@askexenow/exe-os 0.9.38 → 0.9.39

package/dist/lib/store.js

@@ -2600,7 +2600,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path7 from "path";
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -2622,7 +2622,7 @@ function getShardClient(projectName) {
   if (!_encryptionKey) {
     throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   if (!safeName || safeName === "unknown") {
     throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
   }
@@ -2644,9 +2644,12 @@ function getShardClient(projectName) {
   return client;
 }
 function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   return existsSync7(path7.join(SHARDS_DIR, `${safeName}.db`));
 }
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function listShards() {
   if (!existsSync7(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
@@ -2740,7 +2743,8 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN token_cost REAL",
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -2836,9 +2840,32 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+  const safeName = safeShardName(projectName);
+  let client = getShardClient(projectName);
+  try {
+    await ensureShardSchema(client);
+    return client;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/SQLITE_NOTADB|file is not a database/i.test(message)) throw err;
+    client.close();
+    _shards.delete(safeName);
+    _shardLastAccess.delete(safeName);
+    const dbPath = path7.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync7(dbPath)) {
+      const stat = statSync2(dbPath);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const archivedPath = path7.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      renameSync3(dbPath, archivedPath);
+      process.stderr.write(
+        `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
+`
+      );
+    }
+    client = getShardClient(projectName);
+    await ensureShardSchema(client);
+    return client;
+  }
 }
 function evictLRU() {
   let oldest = null;

package/dist/mcp/server.js

@@ -1171,7 +1171,8 @@ function isMultiInstance(agentName, employees) {
   return MULTI_INSTANCE_ROLES.has(emp.role.toLowerCase());
 }
 function addEmployee(employees, employee) {
-  const normalized = { ...employee, name: employee.name.toLowerCase() };
+  const { systemPrompt: _legacyPrompt, ...rest } = employee;
+  const normalized = { ...rest, name: employee.name.toLowerCase() };
   if (employees.some((e) => e.name.toLowerCase() === normalized.name)) {
     throw new Error(`Employee '${normalized.name}' already exists`);
   }
@@ -3797,7 +3798,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path8 from "path";
-import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -3819,7 +3820,7 @@ function getShardClient(projectName) {
   if (!_encryptionKey) {
     throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   if (!safeName || safeName === "unknown") {
     throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
   }
@@ -3841,9 +3842,12 @@ function getShardClient(projectName) {
   return client;
 }
 function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   return existsSync8(path8.join(SHARDS_DIR, `${safeName}.db`));
 }
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function listShards() {
   if (!existsSync8(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
@@ -3937,7 +3941,8 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN token_cost REAL",
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -4033,9 +4038,32 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+  const safeName = safeShardName(projectName);
+  let client = getShardClient(projectName);
+  try {
+    await ensureShardSchema(client);
+    return client;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/SQLITE_NOTADB|file is not a database/i.test(message)) throw err;
+    client.close();
+    _shards.delete(safeName);
+    _shardLastAccess.delete(safeName);
+    const dbPath = path8.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync8(dbPath)) {
+      const stat = statSync2(dbPath);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const archivedPath = path8.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      renameSync3(dbPath, archivedPath);
