@askexenow/exe-os 0.9.30 → 0.9.32

package/dist/bin/setup.js

@@ -304,6 +304,7 @@ __export(keychain_exports, {
 });
 import { readFile as readFile2, writeFile as writeFile2, unlink, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
+import { execSync } from "child_process";
 import path2 from "path";
 import os2 from "os";
 function getKeyDir() {
@@ -312,6 +313,83 @@ function getKeyDir() {
 function getKeyPath() {
   return path2.join(getKeyDir(), "master.key");
 }
+function macKeychainGet() {
+  if (process.platform !== "darwin") return null;
+  try {
+    return execSync(
+      `security find-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
+  }
+}
+function macKeychainSet(value) {
+  if (process.platform !== "darwin") return false;
+  try {
+    try {
+      execSync(
+        `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
+        { timeout: 5e3 }
+      );
+    } catch {
+    }
+    execSync(
+      `security add-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w "${value}"`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function macKeychainDelete() {
+  if (process.platform !== "darwin") return false;
+  try {
+    execSync(
+      `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function linuxSecretGet() {
+  if (process.platform !== "linux") return null;
+  try {
+    return execSync(
+      `secret-tool lookup service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
+  }
+}
+function linuxSecretSet(value) {
+  if (process.platform !== "linux") return false;
+  try {
+    execSync(
+      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${SERVICE}" account "${ACCOUNT}"`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function linuxSecretDelete() {
+  if (process.platform !== "linux") return false;
+  try {
+    execSync(
+      `secret-tool clear service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function tryKeytar() {
   try {
     return await import("keytar");
@@ -319,13 +397,72 @@ async function tryKeytar() {
     return null;
   }
 }
+function deriveMachineKey() {
+  try {
+    const crypto5 = __require("crypto");
+    const material = [
+      os2.hostname(),
+      os2.userInfo().username,
+      os2.arch(),
+      os2.platform(),
+      // Machine ID on Linux (stable across reboots)
+      process.platform === "linux" ? readMachineId() : ""
+    ].join("|");
+    return crypto5.createHash("sha256").update(material).digest();
+  } catch {
+    return null;
+  }
+}
+function readMachineId() {
+  try {
+    const { readFileSync: readFileSync13 } = __require("fs");
+    return readFileSync13("/etc/machine-id", "utf-8").trim();
+  } catch {
+    return "";
+  }
+}
+function encryptWithMachineKey(plaintext, machineKey) {
+  const crypto5 = __require("crypto");
+  const iv = crypto5.randomBytes(12);
+  const cipher = crypto5.createCipheriv("aes-256-gcm", machineKey, iv);
+  let encrypted = cipher.update(plaintext, "utf-8", "base64");
+  encrypted += cipher.final("base64");
+  const authTag = cipher.getAuthTag().toString("base64");
+  return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${authTag}:${encrypted}`;
+}
+function decryptWithMachineKey(encrypted, machineKey) {
+  if (!encrypted.startsWith(ENCRYPTED_PREFIX)) return null;
+  try {
+    const crypto5 = __require("crypto");
+    const parts = encrypted.slice(ENCRYPTED_PREFIX.length).split(":");
+    if (parts.length !== 3) return null;
+    const [ivB64, tagB64, cipherB64] = parts;
+    const iv = Buffer.from(ivB64, "base64");
+    const authTag = Buffer.from(tagB64, "base64");
+    const decipher = crypto5.createDecipheriv("aes-256-gcm", machineKey, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(cipherB64, "base64", "utf-8");
+    decrypted += decipher.final("utf-8");
+    return decrypted;
+  } catch {
+    return null;
+  }
+}
 async function getMasterKey() {
+  const nativeValue = macKeychainGet() ?? linuxSecretGet();
+  if (nativeValue) {
+    return Buffer.from(nativeValue, "base64");
+  }
   const keytar = await tryKeytar();
   if (keytar) {
     try {
-      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
-      if (stored) {
-        return Buffer.from(stored, "base64");
+      const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
+      if (keytarValue) {
+        const migrated = macKeychainSet(keytarValue) || linuxSecretSet(keytarValue);
+        if (migrated) {
+          process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
+        }
+        return Buffer.from(keytarValue, "base64");
       }
     } catch {
     }
@@ -339,8 +476,31 @@ async function getMasterKey() {
     return null;
   }
   try {
-    const content = await readFile2(keyPath, "utf-8");
-    return Buffer.from(content.trim(), "base64");
+    const content = (await readFile2(keyPath, "utf-8")).trim();
+    let b64Value;
+    if (content.startsWith(ENCRYPTED_PREFIX)) {
+      const machineKey = deriveMachineKey();
+      if (!machineKey) {
+        process.stderr.write("[keychain] Cannot derive machine key to decrypt stored key.\n");
+        return null;
