@askexenow/exe-os 0.9.60 → 0.9.62

package/dist/bin/cli.js

@@ -258,8 +258,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 150,
-          returnTopK: 5
+          fetchTopK: 200,
+          returnTopK: 20
         }
       },
       graphRagEnabled: true,
@@ -810,6 +810,48 @@ var init_preferences = __esm({
   }
 });
 
+// src/adapters/runtime-hook-manifest.ts
+function commandHasAnyMarker(command, markers) {
+  return markers.some((marker) => command.includes(marker));
+}
+function isLegacySplitPostToolCommand(command) {
+  return commandHasAnyMarker(command, LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS);
+}
+function textHasLegacySplitPostToolHook(text) {
+  return [EXE_HOOK_FILES.ingest, EXE_HOOK_FILES.errorRecall, EXE_HOOK_FILES.ingestWorker].some((file) => text.includes(file));
+}
+var EXE_HOOK_FILES, EXE_HOOKS, LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS;
+var init_runtime_hook_manifest = __esm({
+  "src/adapters/runtime-hook-manifest.ts"() {
+    "use strict";
+    EXE_HOOK_FILES = {
+      postToolCombined: "post-tool-combined.js",
+      ingest: "ingest.js",
+      errorRecall: "error-recall.js",
+      ingestWorker: "ingest-worker.js"
+    };
+    EXE_HOOKS = {
+      postToolCombined: "dist/hooks/post-tool-combined.js",
+      sessionStart: "dist/hooks/session-start.js",
+      promptSubmit: "dist/hooks/prompt-submit.js",
+      heartbeat: "dist/hooks/exe-heartbeat-hook.js",
+      stop: "dist/hooks/stop.js",
+      preToolUse: "dist/hooks/pre-tool-use.js",
+      subagentStop: "dist/hooks/subagent-stop.js",
+      preCompact: "dist/hooks/pre-compact.js",
+      postCompact: "dist/hooks/post-compact.js",
+      sessionEnd: "dist/hooks/session-end.js",
+      notification: "dist/hooks/notification.js",
+      instructionsLoaded: "dist/hooks/instructions-loaded.js"
+    };
+    LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS = [
+      "dist/hooks/ingest.js",
+      "dist/hooks/error-recall.js",
+      "dist/hooks/ingest-worker.js"
+    ];
+  }
+});
+
 // src/adapters/claude/installer.ts
 var installer_exports = {};
 __export(installer_exports, {
@@ -1132,7 +1174,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/post-tool-combined.js"
+      marker: EXE_HOOKS.postToolCombined
     },
     {
       event: "SessionStart",
@@ -1145,7 +1187,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/session-start.js"
+      marker: EXE_HOOKS.sessionStart
     },
     {
       event: "UserPromptSubmit",
@@ -1157,7 +1199,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/prompt-submit.js"
+      marker: EXE_HOOKS.promptSubmit
     },
     {
       event: "UserPromptSubmit",
@@ -1170,7 +1212,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/exe-heartbeat-hook.js"
+      marker: EXE_HOOKS.heartbeat
     },
     {
       event: "Stop",
@@ -1182,7 +1224,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/stop.js"
+      marker: EXE_HOOKS.stop
     },
     {
       event: "PreToolUse",
@@ -1195,7 +1237,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/pre-tool-use.js"
+      marker: EXE_HOOKS.preToolUse
     },
     {
       event: "SubagentStop",
@@ -1207,7 +1249,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/subagent-stop.js"
+      marker: EXE_HOOKS.subagentStop
     },
     {
       event: "PreCompact",
@@ -1220,7 +1262,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/pre-compact.js"
+      marker: EXE_HOOKS.preCompact
     },
     {
       event: "SessionEnd",
@@ -1232,7 +1274,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/session-end.js"
+      marker: EXE_HOOKS.sessionEnd
     },
     {
       event: "Notification",
@@ -1244,7 +1286,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/notification.js"
+      marker: EXE_HOOKS.notification
     },
     {
       event: "PostCompact",
@@ -1257,7 +1299,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/post-compact.js"
+      marker: EXE_HOOKS.postCompact
     },
     {
       event: "InstructionsLoaded",
@@ -1269,21 +1311,16 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/instructions-loaded.js"
+      marker: EXE_HOOKS.instructionsLoaded
     }
   ];
   let added = 0;
   let skipped = 0;
-  const legacyPostToolMarkers = [
-    "dist/hooks/ingest.js",
-    "dist/hooks/error-recall.js",
-    "dist/hooks/ingest-worker.js"
-  ];
   const postToolGroups = settings.hooks["PostToolUse"];
   if (Array.isArray(postToolGroups)) {
     settings.hooks["PostToolUse"] = postToolGroups.map((g) => ({
       ...g,
-      hooks: g.hooks.filter((h) => !legacyPostToolMarkers.some((marker) => h.command.includes(marker)))
+      hooks: g.hooks.filter((h) => !isLegacySplitPostToolCommand(h.command))
     })).filter((g) => g.hooks.length > 0);
   }
   for (const { event, group, marker } of hooksToRegister) {
@@ -1760,6 +1797,7 @@ var init_installer = __esm({
