@askexenow/exe-os 0.9.372 → 0.9.374

package/dist/{chunk-FB343XQX.js → chunk-DJ7YXOTU.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-75H4R62K.js";
 import {
   initStore
-} from "./chunk-OYQNNKNS.js";
+} from "./chunk-MXPNVSXI.js";
 import {
   getClient,
   isInitialized
-} from "./chunk-5DCCKHDY.js";
+} from "./chunk-TAMDAOCU.js";
 
 // src/lib/schedules.ts
 import crypto from "crypto";

package/dist/{chunk-YFCNWQAM.js → chunk-DJOIMFKV.js}

@@ -1,10 +1,10 @@
 import {
   registerScopedQueryChokepoint,
   scopedQueryChokepointStatus
-} from "./chunk-RUVO3NJC.js";
+} from "./chunk-IN6CAM4F.js";
 import {
   getClient
-} from "./chunk-5DCCKHDY.js";
+} from "./chunk-TAMDAOCU.js";
 
 // src/lib/org-scoped-rows.ts
 var SCOPED_QUERY_MAX_LIMIT = 200;

package/dist/{chunk-UTDMTQNH.js → chunk-DSJI76XL.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-YYB5PMTK.js";
 import {
   EXE_AI_DIR
-} from "./chunk-QMSEL5YS.js";
+} from "./chunk-ZIG7VPJV.js";
 
