@askexenow/exe-os 0.8.75 → 0.8.77

package/dist/bin/cli.js

@@ -2801,6 +2801,19 @@ async function cloudPull(sinceVersion, config) {
   }
 }
 async function cloudSync(config) {
+  if (!isSyncCryptoInitialized()) {
+    try {
+      const { getMasterKey: getMasterKey2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
+      const masterKey = await getMasterKey2();
+      if (masterKey) {
+        initSyncCrypto(masterKey);
+      } else {
+        throw new Error("No master key found");
+      }
+    } catch (err) {
+      throw new Error(`[cloud-sync] Cannot initialize encryption: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   let client;
   try {
     client = getClient();
@@ -24846,6 +24859,16 @@ import { existsSync as existsSync23, readFileSync as readFileSync19, writeFileSy
 import path35 from "path";
 import os12 from "os";
 var args = process.argv.slice(2);
+if (args.includes("--version") || args.includes("-v")) {
+  try {
+    const pkgPath = path35.join(path35.dirname(new URL(import.meta.url).pathname), "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync19(pkgPath, "utf8"));
+    console.log(pkg.version);
+  } catch {
+    console.log("unknown");
+  }
+  process.exit(0);
+}
 if (args.includes("--global")) {
   process.stderr.write(
     "\x1B[33m[deprecated]\x1B[0m --global is deprecated. Use: exe-os claude install\n"

package/dist/bin/exe-boot.js

@@ -5865,6 +5865,19 @@ async function cloudPull(sinceVersion, config) {
   }
 }
 async function cloudSync(config) {
+  if (!isSyncCryptoInitialized()) {
+    try {
+      const { getMasterKey: getMasterKey2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
+      const masterKey = await getMasterKey2();
+      if (masterKey) {
+        initSyncCrypto(masterKey);
+      } else {
+        throw new Error("No master key found");
+      }
+    } catch (err) {
+      throw new Error(`[cloud-sync] Cannot initialize encryption: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   let client;
   try {
     client = getClient();

package/dist/bin/exe-cloud.js

@@ -15,6 +15,100 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/lib/keychain.ts
+import { readFile, writeFile, unlink, mkdir, chmod } from "fs/promises";
+import { existsSync } from "fs";
+import path from "path";
+import os from "os";
+function getKeyDir() {
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
+}
+function getKeyPath() {
+  return path.join(getKeyDir(), "master.key");
+}
+async function tryKeytar() {
+  try {
+    return await import("keytar");
+  } catch {
+    return null;
+  }
+}
+async function getMasterKey() {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
+      if (stored) {
+        return Buffer.from(stored, "base64");
+      }
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (!existsSync(keyPath)) {
+    return null;
+  }
+  try {
+    const content = await readFile(keyPath, "utf-8");
+    return Buffer.from(content.trim(), "base64");
+  } catch {
+    return null;
+  }
+}
+async function setMasterKey(key) {
+  const b64 = key.toString("base64");
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      await keytar.setPassword(SERVICE, ACCOUNT, b64);
+      return;
+    } catch {
+    }
+  }
+  const dir = getKeyDir();
+  await mkdir(dir, { recursive: true });
+  const keyPath = getKeyPath();
+  await writeFile(keyPath, b64 + "\n", "utf-8");
+  await chmod(keyPath, 384);
+}
+async function loadBip39() {
+  try {
+    return await import("bip39");
+  } catch {
+    throw new Error(
+      "bip39 package not found. Run: npm install -g bip39\nOr reinstall exe-os: npm install -g @askexenow/exe-os"
+    );
+  }
+}
+async function exportMnemonic(key) {
+  if (key.length !== 32) {
+    throw new Error(`Key must be 32 bytes, got ${key.length}`);
+  }
+  const { entropyToMnemonic } = await loadBip39();
+  return entropyToMnemonic(key.toString("hex"));
+}
+async function importMnemonic(mnemonic) {
+  const trimmed = mnemonic.trim();
+  const words = trimmed.split(/\s+/);
+  if (words.length !== 24) {
+    throw new Error(`Expected 24 words, got ${words.length}`);
+  }
+  const { validateMnemonic, mnemonicToEntropy } = await loadBip39();
+  if (!validateMnemonic(trimmed)) {
+    throw new Error("Invalid mnemonic \u2014 check for typos or missing words");
+  }
+  const entropy = mnemonicToEntropy(trimmed);
+  return Buffer.from(entropy, "hex");
+}
+var SERVICE, ACCOUNT;
+var init_keychain = __esm({
+  "src/lib/keychain.ts"() {
+    "use strict";
+    SERVICE = "exe-mem";
+    ACCOUNT = "master-key";
+  }
+});
+
 // src/lib/config.ts
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
 import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
@@ -601,98 +695,9 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
 });
 
