    if (recordsResult.rows.length === 0) break;
+    const records = recordsResult.rows.map((row) => ({
+      id: row.id,
+      agent_id: row.agent_id,
+      agent_role: row.agent_role,
+      session_id: row.session_id,
+      timestamp: row.timestamp,
+      tool_name: row.tool_name,
+      project_name: row.project_name,
+      has_error: row.has_error,
+      raw_text: row.raw_text,
+      version: row.version,
+      author_device_id: row.author_device_id,
+      scope: row.scope
+    }));
+    const maxVersion = Number(records[records.length - 1].version);
+    const pushOk = await cloudPush(records, maxVersion, config);
+    if (!pushOk) break;
+    await client.execute({
+      sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_push_version', ?)",
+      args: [String(maxVersion)]
+    });
+    pushed += records.length;
+    batchCursor = maxVersion;
+    if (recordsResult.rows.length < PUSH_BATCH_SIZE) break;
+  }
+  try {
+    await cloudPushRoster(config);
+  } catch (err) {
+    logError(`[cloud-sync] Roster push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    await cloudPullRoster(config);
+  } catch (err) {
+    logError(`[cloud-sync] Roster pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    await cloudPushGlobalProcedures(config);
+  } catch (err) {
+    logError(`[cloud-sync] Global procedures push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    await cloudPullGlobalProcedures(config);
+  } catch (err) {
+    logError(`[cloud-sync] Global procedures pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let behaviorsResult = { pushed: false, pulled: 0 };
+  try {
+    behaviorsResult.pushed = await cloudPushBehaviors(config);
+  } catch (err) {
+    logError(`[cloud-sync] Behaviors push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const pullResult2 = await cloudPullBehaviors(config);
+    behaviorsResult.pulled = pullResult2.pulled;
+  } catch (err) {
+    logError(`[cloud-sync] Behaviors pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let graphragResult = { pushed: false, pulled: 0 };
+  try {
+    graphragResult.pushed = await cloudPushGraphRAG(config);
+  } catch (err) {
+    logError(`[cloud-sync] GraphRAG push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const pullResult2 = await cloudPullGraphRAG(config);
+    graphragResult.pulled = pullResult2.pulled;
+  } catch (err) {
+    logError(`[cloud-sync] GraphRAG pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let tasksResult = { pushed: false, pulled: 0 };
+  try {
+    tasksResult.pushed = await cloudPushTasks(config);
+  } catch (err) {
+    logError(`[cloud-sync] Tasks push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const pullResult2 = await cloudPullTasks(config);
+    tasksResult.pulled = pullResult2.pulled;
+  } catch (err) {
+    logError(`[cloud-sync] Tasks pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let conversationsResult = { pushed: false, pulled: 0 };
+  try {
+    conversationsResult.pushed = await cloudPushConversations(config);
+  } catch (err) {
+    logError(`[cloud-sync] Conversations push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const pullResult2 = await cloudPullConversations(config);
+    conversationsResult.pulled = pullResult2.pulled;
+  } catch (err) {
+    logError(`[cloud-sync] Conversations pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let documentsResult = { pushed: false, pulled: 0 };
+  try {
+    documentsResult.pushed = await cloudPushDocuments(config);
+  } catch (err) {
+    logError(`[cloud-sync] Documents push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const pullResult2 = await cloudPullDocuments(config);
+    documentsResult.pulled = pullResult2.pulled;
+  } catch (err) {
+    logError(`[cloud-sync] Documents pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return {
+    pushed,
+    pulled,
+    behaviors: behaviorsResult,
+    graphrag: graphragResult,
+    tasks: tasksResult,
+    conversations: conversationsResult,
+    documents: documentsResult
+  };
+}
+function recordRosterDeletion(name) {
+  let deletions = [];
+  try {
+    if (existsSync7(ROSTER_DELETIONS_PATH)) {
+      deletions = JSON.parse(readFileSync5(ROSTER_DELETIONS_PATH, "utf-8"));
+    }
+  } catch {
+  }
+  if (!deletions.includes(name)) deletions.push(name);
+  writeFileSync2(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
+}
+function consumeRosterDeletions() {
+  try {
+    if (!existsSync7(ROSTER_DELETIONS_PATH)) return [];
+    const deletions = JSON.parse(readFileSync5(ROSTER_DELETIONS_PATH, "utf-8"));
+    writeFileSync2(ROSTER_DELETIONS_PATH, "[]");
+    return deletions;
+  } catch {
+    return [];
+  }
+}
+function buildRosterBlob(paths) {
+  const rosterPath = paths?.rosterPath ?? path7.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path7.join(EXE_AI_DIR, "identity");
+  const configPath = paths?.configPath ?? path7.join(EXE_AI_DIR, "config.json");
+  let roster = [];
+  if (existsSync7(rosterPath)) {
+    try {
+      roster = JSON.parse(readFileSync5(rosterPath, "utf-8"));
+    } catch {
+    }
+  }
+  const identities = {};
+  if (existsSync7(identityDir)) {
+    for (const file of readdirSync(identityDir).filter((f) => f.endsWith(".md"))) {
+      try {
+        identities[file] = readFileSync5(path7.join(identityDir, file), "utf-8");
+      } catch {
+      }
+    }
+  }
+  let config;
+  if (existsSync7(configPath)) {
+    try {
+      config = JSON.parse(readFileSync5(configPath, "utf-8"));
+    } catch {
+    }
+  }
+  const deletedNames = consumeRosterDeletions();
+  const content = JSON.stringify({ roster, identities, config, deletedNames });
