@askexenow/exe-os 0.9.13 → 0.9.14

package/dist/lib/exe-daemon.js

@@ -400,7 +400,7 @@ var init_daemon_protocol = __esm({
 });
 
 // src/lib/daemon-auth.ts
-import crypto from "crypto";
+import crypto2 from "crypto";
 import path2 from "path";
 import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync } from "fs";
 function normalizeToken(token) {
@@ -419,7 +419,7 @@ function readDaemonToken() {
 function ensureDaemonToken(seed) {
   const existing = readDaemonToken();
   if (existing) return existing;
-  const token = normalizeToken(seed) ?? crypto.randomBytes(32).toString("hex");
+  const token = normalizeToken(seed) ?? crypto2.randomBytes(32).toString("hex");
   ensurePrivateDirSync(EXE_AI_DIR);
   writeFileSync(DAEMON_TOKEN_PATH, `${token}
 `, "utf8");
@@ -976,8 +976,8 @@ function logQueue(msg) {
   process.stderr.write(`[intercom-queue] ${msg}
 `);
   try {
-    const { appendFileSync: appendFileSync2 } = __require("fs");
-    appendFileSync2(INTERCOM_LOG, line);
+    const { appendFileSync: appendFileSync3 } = __require("fs");
+    appendFileSync3(INTERCOM_LOG, line);
   } catch {
   }
 }
@@ -1635,7 +1635,7 @@ async function ensureCompatibilityViews(prisma) {
       for (const mapping of VIEW_MAPPINGS) {
         const relation = mapping.source.replace(/"/g, "");
         const rows = await prisma.$queryRawUnsafe(
-          "SELECT to_regclass($1) AS regclass",
+          "SELECT to_regclass($1)::text AS regclass",
           relation
         );
         if (!rows[0]?.regclass) {
@@ -1952,8 +1952,29 @@ function findPackageRoot() {
   }
   return null;
 }
+function getAvailableMemoryGB() {
+  if (process.platform === "darwin") {
+    try {
+      const { execSync: execSync12 } = __require("child_process");
+      const vmstat = execSync12("vm_stat", { encoding: "utf8" });
+      const pageSize = 16384;
+      const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
+      const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
+      const free = vmstat.match(/Pages free:\s+(\d+)/);
+      const inactive = vmstat.match(/Pages inactive:\s+(\d+)/);
+      const speculative = vmstat.match(/Pages speculative:\s+(\d+)/);
+      const freePages = free ? parseInt(free[1], 10) : 0;
+      const inactivePages = inactive ? parseInt(inactive[1], 10) : 0;
+      const speculativePages = speculative ? parseInt(speculative[1], 10) : 0;
+      return (freePages + inactivePages + speculativePages) * actualPageSize / (1024 * 1024 * 1024);
+    } catch {
+      return os6.freemem() / (1024 * 1024 * 1024);
+    }
+  }
+  return os6.freemem() / (1024 * 1024 * 1024);
+}
 function spawnDaemon() {
-  const freeGB = os6.freemem() / (1024 * 1024 * 1024);
+  const freeGB = getAvailableMemoryGB();
   const totalGB = os6.totalmem() / (1024 * 1024 * 1024);
   if (totalGB <= 8) {
     process.stderr.write(
@@ -1962,9 +1983,9 @@ function spawnDaemon() {
     );
     return;
   }
-  if (totalGB <= 16 && freeGB < 4) {
+  if (totalGB <= 16 && freeGB < 2) {
     process.stderr.write(
-      `[exed-client] SKIP: low memory (${freeGB.toFixed(1)}GB free / ${totalGB.toFixed(0)}GB total). Embedding daemon not started \u2014 using keyword search only.
+      `[exed-client] SKIP: low memory (${freeGB.toFixed(1)}GB available / ${totalGB.toFixed(0)}GB total). Embedding daemon not started \u2014 using keyword search only.
 `
     );
     return;
@@ -3546,6 +3567,27 @@ import { pathToFileURL as pathToFileURL2 } from "url";
 import os7 from "os";
 import path9 from "path";
 import { jwtVerify, importSPKI } from "jose";
+function loadDeviceId() {
+  const deviceJsonPath = path9.join(EXE_AI_DIR, "device.json");
+  try {
+    if (existsSync9(deviceJsonPath)) {
+      const data = JSON.parse(readFileSync8(deviceJsonPath, "utf8"));
+      if (data.deviceId) return data.deviceId;
+    }
+  } catch {
+  }
+  try {
+    if (existsSync9(DEVICE_ID_PATH)) {
+      const id2 = readFileSync8(DEVICE_ID_PATH, "utf8").trim();
+      if (id2) return id2;
+    }
+  } catch {
+  }
+  const id = randomUUID2();
+  mkdirSync4(EXE_AI_DIR, { recursive: true });
+  writeFileSync6(DEVICE_ID_PATH, id, "utf8");
+  return id;
+}
 var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH, PLAN_LIMITS;
 var init_license = __esm({
   "src/lib/license.ts"() {
@@ -3676,7 +3718,7 @@ var init_task_scope = __esm({
 });
 
 // src/lib/notifications.ts
-import crypto2 from "crypto";
+import crypto3 from "crypto";
 import path11 from "path";
 import os8 from "os";
 import {
@@ -3689,7 +3731,7 @@ import {
 async function writeNotification(notification) {
   try {
     const client = getClient();
-    const id = crypto2.randomUUID();
+    const id = crypto3.randomUUID();
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const sessionScope = notification.sessionScope === void 0 ? getCurrentSessionScope() : notification.sessionScope;
     await client.execute({
@@ -3745,7 +3787,7 @@ __export(session_kill_telemetry_exports, {
   recordSessionKill: () => recordSessionKill,
   sumTokensSavedSince: () => sumTokensSavedSince
 });
-import crypto3 from "crypto";
+import crypto4 from "crypto";
 async function recordSessionKill(input) {
   try {
     const client = getClient();
@@ -3755,7 +3797,7 @@ async function recordSessionKill(input) {
                ticks_idle, estimated_tokens_saved)
             VALUES (?, ?, ?, ?, ?, ?, ?)`,
       args: [
-        crypto3.randomUUID(),
+        crypto4.randomUUID(),
         input.sessionName,
         input.agentId,
         (/* @__PURE__ */ new Date()).toISOString(),
@@ -3996,7 +4038,7 @@ var init_session_scope = __esm({
 });
 
 // src/lib/tasks-crud.ts
-import crypto4 from "crypto";
+import crypto5 from "crypto";
 import path13 from "path";
 import os9 from "os";
 import { execSync as execSync6 } from "child_process";
@@ -4117,7 +4159,7 @@ async function resolveTask(client, identifier, scopeSession) {
 }
 async function createTaskCore(input) {
   const client = getClient();
-  const id = crypto4.randomUUID();
+  const id = crypto5.randomUUID();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const slug = slugify(input.title);
   let earlySessionScope = null;
@@ -5063,10 +5105,10 @@ var init_tasks_notify = __esm({
 });
 
 // src/lib/behaviors.ts
-import crypto5 from "crypto";
+import crypto6 from "crypto";
 async function storeBehavior(opts) {
   const client = getClient();
-  const id = crypto5.randomUUID();
+  const id = crypto6.randomUUID();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   await client.execute({
     sql: `INSERT INTO behaviors (id, agent_id, project_name, domain, priority, content, active, created_at, updated_at)
@@ -5095,7 +5137,7 @@ __export(skill_learning_exports, {
   storeTrajectory: () => storeTrajectory,
   sweepTrajectories: () => sweepTrajectories
 });
-import crypto6 from "crypto";
+import crypto7 from "crypto";
 async function extractTrajectory(taskId, agentId) {
   const client = getClient();
   const result = await client.execute({
@@ -5124,11 +5166,11 @@ async function extractTrajectory(taskId, agentId) {
   return signature;
 }
 function hashSignature(signature) {
-  return crypto6.createHash("sha256").update(signature.join("|")).digest("hex").slice(0, 16);
+  return crypto7.createHash("sha256").update(signature.join("|")).digest("hex").slice(0, 16);
 }
 async function storeTrajectory(opts) {
   const client = getClient();
-  const id = crypto6.randomUUID();
+  const id = crypto7.randomUUID();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const signatureHash = hashSignature(opts.signature);
   await client.execute({
@@ -7633,6 +7675,247 @@ var init_daemon_orchestration = __esm({
   }
 });
 
+// src/lib/projection-worker.ts
+var projection_worker_exports = {};
+__export(projection_worker_exports, {
+  processProjectionBatch: () => processProjectionBatch,
+  projectionHandlersForTests: () => projectionHandlersForTests,
+  resetProjectionWorkerForTests: () => resetProjectionWorkerForTests,
+  setProjectionWorkerPrismaClientForTests: () => setProjectionWorkerPrismaClientForTests,
+  startProjectionWorker: () => startProjectionWorker,
+  stopProjectionWorker: () => stopProjectionWorker
+});
+import os12 from "os";
+import path19 from "path";
+import { createRequire as createRequire3 } from "module";
+import { pathToFileURL as pathToFileURL3 } from "url";
+function loadPrisma() {
+  if (!prismaPromise) {
+    prismaPromise = (async () => {
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL3(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path19.join(os12.homedir(), "exe-db");
+      const req = createRequire3(path19.join(exeDbRoot, "package.json"));
+      const entry = req.resolve("@prisma/client");
+      const mod = await import(pathToFileURL3(entry).href);
+      const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+      if (!Ctor) throw new Error(`No PrismaClient in ${entry}`);
+      return new Ctor();
+    })();
+  }
+  return prismaPromise;
+}
+function setProjectionWorkerPrismaClientForTests(client) {
+  prismaPromise = client ? Promise.resolve(client) : null;
+}
+function resetProjectionWorkerForTests() {
+  running = false;
+  if (pollTimer) {
+    clearTimeout(pollTimer);
+    pollTimer = null;
+  }
+  prismaPromise = null;
+}
+async function processBatch() {
+  const prisma = await loadPrisma();
+  const events = await prisma.$queryRawUnsafe(
+    `SELECT "id", "source", "source_id", "event_type", "payload", "metadata", "timestamp"
+     FROM "raw"."raw_events"
+     WHERE "processed_at" IS NULL
+     ORDER BY "timestamp" ASC
+     LIMIT $1`,
+    BATCH_SIZE
+  );
+  if (events.length === 0) return 0;
+  let processed = 0;
+  for (const event of events) {
+    try {
+      const handler = projectionHandlers[event.source] ?? defaultHandler;
+      const result = await handler(event, prisma);
+      await prisma.$executeRawUnsafe(
+        `UPDATE "raw"."raw_events"
+         SET "processed_at" = NOW(), "projections" = $1::jsonb
+         WHERE "id" = $2`,
+        JSON.stringify({ targets: result.targets, skipped: result.skipped }),
+        event.id
+      );
+      processed++;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(
+        `[projection-worker] Error processing event ${event.id}: ${message}
+`
+      );
+      await prisma.$executeRawUnsafe(
+        `UPDATE "raw"."raw_events"
+         SET "processed_at" = NOW(), "projections" = $1::jsonb
+         WHERE "id" = $2`,
+        JSON.stringify({ error: message }),
+        event.id
+      );
+    }
+  }
+  return processed;
+}
+function startProjectionWorker() {
+  if (running) return;
+  running = true;
+  process.stderr.write("[projection-worker] Starting...\n");
+  const tick = async () => {
+    if (!running) return;
+    try {
+      const count = await processBatch();
+      if (count > 0) {
+        process.stderr.write(`[projection-worker] Processed ${count} events.
