@askexenow/exe-os 0.9.239 → 0.9.244

package/dist/chunk-TD5CADZ5.js

@@ -0,0 +1,230 @@
+// src/bin/vps-health-gate.ts
+import { spawnSync } from "child_process";
+import { appendFileSync, existsSync, mkdirSync, readdirSync } from "fs";
+import http from "http";
+import path from "path";
+var DEPLOY_LOG = "/opt/exe-stack/deploy-log.jsonl";
+var BACKUP_DIR = "/opt/exe-stack/backups";
+async function checkCRM() {
+  const start = Date.now();
+  try {
+    const status = await httpGet("http://localhost:3000/api");
+    return {
+      check: "crm",
+      status: status >= 200 && status < 400 ? "pass" : "fail",
+      message: status >= 200 && status < 400 ? `CRM healthy (HTTP ${status})` : `CRM unhealthy (HTTP ${status})`,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check: "crm",
+      status: "fail",
+      message: `CRM unreachable: ${err instanceof Error ? err.message : err}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function checkGateway() {
+  const start = Date.now();
+  try {
+    const status = await httpGet("http://localhost:3100/health");
+    return {
+      check: "gateway",
+      status: status >= 200 && status < 300 ? "pass" : "fail",
+      message: status >= 200 && status < 300 ? `Gateway healthy (HTTP ${status})` : `Gateway unhealthy (HTTP ${status})`,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check: "gateway",
+      status: "fail",
+      message: `Gateway unreachable: ${err instanceof Error ? err.message : err}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+function checkPostgres() {
+  const start = Date.now();
+  const databaseUrl = process.env.DATABASE_URL || "postgres://exe@localhost:5432/exedb";
+  const result = spawnSync("psql", [databaseUrl, "-c", "SELECT 1"], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 1e4
+  });
+  return {
+    check: "postgres",
+    status: result.status === 0 ? "pass" : "fail",
+    message: result.status === 0 ? "Postgres responding" : `Postgres failed: ${result.stderr?.trim() || `exit ${result.status}`}`,
+    durationMs: Date.now() - start
+  };
+}
+function checkRawEvents() {
+  const start = Date.now();
+  const databaseUrl = process.env.DATABASE_URL || "postgres://exe@localhost:5432/exedb";
+  const result = spawnSync(
+    "psql",
+    [databaseUrl, "-t", "-c", "SELECT count(*) FROM raw.raw_events"],
+    {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 1e4
+    }
+  );
+  if (result.status !== 0) {
+    return {
+      check: "raw_events",
+      status: "fail",
+      message: `raw.raw_events query failed: ${result.stderr?.trim() || `exit ${result.status}`}`,
+      durationMs: Date.now() - start
+    };
+  }
+  const count = parseInt(result.stdout?.trim() || "0", 10);
+  return {
+    check: "raw_events",
+    status: count > 0 ? "pass" : "fail",
+    message: count > 0 ? `raw.raw_events has ${count} rows` : "raw.raw_events is empty",
+    durationMs: Date.now() - start
+  };
+}
+async function checkGoTrue() {
+  const start = Date.now();
+  try {
+    const status = await httpGet("http://localhost:9999/health");
+    return {
+      check: "gotrue",
+      status: status >= 200 && status < 300 ? "pass" : "fail",
+      message: status >= 200 && status < 300 ? `GoTrue healthy (HTTP ${status})` : `GoTrue unhealthy (HTTP ${status})`,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check: "gotrue",
+      status: "fail",
+      message: `GoTrue unreachable: ${err instanceof Error ? err.message : err}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function runHealthGate() {
+  console.log("[health-gate] Running post-deploy health checks...\n");
+  const results = [];
+  results.push(checkPostgres());
+  results.push(checkRawEvents());
+  results.push(await checkCRM());
+  results.push(await checkGateway());
+  results.push(await checkGoTrue());
