@askexenow/exe-os 0.9.30 → 0.9.32

package/dist/lib/exe-daemon.js

@@ -2086,8 +2086,8 @@ function findPackageRoot() {
 function getAvailableMemoryGB() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync12 } = __require("child_process");
-      const vmstat = execSync12("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync13 } = __require("child_process");
+      const vmstat = execSync13("vm_stat", { encoding: "utf8" });
       const pageSize = 16384;
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -3715,6 +3715,7 @@ __export(keychain_exports, {
 });
 import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync10 } from "fs";
+import { execSync as execSync2 } from "child_process";
 import path10 from "path";
 import os6 from "os";
 function getKeyDir() {
@@ -3723,6 +3724,83 @@ function getKeyDir() {
 function getKeyPath() {
   return path10.join(getKeyDir(), "master.key");
 }
+function macKeychainGet() {
+  if (process.platform !== "darwin") return null;
+  try {
+    return execSync2(
+      `security find-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
+  }
+}
+function macKeychainSet(value) {
+  if (process.platform !== "darwin") return false;
+  try {
+    try {
+      execSync2(
+        `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
+        { timeout: 5e3 }
+      );
+    } catch {
+    }
+    execSync2(
+      `security add-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w "${value}"`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function macKeychainDelete() {
+  if (process.platform !== "darwin") return false;
+  try {
+    execSync2(
+      `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function linuxSecretGet() {
+  if (process.platform !== "linux") return null;
+  try {
+    return execSync2(
+      `secret-tool lookup service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
+  }
+}
+function linuxSecretSet(value) {
+  if (process.platform !== "linux") return false;
+  try {
+    execSync2(
+      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${SERVICE}" account "${ACCOUNT}"`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function linuxSecretDelete() {
+  if (process.platform !== "linux") return false;
+  try {
+    execSync2(
+      `secret-tool clear service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function tryKeytar() {
   try {
     return await import("keytar");
@@ -3730,13 +3808,72 @@ async function tryKeytar() {
     return null;
   }
 }
+function deriveMachineKey() {
+  try {
+    const crypto14 = __require("crypto");
+    const material = [
+      os6.hostname(),
+      os6.userInfo().username,
+      os6.arch(),
+      os6.platform(),
+      // Machine ID on Linux (stable across reboots)
+      process.platform === "linux" ? readMachineId() : ""
+    ].join("|");
+    return crypto14.createHash("sha256").update(material).digest();
+  } catch {
+    return null;
+  }
+}
+function readMachineId() {
+  try {
+    const { readFileSync: readFileSync22 } = __require("fs");
+    return readFileSync22("/etc/machine-id", "utf-8").trim();
+  } catch {
+    return "";
+  }
+}
+function encryptWithMachineKey(plaintext, machineKey) {
+  const crypto14 = __require("crypto");
+  const iv = crypto14.randomBytes(12);
+  const cipher = crypto14.createCipheriv("aes-256-gcm", machineKey, iv);
+  let encrypted = cipher.update(plaintext, "utf-8", "base64");
+  encrypted += cipher.final("base64");
+  const authTag = cipher.getAuthTag().toString("base64");
+  return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${authTag}:${encrypted}`;
+}
+function decryptWithMachineKey(encrypted, machineKey) {
+  if (!encrypted.startsWith(ENCRYPTED_PREFIX)) return null;
+  try {
+    const crypto14 = __require("crypto");
+    const parts = encrypted.slice(ENCRYPTED_PREFIX.length).split(":");
+    if (parts.length !== 3) return null;
+    const [ivB64, tagB64, cipherB64] = parts;
+    const iv = Buffer.from(ivB64, "base64");
+    const authTag = Buffer.from(tagB64, "base64");
+    const decipher = crypto14.createDecipheriv("aes-256-gcm", machineKey, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(cipherB64, "base64", "utf-8");
+    decrypted += decipher.final("utf-8");
+    return decrypted;
+  } catch {
+    return null;
+  }
+}
 async function getMasterKey() {
+  const nativeValue = macKeychainGet() ?? linuxSecretGet();
+  if (nativeValue) {
+    return Buffer.from(nativeValue, "base64");
+  }
   const keytar = await tryKeytar();
   if (keytar) {
     try {
-      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
-      if (stored) {
-        return Buffer.from(stored, "base64");
+      const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
+      if (keytarValue) {
+        const migrated = macKeychainSet(keytarValue) || linuxSecretSet(keytarValue);
+        if (migrated) {
+          process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
+        }
+        return Buffer.from(keytarValue, "base64");
       }
     } catch {
     }
@@ -3750,8 +3887,31 @@ async function getMasterKey() {
     return null;
   }
   try {
-    const content = await readFile3(keyPath, "utf-8");
-    return Buffer.from(content.trim(), "base64");
+    const content = (await readFile3(keyPath, "utf-8")).trim();
+    let b64Value;
+    if (content.startsWith(ENCRYPTED_PREFIX)) {
+      const machineKey = deriveMachineKey();
+      if (!machineKey) {
+        process.stderr.write("[keychain] Cannot derive machine key to decrypt stored key.\n");
+        return null;
+      }
+      const decrypted = decryptWithMachineKey(content, machineKey);
+      if (!decrypted) {
+        process.stderr.write(
+          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase: exe-os link import\n"
+        );
+        return null;
+      }
+      b64Value = decrypted;
+    } else {
+      b64Value = content;
+    }
+    const key = Buffer.from(b64Value, "base64");
+    const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
+    if (migrated) {
+      process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
+    }
+    return key;
   } catch (err) {
     process.stderr.write(
