@askexenow/exe-os 0.9.37 → 0.9.39

package/dist/hooks/prompt-submit.js

@@ -603,7 +603,8 @@ function isMultiInstance(agentName, employees) {
   return MULTI_INSTANCE_ROLES.has(emp.role.toLowerCase());
 }
 function addEmployee(employees, employee) {
-  const normalized = { ...employee, name: employee.name.toLowerCase() };
+  const { systemPrompt: _legacyPrompt, ...rest } = employee;
+  const normalized = { ...rest, name: employee.name.toLowerCase() };
   if (employees.some((e) => e.name.toLowerCase() === normalized.name)) {
     throw new Error(`Employee '${normalized.name}' already exists`);
   }
@@ -3583,7 +3584,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path8 from "path";
-import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -3605,7 +3606,7 @@ function getShardClient(projectName) {
   if (!_encryptionKey) {
     throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   if (!safeName || safeName === "unknown") {
     throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
   }
@@ -3627,9 +3628,12 @@ function getShardClient(projectName) {
   return client;
 }
 function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   return existsSync8(path8.join(SHARDS_DIR, `${safeName}.db`));
 }
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function listShards() {
   if (!existsSync8(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
@@ -3723,7 +3727,8 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN token_cost REAL",
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -3819,9 +3824,32 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+  const safeName = safeShardName(projectName);
+  let client = getShardClient(projectName);
+  try {
+    await ensureShardSchema(client);
+    return client;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/SQLITE_NOTADB|file is not a database/i.test(message)) throw err;
+    client.close();
+    _shards.delete(safeName);
+    _shardLastAccess.delete(safeName);
+    const dbPath = path8.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync8(dbPath)) {
+      const stat = statSync2(dbPath);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const archivedPath = path8.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      renameSync3(dbPath, archivedPath);
+      process.stderr.write(
+        `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
+`
+      );
+    }
+    client = getShardClient(projectName);
+    await ensureShardSchema(client);
+    return client;
+  }
 }
 function evictLRU() {
   let oldest = null;
@@ -4042,7 +4070,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 wiki, documents, and content",
         domain: "tool-use",
         priority: "p1",
-        content: "create_wiki_page: create a wiki page in exe-wiki. list_wiki_pages: browse wiki pages. get_wiki_page: read a wiki page. update_wiki_page: edit a wiki page. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
+        content: "wiki: read/list wiki pages only. Direct wiki write tools are removed; wiki updates flow through raw-data ingestion/projection into the curated wiki store. Legacy aliases: list_wiki_pages/get_wiki_page. crm: read/list/get CRM records from exe-db. raw_data: read capped raw landing-pad events from exe-db with payload opt-in. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
       },
       {
         title: "MCP tools \u2014 system, operations, and admin",
@@ -4060,7 +4088,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 advanced (triggers, skills, orchestration)",
         domain: "tool-use",
         priority: "p1",
-        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage Layer 0 procedures (actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
+        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage customer-owned company procedures (Layer 0; actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
       }
     ];
     PLATFORM_PROCEDURE_TITLES = new Set(
@@ -5096,7 +5124,7 @@ __export(file_grep_exports, {
   grepProjectFiles: () => grepProjectFiles
 });
 import { execSync as execSync4 } from "child_process";
-import { readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync2, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3, existsSync as existsSync10 } from "fs";
 import path11 from "path";
 import crypto2 from "crypto";
 function hasRipgrep() {
@@ -5213,7 +5241,7 @@ function grepWithNodeFs(pattern, projectRoot, patterns) {
   for (const filePath of files.slice(0, MAX_FILES)) {
     const absPath = path11.join(projectRoot, filePath);
     try {
-      const stat = statSync2(absPath);
+      const stat = statSync3(absPath);
       if (stat.size > MAX_FILE_SIZE) continue;
       const content = readFileSync6(absPath, "utf8");
       const lines = content.split("\n");
@@ -6237,7 +6265,7 @@ __export(intercom_queue_exports, {
   queueIntercom: () => queueIntercom,
   readQueue: () => readQueue
 });
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, renameSync as renameSync3, existsSync as existsSync13, mkdirSync as mkdirSync6 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, renameSync as renameSync4, existsSync as existsSync13, mkdirSync as mkdirSync6 } from "fs";
 import path15 from "path";
 import os8 from "os";
 function ensureDir() {
@@ -6256,7 +6284,7 @@ function writeQueue(queue) {
   ensureDir();
   const tmp = `${QUEUE_PATH}.tmp`;
   writeFileSync7(tmp, JSON.stringify(queue, null, 2));
-  renameSync3(tmp, QUEUE_PATH);
+  renameSync4(tmp, QUEUE_PATH);
 }
 function queueIntercom(targetSession, reason) {
   const queue = readQueue();
@@ -9687,7 +9715,7 @@ var init_messaging = __esm({
 });
 