+  const hash = crypto2.createHash("sha256").update(content).digest("hex").slice(0, 16);
+  return { roster, identities, config, deletedNames, version: hash };
+}
+async function cloudPushRoster(config) {
+  assertSecureEndpoint(config.endpoint);
+  const blob = buildRosterBlob();
+  if (blob.roster.length === 0) return true;
+  try {
+    const client = getClient();
+    const meta = await client.execute(
+      "SELECT value FROM sync_meta WHERE key = 'last_roster_push_version'"
+    );
+    const lastVersion = meta.rows.length > 0 ? Number(meta.rows[0].value) : 0;
+    if (blob.version === lastVersion) return true;
+  } catch {
+  }
+  try {
+    const json = JSON.stringify(blob);
+    const compressed = compress(Buffer.from(json, "utf8"));
+    const encrypted = encryptSyncBlob(compressed);
+    const resp = await fetchWithRetry(`${config.endpoint}/sync/push-roster`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Device-Id": loadDeviceId()
+      },
+      body: JSON.stringify({ blob: encrypted })
+    });
+    if (resp.ok) {
+      try {
+        const client = getClient();
+        await client.execute({
+          sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_roster_push_version', ?)",
+          args: [String(blob.version)]
+        });
+      } catch {
+      }
+    }
+    return resp.ok;
+  } catch (err) {
+    process.stderr.write(`[cloud-sync] ROSTER PUSH FAILED: ${err instanceof Error ? err.message : String(err)}
+`);
+    return false;
+  }
+}
+async function cloudPullRoster(config) {
+  assertSecureEndpoint(config.endpoint);
+  try {
+    const resp = await fetchWithRetry(`${config.endpoint}/sync/pull-roster`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "X-Device-Id": loadDeviceId()
+      }
+    });
+    if (!resp.ok) return { added: 0 };
+    const data = await resp.json();
+    if (!data.blob) return { added: 0 };
+    const compressed = decryptSyncBlob(data.blob);
+    const json = decompress(compressed).toString("utf8");
+    const remote = JSON.parse(json);
+    return mergeRosterFromRemote(remote);
+  } catch (err) {
+    process.stderr.write(`[cloud-sync] ROSTER PULL FAILED: ${err instanceof Error ? err.message : String(err)}
+`);
+    return { added: 0 };
+  }
+}
+function mergeConfig(remoteConfig, configPath) {
+  const cfgPath = configPath ?? path7.join(EXE_AI_DIR, "config.json");
+  let local = {};
+  if (existsSync7(cfgPath)) {
+    try {
+      local = JSON.parse(readFileSync5(cfgPath, "utf-8"));
+    } catch {
+    }
+  }
+  const merged = { ...remoteConfig, ...local };
+  const dir = path7.dirname(cfgPath);
+  if (!existsSync7(dir)) mkdirSync2(dir, { recursive: true });
+  writeFileSync2(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
+}
+async function mergeRosterFromRemote(remote, paths) {
+  return withRosterLock(async () => {
+    const rosterPath = paths?.rosterPath ?? void 0;
+    const identityDir = paths?.identityDir ?? path7.join(EXE_AI_DIR, "identity");
+    const localEmployees = await loadEmployees(rosterPath);
+    const localNames = new Set(localEmployees.map((e) => e.name));
+    let added = 0;
+    let identitiesUpdated = 0;
+    for (const remoteEmp of remote.roster) {
+      if (!localNames.has(remoteEmp.name)) {
+        localEmployees.push(remoteEmp);
+        localNames.add(remoteEmp.name);
+        added++;
+        try {
+          registerBinSymlinks(remoteEmp.name);
+        } catch {
+        }
+      }
+      const remoteIdentity = remote.identities[`${remoteEmp.name}.md`];
+      if (remoteIdentity) {
+        if (!existsSync7(identityDir)) mkdirSync2(identityDir, { recursive: true });
+        const idPath = path7.join(identityDir, `${remoteEmp.name}.md`);
+        let localIdentity = null;
+        try {
+          localIdentity = existsSync7(idPath) ? readFileSync5(idPath, "utf-8") : null;
+        } catch {
+        }
+        if (localIdentity !== remoteIdentity) {
+          writeFileSync2(idPath, remoteIdentity, "utf-8");
+          identitiesUpdated++;
+        }
+      }
+    }
+    let removed = 0;
+    if (remote.deletedNames && remote.deletedNames.length > 0) {
+      const toRemove = new Set(remote.deletedNames);
+      const filtered = localEmployees.filter((e) => !toRemove.has(e.name));
+      removed = localEmployees.length - filtered.length;
+      if (removed > 0) {
+        localEmployees.length = 0;
+        localEmployees.push(...filtered);
+      }
+    }
+    if (added > 0 || removed > 0) {
+      await saveEmployees(localEmployees, rosterPath);
+    }
+    if (remote.config && Object.keys(remote.config).length > 0) {
+      try {
+        mergeConfig(remote.config, paths?.configPath);
+      } catch {
+      }
+    }
+    return { added, identitiesUpdated };
+  });
+}
+async function cloudPushBlob(route, data, metaKey, config) {
+  if (data.length === 0) return { ok: true };
+  assertSecureEndpoint(config.endpoint);
+  const json = JSON.stringify(data);
+  const version = Buffer.from(json).length;
+  try {
+    const client = getClient();
+    const meta = await client.execute({
+      sql: "SELECT value FROM sync_meta WHERE key = ?",
+      args: [metaKey]
+    });
+    const lastVersion = meta.rows.length > 0 ? Number(meta.rows[0].value) : 0;
+    if (version === lastVersion) return { ok: true };
+  } catch {
+  }
+  try {
+    const compressed = compress(Buffer.from(json, "utf8"));
+    const encrypted = encryptSyncBlob(compressed);
+    const resp = await fetchWithRetry(`${config.endpoint}${route}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Device-Id": loadDeviceId()
+      },
+      body: JSON.stringify({ blob: encrypted })
+    });