+      }
+      const decrypted = decryptWithMachineKey(content, machineKey);
+      if (!decrypted) {
+        process.stderr.write(
+          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase: exe-os link import\n"
+        );
+        return null;
+      }
+      b64Value = decrypted;
+    } else {
+      b64Value = content;
+    }
+    const key = Buffer.from(b64Value, "base64");
+    const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
+    if (migrated) {
+      process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
+    }
+    return key;
   } catch (err) {
     process.stderr.write(
       `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
@@ -351,6 +511,9 @@ async function getMasterKey() {
 }
 async function setMasterKey(key) {
   const b64 = key.toString("base64");
+  if (macKeychainSet(b64) || linuxSecretSet(b64)) {
+    return;
+  }
   const keytar = await tryKeytar();
   if (keytar) {
     try {
@@ -362,10 +525,23 @@ async function setMasterKey(key) {
   const dir = getKeyDir();
   await mkdir2(dir, { recursive: true });
   const keyPath = getKeyPath();
-  await writeFile2(keyPath, b64 + "\n", "utf-8");
-  await chmod2(keyPath, 384);
+  const machineKey = deriveMachineKey();
+  if (machineKey) {
+    const encrypted = encryptWithMachineKey(b64, machineKey);
+    await writeFile2(keyPath, encrypted + "\n", "utf-8");
+    await chmod2(keyPath, 384);
+    process.stderr.write("[keychain] Key stored encrypted (machine-bound).\n");
+  } else {
+    await writeFile2(keyPath, b64 + "\n", "utf-8");
+    await chmod2(keyPath, 384);
+    process.stderr.write(
+      "[keychain] WARNING: Key stored in plaintext file \u2014 no OS keychain available.\n"
+    );
+  }
 }
 async function deleteMasterKey() {
+  macKeychainDelete();
+  linuxSecretDelete();
   const keytar = await tryKeytar();
   if (keytar) {
     try {
@@ -407,12 +583,13 @@ async function importMnemonic(mnemonic) {
   const entropy = mnemonicToEntropy(trimmed);
   return Buffer.from(entropy, "hex");
 }
-var SERVICE, ACCOUNT;
+var SERVICE, ACCOUNT, ENCRYPTED_PREFIX;
 var init_keychain = __esm({
   "src/lib/keychain.ts"() {
     "use strict";
     SERVICE = "exe-mem";
     ACCOUNT = "master-key";
+    ENCRYPTED_PREFIX = "enc:";
   }
 });
 
@@ -530,8 +707,8 @@ function findPackageRoot() {
 function getAvailableMemoryGB() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync2 } = __require("child_process");
-      const vmstat = execSync2("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync3 } = __require("child_process");
+      const vmstat = execSync3("vm_stat", { encoding: "utf8" });
       const pageSize = 16384;
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -931,10 +1108,10 @@ async function disposeEmbedder() {
 async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync16 } = await import("fs");
-  const path16 = await import("path");
-  const modelPath = path16.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync16(modelPath)) {
+  const { existsSync: existsSync17 } = await import("fs");
+  const path17 = await import("path");
+  const modelPath = path17.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync17(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -1223,8 +1400,8 @@ async function validateLicense(apiKey, deviceId) {
 }
 function getCacheAgeMs() {
   try {
-    const { statSync: statSync2 } = __require("fs");
-    const s = statSync2(CACHE_PATH);
+    const { statSync: statSync3 } = __require("fs");
+    const s = statSync3(CACHE_PATH);
     return Date.now() - s.mtimeMs;
   } catch {
     return Infinity;
@@ -1687,7 +1864,7 @@ __export(employees_exports, {
 });
 import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir4 } from "fs/promises";
 import { existsSync as existsSync9, symlinkSync, readlinkSync, readFileSync as readFileSync6, renameSync as renameSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "fs";
-import { execSync } from "child_process";
+import { execSync as execSync2 } from "child_process";
 import path8 from "path";
 import os5 from "os";
 function normalizeRole(role) {
@@ -1862,7 +2039,7 @@ async function normalizeRosterCase(rosterPath) {
 }
 function findExeBin() {
   try {
-    return execSync(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
+    return execSync2(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
   } catch {
     return null;
   }
@@ -4062,6 +4239,109 @@ var init_crdt_sync = __esm({
   }
 });
 
+// src/lib/db-backup.ts
+var db_backup_exports = {};
+__export(db_backup_exports, {
+  createBackup: () => createBackup,
+  findActiveDb: () => findActiveDb,
+  getBackupDir: () => getBackupDir,
+  getLatestBackup: () => getLatestBackup,
+  hasBackupToday: () => hasBackupToday,
+  listBackups: () => listBackups,
+  rotateBackups: () => rotateBackups
+});
+import { copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync4, readdirSync, unlinkSync as unlinkSync5, statSync as statSync2 } from "fs";
+import path11 from "path";
+function findActiveDb() {
+  for (const name of DB_NAMES) {