+  const passed = results.every((r) => r.status === "pass");
+  for (const r of results) {
+    const icon = r.status === "pass" ? "\u2713" : "\u2717";
+    const color = r.status === "pass" ? "\x1B[32m" : "\x1B[31m";
+    console.log(`  ${color}${icon}\x1B[0m ${r.check.padEnd(12)} ${r.message} (${r.durationMs}ms)`);
+  }
+  console.log("");
+  const result = {
+    passed,
+    results,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return result;
+}
+function logResult(result) {
+  mkdirSync(path.dirname(DEPLOY_LOG), { recursive: true });
+  const line = JSON.stringify({
+    ...result,
+    type: "health_gate"
+  }) + "\n";
+  try {
+    appendFileSync(DEPLOY_LOG, line);
+    console.log(`[health-gate] Result logged to ${DEPLOY_LOG}`);
+  } catch (err) {
+    console.warn(`[health-gate] Failed to write deploy log: ${err instanceof Error ? err.message : err}`);
+  }
+}
+function restorePreDeployBackup() {
+  if (!existsSync(BACKUP_DIR)) return false;
+  const backups = readdirSync(BACKUP_DIR).filter((f) => f.startsWith("pg-pre-deploy-") && f.endsWith(".dump")).sort().reverse();
+  if (backups.length === 0) {
+    console.warn("[health-gate] No pre-deploy backup found to restore");
+    return false;
+  }
+  const latest = backups[0];
+  const filepath = path.join(BACKUP_DIR, latest);
+  const databaseUrl = process.env.DATABASE_URL || "postgres://exe@localhost:5432/exedb";
+  console.log(`[health-gate] Restoring pre-deploy backup: ${latest}`);
+  const result = spawnSync("pg_restore", ["-d", databaseUrl, "--clean", "--if-exists", filepath], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 3e5
+  });
+  if (result.status !== 0) {
+    console.error(`[health-gate] pg_restore failed: ${result.stderr?.trim() || `exit ${result.status}`}`);
+    return false;
+  }
+  console.log("[health-gate] \u2713 Pre-deploy backup restored");
+  return true;
+}
+function httpGet(url) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(url, { method: "GET", timeout: 1e4 }, (res) => {
+      res.resume();
+      resolve(res.statusCode ?? 0);
+    });
+    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("error", reject);
+    req.end();
+  });
+}
+async function main(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(`
+  exe-os vps-health-gate \u2014 Post-deploy health checks
+
+  Runs 5 checks: Postgres, raw_events, CRM, Gateway, GoTrue.
+  If any check fails, triggers rollback and exits with code 1.
+
+  Usage:
+    exe-os vps-health-gate              Run health gate
+    exe-os vps-health-gate --check-only Run checks without rollback on failure
+`);
+    return;
+  }
+  const checkOnly = args.includes("--check-only");
+  const result = await runHealthGate();
+  logResult(result);
+  if (result.passed) {
+    console.log("[health-gate] \u2713 All checks passed \u2014 deploy is healthy");
+    return;
+  }
+  const failed = result.results.filter((r) => r.status === "fail");
+  console.error(`[health-gate] \u2717 ${failed.length} check(s) failed`);
+  if (checkOnly) {
+    process.exitCode = 1;
+    return;
+  }
+  console.log("[health-gate] Starting rollback...");
+  restorePreDeployBackup();
+  try {
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-7F2E2MBJ.js");
+    const paths = defaultStackPaths();
+    await rollbackStackUpdate({
+      manifestRef: paths.manifestRef,
+      composeFile: paths.composeFile,
+      envFile: paths.envFile
+    });
+    console.log("[health-gate] \u2713 Stack rolled back to previous version");
+  } catch (err) {
+    console.error(`[health-gate] Stack rollback failed: ${err instanceof Error ? err.message : err}`);
+  }
+  process.exitCode = 1;
+}
+
+export {
+  checkCRM,
+  checkGateway,
+  checkPostgres,
+  checkRawEvents,
+  checkGoTrue,
+  runHealthGate,
+  logResult,
+  main
+};