+`);
+      }
+    } catch (err) {
+      process.stderr.write(
+        `[projection-worker] Poll error: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+    }
+    if (running) {
+      pollTimer = setTimeout(tick, POLL_INTERVAL_MS);
+    }
+  };
+  void tick();
+}
+function stopProjectionWorker() {
+  running = false;
+  if (pollTimer) {
+    clearTimeout(pollTimer);
+    pollTimer = null;
+  }
+  process.stderr.write("[projection-worker] Stopped.\n");
+}
+async function processProjectionBatch() {
+  return processBatch();
+}
+var prismaPromise, projectionHandlers, projectionHandlersForTests, defaultHandler, BATCH_SIZE, POLL_INTERVAL_MS, running, pollTimer;
+var init_projection_worker = __esm({
+  "src/lib/projection-worker.ts"() {
+    "use strict";
+    prismaPromise = null;
+    projectionHandlers = {
+      async whatsapp(event, prisma) {
+        const targets = [];
+        const payload = event.payload;
+        await prisma.$executeRawUnsafe(
+          `INSERT INTO "memory"."memory_records" ("id", "agent_id", "agent_role", "session_id", "tool_name", "project_name", "raw_text", "memory_type", "source_type", "intent")
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+       ON CONFLICT ("id") DO NOTHING`,
+          crypto.randomUUID(),
+          "system",
+          "ingest",
+          "projection-worker",
+          "ingest_raw",
+          "exe-os",
+          JSON.stringify(payload),
+          "raw",
+          "whatsapp",
+          event.event_type
+        );
+        targets.push("memory");
+        return { targets };
+      },
+      async shopify(event, prisma) {
+        const targets = [];
+        const payload = event.payload;
+        await prisma.$executeRawUnsafe(
+          `INSERT INTO "memory"."memory_records" ("id", "agent_id", "agent_role", "session_id", "tool_name", "project_name", "raw_text", "memory_type", "source_type", "intent")
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+       ON CONFLICT ("id") DO NOTHING`,
+          crypto.randomUUID(),
+          "system",
+          "ingest",
+          "projection-worker",
+          "ingest_raw",
+          "exe-os",
+          JSON.stringify(payload),
+          "raw",
+          "shopify",
+          event.event_type
+        );
+        targets.push("memory");
+        return { targets };
+      },
+      async cloud_sync(event, prisma) {
+        const targets = [];
+        const payload = event.payload;
+        await prisma.$executeRawUnsafe(
+          `INSERT INTO "memory"."memory_records" ("id", "agent_id", "agent_role", "session_id", "tool_name", "project_name", "raw_text", "memory_type", "source_type", "intent", "domain")
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+       ON CONFLICT ("id") DO NOTHING`,
+          payload.id ?? crypto.randomUUID(),
+          payload.agent_id ?? "system",
+          payload.agent_role ?? "ingest",
+          payload.session_id ?? "projection-worker",
+          payload.tool_name ?? "cloud_sync",
+          payload.project_name ?? "exe-os",
+          payload.raw_text ?? JSON.stringify(payload),
+          payload.memory_type ?? "raw",
+          "cloud_sync",
+          event.event_type,
+          payload.domain ?? null
+        );
+        targets.push("memory");
+        return { targets };
+      },
+      async external_agent(event, prisma) {
+        const targets = [];
+        const payload = event.payload;
+        await prisma.$executeRawUnsafe(
+          `INSERT INTO "memory"."memory_records" ("id", "agent_id", "agent_role", "session_id", "tool_name", "project_name", "raw_text", "memory_type", "source_type", "intent", "domain")
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+       ON CONFLICT ("id") DO NOTHING`,
+          crypto.randomUUID(),
+          "system",
+          "ingest",
+          "projection-worker",
+          "ingest_raw",
+          "exe-os",
+          JSON.stringify(payload),
+          "raw",
+          "external_agent",
+          event.event_type,
+          payload.domain ?? null
+        );
+        targets.push("memory");
+        return { targets };
+      }
+    };
+    projectionHandlersForTests = projectionHandlers;
+    defaultHandler = async (event, prisma) => {
+      await prisma.$executeRawUnsafe(
+        `INSERT INTO "memory"."memory_records" ("id", "agent_id", "agent_role", "session_id", "tool_name", "project_name", "raw_text", "memory_type", "source_type", "intent")
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+     ON CONFLICT ("id") DO NOTHING`,
+        crypto.randomUUID(),
+        "system",
+        "ingest",
+        "projection-worker",
+        "ingest_raw",
+        "exe-os",
+        JSON.stringify(event.payload),
+        "raw",
+        event.source,
+        event.event_type
+      );
+      return { targets: ["memory"] };
+    };
+    BATCH_SIZE = 50;
+    POLL_INTERVAL_MS = 1e4;
+    running = false;
+    pollTimer = null;
+  }
+});
+
 // src/lib/shard-manager.ts
 var shard_manager_exports = {};
 __export(shard_manager_exports, {
@@ -7647,7 +7930,7 @@ __export(shard_manager_exports, {
   listShards: () => listShards,
   shardExists: () => shardExists
 });
-import path19 from "path";
+import path20 from "path";
 import { existsSync as existsSync17, mkdirSync as mkdirSync7, readdirSync as readdirSync4 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
@@ -7682,7 +7965,7 @@ function getShardClient(projectName) {
   while (_shards.size >= MAX_OPEN_SHARDS) {
     evictLRU();
   }
-  const dbPath = path19.join(SHARDS_DIR, `${safeName}.db`);
+  const dbPath = path20.join(SHARDS_DIR, `${safeName}.db`);
   const client = createClient2({
     url: `file:${dbPath}`,
     encryptionKey: _encryptionKey
@@ -7693,7 +7976,7 @@ function getShardClient(projectName) {
 }
 function shardExists(projectName) {
   const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return existsSync17(path19.join(SHARDS_DIR, `${safeName}.db`));
+  return existsSync17(path20.join(SHARDS_DIR, `${safeName}.db`));
 }
 function listShards() {
   if (!existsSync17(SHARDS_DIR)) return [];
@@ -7943,7 +8226,7 @@ var init_shard_manager = __esm({
   "src/lib/shard-manager.ts"() {
     "use strict";
     init_config();
-    SHARDS_DIR = path19.join(EXE_AI_DIR, "shards");
+    SHARDS_DIR = path20.join(EXE_AI_DIR, "shards");
     SHARD_IDLE_MS = 5 * 60 * 1e3;
     MAX_OPEN_SHARDS = 10;
     EVICTION_INTERVAL_MS = 60 * 1e3;
@@ -7966,13 +8249,13 @@ __export(keychain_exports, {
 });
 import { readFile as readFile4, writeFile as writeFile5, unlink, mkdir as mkdir4, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync18 } from "fs";
-import path20 from "path";
-import os12 from "os";
+import path21 from "path";
+import os13 from "os";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path20.join(os12.homedir(), ".exe-os");
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path21.join(os13.homedir(), ".exe-os");
 }
 function getKeyPath() {
-  return path20.join(getKeyDir(), "master.key");
+  return path21.join(getKeyDir(), "master.key");
 }
 async function tryKeytar() {
   try {
@@ -7995,7 +8278,7 @@ async function getMasterKey() {
   const keyPath = getKeyPath();
   if (!existsSync18(keyPath)) {
     process.stderr.write(
-      `[keychain] Key not found at ${keyPath} (HOME=${os12.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
+      `[keychain] Key not found at ${keyPath} (HOME=${os13.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
 `
     );
     return null;
@@ -9215,16 +9498,16 @@ async function pushToWiki(consolidation, config) {
     const contentLines = consolidation.rawText.split("\n").filter((l) => l.trim() && !l.startsWith("CONSOLIDATION") && !l.match(/^[A-Z\s]+:$/)).join(" ");
     const keywords = contentLines.toLowerCase().replace(/[^a-z0-9\s]/g, "").split(/\s+/).filter((w) => w.length > 3);
     let bestMatch = null;
-    for (const doc of docs) {
-      if (!doc.id || !doc.title) continue;
-      const titleWords = doc.title.toLowerCase().replace(/[^a-z0-9\s]/g, "").split(/\s+/).filter((w) => w.length > 3);
+    for (const doc2 of docs) {
+      if (!doc2.id || !doc2.title) continue;
+      const titleWords = doc2.title.toLowerCase().replace(/[^a-z0-9\s]/g, "").split(/\s+/).filter((w) => w.length > 3);
       if (titleWords.length === 0) continue;
       const matchCount = titleWords.filter(
         (tw) => keywords.some((k) => k.includes(tw) || tw.includes(k))
       ).length;
       const score = matchCount / titleWords.length;
       if (score > (bestMatch?.score ?? 0)) {
-        bestMatch = { id: doc.id, title: doc.title, score };
+        bestMatch = { id: doc2.id, title: doc2.title, score };
       }
     }
     if (bestMatch && bestMatch.score >= config.wikiAutoUpdateThreshold) {
@@ -9453,10 +9736,10 @@ async function disposeEmbedder() {
 async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync21 } = await import("fs");
-  const path25 = await import("path");
-  const modelPath = path25.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync21(modelPath)) {
+  const { existsSync: existsSync23 } = await import("fs");
+  const path28 = await import("path");
+  const modelPath = path28.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync23(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -9484,69 +9767,1554 @@ var init_embedder = __esm({
   }
 });
 
-// src/lib/code-chunker.ts
-import ts from "typescript";
-function chunkSourceFile(source, fileName = "file.ts") {
-  const sourceFile = ts.createSourceFile(
-    fileName,
-    source,
-    ts.ScriptTarget.Latest,
-    true,
-    // setParentNodes
-    fileName.endsWith(".tsx") || fileName.endsWith(".jsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS
+// src/lib/crypto.ts
+import crypto8 from "crypto";
+function initSyncCrypto(masterKey) {
+  if (masterKey.length !== 32) {
+    throw new Error(`Master key must be 32 bytes, got ${masterKey.length}`);
+  }
+  _syncKey = Buffer.from(
+    crypto8.hkdfSync("sha256", masterKey, "", SYNC_HKDF_INFO, 32)
   );
-  const chunks = [];
-  const lines = source.split("\n");
-  const importLines = [];
-  function getLineNumber(pos) {
-    return sourceFile.getLineAndCharacterOfPosition(pos).line + 1;
+}
+function isSyncCryptoInitialized() {
+  return _syncKey !== null;
+}
+function requireSyncKey() {
+  if (!_syncKey) {
+    throw new Error("Sync crypto not initialized. Call initSyncCrypto(masterKey) first.");
+  }
+  return _syncKey;
+}
+function encryptSyncBlob(data) {
+  const key = requireSyncKey();
+  const iv = crypto8.randomBytes(IV_LENGTH);
+  const cipher = crypto8.createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, encrypted, tag]).toString("base64");
+}
+function decryptSyncBlob(ciphertext) {
+  const key = requireSyncKey();
+  const combined = Buffer.from(ciphertext, "base64");
+  if (combined.length < IV_LENGTH + TAG_LENGTH) {
+    throw new Error("Sync blob too short to contain IV + tag");
+  }
+  const iv = combined.subarray(0, IV_LENGTH);
+  const tag = combined.subarray(combined.length - TAG_LENGTH);
+  const encrypted = combined.subarray(IV_LENGTH, combined.length - TAG_LENGTH);
+  const decipher = crypto8.createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(encrypted), decipher.final()]);
+}
+var ALGORITHM, IV_LENGTH, TAG_LENGTH, SYNC_HKDF_INFO, _syncKey;
+var init_crypto = __esm({
+  "src/lib/crypto.ts"() {
+    "use strict";
+    ALGORITHM = "aes-256-gcm";