     init_agent_symlinks();
     init_mcp_prefix();
     init_preferences();
+    init_runtime_hook_manifest();
     EXE_SECTION_START = "<!-- exe-os:orchestration-start -->";
     EXE_SECTION_END = "<!-- exe-os:orchestration-end -->";
     ORCHESTRATION_RULES = `${EXE_SECTION_START}
@@ -4306,7 +4344,7 @@ async function ensureSchema() {
       ON session_kills(agent_id);
   `);
   await client.execute(`
-    CREATE TABLE IF NOT EXISTS global_procedures (
+    CREATE TABLE IF NOT EXISTS company_procedures (
       id TEXT PRIMARY KEY,
       title TEXT NOT NULL,
       content TEXT NOT NULL,
@@ -4317,6 +4355,73 @@ async function ensureSchema() {
       updated_at TEXT NOT NULL
     )
   `);
+  const legacyProcedureObject = await client.execute({
+    sql: "SELECT type FROM sqlite_master WHERE name = 'global_procedures'",
+    args: []
+  });
+  const legacyProcedureType = legacyProcedureObject.rows[0]?.type == null ? null : String(legacyProcedureObject.rows[0].type);
+  if (legacyProcedureType === "table") {
+    await client.execute(`
+      INSERT OR IGNORE INTO company_procedures
+        (id, title, content, priority, domain, active, created_at, updated_at)
+      SELECT id, title, content, priority, domain, active, created_at, updated_at
+      FROM global_procedures
+    `);
+    await client.executeMultiple(`
+      CREATE TRIGGER IF NOT EXISTS global_procedures_mirror_insert
+        AFTER INSERT ON global_procedures
+      BEGIN
+        INSERT OR IGNORE INTO company_procedures
+          (id, title, content, priority, domain, active, created_at, updated_at)
+        VALUES
+          (NEW.id, NEW.title, NEW.content, NEW.priority, NEW.domain, NEW.active, NEW.created_at, NEW.updated_at);
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS global_procedures_mirror_update
+        AFTER UPDATE ON global_procedures
+      BEGIN
+        UPDATE company_procedures
+        SET title = NEW.title,
+            content = NEW.content,
+            priority = NEW.priority,
+            domain = NEW.domain,
+            active = NEW.active,
+            created_at = NEW.created_at,
+            updated_at = NEW.updated_at
+        WHERE id = OLD.id;
+      END;
+    `);
+  } else {
+    await client.execute(`
+      CREATE VIEW IF NOT EXISTS global_procedures AS
+      SELECT id, title, content, priority, domain, active, created_at, updated_at
+      FROM company_procedures
+    `);
+    await client.executeMultiple(`
+      CREATE TRIGGER IF NOT EXISTS global_procedures_insert
+        INSTEAD OF INSERT ON global_procedures
+      BEGIN
+        INSERT INTO company_procedures
+          (id, title, content, priority, domain, active, created_at, updated_at)
+        VALUES
+          (NEW.id, NEW.title, NEW.content, NEW.priority, NEW.domain, NEW.active, NEW.created_at, NEW.updated_at);
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS global_procedures_update
+        INSTEAD OF UPDATE ON global_procedures
+      BEGIN
+        UPDATE company_procedures
+        SET title = NEW.title,
+            content = NEW.content,
+            priority = NEW.priority,
+            domain = NEW.domain,
+            active = NEW.active,
+            created_at = NEW.created_at,
+            updated_at = NEW.updated_at
+        WHERE id = OLD.id;
+      END;
+    `);
+  }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS conversations (
       id              TEXT PRIMARY KEY,
@@ -4456,6 +4561,51 @@ async function ensureSchema() {
       VALUES (new.rowid, new.content_text, new.sender_name, new.agent_response);
     END;
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS memory_cards (
+      id            TEXT PRIMARY KEY,
+      memory_id     TEXT NOT NULL,
+      agent_id      TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      project_name  TEXT,
+      timestamp     TEXT NOT NULL,
+      card_type     TEXT NOT NULL,
+      subject       TEXT,
+      predicate     TEXT,
+      object        TEXT,
+      content       TEXT NOT NULL,
+      source_ref    TEXT,
+      confidence    REAL DEFAULT 0.6,
+      active        INTEGER DEFAULT 1,
+      created_at    TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_memory_cards_agent
+      ON memory_cards(agent_id, active, timestamp);
+
+    CREATE INDEX IF NOT EXISTS idx_memory_cards_memory
+      ON memory_cards(memory_id);
+
+    CREATE VIRTUAL TABLE IF NOT EXISTS memory_cards_fts
+      USING fts5(content, subject, predicate, object, content='memory_cards', content_rowid='rowid');
+
+    CREATE TRIGGER IF NOT EXISTS memory_cards_fts_ai AFTER INSERT ON memory_cards BEGIN
+      INSERT INTO memory_cards_fts(rowid, content, subject, predicate, object)
+      VALUES (new.rowid, new.content, new.subject, new.predicate, new.object);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memory_cards_fts_ad AFTER DELETE ON memory_cards BEGIN
