@askexenow/exe-os 0.9.335 → 0.9.338

package/dist/{chunk-XA753DUQ.js → chunk-N5I7RL3I.js}

@@ -119,7 +119,7 @@ function releaseBackfillLock() {
 }
 async function getTaskAwareCapacity() {
   const { getClient } = await import("./lib/database.js");
-  const { sessionScopeFilter } = await import("./task-scope-7BWIG4G3.js");
+  const { sessionScopeFilter } = await import("./task-scope-CQEG5SSJ.js");
   const client = getClient();
   const scope = sessionScopeFilter();
   const result = await client.execute({

package/dist/{chunk-YYKY45TM.js → chunk-OFX5B2S7.js}

@@ -1,6 +1,6 @@
 import {
   loadEmployees
-} from "./chunk-BIM763ML.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/lib/agent-symlinks.ts
 import os from "os";

package/dist/{chunk-H5C4PS64.js → chunk-OJTJYEMX.js}

@@ -1,9 +1,9 @@
 import {
   fastDbInit
-} from "./chunk-OMJH4DQ7.js";
+} from "./chunk-UFAXZ2PY.js";
 import {
   sessionScopeFilter
-} from "./chunk-X3VIRILN.js";
+} from "./chunk-PLRIJALF.js";
 import {
   formatStatusAll,
   formatStatusDeep,
@@ -14,7 +14,7 @@ import {
   getClient,
   isCoordinatorRole,
   loadEmployees
-} from "./chunk-BIM763ML.js";
+} from "./chunk-HEPR6QTL.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";

package/dist/{chunk-5EP4TCZ2.js → chunk-PAEXYFMY.js}

@@ -1,6 +1,6 @@
 import {
   completeReminder
-} from "./chunk-IJTCNN5I.js";
+} from "./chunk-KMBEL7VB.js";
 
 // src/mcp/tools/complete-reminder.ts
 import { z } from "zod";