+    if (resp.ok) {
+      try {
+        const client = getClient();
+        await client.execute({
+          sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES (?, ?)",
+          args: [metaKey, String(version)]
+        });
+      } catch {
+      }
+    }
+    return { ok: resp.ok };
+  } catch (err) {
+    logError(`[cloud-sync] PUSH ${route}: ${err instanceof Error ? err.message : String(err)}`);
+    return { ok: false };
+  }
+}
+async function cloudPullBlob(route, config) {
+  assertSecureEndpoint(config.endpoint);
+  try {
+    const resp = await fetchWithRetry(`${config.endpoint}${route}`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "X-Device-Id": loadDeviceId()
+      }
+    });
+    if (!resp.ok) return null;
+    const data = await resp.json();
+    if (!data.blob) return null;
+    const compressed = decryptSyncBlob(data.blob);
+    const json = decompress(compressed).toString("utf8");
+    return JSON.parse(json);
+  } catch (err) {
+    logError(`[cloud-sync] PULL ${route}: ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+async function cloudPushGlobalProcedures(config) {
+  const client = getClient();
+  const result = await client.execute("SELECT * FROM global_procedures LIMIT 1000");
+  const rows = result.rows;
+  const { ok } = await cloudPushBlob(
+    "/sync/push-global-procedures",
+    rows,
+    "last_global_procedures_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullGlobalProcedures(config) {
+  const remoteProcs = await cloudPullBlob(
+    "/sync/pull-global-procedures",
+    config
+  );
+  if (!remoteProcs || remoteProcs.length === 0) return { pulled: 0 };
+  const client = getClient();
+  const stmts = remoteProcs.map((p) => ({
+    sql: `INSERT INTO global_procedures
+          (id, title, content, priority, domain, active, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(id) DO UPDATE SET
+            title = excluded.title,
+            content = excluded.content,
+            priority = excluded.priority,
+            domain = excluded.domain,
+            active = excluded.active,
+            updated_at = excluded.updated_at
+          WHERE excluded.updated_at > global_procedures.updated_at`,
+    args: [
+      sqlSafe(p.id),
+      sqlSafe(p.title),
+      sqlSafe(p.content),
+      sqlSafe(p.priority ?? "p0"),
+      sqlSafe(p.domain),
+      sqlSafe(p.active ?? 1),
+      sqlSafe(p.created_at),
+      sqlSafe(p.updated_at)
+    ]
+  }));
+  await client.batch(stmts, "write");
+  return { pulled: remoteProcs.length };
+}
+async function cloudPushBehaviors(config) {
+  const client = getClient();
+  const result = await client.execute("SELECT * FROM behaviors LIMIT 10000");
+  const rows = result.rows;
+  const { ok } = await cloudPushBlob(
+    "/sync/push-behaviors",
+    rows,
+    "last_behaviors_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullBehaviors(config) {
+  const remoteBehaviors = await cloudPullBlob(
+    "/sync/pull-behaviors",
+    config
+  );
+  if (!remoteBehaviors || remoteBehaviors.length === 0) return { pulled: 0 };
+  const client = getClient();
+  let pulled = 0;
+  for (const behavior of remoteBehaviors) {
+    const existing = await client.execute({
+      sql: `SELECT COUNT(*) as cnt FROM behaviors
+            WHERE agent_id = ? AND content = ?`,
+      args: [sqlSafe(behavior.agent_id), sqlSafe(behavior.content)]
+    });
+    if (Number(existing.rows[0]?.cnt) > 0) continue;
+    await client.execute({
+      sql: `INSERT OR IGNORE INTO behaviors
+            (id, agent_id, project_name, domain, content, active, priority, created_at, updated_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        sqlSafe(behavior.id),
+        sqlSafe(behavior.agent_id),
+        sqlSafe(behavior.project_name),
+        sqlSafe(behavior.domain),
+        sqlSafe(behavior.content),
+        sqlSafe(behavior.active ?? 1),
+        sqlSafe(behavior.priority ?? "p1"),
+        sqlSafe(behavior.created_at),
+        sqlSafe(behavior.updated_at)
+      ]
+    });
+    pulled++;
+  }
+  return { pulled };
+}
+async function cloudPushGraphRAG(config) {
+  const client = getClient();
+  const [entities, relationships, aliases, entityMems, relMems, hyperedges, hyperedgeNodes] = await Promise.all([
+    client.execute("SELECT * FROM entities LIMIT 50000"),
+    client.execute("SELECT * FROM relationships LIMIT 50000"),
+    client.execute("SELECT * FROM entity_aliases LIMIT 50000"),
+    client.execute("SELECT * FROM entity_memories LIMIT 50000"),
+    client.execute("SELECT * FROM relationship_memories LIMIT 50000"),
+    client.execute("SELECT * FROM hyperedges LIMIT 50000"),
+    client.execute("SELECT * FROM hyperedge_nodes LIMIT 50000")
+  ]);
+  const blob = {
+    entities: entities.rows,
+    relationships: relationships.rows,
+    entity_aliases: aliases.rows,
+    entity_memories: entityMems.rows,
+    relationship_memories: relMems.rows,
+    hyperedges: hyperedges.rows,
+    hyperedge_nodes: hyperedgeNodes.rows
+  };
+  const { ok } = await cloudPushBlob(
+    "/sync/push-graphrag",
+    [blob],
+    "last_graphrag_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullGraphRAG(config) {
+  const data = await cloudPullBlob(
+    "/sync/pull-graphrag",
+    config
+  );
+  if (!data || data.length === 0) return { pulled: 0 };
+  const blob = data[0];
+  const client = getClient();
+  let pulled = 0;
+  if (blob.entities.length > 0) {
+    const stmts = blob.entities.map((e) => ({
+      sql: `INSERT OR IGNORE INTO entities (id, name, type, first_seen, last_seen, properties)
+            VALUES (?, ?, ?, ?, ?, ?)`,
