@askexenow/exe-os 0.9.102 → 0.9.104

package/dist/bin/exe-start-opencode.js

@@ -1545,9 +1545,79 @@ __export(database_exports, {
   isInitialized: () => isInitialized,
   setExternalClient: () => setExternalClient
 });
-import { chmodSync as chmodSync2 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync6, statSync as statSync2, copyFileSync, unlinkSync as unlinkSync3, openSync as openSync2, closeSync as closeSync2, mkdirSync as mkdirSync2 } from "fs";
 import { createClient } from "@libsql/client";
+import { homedir } from "os";
+import { join } from "path";
+function logCatchDebug(context, err) {
+  if (_debugDb) {
+    process.stderr.write(
+      `[database] ${context}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+function acquireDbLock() {
+  mkdirSync2(join(homedir(), ".exe-os"), { recursive: true });
+  try {
+    _lockFd = openSync2(DB_LOCK_PATH, "wx");
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "EEXIST") {
+      try {
+        const lockStat = statSync2(DB_LOCK_PATH);
+        if (Date.now() - lockStat.mtimeMs > 6e4) {
+          unlinkSync3(DB_LOCK_PATH);
+          _lockFd = openSync2(DB_LOCK_PATH, "wx");
+          return;
+        }
+      } catch (e) {
+        logCatchDebug("stale lock check", e);
+      }
+      process.stderr.write(
+        "[database] WARN: Another process holds db.lock \u2014 waiting briefly then proceeding.\n"
+      );
+      return;
+    }
+    throw err;
+  }
+}
+function releaseDbLock() {
+  if (_lockFd !== null) {
+    try {
+      closeSync2(_lockFd);
+    } catch (e) {
+      logCatchDebug("lock close", e);
+    }
+    _lockFd = null;
+  }
+  try {
+    unlinkSync3(DB_LOCK_PATH);
+  } catch (e) {
+    logCatchDebug("lock unlink", e);
+  }
+}
 async function initDatabase(config) {
+  acquireDbLock();
+  if (existsSync6(config.dbPath)) {
+    const dbStat = statSync2(config.dbPath);
+    if (dbStat.size === 0) {
+      const walPath = config.dbPath + "-wal";
+      if (existsSync6(walPath) && statSync2(walPath).size > 0) {
+        const backupPath = config.dbPath + ".zeroed-" + Date.now();
+        copyFileSync(config.dbPath, backupPath);
+        unlinkSync3(config.dbPath);
+        process.stderr.write(
+          `[database] CRITICAL: DB was 0 bytes. Moved to ${backupPath}, attempting WAL recovery.
+`
+        );
+      } else {
+        process.stderr.write(
+          `[database] CRITICAL: DB is 0 bytes and no WAL available for recovery. Data may be lost. Check backups at ${config.dbPath}.bak
+`
+        );
+      }
+    }
+  }
   if (_walCheckpointTimer) {
     clearInterval(_walCheckpointTimer);
     _walCheckpointTimer = null;
@@ -1574,10 +1644,8 @@ async function initDatabase(config) {
   _client = createClient(opts);
   _resilientClient = wrapWithRetry(_client);
   _adapterClient = _resilientClient;
-  _client.execute("PRAGMA busy_timeout = 30000").catch(() => {
-  });
-  _client.execute("PRAGMA journal_mode = WAL").catch(() => {
-  });
+  await _client.execute("PRAGMA busy_timeout = 30000");
+  await _client.execute("PRAGMA journal_mode = WAL");
   if (_walCheckpointTimer) clearInterval(_walCheckpointTimer);
   _walCheckpointTimer = setInterval(() => {
     _client?.execute("PRAGMA wal_checkpoint(PASSIVE)").catch(() => {
@@ -1592,11 +1660,16 @@ async function initDatabase(config) {
     for (const suffix of ["-wal", "-shm"]) {
       try {
         chmodSync2(config.dbPath + suffix, 384);
-      } catch {
+      } catch (chmodErr) {
+        process.stderr.write(`[database] chmod ${suffix} failed: ${chmodErr instanceof Error ? chmodErr.message : String(chmodErr)}
+`);
       }
     }
-  } catch {
+  } catch (chmodErr) {
+    process.stderr.write(`[database] chmod db failed: ${chmodErr instanceof Error ? chmodErr.message : String(chmodErr)}
+`);
   }
+  releaseDbLock();
 }
 function isInitialized() {
   return _adapterClient !== null || _client !== null;
@@ -1651,7 +1724,8 @@ async function ensureSchema() {
   await client.execute("PRAGMA wal_autocheckpoint = 1000");
   try {
     await client.execute("PRAGMA libsql_vector_search_ef = 128");
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS memories (
@@ -1716,6 +1790,23 @@ async function ensureSchema() {
       INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
     END;
   `);
+  try {
+    await client.execute("SELECT COUNT(*) FROM memories_fts LIMIT 1");
+  } catch (ftsErr) {
+    process.stderr.write(
+      `[database] WARN: memories_fts corrupted (${ftsErr instanceof Error ? ftsErr.message : String(ftsErr)}) \u2014 rebuilding FTS index.