package/dist/{chunk-X3VIRILN.js → chunk-PLRIJALF.js}

@@ -1,14 +1,18 @@
 import {
   ensureAgentSymlink
-} from "./chunk-YYKY45TM.js";
+} from "./chunk-OFX5B2S7.js";
 import {
   ensureWorktree,
   getGitRoot,
   isWorktreeDirty
-} from "./chunk-UWT664G5.js";
+} from "./chunk-B76TSEP3.js";
 import {
   incrementSkillSuccess
-} from "./chunk-45AA4HOH.js";
+} from "./chunk-RLRT2BVM.js";
+import {
+  buildTaskResult,
+  serializeMessage
+} from "./chunk-4JERP7NT.js";
 import {
   reviewSignalPath,
   taskSignalDir
@@ -17,14 +21,10 @@ import {
   LEASE_MINUTES,
   leaseExpiryIso
 } from "./chunk-E23LNUWJ.js";
-import {
-  buildTaskResult,
-  serializeMessage
-} from "./chunk-4JERP7NT.js";
 import {
   listSessions,
   registerSession
-} from "./chunk-3HMHSTHQ.js";
+} from "./chunk-UIV2WPBT.js";
 import {
   listTmuxSessions
 } from "./chunk-SSTLTIF3.js";
@@ -33,20 +33,20 @@ import {
 } from "./chunk-RMOBQ6A5.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-AREY6CD2.js";
+} from "./chunk-FUIIVSW6.js";
 import {
   assertRuntimeModelCompatible,
   getAgentRuntime,
   normalizeCcModelName,
   resolveSpawnRuntimeConfig
-} from "./chunk-HDZF7FQF.js";
+} from "./chunk-65SVQELL.js";
 import {
   RUNTIME_TABLE
 } from "./chunk-NGP6LSV2.js";
 import {
   PlanLimitError,
   assertEmployeeLimitSync
-} from "./chunk-7QFR2QUD.js";
+} from "./chunk-MW2GJJ53.js";
 import {
   getSessionKey
 } from "./chunk-CVYC6DUW.js";
@@ -74,10 +74,10 @@ import {
   loadEmployees,
   loadEmployeesSync,
   offloadReadIfMain
-} from "./chunk-BIM763ML.js";
+} from "./chunk-HEPR6QTL.js";
 import {
   loadDeviceId
-} from "./chunk-DTFFLCFM.js";
+} from "./chunk-XACL67CS.js";
 import {
   EXE_AI_DIR
 } from "./chunk-7Y5UDEVM.js";
@@ -555,6 +555,80 @@ function drainQueue(isSessionBusy2, sendKeys, notifyExpiry = notifyExpiredInterc
   }
   return { drained, failed };
 }
+async function drainQueueAsync(isSessionBusy2, sendKeys, notifyExpiry = notifyExpiredIntercom, yieldEvery = 10) {
+  if (_draining) {
+    logQueue("SKIP_DRAIN \u2014 previous drain still running (possible tmux hang)");
+    return { drained: 0, failed: 0 };
+  }
+  _draining = true;
+  const remaining = [];
+  let drained = 0;
+  let failed = 0;
+  let lockAcquired = false;
+  try {
+    lockAcquired = acquireQueueLock();
+    if (!lockAcquired) return { drained: 0, failed: 0 };
+    const queue = readQueue();
+    if (queue.length === 0) return { drained: 0, failed: 0 };
+    const snapshotTargets = new Set(queue.map((q) => q.targetSession));
+    let processed = 0;
+    for (const item of queue) {
+      if (processed > 0 && processed % yieldEvery === 0) {
+        await new Promise((resolve) => setImmediate(resolve));
+      }
+      processed++;
+      const age = Date.now() - new Date(item.queuedAt).getTime();
+      if (age > TTL_MS) {
+        logQueue(`EXPIRED \u2192 ${item.targetSession} (${Math.round(age / 6e4)}min old, reason: ${item.reason})`);
+        try {
+          notifyExpiry(item);
+        } catch (err) {
+          logQueue(`EXPIRY_NOTIFY_FAILED \u2192 ${item.targetSession}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        failed++;
+        continue;
+      }
+      try {
+        if (!await isSessionBusy2(item.targetSession)) {
+          const success = await sendKeys(item.targetSession, item);
+          if (success) {
+            logQueue(`DRAINED \u2192 ${item.targetSession} (after ${item.attempts} retries)`);
+            drained++;
+            continue;
+          }
+        }
+      } catch {
+      }
+      item.attempts++;
+      if (item.attempts >= MAX_RETRIES) {
+        logQueue(`PENDING \u2192 ${item.targetSession} (${MAX_RETRIES} retries exhausted, keeping queued, reason: ${item.reason})`);
