@askexenow/exe-os 0.9.340 → 0.9.342

package/dist/{chunk-EIF2LQHZ.js → chunk-PDWS3E22.js}

@@ -1,9 +1,12 @@
 import {
   mcpHttpPort
-} from "./chunk-AVKXCSBI.js";
+} from "./chunk-GG5NDQNN.js";
 import {
   checkCpuStealSync
 } from "./chunk-SSC7EKY2.js";
+import {
+  inventoryLocalSecretResidue
+} from "./chunk-VRAQTFD6.js";
 import {
   CC_NATIVE_ONLY_CUTOFF,
   compareSemver,
@@ -12,10 +15,10 @@ import {
 import {
   readMcpHttpEvents,
   summarizeMcpTransport
-} from "./chunk-5RACW3LX.js";
+} from "./chunk-RAXVPNMR.js";
 import {
   EXE_AI_DIR
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/bin/exe-healthcheck.ts
 import { existsSync, readFileSync, readdirSync } from "fs";
@@ -529,6 +532,50 @@ function checkRetrievalHealth() {
   }
   return results;
 }
+function checkLocalSecretResidue() {
+  const inventory = inventoryLocalSecretResidue();
+  if (inventory.residues.length === 0) {
+    return [{ name: "security/local-secret-residue", pass: true, detail: "No plaintext recovery/key export residue detected" }];
+  }
+  const shown = inventory.residues.slice(0, 3).map((r) => `${r.kind}: ${r.path}`).join("; ");
+  return [{
+    name: "security/local-secret-residue",
+    pass: false,
+    detail: `${inventory.residues.length} plaintext secret residue file(s) detected: ${shown}${inventory.residues.length > 3 ? " ..." : ""}. Vault needed secrets, then run: exe-os doctor --delete-local-secret-residue`
+  }];
+}
+function checkKeyStorageFallback() {
+  const keyPath = path.join(EXE_AI_DIR, "master.key");
+  if (!existsSync(keyPath)) {
+    return [{ name: "security/key-storage", pass: true, detail: "No master.key file fallback detected (expected when OS keychain owns the key)" }];
+  }
+  let first = "";
+  try {
+    first = readFileSync(keyPath, "utf8").slice(0, 4);
+  } catch {
+    return [{ name: "security/key-storage", pass: false, detail: `master.key exists but is not readable: ${keyPath}` }];
+  }
+  const saltPath = path.join(EXE_AI_DIR, ".machine-key-salt");
+  if (first === "enc:" && existsSync(saltPath)) {
+    return [{
+      name: "security/key-storage",
+      pass: false,
+      detail: `\u{1F7E0} Key is using salted encrypted file fallback at ${keyPath}; migrate to OS keychain when available`
+    }];
+  }
+  if (first === "enc:") {
+    return [{
+      name: "security/key-storage",
+      pass: false,
+      detail: `\u{1F534} Key is using legacy deterministic encrypted file fallback at ${keyPath}; run exe-os key status or exe-os setup to re-migrate/rewrite with salt`
+    }];
+  }
+  return [{
+    name: "security/key-storage",
+    pass: false,
+    detail: `\u{1F534} Key is stored in plaintext file fallback at ${keyPath}; run exe-os key status or exe-os setup to migrate/encrypt it`
+  }];
+}
 var HEALTHCHECK_CHILD_ENV = "EXE_HEALTHCHECK_CHILD";
 var DEFAULT_HEALTHCHECK_TIMEOUT_MS = 3e4;
 function healthcheckTimeoutMs() {
@@ -579,7 +626,9 @@ function runHealthCheck() {
     ...checkMcpTransport(),
     ...checkClaudeCodeInstall(),
     ...checkCpuSteal(),
-    ...checkRetrievalHealth()
+    ...checkRetrievalHealth(),
+    ...checkKeyStorageFallback(),
+    ...checkLocalSecretResidue()
   ];
   const passed = results.filter((r) => r.pass).length;
   const failed = results.filter((r) => !r.pass).length;
@@ -611,6 +660,8 @@ export {
   checkClaudeCodeInstall,
   checkCpuSteal,
   checkRetrievalHealth,
+  checkLocalSecretResidue,
+  checkKeyStorageFallback,
   HEALTHCHECK_CHILD_ENV,
   DEFAULT_HEALTHCHECK_TIMEOUT_MS,
   healthcheckTimeoutMs,

package/dist/{chunk-KTY7I7UH.js → chunk-PPCDBE6Z.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-D3QASX2W.js";
+} from "./chunk-QIFYLIUF.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-XACL67CS.js → chunk-PQIDGXSG.js}