+`
+    );
+    try {
+      await client.execute("INSERT INTO memories_fts(memories_fts) VALUES('rebuild')");
+      process.stderr.write("[database] FTS index rebuilt successfully.\n");
+    } catch (rebuildErr) {
+      process.stderr.write(
+        `[database] ERROR: FTS rebuild failed: ${rebuildErr instanceof Error ? rebuildErr.message : String(rebuildErr)}
+`
+      );
+    }
+  }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS sync_meta (
       key   TEXT PRIMARY KEY,
@@ -1774,35 +1865,40 @@ async function ensureSchema() {
         });
       }
     }
-  } catch {
+  } catch (seedErr) {
+    logCatchDebug("behavior seed", seedErr);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE behaviors ADD COLUMN priority TEXT DEFAULT 'p1'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE behaviors ADD COLUMN vector F32_BLOB(${EMBEDDING_DIM})`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN blocked_by TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN parent_task_id TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
@@ -1811,98 +1907,112 @@ async function ensureSchema() {
               WHERE parent_task_id IS NOT NULL`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `UPDATE tasks SET status = 'done' WHERE status = 'completed'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN reviewer TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN context TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN result TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN assigned_tmux TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN checkpoint TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN checkpoint_count INTEGER NOT NULL DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN complexity TEXT NOT NULL DEFAULT 'standard'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN session_scope TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN task_id TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN author_device_id TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS consolidations (
@@ -2007,14 +2117,16 @@ async function ensureSchema() {
       sql: `ALTER TABLE notifications ADD COLUMN session_scope TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE messages ADD COLUMN session_scope TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE INDEX IF NOT EXISTS idx_notifications_agent_scope_read
@@ -2040,7 +2152,8 @@ async function ensureSchema() {
       sql: `UPDATE tasks SET project_name = 'exe-os' WHERE project_name = 'worker'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS trajectories (
@@ -2064,7 +2177,8 @@ async function ensureSchema() {
   `);
   try {
     await client.execute("ALTER TABLE trajectories ADD COLUMN skill_id TEXT");
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS consolidations (
@@ -2101,63 +2215,72 @@ async function ensureSchema() {
       sql: `ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN deleted_at TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN confidence REAL DEFAULT 0.7`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN last_accessed TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `UPDATE memories SET last_accessed = timestamp WHERE last_accessed IS NULL`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN graph_extracted INTEGER DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   for (const col of [
     "ALTER TABLE memories ADD COLUMN content_hash TEXT",
@@ -2165,14 +2288,16 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_content_hash ON memories(content_hash, agent_id)`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute(
@@ -2180,7 +2305,8 @@ async function ensureSchema() {
          ON memories(content_hash, agent_id, project_name, memory_type)
          WHERE content_hash IS NOT NULL`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS entities (
@@ -2256,7 +2382,8 @@ async function ensureSchema() {
   `);
   try {
     await client.execute("INSERT INTO entities_fts(entities_fts) VALUES('rebuild')");
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS entity_aliases (
@@ -2271,14 +2398,16 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_status ON memories(status)`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS identity (
@@ -2377,7 +2506,8 @@ async function ensureSchema() {
         sql: `ALTER TABLE memories ADD COLUMN ${column}`,
         args: []
       });
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   for (const col of [
@@ -2386,7 +2516,8 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   await client.executeMultiple(`
@@ -2571,56 +2702,64 @@ async function ensureSchema() {
         args: []
       });
     }
-  } catch {
+  } catch (e) {