+    const p = path11.join(EXE_AI_DIR, name);
+    if (existsSync11(p)) return p;
+  }
+  return null;
+}
+function createBackup(reason = "manual") {
+  const dbPath = findActiveDb();
+  if (!dbPath) return null;
+  mkdirSync4(BACKUP_DIR, { recursive: true });
+  const dbName = path11.basename(dbPath, ".db");
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
+  const backupName = `${dbName}-${reason}-${timestamp}.db`;
+  const backupPath = path11.join(BACKUP_DIR, backupName);
+  copyFileSync(dbPath, backupPath);
+  const walPath = dbPath + "-wal";
+  if (existsSync11(walPath)) {
+    try {
+      copyFileSync(walPath, backupPath + "-wal");
+    } catch {
+    }
+  }
+  const shmPath = dbPath + "-shm";
+  if (existsSync11(shmPath)) {
+    try {
+      copyFileSync(shmPath, backupPath + "-shm");
+    } catch {
+    }
+  }
+  return backupPath;
+}
+function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
+  if (!existsSync11(BACKUP_DIR)) return 0;
+  const cutoff = Date.now() - keepDays * 24 * 60 * 60 * 1e3;
+  let deleted = 0;
+  try {
+    const files = readdirSync(BACKUP_DIR);
+    for (const file of files) {
+      if (!file.endsWith(".db") && !file.endsWith(".db-wal") && !file.endsWith(".db-shm")) continue;
+      const filePath = path11.join(BACKUP_DIR, file);
+      try {
+        const stat = statSync2(filePath);
+        if (stat.mtimeMs < cutoff) {
+          unlinkSync5(filePath);
+          deleted++;
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return deleted;
+}
+function listBackups() {
+  if (!existsSync11(BACKUP_DIR)) return [];
+  try {
+    const files = readdirSync(BACKUP_DIR).filter((f) => f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm"));
+    return files.map((name) => {
+      const p = path11.join(BACKUP_DIR, name);
+      const stat = statSync2(p);
+      return { path: p, name, size: stat.size, date: stat.mtime };
+    }).sort((a, b) => b.date.getTime() - a.date.getTime());
+  } catch {
+    return [];
+  }
+}
+function hasBackupToday(reason) {
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const backups = listBackups();
+  return backups.some((b) => b.name.includes(reason) && b.name.includes(today.replace(/-/g, "-")));
+}
+function getLatestBackup() {
+  const backups = listBackups();
+  return backups.length > 0 ? backups[0].path : null;
+}
+function getBackupDir() {
+  return BACKUP_DIR;
+}
+var BACKUP_DIR, DEFAULT_KEEP_DAYS, DB_NAMES;
+var init_db_backup = __esm({
+  "src/lib/db-backup.ts"() {
+    "use strict";
+    init_config();
+    BACKUP_DIR = path11.join(EXE_AI_DIR, "backups");
+    DEFAULT_KEEP_DAYS = 3;
+    DB_NAMES = ["memories.db", "exe-mem.db", "exe-os.db", "exe.db"];
+  }
+});
+
 // src/lib/cloud-sync.ts
 var cloud_sync_exports = {};
 __export(cloud_sync_exports, {
@@ -4091,16 +4371,16 @@ __export(cloud_sync_exports, {
   pushToPostgres: () => pushToPostgres,
   recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync11, readdirSync, mkdirSync as mkdirSync4, appendFileSync, unlinkSync as unlinkSync5, openSync as openSync2, closeSync as closeSync2 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync12, readdirSync as readdirSync2, mkdirSync as mkdirSync5, appendFileSync, unlinkSync as unlinkSync6, openSync as openSync2, closeSync as closeSync2 } from "fs";
 import crypto3 from "crypto";
-import path11 from "path";
+import path12 from "path";
 import { homedir as homedir2 } from "os";
 function sqlSafe(v) {
   return v === void 0 ? null : v;
 }
 function logError(msg) {
   try {
-    const logPath = path11.join(homedir2(), ".exe-os", "workers.log");
+    const logPath = path12.join(homedir2(), ".exe-os", "workers.log");
     appendFileSync(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
@@ -4109,10 +4389,10 @@ function logError(msg) {
 function loadPgClient() {
   if (_pgFailed) return null;
   const postgresUrl = process.env.DATABASE_URL;
-  const configPath = path11.join(EXE_AI_DIR, "config.json");
+  const configPath = path12.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
   try {
-    if (existsSync11(configPath)) {
+    if (existsSync12(configPath)) {
       const cfg = JSON.parse(readFileSync8(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
       if (cfg.cloud?.syncToPostgres === false) {
@@ -4131,8 +4411,8 @@ function loadPgClient() {
     _pgPromise = (async () => {
       const { createRequire: createRequire3 } = await import("module");
       const { pathToFileURL: pathToFileURL3 } = await import("url");
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path11.join(homedir2(), "exe-db");
-      const req = createRequire3(path11.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path12.join(homedir2(), "exe-db");
+      const req = createRequire3(path12.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
       const mod = await import(pathToFileURL3(entry).href);
       const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
@@ -4185,7 +4465,7 @@ async function withRosterLock(fn) {
         if (Date.now() - ts < LOCK_STALE_MS) {
