@askexenow/exe-os 0.9.340 → 0.9.342

package/dist/{chunk-TNJRWUCE.js → chunk-USSB56WK.js}

@@ -1,6 +1,6 @@
 import {
   writeMemoryViaDaemon
-} from "./chunk-2233TQCA.js";
+} from "./chunk-JLZ4RYSD.js";
 
 // src/lib/auto-checkpoint.ts
 var FILE_RE = /(?:^|\s)([\w./-]+\.(?:ts|tsx|js|jsx|json|md|yml|yaml|sql|go|py|css|scss|html|sh))(?:\b|$)/g;

package/dist/{chunk-KMBEL7VB.js → chunk-UUEKJDK6.js}

@@ -1,12 +1,32 @@
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 import {
   loadConfig
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/lib/reminders.ts
 import crypto from "crypto";
+function parseDailyPushHours(dailyPush) {
+  if (!dailyPush || dailyPush.trim().length === 0) return [];
+  try {
+    const parsed = JSON.parse(dailyPush);
+    if (!Array.isArray(parsed.hours)) return [];
+    const hours = parsed.hours.filter((h) => typeof h === "number" && Number.isInteger(h) && h >= 0 && h <= 23);
+    return [...new Set(hours)].sort((a, b) => a - b);
+  } catch {
+    return [];
+  }
+}
+function normalizeDailyPush(dailyPush) {
+  if (dailyPush === void 0 || dailyPush === null) return null;
+  if (dailyPush.trim().length === 0) return null;
+  const hours = parseDailyPushHours(dailyPush);
+  if (hours.length === 0) {
+    throw new Error(`Invalid daily_push: expected JSON like {"hours":[9,18]} with integer hours 0\u201323`);
+  }
+  return JSON.stringify({ hours });
+}
 async function getCloudConfig() {
   try {
     const config = await loadConfig();
@@ -62,6 +82,9 @@ async function cloudFetchReminders(cloud) {
       createdAt: r.created_at,
       dueDate: r.due_date,
       completedAt: r.completed_at,
+      dailyPush: null,
+      // cloud KV does not carry the local push schedule
+      lastPushedAt: null,
       source: "cloud"
     }));
   } catch (err) {
@@ -103,31 +126,42 @@ function dedup(local, cloud) {
   }
   return merged;
 }
-async function createReminder(text, dueDate) {
+async function createReminder(text, dueDate, dailyPush) {
   const client = getClient();
   const id = crypto.randomUUID();
   const now = (/* @__PURE__ */ new Date()).toISOString();
+  const normalizedPush = normalizeDailyPush(dailyPush);
   await client.execute({
-    sql: `INSERT INTO reminders (id, text, created_at, due_date) VALUES (?, ?, ?, ?)`,
-    args: [id, text, now, dueDate ?? null]
+    sql: `INSERT INTO reminders (id, text, created_at, due_date, daily_push) VALUES (?, ?, ?, ?, ?)`,
+    args: [id, text, now, dueDate ?? null, normalizedPush]
   });
   const cloud = await getCloudConfig();
   if (cloud) {
     cloudPushReminder(cloud, text, dueDate ?? null).catch(() => {
     });
   }
-  return { id, text, createdAt: now, dueDate: dueDate ?? null, completedAt: null };
+  return {
+    id,
+    text,
+    createdAt: now,
+    dueDate: dueDate ?? null,
+    completedAt: null,
+    dailyPush: normalizedPush,
+    lastPushedAt: null
+  };
 }
 async function listReminders(includeCompleted = false) {
   const client = getClient();