+    IV_LENGTH = 12;
+    TAG_LENGTH = 16;
+    SYNC_HKDF_INFO = "exe-mem-sync-v2";
+    _syncKey = null;
   }
-  function getLeadingComment(node) {
-    const fullText = sourceFile.getFullText();
-    const ranges = ts.getLeadingCommentRanges(fullText, node.getFullStart());
-    if (!ranges || ranges.length === 0) return void 0;
-    return ranges.map((r) => fullText.slice(r.pos, r.end)).join("\n");
+});
+
+// src/lib/compress.ts
+import { brotliCompressSync, brotliDecompressSync, constants } from "zlib";
+function compress(input) {
+  if (input.length === 0) return Buffer.alloc(0);
+  return brotliCompressSync(input, {
+    params: {
+      [constants.BROTLI_PARAM_QUALITY]: 4
+    }
+  });
+}
+function decompress(input) {
+  if (input.length === 0) return Buffer.alloc(0);
+  return brotliDecompressSync(input);
+}
+var init_compress = __esm({
+  "src/lib/compress.ts"() {
+    "use strict";
   }
-  function getNodeText(node) {
-    return node.getText(sourceFile);
+});
+
+// src/lib/crdt-sync.ts
+var crdt_sync_exports = {};
+__export(crdt_sync_exports, {
+  _setStatePath: () => _setStatePath,
+  applyRemoteUpdate: () => applyRemoteUpdate,
+  destroyCrdtDoc: () => destroyCrdtDoc,
+  getDiffUpdate: () => getDiffUpdate,
+  getFullState: () => getFullState,
+  getStateVector: () => getStateVector,
+  importExistingBehaviors: () => importExistingBehaviors,
+  importExistingMemories: () => importExistingMemories,
+  initCrdtDoc: () => initCrdtDoc,
+  isCrdtSyncEnabled: () => isCrdtSyncEnabled,
+  onUpdate: () => onUpdate,
+  readAllBehaviors: () => readAllBehaviors,
+  readAllMemories: () => readAllMemories,
+  rebuildFromDb: () => rebuildFromDb
+});
+import * as Y from "yjs";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync10, existsSync as existsSync19, mkdirSync as mkdirSync8, unlinkSync as unlinkSync7 } from "fs";
+import path22 from "path";
+import { homedir as homedir2 } from "os";
+function getStatePath() {
+  return _statePathOverride ?? DEFAULT_STATE_PATH;
+}
+function _setStatePath(p) {
+  _statePathOverride = p;
+}
+function initCrdtDoc() {
+  if (doc) return doc;
+  doc = new Y.Doc();
+  const sp = getStatePath();
+  if (existsSync19(sp)) {
+    try {
+      const state = readFileSync15(sp);
+      Y.applyUpdate(doc, new Uint8Array(state));
+    } catch {
+      console.warn("[crdt-sync] WARN: corrupted state file, rebuilding from DB");
+      try {
+        unlinkSync7(sp);
+      } catch {
+      }
+      rebuildFromDb().catch((err) => {
+        console.warn("[crdt-sync] rebuild from DB failed:", err);
+      });
+    }
   }
-  function getName(node) {
-    if (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node)) {
-      return node.name?.getText(sourceFile) ?? "(anonymous)";
+  doc.on("update", () => {
+    persistState();
+  });
+  return doc;
+}
+function getMemoriesMap() {
+  const d = initCrdtDoc();
+  return d.getMap("memories");
+}
+function getBehaviorsMap() {
+  const d = initCrdtDoc();
+  return d.getMap("behaviors");
+}
+function applyRemoteUpdate(update) {
+  const d = initCrdtDoc();
+  Y.applyUpdate(d, update);
+}
+function getFullState() {
+  const d = initCrdtDoc();
+  return Y.encodeStateAsUpdate(d);
+}
+function getDiffUpdate(remoteStateVector) {
+  const d = initCrdtDoc();
+  return Y.encodeStateAsUpdate(d, remoteStateVector);
+}
+function getStateVector() {
+  const d = initCrdtDoc();
+  return Y.encodeStateVector(d);
+}
+function importExistingMemories(memories) {
+  const map = getMemoriesMap();
+  const d = initCrdtDoc();
+  let imported = 0;
+  d.transact(() => {
+    for (const mem of memories) {
+      if (!mem.id) continue;
+      if (map.has(mem.id)) continue;
+      const entry = new Y.Map();
+      entry.set("id", mem.id);
+      entry.set("agent_id", mem.agent_id ?? null);
+      entry.set("agent_role", mem.agent_role ?? null);
+      entry.set("session_id", mem.session_id ?? null);
+      entry.set("timestamp", mem.timestamp ?? null);
+      entry.set("tool_name", mem.tool_name ?? null);
+      entry.set("project_name", mem.project_name ?? null);
+      entry.set("has_error", mem.has_error ?? 0);
+      entry.set("raw_text", mem.raw_text ?? "");
+      entry.set("version", mem.version ?? 0);
+      entry.set("author_device_id", mem.author_device_id ?? null);
+      entry.set("scope", mem.scope ?? "business");
+      map.set(mem.id, entry);
+      imported++;
     }
-    if (ts.isClassDeclaration(node)) {
-      return node.name?.getText(sourceFile) ?? "(anonymous class)";
+  });
+  return imported;
+}
+function importExistingBehaviors(behaviors) {
+  const map = getBehaviorsMap();
+  const d = initCrdtDoc();
+  let imported = 0;
+  d.transact(() => {
+    for (const beh of behaviors) {
+      if (!beh.id) continue;
+      if (map.has(beh.id)) continue;
+      const entry = new Y.Map();
+      entry.set("id", beh.id);
+      entry.set("agent_id", beh.agent_id ?? null);
+      entry.set("project_name", beh.project_name ?? null);
+      entry.set("domain", beh.domain ?? null);
+      entry.set("content", beh.content ?? null);
+      entry.set("active", beh.active ?? 1);
+      entry.set("priority", beh.priority ?? "p1");
+      entry.set("created_at", beh.created_at ?? null);
+      entry.set("updated_at", beh.updated_at ?? null);
+      map.set(beh.id, entry);
+      imported++;
     }
-    if (ts.isInterfaceDeclaration(node)) {
-      return node.name.getText(sourceFile);
+  });
+  return imported;
+}
+function readAllMemories() {
+  const map = getMemoriesMap();
+  const records = [];
+  map.forEach((entry, id) => {
+    records.push({
+      id,
+      agent_id: entry.get("agent_id"),
+      agent_role: entry.get("agent_role"),
+      session_id: entry.get("session_id"),
+      timestamp: entry.get("timestamp"),
+      tool_name: entry.get("tool_name"),
+      project_name: entry.get("project_name"),
+      has_error: entry.get("has_error"),
+      raw_text: entry.get("raw_text"),
+      version: entry.get("version"),
+      author_device_id: entry.get("author_device_id"),
+      scope: entry.get("scope")
+    });
+  });
+  return records;
+}
+function readAllBehaviors() {
+  const map = getBehaviorsMap();
+  const records = [];
+  map.forEach((entry, id) => {
+    records.push({
+      id,
+      agent_id: entry.get("agent_id"),
+      project_name: entry.get("project_name"),
+      domain: entry.get("domain"),
+      content: entry.get("content"),
+      active: entry.get("active"),
+      priority: entry.get("priority"),
+      created_at: entry.get("created_at"),
+      updated_at: entry.get("updated_at")
+    });
+  });
+  return records;
+}
+function onUpdate(callback) {
+  const d = initCrdtDoc();
+  const handler = (update) => callback(update);
+  d.on("update", handler);
+  return () => d.off("update", handler);
+}
+function persistState() {
+  if (!doc) return;
+  try {
+    const sp = getStatePath();
+    const dir = path22.dirname(sp);
+    if (!existsSync19(dir)) mkdirSync8(dir, { recursive: true });
+    const state = Y.encodeStateAsUpdate(doc);
+    writeFileSync10(sp, Buffer.from(state));
+  } catch {
+  }
+}
+function isCrdtSyncEnabled() {
+  return process.env.EXE_CRDT_SYNC !== "0";
+}
+async function rebuildFromDb() {
+  const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+  const client = getClient2();
+  const result = await client.execute(
+    "SELECT id, agent_id, agent_role, session_id, timestamp, tool_name, project_name, has_error, raw_text, version, author_device_id, scope FROM memories"
+  );
+  const memories = result.rows.map((row) => ({
+    id: String(row.id),
+    agent_id: row.agent_id,
+    agent_role: row.agent_role,
+    session_id: row.session_id,
+    timestamp: row.timestamp,
+    tool_name: row.tool_name,
+    project_name: row.project_name,
+    has_error: row.has_error,
+    raw_text: row.raw_text,
+    version: row.version,
+    author_device_id: row.author_device_id,
+    scope: row.scope
+  }));
+  const count = importExistingMemories(memories);
+  persistState();
+  return count;
+}
+function destroyCrdtDoc() {
+  if (doc) {
+    doc.destroy();
+    doc = null;
+  }
+}
+var DEFAULT_STATE_PATH, _statePathOverride, doc;
+var init_crdt_sync = __esm({
+  "src/lib/crdt-sync.ts"() {
+    "use strict";
+    DEFAULT_STATE_PATH = path22.join(homedir2(), ".exe-os", "crdt-state.bin");
+    _statePathOverride = null;
+    doc = null;
+  }
+});
+
+// src/lib/cloud-sync.ts
+var cloud_sync_exports = {};
+__export(cloud_sync_exports, {
+  assertSecureEndpoint: () => assertSecureEndpoint,
+  buildRosterBlob: () => buildRosterBlob,
+  cloudPull: () => cloudPull,
+  cloudPullBehaviors: () => cloudPullBehaviors,
+  cloudPullBlob: () => cloudPullBlob,
+  cloudPullConversations: () => cloudPullConversations,
+  cloudPullDocuments: () => cloudPullDocuments,
+  cloudPullGlobalProcedures: () => cloudPullGlobalProcedures,
+  cloudPullGraphRAG: () => cloudPullGraphRAG,
+  cloudPullRoster: () => cloudPullRoster,
+  cloudPullTasks: () => cloudPullTasks,
+  cloudPush: () => cloudPush,
+  cloudPushBehaviors: () => cloudPushBehaviors,
+  cloudPushBlob: () => cloudPushBlob,
+  cloudPushConversations: () => cloudPushConversations,
+  cloudPushDocuments: () => cloudPushDocuments,
+  cloudPushGlobalProcedures: () => cloudPushGlobalProcedures,
+  cloudPushGraphRAG: () => cloudPushGraphRAG,
+  cloudPushRoster: () => cloudPushRoster,
+  cloudPushTasks: () => cloudPushTasks,
+  cloudSync: () => cloudSync,
+  mergeConfig: () => mergeConfig,
+  mergeRosterFromRemote: () => mergeRosterFromRemote,
+  pushToPostgres: () => pushToPostgres,
+  recordRosterDeletion: () => recordRosterDeletion
+});
+import { readFileSync as readFileSync16, writeFileSync as writeFileSync11, existsSync as existsSync20, readdirSync as readdirSync5, mkdirSync as mkdirSync9, appendFileSync as appendFileSync2, unlinkSync as unlinkSync8, openSync as openSync2, closeSync as closeSync2 } from "fs";
+import crypto9 from "crypto";
+import path23 from "path";
+import { homedir as homedir3 } from "os";
+function sqlSafe(v) {
+  return v === void 0 ? null : v;
+}
+function logError(msg) {
+  try {
+    const logPath = path23.join(homedir3(), ".exe-os", "workers.log");
+    appendFileSync2(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
+`);
+  } catch {
+  }
+}
+function loadPgClient() {
+  if (_pgFailed) return null;
+  const postgresUrl = process.env.DATABASE_URL;
+  const configPath = path23.join(EXE_AI_DIR, "config.json");
+  let cloudPostgresUrl;
+  try {
+    if (existsSync20(configPath)) {
+      const cfg = JSON.parse(readFileSync16(configPath, "utf8"));
+      cloudPostgresUrl = cfg.cloud?.postgresUrl;
+      if (cfg.cloud?.syncToPostgres === false) {
+        _pgFailed = true;
+        return null;
+      }
     }
-    if (ts.isTypeAliasDeclaration(node)) {
-      return node.name.getText(sourceFile);
+  } catch {
+  }
+  const url = postgresUrl || cloudPostgresUrl;
+  if (!url) {
+    _pgFailed = true;
+    return null;
+  }
+  if (!_pgPromise) {
+    _pgPromise = (async () => {
+      const { createRequire: createRequire4 } = await import("module");
+      const { pathToFileURL: pathToFileURL4 } = await import("url");
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path23.join(homedir3(), "exe-db");
+      const req = createRequire4(path23.join(exeDbRoot, "package.json"));
+      const entry = req.resolve("@prisma/client");
+      const mod = await import(pathToFileURL4(entry).href);