+      INSERT INTO memory_cards_fts(memory_cards_fts, rowid, content, subject, predicate, object)
+      VALUES('delete', old.rowid, old.content, old.subject, old.predicate, old.object);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memory_cards_fts_au AFTER UPDATE ON memory_cards BEGIN
+      INSERT INTO memory_cards_fts(memory_cards_fts, rowid, content, subject, predicate, object)
+      VALUES('delete', old.rowid, old.content, old.subject, old.predicate, old.object);
+      INSERT INTO memory_cards_fts(rowid, content, subject, predicate, object)
+      VALUES (new.rowid, new.content, new.subject, new.predicate, new.object);
+    END;
+  `);
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3`,
@@ -5904,12 +6054,12 @@ async function cloudSync(config) {
   try {
     await cloudPushGlobalProcedures(config);
   } catch (err) {
-    logError(`[cloud-sync] Global procedures push: ${err instanceof Error ? err.message : String(err)}`);
+    logError(`[cloud-sync] Company procedures push: ${err instanceof Error ? err.message : String(err)}`);
   }
   try {
     await cloudPullGlobalProcedures(config);
   } catch (err) {
-    logError(`[cloud-sync] Global procedures pull: ${err instanceof Error ? err.message : String(err)}`);
+    logError(`[cloud-sync] Company procedures pull: ${err instanceof Error ? err.message : String(err)}`);
   }
   const countRows = async (sql) => {
     try {
@@ -6318,12 +6468,12 @@ async function cloudPullBlob(route, config) {
 }
 async function cloudPushGlobalProcedures(config) {
   const client = getClient();
-  const result = await client.execute("SELECT * FROM global_procedures LIMIT 1000");
+  const result = await client.execute("SELECT * FROM company_procedures LIMIT 1000");
   const rows = result.rows;
   const { ok } = await cloudPushBlob(
     "/sync/push-global-procedures",
     rows,
-    "last_global_procedures_push_version",
+    "last_company_procedures_push_version",
     config
   );
   return ok;
@@ -6336,7 +6486,7 @@ async function cloudPullGlobalProcedures(config) {
   if (!remoteProcs || remoteProcs.length === 0) return { pulled: 0 };
   const client = getClient();
   const stmts = remoteProcs.map((p) => ({
-    sql: `INSERT INTO global_procedures
+    sql: `INSERT INTO company_procedures
           (id, title, content, priority, domain, active, created_at, updated_at)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?)
           ON CONFLICT(id) DO UPDATE SET
@@ -6346,7 +6496,7 @@ async function cloudPullGlobalProcedures(config) {
             domain = excluded.domain,
             active = excluded.active,
             updated_at = excluded.updated_at
-          WHERE excluded.updated_at > global_procedures.updated_at`,
+          WHERE excluded.updated_at > company_procedures.updated_at`,
     args: [
       sqlSafe(p.id),
       sqlSafe(p.title),
@@ -7756,7 +7906,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 advanced (triggers, skills, orchestration)",
         domain: "tool-use",
         priority: "p1",
-        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage customer-owned company procedures (Layer 0; actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
+        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. company_procedure: manage customer-owned company procedures (Layer 0; actions: store, list, deactivate). Legacy aliases: global_procedure, store_global_procedure, list_global_procedures, deactivate_global_procedure."
       }
     ];
     PLATFORM_PROCEDURE_TITLES = new Set(
@@ -7777,7 +7927,7 @@ import { randomUUID as randomUUID3 } from "crypto";
 async function loadGlobalProcedures() {
   const client = getClient();
   const result = await client.execute({
-    sql: "SELECT * FROM global_procedures WHERE active = 1 ORDER BY priority ASC, created_at ASC",
+    sql: "SELECT * FROM company_procedures WHERE active = 1 ORDER BY priority ASC, created_at ASC",
     args: []
   });
   const allRows = result.rows;
@@ -7806,7 +7956,7 @@ async function storeGlobalProcedure(input) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const client = getClient();
   await client.execute({
-    sql: `INSERT INTO global_procedures (id, title, content, priority, domain, active, created_at, updated_at)
+    sql: `INSERT INTO company_procedures (id, title, content, priority, domain, active, created_at, updated_at)
           VALUES (?, ?, ?, ?, ?, 1, ?, ?)`,
     args: [id, input.title, input.content, input.priority ?? "p0", input.domain ?? null, now, now]
   });
@@ -7817,7 +7967,7 @@ async function deactivateGlobalProcedure(id) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const client = getClient();
   const result = await client.execute({
-    sql: "UPDATE global_procedures SET active = 0, updated_at = ? WHERE id = ?",
