@askexenow/exe-os 0.9.340 → 0.9.342

package/dist/{exe-key-M6TYHNUW.js → exe-key-2N6LY2BU.js}

@@ -1,118 +1,124 @@
 #!/usr/bin/env node
 import {
   computeMcpSurfaceHash
-} from "./chunk-TALWBVZE.js";
+} from "./chunk-BUCXNV32.js";
 import "./chunk-WCGNCH3Q.js";
-import "./chunk-G7WO77Z2.js";
-import "./chunk-XJI7Z6LZ.js";
+import "./chunk-YTCFACP4.js";
+import "./chunk-TLT7NZCW.js";
+import "./chunk-UUQBZPJJ.js";
+import "./chunk-HV4KESRY.js";
 import "./chunk-557C2IGL.js";
-import "./chunk-QZLIZAS7.js";
-import "./chunk-AOO77BDE.js";
-import "./chunk-6M36JFFD.js";
-import "./chunk-DRCRZIIJ.js";
+import "./chunk-TTCUG2CF.js";
+import "./chunk-5H47VHB7.js";
+import "./chunk-EUS4QUKP.js";
+import "./chunk-MKYFAKDW.js";
+import "./chunk-UNXQBELK.js";
 import "./chunk-CRCB5S7I.js";
-import "./chunk-W7DHFGCB.js";
-import "./chunk-PVYR4FCQ.js";
-import "./chunk-VJHUVFIW.js";
-import "./chunk-XCTGRD4S.js";
-import "./chunk-QFPTDSY2.js";
-import "./chunk-DADMPMYX.js";
-import "./chunk-NQBRGXYR.js";
-import "./chunk-WHRTDN5J.js";
+import "./chunk-S7QUM2UK.js";
+import "./chunk-NN2B2QKU.js";
+import "./chunk-HAF2DJYV.js";
+import "./chunk-CE7F6RHG.js";
+import "./chunk-4CMVFVFC.js";
+import "./chunk-P5HIWY2E.js";
+import "./chunk-JRM4TAGS.js";
+import "./chunk-MGGOSFCR.js";
 import "./chunk-E6ORBQHP.js";
-import "./chunk-32SXNM3G.js";
-import "./chunk-LMZISHSJ.js";
-import "./chunk-MQRFKSLI.js";
-import "./chunk-LTVCRHHD.js";
-import "./chunk-6IRVGOUL.js";
-import "./chunk-BU2QQWBQ.js";
-import "./chunk-PAEXYFMY.js";
-import "./chunk-2SG2UGCH.js";
-import "./chunk-KMBEL7VB.js";
-import "./chunk-WYLV4S6A.js";
-import "./chunk-XUKPALWT.js";
-import "./chunk-Q7L6G6KV.js";
-import "./chunk-DILD54TU.js";
-import "./chunk-HMP5VT6A.js";
-import "./chunk-T4KZ2Z2N.js";
-import "./chunk-GN45PBWI.js";
-import "./chunk-OJTJYEMX.js";
-import "./chunk-BPC5LZ6Y.js";
+import "./chunk-C5QAPURN.js";
+import "./chunk-FPFPLPUY.js";
+import "./chunk-JMYHW3AL.js";
+import "./chunk-OZEBAGKR.js";
+import "./chunk-QOO5RW3K.js";
+import "./chunk-Z6RSN7KS.js";
+import "./chunk-NX5INHHG.js";
+import "./chunk-4J4PMPXZ.js";
+import "./chunk-F27XXN6C.js";
+import "./chunk-UUEKJDK6.js";
+import "./chunk-MZM6EJCU.js";
+import "./chunk-6WQ3NNCE.js";
+import "./chunk-7V4JADD6.js";
+import "./chunk-L4A5DL6Z.js";
+import "./chunk-SQKXKV2Y.js";
+import "./chunk-JPUZPAAF.js";
+import "./chunk-QRYVCDWS.js";
 import "./chunk-3OEVDGIY.js";
-import "./chunk-KCC5A7YL.js";
-import "./chunk-IYB2NIW3.js";
+import "./chunk-QQ4E2RYW.js";
+import "./chunk-2KZNGDSW.js";
 import "./chunk-KQ4Z2G24.js";
 import "./chunk-L3TB7CC3.js";
-import "./chunk-EIF2LQHZ.js";
-import "./chunk-AVKXCSBI.js";
-import "./chunk-X2FHTDIU.js";
+import "./chunk-PDWS3E22.js";
+import "./chunk-GG5NDQNN.js";
+import "./chunk-IBYL4DHM.js";
 import "./chunk-SSC7EKY2.js";
-import "./chunk-X7H3HMFH.js";
+import "./chunk-VRAQTFD6.js";
+import "./chunk-KWZMQACA.js";
 import "./chunk-75H4R62K.js";
-import "./chunk-6HBURYON.js";
+import "./chunk-OTF44GXL.js";
 import "./chunk-MMRUBN3I.js";
 import "./chunk-2XZ6X3PJ.js";
-import "./chunk-UXBD22CD.js";
-import "./chunk-I3XKO3KQ.js";
-import "./chunk-A47MXY2I.js";
-import "./chunk-7WPOJDTA.js";
-import "./chunk-B75BOKEI.js";
-import "./chunk-QLFRCA6I.js";
+import "./chunk-XHK3FS3W.js";
+import "./chunk-GJ26DULE.js";
+import "./chunk-EQHQF5IM.js";
+import "./chunk-CNVBKDEY.js";
+import "./chunk-NXUSDL37.js";
+import "./chunk-NBZL5CGA.js";
 import "./chunk-X2Z5GT3V.js";
-import "./chunk-UPWE5NOG.js";
-import "./chunk-TLYAEISW.js";