+      process.stderr.write(
+        `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
+`
+      );
+    }
+    client = getShardClient(projectName);
+    await ensureShardSchema(client);
+    return client;
+  }
 }
 function evictLRU() {
   let oldest = null;
@@ -5242,7 +5270,7 @@ __export(file_grep_exports, {
   grepProjectFiles: () => grepProjectFiles
 });
 import { execSync as execSync4 } from "child_process";
-import { readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync2, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3, existsSync as existsSync10 } from "fs";
 import path11 from "path";
 import crypto2 from "crypto";
 function hasRipgrep() {
@@ -5359,7 +5387,7 @@ function grepWithNodeFs(pattern, projectRoot, patterns) {
   for (const filePath of files.slice(0, MAX_FILES)) {
     const absPath = path11.join(projectRoot, filePath);
     try {
-      const stat = statSync2(absPath);
+      const stat = statSync3(absPath);
       if (stat.size > MAX_FILE_SIZE) continue;
       const content = readFileSync6(absPath, "utf8");
       const lines = content.split("\n");
@@ -7181,8 +7209,8 @@ async function validateLicense(apiKey, deviceId) {
 }
 function getCacheAgeMs() {
   try {
-    const { statSync: statSync6 } = __require("fs");
-    const s = statSync6(CACHE_PATH);
+    const { statSync: statSync7 } = __require("fs");
+    const s = statSync7(CACHE_PATH);
     return Date.now() - s.mtimeMs;
   } catch {
     return Infinity;
@@ -8293,7 +8321,7 @@ __export(intercom_queue_exports, {
   queueIntercom: () => queueIntercom,
   readQueue: () => readQueue
 });
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync9, renameSync as renameSync3, existsSync as existsSync14, mkdirSync as mkdirSync6 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync9, renameSync as renameSync4, existsSync as existsSync14, mkdirSync as mkdirSync6 } from "fs";
 import path18 from "path";
 import os8 from "os";
 function ensureDir() {
@@ -8312,7 +8340,7 @@ function writeQueue(queue) {
   ensureDir();
   const tmp = `${QUEUE_PATH}.tmp`;
   writeFileSync9(tmp, JSON.stringify(queue, null, 2));
-  renameSync3(tmp, QUEUE_PATH);
+  renameSync4(tmp, QUEUE_PATH);
 }
 function queueIntercom(targetSession, reason) {
   const queue = readQueue();
@@ -11397,6 +11425,9 @@ function ensureDir2() {
 function identityPath(agentId) {
   return path25.join(IDENTITY_DIR2, `${agentId}.md`);
 }
+function sanitizeIdentityBody(body) {
+  return body.replace(/<!--[\s\S]*?-->/g, "").trim();
+}
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
   if (!match) {
@@ -11409,11 +11440,11 @@ function parseFrontmatter(raw) {
         created_by: "system",
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       },
-      body: raw
+      body: sanitizeIdentityBody(raw)
     };
   }
   const yamlStr = match[1];
-  const body = match[2].trim();
+  const body = sanitizeIdentityBody(match[2]);
   const fm = {};
   for (const line of yamlStr.split("\n")) {
     const kv = line.match(/^(\w+):\s*(.+)$/);
@@ -11478,7 +11509,9 @@ function listIdentities() {
     const summary = lines[0]?.trim().slice(0, 120) ?? identity.frontmatter.title;
     results.push({
       agentId,
-      title: `${identity.frontmatter.title} (${identity.frontmatter.role.toUpperCase()})`,
+      // User-facing/team-facing title only. `frontmatter.role` is internal
+      // routing metadata and must not leak as an external title.
+      title: identity.frontmatter.title,
       summary
     });
   }
@@ -12369,7 +12402,7 @@ __export(db_backup_exports, {
   listBackups: () => listBackups,
   rotateBackups: () => rotateBackups
 });
-import { copyFileSync as copyFileSync2, existsSync as existsSync29, mkdirSync as mkdirSync15, readdirSync as readdirSync12, unlinkSync as unlinkSync9, statSync as statSync4 } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync29, mkdirSync as mkdirSync15, readdirSync as readdirSync12, unlinkSync as unlinkSync9, statSync as statSync5 } from "fs";
 import path37 from "path";
 function findActiveDb() {
   for (const name of DB_NAMES) {
@@ -12413,7 +12446,7 @@ function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
       if (!file.endsWith(".db") && !file.endsWith(".db-wal") && !file.endsWith(".db-shm")) continue;