-  const sql = includeCompleted ? `SELECT id, text, created_at, due_date, completed_at FROM reminders ORDER BY due_date ASC NULLS LAST LIMIT 500` : `SELECT id, text, created_at, due_date, completed_at FROM reminders WHERE completed_at IS NULL ORDER BY due_date ASC NULLS LAST LIMIT 500`;
+  const sql = includeCompleted ? `SELECT id, text, created_at, due_date, completed_at, daily_push, last_pushed_at FROM reminders ORDER BY due_date ASC NULLS LAST LIMIT 500` : `SELECT id, text, created_at, due_date, completed_at, daily_push, last_pushed_at FROM reminders WHERE completed_at IS NULL ORDER BY due_date ASC NULLS LAST LIMIT 500`;
   const result = await client.execute(sql);
   const local = result.rows.map((row) => ({
     id: String(row.id),
     text: String(row.text),
     createdAt: String(row.created_at),
     dueDate: row.due_date ? String(row.due_date) : null,
-    completedAt: row.completed_at ? String(row.completed_at) : null
+    completedAt: row.completed_at ? String(row.completed_at) : null,
+    dailyPush: row.daily_push ? String(row.daily_push) : null,
+    lastPushedAt: row.last_pushed_at ? String(row.last_pushed_at) : null
   }));
   const cloud = await getCloudConfig();
   if (cloud) {
@@ -171,11 +205,57 @@ async function completeReminder(idOrText) {
     }).catch(() => {
     });
   }
-  return { id, text, createdAt: "", dueDate: null, completedAt: now };
+  return { id, text, createdAt: "", dueDate: null, completedAt: now, dailyPush: null };
+}
+function alreadyPushedThisHour(lastPushedAt, now) {
+  if (!lastPushedAt) return false;
+  const last = new Date(lastPushedAt);
+  if (Number.isNaN(last.getTime())) return false;
+  return last.getFullYear() === now.getFullYear() && last.getMonth() === now.getMonth() && last.getDate() === now.getDate() && last.getHours() === now.getHours();
+}
+async function getDuePushReminders(now = /* @__PURE__ */ new Date()) {
+  const client = getClient();
+  const result = await client.execute({
+    sql: `SELECT id, text, due_date, daily_push, last_pushed_at
+            FROM reminders
+           WHERE completed_at IS NULL AND daily_push IS NOT NULL
+           LIMIT 500`,
+    args: []
+  });
+  const hour = now.getHours();
+  const due = [];
+  for (const row of result.rows) {
+    const hours = parseDailyPushHours(row.daily_push ? String(row.daily_push) : null);
+    if (!hours.includes(hour)) continue;
+    if (alreadyPushedThisHour(row.last_pushed_at ? String(row.last_pushed_at) : null, now)) continue;
+    due.push({
+      id: String(row.id),
+      text: String(row.text),
+      hour,
+      dueDate: row.due_date ? String(row.due_date) : null
+    });
+  }
+  return due;
+}
+async function markReminderPushed(id, now = /* @__PURE__ */ new Date()) {
+  try {
+    const client = getClient();
+    await client.execute({
+      sql: `UPDATE reminders SET last_pushed_at = ? WHERE id = ?`,
+      args: [now.toISOString(), id]
+    });
+  } catch (err) {
+    process.stderr.write(`[reminders] markReminderPushed failed: ${err instanceof Error ? err.message : String(err)}
+`);
+  }
 }
 