+    sql: "UPDATE company_procedures SET active = 0, updated_at = ? WHERE id = ?",
     args: [now, id]
   });
   await loadGlobalProcedures();
@@ -7836,6 +7986,164 @@ ${p.content}`).join("\n\n");
   }
 });
 
+// src/lib/memory-cards.ts
+var memory_cards_exports = {};
+__export(memory_cards_exports, {
+  extractMemoryCards: () => extractMemoryCards,
+  insertMemoryCardsForBatch: () => insertMemoryCardsForBatch,
+  searchMemoryCards: () => searchMemoryCards
+});
+import { createHash as createHash3 } from "crypto";
+function stableId(memoryId, type, content) {
+  return createHash3("sha256").update(`${memoryId}:${type}:${content}`).digest("hex").slice(0, 32);
+}
+function cleanText(text) {
+  return text.replace(/```[\s\S]*?```/g, " ").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+}
+function splitSentences(text) {
+  return cleanText(text).split(/(?<=[.!?])\s+|\n+/).map((s) => s.trim()).filter((s) => s.length >= 24 && s.length <= MAX_SENTENCE_CHARS);
+}
+function inferCardType(sentence, toolName) {
+  const lower = sentence.toLowerCase();
+  if (toolName === "store_decision" || /\b(decided|decision|adr|approved|rejected)\b/.test(lower)) return "decision";
+  if (/\b(prefers|preference|likes|dislikes|wants|doesn't want|does not want)\b/.test(lower)) return "preference";
+  if (/\b(changed|updated|replaced|now|no longer|instead|supersedes)\b/.test(lower)) return "belief_update";
+  if (toolName && ["Read", "Write", "Edit", "Bash"].includes(toolName)) return "code";
+  if (/\b(meeting|deadline|shipped|launched|completed|failed|blocked|assigned|created)\b/.test(lower)) return "event";
+  return "fact";
+}
+function extractSubject(sentence, agentId) {
+  const explicit = sentence.match(/\b([A-Z][a-zA-Z0-9_-]{2,}(?:\s+[A-Z][a-zA-Z0-9_-]{2,})?)\b/);
+  return explicit?.[1] ?? agentId;
+}
+function predicateFor(type) {
+  switch (type) {
+    case "preference":
+      return "prefers";
+    case "belief_update":
+      return "updated";
+    case "decision":
+      return "decided";
+    case "event":
+      return "happened";
+    case "code":
+      return "implemented";
+    default:
+      return "states";
+  }
+}
+function extractMemoryCards(row) {
+  const sentences = splitSentences(row.raw_text);
+  const cards = [];
+  for (const sentence of sentences) {
+    const type = inferCardType(sentence, row.tool_name);
+    const subject = extractSubject(sentence, row.agent_id);
+    const content = sentence.length > MAX_SENTENCE_CHARS ? `${sentence.slice(0, MAX_SENTENCE_CHARS - 1)}\u2026` : sentence;
+    cards.push({
+      id: stableId(row.id, type, content),
+      memory_id: row.id,
+      agent_id: row.agent_id,
+      session_id: row.session_id,
+      project_name: row.project_name ?? null,
+      timestamp: row.timestamp,
+      card_type: type,
+      subject,
+      predicate: predicateFor(type),
+      object: content,
+      content,
+      source_ref: row.id,
+      confidence: type === "fact" ? 0.55 : 0.65
+    });
+    if (cards.length >= MAX_CARDS_PER_MEMORY) break;
+  }
+  return cards;
+}
+async function insertMemoryCardsForBatch(rows) {
+  const cards = rows.flatMap(extractMemoryCards);
+  if (cards.length === 0) return 0;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const client = getClient();
+  const stmts = cards.map((card) => ({
+    sql: `INSERT OR IGNORE INTO memory_cards
+          (id, memory_id, agent_id, session_id, project_name, timestamp, card_type,
+           subject, predicate, object, content, source_ref, confidence, active, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)`,
+    args: [
+      card.id,
+      card.memory_id,
+      card.agent_id,
+      card.session_id,
+      card.project_name,
+      card.timestamp,
+      card.card_type,
+      card.subject,
+      card.predicate,
+      card.object,
+      card.content,
+      card.source_ref,
+      card.confidence,
+      now
+    ]
+  }));
+  await client.batch(stmts, "write");
+  return cards.length;
+}
+function buildMatchExpr(queryText) {
+  const terms = queryText.toLowerCase().split(/\s+/).filter((t) => t.length >= 3).map((t) => t.replace(/[^a-z0-9_]/g, "")).filter((t) => t.length >= 3).slice(0, 12);
+  if (terms.length === 0) return null;
+  return terms.map((t) => `${t}*`).join(terms.length >= 3 ? " AND " : " OR ");
+}
+async function searchMemoryCards(queryText, agentId, options) {
+  const limit = options?.limit ?? 10;
+  const matchExpr = buildMatchExpr(queryText);
+  if (!matchExpr) return [];
+  let sql = `SELECT c.id, c.memory_id, c.agent_id, c.session_id, c.project_name,
+                    c.timestamp, c.card_type, c.content, c.source_ref, c.confidence
+             FROM memory_cards c
+             JOIN memory_cards_fts fts ON c.rowid = fts.rowid
+             WHERE memory_cards_fts MATCH ?
+               AND c.agent_id = ?