       `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
@@ -3762,6 +3922,9 @@ async function getMasterKey() {
 }
 async function setMasterKey(key) {
   const b64 = key.toString("base64");
+  if (macKeychainSet(b64) || linuxSecretSet(b64)) {
+    return;
+  }
   const keytar = await tryKeytar();
   if (keytar) {
     try {
@@ -3773,10 +3936,23 @@ async function setMasterKey(key) {
   const dir = getKeyDir();
   await mkdir3(dir, { recursive: true });
   const keyPath = getKeyPath();
-  await writeFile3(keyPath, b64 + "\n", "utf-8");
-  await chmod2(keyPath, 384);
+  const machineKey = deriveMachineKey();
+  if (machineKey) {
+    const encrypted = encryptWithMachineKey(b64, machineKey);
+    await writeFile3(keyPath, encrypted + "\n", "utf-8");
+    await chmod2(keyPath, 384);
+    process.stderr.write("[keychain] Key stored encrypted (machine-bound).\n");
+  } else {
+    await writeFile3(keyPath, b64 + "\n", "utf-8");
+    await chmod2(keyPath, 384);
+    process.stderr.write(
+      "[keychain] WARNING: Key stored in plaintext file \u2014 no OS keychain available.\n"
+    );
+  }
 }
 async function deleteMasterKey() {
+  macKeychainDelete();
+  linuxSecretDelete();
   const keytar = await tryKeytar();
   if (keytar) {
     try {
@@ -3818,12 +3994,13 @@ async function importMnemonic(mnemonic) {
   const entropy = mnemonicToEntropy(trimmed);
   return Buffer.from(entropy, "hex");
 }
-var SERVICE, ACCOUNT;
+var SERVICE, ACCOUNT, ENCRYPTED_PREFIX;
 var init_keychain = __esm({
   "src/lib/keychain.ts"() {
     "use strict";
     SERVICE = "exe-mem";
     ACCOUNT = "master-key";
+    ENCRYPTED_PREFIX = "enc:";
   }
 });
 
@@ -4827,7 +5004,7 @@ __export(session_registry_exports, {
   registerSession: () => registerSession
 });
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync5, mkdirSync as mkdirSync3, existsSync as existsSync12 } from "fs";
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 import path12 from "path";
 import os7 from "os";
 function registerSession(entry) {
@@ -4867,7 +5044,7 @@ function pruneStaleSessions() {
   if (sessions.length === 0) return 0;
   let liveSessions = [];
   try {
-    liveSessions = execSync2("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
+    liveSessions = execSync3("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
       encoding: "utf8"
     }).trim().split("\n").filter(Boolean);
   } catch {
@@ -4890,7 +5067,7 @@ var init_session_registry = __esm({
 });
 
 // src/lib/session-key.ts
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 function normalizeCommand(command) {
   const trimmed = command.trim().toLowerCase();
   const parts = trimmed.split(/[\\/]/);
@@ -4909,7 +5086,7 @@ function resolveRuntimeProcess() {
   let pid = process.ppid;
   for (let i = 0; i < 10; i++) {
     try {
-      const info = execSync3(`ps -p ${pid} -o ppid=,comm=`, {
+      const info = execSync4(`ps -p ${pid} -o ppid=,comm=`, {
         encoding: "utf8",
         timeout: 2e3
       }).trim();
@@ -5083,14 +5260,14 @@ var init_transport = __esm({
 });
 
 // src/lib/cc-agent-support.ts
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 function _resetCcAgentSupportCache() {
   _cachedSupport = null;
 }
 function claudeSupportsAgentFlag() {
   if (_cachedSupport !== null) return _cachedSupport;
   try {
-    const helpOutput = execSync4("claude --help 2>&1", {
+    const helpOutput = execSync5("claude --help 2>&1", {
       encoding: "utf-8",
       timeout: 5e3
     });
@@ -5568,7 +5745,7 @@ var init_session_kill_telemetry = __esm({
 });
 
 // src/lib/project-name.ts
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync6 } from "child_process";
 import path17 from "path";
 function getProjectName(cwd) {
   const dir = cwd ?? process.cwd();
@@ -5576,7 +5753,7 @@ function getProjectName(cwd) {
   try {
     let repoRoot;
     try {
-      const gitCommonDir = execSync5("git rev-parse --path-format=absolute --git-common-dir", {
+      const gitCommonDir = execSync6("git rev-parse --path-format=absolute --git-common-dir", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -5584,7 +5761,7 @@ function getProjectName(cwd) {
       }).trim();
       repoRoot = path17.dirname(gitCommonDir);
     } catch {
-      repoRoot = execSync5("git rev-parse --show-toplevel", {
+      repoRoot = execSync6("git rev-parse --show-toplevel", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -5675,7 +5852,7 @@ var init_session_scope = __esm({
 import crypto5 from "crypto";
 import path18 from "path";
 import os11 from "os";
-import { execSync as execSync6 } from "child_process";
+import { execSync as execSync7 } from "child_process";
 import { mkdir as mkdir4, writeFile as writeFile4, appendFile } from "fs/promises";
 import { existsSync as existsSync17, readFileSync as readFileSync13 } from "fs";
 async function writeCheckpoint(input) {
@@ -6020,14 +6197,14 @@ function isTmuxSessionAlive(identifier) {
   if (!identifier || identifier === "unknown") return true;
   try {
     if (identifier.startsWith("%")) {
-      const output = execSync6("tmux list-panes -a -F '#{pane_id}'", {
+      const output = execSync7("tmux list-panes -a -F '#{pane_id}'", {
         timeout: 2e3,
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"]
       });
       return output.split("\n").some((l) => l.trim() === identifier);
     } else {
-      execSync6(`tmux has-session -t ${JSON.stringify(identifier)}`, {
+      execSync7(`tmux has-session -t ${JSON.stringify(identifier)}`, {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -6036,7 +6213,7 @@ function isTmuxSessionAlive(identifier) {
   } catch {
     if (identifier.startsWith("%")) return true;
     try {
-      execSync6("tmux list-sessions", {
+      execSync7("tmux list-sessions", {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -6051,12 +6228,12 @@ function checkStaleCompletion(taskContext, taskCreatedAt) {
   if (!DELEGATION_KEYWORDS.test(taskContext)) return null;
   try {
     const since = new Date(taskCreatedAt).toISOString();
-    const branch = execSync6(
+    const branch = execSync7(
       "git rev-parse --abbrev-ref HEAD 2>/dev/null",