 // src/lib/db-backup.ts
-import { existsSync, readdirSync, unlinkSync, statSync, statfsSync } from "fs";
+import { existsSync, readdirSync, unlinkSync, statSync, statfsSync, appendFileSync } from "fs";
 import { copyFile, mkdir, unlink, rename } from "fs/promises";
 import { randomBytes } from "crypto";
 import path from "path";
@@ -192,7 +192,7 @@ async function quickCheckBackupSourceAfterCopy(reason, backupPath) {
       });
     }
   })();
-  const { recordDbIntegrityEvent } = await import("./db-integrity-events-5DTASXJF.js");
+  const { recordDbIntegrityEvent } = await import("./db-integrity-events-2DTFO37N.js");
   const backupName = path.basename(backupPath);
   const markUnverified = (detail) => {
     process.stderr.write(
@@ -205,7 +205,7 @@ async function quickCheckBackupSourceAfterCopy(reason, backupPath) {
   try {
     const { getClient } = await import("./lib/database.js");
     const client = getClient();
-    const { canTrustIntegrityVerdict } = await import("./fts-integrity-LKAZEZJE.js");
+    const { canTrustIntegrityVerdict } = await import("./fts-integrity-4YB34KWX.js");
     if (!await canTrustIntegrityVerdict(client)) {
       return markUnverified("connection is query_only; an FTS5 verdict from it is not trustworthy");
     }
@@ -350,6 +350,7 @@ async function createBackupAsync(reason = "manual", opts = {}) {
   const dbPath = findActiveDb();
   if (!dbPath) return null;
   await mkdir(BACKUP_DIR, { recursive: true });
+  let lowDisk = null;
   try {
     let dbSize = 0;
     try {
@@ -358,14 +359,26 @@ async function createBackupAsync(reason = "manual", opts = {}) {
     }
     const freeBytes = getFreeBytes(BACKUP_DIR);
     if (!hasEnoughDiskSpace(freeBytes, dbSize)) {
-      process.stderr.write(
-        `[db-backup] DISK GUARD: skipping "${reason}" backup \u2014 ${Math.round(freeBytes / 1024 / 1024)}MB free, need >${Math.round(Math.max(MIN_FREE_BYTES, dbSize * 2) / 1024 / 1024)}MB. Disk is nearly full; refusing to make it worse.
-`
-      );
-      return null;
+      lowDisk = { freeBytes, requiredBytes: requiredFreeBytes(dbSize) };
     }
   } catch {
   }
+  if (lowDisk) {
+    const skipping = lowDiskSkipAllowed(opts);
+    const message = lowDiskMessage(reason, lowDisk.freeBytes, lowDisk.requiredBytes, skipping);
+    process.stderr.write(`${message}
+`);
+    recordMissedBackup({
+      reason,
+      freeBytes: lowDisk.freeBytes,
+      requiredBytes: lowDisk.requiredBytes,
+      skipped: skipping,
+      message
+    });
+    alertMissedBackup(message, skipping);
+    if (!skipping) throw new BackupDiskSpaceError(message, { reason, ...lowDisk });
+    return null;
+  }
   const dbName = path.basename(dbPath, ".db");
   const backupName = `${dbName}-${reason}-${uniqueBackupSuffix()}.db`;
   const backupPath = path.join(BACKUP_DIR, backupName);
@@ -402,11 +415,11 @@ async function createBackupAsync(reason = "manual", opts = {}) {
     }
   }
   try {
-    const { manifestWriteEnabled, writeBackupManifest } = await import("./backup-verify-EX2K732J.js");
+    const { manifestWriteEnabled, writeBackupManifest } = await import("./backup-verify-ZKTUYLTA.js");
     if (manifestWriteEnabled()) {
       const manifest = await writeBackupManifest(backupPath, dbName);
       if (manifest && sourceStatus === "unverified") {
-        const { recordDbIntegrityEvent } = await import("./db-integrity-events-5DTASXJF.js");
+        const { recordDbIntegrityEvent } = await import("./db-integrity-events-2DTFO37N.js");
         recordDbIntegrityEvent({
           kind: "backup-verified",
           reason,
@@ -518,9 +531,67 @@ function cleanupStaleTmp(maxAgeMs = STALE_TMP_MAX_AGE_MS) {
   }
   return deleted;
 }
-function hasEnoughDiskSpace(freeBytes, backupSizeBytes, minFreeBytes = MIN_FREE_BYTES) {
-  const required = Math.max(minFreeBytes, backupSizeBytes * 2);
-  return freeBytes >= required;
+function hasEnoughDiskSpace(freeBytes, backupSizeBytes, minFreeBytes = minFreeFloorBytes()) {
+  return freeBytes >= Math.max(minFreeBytes, backupSizeBytes * 2);
+}
+function minFreeFloorBytes() {
+  const raw = Number(process.env.EXE_BACKUP_MIN_FREE_BYTES);
+  return Number.isFinite(raw) && raw > 0 ? raw : MIN_FREE_BYTES;
+}
+function requiredFreeBytes(backupSizeBytes, minFreeBytes = minFreeFloorBytes()) {
+  return Math.max(minFreeBytes, backupSizeBytes * 2);
+}
+var BackupDiskSpaceError = class extends Error {
+  code = "BACKUP_LOW_DISK";
+  reason;
+  freeBytes;
+  requiredBytes;
+  constructor(message, detail) {
+    super(message);
+    this.name = "BackupDiskSpaceError";
+    this.reason = detail.reason;
+    this.freeBytes = detail.freeBytes;
+    this.requiredBytes = detail.requiredBytes;
+  }
+};
+function lowDiskSkipAllowed(opts) {
+  if (opts?.allowSkipOnLowDisk === true) return true;
+  return ["1", "true", "yes"].includes(
+    (process.env.EXE_BACKUP_ALLOW_LOW_DISK_SKIP ?? "").trim().toLowerCase()
+  );
+}
+function mb(bytes) {
+  return Number.isFinite(bytes) ? `${Math.round(bytes / 1024 / 1024)}MB` : "unknown";
+}
+function lowDiskMessage(reason, freeBytes, requiredBytes, skipping) {
+  return `[db-backup] DISK GUARD: BACKUP NOT TAKEN ("${reason}") \u2014 ${mb(freeBytes)} free, need >${mb(requiredBytes)}. ` + (skipping ? "Skip explicitly authorized (allowSkipOnLowDisk/EXE_BACKUP_ALLOW_LOW_DISK_SKIP); " : "") + "This machine is NOT being backed up until disk space is freed.";
+}
+function missedBackupLogPath() {
+  return path.join(EXE_AI_DIR, "missed-backups.jsonl");
+}
+function recordMissedBackup(entry) {
+  try {
+    appendFileSync(
+      missedBackupLogPath(),
+      `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), cause: "low_disk", ...entry })}
+`
+    );
+  } catch {
+  }
+}
+function alertMissedBackup(message, skipped) {
+  void (async () => {
+    try {
+      const { pushNotifyAsync } = await import("./push-notifications-NCZLH6DI.js");
+      pushNotifyAsync({
+        event: "backup_failed",
+        title: skipped ? "Backup SKIPPED \u2014 disk full" : "Backup FAILED \u2014 disk full",
+        body: message,
+        priority: "urgent"
+      });
+    } catch {
+    }
+  })();
 }
 function backupMinFreeRatio() {
   const raw = Number(process.env.EXE_BACKUP_MIN_FREE_RATIO);
@@ -847,6 +918,13 @@ export {
   selectStaleTmpFiles,
   cleanupStaleTmp,
   hasEnoughDiskSpace,
+  minFreeFloorBytes,
+  requiredFreeBytes,
+  BackupDiskSpaceError,
+  lowDiskSkipAllowed,
+  lowDiskMessage,
+  missedBackupLogPath,
+  recordMissedBackup,
   backupMinFreeRatio,
   shouldSkipBackupUnderMemoryPressure,
   rotateBackupsByReason,

package/dist/{chunk-EEXX4UMQ.js → chunk-DZKPOSFD.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-5DCCKHDY.js";
+} from "./chunk-TAMDAOCU.js";
 