+        item.attempts = MAX_RETRIES;
+        remaining.push(item);
+        failed++;
+        continue;
+      }
+      remaining.push(item);
+    }
+    const merged = remaining;
+    const mergedTargets = new Set(merged.map((r) => r.targetSession));
+    let preserved = 0;
+    for (const item of readQueue()) {
+      if (!snapshotTargets.has(item.targetSession) && !mergedTargets.has(item.targetSession)) {
+        merged.push(item);
+        mergedTargets.add(item.targetSession);
+        preserved++;
+      }
+    }
+    if (preserved > 0) {
+      logQueue(`MERGED ${preserved} intercom(s) enqueued mid-drain (preserved from clobber)`);
+    }
+    writeQueue(merged);
+  } finally {
+    if (lockAcquired) releaseQueueLock();
+    _draining = false;
+  }
+  return { drained, failed };
+}
 function drainForSession(targetSession, sendKeys) {
   if (!acquireQueueLock()) return false;
   try {
@@ -1219,7 +1293,7 @@ async function createTaskCore(input) {
         if (isCoordinatorSession) {
           earlySessionScope = resolved;
         } else {
-          const { getSessionProject } = await import("./session-scope-RMKL6YLU.js");
+          const { getSessionProject } = await import("./session-scope-CFHVSVAQ.js");
           const sessionProject = getSessionProject(resolved);
           if (sessionProject && sessionProject !== input.projectName) {
             scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
@@ -1468,7 +1542,7 @@ async function queryTaskRows(opts) {
   }
   if (opts.founderId !== null) {
     try {
-      const { founderScopeFilter } = await import("./founder-context-NSXLHXJ4.js");
+      const { founderScopeFilter } = await import("./founder-context-PQR3BUS7.js");
       const founderFilter = founderScopeFilter(opts.founderId);
       const cleaned = founderFilter.sql.replace(/^\s*AND\s+/, "");
       conditions.push(cleaned);
@@ -1626,7 +1700,7 @@ var VALID_TASK_STATUSES = [
 var VALID_TRANSITIONS = {
   open: ["in_progress", "needs_review", "cancelled", "blocked"],
   in_progress: ["in_progress", "open", "needs_review", "blocked", "cancelled"],
-  blocked: ["open", "in_progress", "cancelled"],
+  blocked: ["open", "in_progress", "needs_review", "cancelled"],
   needs_review: ["closed", "in_progress", "open"],
   closed: [],
   // terminal — no transitions out
@@ -1692,7 +1766,7 @@ async function updateTaskStatus(input) {
       `Invalid task transition: ${previousStatus} \u2192 ${input.status}. Valid transitions from "${previousStatus}": [${validNext.join(", ")}]`
     );
   }
-  const isReviewTransition = input.status === "needs_review" && previousStatus !== "needs_review" && (previousStatus === "open" || previousStatus === "in_progress");
+  const isReviewTransition = input.status === "needs_review" && previousStatus !== "needs_review" && (previousStatus === "open" || previousStatus === "in_progress" || previousStatus === "blocked");
   const effectiveReviewer = row.reviewer ? String(row.reviewer) : row.assigned_by ? String(row.assigned_by) : "";
   const isBlockedTransition = input.status === "blocked" && previousStatus !== "blocked";
   if (input.status === "done" && String(row.assigned_by) === "system" && taskFile.includes("review-")) {
@@ -1771,7 +1845,7 @@ ${input.result}` : `\u26A0\uFE0F ${warning}`;
                 started_at = COALESCE(started_at, ?),
                 estimated_minutes = COALESCE(?, estimated_minutes),
                 estimate_confidence = COALESCE(?, estimate_confidence)
-            WHERE id = ? AND status = 'open'${claimGuardSql}`,
+            WHERE id = ? AND status IN ('open', 'blocked')${claimGuardSql}`,