 // src/lib/memory-queue.ts
-import { appendFileSync as appendFileSync2, readFileSync as readFileSync16, renameSync as renameSync4, unlinkSync as unlinkSync9, existsSync as existsSync20, statSync as statSync3 } from "fs";
+import { appendFileSync as appendFileSync2, readFileSync as readFileSync16, renameSync as renameSync5, unlinkSync as unlinkSync9, existsSync as existsSync20, statSync as statSync4 } from "fs";
 import path24 from "path";
 function enqueueMemory(entry) {
   appendFileSync2(QUEUE_PATH2, JSON.stringify(entry) + "\n");

package/dist/hooks/session-end.js

@@ -7142,7 +7142,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path21 from "path";
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync5, renameSync as renameSync4, statSync as statSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -7164,7 +7164,7 @@ function getShardClient(projectName) {
   if (!_encryptionKey) {
     throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   if (!safeName || safeName === "unknown") {
     throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
   }
@@ -7186,9 +7186,12 @@ function getShardClient(projectName) {
   return client;
 }
 function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   return existsSync17(path21.join(SHARDS_DIR, `${safeName}.db`));
 }
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function listShards() {
   if (!existsSync17(SHARDS_DIR)) return [];
   return readdirSync5(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
@@ -7282,7 +7285,8 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN token_cost REAL",
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -7378,9 +7382,32 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+  const safeName = safeShardName(projectName);
+  let client = getShardClient(projectName);
+  try {
+    await ensureShardSchema(client);
+    return client;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/SQLITE_NOTADB|file is not a database/i.test(message)) throw err;
+    client.close();
+    _shards.delete(safeName);
+    _shardLastAccess.delete(safeName);
+    const dbPath = path21.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync17(dbPath)) {
+      const stat = statSync2(dbPath);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const archivedPath = path21.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      renameSync4(dbPath, archivedPath);
+      process.stderr.write(
+        `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
+`
+      );
+    }
+    client = getShardClient(projectName);
+    await ensureShardSchema(client);
+    return client;
+  }
 }
 function evictLRU() {
   let oldest = null;
@@ -7601,7 +7628,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 wiki, documents, and content",
         domain: "tool-use",
         priority: "p1",
-        content: "create_wiki_page: create a wiki page in exe-wiki. list_wiki_pages: browse wiki pages. get_wiki_page: read a wiki page. update_wiki_page: edit a wiki page. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
+        content: "wiki: read/list wiki pages only. Direct wiki write tools are removed; wiki updates flow through raw-data ingestion/projection into the curated wiki store. Legacy aliases: list_wiki_pages/get_wiki_page. crm: read/list/get CRM records from exe-db. raw_data: read capped raw landing-pad events from exe-db with payload opt-in. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
       },
       {
         title: "MCP tools \u2014 system, operations, and admin",
@@ -7619,7 +7646,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 advanced (triggers, skills, orchestration)",
         domain: "tool-use",
         priority: "p1",
-        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage Layer 0 procedures (actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
+        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage customer-owned company procedures (Layer 0; actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
       }
     ];
     PLATFORM_PROCEDURE_TITLES = new Set(
@@ -8385,7 +8412,7 @@ var init_fast_db_init = __esm({
 });
 