+      const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+      if (!Ctor) throw new Error("No PrismaClient");
+      return new Ctor();
+    })().catch(() => {
+      _pgFailed = true;
+      _pgPromise = null;
+      throw new Error("pg_unavailable");
+    });
+  }
+  return _pgPromise;
+}
+async function pushToPostgres(records) {
+  const loader = loadPgClient();
+  if (!loader) return 0;
+  let prisma;
+  try {
+    prisma = await loader;
+  } catch {
+    return 0;
+  }
+  let inserted = 0;
+  for (const rec of records) {
+    try {
+      await prisma.$executeRawUnsafe(
+        `INSERT INTO raw.raw_events (id, source, source_id, event_type, payload, metadata, timestamp)
+         VALUES (gen_random_uuid(), 'cloud_sync', $1, 'memory', $2::jsonb, $3::jsonb, $4)
+         ON CONFLICT (source, source_id, event_type) DO NOTHING`,
+        String(rec.id ?? ""),
+        JSON.stringify(rec),
+        JSON.stringify({ agent_id: rec.agent_id, project_name: rec.project_name, tool_name: rec.tool_name }),
+        rec.timestamp ? new Date(String(rec.timestamp)) : /* @__PURE__ */ new Date()
+      );
+      inserted++;
+    } catch {
     }
-    if (ts.isEnumDeclaration(node)) {
-      return node.name.getText(sourceFile);
+  }
+  return inserted;
+}
+async function withRosterLock(fn) {
+  try {
+    const fd = openSync2(ROSTER_LOCK_PATH, "wx");
+    closeSync2(fd);
+    writeFileSync11(ROSTER_LOCK_PATH, String(Date.now()));
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      try {
+        const ts2 = parseInt(readFileSync16(ROSTER_LOCK_PATH, "utf-8"), 10);
+        if (Date.now() - ts2 < LOCK_STALE_MS) {
+          throw new Error("Roster merge already in progress \u2014 another sync is running");
+        }
+        unlinkSync8(ROSTER_LOCK_PATH);
+        const fd = openSync2(ROSTER_LOCK_PATH, "wx");
+        closeSync2(fd);
+        writeFileSync11(ROSTER_LOCK_PATH, String(Date.now()));
+      } catch (retryErr) {
+        if (retryErr instanceof Error && retryErr.message.includes("already in progress")) throw retryErr;
+        throw new Error("Roster merge already in progress \u2014 another sync is running");
+      }
+    } else {
+      throw err;
     }
-    if (ts.isVariableStatement(node)) {
-      const decls = node.declarationList.declarations;
-      return decls.map((d) => d.name.getText(sourceFile)).join(", ");
+  }
+  try {
+    return await fn();
+  } finally {
+    try {
+      unlinkSync8(ROSTER_LOCK_PATH);
+    } catch {
     }
-    if (ts.isExportAssignment(node)) {
-      return "default export";
+  }
+}
+async function fetchWithRetry(url, init) {
+  const MAX_RETRIES4 = 3;
+  const BASE_DELAY_MS2 = 200;
+  let lastError;
+  for (let attempt = 0; attempt <= MAX_RETRIES4; attempt++) {
+    try {
+      const signal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
+      const resp = await fetch(url, { ...init, signal });
+      if (resp && resp.status >= 500 && attempt < MAX_RETRIES4) {
+        await new Promise((r) => setTimeout(r, BASE_DELAY_MS2 * Math.pow(2, attempt)));
+        continue;
+      }
+      return resp;
+    } catch (err) {
+      lastError = err;
+      if (attempt === MAX_RETRIES4) throw err;
+      await new Promise((r) => setTimeout(r, BASE_DELAY_MS2 * Math.pow(2, attempt)));
     }
-    return "(unknown)";
   }
-  function visitTopLevel(node) {
-    if (ts.isImportDeclaration(node)) {
-      importLines.push({
-        start: getLineNumber(node.getStart(sourceFile)),
-        end: getLineNumber(node.getEnd())
-      });
+  throw lastError;
+}
+function assertSecureEndpoint(endpoint) {
+  if (endpoint.startsWith("https://")) return;
+  if (endpoint.startsWith("http://")) {
+    try {
+      const parsed = new URL(endpoint);
+      if (LOCALHOST_PATTERNS.test(parsed.hostname)) return;
+    } catch {
       return;
     }
-    if (ts.isFunctionDeclaration(node)) {
-      chunks.push({
-        kind: "function",
-        name: getName(node),
+    throw new Error(
+      `Insecure cloud endpoint rejected: "${endpoint}". Use https:// for remote hosts. Plain http:// is only allowed for localhost.`
+    );
+  }
+}
+async function cloudPush(records, maxVersion, config) {
+  if (records.length === 0) return true;
+  assertSecureEndpoint(config.endpoint);
+  try {
+    const json = JSON.stringify(records);
+    const compressed = compress(Buffer.from(json, "utf8"));
+    const blob = encryptSyncBlob(compressed);
+    const resp = await fetchWithRetry(`${config.endpoint}/sync/push`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Device-Id": loadDeviceId(),
+        "X-Expected-Version": String(maxVersion)
+      },
+      body: JSON.stringify({ version: maxVersion, blob })
+    });
+    if (resp == null) {
+      logError("[cloud-sync] PUSH FAILED: no response from server");
+      return false;
+    }
+    if (resp.status === 409) {
+      logError("[cloud-sync] PUSH VERSION CONFLICT \u2014 re-pull required before next push");
+      return false;
+    }
+    return resp.ok;
+  } catch (err) {
+    logError(`[cloud-sync] PUSH FAILED: ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+}
+async function cloudPull(sinceVersion, config) {
+  assertSecureEndpoint(config.endpoint);
+  try {
+    const response = await fetchWithRetry(`${config.endpoint}/sync/pull`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Device-Id": loadDeviceId()
+      },
+      body: JSON.stringify({ since_version: sinceVersion })
+    });
+    if (response == null) {
+      logError("[cloud-sync] PULL FAILED: no response from server");
+      return { records: [], maxVersion: sinceVersion };
+    }
+    if (!response.ok) return { records: [], maxVersion: sinceVersion };
+    const data = await response.json();
+    const allRecords = [];
+    for (const { blob } of data.blobs ?? []) {
+      try {
+        const compressed = decryptSyncBlob(blob);
+        const json = decompress(compressed).toString("utf8");
+        const records = JSON.parse(json);
+        allRecords.push(...records);
+      } catch {
+        continue;
+      }
+    }
+    return { records: allRecords, maxVersion: data.max_version ?? sinceVersion };
+  } catch (err) {
+    logError(`[cloud-sync] PULL FAILED: ${err instanceof Error ? err.message : String(err)}`);
+    return { records: [], maxVersion: sinceVersion };
+  }
+}
+async function cloudSync(config) {
+  if (!isSyncCryptoInitialized()) {
+    try {
+      const { getMasterKey: getMasterKey2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
+      const masterKey = await getMasterKey2();
+      if (masterKey) {
+        initSyncCrypto(masterKey);
+      } else {
+        throw new Error("No master key found");
+      }
+    } catch (err) {
+      throw new Error(`[cloud-sync] Cannot initialize encryption: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  let client;
+  try {
+    client = getClient();
+  } catch {
+    throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
+  }
+  try {
+    const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+    await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");
+  } catch {
+  }
+  try {
+    await client.execute(
+      "CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)"
+    );
+  } catch (e) {
+    logError(`[cloud-sync] sync_meta CREATE failed: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  const pullMeta = await client.execute(
+    "SELECT value FROM sync_meta WHERE key = 'last_cloud_pull_version'"
+  );
+  const lastPullVersion = pullMeta.rows.length > 0 ? Number(pullMeta.rows[0].value) : 0;
+  const pullResult = await cloudPull(lastPullVersion, config);
+  let pulled = 0;
+  if (pullResult.records.length > 0) {
+    if (isCrdtSyncEnabled()) {
+      const { initCrdtDoc: initCrdtDoc2, importExistingMemories: importExistingMemories2, readAllMemories: readAllMemories2 } = await Promise.resolve().then(() => (init_crdt_sync(), crdt_sync_exports));
+      initCrdtDoc2();
+      importExistingMemories2(
+        pullResult.records.map((rec) => ({
+          id: String(rec.id ?? ""),
+          agent_id: rec.agent_id,
+          agent_role: rec.agent_role,
+          session_id: rec.session_id,
+          timestamp: rec.timestamp,
+          tool_name: rec.tool_name,
+          project_name: rec.project_name,
+          has_error: rec.has_error ?? 0,
+          raw_text: rec.raw_text ?? "",
+          version: rec.version ?? 0,
+          author_device_id: rec.author_device_id,
+          scope: rec.scope ?? "business"
+        }))
+      );
+      const pulledIds = new Set(pullResult.records.map((r) => String(r.id ?? "")));
+      const merged = readAllMemories2().filter((rec) => pulledIds.has(rec.id));
+      const stmts = merged.map((rec) => ({
+        sql: `INSERT OR REPLACE INTO memories
+              (id, agent_id, agent_role, session_id, timestamp,
+               tool_name, project_name, has_error, raw_text, version,
+               author_device_id, scope)
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          sqlSafe(rec.id),
+          sqlSafe(rec.agent_id),
+          sqlSafe(rec.agent_role),
+          sqlSafe(rec.session_id),
+          sqlSafe(rec.timestamp),
+          sqlSafe(rec.tool_name),
+          sqlSafe(rec.project_name),
+          sqlSafe(rec.has_error ?? 0),
+          sqlSafe(rec.raw_text ?? ""),
+          sqlSafe(rec.version ?? 0),
+          sqlSafe(rec.author_device_id),
+          sqlSafe(rec.scope ?? "business")
+        ]
+      }));
+      if (stmts.length > 0) await client.batch(stmts, "write");
+      pulled = pullResult.records.length;
+    } else {
+      const stmts = pullResult.records.map((rec) => ({
+        sql: `INSERT OR REPLACE INTO memories
+              (id, agent_id, agent_role, session_id, timestamp,
+               tool_name, project_name, has_error, raw_text, version,
+               author_device_id, scope)
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          sqlSafe(rec.id),
+          sqlSafe(rec.agent_id),
+          sqlSafe(rec.agent_role),
+          sqlSafe(rec.session_id),
+          sqlSafe(rec.timestamp),
+          sqlSafe(rec.tool_name),
+          sqlSafe(rec.project_name),
+          sqlSafe(rec.has_error ?? 0),
+          sqlSafe(rec.raw_text ?? ""),
+          sqlSafe(rec.version ?? 0),
+          sqlSafe(rec.author_device_id),
+          sqlSafe(rec.scope ?? "business")
+        ]
+      }));
+      await client.batch(stmts, "write");
+      pulled = pullResult.records.length;
+    }
+  }
+  if (pulled > 0) {
+    try {
+      await pushToPostgres(pullResult.records);
+    } catch {
+    }
+  }
+  if (pullResult.maxVersion > lastPullVersion) {
+    await client.execute({
+      sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_pull_version', ?)",
+      args: [String(pullResult.maxVersion)]
+    });
+  }
+  const pushMeta = await client.execute(
+    "SELECT value FROM sync_meta WHERE key = 'last_cloud_push_version'"
+  );
+  const lastPushVersion = pushMeta.rows.length > 0 ? Number(pushMeta.rows[0].value) : 0;
+  let pushed = 0;
+  let batchCursor = lastPushVersion;
+  while (true) {
+    const recordsResult = await client.execute({
+      sql: `SELECT id, agent_id, agent_role, session_id, timestamp,
+                   tool_name, project_name, has_error, raw_text, version,
+                   author_device_id, scope
+            FROM memories
+            WHERE version > ?