+    logCatchDebug("session_agent_map backfill", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE session_agent_map ADD COLUMN cache_cold_count INTEGER NOT NULL DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN budget_tokens INTEGER`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN budget_fallback_model TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN tokens_used INTEGER DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN tokens_warned_at INTEGER`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN spawn_runtime TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE tasks ADD COLUMN spawn_model TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   await client.executeMultiple(`
     CREATE VIRTUAL TABLE IF NOT EXISTS conversations_fts USING fts5(
@@ -2819,13 +2958,15 @@ async function ensureSchema() {
       sql: `ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_tier ON memories(tier)`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
@@ -2836,20 +2977,23 @@ async function ensureSchema() {
       sql: `UPDATE memories SET tier = 2 WHERE tool_name IN ('store_memory', 'manual') AND importance >= 5 AND tier = 3`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN supersedes_id TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_supersedes ON memories(supersedes_id) WHERE supersedes_id IS NOT NULL`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   for (const col of [
     "ALTER TABLE tasks ADD COLUMN checkpoint TEXT",
@@ -2857,7 +3001,8 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   try {
@@ -2865,13 +3010,15 @@ async function ensureSchema() {
       sql: `ALTER TABLE memories ADD COLUMN draft INTEGER DEFAULT 0`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_draft ON memories(draft) WHERE draft = 1`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   for (const col of [
     "ALTER TABLE memories ADD COLUMN valid_from TEXT",
@@ -2879,7 +3026,8 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   try {
@@ -2887,27 +3035,31 @@ async function ensureSchema() {
       sql: `UPDATE memories SET valid_from = timestamp WHERE valid_from IS NULL`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN memory_type TEXT DEFAULT 'raw'`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute(
       `CREATE INDEX IF NOT EXISTS idx_memories_type ON memories(memory_type)`
     );
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN trajectory TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   for (const col of [
     "ALTER TABLE memories ADD COLUMN intent TEXT",
@@ -2928,7 +3080,8 @@ async function ensureSchema() {
   ]) {
     try {
       await client.execute(col);
-    } catch {
+    } catch (e) {
+      logCatchDebug("migration", e);
     }
   }
   try {
@@ -2936,14 +3089,16 @@ async function ensureSchema() {
       sql: `ALTER TABLE memories ADD COLUMN procedure_for TEXT`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
   try {
     await client.execute({
       sql: `UPDATE tasks SET status = 'closed' WHERE status = 'done' AND result IS NOT NULL`,
       args: []
     });
-  } catch {
+  } catch (e) {
+    logCatchDebug("migration", e);
   }
 }
 async function disposeDatabase() {
@@ -2954,7 +3109,8 @@ async function disposeDatabase() {
   if (_client) {
     try {
       await _client.execute("PRAGMA wal_checkpoint(PASSIVE)");
-    } catch {
+    } catch (e) {
+      logCatchDebug("WAL checkpoint", e);
     }
   }
   if (_daemonClient) {
@@ -2970,8 +3126,9 @@ async function disposeDatabase() {
     _client = null;
     _resilientClient = null;
   }
+  releaseDbLock();
 }
-var _client, _resilientClient, _walCheckpointTimer, _daemonClient, _adapterClient, initTurso, SOFT_DELETE_RETENTION_DAYS, disposeTurso;
+var _debugDb, _client, _resilientClient, _walCheckpointTimer, _daemonClient, _adapterClient, _lockFd, DB_LOCK_PATH, initTurso, SOFT_DELETE_RETENTION_DAYS, disposeTurso;
 var init_database = __esm({
   "src/lib/database.ts"() {
     "use strict";
@@ -2979,11 +3136,14 @@ var init_database = __esm({
     init_employees();
     init_database_adapter();
     init_memory();
+    _debugDb = process.env.EXE_DEBUG === "1";
     _client = null;
     _resilientClient = null;
     _walCheckpointTimer = null;
     _daemonClient = null;
     _adapterClient = null;
+    _lockFd = null;
+    DB_LOCK_PATH = join(homedir(), ".exe-os", "db.lock");
     initTurso = initDatabase;
     SOFT_DELETE_RETENTION_DAYS = 7;
     disposeTurso = disposeDatabase;
@@ -3006,18 +3166,54 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path7 from "path";
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync3 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readdirSync, renameSync as renameSync3, statSync as statSync4 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
-  if (!existsSync7(SHARDS_DIR)) {