+      args: [sqlSafe(e.id), sqlSafe(e.name), sqlSafe(e.type), sqlSafe(e.first_seen), sqlSafe(e.last_seen), sqlSafe(e.properties ?? "{}")]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.relationships.length > 0) {
+    const stmts = blob.relationships.map((r) => ({
+      sql: `INSERT OR IGNORE INTO relationships
+            (id, source_entity_id, target_entity_id, type, weight, timestamp, properties, confidence, confidence_label)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        sqlSafe(r.id),
+        sqlSafe(r.source_entity_id),
+        sqlSafe(r.target_entity_id),
+        sqlSafe(r.type),
+        sqlSafe(r.weight ?? 1),
+        sqlSafe(r.timestamp),
+        sqlSafe(r.properties ?? "{}"),
+        sqlSafe(r.confidence ?? 1),
+        sqlSafe(r.confidence_label ?? "extracted")
+      ]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.entity_aliases.length > 0) {
+    const stmts = blob.entity_aliases.map((a) => ({
+      sql: `INSERT OR IGNORE INTO entity_aliases (alias, canonical_entity_id) VALUES (?, ?)`,
+      args: [sqlSafe(a.alias), sqlSafe(a.canonical_entity_id)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.entity_memories.length > 0) {
+    const stmts = blob.entity_memories.map((em) => ({
+      sql: `INSERT OR IGNORE INTO entity_memories (entity_id, memory_id) VALUES (?, ?)`,
+      args: [sqlSafe(em.entity_id), sqlSafe(em.memory_id)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.relationship_memories.length > 0) {
+    const stmts = blob.relationship_memories.map((rm) => ({
+      sql: `INSERT OR IGNORE INTO relationship_memories (relationship_id, memory_id) VALUES (?, ?)`,
+      args: [sqlSafe(rm.relationship_id), sqlSafe(rm.memory_id)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.hyperedges.length > 0) {
+    const stmts = blob.hyperedges.map((h) => ({
+      sql: `INSERT OR IGNORE INTO hyperedges (id, label, relation, confidence, timestamp)
+            VALUES (?, ?, ?, ?, ?)`,
+      args: [sqlSafe(h.id), sqlSafe(h.label), sqlSafe(h.relation), sqlSafe(h.confidence ?? 1), sqlSafe(h.timestamp)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.hyperedge_nodes.length > 0) {
+    const stmts = blob.hyperedge_nodes.map((hn) => ({
+      sql: `INSERT OR IGNORE INTO hyperedge_nodes (hyperedge_id, entity_id) VALUES (?, ?)`,
+      args: [sqlSafe(hn.hyperedge_id), sqlSafe(hn.entity_id)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  return { pulled };
+}
+async function cloudPushTasks(config) {
+  const client = getClient();
+  const result = await client.execute("SELECT * FROM tasks LIMIT 10000");
+  const rows = result.rows;
+  const { ok } = await cloudPushBlob(
+    "/sync/push-tasks",
+    rows,
+    "last_tasks_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullTasks(config) {
+  const remoteTasks = await cloudPullBlob(
+    "/sync/pull-tasks",
+    config
+  );
+  if (!remoteTasks || remoteTasks.length === 0) return { pulled: 0 };
+  const client = getClient();
+  const stmts = remoteTasks.map((t) => ({
+    sql: `INSERT OR IGNORE INTO tasks
+          (id, title, assigned_to, assigned_by, project_name, priority, status, task_file, created_at, updated_at,
+           blocked_by, parent_task_id, budget_tokens, budget_fallback_model, tokens_used, tokens_warned_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    args: [
+      sqlSafe(t.id),
+      sqlSafe(t.title),
+      sqlSafe(t.assigned_to),
+      sqlSafe(t.assigned_by),
+      sqlSafe(t.project_name),
+      sqlSafe(t.priority ?? "p1"),
+      sqlSafe(t.status ?? "open"),
+      sqlSafe(t.task_file),
+      sqlSafe(t.created_at),
+      sqlSafe(t.updated_at),
+      sqlSafe(t.blocked_by),
+      sqlSafe(t.parent_task_id),
+      sqlSafe(t.budget_tokens),
+      sqlSafe(t.budget_fallback_model),
+      sqlSafe(t.tokens_used ?? 0),
+      sqlSafe(t.tokens_warned_at)
+    ]
+  }));
+  await client.batch(stmts, "write");
+  return { pulled: remoteTasks.length };
+}
+async function cloudPushConversations(config) {
+  const client = getClient();
+  const result = await client.execute("SELECT * FROM conversations LIMIT 50000");
+  const rows = result.rows;
+  const { ok } = await cloudPushBlob(
+    "/sync/push-conversations",
+    rows,
+    "last_conversations_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullConversations(config) {
+  const remoteConvos = await cloudPullBlob(
+    "/sync/pull-conversations",
+    config
+  );
+  if (!remoteConvos || remoteConvos.length === 0) return { pulled: 0 };
+  const client = getClient();
+  const stmts = remoteConvos.map((c) => ({
+    sql: `INSERT OR IGNORE INTO conversations
+          (id, platform, external_id, sender_id, sender_name, sender_phone, sender_email,
+           recipient_id, channel_id, thread_id, reply_to_id, content_text, content_media,
+           content_metadata, agent_response, agent_name, timestamp, ingested_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    args: [
+      sqlSafe(c.id),
+      sqlSafe(c.platform),
+      sqlSafe(c.external_id),
+      sqlSafe(c.sender_id),
+      sqlSafe(c.sender_name),
+      sqlSafe(c.sender_phone),
+      sqlSafe(c.sender_email),
+      sqlSafe(c.recipient_id),
+      sqlSafe(c.channel_id),
+      sqlSafe(c.thread_id),
+      sqlSafe(c.reply_to_id),
+      sqlSafe(c.content_text),
+      sqlSafe(c.content_media),
+      sqlSafe(c.content_metadata),
+      sqlSafe(c.agent_response),
+      sqlSafe(c.agent_name),
+      sqlSafe(c.timestamp),
+      sqlSafe(c.ingested_at)
+    ]
+  }));
+  await client.batch(stmts, "write");
+  return { pulled: remoteConvos.length };
+}
+async function cloudPushDocuments(config) {
+  const client = getClient();