+              AND (scope IS NULL OR scope != 'personal')
+            ORDER BY version ASC
+            LIMIT ?`,
+      args: [batchCursor, PUSH_BATCH_SIZE]
+    });
+    if (recordsResult.rows.length === 0) break;
+    const records = recordsResult.rows.map((row) => ({
+      id: row.id,
+      agent_id: row.agent_id,
+      agent_role: row.agent_role,
+      session_id: row.session_id,
+      timestamp: row.timestamp,
+      tool_name: row.tool_name,
+      project_name: row.project_name,
+      has_error: row.has_error,
+      raw_text: row.raw_text,
+      version: row.version,
+      author_device_id: row.author_device_id,
+      scope: row.scope
+    }));
+    const maxVersion = Number(records[records.length - 1].version);
+    const pushOk = await cloudPush(records, maxVersion, config);
+    if (!pushOk) break;
+    try {
+      await pushToPostgres(records);
+    } catch {
+    }
+    await client.execute({
+      sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_cloud_push_version', ?)",
+      args: [String(maxVersion)]
+    });
+    pushed += records.length;
+    batchCursor = maxVersion;
+    if (recordsResult.rows.length < PUSH_BATCH_SIZE) break;
+  }
+  try {
+    await cloudPushRoster(config);
+  } catch (err) {
+    logError(`[cloud-sync] Roster push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    await cloudPullRoster(config);
+  } catch (err) {
+    logError(`[cloud-sync] Roster pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    await cloudPushGlobalProcedures(config);
+  } catch (err) {
+    logError(`[cloud-sync] Global procedures push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    await cloudPullGlobalProcedures(config);
+  } catch (err) {
+    logError(`[cloud-sync] Global procedures pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const countRows = async (sql) => {
+    try {
+      return Number((await client.execute(sql)).rows[0]?.cnt ?? 0);
+    } catch {
+      return 0;
+    }
+  };
+  let behaviorsResult = { pushed: 0, pulled: 0 };
+  try {
+    await cloudPushBehaviors(config);
+    behaviorsResult.pushed = await countRows("SELECT COUNT(*) as cnt FROM behaviors WHERE active = 1");
+  } catch (err) {
+    logError(`[cloud-sync] Behaviors push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const pullResult2 = await cloudPullBehaviors(config);
+    behaviorsResult.pulled = pullResult2.pulled;
+  } catch (err) {
+    logError(`[cloud-sync] Behaviors pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let graphragResult = { pushed: 0, pulled: 0 };
+  try {
+    await cloudPushGraphRAG(config);
+    graphragResult.pushed = await countRows("SELECT COUNT(*) as cnt FROM entities");
+  } catch (err) {
+    logError(`[cloud-sync] GraphRAG push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const pullResult2 = await cloudPullGraphRAG(config);
+    graphragResult.pulled = pullResult2.pulled;
+  } catch (err) {
+    logError(`[cloud-sync] GraphRAG pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let tasksResult = { pushed: 0, pulled: 0 };
+  try {
+    await cloudPushTasks(config);
+    tasksResult.pushed = await countRows("SELECT COUNT(*) as cnt FROM tasks");
+  } catch (err) {
+    logError(`[cloud-sync] Tasks push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const pullResult2 = await cloudPullTasks(config);
+    tasksResult.pulled = pullResult2.pulled;
+  } catch (err) {
+    logError(`[cloud-sync] Tasks pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let conversationsResult = { pushed: 0, pulled: 0 };
+  try {
+    await cloudPushConversations(config);
+    conversationsResult.pushed = await countRows("SELECT COUNT(*) as cnt FROM conversations");
+  } catch (err) {
+    logError(`[cloud-sync] Conversations push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const pullResult2 = await cloudPullConversations(config);
+    conversationsResult.pulled = pullResult2.pulled;
+  } catch (err) {
+    logError(`[cloud-sync] Conversations pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let documentsResult = { pushed: 0, pulled: 0 };
+  try {
+    await cloudPushDocuments(config);
+    documentsResult.pushed = await countRows("SELECT COUNT(*) as cnt FROM documents");
+  } catch (err) {
+    logError(`[cloud-sync] Documents push: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const pullResult2 = await cloudPullDocuments(config);
+    documentsResult.pulled = pullResult2.pulled;
+  } catch (err) {
+    logError(`[cloud-sync] Documents pull: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let rosterResult = { employees: 0, identities: 0 };
+  try {
+    const employees = await loadEmployees();
+    rosterResult.employees = employees.length;
+    const idDir = path23.join(EXE_AI_DIR, "identity");
+    if (existsSync20(idDir)) {
+      rosterResult.identities = readdirSync5(idDir).filter((f) => f.endsWith(".md")).length;
+    }
+  } catch {
+  }
+  const totalMemories = await countRows("SELECT COUNT(*) as cnt FROM memories WHERE status = 'active' OR status IS NULL");
+  return {
+    pushed,
+    pulled,
+    totalMemories,
+    behaviors: behaviorsResult,
+    graphrag: graphragResult,
+    tasks: tasksResult,
+    conversations: conversationsResult,
+    documents: documentsResult,
+    roster: rosterResult
+  };
+}
+function recordRosterDeletion(name) {
+  let deletions = [];
+  try {
+    if (existsSync20(ROSTER_DELETIONS_PATH)) {
+      deletions = JSON.parse(readFileSync16(ROSTER_DELETIONS_PATH, "utf-8"));
+    }
+  } catch {
+  }
+  if (!deletions.includes(name)) deletions.push(name);
+  writeFileSync11(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
+}
+function consumeRosterDeletions() {
+  try {
+    if (!existsSync20(ROSTER_DELETIONS_PATH)) return [];
+    const deletions = JSON.parse(readFileSync16(ROSTER_DELETIONS_PATH, "utf-8"));
+    writeFileSync11(ROSTER_DELETIONS_PATH, "[]");
+    return deletions;
+  } catch {
+    return [];
+  }
+}
+function buildRosterBlob(paths) {
+  const rosterPath = paths?.rosterPath ?? path23.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path23.join(EXE_AI_DIR, "identity");
+  const configPath = paths?.configPath ?? path23.join(EXE_AI_DIR, "config.json");
+  let roster = [];
+  if (existsSync20(rosterPath)) {
+    try {
+      roster = JSON.parse(readFileSync16(rosterPath, "utf-8"));
+    } catch {
+    }
+  }
+  const identities = {};
+  if (existsSync20(identityDir)) {
+    for (const file of readdirSync5(identityDir).filter((f) => f.endsWith(".md"))) {
+      try {
+        identities[file] = readFileSync16(path23.join(identityDir, file), "utf-8");
+      } catch {
+      }
+    }
+  }
+  let config;
+  if (existsSync20(configPath)) {
+    try {
+      config = JSON.parse(readFileSync16(configPath, "utf-8"));
+    } catch {
+    }
+  }
+  let agentConfig;
+  const agentConfigPath = path23.join(EXE_AI_DIR, "agent-config.json");
+  if (existsSync20(agentConfigPath)) {
+    try {
+      agentConfig = JSON.parse(readFileSync16(agentConfigPath, "utf-8"));
+    } catch {
+    }
+  }
+  const deletedNames = consumeRosterDeletions();
+  const content = JSON.stringify({ roster, identities, config, agentConfig, deletedNames });
+  const hash = crypto9.createHash("sha256").update(content).digest("hex").slice(0, 16);
+  return { roster, identities, config, agentConfig, deletedNames, version: hash };
+}
+async function cloudPushRoster(config) {
+  assertSecureEndpoint(config.endpoint);
+  const blob = buildRosterBlob();
+  if (blob.roster.length === 0) return true;
+  try {
+    const client = getClient();
+    const meta = await client.execute(
+      "SELECT value FROM sync_meta WHERE key = 'last_roster_push_version'"
+    );
+    const lastVersion = meta.rows.length > 0 ? Number(meta.rows[0].value) : 0;
+    if (blob.version === lastVersion) return true;
+  } catch {
+  }
+  try {
+    const json = JSON.stringify(blob);
+    const compressed = compress(Buffer.from(json, "utf8"));
+    const encrypted = encryptSyncBlob(compressed);
+    const resp = await fetchWithRetry(`${config.endpoint}/sync/push-roster`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Device-Id": loadDeviceId()
+      },
+      body: JSON.stringify({ blob: encrypted })
+    });
+    if (resp.ok) {
+      try {
+        const client = getClient();
+        await client.execute({
+          sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('last_roster_push_version', ?)",
+          args: [String(blob.version)]
+        });
+      } catch {
+      }
+    }
+    return resp.ok;
+  } catch (err) {
+    process.stderr.write(`[cloud-sync] ROSTER PUSH FAILED: ${err instanceof Error ? err.message : String(err)}
+`);
+    return false;
+  }
+}
+async function cloudPullRoster(config) {
+  assertSecureEndpoint(config.endpoint);
+  try {
+    const resp = await fetchWithRetry(`${config.endpoint}/sync/pull-roster`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "X-Device-Id": loadDeviceId()
+      }
+    });
+    if (!resp.ok) return { added: 0 };
+    const data = await resp.json();
+    if (!data.blob) return { added: 0 };
+    const compressed = decryptSyncBlob(data.blob);
+    const json = decompress(compressed).toString("utf8");
+    const remote = JSON.parse(json);
+    return mergeRosterFromRemote(remote);
+  } catch (err) {
+    process.stderr.write(`[cloud-sync] ROSTER PULL FAILED: ${err instanceof Error ? err.message : String(err)}
+`);
+    return { added: 0 };
+  }
+}
+function mergeConfig(remoteConfig, configPath) {
+  const cfgPath = configPath ?? path23.join(EXE_AI_DIR, "config.json");
+  let local = {};
+  if (existsSync20(cfgPath)) {
+    try {
+      local = JSON.parse(readFileSync16(cfgPath, "utf-8"));
+    } catch {
+    }
+  }
+  const merged = { ...remoteConfig, ...local };
+  const dir = path23.dirname(cfgPath);
+  ensurePrivateDirSync(dir);
+  writeFileSync11(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
+  enforcePrivateFileSync(cfgPath);
+}
+async function mergeRosterFromRemote(remote, paths) {
+  return withRosterLock(async () => {
+    const rosterPath = paths?.rosterPath ?? void 0;
+    const identityDir = paths?.identityDir ?? path23.join(EXE_AI_DIR, "identity");
+    const localEmployees = await loadEmployees(rosterPath);
+    const localNames = new Set(localEmployees.map((e) => e.name));
+    let added = 0;
+    let identitiesUpdated = 0;
+    for (const remoteEmp of remote.roster) {
+      if (!localNames.has(remoteEmp.name)) {
+        localEmployees.push(remoteEmp);
+        localNames.add(remoteEmp.name);
+        added++;
+        try {
+          registerBinSymlinks(remoteEmp.name);
+        } catch {
+        }
+      }
+      const lookupKey = `${remoteEmp.name}.md`;
+      const matchedKey = Object.keys(remote.identities).find(
+        (k) => k.toLowerCase() === lookupKey.toLowerCase()
+      ) ?? lookupKey;
+      const remoteIdentity = remote.identities[matchedKey];
+      if (remoteIdentity) {
+        if (!existsSync20(identityDir)) mkdirSync9(identityDir, { recursive: true });
+        const idPath = path23.join(identityDir, `${remoteEmp.name}.md`);
+        let localIdentity = null;
+        try {
+          localIdentity = existsSync20(idPath) ? readFileSync16(idPath, "utf-8") : null;
+        } catch {
+        }
+        if (localIdentity !== remoteIdentity) {
+          writeFileSync11(idPath, remoteIdentity, "utf-8");
+          identitiesUpdated++;
+        }
+      }
+    }
+    let removed = 0;
+    if (remote.deletedNames && remote.deletedNames.length > 0) {
+      const toRemove = new Set(remote.deletedNames);
+      const filtered = localEmployees.filter((e) => !toRemove.has(e.name));
+      removed = localEmployees.length - filtered.length;
+      if (removed > 0) {
+        localEmployees.length = 0;
+        localEmployees.push(...filtered);
+      }
+    }
+    if (added > 0 || removed > 0) {
+      await saveEmployees(localEmployees, rosterPath);
+    }
+    if (remote.config && Object.keys(remote.config).length > 0) {
+      try {
+        mergeConfig(remote.config, paths?.configPath);
+      } catch {
+      }
+    }
+    if (remote.agentConfig && Object.keys(remote.agentConfig).length > 0) {