-import "./chunk-R44Z32O2.js";
+import "./chunk-QDGZJ653.js";
+import "./chunk-KW2SD2FL.js";
+import "./chunk-6CH3TPHR.js";
 import "./chunk-A4DVMPYB.js";
 import "./chunk-GUMRIUI5.js";
 import "./chunk-Z6BZQHP5.js";
 import "./chunk-VGMACSEV.js";
-import "./chunk-RNAYCUNM.js";
-import "./chunk-JCBKARSK.js";
-import "./chunk-UCQITDLM.js";
-import "./chunk-3QDSCJ3F.js";
-import "./chunk-5RACW3LX.js";
+import "./chunk-S3THSOWV.js";
+import "./chunk-IOEUAQWP.js";
+import "./chunk-5TY4FPH6.js";
+import "./chunk-XZXBB3TN.js";
+import "./chunk-RAXVPNMR.js";
 import "./chunk-QGGH7LOU.js";
-import "./chunk-542EWGY3.js";
-import "./chunk-I7Z6KTGF.js";
-import "./chunk-UFAXZ2PY.js";
-import "./chunk-N5I7RL3I.js";
-import "./chunk-ZREGOV2Q.js";
+import "./chunk-QYZJHTNE.js";
+import "./chunk-R2NN3JKH.js";
+import "./chunk-O7LWR36Z.js";
+import "./chunk-PWUFMX75.js";
+import "./chunk-VPZHJCKW.js";
+import "./chunk-N7QJKQMX.js";
 import "./chunk-AB4PAQYK.js";
-import "./chunk-H37HHX3E.js";
+import "./chunk-VSRPS3J7.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-HHIBOU3P.js";
-import "./chunk-DZ6OQM67.js";
-import "./chunk-Y25OJWOQ.js";
-import "./chunk-PLRIJALF.js";
-import "./chunk-OFX5B2S7.js";
-import "./chunk-B76TSEP3.js";
-import "./chunk-RLRT2BVM.js";
+import "./chunk-6XWTQUO4.js";
+import "./chunk-76CJBM36.js";
+import "./chunk-5ERDIOV3.js";
+import "./chunk-4QCFFW2H.js";
+import "./chunk-UP75Z5X7.js";
+import "./chunk-L2R3LN2P.js";
+import "./chunk-I26FWCSP.js";
+import "./chunk-EV46QTD3.js";
+import "./chunk-E23LNUWJ.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-EIKATSE4.js";
-import "./chunk-E23LNUWJ.js";
-import "./chunk-UIV2WPBT.js";
-import "./chunk-SSTLTIF3.js";
-import "./chunk-RMOBQ6A5.js";
-import "./chunk-54QCG45Y.js";
-import "./chunk-FUIIVSW6.js";
-import "./chunk-65SVQELL.js";
-import "./chunk-NGP6LSV2.js";
-import "./chunk-MW2GJJ53.js";
+import "./chunk-KGWRTRKC.js";
+import "./chunk-AD2VCHSS.js";
+import "./chunk-WOYADZF5.js";
+import "./chunk-SKGMF2SO.js";
+import "./chunk-2WAVZ5UJ.js";
+import "./chunk-HA5R6USD.js";
+import "./chunk-AM7S2TY6.js";
+import "./chunk-JGIPOUIK.js";
+import "./chunk-GWDSB25T.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-2233TQCA.js";
-import "./chunk-HCJCW7X4.js";
+import "./chunk-JLZ4RYSD.js";
+import "./chunk-H7I47RS5.js";
 import "./chunk-OPU3NYOO.js";
-import "./chunk-7TS64TBG.js";
+import "./chunk-G4RGKBCA.js";
 import {
   requestDeployRestart
 } from "./chunk-AFNRE2RV.js";
-import "./chunk-3NGZ4PL7.js";
+import "./chunk-X2Q5NLUL.js";
 import "./chunk-NLEW62VC.js";
 import "./chunk-HYZV25LY.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-YGAAZN3E.js";
-import "./chunk-KTPG4XKI.js";
+import "./chunk-GL57PO3K.js";
+import "./chunk-KP3U5QGJ.js";
 import "./chunk-ML4S5SHZ.js";
 import "./chunk-MP2AFCGL.js";
 import {
@@ -120,11 +126,11 @@ import {
   ensureSchema,
   getClient,
   initDatabase
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 import {
   assertValidDbPath
 } from "./chunk-2I23RPSI.js";
-import "./chunk-ATOU6CYR.js";
+import "./chunk-OLMQ4UOF.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
@@ -135,14 +141,15 @@ import {
   getMasterKey,
   importMnemonic,
   setMasterKey
-} from "./chunk-Z42MXYWW.js";
-import "./chunk-XQNNB5GY.js";
-import "./chunk-XACL67CS.js";
-import "./chunk-5Z5NATNS.js";
+} from "./chunk-QWVXN224.js";
+import "./chunk-NGP6LSV2.js";
+import "./chunk-F55P3H4S.js";
+import "./chunk-PQIDGXSG.js";
+import "./chunk-K7KFGDWF.js";
 import {
   loadConfig