       const filePath = path37.join(BACKUP_DIR, file);
       try {
-        const stat = statSync4(filePath);
+        const stat = statSync5(filePath);
         if (stat.mtimeMs < cutoff) {
           unlinkSync9(filePath);
           deleted++;
@@ -12431,7 +12464,7 @@ function listBackups() {
     const files = readdirSync12(BACKUP_DIR).filter((f) => f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm"));
     return files.map((name) => {
       const p = path37.join(BACKUP_DIR, name);
-      const stat = statSync4(p);
+      const stat = statSync5(p);
       return { path: p, name, size: stat.size, date: stat.mtime };
     }).sort((a, b) => b.date.getTime() - a.date.getTime());
   } catch {
@@ -12762,6 +12795,12 @@ init_hybrid_search();
 init_store();
 init_active_agent();
 import { z } from "zod";
+function formatMemoryBody(rawText, maxChars) {
+  if (rawText.length <= maxChars) return rawText;
+  const marker = ` \u2026 [truncated; +${rawText.length - maxChars} chars \u2014 re-call with max_chars up to 20000 for more]`;
+  const sliceLen = Math.max(0, maxChars - marker.length);
+  return `${rawText.slice(0, sliceLen)}${marker}`;
+}
 function formatSourceLine(record) {
   const doc2 = record.document_metadata;
   if (!doc2) return "";
@@ -12787,6 +12826,7 @@ function registerRecallMyMemory(server2) {
         has_error: z.boolean().optional().describe("Filter for error-containing memories"),
         tool_name: z.string().optional().describe("Filter by tool name (Bash, Write, etc)"),
         limit: z.coerce.number().optional().default(10).describe("Max results to return"),
+        max_chars: z.coerce.number().int().min(100).max(2e4).optional().default(2e3).describe("Max characters to include per memory result. Use a higher value for canonical plans/runbooks."),
         since: z.string().optional().describe("ISO 8601 timestamp \u2014 only return memories at or after this time"),
         include_archived: z.boolean().optional().default(false).describe(
           "Include deprecated (archived) memories alongside active ones. Default false."
@@ -12808,6 +12848,7 @@ function registerRecallMyMemory(server2) {
       has_error,
       tool_name,
       limit,
+      max_chars,
       since,
       include_archived,
       workspace_id,
@@ -12853,7 +12894,7 @@ function registerRecallMyMemory(server2) {
         }
         const formatted = results.map((r) => {
           const header = `[${r.timestamp}] ${r.tool_name} (${r.project_name})${r.has_error ? " [ERROR]" : ""}`;
-          const body = r.raw_text.slice(0, 500);
+          const body = formatMemoryBody(r.raw_text, max_chars ?? 2e3);
           const parts = [header];
           if (r.source_path) {
             const typeTag = r.source_type && r.source_type !== "text" ? ` [${r.source_type}]` : "";
@@ -12892,6 +12933,12 @@ init_hybrid_search();
 init_active_agent();
 init_employees();
 import { z as z2 } from "zod";
+function formatMemoryBody2(rawText, maxChars) {
+  if (rawText.length <= maxChars) return rawText;
+  const marker = ` \u2026 [truncated; +${rawText.length - maxChars} chars \u2014 re-call with max_chars up to 20000 for more]`;
+  const sliceLen = Math.max(0, maxChars - marker.length);
+  return `${rawText.slice(0, sliceLen)}${marker}`;
+}
 function canSeeRaw(queryingRole, targetRole) {
   if (queryingRole === "COO") return true;
   if (queryingRole === "CTO" && [
@@ -12916,6 +12963,7 @@ function registerAskTeamMemory(server2) {
         query: z2.string().describe("What to search for"),
         project_name: z2.string().optional().describe("Filter by project name"),
         limit: z2.coerce.number().optional().default(10).describe("Max results to return"),
+        max_chars: z2.coerce.number().int().min(100).max(2e4).optional().default(2e3).describe("Max characters to include per memory result. Use a higher value for canonical plans/runbooks."),
         since: z2.string().optional().describe("ISO 8601 timestamp \u2014 only return memories at or after this time"),
         include_archived: z2.boolean().optional().default(false).describe(
           "Include deprecated (archived) memories alongside active ones. Default false."