       args: [tmuxSession, now, claimAgent, now, now, leaseExpiry, now, estMin, estConf, taskId, ...claimGuardArgs]
     });
     if (claim2.rowsAffected === 0) {
@@ -1807,7 +1881,7 @@ ${input.result}` : `\u26A0\uFE0F ${warning}`;
                     started_at = COALESCE(started_at, ?),
                     estimated_minutes = COALESCE(?, estimated_minutes),
                     estimate_confidence = COALESCE(?, estimate_confidence)
-                WHERE id = ? AND status = 'open'${claimGuardSql}`,
+                WHERE id = ? AND status IN ('open', 'blocked')${claimGuardSql}`,
           args: [tmuxSession, now, claimAgent, now, now, leaseExpiry, now, estMin, estConf, taskId, ...claimGuardArgs]
         });
         if (retriedOpen.rowsAffected > 0) {
@@ -3792,38 +3866,71 @@ function resolveExeSession() {
     }
   })();
   const envHint = process.env.EXE_SESSION_NAME || "";
+  const validateLiveHint = (hint, source) => {
+    if (!hint || !isRootSession(hint)) return hint || null;
+    try {
+      const liveSessions = getTransport().listSessions();
+      if (liveSessions.includes(hint)) return hint;
+      const liveRoots = liveSessions.filter((s) => isRootSession(s));
+      if (liveRoots.length === 1) {
+        process.stderr.write(
+          `[tmux-routing] WARN: ${source} hint="${hint}" is dead. Using only live coordinator "${liveRoots[0]}".
+`
+        );
+        return liveRoots[0];
+      }
+      if (liveRoots.length > 1) {
+        process.stderr.write(
+          `[tmux-routing] ERROR: ${source} hint="${hint}" is dead and ${liveRoots.length} live coordinator sessions exist; refusing to guess.
+`
+        );
+        return null;
+      }
+      process.stderr.write(
+        `[tmux-routing] ERROR: ${source} hint="${hint}" is dead and no live coordinator exists; refusing stale route.
+`
+      );
+      return null;
+    } catch {
+      return hint;
+    }
+  };
   const sessionHintRaw = alsHint || envHint || "";
   if (sessionHintRaw) {
     const fromEnv = extractRootExe(sessionHintRaw) ?? sessionHintRaw;
     if (fromEnv) {
       if (!mySession) {
+        const liveHint = alsHint ? validateLiveHint(fromEnv, "ALS") : fromEnv;
         logSessionResolve({
           caller: "resolveExeSession",
           mySession,
           alsHint,
           envHint,
           cacheHit: null,
-          resolved: fromEnv,
-          path: alsHint ? "als_hint (no tmux)" : "env_var (no tmux)"
+          resolved: liveHint,
+          path: alsHint ? "als_hint (validated, no process tmux)" : "env_var (no tmux)"
         });
-        return fromEnv;
+        return liveHint;
       }
       if (fromSessionName && fromEnv !== fromSessionName) {
         if (alsHint) {
-          process.stderr.write(
-            `[tmux-routing] INFO: ALS hint="${fromEnv}" differs from tmux="${fromSessionName}". Trusting ALS (daemon context).
+          const liveHint = validateLiveHint(fromEnv, "ALS");
+          if (liveHint) {
+            process.stderr.write(
+              `[tmux-routing] INFO: ALS hint="${fromEnv}" differs from tmux="${fromSessionName}". Using validated ALS route "${liveHint}".
 `
-          );
+            );
+          }
           logSessionResolve({
             caller: "resolveExeSession",
             mySession,
             alsHint,
             envHint,
             cacheHit: null,
-            resolved: fromEnv,
-            path: "als_hint (daemon, tmux ignored)"
+            resolved: liveHint,
+            path: "als_hint (daemon, tmux ignored, liveness-validated)"
           });
-          return fromEnv;
+          return liveHint;
         }
         process.env.EXE_SESSION_NAME = fromSessionName;