+               AND COALESCE(c.active, 1) = 1`;
+  const args2 = [matchExpr, agentId];
+  if (options?.projectName) {
+    sql += ` AND c.project_name = ?`;
+    args2.push(options.projectName);
+  }
+  if (options?.since) {
+    sql += ` AND c.timestamp >= ?`;
+    args2.push(options.since);
+  }
+  sql += ` ORDER BY rank LIMIT ?`;
+  args2.push(limit);
+  const result = await getClient().execute({ sql, args: args2 });
+  return result.rows.map((row) => ({
+    id: `card:${String(row.id)}`,
+    agent_id: String(row.agent_id),
+    agent_role: "memory_card",
+    session_id: String(row.session_id),
+    timestamp: String(row.timestamp),
+    tool_name: `memory_card:${String(row.card_type)}`,
+    project_name: row.project_name == null ? "" : String(row.project_name),
+    has_error: false,
+    raw_text: `[${String(row.card_type)}] ${String(row.content)}
+Source memory: ${String(row.source_ref ?? row.memory_id)}`,
+    vector: [],
+    importance: 6,
+    status: "active",
+    confidence: Number(row.confidence ?? 0.6),
+    last_accessed: String(row.timestamp)
+  }));
+}
+var MAX_CARDS_PER_MEMORY, MAX_SENTENCE_CHARS;
+var init_memory_cards = __esm({
+  "src/lib/memory-cards.ts"() {
+    "use strict";
+    init_database();
+    MAX_CARDS_PER_MEMORY = 6;
+    MAX_SENTENCE_CHARS = 360;
+  }
+});
+
 // src/lib/store.ts
 var store_exports = {};
 __export(store_exports, {
@@ -8174,6 +8482,11 @@ async function flushBatch() {
     const globalClient = getClient();
     const globalStmts = batch.map(buildStmt);
     await globalClient.batch(globalStmts, "write");
+    try {
+      const { insertMemoryCardsForBatch: insertMemoryCardsForBatch2 } = await Promise.resolve().then(() => (init_memory_cards(), memory_cards_exports));
+      await insertMemoryCardsForBatch2(batch);
+    } catch {
+    }
     schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
     _pendingRecords.splice(0, batch.length);
     try {
@@ -9432,7 +9745,7 @@ __export(identity_exports, {
 import { existsSync as existsSync16, mkdirSync as mkdirSync9, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
 import { readdirSync as readdirSync4 } from "fs";
 import path17 from "path";
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 function ensureDir() {
   if (!existsSync16(IDENTITY_DIR2)) {
     mkdirSync9(IDENTITY_DIR2, { recursive: true });
@@ -9479,7 +9792,7 @@ function parseFrontmatter(raw) {
   };
 }
 function contentHash(content) {
-  return createHash3("sha256").update(content).digest("hex").slice(0, 16);
+  return createHash4("sha256").update(content).digest("hex").slice(0, 16);
 }
 function getIdentity(agentId) {
   const filePath = identityPath(agentId);
@@ -9695,7 +10008,7 @@ async function insertProcedures(procedures, timestamp, options) {
       continue;
     }
     await client.execute({
-      sql: `INSERT INTO global_procedures (id, title, content, priority, domain, active, created_at, updated_at)
+      sql: `INSERT INTO company_procedures (id, title, content, priority, domain, active, created_at, updated_at)
             VALUES (?, ?, ?, ?, ?, 1, ?, ?)`,
       args: [
         randomUUID4(),
@@ -9777,7 +10090,7 @@ async function importIdentities(identities, updatedBy) {
 async function getActiveProcedureTitles() {
   const client = getClient();
   const result = await client.execute({
-    sql: "SELECT title FROM global_procedures WHERE active = 1",
+    sql: "SELECT title FROM company_procedures WHERE active = 1",
     args: []
   });
   return new Set(result.rows.map((row) => String(row.title)));
@@ -9800,7 +10113,7 @@ async function exportOrchestration(createdBy) {
     args: []
   });
   const procedureResult = await client.execute({
-    sql: "SELECT title, content, priority, domain FROM global_procedures WHERE active = 1",
+    sql: "SELECT title, content, priority, domain FROM company_procedures WHERE active = 1",
     args: []
   });
   const behaviors = behaviorResult.rows.map((row) => ({
@@ -14899,7 +15212,7 @@ var init_exe_rename = __esm({
 // src/lib/model-downloader.ts
 import { createWriteStream, createReadStream as createReadStream2, existsSync as existsSync26, unlinkSync as unlinkSync12, renameSync as renameSync6 } from "fs";
 import { mkdir as mkdir6 } from "fs/promises";
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import path32 from "path";
 async function downloadModel(opts) {
   const { destDir, onProgress, fetchFn = globalThis.fetch } = opts;
@@ -14927,7 +15240,7 @@ async function downloadModel(opts) {
         throw new Error(`Download failed: HTTP ${response.status}`);
       }
       const contentLength = Number(response.headers.get("content-length") ?? EXPECTED_SIZE);
-      const hash = createHash4("sha256");
+      const hash = createHash5("sha256");
       const fileStream = createWriteStream(tmpPath);
       const reader = response.body.getReader();
       try {
@@ -14971,7 +15284,7 @@ Download attempt ${attempt} failed, retrying...