 // src/bin/exe-cloud.ts
-import { createInterface } from "readline";
-
-// src/lib/keychain.ts
-import { readFile, writeFile, unlink, mkdir, chmod } from "fs/promises";
-import { existsSync } from "fs";
-import path from "path";
-import os from "os";
-var SERVICE = "exe-mem";
-var ACCOUNT = "master-key";
-function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
-}
-function getKeyPath() {
-  return path.join(getKeyDir(), "master.key");
-}
-async function tryKeytar() {
-  try {
-    return await import("keytar");
-  } catch {
-    return null;
-  }
-}
-async function getMasterKey() {
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
-      if (stored) {
-        return Buffer.from(stored, "base64");
-      }
-    } catch {
-    }
-  }
-  const keyPath = getKeyPath();
-  if (!existsSync(keyPath)) {
-    return null;
-  }
-  try {
-    const content = await readFile(keyPath, "utf-8");
-    return Buffer.from(content.trim(), "base64");
-  } catch {
-    return null;
-  }
-}
-async function setMasterKey(key) {
-  const b64 = key.toString("base64");
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      await keytar.setPassword(SERVICE, ACCOUNT, b64);
-      return;
-    } catch {
-    }
-  }
-  const dir = getKeyDir();
-  await mkdir(dir, { recursive: true });
-  const keyPath = getKeyPath();
-  await writeFile(keyPath, b64 + "\n", "utf-8");
-  await chmod(keyPath, 384);
-}
-async function loadBip39() {
-  try {
-    return await import("bip39");
-  } catch {
-    throw new Error(
-      "bip39 package not found. Run: npm install -g bip39\nOr reinstall exe-os: npm install -g @askexenow/exe-os"
-    );
-  }
-}
-async function exportMnemonic(key) {
-  if (key.length !== 32) {
-    throw new Error(`Key must be 32 bytes, got ${key.length}`);
-  }
-  const { entropyToMnemonic } = await loadBip39();
-  return entropyToMnemonic(key.toString("hex"));
-}
-async function importMnemonic(mnemonic) {
-  const trimmed = mnemonic.trim();
-  const words = trimmed.split(/\s+/);
-  if (words.length !== 24) {
-    throw new Error(`Expected 24 words, got ${words.length}`);
-  }
-  const { validateMnemonic, mnemonicToEntropy } = await loadBip39();
-  if (!validateMnemonic(trimmed)) {
-    throw new Error("Invalid mnemonic \u2014 check for typos or missing words");
-  }
-  const entropy = mnemonicToEntropy(trimmed);
-  return Buffer.from(entropy, "hex");
-}
-
-// src/bin/exe-cloud.ts
+init_keychain();
 init_config();
+import { createInterface } from "readline";
 
 // src/lib/ws-auth.ts
 import crypto from "crypto";