-    mkdirSync2(SHARDS_DIR, { recursive: true });
+  _keyValidated = false;
+  _keyValidationPromise = null;
+  if (!existsSync8(SHARDS_DIR)) {
+    mkdirSync3(SHARDS_DIR, { recursive: true });
+  }
+  const existingShards = readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db"));
+  if (existingShards.length === 0) {
+    _keyValidated = true;
   }
   _shardingEnabled = true;
   if (_evictionTimer) clearInterval(_evictionTimer);
   _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
   _evictionTimer.unref();
 }
+async function validateEncryptionKey() {
+  if (_keyValidated) return true;
+  if (!_encryptionKey) return false;
+  const existingShards = readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db"));
+  if (existingShards.length === 0) {
+    _keyValidated = true;
+    return true;
+  }
+  for (const shardFile of existingShards.slice(0, 3)) {
+    const dbPath = path7.join(SHARDS_DIR, shardFile);
+    const testClient = createClient2({ url: `file:${dbPath}`, encryptionKey: _encryptionKey });
+    try {
+      await testClient.execute("SELECT COUNT(*) FROM sqlite_schema");
+      testClient.close();
+      _keyValidated = true;
+      return true;
+    } catch {
+      try {
+        testClient.close();
+      } catch {
+      }
+    }
+  }
+  process.stderr.write(
+    `[shard-manager] WARNING: encryption key cannot read any existing shards (${existingShards.length} found). New shard creation disabled to prevent stranded files. Run /exe-doctor to audit.
+`
+  );
+  _shardingEnabled = false;
+  return false;
+}
 function isShardingEnabled() {
   return _shardingEnabled;
 }
@@ -3051,13 +3247,13 @@ function getShardClient(projectName) {
 }
 function shardExists(projectName) {
   const safeName = safeShardName(projectName);
-  return existsSync7(path7.join(SHARDS_DIR, `${safeName}.db`));
+  return existsSync8(path7.join(SHARDS_DIR, `${safeName}.db`));
 }
 function safeShardName(projectName) {
   return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function listShards() {
-  if (!existsSync7(SHARDS_DIR)) return [];
+  if (!existsSync8(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function auditShardHealth(options = {}) {
@@ -3070,7 +3266,7 @@ async function auditShardHealth(options = {}) {
   const shards = [];
   for (const name of names) {
     const dbPath = path7.join(SHARDS_DIR, `${name}.db`);
-    const stat = statSync3(dbPath);
+    const stat = statSync4(dbPath);
     const item = {
       name,
       path: dbPath,
@@ -3310,6 +3506,17 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
+  if (!_keyValidated) {
+    if (!_keyValidationPromise) {
+      _keyValidationPromise = validateEncryptionKey();
+    }
+    const valid = await _keyValidationPromise;
+    if (!valid) {
+      throw new Error(
+        `Shard creation blocked: encryption key mismatch with existing shards. Run /exe-doctor to audit.`
+      );
+    }
+  }
   const safeName = safeShardName(projectName);
   let client = getShardClient(projectName);
   try {
@@ -3322,8 +3529,8 @@ async function getReadyShardClient(projectName) {
     _shards.delete(safeName);
     _shardLastAccess.delete(safeName);
     const dbPath = path7.join(SHARDS_DIR, `${safeName}.db`);
-    if (existsSync7(dbPath)) {
-      const stat = statSync3(dbPath);
+    if (existsSync8(dbPath)) {
+      const stat = statSync4(dbPath);
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
       const archivedPath = path7.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
       renameSync3(dbPath, archivedPath);
@@ -3388,7 +3595,7 @@ function disposeShards() {
   _shardingEnabled = false;
   _encryptionKey = null;
 }
-var SHARDS_DIR, SHARD_IDLE_MS, MAX_OPEN_SHARDS, EVICTION_INTERVAL_MS, _shards, _shardLastAccess, _evictionTimer, _encryptionKey, _shardingEnabled;
+var SHARDS_DIR, SHARD_IDLE_MS, MAX_OPEN_SHARDS, EVICTION_INTERVAL_MS, _shards, _shardLastAccess, _evictionTimer, _encryptionKey, _shardingEnabled, _keyValidated, _keyValidationPromise;
 var init_shard_manager = __esm({
   "src/lib/shard-manager.ts"() {
     "use strict";
@@ -3402,6 +3609,8 @@ var init_shard_manager = __esm({
     _evictionTimer = null;
     _encryptionKey = null;
     _shardingEnabled = false;
+    _keyValidated = false;
+    _keyValidationPromise = null;
   }
 });
 
@@ -3597,6 +3806,18 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "create_task is dispatch + delivery. Task lifecycle: open \u2192 in_progress (you start) \u2192 done (update_task when finished) \u2192 needs_review (reviewer nudged) \u2192 closed (COO only via close_task). DB is the reliable delivery \u2014 intercom is just a speedup nudge. If you finish a task, self-chain: check for next task immediately (step 7). Never wait for a nudge. Never say 'standing by.'"