 }
 async function fileHash(filePath) {
   return new Promise((resolve, reject) => {
-    const hash = createHash4("sha256");
+    const hash = createHash5("sha256");
     const stream = createReadStream2(filePath);
     stream.on("data", (chunk) => hash.update(chunk));
     stream.on("end", () => resolve(hash.digest("hex")));
@@ -16793,12 +17106,64 @@ var init_update = __esm({
 
 // src/lib/stack-update.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync25, renameSync as renameSync7, writeFileSync as writeFileSync20 } from "fs";
+import { createVerify, verify as verifySignature } from "crypto";
+import { existsSync as existsSync30, mkdirSync as mkdirSync19, readdirSync as readdirSync10, readFileSync as readFileSync25, renameSync as renameSync7, writeFileSync as writeFileSync20 } from "fs";
 import http from "http";
 import https from "https";
 import path37 from "path";
-function parseStackManifest(raw) {
-  const parsed = JSON.parse(raw);
+function isSignedEnvelope(value) {
+  return !!value && typeof value === "object" && "manifest" in value && "signature" in value;
+}
+function canonicalizeStackManifest(manifest) {
+  const clone = JSON.parse(JSON.stringify(manifest));
+  delete clone.signature;
+  return stableJson(clone);
+}
+function verifyStackManifestSignature(manifest, publicKeyPem) {
+  const signature = manifest.signature;
+  if (!signature) throw new Error("Stack manifest signature required but missing");
+  const payload = Buffer.from(canonicalizeStackManifest(manifest));
+  const sig = Buffer.from(signature.signature, "base64");
+  let ok = false;
+  if (signature.alg === "ed25519") {
+    ok = verifySignature(null, payload, publicKeyPem, sig);
+  } else if (signature.alg === "rsa-sha256") {
+    const verifier = createVerify("RSA-SHA256");
+    verifier.update(payload);
+    verifier.end();
+    ok = verifier.verify(publicKeyPem, sig);
+  } else {
+    throw new Error(`Unsupported stack manifest signature alg: ${signature.alg}`);
+  }
+  if (!ok) throw new Error("Stack manifest signature verification failed");
+}
+function stableJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${stableJson(obj[key])}`).join(",")}}`;
+}
+function findLatestBackupEnvFile(envFile) {
+  const backupDir = path37.join(path37.dirname(envFile), ".exe-stack-backups");
+  if (!existsSync30(backupDir)) return null;
+  const backups = readdirSync10(backupDir).filter((name) => name.startsWith("env-") && name.endsWith(".bak")).sort();
+  const latest = backups.at(-1);
+  return latest ? path37.join(backupDir, latest) : null;
+}
+async function rollbackStackUpdate(options) {
+  const exec2 = options.exec ?? defaultExec;
+  const backupEnvFile = options.lockFile && existsSync30(options.lockFile) ? JSON.parse(readFileSync25(options.lockFile, "utf8")).backupEnvFile : void 0;
+  const rollbackEnv = backupEnvFile && existsSync30(backupEnvFile) ? backupEnvFile : findLatestBackupEnvFile(options.envFile);
+  if (!rollbackEnv) throw new Error(`No stack backup env found beside ${options.envFile}`);
+  writeFileSync20(options.envFile, readFileSync25(rollbackEnv), { mode: 384 });
+  const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
+  exec2("docker", [...composeArgs, "up", "-d"]);
+  return { status: "rolled_back", targetVersion: "previous", changes: [], backupEnvFile: rollbackEnv, lockFile: options.lockFile ?? path37.join(path37.dirname(options.envFile), ".exe-stack-lock.json") };
+}
+function parseStackManifest(raw, publicKey) {
+  const parsedRaw = JSON.parse(raw);
+  const parsed = isSignedEnvelope(parsedRaw) ? { ...parsedRaw.manifest, signature: parsedRaw.signature } : parsedRaw;
+  if (publicKey) verifyStackManifestSignature(parsed, publicKey);
   if (parsed.schemaVersion !== 1) throw new Error("Unsupported stack manifest schemaVersion");
   if (!parsed.latest || !parsed.stacks || typeof parsed.stacks !== "object") {
     throw new Error("Invalid stack manifest: latest and stacks are required");
@@ -16816,9 +17181,9 @@ function parseStackManifest(raw) {
   }
   return parsed;
 }
-async function loadStackManifest(ref, fetchText = defaultFetchText) {
-  if (/^https?:\/\//.test(ref)) return parseStackManifest(await fetchText(ref));
-  return parseStackManifest(readFileSync25(ref, "utf8"));
+async function loadStackManifest(ref, fetchText = defaultFetchText, publicKey) {
+  if (/^https?:\/\//.test(ref)) return parseStackManifest(await fetchText(ref), publicKey);
+  return parseStackManifest(readFileSync25(ref, "utf8"), publicKey);
 }
 function parseEnv(raw) {
   const env = /* @__PURE__ */ new Map();
@@ -16884,7 +17249,8 @@ Re-run with --allow-breaking ${missing.map((c) => c.id).join(",")}`
 async function runStackUpdate(options) {
   const exec2 = options.exec ?? defaultExec;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const manifest = await loadStackManifest(options.manifestRef, options.fetchText);
+  if (options.rollback) return rollbackStackUpdate(options);
+  const manifest = await loadStackManifest(options.manifestRef, options.fetchText, options.manifestPublicKey);
   const envRaw = readFileSync25(options.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, options.targetVersion);
   assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
@@ -16907,7 +17273,7 @@ async function runStackUpdate(options) {
     exec2("docker", [...composeArgs, "pull"]);