package/dist/bin/exe-link.js

@@ -9,6 +9,121 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/lib/keychain.ts
+var keychain_exports = {};
+__export(keychain_exports, {
+  deleteMasterKey: () => deleteMasterKey,
+  exportMnemonic: () => exportMnemonic,
+  getMasterKey: () => getMasterKey,
+  importMnemonic: () => importMnemonic,
+  setMasterKey: () => setMasterKey
+});
+import { readFile, writeFile, unlink, mkdir, chmod } from "fs/promises";
+import { existsSync } from "fs";
+import path from "path";
+import os from "os";
+function getKeyDir() {
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
+}
+function getKeyPath() {
+  return path.join(getKeyDir(), "master.key");
+}
+async function tryKeytar() {
+  try {
+    return await import("keytar");
+  } catch {
+    return null;
+  }
+}
+async function getMasterKey() {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
+      if (stored) {
+        return Buffer.from(stored, "base64");
+      }
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (!existsSync(keyPath)) {
+    return null;
+  }
+  try {
+    const content = await readFile(keyPath, "utf-8");
+    return Buffer.from(content.trim(), "base64");
+  } catch {
+    return null;
+  }
+}
+async function setMasterKey(key) {
+  const b64 = key.toString("base64");
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      await keytar.setPassword(SERVICE, ACCOUNT, b64);
+      return;
+    } catch {
+    }
+  }
+  const dir = getKeyDir();
+  await mkdir(dir, { recursive: true });
+  const keyPath = getKeyPath();
+  await writeFile(keyPath, b64 + "\n", "utf-8");
+  await chmod(keyPath, 384);
+}
+async function deleteMasterKey() {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      await keytar.deletePassword(SERVICE, ACCOUNT);
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (existsSync(keyPath)) {
+    await unlink(keyPath);
+  }
+}
+async function loadBip39() {
+  try {
+    return await import("bip39");
+  } catch {
+    throw new Error(
+      "bip39 package not found. Run: npm install -g bip39\nOr reinstall exe-os: npm install -g @askexenow/exe-os"
+    );
+  }
+}
+async function exportMnemonic(key) {
+  if (key.length !== 32) {
+    throw new Error(`Key must be 32 bytes, got ${key.length}`);
+  }
+  const { entropyToMnemonic } = await loadBip39();
+  return entropyToMnemonic(key.toString("hex"));
+}
+async function importMnemonic(mnemonic) {
+  const trimmed = mnemonic.trim();
+  const words = trimmed.split(/\s+/);
+  if (words.length !== 24) {
+    throw new Error(`Expected 24 words, got ${words.length}`);
+  }
+  const { validateMnemonic, mnemonicToEntropy } = await loadBip39();
+  if (!validateMnemonic(trimmed)) {
+    throw new Error("Invalid mnemonic \u2014 check for typos or missing words");
+  }
+  const entropy = mnemonicToEntropy(trimmed);
+  return Buffer.from(entropy, "hex");
+}
+var SERVICE, ACCOUNT;
+var init_keychain = __esm({
+  "src/lib/keychain.ts"() {
+    "use strict";
+    SERVICE = "exe-mem";
+    ACCOUNT = "master-key";
+  }
+});
+
 // src/lib/config.ts
 var config_exports = {};
 __export(config_exports, {
@@ -645,6 +760,19 @@ async function cloudPull(sinceVersion, config) {
   }
 }
 async function cloudSync(config) {
+  if (!isSyncCryptoInitialized()) {
+    try {
+      const { getMasterKey: getMasterKey2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
+      const masterKey = await getMasterKey2();
+      if (masterKey) {
+        initSyncCrypto(masterKey);
+      } else {
+        throw new Error("No master key found");
+      }
+    } catch (err) {
+      throw new Error(`[cloud-sync] Cannot initialize encryption: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   let client;
   try {
     client = getClient();
@@ -1458,96 +1586,9 @@ var init_cloud_sync = __esm({
 });
 
 // src/bin/exe-link.ts
+init_keychain();
 import { createInterface } from "readline";
 
-// src/lib/keychain.ts
-import { readFile, writeFile, unlink, mkdir, chmod } from "fs/promises";
-import { existsSync } from "fs";
-import path from "path";
-import os from "os";
-var SERVICE = "exe-mem";
-var ACCOUNT = "master-key";
-function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
-}
-function getKeyPath() {
-  return path.join(getKeyDir(), "master.key");
-}
-async function tryKeytar() {
-  try {
-    return await import("keytar");
-  } catch {
-    return null;
-  }
-}
-async function getMasterKey() {
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
-      if (stored) {
-        return Buffer.from(stored, "base64");
-      }
-    } catch {
-    }
-  }
-  const keyPath = getKeyPath();
-  if (!existsSync(keyPath)) {
-    return null;
-  }
-  try {
-    const content = await readFile(keyPath, "utf-8");
-    return Buffer.from(content.trim(), "base64");
-  } catch {
-    return null;
-  }
-}
-async function setMasterKey(key) {
-  const b64 = key.toString("base64");
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      await keytar.setPassword(SERVICE, ACCOUNT, b64);
-      return;
-    } catch {
-    }
-  }
-  const dir = getKeyDir();
-  await mkdir(dir, { recursive: true });
-  const keyPath = getKeyPath();
-  await writeFile(keyPath, b64 + "\n", "utf-8");
-  await chmod(keyPath, 384);
-}
-async function loadBip39() {
-  try {
-    return await import("bip39");
-  } catch {
-    throw new Error(
-      "bip39 package not found. Run: npm install -g bip39\nOr reinstall exe-os: npm install -g @askexenow/exe-os"
-    );
-  }
-}
-async function exportMnemonic(key) {
-  if (key.length !== 32) {
-    throw new Error(`Key must be 32 bytes, got ${key.length}`);
-  }
-  const { entropyToMnemonic } = await loadBip39();
-  return entropyToMnemonic(key.toString("hex"));
-}
-async function importMnemonic(mnemonic) {
-  const trimmed = mnemonic.trim();
-  const words = trimmed.split(/\s+/);
-  if (words.length !== 24) {
-    throw new Error(`Expected 24 words, got ${words.length}`);
-  }
-  const { validateMnemonic, mnemonicToEntropy } = await loadBip39();
-  if (!validateMnemonic(trimmed)) {
-    throw new Error("Invalid mnemonic \u2014 check for typos or missing words");
-  }
-  const entropy = mnemonicToEntropy(trimmed);
-  return Buffer.from(entropy, "hex");
-}
-
 // src/lib/is-main.ts
 import { realpathSync } from "fs";
 import { fileURLToPath } from "url";