       },
+      {
+        title: "Review chain \u2014 managers must actively pull completed work, never wait for nudges",
+        domain: "workflow",
+        priority: "p0",
+        content: "When you dispatch work, you OWN the review. Check list_tasks(status='needs_review') on EVERY prompt \u2014 don't wait for intercom nudges (they're unreliable). When a task shows needs_review: (1) read the deliverable (git diff in worktree, exe/output/ files, or task result summary), (2) verify it works (tsc, build, run), (3) close_task if good or create a fix task if not. Reviews sitting >30 minutes is a pipeline stall. The whole chain: worker calls update_task(done) \u2192 system flags needs_review \u2192 manager pulls and verifies \u2192 close_task \u2192 COO reviews manager's work \u2192 merge to main. Every level actively pulls \u2014 nobody waits."
+      },
+      {
+        title: "Bug fix lifecycle \u2014 triage upstream after every verified fix so customers see the status",
+        domain: "workflow",
+        priority: "p0",
+        content: "When a bug from support(action='list_bugs') is fixed and verified, the reviewer MUST triage it upstream: support(action='triage_bug', id='<bug-id>', notes='<what was fixed>', fixed_version='<version>', linked_commit='<hash>'). This closes the bug in the customer's view \u2014 their COO checks list_my_bugs and sees status change from open \u2192 closed with the fix version. Without triage, customers see 'open' forever even after the fix ships. Same for feature requests: support(action='triage_feature', ..., shipped_version='<version>'). Triage is part of the review gate \u2014 a fix is not done until the upstream report is closed."
+      },
       {
         title: "Intercom is a speedup, not delivery \u2014 DB is the source of truth",
         domain: "architecture",
@@ -4293,7 +4514,7 @@ __export(active_agent_exports, {
   resolveActiveAgentFromTmuxSession: () => resolveActiveAgentFromTmuxSession,
   writeActiveAgent: () => writeActiveAgent
 });
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, unlinkSync as unlinkSync4, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, unlinkSync as unlinkSync5, readdirSync as readdirSync3 } from "fs";
 import { execSync as execSync5 } from "child_process";
 import path9 from "path";
 function isNameWithOptionalInstance(candidate, baseName) {
@@ -4343,7 +4564,7 @@ function getMarkerPath() {
 }
 function writeActiveAgent(agentId, agentRole) {
   try {
-    mkdirSync4(CACHE_DIR, { recursive: true });
+    mkdirSync5(CACHE_DIR, { recursive: true });
     writeFileSync4(
       getMarkerPath(),
       JSON.stringify({ agentId, agentRole, startedAt: (/* @__PURE__ */ new Date()).toISOString() })
@@ -4353,7 +4574,7 @@ function writeActiveAgent(agentId, agentRole) {
 }
 function clearActiveAgent() {
   try {
-    unlinkSync4(getMarkerPath());
+    unlinkSync5(getMarkerPath());
   } catch {
   }
 }
@@ -4369,7 +4590,7 @@ function getActiveAgent() {
         const age = Date.now() - new Date(data.startedAt).getTime();
         if (age > STALE_MS) {
           try {
-            unlinkSync4(markerPath);
+            unlinkSync5(markerPath);
           } catch {
           }
         } else {
@@ -4417,7 +4638,7 @@ function getAllActiveAgents() {
           const age = Date.now() - new Date(data.startedAt).getTime();
           if (age > STALE_MS) {
             try {
-              unlinkSync4(path9.join(CACHE_DIR, file));
+              unlinkSync5(path9.join(CACHE_DIR, file));
             } catch {
             }
             continue;
@@ -4440,11 +4661,11 @@ function getAllActiveAgents() {
 function cleanupSessionMarkers() {