 // src/lib/token-budget.ts
 var WARN_THRESHOLD = 0.8;

package/dist/{chunk-WSOA3WMC.js → chunk-E426DOSY.js}

@@ -1,19 +1,167 @@
+import {
+  getMasterKey
+} from "./chunk-HPXFKUGU.js";
 import {
   PRIVATE_DIR_MODE,
   PRIVATE_FILE_MODE,
+  enforcePrivateFileSync,
   ensurePrivateDirSync
 } from "./chunk-HSGBZSCA.js";
 
 // src/gateway/adapters/whatsapp.ts
 import { randomUUID } from "crypto";
 import { homedir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 import { chmodSync, lstatSync, readdirSync } from "fs";
+
+// src/lib/whatsapp-auth-store.ts
+import crypto from "crypto";
+import { readFile, writeFile, unlink, readdir } from "fs/promises";
+import { join } from "path";
+var ALGORITHM = "aes-256-gcm";
+var IV_LENGTH = 12;
+var TAG_LENGTH = 16;
+var ENC_PREFIX = "enc:";
+var HKDF_INFO = "exe-whatsapp-auth-v1";
+function deriveWhatsAppAuthKey(masterKey) {
+  if (masterKey.length !== 32) {
+    throw new Error(`Master key must be 32 bytes, got ${masterKey.length}`);
+  }
+  return Buffer.from(crypto.hkdfSync("sha256", masterKey, "", HKDF_INFO, 32));
+}
+function encryptString(plaintext, key) {
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([
+    cipher.update(Buffer.from(plaintext, "utf-8")),
+    cipher.final()
+  ]);
+  const tag = cipher.getAuthTag();
+  return ENC_PREFIX + Buffer.concat([iv, encrypted, tag]).toString("base64");
+}
+function decryptString(content, key) {
+  if (!content.startsWith(ENC_PREFIX)) {
+    return content;
+  }
+  const combined = Buffer.from(content.slice(ENC_PREFIX.length), "base64");
+  if (combined.length < IV_LENGTH + TAG_LENGTH) {
+    throw new Error("WhatsApp auth blob too short");
+  }
+  const iv = combined.subarray(0, IV_LENGTH);
+  const tag = combined.subarray(combined.length - TAG_LENGTH);
+  const body = combined.subarray(IV_LENGTH, combined.length - TAG_LENGTH);
+  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([
+    decipher.update(body),
+    decipher.final()
+  ]).toString("utf-8");
+}
+async function migratePlaintextAuthFiles(folder, key) {
+  let files;
+  try {
+    files = await readdir(folder);
+  } catch {
+    return 0;
+  }
+  let migrated = 0;
+  for (const file of files) {
+    if (!file.endsWith(".json")) continue;
+    const filePath = join(folder, file);
+    try {
+      const raw = await readFile(filePath, "utf-8");
+      if (raw.startsWith(ENC_PREFIX)) continue;
+      await writeFile(filePath, encryptString(raw, key), "utf-8");
+      enforcePrivateFileSync(filePath);
+      migrated++;
+    } catch {
+    }
+  }
+  return migrated;
+}
+var fileLocks = /* @__PURE__ */ new Map();
+function withFileLock(filePath, fn) {
+  const prev = fileLocks.get(filePath) ?? Promise.resolve();
+  const next = prev.then(fn, fn);
+  fileLocks.set(filePath, next.catch(() => {
+  }));
+  return next;
+}
+async function useEncryptedMultiFileAuthState(folder, key) {
+  ensurePrivateDirSync(folder);
+  await migratePlaintextAuthFiles(folder, key);
+  const baileys = await import("@whiskeysockets/baileys");
+  const { initAuthCreds, BufferJSON, proto } = baileys;
+  const fixFileName = (file) => file?.replace(/\//g, "__")?.replace(/:/g, "-");
+  const writeData = async (data, file) => {
+    const filePath = join(folder, fixFileName(file));
+    await withFileLock(filePath, async () => {
+      const serialized = JSON.stringify(data, BufferJSON.replacer);
+      await writeFile(filePath, encryptString(serialized, key), "utf-8");
+      enforcePrivateFileSync(filePath);
+    });
+  };
+  const readData = async (file) => {
+    const filePath = join(folder, fixFileName(file));
+    try {
+      return await withFileLock(filePath, async () => {
+        const raw = await readFile(filePath, "utf-8");
+        return JSON.parse(decryptString(raw, key), BufferJSON.reviver);
+      });
+    } catch {
+      return null;
+    }
+  };
+  const removeData = async (file) => {
+    const filePath = join(folder, fixFileName(file));
+    await withFileLock(filePath, async () => {
+      try {
+        await unlink(filePath);
+      } catch {
+      }
+    });
+  };
+  const creds = await readData("creds.json") || initAuthCreds();
+  return {
+    state: {
+      creds,
+      keys: {
+        get: async (type, ids) => {
+          const data = {};
+          await Promise.all(ids.map(async (id) => {
+            let value = await readData(`${type}-${id}.json`);
+            if (type === "app-state-sync-key" && value) {
+              value = proto.Message.AppStateSyncKeyData.fromObject(value);
+            }
+            data[id] = value;
+          }));
+          return data;
+        },
+        set: async (data) => {
+          const tasks = [];
+          for (const category in data) {
+            for (const id in data[category]) {
+              const value = data[category][id];
+              const file = `${category}-${id}.json`;
+              tasks.push(value ? writeData(value, file) : removeData(file));
+            }
+          }
+          await Promise.all(tasks);
+        }
+      }
+    },
+    saveCreds: async () => {
+      await writeData(creds, "creds.json");
+    }
+  };
+}
+
+// src/gateway/adapters/whatsapp.ts
 var INITIAL_BACKOFF_MS = 1e3;
 var MAX_BACKOFF_MS = 3e5;
 var BACKOFF_MULTIPLIER = 2;
 var JITTER_FACTOR = 0.25;
-var AUTH_DIR = join(homedir(), ".exe-os", "whatsapp-auth");
+var AUTH_DIR = join2(homedir(), ".exe-os", "whatsapp-auth");
 function createBaileysLogger(accountName) {
   const prefix = accountName ? `[whatsapp:${accountName}]` : "[whatsapp]";
   const logger = {
@@ -49,7 +197,7 @@ function hardenBaileysAuthState(authDir) {
       return;
     }
     for (const entry of entries) {
-      const child = join(dir, entry);
+      const child = join2(dir, entry);
       let stat;
       try {
         stat = lstatSync(child);
@@ -91,7 +239,16 @@ var WhatsAppAdapter = class {
     hardenBaileysAuthState(this.authDir);
     const baileys = await import("@whiskeysockets/baileys");
     const { makeWASocket, useMultiFileAuthState, fetchLatestBaileysVersion, DisconnectReason, makeCacheableSignalKeyStore } = baileys;
-    const { state, saveCreds } = await useMultiFileAuthState(this.authDir);
+    const masterKey = await getMasterKey();
+    let state;
+    let saveCreds;
+    if (masterKey) {
+      const authKey = deriveWhatsAppAuthKey(masterKey);
+      ({ state, saveCreds } = await useEncryptedMultiFileAuthState(this.authDir, authKey));
+    } else {
+      console.error("[whatsapp] WARNING: no master key available \u2014 WhatsApp auth credentials will be stored WITHOUT encryption at rest (file permissions only). Run exe-os setup to enable the keychain.");
+      ({ state, saveCreds } = await useMultiFileAuthState(this.authDir));
+    }
     hardenBaileysAuthState(this.authDir);
     const { version } = await fetchLatestBaileysVersion();
     this.baileysLogger = createBaileysLogger();