@@ -1,12 +1,12 @@
 import {
   getDeviceInfo
-} from "./chunk-5Z5NATNS.js";
+} from "./chunk-K7KFGDWF.js";
 import {
   EXE_AI_DIR
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/lib/license.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, renameSync } from "fs";
+import { chmodSync, readFileSync, writeFileSync, existsSync, mkdirSync, statSync, renameSync } from "fs";
 import { randomUUID } from "crypto";
 import os from "os";
 import path from "path";
@@ -190,7 +190,16 @@ function getLicenseCacheAgeMs() {
 }
 function cacheResponse(token) {
   try {
-    writeFileSync(CACHE_PATH, JSON.stringify({ token }), "utf8");
+    mkdirSync(EXE_AI_DIR, { recursive: true, mode: 448 });
+    try {
+      chmodSync(EXE_AI_DIR, 448);
+    } catch {
+    }
+    writeFileSync(CACHE_PATH, JSON.stringify({ token }), { encoding: "utf8", mode: 384 });
+    try {
+      chmodSync(CACHE_PATH, 384);
+    } catch {
+    }
   } catch {
   }
 }

package/dist/chunk-PWUFMX75.js

@@ -0,0 +1,186 @@
+// src/lib/fast-db-init.ts
+function makeNoopClient() {
+  const emptyResult = {
+    columns: [],
+    columnTypes: [],
+    rows: [],
+    rowsAffected: 0,
+    lastInsertRowid: void 0,
+    toJSON() {
+      return {};
+    }
+  };
+  return {
+    async execute() {
+      return emptyResult;
+    },
+    async batch(stmts) {
+      return stmts.map(() => emptyResult);
+    },
+    async transaction() {
+      throw new Error("Transactions not supported in daemon-down no-op mode");
+    },
+    async executeMultiple() {
+    },
+    async migrate() {
+      return [];
+    },
+    sync() {
+      return Promise.resolve(void 0);
+    },
+    close() {
+    },
+    get closed() {
+      return false;
+    },
+    get protocol() {
+      return "file";
+    }
+  };
+}
+var DAEMON_PROBE_TIMEOUT_MS = (() => {
+  const raw = Number(process.env.EXE_DAEMON_PROBE_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : 1500;
+})();
+var DAEMON_FAST_PATH_BUDGET_MS = (() => {
+  const raw = Number(process.env.EXE_DAEMON_FAST_PATH_BUDGET_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : 4e3;
+})();
+async function fastDbInit(opts) {
+  const { isInitialized, getClient, setExternalClient } = await import("./lib/database.js");
+  if (isInitialized()) {
+    return getClient();
+  }
+  let effectiveDaemonOnly = opts?.daemonOnly;
+  if (effectiveDaemonOnly === void 0) {
+    try {
+      const { loadConfigSync } = await import("./lib/config.js");
+      effectiveDaemonOnly = loadConfigSync().hookDaemonOnly === true;
+    } catch {
+    }
+  }
+  if (effectiveDaemonOnly) {
+    const { isDaemonReady } = await import("./daemon-ready-signal-LPAZWQOV.js");
+    if (!isDaemonReady()) return makeNoopClient();
+  }
+  const forceDirect = process.env.EXE_DB_DIRECT === "1" || process.env.EXE_DB_READONLY === "1" || process.env.EXE_SKIP_DAEMON === "1";
+  const tryDaemonSocket = async () => {
+    try {
+      const { connectEmbedDaemon, sendDaemonRequest, isClientConnected, disconnectClient } = await import("./lib/exe-daemon-client.js");
+      const { deserializeResultSet } = await import("./daemon-protocol-XW2OLNBS.js");
+      await Promise.race([
+        connectEmbedDaemon(),
+        new Promise((_, reject) => setTimeout(() => reject(new Error("Daemon socket timeout (2s)")), 2e3))
+      ]);
+      if (!isClientConnected()) return null;
+      const daemonClient = {
+        async execute(stmt) {
+          const sql = typeof stmt === "string" ? stmt : stmt.sql;
+          const args = typeof stmt === "string" ? [] : Array.isArray(stmt.args) ? stmt.args : [];
+          const resp = await sendDaemonRequest({ type: "db-execute", sql, args });
+          if (resp.error) throw new Error(String(resp.error));
+          if (resp.db) return deserializeResultSet(resp.db);
+          throw new Error("Unexpected daemon response");