   const key = getSessionKey();
   try {
-    unlinkSync4(path9.join(CACHE_DIR, `active-agent-${key}.json`));
+    unlinkSync5(path9.join(CACHE_DIR, `active-agent-${key}.json`));
   } catch {
   }
   try {
-    unlinkSync4(path9.join(CACHE_DIR, "active-agent-undefined.json"));
+    unlinkSync5(path9.join(CACHE_DIR, "active-agent-undefined.json"));
   } catch {
   }
 }
@@ -4465,9 +4686,9 @@ var init_active_agent = __esm({
 import os7 from "os";
 import path10 from "path";
 import {
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   lstatSync,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync6,
   readlinkSync as readlinkSync2,
   symlinkSync as symlinkSync2
 } from "fs";
@@ -4493,7 +4714,7 @@ var init_mcp_prefix = __esm({
 });
 
 // src/lib/preferences.ts
-import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import path11 from "path";
 import os8 from "os";
 var init_preferences = __esm({
@@ -4504,7 +4725,7 @@ var init_preferences = __esm({
 });
 
 // src/adapters/mcp-http-config.ts
-import { chmodSync as chmodSync3, existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
 import { randomBytes } from "crypto";
 import path12 from "path";
 import os9 from "os";
@@ -4517,7 +4738,7 @@ function mcpHttpUrl() {
 function readOrCreateDaemonToken(homeDir = os9.homedir()) {
   const exeDir = path12.join(homeDir, ".exe-os");
   const tokenPath = path12.join(exeDir, "exed.token");
-  if (existsSync11(tokenPath)) {
+  if (existsSync12(tokenPath)) {
     try {
       const token2 = readFileSync7(tokenPath, "utf-8").trim();
       if (/^[a-f0-9]{64}$/i.test(token2)) return token2;
@@ -4525,7 +4746,7 @@ function readOrCreateDaemonToken(homeDir = os9.homedir()) {
     }
   }
   const token = randomBytes(32).toString("hex");
-  mkdirSync6(exeDir, { recursive: true });
+  mkdirSync7(exeDir, { recursive: true });
   writeFileSync6(tokenPath, `${token}
 `, "utf-8");
   try {
@@ -4696,7 +4917,7 @@ var init_runtime_hook_manifest = __esm({
 
 // src/adapters/claude/installer.ts
 import { readFile as readFile4, writeFile as writeFile4, mkdir as mkdir4, readdir, rm } from "fs/promises";
-import { existsSync as existsSync12, readFileSync as readFileSync8, writeFileSync as writeFileSync7, copyFileSync, mkdirSync as mkdirSync7 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync8, writeFileSync as writeFileSync7, copyFileSync as copyFileSync2, mkdirSync as mkdirSync8 } from "fs";
 import { createHash as createHash4 } from "crypto";
 import path13 from "path";
 import os10 from "os";
@@ -4708,7 +4929,7 @@ function resolvePackageRoot() {
   const root = path13.parse(dir).root;
   while (dir !== root) {
     const pkgPath = path13.join(dir, "package.json");
-    if (existsSync12(pkgPath)) {
+    if (existsSync13(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
@@ -4937,7 +5158,7 @@ __export(installer_exports, {
   verifyOpenCodeHooks: () => verifyOpenCodeHooks
 });
 import { readFile as readFile5, writeFile as writeFile5, mkdir as mkdir5 } from "fs/promises";
-import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
 import path14 from "path";
 import os11 from "os";
 async function registerOpenCodeMcp(packageRoot, homeDir = os11.homedir()) {
@@ -4946,7 +5167,7 @@ async function registerOpenCodeMcp(packageRoot, homeDir = os11.homedir()) {
   const configPath = path14.join(configDir, "opencode.json");
   await mkdir5(configDir, { recursive: true });
   let config = {};
-  if (existsSync13(configPath)) {
+  if (existsSync14(configPath)) {
     try {
       config = JSON.parse(await readFile5(configPath, "utf-8"));
     } catch {
@@ -4981,7 +5202,7 @@ async function installOpenCodePlugin(packageRoot, homeDir = os11.homedir()) {