           throw new Error("Roster merge already in progress \u2014 another sync is running");
         }
-        unlinkSync5(ROSTER_LOCK_PATH);
+        unlinkSync6(ROSTER_LOCK_PATH);
         const fd = openSync2(ROSTER_LOCK_PATH, "wx");
         closeSync2(fd);
         writeFileSync6(ROSTER_LOCK_PATH, String(Date.now()));
@@ -4201,7 +4481,7 @@ async function withRosterLock(fn) {
     return await fn();
   } finally {
     try {
-      unlinkSync5(ROSTER_LOCK_PATH);
+      unlinkSync6(ROSTER_LOCK_PATH);
     } catch {
     }
   }
@@ -4572,13 +4852,42 @@ async function cloudSync(config) {
   try {
     const employees = await loadEmployees();
     rosterResult.employees = employees.length;
-    const idDir = path11.join(EXE_AI_DIR, "identity");
-    if (existsSync11(idDir)) {
-      rosterResult.identities = readdirSync(idDir).filter((f) => f.endsWith(".md")).length;
+    const idDir = path12.join(EXE_AI_DIR, "identity");
+    if (existsSync12(idDir)) {
+      rosterResult.identities = readdirSync2(idDir).filter((f) => f.endsWith(".md")).length;
     }
   } catch {
   }
   const totalMemories = await countRows("SELECT COUNT(*) as cnt FROM memories WHERE status = 'active' OR status IS NULL");
+  try {
+    const { getLatestBackup: getLatestBackup2 } = await Promise.resolve().then(() => (init_db_backup(), db_backup_exports));
+    const { statSync: statFile } = await import("fs");
+    const latestBackup = getLatestBackup2();
+    if (latestBackup) {
+      const backupSize = statFile(latestBackup).size;
+      const MAX_CLOUD_BACKUP_BYTES = 50 * 1024 * 1024;
+      if (backupSize <= MAX_CLOUD_BACKUP_BYTES) {
+        const backupData = readFileSync8(latestBackup);
+        const deviceId = loadDeviceId() ?? "unknown";
+        const encrypted = encryptSyncBlob(backupData);
+        const backupRes = await fetchWithRetry(`${config.endpoint}/sync/push-db-backup`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${config.apiKey}` },
+          body: JSON.stringify({
+            device_id: deviceId,
+            filename: path12.basename(latestBackup),
+            blob: encrypted,
+            size: backupData.length
+          })
+        });
+        if (backupRes && !backupRes.ok) {
+          logError(`[cloud-sync] DB backup upload failed: ${backupRes.status}`);
+        }
+      }
+    }
+  } catch (err) {
+    logError(`[cloud-sync] DB backup upload error: ${err instanceof Error ? err.message : String(err)}`);
+  }
   return {
     pushed,
     pulled,
@@ -4594,7 +4903,7 @@ async function cloudSync(config) {
 function recordRosterDeletion(name) {
   let deletions = [];
   try {
-    if (existsSync11(ROSTER_DELETIONS_PATH)) {
+    if (existsSync12(ROSTER_DELETIONS_PATH)) {
       deletions = JSON.parse(readFileSync8(ROSTER_DELETIONS_PATH, "utf-8"));
     }
   } catch {
@@ -4604,7 +4913,7 @@ function recordRosterDeletion(name) {
 }
 function consumeRosterDeletions() {
   try {
-    if (!existsSync11(ROSTER_DELETIONS_PATH)) return [];
+    if (!existsSync12(ROSTER_DELETIONS_PATH)) return [];
     const deletions = JSON.parse(readFileSync8(ROSTER_DELETIONS_PATH, "utf-8"));
     writeFileSync6(ROSTER_DELETIONS_PATH, "[]");
     return deletions;
@@ -4613,35 +4922,35 @@ function consumeRosterDeletions() {
   }
 }
 function buildRosterBlob(paths) {
-  const rosterPath = paths?.rosterPath ?? path11.join(EXE_AI_DIR, "exe-employees.json");
-  const identityDir = paths?.identityDir ?? path11.join(EXE_AI_DIR, "identity");
-  const configPath = paths?.configPath ?? path11.join(EXE_AI_DIR, "config.json");
+  const rosterPath = paths?.rosterPath ?? path12.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path12.join(EXE_AI_DIR, "identity");
+  const configPath = paths?.configPath ?? path12.join(EXE_AI_DIR, "config.json");
   let roster = [];
-  if (existsSync11(rosterPath)) {
+  if (existsSync12(rosterPath)) {
     try {
       roster = JSON.parse(readFileSync8(rosterPath, "utf-8"));
     } catch {
     }
   }
   const identities = {};
-  if (existsSync11(identityDir)) {
-    for (const file of readdirSync(identityDir).filter((f) => f.endsWith(".md"))) {
+  if (existsSync12(identityDir)) {
+    for (const file of readdirSync2(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
-        identities[file] = readFileSync8(path11.join(identityDir, file), "utf-8");
+        identities[file] = readFileSync8(path12.join(identityDir, file), "utf-8");
       } catch {
       }
     }
   }
   let config;
-  if (existsSync11(configPath)) {
+  if (existsSync12(configPath)) {
     try {
       config = JSON.parse(readFileSync8(configPath, "utf-8"));
     } catch {
     }
   }
   let agentConfig;
-  const agentConfigPath = path11.join(EXE_AI_DIR, "agent-config.json");
-  if (existsSync11(agentConfigPath)) {
+  const agentConfigPath = path12.join(EXE_AI_DIR, "agent-config.json");
+  if (existsSync12(agentConfigPath)) {
     try {
       agentConfig = JSON.parse(readFileSync8(agentConfigPath, "utf-8"));
     } catch {
@@ -4719,16 +5028,16 @@ async function cloudPullRoster(config) {
   }
 }
 function mergeConfig(remoteConfig, configPath) {