package/dist/{chunk-C2YS2AA6.js → chunk-U7WOVXBB.js}

@@ -1,9 +1,9 @@
 import {
   listBehaviors
-} from "./chunk-UAFUGPKO.js";
+} from "./chunk-ONAQAL3O.js";
 import {
   loadConfigSync
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/behaviors-export.ts
 import os from "os";

package/dist/{chunk-FE45RXGC.js → chunk-V2GZMY6O.js}

@@ -1,7 +1,7 @@
 import {
   executeAction,
   substituteTemplate
-} from "./chunk-AU5426YP.js";
+} from "./chunk-B7JGEDVE.js";
 
 // src/automation/workflow-engine.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-PATCHPNY.js → chunk-VHALWCUO.js}

@@ -1,7 +1,7 @@
 import {
   getIdentity,
   loadEmployeesSync
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/drift-probes.ts
 var DRIFT_THRESHOLD = 80;

package/dist/{chunk-HLZSC5WK.js → chunk-VQAP35DA.js}

@@ -1,9 +1,9 @@
 import {
   recordSessionKill
-} from "./chunk-452XB7OZ.js";
+} from "./chunk-VRIMTCX2.js";
 import {
   updateTask
-} from "./chunk-5R75ODPS.js";
+} from "./chunk-NBY6R37W.js";
 import {
   ensureEmployee,
   extractRootExe,
@@ -14,13 +14,13 @@ import {
   sessionScopeFilter,
   strictSessionScopeFilter,
   writeNotification
-} from "./chunk-HNLPLLE6.js";
+} from "./chunk-F7JLZXHC.js";
 import {
   queueIntercom
-} from "./chunk-QI4IXJN7.js";
+} from "./chunk-5CHYEKMH.js";
 import {
   listSessions
-} from "./chunk-BZNI4OK5.js";
+} from "./chunk-GHEWRYMY.js";
 import {
   getTransport
 } from "./chunk-MVW62NIZ.js";
@@ -30,18 +30,18 @@ import {
 } from "./chunk-CX6GL3ZJ.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-5NJ4A4ZA.js";
+} from "./chunk-HCBMPZDT.js";
 import {
   getAgentRuntime
-} from "./chunk-6OJJF4WP.js";
+} from "./chunk-XJUUWHVN.js";
 import {
   baseAgentName,
   isCoordinatorName,
   shouldAutoInstance
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 import {
   loadConfigSync
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/daemon-orchestration.ts
 import { execSync } from "child_process";
@@ -473,7 +473,7 @@ function createReviewNudgeRealDeps(_getClient) {
       return Number(rows[0]?.cnt ?? 0);
     },
     sendNudge: (sessionName) => {
-      queueIntercom(sessionName, "review nudge: pending reviews");
+      queueIntercom(sessionName, "review nudge: pending reviews", "completion");
     },
     persistState: saveNudgeState
   };
@@ -666,7 +666,8 @@ function shouldAutoWake(input) {
   return true;
 }
 async function pollOrphanedTasks(deps, nowMs = Date.now()) {
-  const globalGate = checkAutoWakeGates("__global__", nowMs);
+  const checkGate = deps.checkGate ?? checkAutoWakeGates;
+  const globalGate = checkGate("__global__", nowMs);
   if (globalGate) {
     process.stderr.write(`[auto-wake] GLOBAL GATE BLOCKED: ${globalGate} \u2014 skipping all spawns