package/dist/bin/setup.js

@@ -1633,6 +1633,19 @@ async function cloudPull(sinceVersion, config) {
   }
 }
 async function cloudSync(config) {
+  if (!isSyncCryptoInitialized()) {
+    try {
+      const { getMasterKey: getMasterKey2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
+      const masterKey = await getMasterKey2();
+      if (masterKey) {
+        initSyncCrypto(masterKey);
+      } else {
+        throw new Error("No master key found");
+      }
+    } catch (err) {
+      throw new Error(`[cloud-sync] Cannot initialize encryption: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   let client;
   try {
     client = getClient();

package/dist/hooks/summary-worker.js

@@ -3476,6 +3476,19 @@ async function cloudPull(sinceVersion, config) {
   }
 }
 async function cloudSync(config) {
+  if (!isSyncCryptoInitialized()) {
+    try {
+      const { getMasterKey: getMasterKey2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
+      const masterKey = await getMasterKey2();
+      if (masterKey) {
+        initSyncCrypto(masterKey);
+      } else {
+        throw new Error("No master key found");
+      }
+    } catch (err) {
+      throw new Error(`[cloud-sync] Cannot initialize encryption: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   let client;
   try {
     client = getClient();

package/dist/lib/cloud-sync.js

@@ -1,7 +1,132 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/lib/keychain.ts
+var keychain_exports = {};
+__export(keychain_exports, {
+  deleteMasterKey: () => deleteMasterKey,
+  exportMnemonic: () => exportMnemonic,
+  getMasterKey: () => getMasterKey,
+  importMnemonic: () => importMnemonic,
+  setMasterKey: () => setMasterKey
+});
+import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
+import { existsSync as existsSync4 } from "fs";
+import path4 from "path";
+import os3 from "os";
+function getKeyDir() {
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path4.join(os3.homedir(), ".exe-os");
+}
+function getKeyPath() {
+  return path4.join(getKeyDir(), "master.key");
+}
+async function tryKeytar() {
+  try {
+    return await import("keytar");
+  } catch {
+    return null;
+  }
+}
+async function getMasterKey() {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
+      if (stored) {
+        return Buffer.from(stored, "base64");
+      }
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (!existsSync4(keyPath)) {
+    return null;
+  }
+  try {
+    const content = await readFile3(keyPath, "utf-8");
+    return Buffer.from(content.trim(), "base64");
+  } catch {
+    return null;
+  }
+}
+async function setMasterKey(key) {
+  const b64 = key.toString("base64");
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      await keytar.setPassword(SERVICE, ACCOUNT, b64);
+      return;
+    } catch {
+    }
+  }
+  const dir = getKeyDir();
+  await mkdir3(dir, { recursive: true });
+  const keyPath = getKeyPath();
+  await writeFile3(keyPath, b64 + "\n", "utf-8");
+  await chmod2(keyPath, 384);
+}
+async function deleteMasterKey() {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      await keytar.deletePassword(SERVICE, ACCOUNT);
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (existsSync4(keyPath)) {
+    await unlink(keyPath);
+  }
+}
+async function loadBip39() {
+  try {
+    return await import("bip39");
+  } catch {
+    throw new Error(
+      "bip39 package not found. Run: npm install -g bip39\nOr reinstall exe-os: npm install -g @askexenow/exe-os"
+    );
+  }
+}
+async function exportMnemonic(key) {
+  if (key.length !== 32) {
+    throw new Error(`Key must be 32 bytes, got ${key.length}`);
+  }
+  const { entropyToMnemonic } = await loadBip39();
+  return entropyToMnemonic(key.toString("hex"));
+}
+async function importMnemonic(mnemonic) {
+  const trimmed = mnemonic.trim();
+  const words = trimmed.split(/\s+/);
+  if (words.length !== 24) {
+    throw new Error(`Expected 24 words, got ${words.length}`);
+  }
+  const { validateMnemonic, mnemonicToEntropy } = await loadBip39();
+  if (!validateMnemonic(trimmed)) {
+    throw new Error("Invalid mnemonic \u2014 check for typos or missing words");
+  }
+  const entropy = mnemonicToEntropy(trimmed);
+  return Buffer.from(entropy, "hex");
+}
+var SERVICE, ACCOUNT;
+var init_keychain = __esm({
+  "src/lib/keychain.ts"() {
+    "use strict";
+    SERVICE = "exe-mem";
+    ACCOUNT = "master-key";
+  }
+});
+
 // src/lib/cloud-sync.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, readdirSync, mkdirSync as mkdirSync2, appendFileSync, unlinkSync as unlinkSync2, openSync, closeSync } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync5, readdirSync, mkdirSync as mkdirSync2, appendFileSync, unlinkSync as unlinkSync2, openSync, closeSync } from "fs";
 import crypto2 from "crypto";
-import path4 from "path";
+import path5 from "path";
 import { homedir } from "os";
 
