@askexenow/exe-os 0.9.38 → 0.9.39

package/dist/lib/exe-daemon.js

@@ -727,7 +727,8 @@ function isMultiInstance(agentName, employees) {
   return MULTI_INSTANCE_ROLES.has(emp.role.toLowerCase());
 }
 function addEmployee(employees, employee) {
-  const normalized = { ...employee, name: employee.name.toLowerCase() };
+  const { systemPrompt: _legacyPrompt, ...rest } = employee;
+  const normalized = { ...rest, name: employee.name.toLowerCase() };
   if (employees.some((e) => e.name.toLowerCase() === normalized.name)) {
     throw new Error(`Employee '${normalized.name}' already exists`);
   }
@@ -3646,7 +3647,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path9 from "path";
-import { existsSync as existsSync9, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -3668,7 +3669,7 @@ function getShardClient(projectName) {
   if (!_encryptionKey) {
     throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   if (!safeName || safeName === "unknown") {
     throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
   }
@@ -3690,9 +3691,12 @@ function getShardClient(projectName) {
   return client;
 }
 function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   return existsSync9(path9.join(SHARDS_DIR, `${safeName}.db`));
 }
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function listShards() {
   if (!existsSync9(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
@@ -3786,7 +3790,8 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN token_cost REAL",
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -3882,9 +3887,32 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+  const safeName = safeShardName(projectName);
+  let client = getShardClient(projectName);
+  try {
+    await ensureShardSchema(client);
+    return client;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/SQLITE_NOTADB|file is not a database/i.test(message)) throw err;
+    client.close();
+    _shards.delete(safeName);
+    _shardLastAccess.delete(safeName);
+    const dbPath = path9.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync9(dbPath)) {
+      const stat = statSync2(dbPath);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const archivedPath = path9.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      renameSync3(dbPath, archivedPath);
+      process.stderr.write(
+        `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
+`
+      );
+    }
+    client = getShardClient(projectName);
+    await ensureShardSchema(client);
+    return client;
+  }
 }
 function evictLRU() {
   let oldest = null;
@@ -5178,7 +5206,7 @@ __export(memory_queue_exports, {
   enqueueMemory: () => enqueueMemory,
   queueDepth: () => queueDepth
 });
-import { appendFileSync, readFileSync as readFileSync7, renameSync as renameSync3, unlinkSync as unlinkSync3, existsSync as existsSync11, statSync as statSync2 } from "fs";
+import { appendFileSync, readFileSync as readFileSync7, renameSync as renameSync4, unlinkSync as unlinkSync3, existsSync as existsSync11, statSync as statSync3 } from "fs";
 import path11 from "path";
 function enqueueMemory(entry) {
   appendFileSync(QUEUE_PATH, JSON.stringify(entry) + "\n");
@@ -5194,13 +5222,13 @@ function drainQueue() {
   }
   if (!existsSync11(QUEUE_PATH)) return entries;
   try {
-    const stat = statSync2(QUEUE_PATH);
+    const stat = statSync3(QUEUE_PATH);
     if (stat.size === 0) return entries;
   } catch {
     return entries;
   }
   try {
-    renameSync3(QUEUE_PATH, PROCESSING_PATH);
+    renameSync4(QUEUE_PATH, PROCESSING_PATH);
   } catch {
     return entries;
   }
@@ -5661,7 +5689,7 @@ __export(file_grep_exports, {
   grepProjectFiles: () => grepProjectFiles
 });
 import { execSync as execSync4 } from "child_process";
-import { readFileSync as readFileSync8, readdirSync as readdirSync2, statSync as statSync3, existsSync as existsSync13 } from "fs";
+import { readFileSync as readFileSync8, readdirSync as readdirSync2, statSync as statSync4, existsSync as existsSync13 } from "fs";
 import path14 from "path";
 import crypto3 from "crypto";
 function hasRipgrep() {
@@ -5778,7 +5806,7 @@ function grepWithNodeFs(pattern, projectRoot, patterns) {
   for (const filePath of files.slice(0, MAX_FILES)) {
     const absPath = path14.join(projectRoot, filePath);
     try {
-      const stat = statSync3(absPath);
+      const stat = statSync4(absPath);
       if (stat.size > MAX_FILE_SIZE) continue;
       const content = readFileSync8(absPath, "utf8");
       const lines = content.split("\n");
@@ -7349,6 +7377,12 @@ var init_active_agent = __esm({
 