 export {
+  parseDailyPushHours,
+  normalizeDailyPush,
   createReminder,
   listReminders,
-  completeReminder
+  completeReminder,
+  getDuePushReminders,
+  markReminderPushed
 };

package/dist/{chunk-XJI7Z6LZ.js → chunk-UUQBZPJJ.js}

@@ -1,7 +1,7 @@
 import {
   getIdentity,
   loadEmployeesSync
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/lib/drift-probes.ts
 var DRIFT_THRESHOLD = 80;

package/dist/{chunk-RRWDYOQS.js → chunk-V3EEVY4L.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/lib/token-budget.ts
 var WARN_THRESHOLD = 0.8;

package/dist/{chunk-N5I7RL3I.js → chunk-VPZHJCKW.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/lib/worker-gate.ts
 import { readdirSync, writeFileSync, unlinkSync, mkdirSync, existsSync, readFileSync } from "fs";
@@ -119,7 +119,7 @@ function releaseBackfillLock() {
 }
 async function getTaskAwareCapacity() {
   const { getClient } = await import("./lib/database.js");
-  const { sessionScopeFilter } = await import("./task-scope-CQEG5SSJ.js");
+  const { sessionScopeFilter } = await import("./task-scope-FOIW25HR.js");
   const client = getClient();
   const scope = sessionScopeFilter();
   const result = await client.execute({