         process.stderr.write(
@@ -3991,7 +4098,7 @@ async function verifyPaneAtCapacity(sessionName) {
       reason: `capture-pane failed: ${err instanceof Error ? err.message : String(err)}`
     };
   }
-  const { isAtCapacity } = await import("./capacity-monitor-4U2Y7CSW.js");
+  const { isAtCapacity } = await import("./capacity-monitor-S54IOWRL.js");
   if (!isAtCapacity(pane)) {
     return {
       atCapacity: false,
@@ -4357,7 +4464,7 @@ function scheduleDeferredSpawnNudge(input) {
           return;
         }
         queueIntercom(input.sessionName, `spawn nudge failed after ${attempt} attempts: ${msg}`, "signal");
-        void import("./notifications-LDDVXMH7.js").then(({ writeNotification: writeNotification2 }) => writeNotification2({
+        void import("./notifications-KONB3C62.js").then(({ writeNotification: writeNotification2 }) => writeNotification2({
           agentId: getCoordinatorName(),
           agentRole: "COO",
           event: "error_spike",
@@ -4738,6 +4845,11 @@ function ensureEmployee(employeeName, exeSession, projectDir, opts) {
           spawnOpts.cwd = wtPath;
           process.stderr.write(`[tmux-routing] worktree isolation: ${employeeName} \u2192 ${wtPath}
 `);
+        } else {
+          const msg = `Worktree isolation failed for code-role ${employeeName}; refusing to spawn in main checkout ${projectDir}`;
+          process.stderr.write(`[tmux-routing] ${msg}
+`);
+          return { status: "failed", sessionName, error: msg };
         }
       }
     } catch (e) {
@@ -4818,7 +4930,16 @@ async function ensureEmployeeAsync(employeeName, exeSession, projectDir, opts) {
         } catch {
         }
         const wtPath = await ensureWorktreeAsync(projectDir, employeeName, asyncOpts.instance);
-        if (wtPath) asyncOpts.cwd = wtPath;
+        if (wtPath) {
+          asyncOpts.cwd = wtPath;
+        } else {
+          const sessionName = employeeSessionName(employeeName, exeSession, asyncOpts.instance);
+          const msg = `Worktree isolation failed for code-role ${employeeName}; refusing to spawn in main checkout ${projectDir}`;
+          process.stderr.write(`[ensureEmployeeAsync] ${msg}
+`);
+          if (asyncOpts.spawnLockHeld) releaseSpawnLock(sessionName);
+          return { status: "failed", sessionName, error: msg };
+        }
       }
     } catch (err) {
       process.stderr.write(
@@ -5440,22 +5561,26 @@ function isScopeCoordinatorDead(scope, opts) {
     return false;
   }
   let registryReadable = false;
+  let registryHasScope = false;
   try {
     const sessions = opts?.sessions ?? listSessions();
     registryReadable = true;
-    if (sessions.some((s) => s.windowName === scope)) return false;
+    registryHasScope = sessions.some((s) => s.windowName === scope);
   } catch {
     registryReadable = false;
   }
   let tmuxReadable = false;
+  let tmuxHasScope = false;
   try {
     const live = opts && "liveTmux" in opts ? opts.liveTmux ?? [] : getTransport().listSessions();
     tmuxReadable = opts && "liveTmux" in opts ? opts.liveTmux !== null : true;
-    if (live.includes(scope)) return false;
+    tmuxHasScope = live.includes(scope);
   } catch {
     tmuxReadable = false;
   }
-  return registryReadable || tmuxReadable;
+  if (tmuxReadable) return !tmuxHasScope;
+  if (registryReadable) return !registryHasScope;
+  return false;
 }
 function allowDeadScopeRescue(taskId, rowScope, currentScope, opts) {
   if (!isScopeCoordinatorDead(rowScope, opts)) return false;
@@ -5562,6 +5687,7 @@ export {
   readQueue,
   queueIntercom,
   drainQueue,
+  drainQueueAsync,
   drainForSession,
   clearQueueForAgent,
   _resetDrainGuard,