     exec2("docker", [...composeArgs, "up", "-d"]);
     await verifyReleaseHealth(plan.release, options.healthRetries ?? 12, options.healthDelayMs ?? 5e3);
-    writeFileSync20(lockFile, JSON.stringify({ stackVersion: plan.targetVersion, updatedAt: now().toISOString(), services: plan.release.services }, null, 2) + "\n");
+    writeFileSync20(lockFile, JSON.stringify({ stackVersion: plan.targetVersion, updatedAt: now().toISOString(), backupEnvFile, services: plan.release.services }, null, 2) + "\n");
     return { status: "updated", targetVersion: plan.targetVersion, changes: plan.changes, backupEnvFile, lockFile };
   } catch (err) {
     writeFileSync20(options.envFile, envRaw, { mode: 384 });
@@ -16966,7 +17332,7 @@ function defaultStackPaths() {
   return {
     composeFile: process.env.EXE_STACK_COMPOSE_FILE || (existsSync30(cwdCompose) ? cwdCompose : "/opt/exe-stack/docker-compose.yml"),
     envFile: process.env.EXE_STACK_ENV_FILE || (existsSync30(cwdEnv) ? cwdEnv : "/opt/exe-stack/.env"),
-    manifestRef: process.env.EXE_STACK_MANIFEST || "https://updates.askexe.com/stack-manifest.json"
+    manifestRef: process.env.EXE_STACK_MANIFEST || "https://update.askexe.com/stack-manifest.json"
   };
 }
 var init_stack_update = __esm({
@@ -16989,6 +17355,7 @@ function parseArgs4(args2) {
     envFile: defaults.envFile,
     dryRun: false,
     check: false,
+    rollback: false,
     yes: false,
     allowedBreakingChangeIds: []
   };
@@ -17004,6 +17371,9 @@ function parseArgs4(args2) {
     else if (arg === "--env-file") opts.envFile = next();
     else if (arg.startsWith("--env-file=")) opts.envFile = arg.split("=").slice(1).join("=");
     else if (arg === "--lock-file") opts.lockFile = next();
+    else if (arg === "--public-key") opts.manifestPublicKey = readFileSync26(next(), "utf8");
+    else if (arg.startsWith("--public-key=")) opts.manifestPublicKey = readFileSync26(arg.split("=").slice(1).join("="), "utf8");
+    else if (arg === "--rollback") opts.rollback = true;
     else if (arg === "--dry-run") opts.dryRun = true;
     else if (arg === "--check") opts.check = true;
     else if (arg === "--yes" || arg === "-y") opts.yes = true;
@@ -17025,13 +17395,15 @@ Usage:
   exe-os stack-update [--manifest <path-or-url>] [--target <version>] [--yes]
 
 Options:
-  --manifest <ref>           Stack manifest JSON path or URL (default: updates.askexe.com)
+  --manifest <ref>           Stack manifest JSON path or URL (default: update.askexe.com)
   --target <version>         Stack version to install (default: manifest.latest)
   --compose-file <path>      docker-compose.yml path (default: ./docker-compose.yml or /opt/exe-stack/docker-compose.yml)
   --env-file <path>          .env path (default: ./.env or /opt/exe-stack/.env)
   --lock-file <path>         Lock file path (default: beside .env)
   --check                    Print available changes only
   --dry-run                  Plan only; do not run Docker
+  --public-key <path>        PEM public key for signed manifest verification
+  --rollback                 Restore latest backed-up .env and restart stack
   --allow-breaking <ids>     Confirm breaking changes, comma-separated
   -y, --yes                  Non-interactive confirmation
 `);
@@ -17059,7 +17431,16 @@ function printBreaking(changes) {
 }
 async function main3() {
   const opts = parseArgs4(process.argv.slice(2));
-  const manifest = await loadStackManifest(opts.manifestRef);
+  if (opts.rollback) {
+    if (!opts.yes) {
+      console.error("Refusing to rollback without --yes.");
+      process.exit(2);
+    }
+    const result2 = await runStackUpdate(opts);
+    console.log(`\u2705 Stack rollback attempted using backup: ${result2.backupEnvFile ?? "latest backup"}`);
+    return;
+  }
+  const manifest = await loadStackManifest(opts.manifestRef, void 0, opts.manifestPublicKey);
   const envRaw = readFileSync26(opts.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, opts.targetVersion);
   console.log(`Exe OS stack target: ${plan.targetVersion}`);
@@ -25494,16 +25875,16 @@ var init_useAgentLoop = __esm({
   }
 });
 
-// src/gateway/providers/anthropic.ts
+// src/lib/providers/anthropic.ts
 import Anthropic from "@anthropic-ai/sdk";
 var AnthropicProvider;
 var init_anthropic = __esm({
-  "src/gateway/providers/anthropic.ts"() {
+  "src/lib/providers/anthropic.ts"() {
     "use strict";
     AnthropicProvider = class {
       name;
-      client;
       defaultModel;
+      client;
       constructor(name, config) {
         this.name = name;
         this.defaultModel = config.defaultModel ?? "claude-sonnet-4-20250514";
@@ -25596,17 +25977,17 @@ var init_anthropic = __esm({
   }
 });
 
-// src/gateway/providers/openai-compat.ts
+// src/lib/providers/openai-compat.ts
 import OpenAI from "openai";
 import { randomUUID as randomUUID5 } from "crypto";
 var OpenAICompatProvider;
 var init_openai_compat = __esm({
-  "src/gateway/providers/openai-compat.ts"() {
+  "src/lib/providers/openai-compat.ts"() {
     "use strict";
     OpenAICompatProvider = class {
       name;
-      client;
       defaultModel;
+      client;
       constructor(name, config) {
         this.name = name;
         this.defaultModel = config.defaultModel ?? "gpt-4o";
@@ -25738,7 +26119,7 @@ var init_openai_compat = __esm({
   }
 });
 
-// src/gateway/providers/factory.ts
+// src/lib/providers/factory.ts