-  const cfgPath = configPath ?? path11.join(EXE_AI_DIR, "config.json");
+  const cfgPath = configPath ?? path12.join(EXE_AI_DIR, "config.json");
   let local = {};
-  if (existsSync11(cfgPath)) {
+  if (existsSync12(cfgPath)) {
     try {
       local = JSON.parse(readFileSync8(cfgPath, "utf-8"));
     } catch {
     }
   }
   const merged = { ...remoteConfig, ...local };
-  const dir = path11.dirname(cfgPath);
+  const dir = path12.dirname(cfgPath);
   ensurePrivateDirSync(dir);
   writeFileSync6(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
   enforcePrivateFileSync(cfgPath);
@@ -4736,7 +5045,7 @@ function mergeConfig(remoteConfig, configPath) {
 async function mergeRosterFromRemote(remote, paths) {
   return withRosterLock(async () => {
     const rosterPath = paths?.rosterPath ?? void 0;
-    const identityDir = paths?.identityDir ?? path11.join(EXE_AI_DIR, "identity");
+    const identityDir = paths?.identityDir ?? path12.join(EXE_AI_DIR, "identity");
     const localEmployees = await loadEmployees(rosterPath);
     const localNames = new Set(localEmployees.map((e) => e.name));
     let added = 0;
@@ -4757,11 +5066,11 @@ async function mergeRosterFromRemote(remote, paths) {
       ) ?? lookupKey;
       const remoteIdentity = remote.identities[matchedKey];
       if (remoteIdentity) {
-        if (!existsSync11(identityDir)) mkdirSync4(identityDir, { recursive: true });
-        const idPath = path11.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync12(identityDir)) mkdirSync5(identityDir, { recursive: true });
+        const idPath = path12.join(identityDir, `${remoteEmp.name}.md`);
         let localIdentity = null;
         try {
-          localIdentity = existsSync11(idPath) ? readFileSync8(idPath, "utf-8") : null;
+          localIdentity = existsSync12(idPath) ? readFileSync8(idPath, "utf-8") : null;
         } catch {
         }
         if (localIdentity !== remoteIdentity) {
@@ -4791,16 +5100,16 @@ async function mergeRosterFromRemote(remote, paths) {
     }
     if (remote.agentConfig && Object.keys(remote.agentConfig).length > 0) {
       try {
-        const agentConfigPath = path11.join(EXE_AI_DIR, "agent-config.json");
+        const agentConfigPath = path12.join(EXE_AI_DIR, "agent-config.json");
         let local = {};
-        if (existsSync11(agentConfigPath)) {
+        if (existsSync12(agentConfigPath)) {
           try {
             local = JSON.parse(readFileSync8(agentConfigPath, "utf-8"));
           } catch {
           }
         }
         const merged = { ...remote.agentConfig, ...local };
-        ensurePrivateDirSync(path11.dirname(agentConfigPath));
+        ensurePrivateDirSync(path12.dirname(agentConfigPath));
         writeFileSync6(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
         enforcePrivateFileSync(agentConfigPath);
       } catch {
@@ -5241,11 +5550,11 @@ var init_cloud_sync = __esm({
     LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
     FETCH_TIMEOUT_MS = 3e4;
     PUSH_BATCH_SIZE = 5e3;
-    ROSTER_LOCK_PATH = path11.join(EXE_AI_DIR, "roster-merge.lock");
+    ROSTER_LOCK_PATH = path12.join(EXE_AI_DIR, "roster-merge.lock");
     LOCK_STALE_MS = 3e4;
     _pgPromise = null;
     _pgFailed = false;
-    ROSTER_DELETIONS_PATH = path11.join(EXE_AI_DIR, "roster-deletions.json");
+    ROSTER_DELETIONS_PATH = path12.join(EXE_AI_DIR, "roster-deletions.json");
   }
 });
 
@@ -5255,12 +5564,12 @@ __export(preferences_exports, {
   loadPreferences: () => loadPreferences,
   savePreferences: () => savePreferences
 });
-import { existsSync as existsSync12, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
-import path12 from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+import path13 from "path";
 import os7 from "os";
 function loadPreferences(homeDir = os7.homedir()) {
-  const configPath = path12.join(homeDir, ".exe-os", "config.json");
-  if (!existsSync12(configPath)) return {};
+  const configPath = path13.join(homeDir, ".exe-os", "config.json");
+  if (!existsSync13(configPath)) return {};
   try {
     const config = JSON.parse(readFileSync9(configPath, "utf-8"));
     return config.preferences ?? {};
@@ -5269,11 +5578,11 @@ function loadPreferences(homeDir = os7.homedir()) {
   }
 }
 function savePreferences(prefs, homeDir = os7.homedir()) {
-  const configDir = path12.join(homeDir, ".exe-os");
-  const configPath = path12.join(configDir, "config.json");
+  const configDir = path13.join(homeDir, ".exe-os");
+  const configPath = path13.join(configDir, "config.json");
   ensurePrivateDirSync(configDir);
   let config = {};
-  if (existsSync12(configPath)) {
+  if (existsSync13(configPath)) {
     try {
       config = JSON.parse(readFileSync9(configPath, "utf-8"));
     } catch {
@@ -6120,17 +6429,17 @@ __export(identity_exports, {
   listIdentities: () => listIdentities,
   updateIdentity: () => updateIdentity
 });
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
-import { readdirSync as readdirSync2 } from "fs";
-import path13 from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