       { encoding: "utf8", timeout: 3e3 }
     ).trim();
     const branchArg = branch && branch !== "HEAD" ? branch : "";
-    const commitCount = execSync6(
+    const commitCount = execSync7(
       `git log --oneline --since="${since}" ${branchArg} 2>/dev/null | wc -l`,
       { encoding: "utf8", timeout: 5e3 }
     ).trim();
@@ -6794,10 +6971,10 @@ async function disposeEmbedder() {
 async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync26 } = await import("fs");
-  const path31 = await import("path");
-  const modelPath = path31.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync26(modelPath)) {
+  const { existsSync: existsSync27 } = await import("fs");
+  const path32 = await import("path");
+  const modelPath = path32.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync27(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -7654,7 +7831,7 @@ __export(tmux_routing_exports, {
   spawnEmployee: () => spawnEmployee,
   verifyPaneAtCapacity: () => verifyPaneAtCapacity
 });
-import { execFileSync as execFileSync2, execSync as execSync7 } from "child_process";
+import { execFileSync as execFileSync2, execSync as execSync8 } from "child_process";
 import { readFileSync as readFileSync14, writeFileSync as writeFileSync9, mkdirSync as mkdirSync7, existsSync as existsSync19, appendFileSync as appendFileSync2, readdirSync as readdirSync4 } from "fs";
 import path22 from "path";
 import os12 from "os";
@@ -8364,7 +8541,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   let booted = false;
   for (let i = 0; i < 30; i++) {
     try {
-      execSync7("sleep 0.5");
+      execSync8("sleep 0.5");
     } catch {
     }
     try {
@@ -8484,7 +8661,7 @@ __export(review_polling_exports, {
   createRealDeps: () => createRealDeps,
   pollPendingReviews: () => pollPendingReviews
 });
-import { execSync as execSync8 } from "child_process";
+import { execSync as execSync9 } from "child_process";
 async function pollPendingReviews(deps, _state) {
   let sessions;
   try {
@@ -8591,7 +8768,7 @@ async function pollPendingReviews(deps, _state) {
 function createRealDeps(getClient2) {
   return {
     listTmuxSessions: () => {
-      return execSync8("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
+      return execSync9("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
         encoding: "utf8",
         timeout: 3e3
       }).trim().split("\n").filter(Boolean);
@@ -8698,13 +8875,13 @@ __export(tmux_status_exports, {
   parseActivity: () => parseActivity,
   parseContextPercentage: () => parseContextPercentage
 });
-import { execSync as execSync9 } from "child_process";
+import { execSync as execSync10 } from "child_process";
 function inTmux() {
   if (process.env.TMUX || process.env.TMUX_PANE) return true;
   const term = process.env.TERM ?? "";
   if (term.startsWith("tmux") || term.startsWith("screen")) return true;
   try {
-    execSync9("tmux display-message -p '#{session_name}' 2>/dev/null", {
+    execSync10("tmux display-message -p '#{session_name}' 2>/dev/null", {
       encoding: "utf8",
       timeout: 2e3
     });
@@ -8714,12 +8891,12 @@ function inTmux() {
   try {
     let pid = process.ppid;
     for (let depth = 0; depth < 8 && pid > 1; depth++) {
-      const comm = execSync9(`ps -p ${pid} -o comm= 2>/dev/null`, {
+      const comm = execSync10(`ps -p ${pid} -o comm= 2>/dev/null`, {
         encoding: "utf8",
         timeout: 1e3
       }).trim();
       if (/tmux/.test(comm)) return true;
-      const ppid = execSync9(`ps -p ${pid} -o ppid= 2>/dev/null`, {
+      const ppid = execSync10(`ps -p ${pid} -o ppid= 2>/dev/null`, {
         encoding: "utf8",
         timeout: 1e3
       }).trim();
@@ -8732,7 +8909,7 @@ function inTmux() {
 }
 function listTmuxSessions() {
   try {
-    const out = execSync9("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
+    const out = execSync10("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
       encoding: "utf8",
       timeout: 3e3
     });
@@ -8743,7 +8920,7 @@ function listTmuxSessions() {
 }
 function capturePaneLines(windowName, lines = 10) {
   try {
-    const out = execSync9(
+    const out = execSync10(
       `tmux capture-pane -t ${JSON.stringify(windowName)} -p 2>/dev/null | tail -${lines}`,
       { encoding: "utf8", timeout: 3e3 }
     );
@@ -8754,7 +8931,7 @@ function capturePaneLines(windowName, lines = 10) {
 }
 function getPaneCwd(windowName) {
   try {
-    const out = execSync9(
+    const out = execSync10(
       `tmux display-message -t ${JSON.stringify(windowName)} -p '#{pane_current_path}' 2>/dev/null`,
       { encoding: "utf8", timeout: 3e3 }
     );
@@ -8765,7 +8942,7 @@ function getPaneCwd(windowName) {
 }
 function projectFromPath(dir) {
   try {
-    const root = execSync9("git -C " + JSON.stringify(dir) + " rev-parse --show-toplevel 2>/dev/null", {
+    const root = execSync10("git -C " + JSON.stringify(dir) + " rev-parse --show-toplevel 2>/dev/null", {
       encoding: "utf8",
       timeout: 3e3
     }).trim();
@@ -8834,7 +9011,7 @@ function getEmployeeStatuses(employeeNames) {
     }
     let paneAlive = true;
     try {
-      const paneStatus = execSync9(
+      const paneStatus = execSync10(
         `tmux list-panes -t ${JSON.stringify(sessionName)} -F '#{pane_dead}' 2>/dev/null`,
         { encoding: "utf8", timeout: 3e3 }
       ).trim();
@@ -9080,7 +9257,7 @@ __export(daemon_orchestration_exports, {
   shouldKillSession: () => shouldKillSession,
   shouldNudgeEmployee: () => shouldNudgeEmployee
 });
-import { execSync as execSync10 } from "child_process";
+import { execSync as execSync11 } from "child_process";
 import { existsSync as existsSync21, readFileSync as readFileSync16, writeFileSync as writeFileSync10 } from "fs";
 import { homedir } from "os";
 import { join } from "path";
@@ -9398,7 +9575,7 @@ function createSessionTTLRealDeps(getClient2) {
     },
     getSessionCreatedEpoch: (sessionName) => {
       try {
-        const out = execSync10(
+        const out = execSync11(
           `tmux display-message -t ${JSON.stringify(sessionName)} -p '#{session_created}' 2>/dev/null`,