package/dist/chunk-VRAQTFD6.js

@@ -0,0 +1,265 @@
+import {
+  redactSecrets
+} from "./chunk-4QCFFW2H.js";
+import {
+  EXE_AI_DIR
+} from "./chunk-WZHZCDDO.js";
+
+// src/lib/local-secret-inventory.ts
+import {
+  chmodSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  rmSync
+} from "fs";
+import path from "path";
+var SQLITE_HEADER = "SQLite format 3\0";
+var CRDT_STATE_ENC_MAGIC = "EXEO-CRDT-ENC1:";
+function isEncryptedCrdtState(head) {
+  const magic = Buffer.from(CRDT_STATE_ENC_MAGIC, "utf8");
+  if (head.length < magic.length) return false;
+  return head.subarray(0, magic.length).equals(magic);
+}
+function safeStat(filePath) {
+  try {
+    return lstatSync(filePath);
+  } catch {
+    return null;
+  }
+}
+function addIfFile(residues, filePath, kind, detail, cleanup, deletable = true) {
+  const st = safeStat(filePath);
+  if (!st?.isFile()) return;
+  residues.push({ kind, path: filePath, sizeBytes: Number(st.size), detail, cleanup, deletable });
+}
+function firstBytes(filePath, n) {
+  try {
+    return readFileSync(filePath).subarray(0, n);
+  } catch {
+    return Buffer.alloc(0);
+  }
+}
+function isPlaintextSqliteFile(filePath) {
+  const st = safeStat(filePath);
+  if (!st?.isFile()) return false;
+  if (st.size === 0) return true;
+  return firstBytes(filePath, SQLITE_HEADER.length).toString("binary") === SQLITE_HEADER;
+}
+function walk(dir, maxDepth) {
+  if (maxDepth < 0) return [];
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    const full = path.join(dir, entry);
+    const st = safeStat(full);
+    if (!st) continue;
+    if (st.isFile()) out.push(full);
+    else if (st.isDirectory()) out.push(...walk(full, maxDepth - 1));
+  }
+  return out;
+}
+function segmentIsEmergencyRecovery(segment) {
+  if (/emergency[-_]?recovery/i.test(segment)) return true;
+  if (/recovery[-_]?export/i.test(segment)) return true;
+  return false;
+}
+function isEmergencyRecoveryExport(filePath) {
+  const base = path.basename(filePath);
+  if (/^NEW_KEY_DO_NOT_SHARE\.base64$/i.test(base)) return true;
+  if (/^OLD_KEY_BACKUP_DELETE_AFTER_VERIFICATION\.base64$/i.test(base)) return true;
+  return segmentIsEmergencyRecovery(base);
+}
+function isUnderEmergencyRecoveryDir(dataDir, filePath) {
+  const rel = path.relative(dataDir, filePath);
+  if (rel.startsWith("..")) return false;
+  const segments = rel.split(path.sep);
+  return segments.slice(0, -1).some(segmentIsEmergencyRecovery);
+}
+function findEmergencyRecoveryDirs(dataDir, maxDepth) {
+  const out = [];
+  const recurse = (dir, depth) => {
+    if (depth < 0) return;
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path.join(dir, entry);
+      const st = safeStat(full);
+      if (!st?.isDirectory()) continue;
+      if (segmentIsEmergencyRecovery(entry)) out.push(full);
+      recurse(full, depth - 1);
+    }
+  };
+  recurse(dataDir, maxDepth);
+  return out;
+}
+function dirSize(dir) {
+  let total = 0;
+  for (const f of walk(dir, 8)) {
+    const st = safeStat(f);
+    if (st?.isFile()) total += Number(st.size);
+  }
+  return total;
+}
+function inventoryLocalSecretResidue(dataDir = EXE_AI_DIR) {
+  const residues = [];
+  addIfFile(
+    residues,
+    path.join(dataDir, "recovery-phrase.txt"),
+    "recovery-phrase",
+    "Headless setup recovery phrase is still on disk. Do not print it; move it to a password manager or offline vault, then delete the file.",
+    "Vault the phrase, then run: exe-os doctor --delete-local-secret-residue"
+  );
+  for (const filePath of walk(dataDir, 4)) {
+    if (isEmergencyRecoveryExport(filePath) || isUnderEmergencyRecoveryDir(dataDir, filePath)) {
+      addIfFile(
+        residues,
+        filePath,
+        "emergency-recovery-export",
+        "Plaintext key/recovery export residue from an emergency recovery or key rotation flow.",
+        "Confirm the key/phrase is vaulted or no longer needed, then run: exe-os doctor --delete-local-secret-residue"
+      );
+    }
+  }
+  for (const emDir of findEmergencyRecoveryDirs(dataDir, 4)) {
+    const st = safeStat(emDir);
+    if (!st?.isDirectory()) continue;
+    residues.push({
+      kind: "emergency-recovery-export",
+      path: emDir,
+      sizeBytes: dirSize(emDir),
+      detail: "Emergency recovery / key rotation export directory. May hold a multi-GB plaintext memories.jsonl and key material.",