+        },
+        async batch(stmts, mode) {
+          const statements = stmts.map((s) => {
+            const sql = typeof s === "string" ? s : s.sql;
+            const args = typeof s === "string" ? [] : Array.isArray(s.args) ? s.args : [];
+            return { sql, args };
+          });
+          const resp = await sendDaemonRequest({ type: "db-batch", statements, mode: mode ?? "deferred" });
+          if (resp.error) throw new Error(String(resp.error));
+          const batchResults = resp["db-batch"];
+          if (batchResults) return batchResults.map(deserializeResultSet);
+          throw new Error("Unexpected daemon batch response");
+        },
+        async transaction(_mode) {
+          throw new Error("Transactions not supported via daemon socket");
+        },
+        async executeMultiple(_sql) {
+          throw new Error("executeMultiple not supported via daemon socket");
+        },
+        async migrate(_stmts) {
+          throw new Error("migrate not supported via daemon socket");
+        },
+        sync() {
+          return Promise.resolve(void 0);
+        },
+        close() {
+        },
+        get closed() {
+          return false;
+        },
+        get protocol() {
+          return "file";
+        }
+      };
+      try {
+        const probe = await sendDaemonRequest(
+          { type: "db-execute", sql: "SELECT 1", args: [] },
+          DAEMON_PROBE_TIMEOUT_MS
+        );
+        if (probe.error) throw new Error(String(probe.error));
+      } catch {
+        try {
+          disconnectClient();
+        } catch {
+        }
+        return null;
+      }
+      setExternalClient(daemonClient);
+      return daemonClient;
+    } catch {
+      return null;
+    }
+  };
+  const fastPathStart = Date.now();
+  if (!forceDirect) {
+    const client = await tryDaemonSocket();
+    if (client) return client;
+    let daemonLooksPresent = false;
+    try {
+      const { isDaemonReady } = await import("./daemon-ready-signal-LPAZWQOV.js");
+      const { existsSync } = await import("fs");
+      const { join } = await import("path");
+      const { EXE_AI_DIR } = await import("./lib/config.js");
+      const socketPath = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? join(EXE_AI_DIR, "exed.sock");
+      daemonLooksPresent = isDaemonReady() || existsSync(socketPath);
+    } catch {
+    }
+    const budgetLeft = DAEMON_FAST_PATH_BUDGET_MS - (Date.now() - fastPathStart);
+    if (daemonLooksPresent && budgetLeft > 500) {
+      await new Promise((resolve) => setTimeout(resolve, 500));
+      const retryClient = await tryDaemonSocket();
+      if (retryClient) return retryClient;
+    }
+  }
+  if (effectiveDaemonOnly) {
+    return makeNoopClient();
+  }
+  if (opts?.socketOnly) {
+    throw new Error("Daemon socket unavailable and socketOnly=true \u2014 skipping slow DB fallback");
+  }
+  if (!forceDirect) {
+    let daemonOwnsDb = false;
+    try {
+      const { isDaemonReady } = await import("./daemon-ready-signal-LPAZWQOV.js");
+      const { isDbLockHeldByLiveProcess } = await import("./lib/database.js");
+      daemonOwnsDb = isDaemonReady() || isDbLockHeldByLiveProcess();
+    } catch {
+    }
+    if (daemonOwnsDb) {
+      process.stderr.write(
+        "[fast-db-init] daemon is alive but did not answer SELECT 1 in time \u2014 degrading to a no-op DB client instead of opening the encrypted DB as a second writer (bug 96a28cf2). Reads return empty; writes are dropped (memory ingest still queues via the daemon WAL). Set EXE_DB_DIRECT=1 to force a direct open.\n"
+      );
+      return makeNoopClient();
+    }
+  }
+  const { initStore } = await import("./lib/store.js");
+  await initStore({ lightweight: true });
+  return getClient();
+}
+
+export {
+  fastDbInit
+};