 // src/mcp/tools/recall-my-memory.ts
 import { z } from "zod";
+function formatMemoryBody(rawText, maxChars) {
+  if (rawText.length <= maxChars) return rawText;
+  const marker = ` \u2026 [truncated; +${rawText.length - maxChars} chars \u2014 re-call with max_chars up to 20000 for more]`;
+  const sliceLen = Math.max(0, maxChars - marker.length);
+  return `${rawText.slice(0, sliceLen)}${marker}`;
+}
 function formatSourceLine(record) {
   const doc2 = record.document_metadata;
   if (!doc2) return "";
@@ -7374,6 +7408,7 @@ function registerRecallMyMemory(server) {
         has_error: z.boolean().optional().describe("Filter for error-containing memories"),
         tool_name: z.string().optional().describe("Filter by tool name (Bash, Write, etc)"),
         limit: z.coerce.number().optional().default(10).describe("Max results to return"),
+        max_chars: z.coerce.number().int().min(100).max(2e4).optional().default(2e3).describe("Max characters to include per memory result. Use a higher value for canonical plans/runbooks."),
         since: z.string().optional().describe("ISO 8601 timestamp \u2014 only return memories at or after this time"),
         include_archived: z.boolean().optional().default(false).describe(
           "Include deprecated (archived) memories alongside active ones. Default false."
@@ -7395,6 +7430,7 @@ function registerRecallMyMemory(server) {
       has_error,
       tool_name,
       limit,
+      max_chars,
       since,
       include_archived,
       workspace_id,
@@ -7440,7 +7476,7 @@ function registerRecallMyMemory(server) {
         }
         const formatted = results.map((r) => {
           const header = `[${r.timestamp}] ${r.tool_name} (${r.project_name})${r.has_error ? " [ERROR]" : ""}`;
-          const body = r.raw_text.slice(0, 500);
+          const body = formatMemoryBody(r.raw_text, max_chars ?? 2e3);
           const parts = [header];
           if (r.source_path) {
             const typeTag = r.source_type && r.source_type !== "text" ? ` [${r.source_type}]` : "";
@@ -7485,6 +7521,12 @@ var init_recall_my_memory = __esm({
 
 // src/mcp/tools/ask-team-memory.ts
 import { z as z2 } from "zod";
+function formatMemoryBody2(rawText, maxChars) {
+  if (rawText.length <= maxChars) return rawText;
+  const marker = ` \u2026 [truncated; +${rawText.length - maxChars} chars \u2014 re-call with max_chars up to 20000 for more]`;
+  const sliceLen = Math.max(0, maxChars - marker.length);
+  return `${rawText.slice(0, sliceLen)}${marker}`;
+}
 function canSeeRaw(queryingRole, targetRole) {
   if (queryingRole === "COO") return true;
   if (queryingRole === "CTO" && [
@@ -7509,6 +7551,7 @@ function registerAskTeamMemory(server) {
         query: z2.string().describe("What to search for"),
         project_name: z2.string().optional().describe("Filter by project name"),
         limit: z2.coerce.number().optional().default(10).describe("Max results to return"),
+        max_chars: z2.coerce.number().int().min(100).max(2e4).optional().default(2e3).describe("Max characters to include per memory result. Use a higher value for canonical plans/runbooks."),
         since: z2.string().optional().describe("ISO 8601 timestamp \u2014 only return memories at or after this time"),
         include_archived: z2.boolean().optional().default(false).describe(
           "Include deprecated (archived) memories alongside active ones. Default false."
@@ -7519,7 +7562,7 @@ function registerAskTeamMemory(server) {
         retrieval_mode: z2.enum(RETRIEVAL_MODES).optional().default("all").describe(`Typed retrieval mode. Raw visibility is still ACL-gated. ${formatRetrievalModes()}`)
       }
     },
-    async ({ team_member, query, project_name, limit, since, include_archived, include_raw: _include_raw, retrieval_mode }) => {
+    async ({ team_member, query, project_name, limit, max_chars, since, include_archived, include_raw: _include_raw, retrieval_mode }) => {
       try {
         const { agentId: queryingAgentId, agentRole: queryingAgentRole } = getActiveAgent();
         const employees = loadEmployeesSync();
@@ -7552,7 +7595,7 @@ function registerAskTeamMemory(server) {
         }
         const formatted = results.map(
           (r) => `[${r.timestamp}] ${r.tool_name} (${r.project_name})${r.has_error ? " [ERROR]" : ""}
-${r.raw_text.slice(0, 500)}`
+${formatMemoryBody2(r.raw_text, max_chars ?? 2e3)}`
         ).join("\n\n---\n\n");
         return {
           content: [
@@ -7830,8 +7873,8 @@ async function validateLicense(apiKey, deviceId) {
 }
 function getCacheAgeMs() {
   try {
-    const { statSync: statSync7 } = __require("fs");
-    const s = statSync7(CACHE_PATH);
+    const { statSync: statSync8 } = __require("fs");
+    const s = statSync8(CACHE_PATH);
     return Date.now() - s.mtimeMs;
   } catch {
     return Infinity;
@@ -8395,7 +8438,8 @@ var init_wiki_client = __esm({
 // src/lib/unified-search.ts
 function truncate(text3, max) {
   if (text3.length <= max) return text3;
-  return text3.slice(0, max - 1) + "\u2026";
+  const marker = ` \u2026 [truncated; +${text3.length - max} chars]`;
+  return text3.slice(0, Math.max(0, max - marker.length)) + marker;
 }
 async function searchMemories2(query, agentId, limit) {
   const { hybridSearch: hybridSearch2 } = await Promise.resolve().then(() => (init_hybrid_search(), hybrid_search_exports));
@@ -8631,6 +8675,12 @@ var init_search_everything = __esm({
 