+import { readdirSync as readdirSync3 } from "fs";
+import path14 from "path";
 import { createHash as createHash2 } from "crypto";
 function ensureDir() {
-  if (!existsSync13(IDENTITY_DIR2)) {
-    mkdirSync5(IDENTITY_DIR2, { recursive: true });
+  if (!existsSync14(IDENTITY_DIR2)) {
+    mkdirSync6(IDENTITY_DIR2, { recursive: true });
   }
 }
 function identityPath(agentId) {
-  return path13.join(IDENTITY_DIR2, `${agentId}.md`);
+  return path14.join(IDENTITY_DIR2, `${agentId}.md`);
 }
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
@@ -6171,7 +6480,7 @@ function contentHash(content) {
 }
 function getIdentity(agentId) {
   const filePath = identityPath(agentId);
-  if (!existsSync13(filePath)) return null;
+  if (!existsSync14(filePath)) return null;
   const raw = readFileSync10(filePath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(raw);
   return {
@@ -6203,7 +6512,7 @@ async function updateIdentity(agentId, content, updatedBy) {
 }
 function listIdentities() {
   ensureDir();
-  const files = readdirSync2(IDENTITY_DIR2).filter((f) => f.endsWith(".md"));
+  const files = readdirSync3(IDENTITY_DIR2).filter((f) => f.endsWith(".md"));
   const results = [];
   for (const file of files) {
     const agentId = file.replace(".md", "");
@@ -6242,7 +6551,7 @@ var init_identity = __esm({
     "use strict";
     init_config();
     init_database();
-    IDENTITY_DIR2 = path13.join(EXE_AI_DIR, "identity");
+    IDENTITY_DIR2 = path14.join(EXE_AI_DIR, "identity");
   }
 });
 
@@ -6793,28 +7102,28 @@ __export(session_wrappers_exports, {
   generateSessionWrappers: () => generateSessionWrappers
 });
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   readFileSync as readFileSync11,
   writeFileSync as writeFileSync9,
-  mkdirSync as mkdirSync6,
+  mkdirSync as mkdirSync7,
   chmodSync as chmodSync2,
-  readdirSync as readdirSync3,
-  unlinkSync as unlinkSync6
+  readdirSync as readdirSync4,
+  unlinkSync as unlinkSync7
 } from "fs";
-import path14 from "path";
+import path15 from "path";
 import { homedir as homedir3 } from "os";
 function generateSessionWrappers(packageRoot, homeDir) {
   const home = homeDir ?? homedir3();
-  const binDir = path14.join(home, ".exe-os", "bin");
-  const rosterPath = path14.join(home, ".exe-os", "exe-employees.json");
-  mkdirSync6(binDir, { recursive: true });
-  const exeStartDst = path14.join(binDir, "exe-start");
+  const binDir = path15.join(home, ".exe-os", "bin");
+  const rosterPath = path15.join(home, ".exe-os", "exe-employees.json");
+  mkdirSync7(binDir, { recursive: true });
+  const exeStartDst = path15.join(binDir, "exe-start");
   const candidates = [
-    path14.join(packageRoot, "dist", "bin", "exe-start.sh"),
-    path14.join(packageRoot, "src", "bin", "exe-start.sh")
+    path15.join(packageRoot, "dist", "bin", "exe-start.sh"),
+    path15.join(packageRoot, "src", "bin", "exe-start.sh")
   ];
   for (const src of candidates) {
-    if (existsSync14(src)) {
+    if (existsSync15(src)) {
       writeFileSync9(exeStartDst, readFileSync11(src));
       chmodSync2(exeStartDst, 493);
       break;
@@ -6830,13 +7139,13 @@ function generateSessionWrappers(packageRoot, homeDir) {
     return { created: 0, pathConfigured: false };
   }
   try {
-    for (const f of readdirSync3(binDir)) {
+    for (const f of readdirSync4(binDir)) {
       if (f === "exe-start") continue;
-      const fPath = path14.join(binDir, f);
+      const fPath = path15.join(binDir, f);
       try {
         const content = readFileSync11(fPath, "utf8");
         if (content.includes("exe-start")) {
-          unlinkSync6(fPath);
+          unlinkSync7(fPath);
         }
       } catch {
       }
@@ -6849,30 +7158,30 @@ exec "${exeStartDst}" "$0" "$@"
 `;
   for (const emp of employees) {
     for (let n = 1; n <= MAX_N; n++) {
-      const wrapperPath = path14.join(binDir, `${emp.name}${n}`);
+      const wrapperPath = path15.join(binDir, `${emp.name}${n}`);
       writeFileSync9(wrapperPath, wrapperContent);
       chmodSync2(wrapperPath, 493);
       created++;
-      const codexPath = path14.join(binDir, `${emp.name}${n}-codex`);
+      const codexPath = path15.join(binDir, `${emp.name}${n}-codex`);
       writeFileSync9(codexPath, wrapperContent);
       chmodSync2(codexPath, 493);
       created++;
     }
   }
   const codexLauncherCandidates = [
-    path14.join(packageRoot, "dist", "bin", "exe-start-codex.js"),
-    path14.join(packageRoot, "src", "bin", "exe-start-codex.ts")
+    path15.join(packageRoot, "dist", "bin", "exe-start-codex.js"),
+    path15.join(packageRoot, "src", "bin", "exe-start-codex.ts")
   ];
   let codexLauncher = null;
   for (const c of codexLauncherCandidates) {
-    if (existsSync14(c)) {
+    if (existsSync15(c)) {
       codexLauncher = c;
       break;
     }
   }
   if (codexLauncher) {
     for (const emp of employees) {
-      const wrapperPath = path14.join(binDir, `${emp.name}-codex`);
+      const wrapperPath = path15.join(binDir, `${emp.name}-codex`);
       const content = `#!/bin/bash