package/dist/{chunk-UPWE5NOG.js → chunk-QDGZJ653.js}

@@ -1,12 +1,12 @@
 import {
   storeBehavior
-} from "./chunk-TLYAEISW.js";
+} from "./chunk-KW2SD2FL.js";
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 import {
   loadConfig
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/lib/skill-learning.ts
 import crypto from "crypto";

package/dist/{chunk-MQRFKSLI.js → chunk-QOO5RW3K.js}

@@ -1,23 +1,23 @@
 import {
   getActiveAgent
-} from "./chunk-DZ6OQM67.js";
+} from "./chunk-5ERDIOV3.js";
 import {
   listTasks
-} from "./chunk-PLRIJALF.js";
+} from "./chunk-UP75Z5X7.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/mcp/tools/list-tasks.ts
 import { z } from "zod";
 import { execFileSync } from "child_process";
 function resolveCallerSessionForList() {
-  const contextual = getAgentContext()?.sessionHint || process.env.EXE_SESSION_NAME || process.env.EXE_SESSION || null;
+  if (getAgentContext()) return getAgentContext()?.sessionHint || null;
+  const contextual = process.env.EXE_SESSION_NAME || process.env.EXE_SESSION || null;
   if (contextual) return contextual;
-  if (getAgentContext()) return null;
   if (process.env.VITEST === "true" || process.env.NODE_ENV === "test") return null;
   try {
     const session = execFileSync(
@@ -144,5 +144,6 @@ ${lines.join("\n")}`
 }
 
 export {
+  resolveCallerSessionForList,
   registerListTasks
 };

package/dist/{chunk-KCC5A7YL.js → chunk-QQ4E2RYW.js}

@@ -1,7 +1,7 @@
 import {
   formatDegradations,
   getRetrievalHealth
-} from "./chunk-IYB2NIW3.js";
+} from "./chunk-2KZNGDSW.js";
 import {
   buildRestartReport,
   formatRestartReport
@@ -11,12 +11,16 @@ import {
   LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS,
   manifestEntryForCommand
 } from "./chunk-L3TB7CC3.js";
+import {
+  cleanupLocalSecretResidue,
+  inventoryLocalSecretResidue
+} from "./chunk-VRAQTFD6.js";
 import {
   blobToVector
 } from "./chunk-OTVEIJUQ.js";
 import {
   offloadReadIfMain
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";
@@ -290,14 +294,23 @@ async function detectConflicts(client, projectFilter, agentFilter2) {
 