+      try {
+        const agentConfigPath = path23.join(EXE_AI_DIR, "agent-config.json");
+        let local = {};
+        if (existsSync20(agentConfigPath)) {
+          try {
+            local = JSON.parse(readFileSync16(agentConfigPath, "utf-8"));
+          } catch {
+          }
+        }
+        const merged = { ...remote.agentConfig, ...local };
+        ensurePrivateDirSync(path23.dirname(agentConfigPath));
+        writeFileSync11(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+        enforcePrivateFileSync(agentConfigPath);
+      } catch {
+      }
+    }
+    return { added, identitiesUpdated };
+  });
+}
+async function cloudPushBlob(route, data, metaKey, config) {
+  if (data.length === 0) return { ok: true };
+  assertSecureEndpoint(config.endpoint);
+  const json = JSON.stringify(data);
+  const version = Buffer.from(json).length;
+  try {
+    const client = getClient();
+    const meta = await client.execute({
+      sql: "SELECT value FROM sync_meta WHERE key = ?",
+      args: [metaKey]
+    });
+    const lastVersion = meta.rows.length > 0 ? Number(meta.rows[0].value) : 0;
+    if (version === lastVersion) return { ok: true };
+  } catch {
+  }
+  try {
+    const compressed = compress(Buffer.from(json, "utf8"));
+    const encrypted = encryptSyncBlob(compressed);
+    const resp = await fetchWithRetry(`${config.endpoint}${route}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Device-Id": loadDeviceId()
+      },
+      body: JSON.stringify({ blob: encrypted })
+    });
+    if (resp.ok) {
+      try {
+        const client = getClient();
+        await client.execute({
+          sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES (?, ?)",
+          args: [metaKey, String(version)]
+        });
+      } catch {
+      }
+    }
+    return { ok: resp.ok };
+  } catch (err) {
+    logError(`[cloud-sync] PUSH ${route}: ${err instanceof Error ? err.message : String(err)}`);
+    return { ok: false };
+  }
+}
+async function cloudPullBlob(route, config) {
+  assertSecureEndpoint(config.endpoint);
+  try {
+    const resp = await fetchWithRetry(`${config.endpoint}${route}`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "X-Device-Id": loadDeviceId()
+      }
+    });
+    if (!resp.ok) return null;
+    const data = await resp.json();
+    if (!data.blob) return null;
+    const compressed = decryptSyncBlob(data.blob);
+    const json = decompress(compressed).toString("utf8");
+    return JSON.parse(json);
+  } catch (err) {
+    logError(`[cloud-sync] PULL ${route}: ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+async function cloudPushGlobalProcedures(config) {
+  const client = getClient();
+  const result = await client.execute("SELECT * FROM global_procedures LIMIT 1000");
+  const rows = result.rows;
+  const { ok } = await cloudPushBlob(
+    "/sync/push-global-procedures",
+    rows,
+    "last_global_procedures_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullGlobalProcedures(config) {
+  const remoteProcs = await cloudPullBlob(
+    "/sync/pull-global-procedures",
+    config
+  );
+  if (!remoteProcs || remoteProcs.length === 0) return { pulled: 0 };
+  const client = getClient();
+  const stmts = remoteProcs.map((p) => ({
+    sql: `INSERT INTO global_procedures
+          (id, title, content, priority, domain, active, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(id) DO UPDATE SET
+            title = excluded.title,
+            content = excluded.content,
+            priority = excluded.priority,
+            domain = excluded.domain,
+            active = excluded.active,
+            updated_at = excluded.updated_at
+          WHERE excluded.updated_at > global_procedures.updated_at`,
+    args: [
+      sqlSafe(p.id),
+      sqlSafe(p.title),
+      sqlSafe(p.content),
+      sqlSafe(p.priority ?? "p0"),
+      sqlSafe(p.domain),
+      sqlSafe(p.active ?? 1),
+      sqlSafe(p.created_at),
+      sqlSafe(p.updated_at)
+    ]
+  }));
+  await client.batch(stmts, "write");
+  return { pulled: remoteProcs.length };
+}
+async function cloudPushBehaviors(config) {
+  const client = getClient();
+  const result = await client.execute("SELECT * FROM behaviors LIMIT 10000");
+  const rows = result.rows;
+  const { ok } = await cloudPushBlob(
+    "/sync/push-behaviors",
+    rows,
+    "last_behaviors_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullBehaviors(config) {
+  const remoteBehaviors = await cloudPullBlob(
+    "/sync/pull-behaviors",
+    config
+  );
+  if (!remoteBehaviors || remoteBehaviors.length === 0) return { pulled: 0 };
+  const client = getClient();
+  let pulled = 0;
+  for (const behavior of remoteBehaviors) {
+    const existing = await client.execute({
+      sql: `SELECT COUNT(*) as cnt FROM behaviors
+            WHERE agent_id = ? AND content = ?`,
+      args: [sqlSafe(behavior.agent_id), sqlSafe(behavior.content)]
+    });
+    if (Number(existing.rows[0]?.cnt) > 0) continue;
+    await client.execute({
+      sql: `INSERT OR IGNORE INTO behaviors
+            (id, agent_id, project_name, domain, content, active, priority, created_at, updated_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        sqlSafe(behavior.id),
+        sqlSafe(behavior.agent_id),
+        sqlSafe(behavior.project_name),
+        sqlSafe(behavior.domain),
+        sqlSafe(behavior.content),
+        sqlSafe(behavior.active ?? 1),
+        sqlSafe(behavior.priority ?? "p1"),
+        sqlSafe(behavior.created_at),
+        sqlSafe(behavior.updated_at)
+      ]
+    });
+    pulled++;
+  }
+  return { pulled };
+}
+async function cloudPushGraphRAG(config) {
+  const client = getClient();
+  const [entities, relationships, aliases, entityMems, relMems, hyperedges, hyperedgeNodes] = await Promise.all([
+    client.execute("SELECT * FROM entities LIMIT 50000"),
+    client.execute("SELECT * FROM relationships LIMIT 50000"),
+    client.execute("SELECT * FROM entity_aliases LIMIT 50000"),
+    client.execute("SELECT * FROM entity_memories LIMIT 50000"),
+    client.execute("SELECT * FROM relationship_memories LIMIT 50000"),
+    client.execute("SELECT * FROM hyperedges LIMIT 50000"),
+    client.execute("SELECT * FROM hyperedge_nodes LIMIT 50000")
+  ]);
+  const blob = {
+    entities: entities.rows,
+    relationships: relationships.rows,
+    entity_aliases: aliases.rows,
+    entity_memories: entityMems.rows,
+    relationship_memories: relMems.rows,
+    hyperedges: hyperedges.rows,
+    hyperedge_nodes: hyperedgeNodes.rows
+  };
+  const { ok } = await cloudPushBlob(
+    "/sync/push-graphrag",
+    [blob],
+    "last_graphrag_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullGraphRAG(config) {
+  const data = await cloudPullBlob(
+    "/sync/pull-graphrag",
+    config
+  );
+  if (!data || data.length === 0) return { pulled: 0 };
+  const blob = data[0];
+  const client = getClient();
+  let pulled = 0;
+  if (blob.entities.length > 0) {
+    const stmts = blob.entities.map((e) => ({
+      sql: `INSERT OR IGNORE INTO entities (id, name, type, first_seen, last_seen, properties)
+            VALUES (?, ?, ?, ?, ?, ?)`,
+      args: [sqlSafe(e.id), sqlSafe(e.name), sqlSafe(e.type), sqlSafe(e.first_seen), sqlSafe(e.last_seen), sqlSafe(e.properties ?? "{}")]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.relationships.length > 0) {
+    const stmts = blob.relationships.map((r) => ({
+      sql: `INSERT OR IGNORE INTO relationships
+            (id, source_entity_id, target_entity_id, type, weight, timestamp, properties, confidence, confidence_label)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        sqlSafe(r.id),
+        sqlSafe(r.source_entity_id),
+        sqlSafe(r.target_entity_id),
+        sqlSafe(r.type),
+        sqlSafe(r.weight ?? 1),
+        sqlSafe(r.timestamp),
+        sqlSafe(r.properties ?? "{}"),
+        sqlSafe(r.confidence ?? 1),
+        sqlSafe(r.confidence_label ?? "extracted")
+      ]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.entity_aliases.length > 0) {
+    const stmts = blob.entity_aliases.map((a) => ({
+      sql: `INSERT OR IGNORE INTO entity_aliases (alias, canonical_entity_id) VALUES (?, ?)`,
+      args: [sqlSafe(a.alias), sqlSafe(a.canonical_entity_id)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.entity_memories.length > 0) {
+    const stmts = blob.entity_memories.map((em) => ({
+      sql: `INSERT OR IGNORE INTO entity_memories (entity_id, memory_id) VALUES (?, ?)`,
+      args: [sqlSafe(em.entity_id), sqlSafe(em.memory_id)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.relationship_memories.length > 0) {
+    const stmts = blob.relationship_memories.map((rm) => ({
+      sql: `INSERT OR IGNORE INTO relationship_memories (relationship_id, memory_id) VALUES (?, ?)`,
+      args: [sqlSafe(rm.relationship_id), sqlSafe(rm.memory_id)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.hyperedges.length > 0) {
+    const stmts = blob.hyperedges.map((h) => ({
+      sql: `INSERT OR IGNORE INTO hyperedges (id, label, relation, confidence, timestamp)
+            VALUES (?, ?, ?, ?, ?)`,
+      args: [sqlSafe(h.id), sqlSafe(h.label), sqlSafe(h.relation), sqlSafe(h.confidence ?? 1), sqlSafe(h.timestamp)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.hyperedge_nodes.length > 0) {
+    const stmts = blob.hyperedge_nodes.map((hn) => ({
+      sql: `INSERT OR IGNORE INTO hyperedge_nodes (hyperedge_id, entity_id) VALUES (?, ?)`,
+      args: [sqlSafe(hn.hyperedge_id), sqlSafe(hn.entity_id)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  return { pulled };
+}
+async function cloudPushTasks(config) {
+  const client = getClient();
+  const result = await client.execute("SELECT * FROM tasks LIMIT 10000");
+  const rows = result.rows;
+  const { ok } = await cloudPushBlob(
+    "/sync/push-tasks",
+    rows,
+    "last_tasks_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullTasks(config) {
+  const remoteTasks = await cloudPullBlob(
+    "/sync/pull-tasks",
+    config
+  );
+  if (!remoteTasks || remoteTasks.length === 0) return { pulled: 0 };
+  const client = getClient();
+  const stmts = remoteTasks.map((t) => ({
+    sql: `INSERT OR IGNORE INTO tasks
+          (id, title, assigned_to, assigned_by, project_name, priority, status, task_file, created_at, updated_at,
+           blocked_by, parent_task_id, budget_tokens, budget_fallback_model, tokens_used, tokens_warned_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    args: [
+      sqlSafe(t.id),
+      sqlSafe(t.title),
+      sqlSafe(t.assigned_to),
+      sqlSafe(t.assigned_by),
+      sqlSafe(t.project_name),
+      sqlSafe(t.priority ?? "p1"),
+      sqlSafe(t.status ?? "open"),
+      sqlSafe(t.task_file),
+      sqlSafe(t.created_at),
+      sqlSafe(t.updated_at),
+      sqlSafe(t.blocked_by),
+      sqlSafe(t.parent_task_id),
+      sqlSafe(t.budget_tokens),
+      sqlSafe(t.budget_fallback_model),
+      sqlSafe(t.tokens_used ?? 0),
+      sqlSafe(t.tokens_warned_at)
+    ]
+  }));
+  await client.batch(stmts, "write");
+  return { pulled: remoteTasks.length };
+}
+async function cloudPushConversations(config) {
+  const client = getClient();
+  const result = await client.execute("SELECT * FROM conversations LIMIT 50000");
+  const rows = result.rows;
+  const { ok } = await cloudPushBlob(
+    "/sync/push-conversations",
+    rows,
+    "last_conversations_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullConversations(config) {
+  const remoteConvos = await cloudPullBlob(
+    "/sync/pull-conversations",
+    config
+  );
+  if (!remoteConvos || remoteConvos.length === 0) return { pulled: 0 };
+  const client = getClient();
+  const stmts = remoteConvos.map((c) => ({
+    sql: `INSERT OR IGNORE INTO conversations
+          (id, platform, external_id, sender_id, sender_name, sender_phone, sender_email,
+           recipient_id, channel_id, thread_id, reply_to_id, content_text, content_media,
+           content_metadata, agent_response, agent_name, timestamp, ingested_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    args: [
+      sqlSafe(c.id),
+      sqlSafe(c.platform),