 exec node "${codexLauncher}" --agent ${emp.name} "$@"
 `;
@@ -6895,12 +7204,12 @@ export PATH="${binDir}:$PATH"
   const shell = process.env.SHELL ?? "/bin/bash";
   const profilePaths = [];
   if (shell.includes("zsh")) {
-    profilePaths.push(path14.join(home, ".zshrc"));
+    profilePaths.push(path15.join(home, ".zshrc"));
   } else if (shell.includes("bash")) {
-    profilePaths.push(path14.join(home, ".bashrc"));
-    profilePaths.push(path14.join(home, ".bash_profile"));
+    profilePaths.push(path15.join(home, ".bashrc"));
+    profilePaths.push(path15.join(home, ".bash_profile"));
   } else {
-    profilePaths.push(path14.join(home, ".profile"));
+    profilePaths.push(path15.join(home, ".profile"));
   }
   for (const profilePath of profilePaths) {
     try {
@@ -6932,9 +7241,9 @@ var init_session_wrappers = __esm({
 init_config();
 init_keychain();
 import crypto4 from "crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync10, unlinkSync as unlinkSync7 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync10, unlinkSync as unlinkSync8 } from "fs";
 import os8 from "os";
-import path15 from "path";
+import path16 from "path";
 import { createInterface } from "readline";
 
 // src/lib/model-downloader.ts
@@ -7026,22 +7335,22 @@ async function fileHash(filePath) {
 
 // src/lib/setup-wizard.ts
 function findPackageRoot2() {
-  let dir = path15.dirname(new URL(import.meta.url).pathname);
-  const root = path15.parse(dir).root;
+  let dir = path16.dirname(new URL(import.meta.url).pathname);
+  const root = path16.parse(dir).root;
   while (dir !== root) {
-    const pkgPath = path15.join(dir, "package.json");
-    if (existsSync15(pkgPath)) {
+    const pkgPath = path16.join(dir, "package.json");
+    if (existsSync16(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync12(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
       } catch {
       }
     }
-    dir = path15.dirname(dir);
+    dir = path16.dirname(dir);
   }
   return null;
 }
-var SETUP_STATE_PATH = path15.join(os8.homedir(), ".exe-os", "setup-state.json");
+var SETUP_STATE_PATH = path16.join(os8.homedir(), ".exe-os", "setup-state.json");
 function loadSetupState() {
   try {
     return JSON.parse(readFileSync12(SETUP_STATE_PATH, "utf8"));
@@ -7050,12 +7359,12 @@ function loadSetupState() {
   }
 }
 function saveSetupState(state) {
-  mkdirSync7(path15.dirname(SETUP_STATE_PATH), { recursive: true });
+  mkdirSync8(path16.dirname(SETUP_STATE_PATH), { recursive: true });
   writeFileSync10(SETUP_STATE_PATH, JSON.stringify(state, null, 2));
 }
 function clearSetupState() {
   try {
-    unlinkSync7(SETUP_STATE_PATH);
+    unlinkSync8(SETUP_STATE_PATH);
   } catch {
   }
 }
@@ -7072,8 +7381,8 @@ function ask(rl, prompt) {
 function getAvailableMemoryGB2() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync2 } = __require("child_process");
-      const vmstat = execSync2("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync3 } = __require("child_process");
+      const vmstat = execSync3("vm_stat", { encoding: "utf8" });
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const pageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : 16384;
       const free = vmstat.match(/Pages free:\s+(\d+)/);
@@ -7101,10 +7410,10 @@ async function validateModel(log) {
   if (totalGB <= 8 || isLowMemory()) {
     log(`System memory: ${totalGB.toFixed(0)}GB total, ${freeGB.toFixed(1)}GB free`);
     log("Skipping in-memory model validation (low memory \u2014 will validate on first use).");
-    const modelPath = path15.join(MODELS_DIR, LOCAL_FILENAME);
-    if (existsSync15(modelPath)) {
-      const { statSync: statSync2 } = await import("fs");
-      const size = statSync2(modelPath).size;
+    const modelPath = path16.join(MODELS_DIR, LOCAL_FILENAME);
+    if (existsSync16(modelPath)) {
+      const { statSync: statSync3 } = await import("fs");
+      const size = statSync3(modelPath).size;
       if (size > 300 * 1e6) {
         log(`Model file verified (${(size / 1e6).toFixed(0)} MB).`);
         return;
@@ -7193,7 +7502,7 @@ async function runSetupWizard(opts = {}) {
     if (state.completedSteps.length > 0) {
       log(`Resuming setup from step ${Math.max(...state.completedSteps) + 1}...`);
     }
-    if (existsSync15(LEGACY_LANCE_PATH)) {
+    if (existsSync16(LEGACY_LANCE_PATH)) {
       log("\u26A0 Found v1.0 LanceDB at ~/.exe-os/local.lance");
       log("  v1.1 uses libSQL (SQLite). Your existing memories are not automatically migrated.");
       log("  The old directory will not be modified or deleted.");
@@ -7208,6 +7517,23 @@ async function runSetupWizard(opts = {}) {
         const key = crypto4.randomBytes(32);
         await setMasterKey(key);
         log("Encryption key generated and stored securely.");
+        log("");
+        const { exportMnemonic: exportMnemonic2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
+        const mnemonic = await exportMnemonic2(key);
+        log("=============================================================");
+        log("  YOUR 24-WORD RECOVERY PHRASE");