 // src/bin/exe-doctor.ts
 function parseFlags(argv) {
-  const flags = { fix: false, dryRun: false, verbose: false, conflicts: false, restarts: false };
+  const flags = {
+    fix: false,
+    dryRun: false,
+    verbose: false,
+    conflicts: false,
+    restarts: false,
+    deleteLocalSecretResidue: false
+  };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === "--fix") flags.fix = true;
     else if (arg === "--dry-run") flags.dryRun = true;
     else if (arg === "--verbose") flags.verbose = true;
+    else if (arg === "--bounded") flags.bounded = true;
     else if (arg === "--conflicts") flags.conflicts = true;
     else if (arg === "--restarts" || arg === "--daemon-restarts") flags.restarts = true;
+    else if (arg === "--delete-local-secret-residue" || arg === "--cleanup-local-secret-residue") flags.deleteLocalSecretResidue = true;
     else if (arg === "--agent" && argv[i + 1]) flags.agent = argv[++i];
     else if (arg === "--project" && argv[i + 1]) flags.project = argv[++i];
   }
@@ -317,6 +330,10 @@ function agentFilter(flags) {
   const clause = clauses.length > 0 ? " WHERE " + clauses.join(" AND ") : "";
   return { clause, args };
 }
+function boundedAuditLimit(value, fallback, max) {
+  if (!Number.isFinite(value) || value === void 0) return fallback;
+  return Math.max(1, Math.min(Math.floor(value), max));
+}
 async function auditStats(client, flags) {
   const { clause, args } = agentFilter(flags);
   const summary = await offloadReadIfMain(
@@ -367,6 +384,16 @@ async function auditNullVectors(client, flags) {
 }
 async function auditDuplicates(client, flags) {
   const { clause, args } = agentFilter(flags);
+  const groupLimit = boundedAuditLimit(
+    flags.duplicateGroupLimit,
+    flags.bounded ? 25 : 500,
+    500
+  );
+  const memberLimit = boundedAuditLimit(
+    flags.duplicateMemberLimit,
+    flags.bounded ? 250 : 1e4,
+    1e4
+  );
   const liveOnly = " AND COALESCE(status, 'active') = 'active'";
   const backfillExclude = clause ? " AND tool_name != 'ConversationBackfill'" : " WHERE tool_name != 'ConversationBackfill'";
   const groups = await offloadReadIfMain(
@@ -376,7 +403,7 @@ async function auditDuplicates(client, flags) {
           GROUP BY text_head, text_len
           HAVING cnt > 1
           ORDER BY cnt DESC
-          LIMIT 500`,
+          LIMIT ${groupLimit}`,
     args,
     true
   );
@@ -390,7 +417,7 @@ async function auditDuplicates(client, flags) {
     if (flags.project) filterClause += " AND project_name = ?";
     const ids = await offloadReadIfMain(
       client,
-      `SELECT id, raw_text FROM memories${filterClause} ORDER BY timestamp DESC LIMIT 10000`,
+      `SELECT id, raw_text FROM memories${filterClause} ORDER BY timestamp DESC LIMIT ${memberLimit}`,
       filterArgs,
       true
     );
@@ -621,7 +648,7 @@ function auditHookOwnership() {
 }
 async function auditShards() {
   try {
-    const { auditShardHealth } = await import("./shard-manager-MBWQEYNG.js");
+    const { auditShardHealth } = await import("./shard-manager-35PWFR3B.js");
     const report = await auditShardHealth();
     return {
       total: report.total,
@@ -638,23 +665,34 @@ async function auditShards() {
 }
 async function auditKeyHealth() {
   try {
-    const { getMasterKey } = await import("./lib/keychain.js");
-    const { getKeyBackupStatus } = await import("./key-backup-status-TNEHXA2X.js");
-    const key = await getMasterKey();
+    const { getMasterKey, getKeyStorageInfo } = await import("./lib/keychain.js");
+    const { getKeyBackupStatus } = await import("./key-backup-status-LOSMVATJ.js");
+    const [key, storage] = await Promise.all([getMasterKey(), getKeyStorageInfo()]);
     const backup = getKeyBackupStatus();
     return {
       masterKeyPresent: Boolean(key),
       recoveryBackupMarked: backup.exists,
       recoveryBackupConfirmedAt: backup.confirmedAt,
-      recoveryBackupSource: backup.source
+      recoveryBackupSource: backup.source,
+      storageKind: storage.kind,
+      storageSecure: storage.secure,
+      storageNote: storage.note,
+      storagePath: storage.path
     };
   } catch {
     return { masterKeyPresent: false, recoveryBackupMarked: false };
   }
 }
+function auditLocalSecretResidue() {