+      cleanup: "Confirm the key/phrase is vaulted or no longer needed, then run: exe-os doctor --delete-local-secret-residue",
+      deletable: true
+    });
+  }
+  {
+    const crdtPath = path.join(dataDir, "crdt-state.bin");
+    const crdtStat = safeStat(crdtPath);
+    if (crdtStat?.isFile() && crdtStat.size > 0 && !isEncryptedCrdtState(firstBytes(crdtPath, CRDT_STATE_ENC_MAGIC.length))) {
+      residues.push({
+        kind: "crdt-plaintext-state",
+        path: crdtPath,
+        sizeBytes: Number(crdtStat.size),
+        detail: "Plaintext CRDT sync state \u2014 an unencrypted mirror of decrypted memory rows. Persists even after CRDT sync is disabled.",
+        cleanup: "Safe to delete (rebuilt from the encrypted DB on next sync). Run: exe-os doctor --delete-local-secret-residue",
+        deletable: true
+      });
+    }
+  }
+  const supportArtifactDirs = [
+    { dir: "bug-reports", kind: "unredacted-bug-report", label: "Bug-report" },
+    { dir: "feature-requests", kind: "unredacted-support-artifact", label: "Feature-request" },
+    { dir: "reviews", kind: "unredacted-support-artifact", label: "Review" }
+  ];
+  for (const { dir, kind, label } of supportArtifactDirs) {
+    const artifactDir = path.join(dataDir, dir);
+    if (!safeStat(artifactDir)?.isDirectory()) continue;
+    for (const filePath of walk(artifactDir, 4)) {
+      const st = safeStat(filePath);
+      if (!st?.isFile() || st.size === 0) continue;
+      if (st.size > 5 * 1024 * 1024) continue;
+      let content;
+      try {
+        content = readFileSync(filePath, "utf8");
+      } catch {
+        continue;
+      }
+      if (redactSecrets(content).redactedCount > 0) {
+        residues.push({
+          kind,
+          path: filePath,
+          sizeBytes: Number(st.size),
+          detail: `${label} file on disk contains secret-shaped content (e.g. an API key or private key) written before local redaction shipped. Rotate any exposed key.`,
+          cleanup: "Review the file, rotate any exposed secret, then delete it manually. Not auto-deleted (it is your own artifact).",
+          deletable: false
+        });
+      }
+    }
+  }
+  let rootEntries = [];
+  try {
+    rootEntries = readdirSync(dataDir);
+  } catch {
+    rootEntries = [];
+  }
+  for (const entry of rootEntries) {
+    if (!/\.(db|sqlite|sqlite3)$/i.test(entry)) continue;
+    const filePath = path.join(dataDir, entry);
+    if (!isPlaintextSqliteFile(filePath)) continue;
+    addIfFile(
+      residues,
+      filePath,
+      "legacy-plaintext-sqlite",
+      "Legacy plaintext SQLite database/stub detected in the exe-os data directory. SQLCipher databases should not expose a SQLite header.",
+      "Confirm this is not the active encrypted DB, back it up if needed, then run: exe-os doctor --delete-local-secret-residue"
+    );
+  }
+  residues.sort((a, b) => a.path.localeCompare(b.path));
+  return { dataDir, residues };
+}
+function isContainedWithin(target, dataDirReal) {
+  let targetReal;
+  try {
+    targetReal = realpathSync(target);
+  } catch {
+    return false;
+  }
+  if (targetReal === dataDirReal) return false;
+  const rel = path.relative(dataDirReal, targetReal);
+  return rel.length > 0 && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function cleanupLocalSecretResidue(opts = {}) {
+  const inventory = inventoryLocalSecretResidue(opts.dataDir);
+  const deleted = [];
+  const skipped = [];
+  let dataDirReal;
+  try {
+    dataDirReal = realpathSync(inventory.dataDir);
+  } catch {
+    dataDirReal = path.resolve(inventory.dataDir);
+  }
+  for (const residue of inventory.residues) {
+    if (!residue.deletable) {
+      skipped.push(residue.path);
+      continue;
+    }
+    if (!isContainedWithin(residue.path, dataDirReal)) {
+      console.warn(`[local-secret-inventory] refusing to delete path outside data dir: ${residue.path}`);
+      skipped.push(residue.path);
+      continue;
+    }
+    if (opts.dryRun) {
+      deleted.push(residue.path);
+      continue;
+    }
+    try {
+      rmSync(residue.path, { force: true, recursive: true });
+      deleted.push(residue.path);
+    } catch {
+      skipped.push(residue.path);
+    }
+  }
+  try {
+    mkdirSync(inventory.dataDir, { recursive: true, mode: 448 });
+    chmodSync(inventory.dataDir, 448);
+  } catch {
+  }
+  return { deleted, skipped };
+}
+
+export {
+  inventoryLocalSecretResidue,
+  cleanupLocalSecretResidue
+};