 // src/lib/memory-queue.ts
-import { appendFileSync as appendFileSync2, readFileSync as readFileSync15, renameSync as renameSync4, unlinkSync as unlinkSync9, existsSync as existsSync18, statSync as statSync2 } from "fs";
+import { appendFileSync as appendFileSync2, readFileSync as readFileSync15, renameSync as renameSync5, unlinkSync as unlinkSync9, existsSync as existsSync18, statSync as statSync3 } from "fs";
 import path22 from "path";
 function enqueueMemory(entry) {
   appendFileSync2(QUEUE_PATH2, JSON.stringify(entry) + "\n");

package/dist/hooks/session-start.js

@@ -594,7 +594,8 @@ function isMultiInstance(agentName, employees) {
   return MULTI_INSTANCE_ROLES.has(emp.role.toLowerCase());
 }
 function addEmployee(employees, employee) {
-  const normalized = { ...employee, name: employee.name.toLowerCase() };
+  const { systemPrompt: _legacyPrompt, ...rest } = employee;
+  const normalized = { ...rest, name: employee.name.toLowerCase() };
   if (employees.some((e) => e.name.toLowerCase() === normalized.name)) {
     throw new Error(`Employee '${normalized.name}' already exists`);
   }
@@ -3649,7 +3650,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path8 from "path";
-import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -3671,7 +3672,7 @@ function getShardClient(projectName) {
   if (!_encryptionKey) {
     throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   if (!safeName || safeName === "unknown") {
     throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
   }
@@ -3693,9 +3694,12 @@ function getShardClient(projectName) {
   return client;
 }
 function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   return existsSync8(path8.join(SHARDS_DIR, `${safeName}.db`));
 }
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function listShards() {
   if (!existsSync8(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
@@ -3789,7 +3793,8 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN token_cost REAL",
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -3885,9 +3890,32 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+  const safeName = safeShardName(projectName);
+  let client = getShardClient(projectName);
+  try {
+    await ensureShardSchema(client);
+    return client;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/SQLITE_NOTADB|file is not a database/i.test(message)) throw err;
+    client.close();
+    _shards.delete(safeName);
+    _shardLastAccess.delete(safeName);
+    const dbPath = path8.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync8(dbPath)) {
+      const stat = statSync2(dbPath);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const archivedPath = path8.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      renameSync3(dbPath, archivedPath);
+      process.stderr.write(
+        `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
+`
+      );
+    }
+    client = getShardClient(projectName);
+    await ensureShardSchema(client);
+    return client;
+  }
 }
 function evictLRU() {
   let oldest = null;
@@ -4108,7 +4136,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 wiki, documents, and content",
         domain: "tool-use",
         priority: "p1",
-        content: "create_wiki_page: create a wiki page in exe-wiki. list_wiki_pages: browse wiki pages. get_wiki_page: read a wiki page. update_wiki_page: edit a wiki page. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
+        content: "wiki: read/list wiki pages only. Direct wiki write tools are removed; wiki updates flow through raw-data ingestion/projection into the curated wiki store. Legacy aliases: list_wiki_pages/get_wiki_page. crm: read/list/get CRM records from exe-db. raw_data: read capped raw landing-pad events from exe-db with payload opt-in. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
       },
       {
         title: "MCP tools \u2014 system, operations, and admin",
@@ -4126,7 +4154,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 advanced (triggers, skills, orchestration)",
         domain: "tool-use",
         priority: "p1",
-        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage Layer 0 procedures (actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
+        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage customer-owned company procedures (Layer 0; actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
       }
     ];
     PLATFORM_PROCEDURE_TITLES = new Set(
@@ -5162,7 +5190,7 @@ __export(file_grep_exports, {
   grepProjectFiles: () => grepProjectFiles
 });
 import { execSync as execSync4 } from "child_process";
-import { readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync2, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3, existsSync as existsSync10 } from "fs";
 import path11 from "path";
 import crypto2 from "crypto";
 function hasRipgrep() {
@@ -5279,7 +5307,7 @@ function grepWithNodeFs(pattern, projectRoot, patterns) {
   for (const filePath of files.slice(0, MAX_FILES)) {
     const absPath = path11.join(projectRoot, filePath);
     try {
-      const stat = statSync2(absPath);
+      const stat = statSync3(absPath);
       if (stat.size > MAX_FILE_SIZE) continue;
       const content = readFileSync6(absPath, "utf8");
       const lines = content.split("\n");
@@ -7006,7 +7034,7 @@ var init_provider_table = __esm({
 });
 