+  try {
+    return inventoryLocalSecretResidue();
+  } catch {
+    return { dataDir: "", residues: [] };
+  }
+}
 async function auditOutbox() {
   try {
-    const { getOutboxStatus } = await import("./support-outbox-MGUVVGHT.js");
+    const { getOutboxStatus } = await import("./support-outbox-WHGPUYL2.js");
     return await getOutboxStatus();
   } catch {
     return {
@@ -686,7 +724,7 @@ async function auditCpuSteal() {
 }
 async function runAudit(client, flags) {
   const runConflicts = flags.conflicts || process.env.EXE_AUDIT_CONFLICTS === "1";
-  const [stats, nullVectors, duplicates, bloated, fts, orphanedProjects, shards, keyHealth, outbox, cpuSteal] = await Promise.all([
+  const [stats, nullVectors, duplicates, bloated, fts, orphanedProjects, shards, keyHealth, localSecretResidue, outbox, cpuSteal] = await Promise.all([
     auditStats(client, flags),
     auditNullVectors(client, flags),
     auditDuplicates(client, flags),
@@ -695,6 +733,7 @@ async function runAudit(client, flags) {
     auditOrphanedProjects(client),
     auditShards(),
     auditKeyHealth(),
+    Promise.resolve(auditLocalSecretResidue()),
     auditOutbox(),
     auditCpuSteal()
   ]);
@@ -723,7 +762,7 @@ async function runAudit(client, flags) {
   } catch {
     retrievalHealth = void 0;
   }
-  return { stats, nullVectors, duplicates, duplicateCount, bloated, fts, orphanedProjects, conflicts, hookHealth, hookOwnership, shards, keyHealth, outbox, cpuSteal, retrievalHealth };
+  return { stats, nullVectors, duplicates, duplicateCount, bloated, fts, orphanedProjects, conflicts, hookHealth, hookOwnership, shards, keyHealth, localSecretResidue, outbox, cpuSteal, retrievalHealth };
 }
 function indicator(value, warn) {
   if (value === 0) return "\u{1F7E2}";
@@ -768,18 +807,43 @@ function formatReport(report, flags) {
   const dupPct = s.total > 0 ? report.duplicateCount / s.total * 100 : 0;
   const dupIndicator = dupPct === 0 ? "\u{1F7E2}" : dupPct <= 5 ? "\u{1F7E0}" : "\u{1F534}";
   lines.push(`${dupIndicator} Duplicates:       ${fmtNum(report.duplicateCount)} / ${fmtNum(s.total)} (${pct(report.duplicateCount, s.total)})`);
+  if (flags.bounded) {
+    const groupLimit = boundedAuditLimit(flags.duplicateGroupLimit, 25, 500);
+    const memberLimit = boundedAuditLimit(flags.duplicateMemberLimit, 250, 1e4);
+    lines.push(`                     bounded scan: top ${fmtNum(groupLimit)} bucket(s), ${fmtNum(memberLimit)} row(s)/bucket`);
+  }
   lines.push(`${indicator(report.bloated.length, 20)} Bloated (>5KB):   ${fmtNum(report.bloated.length)} / ${fmtNum(s.total)} (${pct(report.bloated.length, s.total)})`);
   const ftsIndicator = report.fts.inSync ? "\u{1F7E2}" : "\u{1F534}";
   lines.push(`${ftsIndicator} FTS index:        ${report.fts.inSync ? "in sync" : "OUT OF SYNC"} (${fmtNum(report.fts.memoryCount)} / ${fmtNum(report.fts.ftsCount)})`);
   const kh = report.keyHealth;
   if (!kh.masterKeyPresent) {
     lines.push("\u{1F534} Recovery key:    master key missing \u2014 import phrase or run setup before syncing");
-  } else if (!kh.recoveryBackupMarked) {
+  } else {
+    lines.push("\u{1F7E2} Recovery key:    present");
+  }
+  if (kh.storageKind && kh.storageKind !== "macos-keychain" && kh.storageKind !== "linux-secret-service" && kh.storageKind !== "legacy-keytar") {
+    const icon = kh.storageSecure ? "\u{1F7E0}" : "\u{1F534}";
+    lines.push(`${icon} Key storage:     ${kh.storageKind} \u2014 ${kh.storageNote ?? "file fallback in use"}`);
+    if (kh.storagePath) lines.push(`                     ${kh.storagePath}`);
+  }
+  if (!kh.recoveryBackupMarked) {
     lines.push("\u{1F534} Recovery backup: not confirmed \u2014 run `exe-os cloud link --show-full` in your local Terminal and save the 24-word phrase");
   } else {
     const suffix = kh.recoveryBackupConfirmedAt ? ` (${kh.recoveryBackupConfirmedAt.slice(0, 10)}${kh.recoveryBackupSource ? ` via ${kh.recoveryBackupSource}` : ""})` : "";
     lines.push(`\u{1F7E2} Recovery backup: confirmed${suffix}`);
   }
+  if (report.localSecretResidue.residues.length > 0) {
+    lines.push(`\u{1F534} Local plaintext residue: ${report.localSecretResidue.residues.length} file(s) need operator cleanup`);
