@askexenow/exe-os 0.9.239 → 0.9.243

package/dist/{chunk-TRZ5KA2R.js → chunk-VXIMSRTO.js}

@@ -27,7 +27,7 @@ function resolveDataDir() {
     }
   }
   if (process.getuid?.() === 0) {
-    const sudoUser = process.env.SUDO_USER;
+    const sudoUser = process.env.SUDO_USER || "";
     if (sudoUser) {
       try {
         const sudoHome = execSync(`getent passwd ${sudoUser} | cut -d: -f6`, { encoding: "utf8" }).trim();
@@ -63,7 +63,7 @@ var DB_PATH = path.join(EXE_AI_DIR, "memories.db");
 var MODELS_DIR = path.join(EXE_AI_DIR, "models");
 var CONFIG_PATH = path.join(EXE_AI_DIR, "config.json");
 function isDbAuthorityEnabled() {
-  return process.env.EXE_DB_AUTHORITY === "1";
+  return (process.env.EXE_DB_AUTHORITY ?? "") === "1";
 }
 var LEGACY_LANCE_PATH = path.join(EXE_AI_DIR, "local.lance");
 var CURRENT_CONFIG_VERSION = 1;

package/dist/{chunk-DAZIV4QZ.js → chunk-WCXZF42W.js}

@@ -1,6 +1,6 @@
 import {
   createReminder
-} from "./chunk-5WLMF6PL.js";
+} from "./chunk-YMZHTTOQ.js";
 
 // src/mcp/tools/create-reminder.ts
 import { z } from "zod";

package/dist/{chunk-6OJJF4WP.js → chunk-XJUUWHVN.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-NGP6LSV2.js";
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 import {
   atomicWriteJsonSync,
   ensurePrivateDirSync

package/dist/{chunk-F7LU65PQ.js → chunk-Y25OJWOQ.js}

@@ -1,4 +1,5 @@
 // src/lib/secret-redaction.ts
+import { validateMnemonic } from "bip39";
 var SECRET_PATTERNS = [
   { name: "openai_key", pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
   { name: "anthropic_key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
@@ -10,9 +11,15 @@ var SECRET_PATTERNS = [
   { name: "private_key", pattern: /-----BEGIN (?:OPENSSH|RSA|DSA|EC|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END (?:OPENSSH|RSA|DSA|EC|PGP)? ?PRIVATE KEY-----/g },
   { name: "db_url_password", pattern: /\b(postgres(?:ql)?|mysql|mongodb|redis):\/\/([^:\s/@]+):([^@\s]+)@/gi },
   { name: "assignment_secret", pattern: /\b(api[_-]?key|secret|token|password|passwd|pwd|private[_-]?key|access[_-]?key)\s*[:=]\s*(['\"]?)[^\s'"]{8,}\2/gi },
-  { name: "env_secret", pattern: /\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_KEY|ACCESS_KEY)[A-Z0-9_]*\s*=\s*['\"]?[^'"\s]{8,}/g },
-  { name: "recovery_phrase", pattern: /\b(?:[a-z]{3,12}\s+){23}[a-z]{3,12}\b/gi }
+  { name: "env_secret", pattern: /\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_KEY|ACCESS_KEY)[A-Z0-9_]*\s*=\s*['\"]?[^'"\s]{8,}/g }
 ];
+var MNEMONIC_CANDIDATE_RE = /\b(?:[a-z]{3,12}\s+){11,23}[a-z]{3,12}\b/g;
+var MNEMONIC_LENGTHS = /* @__PURE__ */ new Set([12, 15, 18, 21, 24]);
+function looksLikeBip39Mnemonic(candidate) {
+  const words = candidate.trim().split(/\s+/);
+  if (!MNEMONIC_LENGTHS.has(words.length)) return false;
+  return validateMnemonic(words.join(" "));
+}
 function redactSecrets(input) {
   let text = input;
   let redactedCount = 0;
@@ -25,6 +32,11 @@ function redactSecrets(input) {
       return `[REDACTED:${name}]`;
     });
   }
+  text = text.replace(MNEMONIC_CANDIDATE_RE, (match) => {
+    if (!looksLikeBip39Mnemonic(match)) return match;
+    redactedCount++;
+    return "[REDACTED:recovery_phrase]";
+  });
   return { text, redactedCount };
 }
 