+      sqlSafe(c.external_id),
+      sqlSafe(c.sender_id),
+      sqlSafe(c.sender_name),
+      sqlSafe(c.sender_phone),
+      sqlSafe(c.sender_email),
+      sqlSafe(c.recipient_id),
+      sqlSafe(c.channel_id),
+      sqlSafe(c.thread_id),
+      sqlSafe(c.reply_to_id),
+      sqlSafe(c.content_text),
+      sqlSafe(c.content_media),
+      sqlSafe(c.content_metadata),
+      sqlSafe(c.agent_response),
+      sqlSafe(c.agent_name),
+      sqlSafe(c.timestamp),
+      sqlSafe(c.ingested_at)
+    ]
+  }));
+  await client.batch(stmts, "write");
+  return { pulled: remoteConvos.length };
+}
+async function cloudPushDocuments(config) {
+  const client = getClient();
+  const [workspaces, documents] = await Promise.all([
+    client.execute("SELECT * FROM workspaces LIMIT 1000"),
+    client.execute("SELECT * FROM documents LIMIT 10000")
+  ]);
+  const blob = {
+    workspaces: workspaces.rows,
+    documents: documents.rows
+  };
+  const { ok } = await cloudPushBlob(
+    "/sync/push-documents",
+    [blob],
+    "last_documents_push_version",
+    config
+  );
+  return ok;
+}
+async function cloudPullDocuments(config) {
+  const data = await cloudPullBlob(
+    "/sync/pull-documents",
+    config
+  );
+  if (!data || data.length === 0) return { pulled: 0 };
+  const blob = data[0];
+  const client = getClient();
+  let pulled = 0;
+  if (blob.workspaces.length > 0) {
+    const stmts = blob.workspaces.map((w) => ({
+      sql: `INSERT OR IGNORE INTO workspaces (id, slug, name, owner_agent_id, created_at, metadata)
+            VALUES (?, ?, ?, ?, ?, ?)`,
+      args: [sqlSafe(w.id), sqlSafe(w.slug), sqlSafe(w.name), sqlSafe(w.owner_agent_id), sqlSafe(w.created_at), sqlSafe(w.metadata)]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  if (blob.documents.length > 0) {
+    const stmts = blob.documents.map((d) => ({
+      sql: `INSERT OR IGNORE INTO documents
+            (id, workspace_id, filename, mime, source_type, user_id, uploaded_at, metadata)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        sqlSafe(d.id),
+        sqlSafe(d.workspace_id),
+        sqlSafe(d.filename),
+        sqlSafe(d.mime),
+        sqlSafe(d.source_type),
+        sqlSafe(d.user_id),
+        sqlSafe(d.uploaded_at),
+        sqlSafe(d.metadata)
+      ]
+    }));
+    await client.batch(stmts, "write");
+    pulled += stmts.length;
+  }
+  return { pulled };
+}
+var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, _pgPromise, _pgFailed, ROSTER_DELETIONS_PATH;
+var init_cloud_sync = __esm({
+  "src/lib/cloud-sync.ts"() {
+    "use strict";
+    init_database();
+    init_crypto();
+    init_compress();
+    init_license();
+    init_config();
+    init_crdt_sync();
+    init_employees();
+    init_secure_files();
+    LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
+    FETCH_TIMEOUT_MS = 3e4;
+    PUSH_BATCH_SIZE = 5e3;
+    ROSTER_LOCK_PATH = path23.join(EXE_AI_DIR, "roster-merge.lock");
+    LOCK_STALE_MS = 3e4;
+    _pgPromise = null;
+    _pgFailed = false;
+    ROSTER_DELETIONS_PATH = path23.join(EXE_AI_DIR, "roster-deletions.json");
+  }
+});
+
+// src/lib/code-chunker.ts
+import ts from "typescript";
+function chunkSourceFile(source, fileName = "file.ts") {
+  const sourceFile = ts.createSourceFile(
+    fileName,
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    // setParentNodes
+    fileName.endsWith(".tsx") || fileName.endsWith(".jsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS
+  );
+  const chunks = [];
+  const lines = source.split("\n");
+  const importLines = [];
+  function getLineNumber(pos) {
+    return sourceFile.getLineAndCharacterOfPosition(pos).line + 1;
+  }
+  function getLeadingComment(node) {
+    const fullText = sourceFile.getFullText();
+    const ranges = ts.getLeadingCommentRanges(fullText, node.getFullStart());
+    if (!ranges || ranges.length === 0) return void 0;
+    return ranges.map((r) => fullText.slice(r.pos, r.end)).join("\n");
+  }
+  function getNodeText(node) {
+    return node.getText(sourceFile);
+  }
+  function getName(node) {
+    if (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node)) {
+      return node.name?.getText(sourceFile) ?? "(anonymous)";
+    }
+    if (ts.isClassDeclaration(node)) {
+      return node.name?.getText(sourceFile) ?? "(anonymous class)";
+    }
+    if (ts.isInterfaceDeclaration(node)) {
+      return node.name.getText(sourceFile);
+    }
+    if (ts.isTypeAliasDeclaration(node)) {
+      return node.name.getText(sourceFile);
+    }
+    if (ts.isEnumDeclaration(node)) {
+      return node.name.getText(sourceFile);
+    }
+    if (ts.isVariableStatement(node)) {
+      const decls = node.declarationList.declarations;
+      return decls.map((d) => d.name.getText(sourceFile)).join(", ");
+    }
+    if (ts.isExportAssignment(node)) {
+      return "default export";
+    }
+    return "(unknown)";
+  }
+  function visitTopLevel(node) {
+    if (ts.isImportDeclaration(node)) {
+      importLines.push({
+        start: getLineNumber(node.getStart(sourceFile)),
+        end: getLineNumber(node.getEnd())
+      });
+      return;
+    }
+    if (ts.isFunctionDeclaration(node)) {
+      chunks.push({
+        kind: "function",
+        name: getName(node),
         text: getNodeText(node),
         startLine: getLineNumber(node.getStart(sourceFile)),
         endLine: getLineNumber(node.getEnd()),
@@ -9678,13 +11446,13 @@ __export(graph_rag_exports, {
   resolveAlias: () => resolveAlias,
   storeExtraction: () => storeExtraction
 });
-import crypto7 from "crypto";
+import crypto10 from "crypto";
 function normalizeEntityName(name) {
   return name.replace(/\s*\([^)]*\)\s*/g, "").trim().toLowerCase();
 }
 function entityId(name, type) {
   const normalized = normalizeEntityName(name);
-  return crypto7.createHash("sha256").update(`${normalized}::${type.toLowerCase()}`).digest("hex").slice(0, 16);
+  return crypto10.createHash("sha256").update(`${normalized}::${type.toLowerCase()}`).digest("hex").slice(0, 16);
 }
 async function resolveAlias(client, name) {
   const normalized = normalizeEntityName(name);
@@ -9934,7 +11702,7 @@ async function storeExtraction(client, extraction, memoryId, timestamp) {
     const targetAlias = await resolveAlias(client, r.target);
     const sourceId = sourceAlias ?? entityId(r.source, r.sourceType);
     const targetId = targetAlias ?? entityId(r.target, r.targetType);
-    const relId = crypto7.randomUUID().slice(0, 16);
+    const relId = crypto10.randomUUID().slice(0, 16);
     try {
       await client.execute({
         sql: `INSERT OR IGNORE INTO entities (id, name, type, first_seen, last_seen)
@@ -9997,7 +11765,7 @@ async function storeExtraction(client, extraction, memoryId, timestamp) {
     }
   }
   for (const h of extraction.hyperedges) {
-    const hId = crypto7.randomUUID().slice(0, 16);
+    const hId = crypto10.randomUUID().slice(0, 16);
     try {
       await client.execute({
         sql: `INSERT OR IGNORE INTO hyperedges (id, label, relation, confidence, timestamp)
@@ -10061,7 +11829,7 @@ async function extractBatch(client, batchSize = 50, model = "claude-haiku-4-5-20
         totalEntities += stored.entitiesStored;
         totalRelationships += stored.relationshipsStored;
       }
-      const contentHash = crypto7.createHash("sha256").update(rawContent).digest("hex").slice(0, 32);
+      const contentHash = crypto10.createHash("sha256").update(rawContent).digest("hex").slice(0, 32);
       await client.execute({
         sql: "UPDATE memories SET graph_extracted = 1, content_hash = ?, graph_extracted_hash = ? WHERE id = ?",
         args: [contentHash, contentHash, memoryId]
@@ -10178,8 +11946,8 @@ __export(wiki_sync_exports, {
   listWorkspaces: () => listWorkspaces,
   syncMemories: () => syncMemories
 });
-async function wikiRequest(config, path25, method = "GET", body) {
-  const url = `${config.wikiUrl}/api/v1${path25}`;
+async function wikiRequest(config, path28, method = "GET", body) {
+  const url = `${config.wikiUrl}/api/v1${path28}`;
   const headers = {
     "Authorization": `Bearer ${config.wikiApiKey}`,
     "Content-Type": "application/json"
@@ -10191,7 +11959,7 @@ async function wikiRequest(config, path25, method = "GET", body) {
     signal: AbortSignal.timeout(3e4)
   });
   if (!response.ok) {
-    throw new Error(`Wiki API ${method} ${path25}: ${response.status} ${response.statusText}`);
+    throw new Error(`Wiki API ${method} ${path28}: ${response.status} ${response.statusText}`);
   }
   return response.json();
 }
@@ -10303,8 +12071,8 @@ __export(token_spend_exports, {
 import { readdir } from "fs/promises";
 import { createReadStream } from "fs";
 import { createInterface } from "readline";
-import path21 from "path";
-import os13 from "os";
+import path24 from "path";
+import os14 from "os";
 function getPricing(model) {
   if (MODEL_PRICING[model]) return MODEL_PRICING[model];
   const stripped = model.replace(/-\d{8}$/, "");
@@ -10331,18 +12099,18 @@ async function getAgentSpend(period = "7d") {
   for (const row of dbResult.rows) {
     sessionAgent.set(row.session_uuid, row.agent_id);
   }
-  const claudeDir = path21.join(os13.homedir(), ".claude", "projects");
+  const claudeDir = path24.join(os14.homedir(), ".claude", "projects");
   let projectDirs = [];
   try {
     const entries = await readdir(claudeDir);
-    projectDirs = entries.map((e) => path21.join(claudeDir, e));
+    projectDirs = entries.map((e) => path24.join(claudeDir, e));
   } catch {
     return [];
   }
   const agentTotals = /* @__PURE__ */ new Map();
   for (const [sessionUuid, agentId] of sessionAgent) {
     for (const dir of projectDirs) {
-      const jsonlPath = path21.join(dir, `${sessionUuid}.jsonl`);
+      const jsonlPath = path24.join(dir, `${sessionUuid}.jsonl`);
       try {
         const usage = await extractSessionUsage(jsonlPath);
         if (usage.input === 0 && usage.output === 0) continue;
@@ -10467,11 +12235,11 @@ __export(update_check_exports, {
   getRemoteVersion: () => getRemoteVersion
 });
 import { execSync as execSync11 } from "child_process";
-import { readFileSync as readFileSync15 } from "fs";
-import path22 from "path";
+import { readFileSync as readFileSync17 } from "fs";
+import path25 from "path";
 function getLocalVersion(packageRoot) {
-  const pkgPath = path22.join(packageRoot, "package.json");
-  const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
+  const pkgPath = path25.join(packageRoot, "package.json");
+  const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
   return pkg.version;
 }
 function getRemoteVersion() {
@@ -10514,16 +12282,16 @@ __export(ws_auth_exports, {
   deriveWsAuthToken: () => deriveWsAuthToken,
   hashAuthToken: () => hashAuthToken
 });
-import crypto8 from "crypto";
+import crypto11 from "crypto";
 function deriveWsAuthToken(masterKey) {
-  return Buffer.from(crypto8.hkdfSync("sha256", masterKey, "", WS_AUTH_HKDF_INFO, 32));
+  return Buffer.from(crypto11.hkdfSync("sha256", masterKey, "", WS_AUTH_HKDF_INFO, 32));
 }
 function deriveOrgId(masterKey) {
-  const raw = Buffer.from(crypto8.hkdfSync("sha256", masterKey, "", ORG_ID_HKDF_INFO, 32));
-  return crypto8.createHash("sha256").update(raw).digest("hex").slice(0, 32);
+  const raw = Buffer.from(crypto11.hkdfSync("sha256", masterKey, "", ORG_ID_HKDF_INFO, 32));
+  return crypto11.createHash("sha256").update(raw).digest("hex").slice(0, 32);
 }
 function hashAuthToken(token) {
-  return crypto8.createHash("sha256").update(token).digest("hex");
+  return crypto11.createHash("sha256").update(token).digest("hex");
 }
 var WS_AUTH_HKDF_INFO, ORG_ID_HKDF_INFO;
 var init_ws_auth = __esm({
@@ -10541,14 +12309,14 @@ __export(device_registry_exports, {
   resolveTargetDevice: () => resolveTargetDevice,
   setFriendlyName: () => setFriendlyName
 });
-import crypto9 from "crypto";
-import os14 from "os";
-import { readFileSync as readFileSync16, writeFileSync as writeFileSync10, mkdirSync as mkdirSync8, existsSync as existsSync19 } from "fs";
-import path23 from "path";
+import crypto12 from "crypto";
+import os15 from "os";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync12, mkdirSync as mkdirSync10, existsSync as existsSync21 } from "fs";