 // src/lib/database.ts
@@ -19,7 +144,19 @@ import crypto from "crypto";
 var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 12;
 var TAG_LENGTH = 16;
+var SYNC_HKDF_INFO = "exe-mem-sync-v2";
 var _syncKey = null;
+function initSyncCrypto(masterKey) {
+  if (masterKey.length !== 32) {
+    throw new Error(`Master key must be 32 bytes, got ${masterKey.length}`);
+  }
+  _syncKey = Buffer.from(
+    crypto.hkdfSync("sha256", masterKey, "", SYNC_HKDF_INFO, 32)
+  );
+}
+function isSyncCryptoInitialized() {
+  return _syncKey !== null;
+}
 function requireSyncKey() {
   if (!_syncKey) {
     throw new Error("Sync crypto not initialized. Call initSyncCrypto(masterKey) first.");
@@ -255,7 +392,7 @@ function sqlSafe(v) {
 }
 function logError(msg) {
   try {
-    const logPath = path4.join(homedir(), ".exe-os", "workers.log");
+    const logPath = path5.join(homedir(), ".exe-os", "workers.log");
     appendFileSync(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
@@ -264,7 +401,7 @@ function logError(msg) {
 var LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
 var FETCH_TIMEOUT_MS = 3e4;
 var PUSH_BATCH_SIZE = 5e3;
-var ROSTER_LOCK_PATH = path4.join(EXE_AI_DIR, "roster-merge.lock");
+var ROSTER_LOCK_PATH = path5.join(EXE_AI_DIR, "roster-merge.lock");
 var LOCK_STALE_MS = 3e4;
 async function withRosterLock(fn) {
   try {
@@ -401,6 +538,19 @@ async function cloudPull(sinceVersion, config) {
   }
 }
 async function cloudSync(config) {
+  if (!isSyncCryptoInitialized()) {
+    try {
+      const { getMasterKey: getMasterKey2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
+      const masterKey = await getMasterKey2();
+      if (masterKey) {
+        initSyncCrypto(masterKey);
+      } else {
+        throw new Error("No master key found");
+      }
+    } catch (err) {
+      throw new Error(`[cloud-sync] Cannot initialize encryption: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   let client;
   try {
     client = getClient();
@@ -585,11 +735,11 @@ async function cloudSync(config) {
     documents: documentsResult
   };
 }
-var ROSTER_DELETIONS_PATH = path4.join(EXE_AI_DIR, "roster-deletions.json");
+var ROSTER_DELETIONS_PATH = path5.join(EXE_AI_DIR, "roster-deletions.json");
 function recordRosterDeletion(name) {
   let deletions = [];
   try {
-    if (existsSync4(ROSTER_DELETIONS_PATH)) {
+    if (existsSync5(ROSTER_DELETIONS_PATH)) {
       deletions = JSON.parse(readFileSync4(ROSTER_DELETIONS_PATH, "utf-8"));
     }
   } catch {
@@ -599,7 +749,7 @@ function recordRosterDeletion(name) {
 }
 function consumeRosterDeletions() {
   try {
-    if (!existsSync4(ROSTER_DELETIONS_PATH)) return [];
+    if (!existsSync5(ROSTER_DELETIONS_PATH)) return [];
     const deletions = JSON.parse(readFileSync4(ROSTER_DELETIONS_PATH, "utf-8"));
     writeFileSync3(ROSTER_DELETIONS_PATH, "[]");
     return deletions;
@@ -608,27 +758,27 @@ function consumeRosterDeletions() {
   }
 }
 function buildRosterBlob(paths) {
-  const rosterPath = paths?.rosterPath ?? path4.join(EXE_AI_DIR, "exe-employees.json");
-  const identityDir = paths?.identityDir ?? path4.join(EXE_AI_DIR, "identity");
-  const configPath = paths?.configPath ?? path4.join(EXE_AI_DIR, "config.json");