 var factory_exports = {};
 __export(factory_exports, {
   OPENCODE_ANTHROPIC_MODELS: () => OPENCODE_ANTHROPIC_MODELS,
@@ -25789,7 +26170,7 @@ function createProvider(opts) {
 }
 var OPENCODE_BASE_URL, OPENCODE_ANTHROPIC_MODELS, OPENCODE_OPENAI_MODELS, OPENAI_BASE_URL;
 var init_factory = __esm({
-  "src/gateway/providers/factory.ts"() {
+  "src/lib/providers/factory.ts"() {
     "use strict";
     init_anthropic();
     init_openai_compat();
@@ -31434,8 +31815,8 @@ function verifyOpenCodeHooks(homeDir = os19.homedir()) {
   if (!existsSync32(pluginPath)) return false;
   try {
     const plugin = readFileSync28(pluginPath, "utf-8");
-    if (!plugin.includes("post-tool-combined.js")) return false;
-    if (plugin.includes('fireHook("ingest.js"') || plugin.includes('runHook("error-recall.js"')) return false;
+    if (!plugin.includes(EXE_HOOK_FILES.postToolCombined)) return false;
+    if (textHasLegacySplitPostToolHook(plugin)) return false;
   } catch {
     return false;
   }
@@ -31459,6 +31840,7 @@ var init_installer2 = __esm({
     "use strict";
     init_installer();
     init_plugin_template();
+    init_runtime_hook_manifest();
   }
 });
 
@@ -31507,7 +31889,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/session-start.js"
+      marker: EXE_HOOKS.sessionStart
     },
     {
       event: "PostToolUse",
@@ -31522,7 +31904,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/post-tool-combined.js"
+      marker: EXE_HOOKS.postToolCombined
     },
     {
       event: "UserPromptSubmit",
@@ -31536,7 +31918,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/prompt-submit.js"
+      marker: EXE_HOOKS.promptSubmit
     },
     {
       event: "Stop",
@@ -31548,7 +31930,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/stop.js"
+      marker: EXE_HOOKS.stop
     },
     {
       event: "PreToolUse",
@@ -31561,21 +31943,16 @@ async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
           }
         ]
       },
-      marker: "dist/hooks/pre-tool-use.js"
+      marker: EXE_HOOKS.preToolUse
     }
   ];
   let added = 0;
   let skipped = 0;
-  const legacyPostToolMarkers = [
-    "dist/hooks/ingest.js",
-    "dist/hooks/error-recall.js",
-    "dist/hooks/ingest-worker.js"
-  ];
   const postToolGroups = hooksJson.hooks["PostToolUse"];
   if (Array.isArray(postToolGroups)) {
     hooksJson.hooks["PostToolUse"] = postToolGroups.map((g) => ({
       ...g,
-      hooks: g.hooks.filter((h) => !legacyPostToolMarkers.some((marker) => h.command.includes(marker)))
+      hooks: g.hooks.filter((h) => !isLegacySplitPostToolCommand(h.command))
     })).filter((g) => g.hooks.length > 0);
   }
   for (const { event, group, marker } of hooksToRegister) {
@@ -31618,11 +31995,11 @@ function verifyCodexHooks(homeDir = os20.homedir()) {
       }
     }
     const postToolCommands = (hooksJson.hooks.PostToolUse ?? []).flatMap((g) => g.hooks.map((h) => h.command));
-    if (!postToolCommands.some((cmd) => cmd.includes("dist/hooks/post-tool-combined.js"))) {
+    if (!postToolCommands.some((cmd) => cmd.includes(EXE_HOOKS.postToolCombined))) {
       return false;
     }
     if (postToolCommands.some(
-      (cmd) => cmd.includes("dist/hooks/ingest.js") || cmd.includes("dist/hooks/error-recall.js") || cmd.includes("dist/hooks/ingest-worker.js")
+      (cmd) => isLegacySplitPostToolCommand(cmd)
     )) {
       return false;
     }
@@ -31783,6 +32160,7 @@ var init_installer3 = __esm({
     "use strict";
     init_installer();
     init_preferences();
+    init_runtime_hook_manifest();
     DEFAULT_CODEX_STATUS_LINE = [
       "model-with-reasoning",
       "current-dir",
@@ -32002,7 +32380,7 @@ var init_mcp_diagnostics = __esm({
 });
 
 // src/bin/cli.ts
-import { existsSync as existsSync35, readFileSync as readFileSync30, writeFileSync as writeFileSync21, readdirSync as readdirSync10, rmSync } from "fs";
+import { existsSync as existsSync35, readFileSync as readFileSync30, writeFileSync as writeFileSync21, readdirSync as readdirSync11, rmSync } from "fs";
 import path49 from "path";
 import os22 from "os";
 var args = process.argv.slice(2);
@@ -32451,7 +32829,7 @@ async function runClaudeUninstall(flags = []) {
   if (existsSync35(skillsDir)) {
     let skillCount = 0;
     try {
-      const entries = readdirSync10(skillsDir);
+      const entries = readdirSync11(skillsDir);
       for (const entry of entries) {
         if (entry.startsWith("exe")) {
           const fullPath = path49.join(skillsDir, entry);
@@ -32484,7 +32862,7 @@ async function runClaudeUninstall(flags = []) {
   if (existsSync35(agentsDir)) {
     let agentCount = 0;
     try {
-      const entries = readdirSync10(agentsDir).filter((f) => f.endsWith(".md"));
+      const entries = readdirSync11(agentsDir).filter((f) => f.endsWith(".md"));
       let knownNames = /* @__PURE__ */ new Set();
       const rosterPath = path49.join(exeOsDir, "exe-employees.json");
       if (existsSync35(rosterPath)) {
@@ -32512,7 +32890,7 @@ async function runClaudeUninstall(flags = []) {
   if (existsSync35(projectsDir)) {
     let projectCount = 0;
     try {
-      const projects = readdirSync10(projectsDir);
+      const projects = readdirSync11(projectsDir);
       for (const proj of projects) {
         const projSettings = path49.join(projectsDir, proj, "settings.json");
         if (!existsSync35(projSettings)) continue;