 // src/mcp/tools/get-session-context.ts
 import { z as z6 } from "zod";
+function formatMemoryBody3(rawText, maxChars) {
+  if (rawText.length <= maxChars) return rawText;
+  const marker = ` \u2026 [truncated; +${rawText.length - maxChars} chars \u2014 re-call with max_chars up to 20000 for more]`;
+  const sliceLen = Math.max(0, maxChars - marker.length);
+  return `${rawText.slice(0, sliceLen)}${marker}`;
+}
 function registerGetSessionContext(server) {
   server.registerTool(
     "get_session_context",
@@ -8642,10 +8692,11 @@ function registerGetSessionContext(server) {
         target_timestamp: z6.string().describe(
           "ISO 8601 timestamp to center the context window around"
         ),
-        window_size: z6.number().optional().default(3).describe("Number of memories before and after the target")
+        window_size: z6.number().optional().default(3).describe("Number of memories before and after the target"),
+        max_chars: z6.coerce.number().int().min(100).max(2e4).optional().default(2e3).describe("Max characters to include per memory result.")
       }
     },
-    async ({ session_id, target_timestamp, window_size }) => {
+    async ({ session_id, target_timestamp, window_size, max_chars }) => {
       const client = getClient();
       const result = await client.execute({
         sql: `SELECT id, agent_id, agent_role, session_id, timestamp,
@@ -8691,7 +8742,7 @@ function registerGetSessionContext(server) {
       const windowMemories = sorted.slice(start, end);
       const formatted = windowMemories.map(
         (r) => `[${r.timestamp}] ${r.tool_name} (${r.project_name})${r.has_error ? " [ERROR]" : ""}
-${r.raw_text.slice(0, 500)}`
+${formatMemoryBody3(r.raw_text, max_chars ?? 2e3)}`
       ).join("\n\n---\n\n");
       return {
         content: [
@@ -9837,7 +9888,7 @@ __export(intercom_queue_exports, {
   queueIntercom: () => queueIntercom,
   readQueue: () => readQueue
 });
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync10, renameSync as renameSync4, existsSync as existsSync17, mkdirSync as mkdirSync6 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync10, renameSync as renameSync5, existsSync as existsSync17, mkdirSync as mkdirSync6 } from "fs";
 import path21 from "path";
 import os9 from "os";
 function ensureDir() {
@@ -9856,7 +9907,7 @@ function writeQueue(queue) {
   ensureDir();
   const tmp = `${QUEUE_PATH2}.tmp`;
   writeFileSync10(tmp, JSON.stringify(queue, null, 2));
-  renameSync4(tmp, QUEUE_PATH2);
+  renameSync5(tmp, QUEUE_PATH2);
 }
 function queueIntercom(targetSession, reason) {
   const queue = readQueue();
@@ -12987,6 +13038,9 @@ function ensureDir2() {
 function identityPath(agentId) {
   return path28.join(IDENTITY_DIR2, `${agentId}.md`);
 }
+function sanitizeIdentityBody(body) {
+  return body.replace(/<!--[\s\S]*?-->/g, "").trim();
+}
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
   if (!match) {
@@ -12999,11 +13053,11 @@ function parseFrontmatter(raw) {
         created_by: "system",
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       },
-      body: raw
+      body: sanitizeIdentityBody(raw)
     };
   }
   const yamlStr = match[1];
-  const body = match[2].trim();
+  const body = sanitizeIdentityBody(match[2]);
   const fm = {};
   for (const line of yamlStr.split("\n")) {
     const kv = line.match(/^(\w+):\s*(.+)$/);
@@ -13068,7 +13122,9 @@ function listIdentities() {
     const summary = lines[0]?.trim().slice(0, 120) ?? identity.frontmatter.title;
     results.push({
       agentId,
-      title: `${identity.frontmatter.title} (${identity.frontmatter.role.toUpperCase()})`,
+      // User-facing/team-facing title only. `frontmatter.role` is internal
+      // routing metadata and must not leak as an external title.
+      title: identity.frontmatter.title,
       summary
     });
   }
@@ -13859,6 +13915,40 @@ var init_list_tasks = __esm({
 