-} from "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+} from "./chunk-WZHZCDDO.js";
+import "./chunk-BYTDMAGB.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";
@@ -231,7 +238,7 @@ async function keyStatus() {
   console.log(`Storage: ${storage.kind} \u2014 ${storage.note}`);
   console.log(`Key length: ${key.length} bytes`);
   try {
-    const { getKeyBackupStatus, keyBackupMarkerPath } = await import("./key-backup-status-TNEHXA2X.js");
+    const { getKeyBackupStatus, keyBackupMarkerPath } = await import("./key-backup-status-LOSMVATJ.js");
     const backup = getKeyBackupStatus();
     if (backup.exists) {
       const when = backup.confirmedAt ? ` at ${backup.confirmedAt}` : "";
@@ -410,149 +417,157 @@ async function rotateWizard(argv) {
   const newKeyTempPath = path.join(baseDir, "NEW_KEY_DO_NOT_SHARE.base64");
   writeFileSync(newKeyTempPath, `${newKey.toString("base64")}
 `, { mode: 384 });
-  console.log(`Rotation workspace: ${baseDir}`);
-  console.log("Stopping daemon...");
-  await stopDaemonIfAlive();
-  console.log("Backing up encrypted DB/WAL/SHM...");
-  const dbDir = path.dirname(pf.dbPath);
-  for (const name of ["memories.db", "memories.db-wal", "memories.db-shm"]) {
-    const src = path.join(dbDir, name);
-    if (existsSync(src)) copyFileSync(src, path.join(backupDir, name));
-  }
-  console.log("Creating fresh encrypted DB with new key...");
-  await initDatabase({ dbPath: newDbPath, encryptionKey: newKey.toString("hex") });
-  await ensureSchema();
-  const target = getClient();
-  await target.execute("PRAGMA foreign_keys=OFF");
-  assertValidDbPath(pf.dbPath, "exe-key rotate source");
-  const source = createClient({ url: `file:${pf.dbPath}`, encryptionKey: pf.key.toString("hex") });
-  await source.execute("PRAGMA busy_timeout = 30000");
-  const tables = await getTableNames(source);
-  const copiedTables = [];
-  for (const table of tables) {
-    const copied = await copyTable(source, target, table);
-    copiedTables.push({ table, count: copied });
-    console.log(`\u2713 copied ${table}: ${copied}`);
-  }
-  const generationId = crypto.randomUUID();
-  await target.execute({ sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES (?, ?)", args: ["key_rotation_at", (/* @__PURE__ */ new Date()).toISOString()] });
-  await target.execute({ sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES (?, ?)", args: ["key_rotation_generation_id", generationId] });
-  await target.execute({ sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES (?, ?)", args: ["cloud_reupload_required", pf.cloudConfigured ? "1" : "0"] });
-  await target.execute("DELETE FROM sync_meta WHERE key IN ('last_cloud_pull_version', 'last_cloud_push_version')");
-  const verifyMem = await target.execute("SELECT COUNT(*) as cnt FROM memories");
-  const verifyTasks = await target.execute("SELECT COUNT(*) as cnt FROM tasks");
-  const expectedMemories = Number(verifyMem.rows[0]?.cnt ?? 0);
-  const expectedTasks = Number(verifyTasks.rows[0]?.cnt ?? 0);
-  console.log(`Verified new DB: ${expectedMemories} memories, ${expectedTasks} tasks`);
-  await target.execute("PRAGMA wal_checkpoint(TRUNCATE)");
   try {
-    source.close();
-  } catch {
-  }
-  try {
-    target.close();
-  } catch {
-  }
-  console.log("Swapping DB files...");
-  for (const name of ["memories.db", "memories.db-wal", "memories.db-shm"]) {
-    const current = path.join(dbDir, name);
-    if (existsSync(current)) renameSync(current, path.join(backupDir, `moved-${name}`));
-  }