@@ -12926,7 +12974,7 @@ function registerAskTeamMemory(server2) {
         retrieval_mode: z2.enum(RETRIEVAL_MODES).optional().default("all").describe(`Typed retrieval mode. Raw visibility is still ACL-gated. ${formatRetrievalModes()}`)
       }
     },
-    async ({ team_member, query, project_name, limit, since, include_archived, include_raw: _include_raw, retrieval_mode }) => {
+    async ({ team_member, query, project_name, limit, max_chars, since, include_archived, include_raw: _include_raw, retrieval_mode }) => {
       try {
         const { agentId: queryingAgentId, agentRole: queryingAgentRole } = getActiveAgent();
         const employees = loadEmployeesSync();
@@ -12959,7 +13007,7 @@ function registerAskTeamMemory(server2) {
         }
         const formatted = results.map(
           (r) => `[${r.timestamp}] ${r.tool_name} (${r.project_name})${r.has_error ? " [ERROR]" : ""}
-${r.raw_text.slice(0, 500)}`
+${formatMemoryBody2(r.raw_text, max_chars ?? 2e3)}`
         ).join("\n\n---\n\n");
         return {
           content: [
@@ -13201,7 +13249,8 @@ var MAX_SNIPPET = 500;
 var ALL_SOURCES = ["memory", "conversations", "wiki"];
 function truncate(text3, max) {
   if (text3.length <= max) return text3;
-  return text3.slice(0, max - 1) + "\u2026";
+  const marker = ` \u2026 [truncated; +${text3.length - max} chars]`;
+  return text3.slice(0, Math.max(0, max - marker.length)) + marker;
 }
 async function searchMemories2(query, agentId, limit) {
   const { hybridSearch: hybridSearch2 } = await Promise.resolve().then(() => (init_hybrid_search(), hybrid_search_exports));
@@ -13422,6 +13471,12 @@ ${formatted.join("\n\n---\n\n")}`
 // src/mcp/tools/get-session-context.ts
 init_database();
 import { z as z6 } from "zod";
+function formatMemoryBody3(rawText, maxChars) {
+  if (rawText.length <= maxChars) return rawText;
+  const marker = ` \u2026 [truncated; +${rawText.length - maxChars} chars \u2014 re-call with max_chars up to 20000 for more]`;
+  const sliceLen = Math.max(0, maxChars - marker.length);
+  return `${rawText.slice(0, sliceLen)}${marker}`;
+}
 function registerGetSessionContext(server2) {
   server2.registerTool(
     "get_session_context",
@@ -13433,10 +13488,11 @@ function registerGetSessionContext(server2) {
         target_timestamp: z6.string().describe(
           "ISO 8601 timestamp to center the context window around"
         ),
-        window_size: z6.number().optional().default(3).describe("Number of memories before and after the target")
+        window_size: z6.number().optional().default(3).describe("Number of memories before and after the target"),
+        max_chars: z6.coerce.number().int().min(100).max(2e4).optional().default(2e3).describe("Max characters to include per memory result.")
       }
     },
-    async ({ session_id, target_timestamp, window_size }) => {
+    async ({ session_id, target_timestamp, window_size, max_chars }) => {
       const client = getClient();
       const result = await client.execute({
         sql: `SELECT id, agent_id, agent_role, session_id, timestamp,
@@ -13482,7 +13538,7 @@ function registerGetSessionContext(server2) {
       const windowMemories = sorted.slice(start, end);
       const formatted = windowMemories.map(
         (r) => `[${r.timestamp}] ${r.tool_name} (${r.project_name})${r.has_error ? " [ERROR]" : ""}
-${r.raw_text.slice(0, 500)}`
+${formatMemoryBody3(r.raw_text, max_chars ?? 2e3)}`
       ).join("\n\n---\n\n");
       return {
         content: [
@@ -14117,8 +14173,43 @@ ${lines.join("\n")}`
 // src/mcp/tools/get-task.ts
 init_tasks();
 init_database();
+init_task_scope();
 init_employees();
 import { z as z13 } from "zod";
+async function diagnoseMissingTask(client, identifier) {
+  const shortUuid = /^[a-f0-9]{7,12}$/i.test(identifier);
+  const args = [];
+  const clauses = [];
+  if (shortUuid) {
+    clauses.push("id LIKE ?");
+    args.push(`${identifier}%`);
+  }
+  clauses.push("task_file LIKE ?");
+  args.push(`%${identifier}%`);
+  clauses.push("title LIKE ?");
+  args.push(`%${identifier}%`);
+  const result = await client.execute({
+    sql: `SELECT id, title, status, assigned_to, project_name, session_scope, task_file
+            FROM tasks
+           WHERE ${clauses.map((c) => `(${c})`).join(" OR ")}