+  const [workspaces, documents] = await Promise.all([
+    client.execute("SELECT * FROM workspaces LIMIT 1000"),
+    client.execute("SELECT * FROM documents LIMIT 10000")
+  ]);
+  const blob = {
+    workspaces: workspaces.rows,
+    documents: documents.rows
+  };
+  const { ok } = await cloudPushBlob(
+    "/sync/push-documents",
+    [blob],
+    "last_documents_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullDocuments(config) {
+  const data = await cloudPullBlob(
+    "/sync/pull-documents",
+    config
+  );
+  if (!data || data.length === 0) return { pulled: 0 };
+  const blob = data[0];
+  const client = getClient();
+  let pulled = 0;
+  if (blob.workspaces.length > 0) {
+    const stmts = blob.workspaces.map((w) => ({
+      sql: `INSERT OR IGNORE INTO workspaces (id, slug, name, owner_agent_id, created_at, metadata)
+            VALUES (?, ?, ?, ?, ?, ?)`,
+      args: [sqlSafe(w.id), sqlSafe(w.slug), sqlSafe(w.name), sqlSafe(w.owner_agent_id), sqlSafe(w.created_at), sqlSafe(w.metadata)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.documents.length > 0) {
+    const stmts = blob.documents.map((d) => ({
+      sql: `INSERT OR IGNORE INTO documents
+            (id, workspace_id, filename, mime, source_type, user_id, uploaded_at, metadata)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        sqlSafe(d.id),
+        sqlSafe(d.workspace_id),
+        sqlSafe(d.filename),
+        sqlSafe(d.mime),
+        sqlSafe(d.source_type),
+        sqlSafe(d.user_id),
+        sqlSafe(d.uploaded_at),
+        sqlSafe(d.metadata)
+      ]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  return { pulled };
+}
+var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, ROSTER_DELETIONS_PATH;
+var init_cloud_sync = __esm({
+  "src/lib/cloud-sync.ts"() {
     "use strict";
-    init_db_retry();
-    _resilientClient = null;
+    init_database();
+    init_crypto();
+    init_compress();
+    init_license();
+    init_config();
+    init_employees();
+    LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
+    FETCH_TIMEOUT_MS = 3e4;
+    PUSH_BATCH_SIZE = 5e3;
+    ROSTER_LOCK_PATH = path7.join(EXE_AI_DIR, "roster-merge.lock");
+    LOCK_STALE_MS = 3e4;
+    ROSTER_DELETIONS_PATH = path7.join(EXE_AI_DIR, "roster-deletions.json");
   }
 });
 
@@ -1990,17 +3170,17 @@ __export(identity_exports, {
   listIdentities: () => listIdentities,
   updateIdentity: () => updateIdentity
 });
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { readdirSync } from "fs";
-import path7 from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { readdirSync as readdirSync2 } from "fs";
+import path8 from "path";
 import { createHash as createHash2 } from "crypto";
 function ensureDir() {
-  if (!existsSync7(IDENTITY_DIR)) {
-    mkdirSync2(IDENTITY_DIR, { recursive: true });
+  if (!existsSync8(IDENTITY_DIR)) {
+    mkdirSync3(IDENTITY_DIR, { recursive: true });
   }
 }
 function identityPath(agentId) {
-  return path7.join(IDENTITY_DIR, `${agentId}.md`);
+  return path8.join(IDENTITY_DIR, `${agentId}.md`);
 }
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
@@ -2041,8 +3221,8 @@ function contentHash(content) {
 }
 function getIdentity(agentId) {
   const filePath = identityPath(agentId);
-  if (!existsSync7(filePath)) return null;
-  const raw = readFileSync5(filePath, "utf-8");
+  if (!existsSync8(filePath)) return null;
+  const raw = readFileSync6(filePath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(raw);
   return {
     agentId,
@@ -2056,7 +3236,7 @@ async function updateIdentity(agentId, content, updatedBy) {
   ensureDir();
   const filePath = identityPath(agentId);
   const hash = contentHash(content);
-  writeFileSync2(filePath, content, "utf-8");
+  writeFileSync3(filePath, content, "utf-8");
   try {
     const client = getClient();
     await client.execute({
@@ -2073,7 +3253,7 @@ async function updateIdentity(agentId, content, updatedBy) {
 }
 function listIdentities() {
   ensureDir();
-  const files = readdirSync(IDENTITY_DIR).filter((f) => f.endsWith(".md"));
+  const files = readdirSync2(IDENTITY_DIR).filter((f) => f.endsWith(".md"));
   const results = [];
   for (const file of files) {
     const agentId = file.replace(".md", "");
@@ -2112,7 +3292,7 @@ var init_identity = __esm({
     "use strict";
     init_config();
     init_database();
-    IDENTITY_DIR = path7.join(EXE_AI_DIR, "identity");
+    IDENTITY_DIR = path8.join(EXE_AI_DIR, "identity");
   }
 });
 
@@ -2646,73 +3826,129 @@ ${PLAN_MODE_COMPAT}
   }
 });
 
-// src/lib/setup-wizard.ts
-init_config();
-import crypto2 from "crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3 } from "fs";
-import os3 from "os";
-import path8 from "path";
-import { createInterface } from "readline";
-
-// src/lib/keychain.ts
-import { readFile as readFile2, writeFile as writeFile2, unlink, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
-import path2 from "path";
-import os2 from "os";
-import crypto from "crypto";
-var SERVICE = "exe-mem";
-var ACCOUNT = "master-key";
-function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path2.join(os2.homedir(), ".exe-os");
-}
-function getKeyPath() {
-  return path2.join(getKeyDir(), "master.key");
-}
-async function tryKeytar() {
+// src/lib/session-wrappers.ts
+var session_wrappers_exports = {};
+__export(session_wrappers_exports, {
+  generateSessionWrappers: () => generateSessionWrappers
+});
+import {
+  existsSync as existsSync9,
+  readFileSync as readFileSync7,
+  writeFileSync as writeFileSync4,
+  mkdirSync as mkdirSync4,
+  chmodSync,
+  readdirSync as readdirSync3,
+  unlinkSync as unlinkSync4
+} from "fs";
+import path9 from "path";