+  const rosterPath = paths?.rosterPath ?? path5.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path5.join(EXE_AI_DIR, "identity");
+  const configPath = paths?.configPath ?? path5.join(EXE_AI_DIR, "config.json");
   let roster = [];
-  if (existsSync4(rosterPath)) {
+  if (existsSync5(rosterPath)) {
     try {
       roster = JSON.parse(readFileSync4(rosterPath, "utf-8"));
     } catch {
     }
   }
   const identities = {};
-  if (existsSync4(identityDir)) {
+  if (existsSync5(identityDir)) {
     for (const file of readdirSync(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
-        identities[file] = readFileSync4(path4.join(identityDir, file), "utf-8");
+        identities[file] = readFileSync4(path5.join(identityDir, file), "utf-8");
       } catch {
       }
     }
   }
   let config;
-  if (existsSync4(configPath)) {
+  if (existsSync5(configPath)) {
     try {
       config = JSON.parse(readFileSync4(configPath, "utf-8"));
     } catch {
@@ -706,23 +856,23 @@ async function cloudPullRoster(config) {
   }
 }
 function mergeConfig(remoteConfig, configPath) {
-  const cfgPath = configPath ?? path4.join(EXE_AI_DIR, "config.json");
+  const cfgPath = configPath ?? path5.join(EXE_AI_DIR, "config.json");
   let local = {};
-  if (existsSync4(cfgPath)) {
+  if (existsSync5(cfgPath)) {
     try {
       local = JSON.parse(readFileSync4(cfgPath, "utf-8"));
     } catch {
     }
   }
   const merged = { ...remoteConfig, ...local };
-  const dir = path4.dirname(cfgPath);
-  if (!existsSync4(dir)) mkdirSync2(dir, { recursive: true });
+  const dir = path5.dirname(cfgPath);
+  if (!existsSync5(dir)) mkdirSync2(dir, { recursive: true });
   writeFileSync3(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
 }
 async function mergeRosterFromRemote(remote, paths) {
   return withRosterLock(async () => {
     const rosterPath = paths?.rosterPath ?? void 0;
-    const identityDir = paths?.identityDir ?? path4.join(EXE_AI_DIR, "identity");
+    const identityDir = paths?.identityDir ?? path5.join(EXE_AI_DIR, "identity");
     const localEmployees = await loadEmployees(rosterPath);
     const localNames = new Set(localEmployees.map((e) => e.name));
     let added = 0;
@@ -743,11 +893,11 @@ async function mergeRosterFromRemote(remote, paths) {
       ) ?? lookupKey;
       const remoteIdentity = remote.identities[matchedKey];
       if (remoteIdentity) {
-        if (!existsSync4(identityDir)) mkdirSync2(identityDir, { recursive: true });
-        const idPath = path4.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync5(identityDir)) mkdirSync2(identityDir, { recursive: true });
+        const idPath = path5.join(identityDir, `${remoteEmp.name}.md`);
         let localIdentity = null;
         try {
-          localIdentity = existsSync4(idPath) ? readFileSync4(idPath, "utf-8") : null;
+          localIdentity = existsSync5(idPath) ? readFileSync4(idPath, "utf-8") : null;
         } catch {
         }
         if (localIdentity !== remoteIdentity) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.8.75",
+  "version": "0.8.77",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "CC-BY-NC-4.0",
   "type": "module",