     /__PACKAGE_ROOT__/g,
     packageRoot.replace(/\\/g, "\\\\")
   );
-  if (existsSync13(pluginPath)) {
+  if (existsSync14(pluginPath)) {
     const existing = await readFile5(pluginPath, "utf-8");
     if (existing === pluginContent) {
       return false;
@@ -4993,14 +5214,14 @@ async function installOpenCodePlugin(packageRoot, homeDir = os11.homedir()) {
 function verifyOpenCodeHooks(homeDir = os11.homedir()) {
   const configPath = path14.join(homeDir, ".config", "opencode", "opencode.json");
   const pluginPath = path14.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
-  if (!existsSync13(configPath)) return false;
+  if (!existsSync14(configPath)) return false;
   try {
     const config = JSON.parse(readFileSync9(configPath, "utf-8"));
     if (!config.mcp?.["exe-os"]?.enabled) return false;
   } catch {
     return false;
   }
-  if (!existsSync13(pluginPath)) return false;
+  if (!existsSync14(pluginPath)) return false;
   try {
     const plugin = readFileSync9(pluginPath, "utf-8");
     if (!plugin.includes(EXE_HOOK_FILES.postToolCombined)) return false;
@@ -5037,10 +5258,10 @@ var init_installer2 = __esm({
 import os12 from "os";
 import path15 from "path";
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   readFileSync as readFileSync10,
   writeFileSync as writeFileSync8,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   readdirSync as readdirSync4
 } from "fs";
 import { spawnSync } from "child_process";
@@ -5051,7 +5272,7 @@ init_database();
 
 // src/lib/keychain.ts
 import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync6, statSync as statSync2 } from "fs";
+import { existsSync as existsSync7, statSync as statSync3 } from "fs";
 import { execSync as execSync3 } from "child_process";
 import path6 from "path";
 import os5 from "os";
@@ -5090,7 +5311,7 @@ function isRootOnlyTrustedServerKeyFile(keyPath) {
   if (process.platform !== "linux") return false;
   try {
     const uid = typeof os5.userInfo().uid === "number" ? os5.userInfo().uid : -1;
-    const st = statSync2(keyPath);
+    const st = statSync3(keyPath);
     if (!st.isFile() || (st.mode & 63) !== 0) return false;
     if (uid === 0) return true;
     const exeOsDir = process.env.EXE_OS_DIR;
@@ -5292,7 +5513,7 @@ async function getMasterKey() {
     }
   }
   const keyPath = getKeyPath();
-  if (!existsSync6(keyPath)) {
+  if (!existsSync7(keyPath)) {
     process.stderr.write(
       `[keychain] Key not found at ${keyPath} (HOME=${os5.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
 `
@@ -5486,6 +5707,13 @@ function schedulePostWriteMemoryHygiene(memoryIds) {
 }
 
 // src/lib/store.ts
+var _debugStore = process.env.EXE_DEBUG === "1";
+function logStoreWarn(context, err) {
+  process.stderr.write(
+    `[store] WARN ${context}: ${err instanceof Error ? err.message : String(err)}
+`
+  );
+}
 var INIT_MAX_RETRIES = 3;
 var INIT_RETRY_DELAY_MS = 1e3;
 function isBusyError2(err) {
@@ -5548,13 +5776,15 @@ async function initStore(options) {
   try {
     const { initDaemonClient: initDaemonClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await initDaemonClient2();
-  } catch {
+  } catch (e) {
+    logStoreWarn("catch", e);
   }
   if (!options?.lightweight) {
     try {
       const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
       initShardManager2(hexKey);
-    } catch {
+    } catch (e) {
+      logStoreWarn("catch", e);
     }
     const client = getClient();
     const vResult = await retryOnBusy2(
@@ -5565,7 +5795,8 @@ async function initStore(options) {
     try {
       const { loadGlobalProcedures: loadGlobalProcedures2 } = await Promise.resolve().then(() => (init_global_procedures(), global_procedures_exports));