 // src/lib/intercom-queue.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync5, renameSync as renameSync3, existsSync as existsSync11, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync5, renameSync as renameSync4, existsSync as existsSync11, mkdirSync as mkdirSync4 } from "fs";
 import path14 from "path";
 import os7 from "os";
 var QUEUE_PATH, TTL_MS, INTERCOM_LOG;
@@ -7483,6 +7511,9 @@ function ensureDir() {
 function identityPath(agentId) {
   return path19.join(IDENTITY_DIR2, `${agentId}.md`);
 }
+function sanitizeIdentityBody(body) {
+  return body.replace(/<!--[\s\S]*?-->/g, "").trim();
+}
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
   if (!match) {
@@ -7495,11 +7526,11 @@ function parseFrontmatter(raw) {
         created_by: "system",
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       },
-      body: raw
+      body: sanitizeIdentityBody(raw)
     };
   }
   const yamlStr = match[1];
-  const body = match[2].trim();
+  const body = sanitizeIdentityBody(match[2]);
   const fm = {};
   for (const line of yamlStr.split("\n")) {
     const kv = line.match(/^(\w+):\s*(.+)$/);
@@ -7564,7 +7595,9 @@ function listIdentities() {
     const summary = lines[0]?.trim().slice(0, 120) ?? identity.frontmatter.title;
     results.push({
       agentId,
-      title: `${identity.frontmatter.title} (${identity.frontmatter.role.toUpperCase()})`,
+      // User-facing/team-facing title only. `frontmatter.role` is internal
+      // routing metadata and must not leak as an external title.
+      title: identity.frontmatter.title,
       summary
     });
   }

package/dist/hooks/stop.js

@@ -3698,7 +3698,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path14 from "path";
-import { existsSync as existsSync12, mkdirSync as mkdirSync6, readdirSync as readdirSync3 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readdirSync as readdirSync3, renameSync as renameSync4, statSync as statSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -3720,7 +3720,7 @@ function getShardClient(projectName) {
   if (!_encryptionKey) {
     throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   if (!safeName || safeName === "unknown") {
     throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
   }
@@ -3742,9 +3742,12 @@ function getShardClient(projectName) {
   return client;
 }
 function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   return existsSync12(path14.join(SHARDS_DIR, `${safeName}.db`));
 }
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function listShards() {
   if (!existsSync12(SHARDS_DIR)) return [];
   return readdirSync3(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
@@ -3838,7 +3841,8 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN token_cost REAL",
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -3934,9 +3938,32 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+  const safeName = safeShardName(projectName);
+  let client = getShardClient(projectName);
+  try {
+    await ensureShardSchema(client);
+    return client;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/SQLITE_NOTADB|file is not a database/i.test(message)) throw err;
+    client.close();
+    _shards.delete(safeName);
+    _shardLastAccess.delete(safeName);
+    const dbPath = path14.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync12(dbPath)) {
+      const stat = statSync2(dbPath);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const archivedPath = path14.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      renameSync4(dbPath, archivedPath);
+      process.stderr.write(
+        `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
+`
+      );
+    }
+    client = getShardClient(projectName);
+    await ensureShardSchema(client);
+    return client;
+  }
 }
 function evictLRU() {
   let oldest = null;
@@ -4157,7 +4184,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 wiki, documents, and content",
         domain: "tool-use",
         priority: "p1",
-        content: "create_wiki_page: create a wiki page in exe-wiki. list_wiki_pages: browse wiki pages. get_wiki_page: read a wiki page. update_wiki_page: edit a wiki page. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
+        content: "wiki: read/list wiki pages only. Direct wiki write tools are removed; wiki updates flow through raw-data ingestion/projection into the curated wiki store. Legacy aliases: list_wiki_pages/get_wiki_page. crm: read/list/get CRM records from exe-db. raw_data: read capped raw landing-pad events from exe-db with payload opt-in. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
       },
       {
         title: "MCP tools \u2014 system, operations, and admin",
@@ -4175,7 +4202,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 advanced (triggers, skills, orchestration)",
         domain: "tool-use",
         priority: "p1",
-        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage Layer 0 procedures (actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
+        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage customer-owned company procedures (Layer 0; actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
       }
     ];
     PLATFORM_PROCEDURE_TITLES = new Set(
@@ -4941,7 +4968,7 @@ var init_fast_db_init = __esm({
 });
 