+           ORDER BY updated_at DESC
+           LIMIT 10`,
+    args
+  });
+  if (result.rows.length === 0) return null;
+  const scoped = sessionScopeFilter();
+  const scopeNote = scoped.args.length > 0 ? `Current session scope appears to be ${String(scoped.args[0])}. get_task is session-scoped by default.` : "No current session scope detected.";
+  const matches = result.rows.map((r) => {
+    const id = String(r.id);
+    return `- ${id.slice(0, 8)} ${String(r.title)} [${String(r.status)}] assigned_to=${String(r.assigned_to)} project=${String(r.project_name)} session_scope=${String(r.session_scope ?? "NULL")}`;
+  }).join("\n");
+  return `Task not found in the current scoped lookup, but similar task rows exist. ${scopeNote}
+
+Matches across all scopes/statuses:
+${matches}
+
+Use the full UUID from the matching row, switch to the owning coordinator session, or list tasks with the correct project/session scope.`;
+}
 function registerGetTask(server2) {
   server2.registerTool(
     "get_task",
@@ -14131,7 +14222,16 @@ function registerGetTask(server2) {
     },
     async ({ task_id }) => {
       const client = getClient();
-      const row = await resolveTask(client, task_id);
+      let row;
+      try {
+        row = await resolveTask(client, task_id);
+      } catch (err) {
+        const fallback = await diagnoseMissingTask(client, task_id);
+        if (fallback) {
+          return { content: [{ type: "text", text: fallback }], isError: true };
+        }
+        throw err;
+      }
       const contextText = row.context ? String(row.context) : "";
       const hasEmbeddedMandatoryReminder = contextText.includes('update_task with status "done"') || contextText.includes("update_task(done)");
       const lines = [
@@ -18568,7 +18668,7 @@ function registerImportOrchestration(server2) {
 
 // src/mcp/tools/load-skill.ts
 import { z as z50 } from "zod";
-import { readFileSync as readFileSync21, readdirSync as readdirSync9, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync21, readdirSync as readdirSync9, statSync as statSync4 } from "fs";
 import path32 from "path";
 import { homedir as homedir2 } from "os";
 var SKILLS_DIR = path32.join(homedir2(), ".claude", "skills");
@@ -18578,9 +18678,9 @@ function listAvailableSkills() {
     return entries.filter((entry) => {
       try {
         const entryPath = path32.join(SKILLS_DIR, entry);
-        if (!statSync3(entryPath).isDirectory()) return false;
+        if (!statSync4(entryPath).isDirectory()) return false;
         const skillFile = path32.join(entryPath, "SKILL.md");
-        statSync3(skillFile);
+        statSync4(skillFile);
         return true;
       } catch {
         return false;
@@ -21392,7 +21492,7 @@ import { z as z70 } from "zod";
 
 // src/lib/cloud-sync.ts
 init_database();
-import { readFileSync as readFileSync26, writeFileSync as writeFileSync20, existsSync as existsSync32, readdirSync as readdirSync13, mkdirSync as mkdirSync17, appendFileSync as appendFileSync2, unlinkSync as unlinkSync11, openSync as openSync2, closeSync as closeSync2, statSync as statSync5 } from "fs";
+import { readFileSync as readFileSync26, writeFileSync as writeFileSync20, existsSync as existsSync32, readdirSync as readdirSync13, mkdirSync as mkdirSync17, appendFileSync as appendFileSync2, unlinkSync as unlinkSync11, openSync as openSync2, closeSync as closeSync2, statSync as statSync6 } from "fs";
 import crypto17 from "crypto";
 import path40 from "path";
 import { homedir as homedir6 } from "os";
@@ -21959,7 +22059,7 @@ async function cloudSync(config2) {
     const { getLatestBackup: getLatestBackup2 } = await Promise.resolve().then(() => (init_db_backup(), db_backup_exports));
     const latestBackup = getLatestBackup2();
     if (latestBackup) {
-      const backupSize = statSync5(latestBackup).size;
+      const backupSize = statSync6(latestBackup).size;
       const MAX_CLOUD_BACKUP_BYTES = 50 * 1024 * 1024;
       if (backupSize <= MAX_CLOUD_BACKUP_BYTES) {
         const backupData = readFileSync26(latestBackup);

package/dist/mcp/tools/create-task.js

@@ -546,7 +546,8 @@ function isMultiInstance(agentName, employees) {
   return MULTI_INSTANCE_ROLES.has(emp.role.toLowerCase());
 }
 function addEmployee(employees, employee) {