       await loadGlobalProcedures2();
-    } catch {
+    } catch (e) {
+      logStoreWarn("catch", e);
     }
   }
 }
@@ -5693,12 +5924,14 @@ async function flushBatch() {
     try {
       const { insertMemoryCardsForBatch: insertMemoryCardsForBatch2 } = await Promise.resolve().then(() => (init_memory_cards(), memory_cards_exports));
       await insertMemoryCardsForBatch2(batch);
-    } catch {
+    } catch (e) {
+      logStoreWarn("catch", e);
     }
     try {
       const { insertOntologyForBatch: insertOntologyForBatch2 } = await Promise.resolve().then(() => (init_agentic_ontology(), agentic_ontology_exports));
       await insertOntologyForBatch2(batch);
-    } catch {
+    } catch (e) {
+      logStoreWarn("catch", e);
     }
     schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
     _pendingRecords.splice(0, batch.length);
@@ -5737,7 +5970,8 @@ ${err.stack.split("\n").slice(1, 3).join("\n")}` : ""}` : String(err);
           }
         }
       }
-    } catch {
+    } catch (e) {
+      logStoreWarn("catch", e);
     }
     return batch.length;
   } finally {
@@ -5765,11 +5999,11 @@ function vectorToBlob(vector) {
 import os6 from "os";
 import path8 from "path";
 import {
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync3,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync4,
   readdirSync as readdirSync2,
-  statSync as statSync4,
-  unlinkSync as unlinkSync3,
+  statSync as statSync5,
+  unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync3
 } from "fs";
 
@@ -5830,7 +6064,7 @@ function getBehaviorLimit() {
   }
 }
 function sweepStaleBehaviorExports(now = Date.now()) {
-  if (!existsSync8(BEHAVIORS_EXPORT_DIR)) return;
+  if (!existsSync9(BEHAVIORS_EXPORT_DIR)) return;
   let entries;
   try {
     entries = readdirSync2(BEHAVIORS_EXPORT_DIR);
@@ -5840,9 +6074,9 @@ function sweepStaleBehaviorExports(now = Date.now()) {
   for (const entry of entries) {
     const filePath = path8.join(BEHAVIORS_EXPORT_DIR, entry);
     try {
-      const stat = statSync4(filePath);
+      const stat = statSync5(filePath);
       if (now - stat.mtimeMs > STALE_EXPORT_AGE_MS) {
-        unlinkSync3(filePath);
+        unlinkSync4(filePath);
       }
     } catch {
     }
@@ -5880,7 +6114,7 @@ function exportFilePath(agentId, projectName, sessionKey) {
   );
 }
 async function exportBehaviorsForAgent(agentId, projectName, sessionKey) {
-  mkdirSync3(BEHAVIORS_EXPORT_DIR, { recursive: true });
+  mkdirSync4(BEHAVIORS_EXPORT_DIR, { recursive: true });
   sweepStaleBehaviorExports();
   const behaviors = await listBehaviors(agentId, projectName, getBehaviorLimit());
   if (behaviors.length === 0) return null;
@@ -5922,7 +6156,7 @@ function resolveAgent(argv) {
 function loadIdentity(agent) {
   const dir = path15.join(os12.homedir(), ".exe-os", "identity");
   const exact = path15.join(dir, `${agent}.md`);
-  if (existsSync14(exact)) {
+  if (existsSync15(exact)) {
     const content = readFileSync10(exact, "utf-8").trim();
     if (content) return content;
   }
@@ -5948,9 +6182,9 @@ function loadIdentity(agent) {
 }
 function writeAgentFile(agent, identity, behaviorsPath) {
   const agentDir = path15.join(os12.homedir(), ".config", "opencode", "agents");
-  mkdirSync8(agentDir, { recursive: true });
+  mkdirSync9(agentDir, { recursive: true });
   let content = identity;
-  if (behaviorsPath && existsSync14(behaviorsPath)) {
+  if (behaviorsPath && existsSync15(behaviorsPath)) {
     const behaviors = readFileSync10(behaviorsPath, "utf-8").trim();
     if (behaviors) {
       content += "\n\n" + behaviors;