package/dist/{chunk-H37HHX3E.js → chunk-VSRPS3J7.js}

@@ -9,7 +9,7 @@ import {
   findScopedDuplicate,
   governMemoryRecord,
   schedulePostWriteMemoryHygiene
-} from "./chunk-HHIBOU3P.js";
+} from "./chunk-6XWTQUO4.js";
 import {
   orgBus
 } from "./chunk-MP2AFCGL.js";
@@ -18,16 +18,16 @@ import {
   ensureSchema,
   getClient,
   initTurso
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 import {
   EMBEDDING_DIM
 } from "./chunk-FXU7JOXK.js";
 import {
   getMasterKey
-} from "./chunk-Z42MXYWW.js";
+} from "./chunk-QWVXN224.js";
 import {
   loadConfig
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/lib/store.ts
 var _debugStore = process.env.EXE_DEBUG === "1";
@@ -68,7 +68,7 @@ function recordShardFailure(project, error) {
       `[store] Shard circuit OPEN for "${project}" after ${state.failures} consecutive failures. Will retry in ${SHARD_CB_COOLDOWN_MS / 6e4}min. Last error: ${error}
 `
     );
-    void import("./orchestration-events-5SIJOE4H.js").then(({ recordOrchestrationEventBestEffort }) => {
+    void import("./orchestration-events-WV4NWKZH.js").then(({ recordOrchestrationEventBestEffort }) => {
       recordOrchestrationEventBestEffort({
         eventType: "shard.circuit_open",
         source: "store.recordShardFailure",
@@ -152,7 +152,7 @@ async function initStore(options) {
   if (!options?.lightweight) {
     try {
       if (process.env.EXE_DISABLE_SHARDING !== "1") {
-        const { initShardManager } = await import("./shard-manager-MBWQEYNG.js");
+        const { initShardManager } = await import("./shard-manager-35PWFR3B.js");
         initShardManager(hexKey);
       }
     } catch (e) {
@@ -165,7 +165,7 @@ async function initStore(options) {
     );
     _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
     try {
-      const { loadGlobalProcedures } = await import("./global-procedures-R7KRREEK.js");
+      const { loadGlobalProcedures } = await import("./global-procedures-XQX3LUH6.js");
       await loadGlobalProcedures();
     } catch (e) {
       logStoreWarn("catch", e);
@@ -293,7 +293,7 @@ async function writeMemory(record) {
     founder_id: record.founder_id ?? null
   };
   try {
-    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-T4ITBGSG.js");
+    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-HJTXYCWH.js");
     const poisonResult = await checkMemoryPoisoning({
       memoryId: dbRow.id,
       vector: Array.isArray(dbRow.vector) ? dbRow.vector : void 0,
@@ -486,19 +486,19 @@ async function flushBatch() {
     }
     _nextVersion = baseVersion;
     try {
-      const { insertMemoryCardsForBatch } = await import("./memory-cards-TQRLZI4D.js");
+      const { insertMemoryCardsForBatch } = await import("./memory-cards-ZRDW7QBX.js");
       await insertMemoryCardsForBatch(batch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { insertOntologyForBatch } = await import("./agentic-ontology-RNSXGXW4.js");
+      const { insertOntologyForBatch } = await import("./agentic-ontology-3FXYMHKW.js");
       await insertOntologyForBatch(batch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { extractGraphForBatch } = await import("./memory-graph-extractor-IWGNVAFU.js");
+      const { extractGraphForBatch } = await import("./memory-graph-extractor-QLXDMHRS.js");
       await extractGraphForBatch(batch);
     } catch (e) {
       logStoreWarn("catch", e);
@@ -506,7 +506,7 @@ async function flushBatch() {
     schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
     _pendingRecords.splice(0, batch.length);
     try {
-      const { isShardingEnabled, getReadyShardClient } = await import("./shard-manager-MBWQEYNG.js");
+      const { isShardingEnabled, getReadyShardClient } = await import("./shard-manager-35PWFR3B.js");
       if (process.env.EXE_DISABLE_SHARDING !== "1" && isShardingEnabled()) {
         const byProject = /* @__PURE__ */ new Map();
         let skippedUnknown = 0;
@@ -590,7 +590,7 @@ async function searchMemories(queryVector, agentId, options) {
   let client;
   let isMainDb = true;
   try {
-    const { isShardingEnabled, shardExists, getReadyShardClient } = await import("./shard-manager-MBWQEYNG.js");
+    const { isShardingEnabled, shardExists, getReadyShardClient } = await import("./shard-manager-35PWFR3B.js");
     if (isShardingEnabled() && options?.projectName && shardExists(options.projectName)) {
       client = await getReadyShardClient(options.projectName);
       isMainDb = false;
@@ -629,7 +629,7 @@ async function searchMemories(queryVector, agentId, options) {
     args.push(activeEmbeddingModel);
   }
   try {
-    const { founderScopeFilter } = await import("./founder-context-PQR3BUS7.js");
+    const { founderScopeFilter } = await import("./founder-context-7L3CFPYN.js");
     const founderFilter = founderScopeFilter(options?.founderId);
     sql += founderFilter.sql;
     args.push(...founderFilter.args.filter((a) => a !== null));

package/dist/{chunk-5ZNY7IZI.js → chunk-WMESXBJM.js}

@@ -1,6 +1,6 @@
 import {
   getBrandName
-} from "./chunk-TPHCZDE3.js";
+} from "./chunk-O5V57XYE.js";
 