-  copyFileSync(newDbPath, pf.dbPath);
-  rmSync(path.join(dbDir, "memories.db-wal"), { force: true });
-  rmSync(path.join(dbDir, "memories.db-shm"), { force: true });
-  console.log("Installing new key into OS keychain...");
-  await setMasterKey(newKey);
-  await initDatabase({ dbPath: pf.dbPath, encryptionKey: newKey.toString("hex") });
-  const finalClient = getClient();
-  const finalMem = await finalClient.execute("SELECT COUNT(*) as cnt FROM memories");
-  const finalTasks = await finalClient.execute("SELECT COUNT(*) as cnt FROM tasks");
-  const finalMemoryCount = Number(finalMem.rows[0]?.cnt ?? 0);
-  const finalTaskCount = Number(finalTasks.rows[0]?.cnt ?? 0);
-  if (finalMemoryCount !== expectedMemories || finalTaskCount !== expectedTasks) {
-    throw new Error(`Post-swap verification mismatch: expected ${expectedMemories}/${expectedTasks}, got ${finalMemoryCount}/${finalTaskCount}. Backup kept at ${backupDir}`);
-  }
-  rmSync(newKeyTempPath, { force: true });
-  writeFileSync(path.join(baseDir, "rotation-manifest.json"), JSON.stringify({
-    rotationId,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    backupDir,
-    generationId,
-    cloudReuploadRequired: pf.cloudConfigured,
-    finalCounts: { memories: finalMemoryCount, tasks: finalTaskCount },
-    copiedTables
-  }, null, 2) + "\n", { mode: 384 });
-  console.log("Restarting daemon and verifying daemon DB access...");
-  try {
-    const { connectEmbedDaemon, sendDaemonRequest, isClientConnected, disconnectClient } = await import("./lib/exe-daemon-client.js");
-    await connectEmbedDaemon();
-    const resp = await sendDaemonRequest({ type: "db-execute", sql: "SELECT COUNT(*) as cnt FROM memories", args: [] });
-    if (resp.error) throw new Error(String(resp.error));
-    console.log(`\u2713 Daemon connected: ${isClientConnected()} (${resp.db?.rows?.[0]?.cnt ?? "?"} memories)`);
-    disconnectClient();
-  } catch (err) {
-    console.log(`\u26A0 Daemon restart/verify failed: ${err instanceof Error ? err.message : String(err)}`);
-    console.log("  You can retry by running any exe-os command that starts the daemon.");
-  }
-  console.log("");
-  console.log("Key rotation complete.");
-  console.log(`Backup kept at: ${backupDir}`);
-  console.log(`New DB verified: ${finalMemoryCount} memories, ${finalTaskCount} tasks`);
-  if (pf.cloudConfigured) {
-    console.log("Local key rotation is complete.");
-    console.log("Cloud sync is paused until your newly encrypted cloud backup is re-uploaded.");
-    console.log("");
-  }
-  const newRecoveryPhrase = await exportMnemonic(newKey);
-  console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
-  console.log(" REQUIRED: SAVE YOUR NEW RECOVERY PHRASE");
-  console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
-  console.log("Write these 24 words down now. They will not be uploaded to Exe Cloud.");
-  console.log("");
-  console.log(newRecoveryPhrase);
-  console.log("");
-  console.log("If you need to reveal it again later from this trusted local Terminal, run:");
-  console.log("  exe-os cloud link --show-full");
-  console.log("");
-  console.log("Do not continue to cloud re-upload until the NEW phrase is saved.");
-  if (pf.cloudConfigured) {
-    const rl2 = createInterface({ input: process.stdin, output: process.stdout });
+    console.log(`Rotation workspace: ${baseDir}`);
+    console.log("Stopping daemon...");
+    await stopDaemonIfAlive();
+    console.log("Backing up encrypted DB/WAL/SHM...");
+    const dbDir = path.dirname(pf.dbPath);