package/dist/{chunk-ZISQOOER.js → chunk-EKE37MO4.js}

@@ -1,15 +1,15 @@
 import {
   storeBehavior
-} from "./chunk-MBNIJXKI.js";
+} from "./chunk-WMEYJT4R.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-VGMACSEV.js";
 import {
   getClient
-} from "./chunk-5DCCKHDY.js";
+} from "./chunk-TAMDAOCU.js";
 import {
   loadConfig
-} from "./chunk-QMSEL5YS.js";
+} from "./chunk-ZIG7VPJV.js";
 
 // src/lib/skill-learning.ts
 import crypto from "crypto";

package/dist/{chunk-RIECV7SR.js → chunk-EKYYMIVT.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-QMSEL5YS.js";
+} from "./chunk-ZIG7VPJV.js";
 import {
   enforcePrivateFileSync,
   ensurePrivateDirSync

package/dist/{chunk-HIVZ53YB.js → chunk-EXTZSNWL.js}

@@ -1,10 +1,10 @@
 import {
   PLATFORM_PROCEDURES,
   PLATFORM_PROCEDURE_TITLES
-} from "./chunk-THIJIOE2.js";
+} from "./chunk-PY3FOMRN.js";
 import {
   getClient
-} from "./chunk-5DCCKHDY.js";
+} from "./chunk-TAMDAOCU.js";
 
 // src/lib/global-procedures.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-YYA5LXCT.js → chunk-FNEZ4BWT.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-QMSEL5YS.js";
+} from "./chunk-ZIG7VPJV.js";
 
 // src/lib/mcp-transport-health.ts
 import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, writeFileSync } from "fs";