           { encoding: "utf8", timeout: 3e3 }
         ).trim();
@@ -9625,7 +9802,7 @@ function reapOrphanedMcpProcesses(deps) {
 function createOrphanReaperRealDeps() {
   return {
     listProcesses: () => {
-      const output = execSync10("ps -eo pid,ppid,args", {
+      const output = execSync11("ps -eo pid,ppid,args", {
         encoding: "utf8",
         timeout: 5e3
       });
@@ -10079,6 +10256,109 @@ var init_consolidation = __esm({
   }
 });
 
+// src/lib/db-backup.ts
+var db_backup_exports = {};
+__export(db_backup_exports, {
+  createBackup: () => createBackup,
+  findActiveDb: () => findActiveDb,
+  getBackupDir: () => getBackupDir,
+  getLatestBackup: () => getLatestBackup,
+  hasBackupToday: () => hasBackupToday,
+  listBackups: () => listBackups,
+  rotateBackups: () => rotateBackups
+});
+import { copyFileSync, existsSync as existsSync22, mkdirSync as mkdirSync8, readdirSync as readdirSync5, unlinkSync as unlinkSync8, statSync as statSync3 } from "fs";
+import path24 from "path";
+function findActiveDb() {
+  for (const name of DB_NAMES) {
+    const p = path24.join(EXE_AI_DIR, name);
+    if (existsSync22(p)) return p;
+  }
+  return null;
+}
+function createBackup(reason = "manual") {
+  const dbPath = findActiveDb();
+  if (!dbPath) return null;
+  mkdirSync8(BACKUP_DIR, { recursive: true });
+  const dbName = path24.basename(dbPath, ".db");
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
+  const backupName = `${dbName}-${reason}-${timestamp}.db`;
+  const backupPath = path24.join(BACKUP_DIR, backupName);
+  copyFileSync(dbPath, backupPath);
+  const walPath = dbPath + "-wal";
+  if (existsSync22(walPath)) {
+    try {
+      copyFileSync(walPath, backupPath + "-wal");
+    } catch {
+    }
+  }
+  const shmPath = dbPath + "-shm";
+  if (existsSync22(shmPath)) {
+    try {
+      copyFileSync(shmPath, backupPath + "-shm");
+    } catch {
+    }
+  }
+  return backupPath;
+}
+function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
+  if (!existsSync22(BACKUP_DIR)) return 0;
+  const cutoff = Date.now() - keepDays * 24 * 60 * 60 * 1e3;
+  let deleted = 0;
+  try {
+    const files = readdirSync5(BACKUP_DIR);
+    for (const file of files) {
+      if (!file.endsWith(".db") && !file.endsWith(".db-wal") && !file.endsWith(".db-shm")) continue;
+      const filePath = path24.join(BACKUP_DIR, file);
+      try {
+        const stat = statSync3(filePath);
+        if (stat.mtimeMs < cutoff) {
+          unlinkSync8(filePath);
+          deleted++;
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return deleted;
+}
+function listBackups() {
+  if (!existsSync22(BACKUP_DIR)) return [];
+  try {
+    const files = readdirSync5(BACKUP_DIR).filter((f) => f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm"));
+    return files.map((name) => {
+      const p = path24.join(BACKUP_DIR, name);
+      const stat = statSync3(p);
+      return { path: p, name, size: stat.size, date: stat.mtime };
+    }).sort((a, b) => b.date.getTime() - a.date.getTime());
+  } catch {
+    return [];
+  }
+}
+function hasBackupToday(reason) {
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const backups = listBackups();
+  return backups.some((b) => b.name.includes(reason) && b.name.includes(today.replace(/-/g, "-")));
+}
+function getLatestBackup() {
+  const backups = listBackups();
+  return backups.length > 0 ? backups[0].path : null;
+}
+function getBackupDir() {
+  return BACKUP_DIR;
+}
+var BACKUP_DIR, DEFAULT_KEEP_DAYS, DB_NAMES;
+var init_db_backup = __esm({
+  "src/lib/db-backup.ts"() {
+    "use strict";
+    init_config();
+    BACKUP_DIR = path24.join(EXE_AI_DIR, "backups");
+    DEFAULT_KEEP_DAYS = 3;
+    DB_NAMES = ["memories.db", "exe-mem.db", "exe-os.db", "exe.db"];
+  }
+});
+
 // src/lib/crypto.ts
 import crypto8 from "crypto";
 function initSyncCrypto(masterKey) {
@@ -10170,8 +10450,8 @@ __export(crdt_sync_exports, {
   rebuildFromDb: () => rebuildFromDb
 });
 import * as Y from "yjs";
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync11, existsSync as existsSync22, mkdirSync as mkdirSync8, unlinkSync as unlinkSync8 } from "fs";
-import path24 from "path";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync11, existsSync as existsSync23, mkdirSync as mkdirSync9, unlinkSync as unlinkSync9 } from "fs";
+import path25 from "path";
 import { homedir as homedir2 } from "os";
 function getStatePath() {
   return _statePathOverride ?? DEFAULT_STATE_PATH;
@@ -10183,14 +10463,14 @@ function initCrdtDoc() {
   if (doc) return doc;
   doc = new Y.Doc();
   const sp = getStatePath();
-  if (existsSync22(sp)) {
+  if (existsSync23(sp)) {
     try {
       const state = readFileSync17(sp);
       Y.applyUpdate(doc, new Uint8Array(state));
     } catch {
       console.warn("[crdt-sync] WARN: corrupted state file, rebuilding from DB");
       try {
-        unlinkSync8(sp);
+        unlinkSync9(sp);
       } catch {
       }
       rebuildFromDb().catch((err) => {
@@ -10327,8 +10607,8 @@ function persistState() {
   if (!doc) return;
   try {
     const sp = getStatePath();
-    const dir = path24.dirname(sp);
-    if (!existsSync22(dir)) mkdirSync8(dir, { recursive: true });
+    const dir = path25.dirname(sp);
+    if (!existsSync23(dir)) mkdirSync9(dir, { recursive: true });
     const state = Y.encodeStateAsUpdate(doc);
     writeFileSync11(sp, Buffer.from(state));
   } catch {
@@ -10371,7 +10651,7 @@ var DEFAULT_STATE_PATH, _statePathOverride, doc;
 var init_crdt_sync = __esm({
   "src/lib/crdt-sync.ts"() {
     "use strict";
-    DEFAULT_STATE_PATH = path24.join(homedir2(), ".exe-os", "crdt-state.bin");
+    DEFAULT_STATE_PATH = path25.join(homedir2(), ".exe-os", "crdt-state.bin");
     _statePathOverride = null;
     doc = null;
   }
@@ -10406,16 +10686,16 @@ __export(cloud_sync_exports, {
   pushToPostgres: () => pushToPostgres,
   recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync12, existsSync as existsSync23, readdirSync as readdirSync5, mkdirSync as mkdirSync9, appendFileSync as appendFileSync3, unlinkSync as unlinkSync9, openSync as openSync2, closeSync as closeSync2 } from "fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync12, existsSync as existsSync24, readdirSync as readdirSync6, mkdirSync as mkdirSync10, appendFileSync as appendFileSync3, unlinkSync as unlinkSync10, openSync as openSync2, closeSync as closeSync2 } from "fs";