-  const normalized = { ...employee, name: employee.name.toLowerCase() };
+  const { systemPrompt: _legacyPrompt, ...rest } = employee;
+  const normalized = { ...rest, name: employee.name.toLowerCase() };
   if (employees.some((e) => e.name.toLowerCase() === normalized.name)) {
     throw new Error(`Employee '${normalized.name}' already exists`);
   }
@@ -4808,6 +4809,9 @@ function ensureDir2() {
 function identityPath(agentId) {
   return path19.join(IDENTITY_DIR2, `${agentId}.md`);
 }
+function sanitizeIdentityBody(body) {
+  return body.replace(/<!--[\s\S]*?-->/g, "").trim();
+}
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
   if (!match) {
@@ -4820,11 +4824,11 @@ function parseFrontmatter(raw) {
         created_by: "system",
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       },
-      body: raw
+      body: sanitizeIdentityBody(raw)
     };
   }
   const yamlStr = match[1];
-  const body = match[2].trim();
+  const body = sanitizeIdentityBody(match[2]);
   const fm = {};
   for (const line of yamlStr.split("\n")) {
     const kv = line.match(/^(\w+):\s*(.+)$/);
@@ -4889,7 +4893,9 @@ function listIdentities() {
     const summary = lines[0]?.trim().slice(0, 120) ?? identity.frontmatter.title;
     results.push({
       agentId,
-      title: `${identity.frontmatter.title} (${identity.frontmatter.role.toUpperCase()})`,
+      // User-facing/team-facing title only. `frontmatter.role` is internal
+      // routing metadata and must not leak as an external title.
+      title: identity.frontmatter.title,
       summary
     });
   }

package/dist/runtime/index.js

@@ -6984,7 +6984,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path20 from "path";
-import { existsSync as existsSync16, mkdirSync as mkdirSync7, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync7, readdirSync as readdirSync4, renameSync as renameSync4, statSync as statSync2 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -7006,7 +7006,7 @@ function getShardClient(projectName) {
   if (!_encryptionKey) {
     throw new Error("Shard manager not initialized. Call initShardManager() first.");
   }
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   if (!safeName || safeName === "unknown") {
     throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
   }
@@ -7028,9 +7028,12 @@ function getShardClient(projectName) {
   return client;
 }
 function shardExists(projectName) {
-  const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const safeName = safeShardName(projectName);
   return existsSync16(path20.join(SHARDS_DIR, `${safeName}.db`));
 }
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function listShards() {
   if (!existsSync16(SHARDS_DIR)) return [];
   return readdirSync4(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
@@ -7124,7 +7127,8 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN token_cost REAL",
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT"
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
   ]) {
     try {
       await client.execute(col);
@@ -7220,9 +7224,32 @@ async function ensureShardSchema(client) {
   }
 }
 async function getReadyShardClient(projectName) {
-  const client = getShardClient(projectName);
-  await ensureShardSchema(client);
-  return client;
+  const safeName = safeShardName(projectName);
+  let client = getShardClient(projectName);
+  try {
+    await ensureShardSchema(client);
+    return client;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/SQLITE_NOTADB|file is not a database/i.test(message)) throw err;
+    client.close();
+    _shards.delete(safeName);
+    _shardLastAccess.delete(safeName);
+    const dbPath = path20.join(SHARDS_DIR, `${safeName}.db`);
+    if (existsSync16(dbPath)) {
+      const stat = statSync2(dbPath);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const archivedPath = path20.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
+      renameSync4(dbPath, archivedPath);
+      process.stderr.write(
+        `[shard-manager] Archived unreadable shard ${safeName}: ${archivedPath} (${stat.size} bytes, mtime ${stat.mtime.toISOString()})
+`
+      );
+    }
+    client = getShardClient(projectName);
+    await ensureShardSchema(client);
+    return client;
+  }
 }
 function evictLRU() {
   let oldest = null;