+import path26 from "path";
 function getDeviceInfo() {
-  if (existsSync19(DEVICE_JSON_PATH)) {
+  if (existsSync21(DEVICE_JSON_PATH)) {
     try {
-      const raw = readFileSync16(DEVICE_JSON_PATH, "utf8");
+      const raw = readFileSync18(DEVICE_JSON_PATH, "utf8");
       const data = JSON.parse(raw);
       if (data.deviceId && data.friendlyName && data.hostname) {
         return data;
@@ -10556,20 +12324,20 @@ function getDeviceInfo() {
     } catch {
     }
   }
-  const hostname = os14.hostname();
+  const hostname = os15.hostname();
   const info = {
-    deviceId: crypto9.randomUUID(),
+    deviceId: crypto12.randomUUID(),
     friendlyName: hostname.replace(/\./g, "-").toLowerCase(),
     hostname
   };
-  mkdirSync8(path23.dirname(DEVICE_JSON_PATH), { recursive: true });
-  writeFileSync10(DEVICE_JSON_PATH, JSON.stringify(info, null, 2));
+  mkdirSync10(path26.dirname(DEVICE_JSON_PATH), { recursive: true });
+  writeFileSync12(DEVICE_JSON_PATH, JSON.stringify(info, null, 2));
   return info;
 }
 function setFriendlyName(name) {
   const info = getDeviceInfo();
   info.friendlyName = name;
-  writeFileSync10(DEVICE_JSON_PATH, JSON.stringify(info, null, 2));
+  writeFileSync12(DEVICE_JSON_PATH, JSON.stringify(info, null, 2));
 }
 async function resolveTargetDevice(targetAgent, targetProject) {
   const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
@@ -10603,7 +12371,7 @@ var init_device_registry = __esm({
   "src/lib/device-registry.ts"() {
     "use strict";
     init_config();
-    DEVICE_JSON_PATH = path23.join(EXE_AI_DIR, "device.json");
+    DEVICE_JSON_PATH = path26.join(EXE_AI_DIR, "device.json");
   }
 });
 
@@ -10628,18 +12396,18 @@ function assertSecureWsUrl(url) {
         `Malformed WebSocket URL rejected: "${url}".`
       );
     }
-    if (LOCALHOST_PATTERNS.test(parsed.hostname)) return;
+    if (LOCALHOST_PATTERNS2.test(parsed.hostname)) return;
     throw new Error(
       `Insecure WebSocket URL rejected: "${url}". Use wss:// for remote hosts. Plain ws:// is only allowed for localhost.`
     );
   }
 }
-var LOCALHOST_PATTERNS;
+var LOCALHOST_PATTERNS2;
 var init_gateway_client = __esm({
   "src/lib/gateway-client.ts"() {
     "use strict";
     init_message_queue();
-    LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
+    LOCALHOST_PATTERNS2 = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
   }
 });
 
@@ -10827,10 +12595,10 @@ __export(messaging_exports, {
   sendMessage: () => sendMessage,
   setWsClientSend: () => setWsClientSend
 });
-import crypto10 from "crypto";
+import crypto13 from "crypto";
 function generateUlid() {
   const timestamp = Date.now().toString(36).padStart(10, "0");
-  const random = crypto10.randomBytes(10).toString("hex").slice(0, 16);
+  const random = crypto13.randomBytes(10).toString("hex").slice(0, 16);
   return (timestamp + random).toUpperCase();
 }
 function rowToMessage(row) {
@@ -11089,13 +12857,13 @@ init_memory();
 init_daemon_protocol();
 init_daemon_auth();
 init_daemon_orchestration();
-import os15 from "os";
+import os16 from "os";
 import net2 from "net";
-import { writeFileSync as writeFileSync11, unlinkSync as unlinkSync7, mkdirSync as mkdirSync9, existsSync as existsSync20, readFileSync as readFileSync17, chmodSync as chmodSync2 } from "fs";
-import path24 from "path";
+import { writeFileSync as writeFileSync13, unlinkSync as unlinkSync9, mkdirSync as mkdirSync11, existsSync as existsSync22, readFileSync as readFileSync19, chmodSync as chmodSync2 } from "fs";
+import path27 from "path";
 import { getLlama } from "node-llama-cpp";
-var SOCKET_PATH2 = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path24.join(EXE_AI_DIR, "exed.sock");
-var PID_PATH2 = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path24.join(EXE_AI_DIR, "exed.pid");
+var SOCKET_PATH2 = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path27.join(EXE_AI_DIR, "exed.sock");
+var PID_PATH2 = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path27.join(EXE_AI_DIR, "exed.pid");
 var MODEL_FILE = "jina-embeddings-v5-small-q4_k_m.gguf";
 var IDLE_TIMEOUT_MS = 15 * 60 * 1e3;
 var REVIEW_POLL_INTERVAL_MS = 60 * 1e3;
@@ -11123,8 +12891,8 @@ function enqueue(queue, entry) {
   queue.push(entry);
 }
 async function loadModel() {
-  const modelPath = path24.join(MODELS_DIR, MODEL_FILE);
-  if (!existsSync20(modelPath)) {
+  const modelPath = path27.join(MODELS_DIR, MODEL_FILE);
+  if (!existsSync22(modelPath)) {
     process.stderr.write(`[exed] FATAL: model not found at ${modelPath}
 `);
     process.exit(1);
@@ -11194,6 +12962,11 @@ function checkIdle() {
 }
 async function shutdown() {
   resetIdleTimer();
+  try {
+    const { stopProjectionWorker: stopProjectionWorker2 } = await Promise.resolve().then(() => (init_projection_worker(), projection_worker_exports));
+    stopProjectionWorker2();
+  } catch {
+  }
   try {
     const { disposeShards: disposeShards2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
     disposeShards2();
@@ -11215,11 +12988,11 @@ async function shutdown() {
   }
   _llama = null;
   try {
-    unlinkSync7(SOCKET_PATH2);
+    unlinkSync9(SOCKET_PATH2);
   } catch {
   }
   try {
-    unlinkSync7(PID_PATH2);
+    unlinkSync9(PID_PATH2);
   } catch {
   }
   process.stderr.write("[exed] Shutdown complete.\n");
@@ -11355,28 +13128,28 @@ async function handleIngest(req) {
   }
 }
 function startServer() {
-  mkdirSync9(path24.dirname(SOCKET_PATH2), { recursive: true });
+  mkdirSync11(path27.dirname(SOCKET_PATH2), { recursive: true });
   try {
-    chmodSync2(path24.dirname(SOCKET_PATH2), 448);
+    chmodSync2(path27.dirname(SOCKET_PATH2), 448);
   } catch {
   }
   _daemonToken = ensureDaemonToken(process.env[DAEMON_TOKEN_ENV2] ?? null);
   for (const oldFile of ["embed.sock", "embed.pid"]) {
-    const oldPath = path24.join(path24.dirname(SOCKET_PATH2), oldFile);
+    const oldPath = path27.join(path27.dirname(SOCKET_PATH2), oldFile);
     try {
       if (oldFile.endsWith(".pid")) {
-        const pid = parseInt(readFileSync17(oldPath, "utf8").trim(), 10);
+        const pid = parseInt(readFileSync19(oldPath, "utf8").trim(), 10);
         if (pid > 0) try {
           process.kill(pid, "SIGKILL");
         } catch {
         }
       }
-      unlinkSync7(oldPath);
+      unlinkSync9(oldPath);
     } catch {
     }
   }
   try {
-    unlinkSync7(SOCKET_PATH2);
+    unlinkSync9(SOCKET_PATH2);
   } catch {
   }
   const server = net2.createServer((socket) => {
@@ -11466,7 +13239,7 @@ function startServer() {
       chmodSync2(SOCKET_PATH2, 384);
     } catch {
     }
-    writeFileSync11(PID_PATH2, String(process.pid));
+    writeFileSync13(PID_PATH2, String(process.pid));
     try {
       chmodSync2(PID_PATH2, 384);
     } catch {
@@ -11666,6 +13439,35 @@ function startConsolidation() {
 `);
   });
 }
+var CLOUD_SYNC_INTERVAL_MS = Number(process.env.EXE_CLOUD_SYNC_INTERVAL_MS) || 5 * 60 * 1e3;
+function startCloudSyncTimer() {
+  const tick = async () => {
+    try {
+      const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+      const config = await loadConfig2();
+      if (!config.cloud?.apiKey || !config.cloud?.endpoint) return;
+      const { cloudSync: cloudSync2 } = await Promise.resolve().then(() => (init_cloud_sync(), cloud_sync_exports));
+      const result = await cloudSync2({
+        apiKey: config.cloud.apiKey,
+        endpoint: config.cloud.endpoint
+      });
+      if (result.pushed > 0 || result.pulled > 0) {
+        process.stderr.write(
+          `[exed] Cloud sync: pushed=${result.pushed} pulled=${result.pulled} total=${result.totalMemories}
+`
+        );
+      }
+    } catch (err) {
+      process.stderr.write(`[exed] Cloud sync error (non-fatal): ${err instanceof Error ? err.message : String(err)}
+`);
+    }
+  };
+  const timer = setInterval(() => void tick(), CLOUD_SYNC_INTERVAL_MS);
+  timer.unref();
+  setTimeout(() => void tick(), 3e4);
+  process.stderr.write(`[exed] Cloud sync timer started (every ${CLOUD_SYNC_INTERVAL_MS / 6e4}m)
+`);
+}
 var SKILL_SWEEP_INTERVAL_MS = 6 * 60 * 60 * 1e3;
 function startSkillSweep() {
   const tick = async () => {
@@ -11763,7 +13565,7 @@ function startWikiSync() {
   });
 }
 var AGENT_STATS_INTERVAL_MS = 60 * 1e3;
-var AGENT_STATS_PATH = path24.join(EXE_AI_DIR, "agent-stats.json");
+var AGENT_STATS_PATH = path27.join(EXE_AI_DIR, "agent-stats.json");
 async function writeAgentStats() {
   if (!await ensureStoreForPolling()) return;
   try {
@@ -11821,7 +13623,7 @@ async function writeAgentStats() {
         pid: process.pid
       }
     };
-    writeFileSync11(AGENT_STATS_PATH, JSON.stringify(stats, null, 2), "utf8");
+    writeFileSync13(AGENT_STATS_PATH, JSON.stringify(stats, null, 2), "utf8");
   } catch (err) {
     process.stderr.write(`[exed] Agent stats error: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -11893,12 +13695,12 @@ function startIntercomQueueDrain() {
       const hasInProgressTask = (session) => {
         try {
           const { baseAgentName: ban } = (init_employees(), __toCommonJS(employees_exports));
-          const path25 = __require("path");
-          const { existsSync: existsSync21 } = __require("fs");
-          const os16 = __require("os");
+          const path28 = __require("path");
+          const { existsSync: existsSync23 } = __require("fs");
+          const os17 = __require("os");
           const agent = ban(session.split("-")[0] ?? session);
-          const markerPath = path25.join(os16.homedir(), ".exe-os", "session-cache", `current-task-${agent}.json`);
-          return existsSync21(markerPath);
+          const markerPath = path28.join(os17.homedir(), ".exe-os", "session-cache", `current-task-${agent}.json`);
+          return existsSync23(markerPath);
         } catch {
           return false;
         }
@@ -11987,7 +13789,7 @@ function startAutoWake() {
   process.stderr.write(`[exed] Auto-wake started (every ${AUTO_WAKE_INTERVAL_MS / 1e3}s)
 `);
 }
-var TOTAL_MEM_GB = os15.totalmem() / 1024 ** 3;
+var TOTAL_MEM_GB = os16.totalmem() / 1024 ** 3;
 var RSS_WARN_BYTES = Number(process.env.EXE_RSS_WARN_MB) * 1024 * 1024 || (TOTAL_MEM_GB >= 64 ? 6 * 1024 ** 3 : TOTAL_MEM_GB >= 32 ? 4 * 1024 ** 3 : 1024 ** 3);
 var RSS_RESTART_BYTES = Number(process.env.EXE_RSS_RESTART_MB) * 1024 * 1024 || (TOTAL_MEM_GB >= 64 ? 8 * 1024 ** 3 : TOTAL_MEM_GB >= 32 ? 6 * 1024 ** 3 : 2 * 1024 ** 3);
 var RSS_CHECK_INTERVAL_MS = 30 * 1e3;
@@ -12023,8 +13825,8 @@ process.on("SIGINT", () => void shutdown());
 process.on("SIGTERM", () => void shutdown());
 function checkExistingDaemon() {
   try {
-    if (!existsSync20(PID_PATH2)) return false;
-    const pid = parseInt(readFileSync17(PID_PATH2, "utf8").trim(), 10);
+    if (!existsSync22(PID_PATH2)) return false;
+    const pid = parseInt(readFileSync19(PID_PATH2, "utf8").trim(), 10);
     if (!pid || isNaN(pid)) return false;
     process.kill(pid, 0);
     process.stderr.write(`[exed] Another daemon is already running (PID ${pid}). Exiting.
@@ -12037,7 +13839,7 @@ function checkExistingDaemon() {
       return true;
     }
     try {
-      unlinkSync7(PID_PATH2);
+      unlinkSync9(PID_PATH2);
     } catch {
     }
     return false;
@@ -12103,6 +13905,7 @@ try {
   startIdleKill();
   startConsolidation();
   startSkillSweep();
+  startCloudSyncTimer();
   startOrphanReaper();
   startAgentStats();
   startCapacityMonitoring();
@@ -12113,6 +13916,8 @@ try {
   startConfidenceDecay();
   startAutoUpdateCheck();
   startRssWatchdog();
+  const { startProjectionWorker: startProjectionWorker2 } = await Promise.resolve().then(() => (init_projection_worker(), projection_worker_exports));
+  startProjectionWorker2();
   try {
     const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
     const config = await loadConfig2();
@@ -12206,11 +14011,11 @@ try {
   process.stderr.write(`[exed] FATAL: ${err instanceof Error ? err.message : String(err)}
 `);
   try {
-    unlinkSync7(SOCKET_PATH2);
+    unlinkSync9(SOCKET_PATH2);
   } catch {
   }
   try {
-    unlinkSync7(PID_PATH2);
+    unlinkSync9(PID_PATH2);
   } catch {
   }
   process.exit(1);