package/dist/{chunk-2ORPA23Y.js → chunk-YMXXD2GW.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/shard-manager.ts
 import path from "path";
@@ -17,24 +17,32 @@ var _encryptionKey = null;
 var _shardingEnabled = false;
 var _keyValidated = false;
 var _keyValidationPromise = null;
+var _validationFailedForKey = null;
+var _validationWarningEmitted = false;
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
-  _keyValidated = false;
   _keyValidationPromise = null;
+  _keyValidated = false;
   if (!existsSync(SHARDS_DIR)) {
     mkdirSync(SHARDS_DIR, { recursive: true });
   }
   const existingShards = readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db"));
   if (existingShards.length === 0) {
     _keyValidated = true;
+    _validationFailedForKey = null;
+  }
+  if (_validationFailedForKey === encryptionKey && existingShards.length > 0) {
+    _keyValidated = true;
+    _shardingEnabled = false;
+  } else {
+    _shardingEnabled = true;
   }
-  _shardingEnabled = true;
   if (_evictionTimer) clearInterval(_evictionTimer);
   _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
   _evictionTimer.unref();
 }
 async function validateEncryptionKey() {
-  if (_keyValidated) return true;
+  if (_keyValidated) return _shardingEnabled;
   if (!_encryptionKey) return false;
   const existingShards = readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db"));
   if (existingShards.length === 0) {
@@ -48,6 +56,8 @@ async function validateEncryptionKey() {
       await testClient.execute("SELECT COUNT(*) FROM sqlite_schema");
       testClient.close();
       _keyValidated = true;
+      _validationFailedForKey = null;
+      _validationWarningEmitted = false;
       return true;
     } catch {
       try {
@@ -56,10 +66,16 @@ async function validateEncryptionKey() {
       }
     }
   }
-  process.stderr.write(
-    `[shard-manager] WARNING: encryption key cannot read any existing shards (${existingShards.length} found). New shard creation disabled to prevent stranded files. Run /exe-doctor to audit.
+  if (!_validationWarningEmitted) {
+    process.stderr.write(
+      `[shard-manager] WARNING: encryption key cannot read any existing shards (${existingShards.length} found). New shard creation disabled to prevent stranded files. Run /exe-doctor to audit.
 `
-  );
+    );
+    _validationWarningEmitted = true;
+  }
+  _validationFailedForKey = _encryptionKey;
+  _keyValidated = true;
+  _keyValidationPromise = null;
   _shardingEnabled = false;
   return false;
 }
@@ -324,7 +340,9 @@ async function ensureShardSchema(client) {
     // Session scope (must match database.ts)
     "ALTER TABLE memories ADD COLUMN session_scope TEXT",
     // Keywords for FTS5 dual-column search (must match database.ts)
-    "ALTER TABLE memories ADD COLUMN keywords TEXT DEFAULT ''"
+    "ALTER TABLE memories ADD COLUMN keywords TEXT DEFAULT ''",
+    // Multi-user founder scope (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN founder_id TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -469,6 +487,11 @@ async function ensureShardSchema(client) {
   `);
 }
 async function getReadyShardClient(projectName) {
+  if (!_shardingEnabled && _validationFailedForKey === _encryptionKey) {
+    throw new Error(
+      `Shard creation blocked: encryption key mismatch with existing shards. Run /exe-doctor to audit.`
+    );
+  }
   if (!_keyValidated) {
     if (!_keyValidationPromise) {
       _keyValidationPromise = validateEncryptionKey();
@@ -480,6 +503,11 @@ async function getReadyShardClient(projectName) {
       );
     }
   }
+  if (!_shardingEnabled) {
+    throw new Error(
+      `Shard creation blocked: encryption key mismatch with existing shards. Run /exe-doctor to audit.`
+    );
+  }
   const safeName = safeShardName(projectName);
   let client = getShardClient(projectName);
   try {

package/dist/{chunk-5WLMF6PL.js → chunk-YMZHTTOQ.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/reminders.ts
 import crypto from "crypto";