 `);
@@ -762,7 +763,7 @@ async function pollOrphanedTasks(deps, nowMs = Date.now()) {
       }
       continue;
     }
-    const agentGate = checkAutoWakeGates(key, nowMs);
+    const agentGate = checkGate(key, nowMs);
     if (agentGate) {
       process.stderr.write(`[auto-wake] AGENT GATE BLOCKED: ${agentId} \u2014 ${agentGate}
 `);
@@ -874,7 +875,7 @@ async function releaseStuckTasks(deps, nowMs = Date.now()) {
       }
       if (deps.notifyOrphan) {
         try {
-          await deps.notifyOrphan(t.taskId, t.agentId);
+          await deps.notifyOrphan(t.taskId, t.agentId, t.sessionScope);
         } catch {
         }
       }
@@ -887,7 +888,7 @@ async function releaseStuckTasks(deps, nowMs = Date.now()) {
       );
       if (deps.notifyOrphan) {
         try {
-          await deps.notifyOrphan(t.taskId, t.agentId);
+          await deps.notifyOrphan(t.taskId, t.agentId, t.sessionScope);
         } catch {
         }
       }
@@ -937,13 +938,14 @@ function createStuckTaskRealDeps(getClient) {
       const agentPart = sessionName.split("-")[0];
       return baseAgentName(agentPart);
     },
-    notifyOrphan: async (taskId, agentId) => {
+    notifyOrphan: async (taskId, agentId, sessionScope) => {
       await writeNotification({
         agentId,
         agentRole: "employee",
         event: "orphan_task",
         project: "",
-        summary: `Agent "${agentId}" session died \u2014 task ${taskId.slice(0, 8)} needs review (auto-closed: session ended without completion)`
+        summary: `Agent "${agentId}" session died \u2014 task ${taskId.slice(0, 8)} needs review (auto-closed: session ended without completion)`,
+        sessionScope: sessionScope ?? void 0
       });
     }
   };
@@ -1655,7 +1657,7 @@ async function reapOrphanedWorktrees(deps, nowMs = Date.now()) {
 }
 async function createWorktreeReaperRealDeps() {
   const { getPaneCwdAsync } = await import("./lib/tmux-status.js");
-  const { getGitRoot, isWorktreeDirty: isDirty } = await import("./worktree-JXN4RCWC.js");
+  const { getGitRoot, isWorktreeDirty: isDirty } = await import("./worktree-RICSCT2S.js");
   const { statSync: statSync2 } = await import("fs");
   const { basename } = await import("path");
   const { promisify } = await import("util");
@@ -1796,7 +1798,7 @@ async function gcStaleCheckpoints() {
 }
 async function pollTaskGroupBarriers() {
   try {
-    const { checkAndFireBarriers } = await import("./tasks-crud-JXZEBZFR.js");
+    const { checkAndFireBarriers } = await import("./tasks-crud-DQOG2NPG.js");
     const firedGroupIds = await checkAndFireBarriers();
     if (firedGroupIds.length === 0) return 0;
     const { getClient } = await import("./lib/database.js");