 // src/mcp/tools/get-task.ts
 import { z as z13 } from "zod";
+async function diagnoseMissingTask(client, identifier) {
+  const shortUuid = /^[a-f0-9]{7,12}$/i.test(identifier);
+  const args = [];
+  const clauses = [];
+  if (shortUuid) {
+    clauses.push("id LIKE ?");
+    args.push(`${identifier}%`);
+  }
+  clauses.push("task_file LIKE ?");
+  args.push(`%${identifier}%`);
+  clauses.push("title LIKE ?");
+  args.push(`%${identifier}%`);
+  const result = await client.execute({
+    sql: `SELECT id, title, status, assigned_to, project_name, session_scope, task_file
+            FROM tasks
+           WHERE ${clauses.map((c) => `(${c})`).join(" OR ")}
+           ORDER BY updated_at DESC
+           LIMIT 10`,
+    args
+  });
+  if (result.rows.length === 0) return null;
+  const scoped = sessionScopeFilter();
+  const scopeNote = scoped.args.length > 0 ? `Current session scope appears to be ${String(scoped.args[0])}. get_task is session-scoped by default.` : "No current session scope detected.";
+  const matches = result.rows.map((r) => {
+    const id = String(r.id);
+    return `- ${id.slice(0, 8)} ${String(r.title)} [${String(r.status)}] assigned_to=${String(r.assigned_to)} project=${String(r.project_name)} session_scope=${String(r.session_scope ?? "NULL")}`;
+  }).join("\n");
+  return `Task not found in the current scoped lookup, but similar task rows exist. ${scopeNote}
+
+Matches across all scopes/statuses:
+${matches}
+
+Use the full UUID from the matching row, switch to the owning coordinator session, or list tasks with the correct project/session scope.`;
+}
 function registerGetTask(server) {
   server.registerTool(
     "get_task",
@@ -13871,7 +13961,16 @@ function registerGetTask(server) {
     },
     async ({ task_id }) => {
       const client = getClient();
-      const row = await resolveTask(client, task_id);
+      let row;
+      try {
+        row = await resolveTask(client, task_id);
+      } catch (err) {
+        const fallback = await diagnoseMissingTask(client, task_id);
+        if (fallback) {
+          return { content: [{ type: "text", text: fallback }], isError: true };
+        }
+        throw err;
+      }
       const contextText = row.context ? String(row.context) : "";
       const hasEmbeddedMandatoryReminder = contextText.includes('update_task with status "done"') || contextText.includes("update_task(done)");
       const lines = [
@@ -13967,6 +14066,7 @@ var init_get_task = __esm({
     "use strict";
     init_tasks();
     init_database();
+    init_task_scope();
     init_employees();
   }
 });
@@ -19513,7 +19613,7 @@ var init_import_orchestration = __esm({
 