+    for (const residue of report.localSecretResidue.residues.slice(0, 5)) {
+      lines.push(`                     ${residue.kind}: ${residue.path}`);
+    }
+    if (report.localSecretResidue.residues.length > 5) {
+      lines.push(`                     ...${report.localSecretResidue.residues.length - 5} more`);
+    }
+    lines.push("                     Vault anything needed, then run: exe-os doctor --delete-local-secret-residue");
+  } else {
+    lines.push("\u{1F7E2} Local plaintext residue: none detected");
+  }
   if (report.orphanedProjects.length > 0) {
     const orphanList = report.orphanedProjects.map((o) => `${o.project_name} \u2014 ${o.count} memories`).join(", ");
     lines.push(`\u2139\uFE0F  Orphaned projects: ${report.orphanedProjects.length} (${orphanList})`);
@@ -959,7 +1023,7 @@ function formatReport(report, flags) {
   return lines.join("\n");
 }
 async function fixNullVectors() {
-  const { tryAcquireWorkerSlot, registerWorkerPid } = await import("./worker-gate-MXUQUG4M.js");
+  const { tryAcquireWorkerSlot, registerWorkerPid } = await import("./worker-gate-3KUBAU32.js");
   if (!tryAcquireWorkerSlot()) {
     process.stderr.write("[exe-doctor] Worker gate full \u2014 waiting for existing backfill workers to finish\n");
     await new Promise((r) => setTimeout(r, 5e3));
@@ -1073,7 +1137,7 @@ function shouldFixShards(shards) {
   return shards.unreadable > 0 || shards.schemaMismatches > 0;
 }
 async function fixShards(dryRun) {
-  const { auditShardHealth } = await import("./shard-manager-MBWQEYNG.js");
+  const { auditShardHealth } = await import("./shard-manager-35PWFR3B.js");
   const report = await auditShardHealth({ repair: true, dryRun });
   return {
     total: report.total,
@@ -1133,6 +1197,7 @@ function emptyAuditReport() {
     hookOwnership: { checkedFiles: [], issues: [], staleLegacyHooks: [] },
     shards: { total: 0, ok: 0, unreadable: 0, schemaMismatches: 0, archived: 0, unreadableNames: [], schemaIssueNames: [] },
     keyHealth: { masterKeyPresent: true, recoveryBackupMarked: true },
+    localSecretResidue: { dataDir: "", residues: [] },
     outbox: { bugReports: { total: 0, unsent: 0 }, featureRequests: { total: 0, unsent: 0 } },
     cpuSteal: { available: false, stealPercent: null, severity: "na", source: "none", message: "not checked" }
   };
@@ -1144,10 +1209,21 @@ async function main(argv = process.argv.slice(2)) {
     console.log(formatRestartReport(restartReport));
     return emptyAuditReport();
   }
-  const { fastDbInit } = await import("./fast-db-init-QQB6IVWV.js");
+  const { fastDbInit } = await import("./fast-db-init-4CWHSOOR.js");
   const client = await fastDbInit();
   const report = await runAudit(client, flags);
   console.log(formatReport(report, flags));
+  if (flags.deleteLocalSecretResidue) {
+    const cleanup = cleanupLocalSecretResidue({ dryRun: flags.dryRun });
+    const verb = flags.dryRun ? "Would delete" : "Deleted";
+    console.log(`
+[local-secret-residue] ${verb} ${cleanup.deleted.length} file(s).`);
+    for (const file of cleanup.deleted) console.log(`  ${file}`);
+    if (cleanup.skipped.length > 0) {
+      console.log(`[local-secret-residue] Skipped ${cleanup.skipped.length} file(s):`);
+      for (const file of cleanup.skipped) console.log(`  ${file}`);
+    }
+  }
   if (flags.fix || flags.dryRun) {
     const mode = flags.dryRun ? "[dry-run]" : "[fix]";
     console.log(`
@@ -1155,7 +1231,7 @@ ${mode} Applying repairs...
 `);
     if (!flags.dryRun) {
       try {
-        const { createBackup } = await import("./db-backup-DLD4QZBO.js");
+        const { createBackup } = await import("./db-backup-W2QFSYQC.js");
         const backupPath = await createBackup("pre-fix");
         if (backupPath) {
           console.log(`  Backup created: ${backupPath.split("/").pop()}`);
@@ -1228,6 +1304,7 @@ export {
   auditHookOwnership,
   auditShards,
   auditKeyHealth,
+  auditLocalSecretResidue,
   auditOutbox,
   auditCpuSteal,
   runAudit,

package/dist/{chunk-BPC5LZ6Y.js → chunk-QRYVCDWS.js}

@@ -1,9 +1,9 @@
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 import {
   loadConfigSync
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/lib/token-spend.ts
 import { readdir, stat } from "fs/promises";