 import crypto9 from "crypto";
-import path25 from "path";
+import path26 from "path";
 import { homedir as homedir3 } from "os";
 function sqlSafe(v) {
   return v === void 0 ? null : v;
 }
 function logError(msg) {
   try {
-    const logPath = path25.join(homedir3(), ".exe-os", "workers.log");
+    const logPath = path26.join(homedir3(), ".exe-os", "workers.log");
     appendFileSync3(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
@@ -10424,10 +10704,10 @@ function logError(msg) {
 function loadPgClient() {
   if (_pgFailed) return null;
   const postgresUrl = process.env.DATABASE_URL;
-  const configPath = path25.join(EXE_AI_DIR, "config.json");
+  const configPath = path26.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
   try {
-    if (existsSync23(configPath)) {
+    if (existsSync24(configPath)) {
       const cfg = JSON.parse(readFileSync18(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
       if (cfg.cloud?.syncToPostgres === false) {
@@ -10446,8 +10726,8 @@ function loadPgClient() {
     _pgPromise = (async () => {
       const { createRequire: createRequire4 } = await import("module");
       const { pathToFileURL: pathToFileURL4 } = await import("url");
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path25.join(homedir3(), "exe-db");
-      const req = createRequire4(path25.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path26.join(homedir3(), "exe-db");
+      const req = createRequire4(path26.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
       const mod = await import(pathToFileURL4(entry).href);
       const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
@@ -10500,7 +10780,7 @@ async function withRosterLock(fn) {
         if (Date.now() - ts2 < LOCK_STALE_MS) {
           throw new Error("Roster merge already in progress \u2014 another sync is running");
         }
-        unlinkSync9(ROSTER_LOCK_PATH);
+        unlinkSync10(ROSTER_LOCK_PATH);
         const fd = openSync2(ROSTER_LOCK_PATH, "wx");
         closeSync2(fd);
         writeFileSync12(ROSTER_LOCK_PATH, String(Date.now()));
@@ -10516,7 +10796,7 @@ async function withRosterLock(fn) {
     return await fn();
   } finally {
     try {
-      unlinkSync9(ROSTER_LOCK_PATH);
+      unlinkSync10(ROSTER_LOCK_PATH);
     } catch {
     }
   }
@@ -10887,13 +11167,42 @@ async function cloudSync(config) {
   try {
     const employees = await loadEmployees();
     rosterResult.employees = employees.length;
-    const idDir = path25.join(EXE_AI_DIR, "identity");
-    if (existsSync23(idDir)) {
-      rosterResult.identities = readdirSync5(idDir).filter((f) => f.endsWith(".md")).length;
+    const idDir = path26.join(EXE_AI_DIR, "identity");
+    if (existsSync24(idDir)) {
+      rosterResult.identities = readdirSync6(idDir).filter((f) => f.endsWith(".md")).length;
     }
   } catch {
   }
   const totalMemories = await countRows("SELECT COUNT(*) as cnt FROM memories WHERE status = 'active' OR status IS NULL");
+  try {
+    const { getLatestBackup: getLatestBackup2 } = await Promise.resolve().then(() => (init_db_backup(), db_backup_exports));
+    const { statSync: statFile } = await import("fs");
+    const latestBackup = getLatestBackup2();
+    if (latestBackup) {
+      const backupSize = statFile(latestBackup).size;
+      const MAX_CLOUD_BACKUP_BYTES = 50 * 1024 * 1024;
+      if (backupSize <= MAX_CLOUD_BACKUP_BYTES) {
+        const backupData = readFileSync18(latestBackup);
+        const deviceId = loadDeviceId() ?? "unknown";
+        const encrypted = encryptSyncBlob(backupData);
+        const backupRes = await fetchWithRetry(`${config.endpoint}/sync/push-db-backup`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${config.apiKey}` },
+          body: JSON.stringify({
+            device_id: deviceId,
+            filename: path26.basename(latestBackup),
+            blob: encrypted,
+            size: backupData.length
+          })
+        });
+        if (backupRes && !backupRes.ok) {
+          logError(`[cloud-sync] DB backup upload failed: ${backupRes.status}`);
+        }
+      }
+    }
+  } catch (err) {
+    logError(`[cloud-sync] DB backup upload error: ${err instanceof Error ? err.message : String(err)}`);
+  }
   return {
     pushed,
     pulled,
@@ -10909,7 +11218,7 @@ async function cloudSync(config) {
 function recordRosterDeletion(name) {
   let deletions = [];
   try {
-    if (existsSync23(ROSTER_DELETIONS_PATH)) {
+    if (existsSync24(ROSTER_DELETIONS_PATH)) {
       deletions = JSON.parse(readFileSync18(ROSTER_DELETIONS_PATH, "utf-8"));
     }
   } catch {
@@ -10919,7 +11228,7 @@ function recordRosterDeletion(name) {
 }
 function consumeRosterDeletions() {
   try {
-    if (!existsSync23(ROSTER_DELETIONS_PATH)) return [];
+    if (!existsSync24(ROSTER_DELETIONS_PATH)) return [];
     const deletions = JSON.parse(readFileSync18(ROSTER_DELETIONS_PATH, "utf-8"));
     writeFileSync12(ROSTER_DELETIONS_PATH, "[]");
     return deletions;
@@ -10928,35 +11237,35 @@ function consumeRosterDeletions() {
   }
 }
 function buildRosterBlob(paths) {
-  const rosterPath = paths?.rosterPath ?? path25.join(EXE_AI_DIR, "exe-employees.json");
-  const identityDir = paths?.identityDir ?? path25.join(EXE_AI_DIR, "identity");
-  const configPath = paths?.configPath ?? path25.join(EXE_AI_DIR, "config.json");
+  const rosterPath = paths?.rosterPath ?? path26.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path26.join(EXE_AI_DIR, "identity");
+  const configPath = paths?.configPath ?? path26.join(EXE_AI_DIR, "config.json");
   let roster = [];
-  if (existsSync23(rosterPath)) {
+  if (existsSync24(rosterPath)) {
     try {
       roster = JSON.parse(readFileSync18(rosterPath, "utf-8"));
     } catch {
     }
   }
   const identities = {};
-  if (existsSync23(identityDir)) {
-    for (const file of readdirSync5(identityDir).filter((f) => f.endsWith(".md"))) {