 // src/mcp/tools/load-skill.ts
 import { z as z50 } from "zod";
-import { readFileSync as readFileSync23, readdirSync as readdirSync9, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync23, readdirSync as readdirSync9, statSync as statSync5 } from "fs";
 import path35 from "path";
 import { homedir as homedir2 } from "os";
 function listAvailableSkills() {
@@ -19522,9 +19622,9 @@ function listAvailableSkills() {
     return entries.filter((entry) => {
       try {
         const entryPath = path35.join(SKILLS_DIR, entry);
-        if (!statSync4(entryPath).isDirectory()) return false;
+        if (!statSync5(entryPath).isDirectory()) return false;
         const skillFile = path35.join(entryPath, "SKILL.md");
-        statSync4(skillFile);
+        statSync5(skillFile);
         return true;
       } catch {
         return false;
@@ -22954,7 +23054,7 @@ __export(db_backup_exports, {
   listBackups: () => listBackups,
   rotateBackups: () => rotateBackups
 });
-import { copyFileSync as copyFileSync2, existsSync as existsSync33, mkdirSync as mkdirSync15, readdirSync as readdirSync12, unlinkSync as unlinkSync10, statSync as statSync5 } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync33, mkdirSync as mkdirSync15, readdirSync as readdirSync12, unlinkSync as unlinkSync10, statSync as statSync6 } from "fs";
 import path41 from "path";
 function findActiveDb() {
   for (const name of DB_NAMES) {
@@ -22998,7 +23098,7 @@ function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
       if (!file.endsWith(".db") && !file.endsWith(".db-wal") && !file.endsWith(".db-shm")) continue;
       const filePath = path41.join(BACKUP_DIR, file);
       try {
-        const stat = statSync5(filePath);
+        const stat = statSync6(filePath);
         if (stat.mtimeMs < cutoff) {
           unlinkSync10(filePath);
           deleted++;
@@ -23016,7 +23116,7 @@ function listBackups() {
     const files = readdirSync12(BACKUP_DIR).filter((f) => f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm"));
     return files.map((name) => {
       const p = path41.join(BACKUP_DIR, name);
-      const stat = statSync5(p);
+      const stat = statSync6(p);
       return { path: p, name, size: stat.size, date: stat.mtime };
     }).sort((a, b) => b.date.getTime() - a.date.getTime());
   } catch {
@@ -23982,7 +24082,7 @@ __export(cloud_sync_exports, {
   pushToPostgres: () => pushToPostgres,
   recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync29, writeFileSync as writeFileSync21, existsSync as existsSync36, readdirSync as readdirSync13, mkdirSync as mkdirSync17, appendFileSync as appendFileSync3, unlinkSync as unlinkSync12, openSync as openSync2, closeSync as closeSync2, statSync as statSync6 } from "fs";
+import { readFileSync as readFileSync29, writeFileSync as writeFileSync21, existsSync as existsSync36, readdirSync as readdirSync13, mkdirSync as mkdirSync17, appendFileSync as appendFileSync3, unlinkSync as unlinkSync12, openSync as openSync2, closeSync as closeSync2, statSync as statSync7 } from "fs";
 import crypto18 from "crypto";
 import path44 from "path";
 import { homedir as homedir6 } from "os";
@@ -24474,7 +24574,7 @@ async function cloudSync(config2) {
     const { getLatestBackup: getLatestBackup2 } = await Promise.resolve().then(() => (init_db_backup(), db_backup_exports));
     const latestBackup = getLatestBackup2();
     if (latestBackup) {
-      const backupSize = statSync6(latestBackup).size;
+      const backupSize = statSync7(latestBackup).size;
       const MAX_CLOUD_BACKUP_BYTES = 50 * 1024 * 1024;
       if (backupSize <= MAX_CLOUD_BACKUP_BYTES) {
         const backupData = readFileSync29(latestBackup);