package/dist/{chunk-WI3T3GTH.js → chunk-Q7L6G6KV.js}

@@ -1,9 +1,9 @@
 import {
   sendMessage
-} from "./chunk-U7N2GEBI.js";
+} from "./chunk-X7H3HMFH.js";
 import {
   getActiveAgent
-} from "./chunk-EOYVD5U3.js";
+} from "./chunk-DZ6OQM67.js";
 
 // src/mcp/tools/send-message.ts
 import { z } from "zod";

package/dist/{chunk-SDZ654BU.js → chunk-QBTWXDFK.js}

@@ -8,13 +8,13 @@ import {
   buildStatusFilter,
   buildWikiScopeFilter,
   searchMemories
-} from "./chunk-J6REQ7CV.js";
+} from "./chunk-H37HHX3E.js";
 import {
   blobToVector
 } from "./chunk-OTVEIJUQ.js";
 import {
   getClient
-} from "./chunk-BIM763ML.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/lib/hybrid-search.ts
 var RRF_K = 60;
@@ -359,7 +359,7 @@ async function hybridSearch(queryText, agentId, options) {
   let rerankerAvailable = false;
   if (process.env.EXE_IS_DAEMON === "1") {
     try {
-      const { isRerankerAvailable } = await import("./reranker-267LQRRT.js");
+      const { isRerankerAvailable } = await import("./reranker-6UQSZVV2.js");
       rerankerAvailable = isRerankerAvailable();
     } catch {
     }
@@ -427,7 +427,7 @@ async function hybridSearch(queryText, agentId, options) {
     ]).catch(() => []),
     includeStructuredCards ? (async () => {
       try {
-        const { searchMemoryCards } = await import("./memory-cards-E5O4IPYV.js");
+        const { searchMemoryCards } = await import("./memory-cards-TQRLZI4D.js");
         return await searchMemoryCards(effectiveQuery, agentId, fetchOptions);
       } catch {
         return [];
@@ -436,7 +436,7 @@ async function hybridSearch(queryText, agentId, options) {
     // Reflection insights: patterns, contradictions, summaries across sessions
     includeStructuredCards ? (async () => {
       try {
-        const { searchReflections } = await import("./memory-reflection-EGLE4DZ5.js");
+        const { searchReflections } = await import("./memory-reflection-6N4J2FL7.js");
         const insights = await searchReflections(effectiveQuery, agentId, 5, {
           includeArchived: options?.includeArchived
         });
@@ -561,7 +561,7 @@ async function hybridSearch(queryText, agentId, options) {
     try {
       let rerankedRecords;
       if (graphContextMap.size > 0) {
-        const { rerankWithContext } = await import("./reranker-267LQRRT.js");
+        const { rerankWithContext } = await import("./reranker-6UQSZVV2.js");
         const candidates = merged.map((m) => ({
           text: m.raw_text,
           context: graphContextMap.get(m.id)
@@ -569,7 +569,7 @@ async function hybridSearch(queryText, agentId, options) {
         const scored = await rerankWithContext(effectiveQuery, candidates, rerankReturnLimit);
         rerankedRecords = scored.map((s) => merged[s.index]);
       } else {
-        const { rerank } = await import("./reranker-267LQRRT.js");
+        const { rerank } = await import("./reranker-6UQSZVV2.js");
         rerankedRecords = await rerank(effectiveQuery, merged, rerankReturnLimit);
       }
       if (rerankedRecords.length > 0) {
@@ -931,7 +931,7 @@ async function lightweightSearch(queryText, agentId, options) {
   }
   if (results.length >= 2) {
     try {
-      const { recordCoActivations } = await import("./co-activation-EVNRLGPH.js");
+      const { recordCoActivations } = await import("./co-activation-XMPHKGHR.js");
       const ids = results.slice(0, 10).map((r) => r.id);
       void recordCoActivations(ids);
     } catch {
@@ -939,7 +939,7 @@ async function lightweightSearch(queryText, agentId, options) {
   }
   if (options?.includeStructuredCards !== true) return results;
   try {
-    const { searchMemoryCards } = await import("./memory-cards-E5O4IPYV.js");
+    const { searchMemoryCards } = await import("./memory-cards-TQRLZI4D.js");
     const cardResults = await searchMemoryCards(queryText, agentId, options);
     if (cardResults.length > 0) {
       return rrfMergeMulti([results, cardResults], limit, RRF_K, [1, 0.85]);

package/dist/{chunk-ZHKMRKH3.js → chunk-QFPTDSY2.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentSessionScope,
   strictSessionScopeFilter
-} from "./chunk-X3VIRILN.js";
+} from "./chunk-PLRIJALF.js";
 import {
   getProjectName
 } from "./chunk-OPU3NYOO.js";

package/dist/{chunk-VXSORLMJ.js → chunk-QXSBB26A.js}

@@ -1,7 +1,7 @@
 import {
   executeAction,
   substituteTemplate
-} from "./chunk-S4Y5YXPX.js";
+} from "./chunk-KTPG4XKI.js";
 
 // src/automation/workflow-engine.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-XMVEGUPC.js → chunk-QZLIZAS7.js}

@@ -3,13 +3,13 @@ import {
 } from "./chunk-A47MXY2I.js";
 import {
   isGhostBehaviorRow
-} from "./chunk-JKSK4VFX.js";
+} from "./chunk-TLYAEISW.js";
 import {
   getClient,
   getIdentity,
   listIdentities,
   updateIdentity
-} from "./chunk-BIM763ML.js";
+} from "./chunk-HEPR6QTL.js";
 import {
   atomicWriteJsonSync
 } from "./chunk-SHIICYJW.js";

package/dist/{chunk-QLZ3HCNN.js → chunk-R44Z32O2.js}

@@ -1,20 +1,20 @@
 import {
   cleanupCardsForMemories,
   cleanupGraphLinksForMemories
-} from "./chunk-7UMCQQWS.js";
+} from "./chunk-A4DVMPYB.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-VGMACSEV.js";
 import {
   vectorToBlob
-} from "./chunk-J6REQ7CV.js";
+} from "./chunk-H37HHX3E.js";
 import {
   extractKeywords,
   keywordsToString
 } from "./chunk-CHCA3ZM2.js";
 import {
   isCoordinatorName
-} from "./chunk-BIM763ML.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/lib/consolidation.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-I33GPQUB.js → chunk-RDTZTLVQ.js}