+  if (existsSync24(identityDir)) {
+    for (const file of readdirSync6(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
-        identities[file] = readFileSync18(path25.join(identityDir, file), "utf-8");
+        identities[file] = readFileSync18(path26.join(identityDir, file), "utf-8");
       } catch {
       }
     }
   }
   let config;
-  if (existsSync23(configPath)) {
+  if (existsSync24(configPath)) {
     try {
       config = JSON.parse(readFileSync18(configPath, "utf-8"));
     } catch {
     }
   }
   let agentConfig;
-  const agentConfigPath = path25.join(EXE_AI_DIR, "agent-config.json");
-  if (existsSync23(agentConfigPath)) {
+  const agentConfigPath = path26.join(EXE_AI_DIR, "agent-config.json");
+  if (existsSync24(agentConfigPath)) {
     try {
       agentConfig = JSON.parse(readFileSync18(agentConfigPath, "utf-8"));
     } catch {
@@ -11034,16 +11343,16 @@ async function cloudPullRoster(config) {
   }
 }
 function mergeConfig(remoteConfig, configPath) {
-  const cfgPath = configPath ?? path25.join(EXE_AI_DIR, "config.json");
+  const cfgPath = configPath ?? path26.join(EXE_AI_DIR, "config.json");
   let local = {};
-  if (existsSync23(cfgPath)) {
+  if (existsSync24(cfgPath)) {
     try {
       local = JSON.parse(readFileSync18(cfgPath, "utf-8"));
     } catch {
     }
   }
   const merged = { ...remoteConfig, ...local };
-  const dir = path25.dirname(cfgPath);
+  const dir = path26.dirname(cfgPath);
   ensurePrivateDirSync(dir);
   writeFileSync12(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
   enforcePrivateFileSync(cfgPath);
@@ -11051,7 +11360,7 @@ function mergeConfig(remoteConfig, configPath) {
 async function mergeRosterFromRemote(remote, paths) {
   return withRosterLock(async () => {
     const rosterPath = paths?.rosterPath ?? void 0;
-    const identityDir = paths?.identityDir ?? path25.join(EXE_AI_DIR, "identity");
+    const identityDir = paths?.identityDir ?? path26.join(EXE_AI_DIR, "identity");
     const localEmployees = await loadEmployees(rosterPath);
     const localNames = new Set(localEmployees.map((e) => e.name));
     let added = 0;
@@ -11072,11 +11381,11 @@ async function mergeRosterFromRemote(remote, paths) {
       ) ?? lookupKey;
       const remoteIdentity = remote.identities[matchedKey];
       if (remoteIdentity) {
-        if (!existsSync23(identityDir)) mkdirSync9(identityDir, { recursive: true });
-        const idPath = path25.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync24(identityDir)) mkdirSync10(identityDir, { recursive: true });
+        const idPath = path26.join(identityDir, `${remoteEmp.name}.md`);
         let localIdentity = null;
         try {
-          localIdentity = existsSync23(idPath) ? readFileSync18(idPath, "utf-8") : null;
+          localIdentity = existsSync24(idPath) ? readFileSync18(idPath, "utf-8") : null;
         } catch {
         }
         if (localIdentity !== remoteIdentity) {
@@ -11106,16 +11415,16 @@ async function mergeRosterFromRemote(remote, paths) {
     }
     if (remote.agentConfig && Object.keys(remote.agentConfig).length > 0) {
       try {
-        const agentConfigPath = path25.join(EXE_AI_DIR, "agent-config.json");
+        const agentConfigPath = path26.join(EXE_AI_DIR, "agent-config.json");
         let local = {};
-        if (existsSync23(agentConfigPath)) {
+        if (existsSync24(agentConfigPath)) {
           try {
             local = JSON.parse(readFileSync18(agentConfigPath, "utf-8"));
           } catch {
           }
         }
         const merged = { ...remote.agentConfig, ...local };
-        ensurePrivateDirSync(path25.dirname(agentConfigPath));
+        ensurePrivateDirSync(path26.dirname(agentConfigPath));
         writeFileSync12(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
         enforcePrivateFileSync(agentConfigPath);
       } catch {
@@ -11556,11 +11865,11 @@ var init_cloud_sync = __esm({
     LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
     FETCH_TIMEOUT_MS = 3e4;
     PUSH_BATCH_SIZE = 5e3;
-    ROSTER_LOCK_PATH = path25.join(EXE_AI_DIR, "roster-merge.lock");
+    ROSTER_LOCK_PATH = path26.join(EXE_AI_DIR, "roster-merge.lock");
     LOCK_STALE_MS = 3e4;
     _pgPromise = null;
     _pgFailed = false;
-    ROSTER_DELETIONS_PATH = path25.join(EXE_AI_DIR, "roster-deletions.json");
+    ROSTER_DELETIONS_PATH = path26.join(EXE_AI_DIR, "roster-deletions.json");
   }
 });
 
@@ -12259,7 +12568,7 @@ __export(token_spend_exports, {
 import { readdir } from "fs/promises";
 import { createReadStream } from "fs";
 import { createInterface } from "readline";
-import path26 from "path";
+import path27 from "path";
 import os14 from "os";
 function getPricing(model) {
   if (MODEL_PRICING[model]) return MODEL_PRICING[model];
@@ -12287,18 +12596,18 @@ async function getAgentSpend(period = "7d") {
   for (const row of dbResult.rows) {
     sessionAgent.set(row.session_uuid, row.agent_id);
   }
-  const claudeDir = path26.join(os14.homedir(), ".claude", "projects");
+  const claudeDir = path27.join(os14.homedir(), ".claude", "projects");
   let projectDirs = [];
   try {
     const entries = await readdir(claudeDir);
-    projectDirs = entries.map((e) => path26.join(claudeDir, e));
+    projectDirs = entries.map((e) => path27.join(claudeDir, e));
   } catch {
     return [];
   }
   const agentTotals = /* @__PURE__ */ new Map();
   for (const [sessionUuid, agentId] of sessionAgent) {
     for (const dir of projectDirs) {
-      const jsonlPath = path26.join(dir, `${sessionUuid}.jsonl`);
+      const jsonlPath = path27.join(dir, `${sessionUuid}.jsonl`);
       try {
         const usage = await extractSessionUsage(jsonlPath);
         if (usage.input === 0 && usage.output === 0) continue;
@@ -12431,7 +12740,7 @@ __export(task_enforcement_exports, {
   sendNudge: () => sendNudge
 });
 import { writeFileSync as writeFileSync13 } from "fs";
-import path27 from "path";
+import path28 from "path";
 function writeAuditEntry(entry) {
   try {
     const line = JSON.stringify(entry) + "\n";
@@ -12606,7 +12915,7 @@ var init_task_enforcement = __esm({
       "What do you need?"