+        log("=============================================================");
+        log("");
+        log("  " + mnemonic);
+        log("");
+        log("  SAVE THIS NOW. Write it down or store it in your password");
+        log("  manager. This phrase is the ONLY way to decrypt your memories");
+        log("  if you lose this computer. We cannot recover it for you.");
+        log("");
+        log("  Like a Bitcoin wallet \u2014 lose the phrase, lose everything.");
+        log("=============================================================");
+        log("");
+        await ask(rl, "Press Enter after you've saved your recovery phrase...");
       }
       state.completedSteps.push(1);
       saveSetupState(state);
@@ -7357,7 +7683,7 @@ async function runSetupWizard(opts = {}) {
       await saveConfig(config);
       log("");
       try {
-        const claudeJsonPath = path15.join(os8.homedir(), ".claude.json");
+        const claudeJsonPath = path16.join(os8.homedir(), ".claude.json");
         let claudeJson = {};
         try {
           claudeJson = JSON.parse(readFileSync12(claudeJsonPath, "utf8"));
@@ -7383,7 +7709,7 @@ async function runSetupWizard(opts = {}) {
       const prefs = { ...existingPrefs };
       log("=== Config Defaults ===");
       log("");
-      const ghosttyDetected = existsSync15(path15.join(os8.homedir(), ".config", "ghostty")) || existsSync15(path15.join(os8.homedir(), "Library", "Application Support", "com.mitchellh.ghostty"));
+      const ghosttyDetected = existsSync16(path16.join(os8.homedir(), ".config", "ghostty")) || existsSync16(path16.join(os8.homedir(), "Library", "Application Support", "com.mitchellh.ghostty"));
       if (ghosttyDetected) {
         const ghosttyAnswer = await ask(rl, "Detected Ghostty terminal. Use exe-os Ghostty defaults? (Y/n) ");
         prefs.ghostty = ghosttyAnswer.toLowerCase() !== "n";
@@ -7430,7 +7756,7 @@ async function runSetupWizard(opts = {}) {
       let missingIdentities = [];
       for (const emp of roster) {
         const idPath = identityPath2(emp.name);
-        if (!existsSync15(idPath)) {
+        if (!existsSync16(idPath)) {
           missingIdentities.push(emp.name);
         }
       }
@@ -7462,7 +7788,7 @@ async function runSetupWizard(opts = {}) {
           }
           missingIdentities = [];
           for (const emp of roster) {
-            if (!existsSync15(identityPath2(emp.name))) {
+            if (!existsSync16(identityPath2(emp.name))) {
               missingIdentities.push(emp.name);
             }
           }
@@ -7527,7 +7853,7 @@ async function runSetupWizard(opts = {}) {
       const cooIdentityContent = getIdentityTemplate("coo");
       if (cooIdentityContent) {
         const cooIdPath = identityPath2(cooName);
-        mkdirSync7(path15.dirname(cooIdPath), { recursive: true });
+        mkdirSync8(path16.dirname(cooIdPath), { recursive: true });
         const replaced = cooIdentityContent.replace(/agent_id:\s*exe/g, `agent_id: ${cooName}`).replace(/\$\{agent_id\}/g, cooName);
         writeFileSync10(cooIdPath, replaced, "utf-8");
       }
@@ -7623,7 +7949,7 @@ async function runSetupWizard(opts = {}) {
       const ctoIdentityContent = getIdentityTemplate("cto");
       if (ctoIdentityContent) {
         const ctoIdPath = identityPath2(ctoName);
-        mkdirSync7(path15.dirname(ctoIdPath), { recursive: true });
+        mkdirSync8(path16.dirname(ctoIdPath), { recursive: true });
         const replaced = ctoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${ctoName}`).replace(/\$\{agent_id\}/g, ctoName);
         writeFileSync10(ctoIdPath, replaced, "utf-8");
       }
@@ -7646,7 +7972,7 @@ async function runSetupWizard(opts = {}) {
       const cmoIdentityContent = getIdentityTemplate("cmo");
       if (cmoIdentityContent) {
         const cmoIdPath = identityPath2(cmoName);
-        mkdirSync7(path15.dirname(cmoIdPath), { recursive: true });
+        mkdirSync8(path16.dirname(cmoIdPath), { recursive: true });
         const replaced = cmoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${cmoName}`).replace(/\$\{agent_id\}/g, cmoName);
         writeFileSync10(cmoIdPath, replaced, "utf-8");
       }
@@ -7670,7 +7996,7 @@ async function runSetupWizard(opts = {}) {
             log(`Session shortcuts generated (${cooName}1, ${cooName}2, ...)`);
           }
           if (wrapResult.pathConfigured) {
-            const binDir = path15.join(os8.homedir(), ".exe-os", "bin");
+            const binDir = path16.join(os8.homedir(), ".exe-os", "bin");
             process.env.PATH = `${binDir}:${process.env.PATH ?? ""}`;
             pathJustConfigured = true;
           }
@@ -7713,7 +8039,7 @@ async function runSetupWizard(opts = {}) {
     const pkgRoot2 = findPackageRoot2();
     if (pkgRoot2) {
       try {
-        version = JSON.parse(readFileSync12(path15.join(pkgRoot2, "package.json"), "utf-8")).version;
+        version = JSON.parse(readFileSync12(path16.join(pkgRoot2, "package.json"), "utf-8")).version;
       } catch {
       }
     }