+    for (const name of ["memories.db", "memories.db-wal", "memories.db-shm"]) {
+      const src = path.join(dbDir, name);
+      if (existsSync(src)) copyFileSync(src, path.join(backupDir, name));
+    }
+    console.log("Creating fresh encrypted DB with new key...");
+    await initDatabase({ dbPath: newDbPath, encryptionKey: newKey.toString("hex") });
+    await ensureSchema();
+    const target = getClient();
+    await target.execute("PRAGMA foreign_keys=OFF");
+    assertValidDbPath(pf.dbPath, "exe-key rotate source");
+    const source = createClient({ url: `file:${pf.dbPath}`, encryptionKey: pf.key.toString("hex") });
+    await source.execute("PRAGMA busy_timeout = 30000");
+    const tables = await getTableNames(source);
+    const copiedTables = [];
+    for (const table of tables) {
+      const copied = await copyTable(source, target, table);
+      copiedTables.push({ table, count: copied });
+      console.log(`\u2713 copied ${table}: ${copied}`);
+    }
+    const generationId = crypto.randomUUID();
+    await target.execute({ sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES (?, ?)", args: ["key_rotation_at", (/* @__PURE__ */ new Date()).toISOString()] });
+    await target.execute({ sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES (?, ?)", args: ["key_rotation_generation_id", generationId] });
+    await target.execute({ sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES (?, ?)", args: ["cloud_reupload_required", pf.cloudConfigured ? "1" : "0"] });
+    await target.execute("DELETE FROM sync_meta WHERE key IN ('last_cloud_pull_version', 'last_cloud_push_version')");
+    const verifyMem = await target.execute("SELECT COUNT(*) as cnt FROM memories");
+    const verifyTasks = await target.execute("SELECT COUNT(*) as cnt FROM tasks");
+    const expectedMemories = Number(verifyMem.rows[0]?.cnt ?? 0);
+    const expectedTasks = Number(verifyTasks.rows[0]?.cnt ?? 0);
+    console.log(`Verified new DB: ${expectedMemories} memories, ${expectedTasks} tasks`);
+    await target.execute("PRAGMA wal_checkpoint(TRUNCATE)");
     try {
-      const saved = await ask(rl2, 'After saving the 24 words, type exactly "I SAVED MY NEW RECOVERY PHRASE" to continue: ');
-      if (saved !== "I SAVED MY NEW RECOVERY PHRASE") {
-        console.log("Cloud re-upload skipped. Save the phrase with:");
-        console.log("  exe-os cloud link --show-full");
-        console.log("Then run:");
-        console.log("  exe-os cloud reupload");
-        return 0;
-      }
-    } finally {
-      rl2.close();
+      source.close();
+    } catch {
     }
-    console.log("Starting automatic cloud re-upload now...");
     try {
-      const { main: runCloud } = await import("./bin/exe-cloud.js");
-      const originalArgv = process.argv;
+      target.close();
+    } catch {
+    }
+    console.log("Swapping DB files...");
+    for (const name of ["memories.db", "memories.db-wal", "memories.db-shm"]) {
+      const current = path.join(dbDir, name);
+      if (existsSync(current)) renameSync(current, path.join(backupDir, `moved-${name}`));
+    }
+    copyFileSync(newDbPath, pf.dbPath);
+    rmSync(path.join(dbDir, "memories.db-wal"), { force: true });
+    rmSync(path.join(dbDir, "memories.db-shm"), { force: true });
+    const staleCrdtState = path.join(dataDir(), "crdt-state.bin");
+    if (existsSync(staleCrdtState)) {
+      renameSync(staleCrdtState, path.join(backupDir, "crdt-state.bin"));