     ];
     MANAGER_ROLES = ["COO", "CTO"];
-    AUDIT_LOG_PATH = path27.join(
+    AUDIT_LOG_PATH = path28.join(
       process.env.HOME ?? process.env.USERPROFILE ?? "/tmp",
       ".exe-os",
       "enforcement-audit.jsonl"
@@ -12622,17 +12931,17 @@ __export(update_check_exports, {
   getLocalVersion: () => getLocalVersion,
   getRemoteVersion: () => getRemoteVersion
 });
-import { execSync as execSync11 } from "child_process";
+import { execSync as execSync12 } from "child_process";
 import { readFileSync as readFileSync19 } from "fs";
-import path28 from "path";
+import path29 from "path";
 function getLocalVersion(packageRoot) {
-  const pkgPath = path28.join(packageRoot, "package.json");
+  const pkgPath = path29.join(packageRoot, "package.json");
   const pkg = JSON.parse(readFileSync19(pkgPath, "utf-8"));
   return pkg.version;
 }
 function getRemoteVersion() {
   try {
-    const output = execSync11("npm view @askexenow/exe-os version", {
+    const output = execSync12("npm view @askexenow/exe-os version", {
       encoding: "utf-8",
       timeout: 15e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -12699,10 +13008,10 @@ __export(device_registry_exports, {
 });
 import crypto12 from "crypto";
 import os15 from "os";
-import { readFileSync as readFileSync20, writeFileSync as writeFileSync14, mkdirSync as mkdirSync10, existsSync as existsSync24 } from "fs";
-import path29 from "path";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync14, mkdirSync as mkdirSync11, existsSync as existsSync25 } from "fs";
+import path30 from "path";
 function getDeviceInfo() {
-  if (existsSync24(DEVICE_JSON_PATH)) {
+  if (existsSync25(DEVICE_JSON_PATH)) {
     try {
       const raw = readFileSync20(DEVICE_JSON_PATH, "utf8");
       const data = JSON.parse(raw);
@@ -12718,7 +13027,7 @@ function getDeviceInfo() {
     friendlyName: hostname.replace(/\./g, "-").toLowerCase(),
     hostname
   };
-  mkdirSync10(path29.dirname(DEVICE_JSON_PATH), { recursive: true });
+  mkdirSync11(path30.dirname(DEVICE_JSON_PATH), { recursive: true });
   writeFileSync14(DEVICE_JSON_PATH, JSON.stringify(info, null, 2));
   return info;
 }
@@ -12759,7 +13068,7 @@ var init_device_registry = __esm({
   "src/lib/device-registry.ts"() {
     "use strict";
     init_config();
-    DEVICE_JSON_PATH = path29.join(EXE_AI_DIR, "device.json");
+    DEVICE_JSON_PATH = path30.join(EXE_AI_DIR, "device.json");
   }
 });
 
@@ -13246,8 +13555,8 @@ init_daemon_protocol();
 init_daemon_auth();
 import os16 from "os";
 import net2 from "net";
-import { writeFileSync as writeFileSync15, unlinkSync as unlinkSync10, mkdirSync as mkdirSync11, existsSync as existsSync25, readFileSync as readFileSync21, chmodSync as chmodSync2 } from "fs";
-import path30 from "path";
+import { writeFileSync as writeFileSync15, unlinkSync as unlinkSync11, mkdirSync as mkdirSync12, existsSync as existsSync26, readFileSync as readFileSync21, chmodSync as chmodSync2 } from "fs";
+import path31 from "path";
 import { getLlama } from "node-llama-cpp";
 
 // src/lib/orchestration-metrics.ts
@@ -13319,8 +13628,8 @@ function initMetrics() {
 }
 
 // src/lib/exe-daemon.ts
-var SOCKET_PATH2 = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path30.join(EXE_AI_DIR, "exed.sock");
-var PID_PATH2 = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path30.join(EXE_AI_DIR, "exed.pid");
+var SOCKET_PATH2 = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path31.join(EXE_AI_DIR, "exed.sock");
+var PID_PATH2 = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path31.join(EXE_AI_DIR, "exed.pid");
 var MODEL_FILE = "jina-embeddings-v5-small-q4_k_m.gguf";
 var IDLE_TIMEOUT_MS = 15 * 60 * 1e3;
 var REVIEW_POLL_INTERVAL_MS = 60 * 1e3;
@@ -13348,8 +13657,8 @@ function enqueue(queue, entry) {
   queue.push(entry);
 }
 async function loadModel() {
-  const modelPath = path30.join(MODELS_DIR, MODEL_FILE);
-  if (!existsSync25(modelPath)) {
+  const modelPath = path31.join(MODELS_DIR, MODEL_FILE);
+  if (!existsSync26(modelPath)) {
     process.stderr.write(`[exed] FATAL: model not found at ${modelPath}
 `);
     process.exit(1);
@@ -13446,11 +13755,11 @@ async function shutdown() {
   }
   _llama = null;
   try {
-    unlinkSync10(SOCKET_PATH2);
+    unlinkSync11(SOCKET_PATH2);
   } catch {
   }
   try {
-    unlinkSync10(PID_PATH2);
+    unlinkSync11(PID_PATH2);
   } catch {
   }
   process.stderr.write("[exed] Shutdown complete.\n");
@@ -13704,14 +14013,14 @@ function startMemoryQueueDrain() {
 `);
 }
 function startServer() {
-  mkdirSync11(path30.dirname(SOCKET_PATH2), { recursive: true });
+  mkdirSync12(path31.dirname(SOCKET_PATH2), { recursive: true });
   try {
-    chmodSync2(path30.dirname(SOCKET_PATH2), 448);
+    chmodSync2(path31.dirname(SOCKET_PATH2), 448);
   } catch {
   }
   _daemonToken = ensureDaemonToken(process.env[DAEMON_TOKEN_ENV2] ?? null);
   for (const oldFile of ["embed.sock", "embed.pid"]) {
-    const oldPath = path30.join(path30.dirname(SOCKET_PATH2), oldFile);
+    const oldPath = path31.join(path31.dirname(SOCKET_PATH2), oldFile);
     try {
       if (oldFile.endsWith(".pid")) {
         const pid = parseInt(readFileSync21(oldPath, "utf8").trim(), 10);
@@ -13720,12 +14029,12 @@ function startServer() {
         } catch {
         }
       }
-      unlinkSync10(oldPath);
+      unlinkSync11(oldPath);
     } catch {
     }
   }
   try {
-    unlinkSync10(SOCKET_PATH2);
+    unlinkSync11(SOCKET_PATH2);
   } catch {
   }
   const server = net2.createServer((socket) => {
@@ -13972,6 +14281,11 @@ function startConsolidation() {
         embedFn = embed2;
       } catch {
       }
+      try {
+        const { createBackup: createBackup2 } = await Promise.resolve().then(() => (init_db_backup(), db_backup_exports));
+        createBackup2("pre-consolidation");
+      } catch {
+      }
       process.stderr.write(`[exed] Starting consolidation (${count} unconsolidated memories)...