package/dist/{chunk-452XB7OZ.js → chunk-VRIMTCX2.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/session-kill-telemetry.ts
 import crypto from "crypto";

package/dist/{chunk-SUNYJ6YE.js → chunk-VT2B5BHM.js}

@@ -1,6 +1,6 @@
 import {
   redactSecrets
-} from "./chunk-F7LU65PQ.js";
+} from "./chunk-Y25OJWOQ.js";
 import {
   isExeMcpTool,
   stripExeMcpPrefix

package/dist/{chunk-UZIJDYDA.js → chunk-VWVJVQDH.js}

@@ -7,10 +7,10 @@ import {
 import {
   connectEmbedDaemon,
   embedBatchViaClient
-} from "./chunk-VHKL4S4T.js";
+} from "./chunk-RRHSONV5.js";
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/code-context-index.ts
 import crypto from "crypto";

package/dist/{chunk-TRZ5KA2R.js → chunk-VXIMSRTO.js}

@@ -27,7 +27,7 @@ function resolveDataDir() {
     }
   }
   if (process.getuid?.() === 0) {
-    const sudoUser = process.env.SUDO_USER;
+    const sudoUser = process.env.SUDO_USER || "";
     if (sudoUser) {
       try {
         const sudoHome = execSync(`getent passwd ${sudoUser} | cut -d: -f6`, { encoding: "utf8" }).trim();
@@ -63,7 +63,7 @@ var DB_PATH = path.join(EXE_AI_DIR, "memories.db");
 var MODELS_DIR = path.join(EXE_AI_DIR, "models");
 var CONFIG_PATH = path.join(EXE_AI_DIR, "config.json");
 function isDbAuthorityEnabled() {
-  return process.env.EXE_DB_AUTHORITY === "1";
+  return (process.env.EXE_DB_AUTHORITY ?? "") === "1";
 }
 var LEGACY_LANCE_PATH = path.join(EXE_AI_DIR, "local.lance");
 var CURRENT_CONFIG_VERSION = 1;

package/dist/{chunk-DAZIV4QZ.js → chunk-WCXZF42W.js}

@@ -1,6 +1,6 @@
 import {
   createReminder
-} from "./chunk-5WLMF6PL.js";
+} from "./chunk-YMZHTTOQ.js";
 
 // src/mcp/tools/create-reminder.ts
 import { z } from "zod";

package/dist/{chunk-6OJJF4WP.js → chunk-XJUUWHVN.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-NGP6LSV2.js";
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 import {
   atomicWriteJsonSync,
   ensurePrivateDirSync

package/dist/{chunk-F7LU65PQ.js → chunk-Y25OJWOQ.js}

@@ -1,4 +1,5 @@
 // src/lib/secret-redaction.ts
+import { validateMnemonic } from "bip39";
 var SECRET_PATTERNS = [
   { name: "openai_key", pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
   { name: "anthropic_key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
@@ -10,9 +11,15 @@ var SECRET_PATTERNS = [
   { name: "private_key", pattern: /-----BEGIN (?:OPENSSH|RSA|DSA|EC|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END (?:OPENSSH|RSA|DSA|EC|PGP)? ?PRIVATE KEY-----/g },
   { name: "db_url_password", pattern: /\b(postgres(?:ql)?|mysql|mongodb|redis):\/\/([^:\s/@]+):([^@\s]+)@/gi },
   { name: "assignment_secret", pattern: /\b(api[_-]?key|secret|token|password|passwd|pwd|private[_-]?key|access[_-]?key)\s*[:=]\s*(['\"]?)[^\s'"]{8,}\2/gi },
-  { name: "env_secret", pattern: /\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_KEY|ACCESS_KEY)[A-Z0-9_]*\s*=\s*['\"]?[^'"\s]{8,}/g },
-  { name: "recovery_phrase", pattern: /\b(?:[a-z]{3,12}\s+){23}[a-z]{3,12}\b/gi }
+  { name: "env_secret", pattern: /\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_KEY|ACCESS_KEY)[A-Z0-9_]*\s*=\s*['\"]?[^'"\s]{8,}/g }
 ];
+var MNEMONIC_CANDIDATE_RE = /\b(?:[a-z]{3,12}\s+){11,23}[a-z]{3,12}\b/g;
+var MNEMONIC_LENGTHS = /* @__PURE__ */ new Set([12, 15, 18, 21, 24]);
+function looksLikeBip39Mnemonic(candidate) {
+  const words = candidate.trim().split(/\s+/);
+  if (!MNEMONIC_LENGTHS.has(words.length)) return false;
+  return validateMnemonic(words.join(" "));
+}
 function redactSecrets(input) {
   let text = input;
   let redactedCount = 0;
@@ -25,6 +32,11 @@ function redactSecrets(input) {
       return `[REDACTED:${name}]`;
     });
   }
+  text = text.replace(MNEMONIC_CANDIDATE_RE, (match) => {
+    if (!looksLikeBip39Mnemonic(match)) return match;
+    redactedCount++;
+    return "[REDACTED:recovery_phrase]";
+  });
   return { text, redactedCount };
 }
 