 // src/lib/status-brief.ts
 import pathMod from "path";
@@ -198,6 +198,8 @@ function buildReminders(data) {
   return lines;
 }
 function buildDegradedBanner(data) {
+  const breakerLines = buildBreakerBanner();
+  if (breakerLines.length > 0) return breakerLines;
   const dh = data.daemonHealth;
   if (!dh) return [];
   const lines = [];
@@ -230,6 +232,32 @@ function buildDegradedBanner(data) {
   }
   return [];
 }
+function buildBreakerBanner() {
+  const alert = readBreakerAlertSync();
+  if (!alert) return [];
+  const lines = [];
+  lines.push("\u{1F6A8}\u{1F6A8}\u{1F6A8} DAEMON DEGRADED \u2014 RESTART BREAKER TRIPPED \u{1F6A8}\u{1F6A8}\u{1F6A8}");
+  lines.push("");
+  lines.push(`  \u274C ${String(alert.reason ?? "crash-loop circuit breaker open")}`);
+  lines.push(`  Crash restarts in window: ${String(alert.crashRestartsInWindow ?? "?")}`);
+  if (typeof alert.lastBootClassification === "string") lines.push(`  Last boot: ${alert.lastBootClassification}`);
+  lines.push("");
+  lines.push("  \u{1F527} TO FIX:");
+  lines.push("    1. Run:  exe-os daemon status        (see crash timestamps + last exit)");
+  lines.push("    2. Run:  exe-os daemon reset-breaker (clear the breaker)");
+  lines.push("    3. Relaunch the daemon, then /mcp");
+  return lines;
+}
+function readBreakerAlertSync() {
+  try {
+    const home = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? pathMod.join(osMod.homedir(), ".exe-os");
+    const p = pathMod.join(home, "daemon-restart-breaker.ALERT.json");
+    if (!fsMod.existsSync(p)) return null;
+    return JSON.parse(fsMod.readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
 function buildOrchestrationPhase(data, employees) {
   if (!data.orchestrationPhase) return [];
   const phase = data.orchestrationPhase;
@@ -332,9 +360,15 @@ function buildActionRequired(data) {
     );
     for (const b of ub.branches.slice(0, 5)) {
       const age = b.ageHours >= 24 ? `${(b.ageHours / 24).toFixed(1)}d` : `${b.ageHours.toFixed(0)}h`;
-      lines.push(`    \u2022 ${b.name} (+${b.ahead} commit${b.ahead === 1 ? "" : "s"}, ${b.filesChanged} file${b.filesChanged === 1 ? "" : "s"}, ${age})`);
+      lines.push(`    \u2022 ${b.name} (+${b.ahead} commit${b.ahead === 1 ? "" : "s"}, ${age})`);
     }
-    if (ub.total > 5) lines.push(`    ... ${ub.total - 5} more \u2014 run: exe-os git-sweep --dry-run`);
+    if (ub.total > 5) lines.push(`    ... ${ub.total - 5} more \u2014 list all: git branch -r --no-merged origin/main`);
+  }
+  if (data.localMainAhead && data.localMainAhead.ahead > 0) {
+    hasIssues = true;
+    const ahead = data.localMainAhead;
+    lines.push(`  \u{1F534} Local ${ahead.branch} is ${ahead.ahead} commit${ahead.ahead === 1 ? "" : "s"} ahead of origin/${ahead.branch} \u2014 do NOT reset`);
+    for (const c of ahead.commits.slice(0, 5)) lines.push(`    \u2022 ${c}`);
   }
   if (data.failedMessages && data.failedMessages.length > 0) {
     hasIssues = true;