+import { homedir as homedir2 } from "os";
+function generateSessionWrappers(packageRoot, homeDir) {
+  const home = homeDir ?? homedir2();
+  const binDir = path9.join(home, ".exe-os", "bin");
+  const rosterPath = path9.join(home, ".exe-os", "exe-employees.json");
+  mkdirSync4(binDir, { recursive: true });
+  const exeStartDst = path9.join(binDir, "exe-start");
+  const candidates = [
+    path9.join(packageRoot, "dist", "bin", "exe-start.sh"),
+    path9.join(packageRoot, "src", "bin", "exe-start.sh")
+  ];
+  for (const src of candidates) {
+    if (existsSync9(src)) {
+      writeFileSync4(exeStartDst, readFileSync7(src));
+      chmodSync(exeStartDst, 493);
+      break;
+    }
+  }
+  let employees = [];
   try {
-    return await import("keytar");
+    employees = JSON.parse(readFileSync7(rosterPath, "utf8"));
   } catch {
-    return null;
+    return { created: 0, pathConfigured: false };
   }
-}
-async function getMasterKey() {
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
-      if (stored) {
-        return Buffer.from(stored, "base64");
-      }
-    } catch {
-    }
-  }
-  const keyPath = getKeyPath();
-  if (!existsSync2(keyPath)) {
-    return null;
+  if (employees.length === 0) {
+    return { created: 0, pathConfigured: false };
   }
   try {
-    const content = await readFile2(keyPath, "utf-8");
-    return Buffer.from(content.trim(), "base64");
+    for (const f of readdirSync3(binDir)) {
+      if (f === "exe-start") continue;
+      const fPath = path9.join(binDir, f);
+      try {
+        const content = readFileSync7(fPath, "utf8");
+        if (content.includes("exe-start")) {
+          unlinkSync4(fPath);
+        }
+      } catch {
+      }
+    }
   } catch {
-    return null;
   }
+  let created = 0;
+  const wrapperContent = `#!/bin/bash
+exec "${exeStartDst}" "$0" "$@"
+`;
+  for (const emp of employees) {
+    for (let n = 1; n <= MAX_N; n++) {
+      const wrapperPath = path9.join(binDir, `${emp.name}${n}`);
+      writeFileSync4(wrapperPath, wrapperContent);
+      chmodSync(wrapperPath, 493);
+      created++;
+    }
+  }
+  const pathConfigured = ensurePath(home, binDir);
+  return { created, pathConfigured };
 }
-async function setMasterKey(key) {
-  const b64 = key.toString("base64");
-  const keytar = await tryKeytar();
-  if (keytar) {
+function ensurePath(home, binDir) {
+  if (process.env.PATH?.split(":").includes(binDir)) {
+    return false;
+  }
+  const exportLine = `
+# exe-os session commands
+export PATH="${binDir}:$PATH"
+`;
+  const shell = process.env.SHELL ?? "/bin/bash";
+  const profilePaths = [];
+  if (shell.includes("zsh")) {
+    profilePaths.push(path9.join(home, ".zshrc"));
+  } else if (shell.includes("bash")) {
+    profilePaths.push(path9.join(home, ".bashrc"));
+    profilePaths.push(path9.join(home, ".bash_profile"));
+  } else {
+    profilePaths.push(path9.join(home, ".profile"));
+  }
+  for (const profilePath of profilePaths) {
     try {
-      await keytar.setPassword(SERVICE, ACCOUNT, b64);
-      return;
+      let content = "";
+      try {
+        content = readFileSync7(profilePath, "utf8");
+      } catch {
+      }
+      if (content.includes(".exe-os/bin")) {
+        return false;
+      }
+      writeFileSync4(profilePath, content + exportLine);
+      return true;
     } catch {
+      continue;
     }
   }
-  const dir = getKeyDir();
-  await mkdir2(dir, { recursive: true });
-  const keyPath = getKeyPath();
-  await writeFile2(keyPath, b64 + "\n", "utf-8");
-  await chmod2(keyPath, 384);
+  return false;
 }
+var MAX_N;
+var init_session_wrappers = __esm({
+  "src/lib/session-wrappers.ts"() {
+    "use strict";
+    MAX_N = 9;
+  }
+});
+
+// src/lib/setup-wizard.ts
+init_config();
+init_keychain();
+import crypto3 from "crypto";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5, unlinkSync as unlinkSync5 } from "fs";
+import os3 from "os";
+import path10 from "path";
+import { createInterface } from "readline";
 
 // src/lib/model-downloader.ts
 import { createWriteStream, createReadStream, existsSync as existsSync3, unlinkSync, renameSync as renameSync2 } from "fs";
@@ -2802,21 +4038,37 @@ async function fileHash(filePath) {
 }
 
 // src/lib/setup-wizard.ts
-var SETUP_STATE_PATH = path8.join(os3.homedir(), ".exe-os", "setup-state.json");
+function findPackageRoot2() {
+  let dir = path10.dirname(new URL(import.meta.url).pathname);
+  const root = path10.parse(dir).root;
+  while (dir !== root) {
+    const pkgPath = path10.join(dir, "package.json");
+    if (existsSync10(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+        if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
+      } catch {
+      }
+    }
+    dir = path10.dirname(dir);
+  }
+  return null;
+}
+var SETUP_STATE_PATH = path10.join(os3.homedir(), ".exe-os", "setup-state.json");
 function loadSetupState() {
   try {
-    return JSON.parse(readFileSync6(SETUP_STATE_PATH, "utf8"));
+    return JSON.parse(readFileSync8(SETUP_STATE_PATH, "utf8"));
   } catch {
     return { completedSteps: [], startedAt: (/* @__PURE__ */ new Date()).toISOString() };
   }
 }
 function saveSetupState(state) {
-  mkdirSync3(path8.dirname(SETUP_STATE_PATH), { recursive: true });
-  writeFileSync3(SETUP_STATE_PATH, JSON.stringify(state, null, 2));
+  mkdirSync5(path10.dirname(SETUP_STATE_PATH), { recursive: true });
+  writeFileSync5(SETUP_STATE_PATH, JSON.stringify(state, null, 2));
 }
 function clearSetupState() {
   try {
-    unlinkSync3(SETUP_STATE_PATH);
+    unlinkSync5(SETUP_STATE_PATH);
   } catch {
   }
 }
@@ -2850,20 +4102,67 @@ async function runSetupWizard(opts = {}) {
     log("");