 `);
       const result = await runConsolidation2(client, {
@@ -14094,7 +14408,7 @@ function startGraphExtraction() {
 `);
 }
 var AGENT_STATS_INTERVAL_MS = 60 * 1e3;
-var AGENT_STATS_PATH = path30.join(EXE_AI_DIR, "agent-stats.json");
+var AGENT_STATS_PATH = path31.join(EXE_AI_DIR, "agent-stats.json");
 async function writeAgentStats() {
   fired("agent_stats");
   if (!await ensureStoreForPolling()) return;
@@ -14199,6 +14513,33 @@ function startConfidenceDecay() {
   process.stderr.write(`[exed] Confidence decay started (every 24h)
 `);
 }
+var DB_BACKUP_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+function startDatabaseBackup() {
+  const tick = () => {
+    fired("db_backup");
+    try {
+      const { createBackup: createBackup2, rotateBackups: rotateBackups2, hasBackupToday: hasBackupToday2 } = (init_db_backup(), __toCommonJS(db_backup_exports));
+      if (hasBackupToday2("daily")) return;
+      const backupPath = createBackup2("daily");
+      if (backupPath) {
+        acted("db_backup");
+        const deleted = rotateBackups2();
+        process.stderr.write(
+          `[exed] DB backup: ${backupPath.split("/").pop()}${deleted > 0 ? ` (rotated ${deleted} old)` : ""}
+`
+        );
+      }
+    } catch (err) {
+      process.stderr.write(`[exed] DB backup error: ${err instanceof Error ? err.message : String(err)}
+`);
+    }
+  };
+  tick();
+  const timer = setInterval(tick, DB_BACKUP_INTERVAL_MS);
+  timer.unref();
+  process.stderr.write(`[exed] Database backup started (daily, keep 3 days)
+`);
+}
 var QUEUE_DRAIN_INTERVAL_MS = 15e3;
 function startIntercomQueueDrain() {
   const tick = () => {
@@ -14209,12 +14550,12 @@ function startIntercomQueueDrain() {
       const hasInProgressTask = (session) => {
         try {
           const { baseAgentName: ban } = (init_employees(), __toCommonJS(employees_exports));
-          const path31 = __require("path");
-          const { existsSync: existsSync26 } = __require("fs");
+          const path32 = __require("path");
+          const { existsSync: existsSync27 } = __require("fs");
           const os17 = __require("os");
           const agent = ban(session.split("-")[0] ?? session);
-          const markerPath = path31.join(os17.homedir(), ".exe-os", "session-cache", `current-task-${agent}.json`);
-          return existsSync26(markerPath);
+          const markerPath = path32.join(os17.homedir(), ".exe-os", "session-cache", `current-task-${agent}.json`);
+          return existsSync27(markerPath);
         } catch {
           return false;
         }
@@ -14378,7 +14719,7 @@ process.on("SIGINT", () => void shutdown());
 process.on("SIGTERM", () => void shutdown());
 function checkExistingDaemon() {
   try {
-    if (!existsSync25(PID_PATH2)) return false;
+    if (!existsSync26(PID_PATH2)) return false;
     const pid = parseInt(readFileSync21(PID_PATH2, "utf8").trim(), 10);
     if (!pid || isNaN(pid)) return false;
     process.kill(pid, 0);
@@ -14392,7 +14733,7 @@ function checkExistingDaemon() {
       return true;
     }
     try {
-      unlinkSync10(PID_PATH2);
+      unlinkSync11(PID_PATH2);
     } catch {
     }
     return false;
@@ -14417,8 +14758,8 @@ function startAutoUpdateCheck() {
       );
       if (autoInstall) {
         process.stderr.write("[exed] Auto-installing update...\n");
-        const { execSync: execSync12 } = await import("child_process");
-        execSync12("npm install -g @askexenow/exe-os@latest", {
+        const { execSync: execSync13 } = await import("child_process");
+        execSync13("npm install -g @askexenow/exe-os@latest", {
           timeout: 12e4,
           stdio: ["pipe", "pipe", "pipe"]
         });
@@ -14472,6 +14813,7 @@ try {
   startMemoryQueueDrain();
   startIntercomQueueDrain();
   startConfidenceDecay();
+  startDatabaseBackup();
   startAutoUpdateCheck();
   startRssWatchdog();
   startTaskEnforcementScanner();
@@ -14570,11 +14912,11 @@ try {
   process.stderr.write(`[exed] FATAL: ${err instanceof Error ? err.message : String(err)}
 `);
   try {
-    unlinkSync10(SOCKET_PATH2);
+    unlinkSync11(SOCKET_PATH2);
   } catch {
   }
   try {
-    unlinkSync10(PID_PATH2);
+    unlinkSync11(PID_PATH2);
   } catch {
   }
   process.exit(1);