+      console.log("Moved stale crdt-state.bin (old-key CRDT cache) into pre-rotation backup; it rebuilds from the DB on next sync.");
+    }
+    console.log("Installing new key into OS keychain...");
+    await setMasterKey(newKey);
+    await initDatabase({ dbPath: pf.dbPath, encryptionKey: newKey.toString("hex") });
+    const finalClient = getClient();
+    const finalMem = await finalClient.execute("SELECT COUNT(*) as cnt FROM memories");
+    const finalTasks = await finalClient.execute("SELECT COUNT(*) as cnt FROM tasks");
+    const finalMemoryCount = Number(finalMem.rows[0]?.cnt ?? 0);
+    const finalTaskCount = Number(finalTasks.rows[0]?.cnt ?? 0);
+    if (finalMemoryCount !== expectedMemories || finalTaskCount !== expectedTasks) {
+      throw new Error(`Post-swap verification mismatch: expected ${expectedMemories}/${expectedTasks}, got ${finalMemoryCount}/${finalTaskCount}. Backup kept at ${backupDir}`);
+    }
+    writeFileSync(path.join(baseDir, "rotation-manifest.json"), JSON.stringify({
+      rotationId,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      backupDir,
+      generationId,
+      cloudReuploadRequired: pf.cloudConfigured,
+      finalCounts: { memories: finalMemoryCount, tasks: finalTaskCount },
+      copiedTables
+    }, null, 2) + "\n", { mode: 384 });
+    console.log("Restarting daemon and verifying daemon DB access...");
+    try {
+      const { connectEmbedDaemon, sendDaemonRequest, isClientConnected, disconnectClient } = await import("./lib/exe-daemon-client.js");
+      await connectEmbedDaemon();
+      const resp = await sendDaemonRequest({ type: "db-execute", sql: "SELECT COUNT(*) as cnt FROM memories", args: [] });
+      if (resp.error) throw new Error(String(resp.error));
+      console.log(`\u2713 Daemon connected: ${isClientConnected()} (${resp.db?.rows?.[0]?.cnt ?? "?"} memories)`);
+      disconnectClient();
+    } catch (err) {
+      console.log(`\u26A0 Daemon restart/verify failed: ${err instanceof Error ? err.message : String(err)}`);
+      console.log("  You can retry by running any exe-os command that starts the daemon.");
+    }
+    console.log("");
+    console.log("Key rotation complete.");
+    console.log(`Backup kept at: ${backupDir}`);
+    console.log(`New DB verified: ${finalMemoryCount} memories, ${finalTaskCount} tasks`);
+    if (pf.cloudConfigured) {
+      console.log("Local key rotation is complete.");
+      console.log("Cloud sync is paused until your newly encrypted cloud backup is re-uploaded.");
+      console.log("");
+    }
+    const newRecoveryPhrase = await exportMnemonic(newKey);
+    console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+    console.log(" REQUIRED: SAVE YOUR NEW RECOVERY PHRASE");
+    console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+    console.log("Write these 24 words down now. They will not be uploaded to Exe Cloud.");
+    console.log("");
+    console.log(newRecoveryPhrase);
+    console.log("");
+    console.log("If you need to reveal it again later from this trusted local Terminal, run:");
+    console.log("  exe-os cloud link --show-full");
+    console.log("");
+    console.log("Do not continue to cloud re-upload until the NEW phrase is saved.");
+    if (pf.cloudConfigured) {
+      const rl2 = createInterface({ input: process.stdin, output: process.stdout });
       try {
-        process.argv = [process.argv[0], process.argv[1], "reupload", "--local-db-is-source-of-truth"];
-        await runCloud();
+        const saved = await ask(rl2, 'After saving the 24 words, type exactly "I SAVED MY NEW RECOVERY PHRASE" to continue: ');