     log("=== exe-os Setup ===");
     log("");
-    log("Already set up on another device?");
-    log("  Run `exe-link` to sync your encryption key and skip setup.");
+    log("Is this a new installation or pairing with an existing device?");
     log("");
-    const skipSetup = await ask(rl, "Fresh install? (Y/n): ");
-    if (skipSetup.toLowerCase() === "n") {
-      log("Run `exe-link` to import your encryption key from another device.");
-      rl.close();
-      return;
+    log("  [1] New installation (first device)");
+    log("  [2] Pair with existing device (I have a 24-word phrase)");
+    log("");
+    const installType = await ask(rl, "Choice (1/2): ");
+    let isPairing = false;
+    let pairingRosterPulled = false;
+    if (installType === "2") {
+      isPairing = true;
+      log("");
+      const { importMnemonic: importMnemonic2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
+      const mnemonic = await ask(rl, "Paste your 24-word recovery phrase: ");
+      try {
+        const key = await importMnemonic2(mnemonic);
+        await setMasterKey(key);
+        log("Master key imported and stored securely.");
+        log("");
+        log("Enter the API key from your existing device.");
+        log("(Find it in ~/.exe-os/config.json under cloud.apiKey, or ask your team lead.)");
+        log("");
+        const apiKey = await ask(rl, "API key (exe_sk_...): ");
+        if (apiKey && apiKey.startsWith("exe_sk_")) {
+          const cloudEndpoint = "https://askexe.com/cloud";
+          const cloudCfg = { apiKey, endpoint: cloudEndpoint };
+          const earlyConfig = await loadConfig();
+          earlyConfig.cloud = cloudCfg;
+          await saveConfig(earlyConfig);
+          const { saveLicense: saveLic, mirrorLicenseKey: mirrorLic } = await Promise.resolve().then(() => (init_license(), license_exports));
+          saveLic(apiKey);
+          mirrorLic(apiKey);
+          log("Cloud sync configured.");
+          try {
+            const { initSyncCrypto: initSyncCrypto2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
+            const { cloudPullRoster: cloudPullRoster2 } = await Promise.resolve().then(() => (init_cloud_sync(), cloud_sync_exports));
+            initSyncCrypto2(key);
+            const result = await cloudPullRoster2({ apiKey, endpoint: cloudEndpoint });
+            if (result.added > 0) {
+              log(`Pulled ${result.added} employee(s) from Exe Cloud.`);
+              pairingRosterPulled = true;
+            }
+          } catch {
+            log("Could not pull roster from cloud \u2014 you can set up employees manually.");
+          }
+        } else {
+          log("No API key provided \u2014 cloud sync will need to be configured later.");
+          log("Run /exe-cloud after setup to connect.");
+        }
+        log("");
+      } catch (err) {
+        log(`Key import failed: ${err instanceof Error ? err.message : String(err)}`);
+        log("Check your phrase and try again, or choose option 1 for a fresh install.");
+        rl.close();
+        return;
+      }
     }
     const state = loadSetupState();
     if (state.completedSteps.length > 0) {
       log(`Resuming setup from step ${Math.max(...state.completedSteps) + 1}...`);
     }
-    if (existsSync8(LEGACY_LANCE_PATH)) {
+    if (existsSync10(LEGACY_LANCE_PATH)) {
       log("\u26A0 Found v1.0 LanceDB at ~/.exe-os/local.lance");
       log("  v1.1 uses libSQL (SQLite). Your existing memories are not automatically migrated.");
       log("  The old directory will not be modified or deleted.");
@@ -2875,7 +4174,7 @@ async function runSetupWizard(opts = {}) {
         log("Encryption key already exists \u2014 skipping generation.");
       } else {
         log("Generating 256-bit encryption key...");
-        const key = crypto2.randomBytes(32);
+        const key = crypto3.randomBytes(32);
         await setMasterKey(key);
         log("Encryption key generated and stored securely.");
       }
@@ -2886,7 +4185,15 @@ async function runSetupWizard(opts = {}) {
     }
     log("");
     let cloudConfig;
-    if (!state.completedSteps.includes(2)) {
+    if (isPairing) {
+      const pairingConfig = await loadConfig();
+      if (pairingConfig.cloud?.apiKey) {
+        cloudConfig = pairingConfig.cloud;
+        log("Cloud sync: using shared API key from pairing.");
+      }
+      state.completedSteps.push(2);
+      saveSetupState(state);
+    } else if (!state.completedSteps.includes(2)) {
       log("Exe Cloud: your memories are end-to-end encrypted, compressed, and");
       log("backed up on Exe Cloud. Free for all plans. We can't read your data \u2014");
       log("only your encryption key can decrypt it.");
@@ -2967,10 +4274,10 @@ async function runSetupWizard(opts = {}) {
       await saveConfig(config);
       log("");
       try {
-        const claudeJsonPath = path8.join(os3.homedir(), ".claude.json");
+        const claudeJsonPath = path10.join(os3.homedir(), ".claude.json");
         let claudeJson = {};
         try {
-          claudeJson = JSON.parse(readFileSync6(claudeJsonPath, "utf8"));
+          claudeJson = JSON.parse(readFileSync8(claudeJsonPath, "utf8"));
         } catch {
         }
         if (!claudeJson.projects) claudeJson.projects = {};
@@ -2979,7 +4286,7 @@ async function runSetupWizard(opts = {}) {
           if (!projects[dir]) projects[dir] = {};
           projects[dir].hasTrustDialogAccepted = true;
         }
-        writeFileSync3(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
+        writeFileSync5(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
       } catch {
       }