 // src/lib/memory-queue.ts
-import { appendFileSync as appendFileSync2, readFileSync as readFileSync11, renameSync as renameSync4, unlinkSync as unlinkSync4, existsSync as existsSync13, statSync as statSync2 } from "fs";
+import { appendFileSync as appendFileSync2, readFileSync as readFileSync11, renameSync as renameSync5, unlinkSync as unlinkSync4, existsSync as existsSync13, statSync as statSync3 } from "fs";
 import path15 from "path";
 function enqueueMemory(entry) {
   appendFileSync2(QUEUE_PATH2, JSON.stringify(entry) + "\n");

package/dist/hooks/subagent-stop.js

@@ -3679,7 +3679,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path14 from "path";
-import { existsSync as existsSync12, mkdirSync as mkdirSync6, readdirSync as readdirSync3 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readdirSync as readdirSync3, renameSync as renameSync4, statSync as statSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -3701,7 +3701,7 @@ function getShardClient(projectName) {
   if (!_encryptionKey) {
     throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   if (!safeName || safeName === "unknown") {
     throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
   }
@@ -3723,9 +3723,12 @@ function getShardClient(projectName) {
   return client;
 }
 function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   return existsSync12(path14.join(SHARDS_DIR, `${safeName}.db`));
 }
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function listShards() {
   if (!existsSync12(SHARDS_DIR)) return [];
   return readdirSync3(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
@@ -3819,7 +3822,8 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN token_cost REAL",
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -3915,9 +3919,32 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+  const safeName = safeShardName(projectName);
+  let client = getShardClient(projectName);
+  try {
+    await ensureShardSchema(client);
+    return client;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/SQLITE_NOTADB|file is not a database/i.test(message)) throw err;
+    client.close();
+    _shards.delete(safeName);
+    _shardLastAccess.delete(safeName);
+    const dbPath = path14.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync12(dbPath)) {
+      const stat = statSync2(dbPath);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const archivedPath = path14.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      renameSync4(dbPath, archivedPath);
+      process.stderr.write(
+        `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
+`
+      );
+    }
+    client = getShardClient(projectName);
+    await ensureShardSchema(client);
+    return client;
+  }
 }
 function evictLRU() {
   let oldest = null;
@@ -4138,7 +4165,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 wiki, documents, and content",
         domain: "tool-use",
         priority: "p1",
-        content: "create_wiki_page: create a wiki page in exe-wiki. list_wiki_pages: browse wiki pages. get_wiki_page: read a wiki page. update_wiki_page: edit a wiki page. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
+        content: "wiki: read/list wiki pages only. Direct wiki write tools are removed; wiki updates flow through raw-data ingestion/projection into the curated wiki store. Legacy aliases: list_wiki_pages/get_wiki_page. crm: read/list/get CRM records from exe-db. raw_data: read capped raw landing-pad events from exe-db with payload opt-in. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
       },
       {
         title: "MCP tools \u2014 system, operations, and admin",
@@ -4156,7 +4183,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 advanced (triggers, skills, orchestration)",
         domain: "tool-use",
         priority: "p1",
-        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage Layer 0 procedures (actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
+        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage customer-owned company procedures (Layer 0; actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
       }
     ];
     PLATFORM_PROCEDURE_TITLES = new Set(