package/dist/lib/hybrid-search.js

@@ -3238,7 +3238,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path7 from "path";
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -3260,7 +3260,7 @@ function getShardClient(projectName) {
   if (!_encryptionKey) {
     throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   if (!safeName || safeName === "unknown") {
     throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
   }
@@ -3282,9 +3282,12 @@ function getShardClient(projectName) {
   return client;
 }
 function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   return existsSync7(path7.join(SHARDS_DIR, `${safeName}.db`));
 }
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function listShards() {
   if (!existsSync7(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
@@ -3378,7 +3381,8 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN token_cost REAL",
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -3474,9 +3478,32 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+  const safeName = safeShardName(projectName);
+  let client = getShardClient(projectName);
+  try {
+    await ensureShardSchema(client);
+    return client;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/SQLITE_NOTADB|file is not a database/i.test(message)) throw err;
+    client.close();
+    _shards.delete(safeName);
+    _shardLastAccess.delete(safeName);
+    const dbPath = path7.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync7(dbPath)) {
+      const stat = statSync2(dbPath);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const archivedPath = path7.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      renameSync3(dbPath, archivedPath);
+      process.stderr.write(
+        `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
+`
+      );
+    }
+    client = getShardClient(projectName);
+    await ensureShardSchema(client);
+    return client;
+  }
 }
 function evictLRU() {
   let oldest = null;
@@ -4751,7 +4778,7 @@ __export(file_grep_exports, {
   grepProjectFiles: () => grepProjectFiles
 });
 import { execSync as execSync4 } from "child_process";
-import { readFileSync as readFileSync5, readdirSync as readdirSync2, statSync as statSync2, existsSync as existsSync9 } from "fs";
+import { readFileSync as readFileSync5, readdirSync as readdirSync2, statSync as statSync3, existsSync as existsSync9 } from "fs";
 import path10 from "path";
 import crypto2 from "crypto";
 function hasRipgrep() {
@@ -4868,7 +4895,7 @@ function grepWithNodeFs(pattern, projectRoot, patterns) {
   for (const filePath of files.slice(0, MAX_FILES)) {
     const absPath = path10.join(projectRoot, filePath);
     try {
-      const stat = statSync2(absPath);
+      const stat = statSync3(absPath);
       if (stat.size > MAX_FILE_SIZE) continue;
       const content = readFileSync5(absPath, "utf8");
       const lines = content.split("\n");

package/dist/lib/identity.js

@@ -169,6 +169,9 @@ function ensureDir() {
 function identityPath(agentId) {
   return path4.join(IDENTITY_DIR2, `${agentId}.md`);
 }
+function sanitizeIdentityBody(body) {
+  return body.replace(/<!--[\s\S]*?-->/g, "").trim();
+}
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
   if (!match) {
@@ -181,11 +184,11 @@ function parseFrontmatter(raw) {
         created_by: "system",
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       },
-      body: raw
+      body: sanitizeIdentityBody(raw)
     };
   }
   const yamlStr = match[1];
-  const body = match[2].trim();
+  const body = sanitizeIdentityBody(match[2]);
   const fm = {};
   for (const line of yamlStr.split("\n")) {
     const kv = line.match(/^(\w+):\s*(.+)$/);
@@ -250,7 +253,9 @@ function listIdentities() {
     const summary = lines[0]?.trim().slice(0, 120) ?? identity.frontmatter.title;
     results.push({
       agentId,
-      title: `${identity.frontmatter.title} (${identity.frontmatter.role.toUpperCase()})`,
+      // User-facing/team-facing title only. `frontmatter.role` is internal
+      // routing metadata and must not leak as an external title.
+      title: identity.frontmatter.title,
       summary
     });
   }

package/dist/lib/schedules.js

@@ -2600,7 +2600,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path7 from "path";
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -2622,7 +2622,7 @@ function getShardClient(projectName) {
   if (!_encryptionKey) {
     throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   if (!safeName || safeName === "unknown") {
     throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
   }
@@ -2644,9 +2644,12 @@ function getShardClient(projectName) {
   return client;
 }
 function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   return existsSync7(path7.join(SHARDS_DIR, `${safeName}.db`));
 }
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function listShards() {
   if (!existsSync7(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
@@ -2740,7 +2743,8 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN token_cost REAL",
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -2836,9 +2840,32 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+  const safeName = safeShardName(projectName);
+  let client = getShardClient(projectName);
+  try {
+    await ensureShardSchema(client);
+    return client;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/SQLITE_NOTADB|file is not a database/i.test(message)) throw err;
+    client.close();
+    _shards.delete(safeName);
+    _shardLastAccess.delete(safeName);
+    const dbPath = path7.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync7(dbPath)) {
+      const stat = statSync2(dbPath);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const archivedPath = path7.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      renameSync3(dbPath, archivedPath);
+      process.stderr.write(
+        `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
+`
+      );
+    }
+    client = getShardClient(projectName);
+    await ensureShardSchema(client);
+    return client;
+  }
 }
 function evictLRU() {
   let oldest = null;