package/dist/{chunk-2ORPA23Y.js → chunk-YMXXD2GW.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/shard-manager.ts
 import path from "path";
@@ -17,24 +17,32 @@ var _encryptionKey = null;
 var _shardingEnabled = false;
 var _keyValidated = false;
 var _keyValidationPromise = null;
+var _validationFailedForKey = null;
+var _validationWarningEmitted = false;
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
-  _keyValidated = false;
   _keyValidationPromise = null;
+  _keyValidated = false;
   if (!existsSync(SHARDS_DIR)) {
     mkdirSync(SHARDS_DIR, { recursive: true });
   }
   const existingShards = readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db"));
   if (existingShards.length === 0) {
     _keyValidated = true;
+    _validationFailedForKey = null;
+  }
+  if (_validationFailedForKey === encryptionKey && existingShards.length > 0) {
+    _keyValidated = true;
+    _shardingEnabled = false;
+  } else {
+    _shardingEnabled = true;
   }
-  _shardingEnabled = true;
   if (_evictionTimer) clearInterval(_evictionTimer);
   _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
   _evictionTimer.unref();
 }
 async function validateEncryptionKey() {
-  if (_keyValidated) return true;
+  if (_keyValidated) return _shardingEnabled;
   if (!_encryptionKey) return false;
   const existingShards = readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db"));
   if (existingShards.length === 0) {
@@ -48,6 +56,8 @@ async function validateEncryptionKey() {
       await testClient.execute("SELECT COUNT(*) FROM sqlite_schema");
       testClient.close();
       _keyValidated = true;
+      _validationFailedForKey = null;
+      _validationWarningEmitted = false;
       return true;
     } catch {
       try {
@@ -56,10 +66,16 @@ async function validateEncryptionKey() {
       }
     }
   }
-  process.stderr.write(
-    `[shard-manager] WARNING: encryption key cannot read any existing shards (${existingShards.length} found). New shard creation disabled to prevent stranded files. Run /exe-doctor to audit.
+  if (!_validationWarningEmitted) {
+    process.stderr.write(
+      `[shard-manager] WARNING: encryption key cannot read any existing shards (${existingShards.length} found). New shard creation disabled to prevent stranded files. Run /exe-doctor to audit.
 `
-  );
+    );
+    _validationWarningEmitted = true;
+  }
+  _validationFailedForKey = _encryptionKey;
+  _keyValidated = true;
+  _keyValidationPromise = null;
   _shardingEnabled = false;
   return false;
 }
@@ -324,7 +340,9 @@ async function ensureShardSchema(client) {
     // Session scope (must match database.ts)
     "ALTER TABLE memories ADD COLUMN session_scope TEXT",
     // Keywords for FTS5 dual-column search (must match database.ts)
-    "ALTER TABLE memories ADD COLUMN keywords TEXT DEFAULT ''"
+    "ALTER TABLE memories ADD COLUMN keywords TEXT DEFAULT ''",
+    // Multi-user founder scope (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN founder_id TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -469,6 +487,11 @@ async function ensureShardSchema(client) {
   `);
 }
 async function getReadyShardClient(projectName) {
+  if (!_shardingEnabled && _validationFailedForKey === _encryptionKey) {
+    throw new Error(
+      `Shard creation blocked: encryption key mismatch with existing shards. Run /exe-doctor to audit.`
+    );
+  }
   if (!_keyValidated) {
     if (!_keyValidationPromise) {
       _keyValidationPromise = validateEncryptionKey();
@@ -480,6 +503,11 @@ async function getReadyShardClient(projectName) {
       );
     }
   }
+  if (!_shardingEnabled) {
+    throw new Error(
+      `Shard creation blocked: encryption key mismatch with existing shards. Run /exe-doctor to audit.`
+    );
+  }
   const safeName = safeShardName(projectName);
   let client = getShardClient(projectName);
   try {

package/dist/{chunk-5WLMF6PL.js → chunk-YMZHTTOQ.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/reminders.ts
 import crypto from "crypto";