+        if (saved !== "I SAVED MY NEW RECOVERY PHRASE") {
+          console.log("Cloud re-upload skipped. Save the phrase with:");
+          console.log("  exe-os cloud link --show-full");
+          console.log("Then run:");
+          console.log("  exe-os cloud reupload");
+          return 0;
+        }
       } finally {
-        process.argv = originalArgv;
+        rl2.close();
+      }
+      console.log("Starting automatic cloud re-upload now...");
+      try {
+        const { main: runCloud } = await import("./bin/exe-cloud.js");
+        const originalArgv = process.argv;
+        try {
+          process.argv = [process.argv[0], process.argv[1], "reupload", "--local-db-is-source-of-truth"];
+          await runCloud();
+        } finally {
+          process.argv = originalArgv;
+        }
+        console.log("\u2713 Cloud re-upload finished. Main device rotation is complete.");
+      } catch (err) {
+        console.log(`\u26A0 Cloud re-upload did not finish: ${err instanceof Error ? err.message : String(err)}`);
+        console.log("Your local key rotation succeeded, but normal cloud sync remains blocked.");
+        console.log("Retry with the support fallback command:");
+        console.log("  exe-os cloud reupload");
       }
-      console.log("\u2713 Cloud re-upload finished. Main device rotation is complete.");
-    } catch (err) {
-      console.log(`\u26A0 Cloud re-upload did not finish: ${err instanceof Error ? err.message : String(err)}`);
-      console.log("Your local key rotation succeeded, but normal cloud sync remains blocked.");
-      console.log("Retry with the support fallback command:");
-      console.log("  exe-os cloud reupload");
     }
+    console.log("");
+    console.log("Cleanup guidance:");
+    console.log("  1. Verify the new recovery phrase opens this DB on another local terminal/device.");
+    console.log("  2. Keep the old-key encrypted backup until verification is complete.");
+    console.log(`  3. After verification, manually review/remove the sensitive rotation workspace: ${baseDir}`);
+    return 0;
+  } finally {
+    rmSync(newKeyTempPath, { force: true });
   }
-  console.log("");
-  console.log("Cleanup guidance:");
-  console.log("  1. Verify the new recovery phrase opens this DB on another local terminal/device.");
-  console.log("  2. Keep the old-key encrypted backup until verification is complete.");
-  console.log(`  3. After verification, manually review/remove the sensitive rotation workspace: ${baseDir}`);
-  return 0;
 }
 async function acceptRotationWizard(argv) {
   const dryRun = argv.includes("--dry-run");
@@ -745,7 +760,7 @@ async function confirmBackupWizard(argv) {
       rl.close();
     }
   }
-  const { markKeyBackupConfirmed, keyBackupMarkerPath } = await import("./key-backup-status-TNEHXA2X.js");
+  const { markKeyBackupConfirmed, keyBackupMarkerPath } = await import("./key-backup-status-LOSMVATJ.js");
   markKeyBackupConfirmed("exe-os key confirm-backup");
   console.log("");
   console.log("\u2713 Recovery phrase backup confirmed for this node.");

package/dist/{exe-org-BGZNNE4H.js → exe-org-X4CSNCKS.js}

@@ -3,9 +3,9 @@ import {
   getOrchestrationPhaseInfo,
   loadOrchestrationPhase,
   setOrchestrationPhase
-} from "./chunk-32SXNM3G.js";
-import "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+} from "./chunk-C5QAPURN.js";
+import "./chunk-WZHZCDDO.js";
+import "./chunk-BYTDMAGB.js";
 import "./chunk-MLKGABMK.js";
 
 // src/bin/exe-org.ts