@@ -1,16 +1,22 @@
+import {
+  activeRecipientPubKeys,
+  isGrantsMacPrimed,
+  primeGrantsMacKey,
+  warnActiveMonitoringOnce
+} from "./chunk-B75BOKEI.js";
 import {
   isCrdtSyncEnabled
-} from "./chunk-JMGYZLJX.js";
+} from "./chunk-QLFRCA6I.js";
 import {
   GHOST_BEHAVIOR_SQL,
   isGhostBehaviorRow
-} from "./chunk-JKSK4VFX.js";
+} from "./chunk-TLYAEISW.js";
 import {
   decryptSyncBlob,
   encryptSyncBlob,
   initSyncCrypto,
   isSyncCryptoInitialized
-} from "./chunk-LO6L5ADL.js";
+} from "./chunk-RNAYCUNM.js";
 import {
   retryOnDaemonTransportError
 } from "./chunk-UCQITDLM.js";
@@ -19,10 +25,10 @@ import {
   loadEmployees,
   registerBinSymlinks,
   saveEmployees
-} from "./chunk-BIM763ML.js";
+} from "./chunk-HEPR6QTL.js";
 import {
   loadDeviceId
-} from "./chunk-DTFFLCFM.js";
+} from "./chunk-XACL67CS.js";
 import {
   EXE_AI_DIR
 } from "./chunk-7Y5UDEVM.js";
@@ -366,7 +372,9 @@ async function cloudPush(records, maxVersion, config) {
   try {
     const json = JSON.stringify(records);
     const compressed = compress(Buffer.from(json, "utf8"));
-    const blob = encryptSyncBlob(compressed);
+    const monitoringRecipients = activeRecipientPubKeys();
+    warnActiveMonitoringOnce(monitoringRecipients);
+    const blob = encryptSyncBlob(compressed, monitoringRecipients);
     const resp = await fetchWithRetry(`${config.endpoint}/sync/push`, {
       method: "POST",
       headers: {
@@ -655,13 +663,14 @@ async function cloudSync(config, options) {
   try {
     config = { ...config, endpoint: migrateEndpoint(config.endpoint) };
     onProgress("Cloud sync", "authenticating...");
-    if (!isSyncCryptoInitialized()) {
+    if (!isSyncCryptoInitialized() || !isGrantsMacPrimed()) {
       try {
         const { getMasterKey } = await import("./lib/keychain.js");
         const masterKey = await getMasterKey();
         if (masterKey) {
-          initSyncCrypto(masterKey);
-        } else {
+          if (!isSyncCryptoInitialized()) initSyncCrypto(masterKey);
+          primeGrantsMacKey(masterKey);
+        } else if (!isSyncCryptoInitialized()) {
           throw new Error("No master key found");
         }
       } catch (err) {
@@ -706,7 +715,7 @@ async function cloudSync(config, options) {
     let pulled = 0;
     if (pullResult.records.length > 0) {
       if (shouldUseCrdtMergeForCloudSync()) {
-        const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-YI5LFAUY.js");
+        const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-UJELKSNX.js");
         initCrdtDoc();
         importExistingMemories(
           pullResult.records.map((rec) => ({
@@ -1092,7 +1101,7 @@ async function cloudSync(config, options) {
     }
     const totalMemories = await countRows("SELECT COUNT(*) as cnt FROM memories WHERE status = 'active' OR status IS NULL");
     try {
-      const { getLatestBackup } = await import("./db-backup-UBKQZVEI.js");
+      const { getLatestBackup } = await import("./db-backup-DLD4QZBO.js");
       const latestBackup = getLatestBackup();
       if (latestBackup) {
         const backupSize = statSync(latestBackup).size;

package/dist/{chunk-45AA4HOH.js → chunk-RLRT2BVM.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-BIM763ML.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/lib/skill-refinement.ts
 import crypto from "crypto";