       state.completedSteps.push(5);
@@ -3005,7 +4312,34 @@ async function runSetupWizard(opts = {}) {
     } = await Promise.resolve().then(() => (init_license(), license_exports));
     const createdEmployees = [];
     let cooName = "exe";
-    if (!state.completedSteps.includes(6)) {
+    if (pairingRosterPulled) {
+      const roster = await loadEmployees2(EMPLOYEES_PATH2).catch(() => []);
+      const existingCoo = roster.find((e) => e.role === "COO");
+      if (existingCoo) {
+        cooName = existingCoo.name;
+        log(`Team synced from cloud. COO: ${cooName}`);
+        const teamList = roster.map((e) => `${e.name} (${e.role})`).join(", ");
+        log(`Team: ${teamList}`);
+        createdEmployees.push(...roster.map((e) => ({ name: e.name, role: e.role })));
+      }
+      for (const emp of roster) {
+        registerBinSymlinks2(emp.name);
+      }
+      try {
+        const { generateSessionWrappers: generateSessionWrappers2 } = await Promise.resolve().then(() => (init_session_wrappers(), session_wrappers_exports));
+        const pkgRoot = findPackageRoot2();
+        if (pkgRoot) {
+          const wrapResult = generateSessionWrappers2(pkgRoot);
+          if (wrapResult.created > 0) {
+            log(`Session shortcuts generated: ${roster.map((e) => `${e.name}1`).join(", ")}, ...`);
+          }
+        }
+      } catch {
+      }
+      state.completedSteps.push(6, 7, 8);
+      saveSetupState(state);
+      log("");
+    } else if (!state.completedSteps.includes(6)) {
       log("=== Your Team ===");
       log("");
       log("Every install starts with a COO \u2014 your right-hand operator.");
@@ -3031,9 +4365,9 @@ async function runSetupWizard(opts = {}) {
       const cooIdentityContent = getIdentityTemplate("coo");
       if (cooIdentityContent) {
         const cooIdPath = identityPath2(cooName);
-        mkdirSync3(path8.dirname(cooIdPath), { recursive: true });
+        mkdirSync5(path10.dirname(cooIdPath), { recursive: true });
         const replaced = cooIdentityContent.replace(/agent_id:\s*exe/g, `agent_id: ${cooName}`).replace(/\$\{agent_id\}/g, cooName);
-        writeFileSync3(cooIdPath, replaced, "utf-8");
+        writeFileSync5(cooIdPath, replaced, "utf-8");
       }
       registerBinSymlinks2(cooName);
       createdEmployees.push({ name: cooName, role: "COO" });
@@ -3132,9 +4466,9 @@ async function runSetupWizard(opts = {}) {
           const ctoIdentityContent = getIdentityTemplate("cto");
           if (ctoIdentityContent) {
             const ctoIdPath = identityPath2(ctoName);
-            mkdirSync3(path8.dirname(ctoIdPath), { recursive: true });
+            mkdirSync5(path10.dirname(ctoIdPath), { recursive: true });
             const replaced = ctoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${ctoName}`).replace(/\$\{agent_id\}/g, ctoName);
-            writeFileSync3(ctoIdPath, replaced, "utf-8");
+            writeFileSync5(ctoIdPath, replaced, "utf-8");
           }
           registerBinSymlinks2(ctoName);
           createdEmployees.push({ name: ctoName, role: "CTO" });
@@ -3160,9 +4494,9 @@ async function runSetupWizard(opts = {}) {
           const cmoIdentityContent = getIdentityTemplate("cmo");
           if (cmoIdentityContent) {
             const cmoIdPath = identityPath2(cmoName);
-            mkdirSync3(path8.dirname(cmoIdPath), { recursive: true });
+            mkdirSync5(path10.dirname(cmoIdPath), { recursive: true });
             const replaced = cmoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${cmoName}`).replace(/\$\{agent_id\}/g, cmoName);
-            writeFileSync3(cmoIdPath, replaced, "utf-8");
+            writeFileSync5(cmoIdPath, replaced, "utf-8");
           }
           registerBinSymlinks2(cmoName);
           createdEmployees.push({ name: cmoName, role: "CMO" });
@@ -3175,11 +4509,24 @@ async function runSetupWizard(opts = {}) {
     } else {
       log("Step 8 already complete \u2014 skipping.");
     }
+    if (!pairingRosterPulled) {
+      try {
+        const { generateSessionWrappers: generateSessionWrappers2 } = await Promise.resolve().then(() => (init_session_wrappers(), session_wrappers_exports));
+        const pkgRoot = findPackageRoot2();
+        if (pkgRoot) {
+          const wrapResult = generateSessionWrappers2(pkgRoot);
+          if (wrapResult.created > 0) {
+            log(`Session shortcuts generated (${cooName}1, ${cooName}2, ...)`);
+          }
+        }
+      } catch {
+      }
+    }
     clearSetupState();
     log("=== Two Ways to Work ===");
     log("");
     log("  1. Claude Code mode");
-    log(`     Type \`${cooName}\` in your terminal. Works with your Claude Code subscription.`);
+    log(`     Type \`${cooName}1\` in your project folder. Works with your Claude Code subscription.`);
     log("     Best for developers who live in the terminal.");
     log("");
     log("  2. Dashboard mode");
@@ -3189,8 +4536,6 @@ async function runSetupWizard(opts = {}) {
     log("  Both modes share the same memory, employees, and data.");
     log("  You can switch anytime.");
     log("");
-    log("  For Claude Code mode, run: exe-os claude");
-    log("");
     log("=== Setup Complete ===");
     log("Database: " + config.dbPath);
     if (cloudConfig) {
@@ -3206,7 +4551,7 @@ async function runSetupWizard(opts = {}) {
       log("Team: " + createdEmployees.map((e) => `${e.name} (${e.role})`).join(", "));
     }
     log("");
-    log(`Type \`${cooName}\` to start (Claude Code) or \`exe-os\` for dashboard.`);
+    log(`Type \`${cooName}1\` to start (Claude Code) or \`exe-os\` for dashboard.`);
     log("");
   } finally {
     rl.close();