@askexenow/exe-os 0.9.63 → 0.9.65

package/dist/lib/cloud-sync.js

@@ -3421,31 +3421,43 @@ var ROSTER_LOCK_PATH = path10.join(EXE_AI_DIR, "roster-merge.lock");
 var LOCK_STALE_MS = 3e4;
 var _pgPromise = null;
 var _pgFailed = false;
+function isTruthyEnv(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 function loadPgClient() {
   if (_pgFailed) return null;
-  const postgresUrl = process.env.DATABASE_URL;
   const configPath = path10.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
+  let configEnabled = false;
   try {
     if (existsSync10(configPath)) {
       const cfg = JSON.parse(readFileSync7(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
-      if (cfg.cloud?.syncToPostgres === false) {
-        _pgFailed = true;
-        return null;
-      }
+      configEnabled = cfg.cloud?.syncToPostgres === true;
     }
   } catch {
   }
-  const url = postgresUrl || cloudPostgresUrl;
+  const envEnabled = isTruthyEnv(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+  if (!envEnabled && !configEnabled) {
+    return null;
+  }
+  const url = process.env.DATABASE_URL || cloudPostgresUrl;
   if (!url) {
     _pgFailed = true;
     return null;
   }
   if (!_pgPromise) {
     _pgPromise = (async () => {
+      if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url;
       const { createRequire: createRequire3 } = await import("module");
       const { pathToFileURL: pathToFileURL3 } = await import("url");
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL3(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path10.join(homedir2(), "exe-db");
       const req = createRequire3(path10.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
@@ -3642,6 +3654,15 @@ async function cloudSync(config) {
   } catch {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
+  try {
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    if (String(relink.rows[0]?.value ?? "") === "1") {
+      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Paused after key rotation")) throw err;
+  }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");

package/dist/lib/exe-daemon.js

@@ -313,15 +313,6 @@ var init_memory = __esm({
 });
 
 // src/lib/daemon-protocol.ts
-var daemon_protocol_exports = {};
-__export(daemon_protocol_exports, {
-  deserializeArgs: () => deserializeArgs,
-  deserializeResultSet: () => deserializeResultSet,
-  deserializeValue: () => deserializeValue,
-  serializeArgs: () => serializeArgs,
-  serializeResultSet: () => serializeResultSet,
-  serializeValue: () => serializeValue
-});
 function serializeValue(v) {
   if (v === null || v === void 0) return null;
   if (typeof v === "bigint") return Number(v);
@@ -346,9 +337,6 @@ function deserializeValue(v) {
   }
   return v;
 }
-function serializeArgs(args) {
-  return args.map(serializeValue);
-}
 function deserializeArgs(args) {
   return args.map(deserializeValue);
 }
@@ -3510,10 +3498,12 @@ var init_memory_write_governor = __esm({
 // src/lib/projection-worker.ts
 var projection_worker_exports = {};
 __export(projection_worker_exports, {
+  computeProjectionBackoffMs: () => computeProjectionBackoffMs,
   processProjectionBatch: () => processProjectionBatch,
   projectionHandlersForTests: () => projectionHandlersForTests,
   resetProjectionWorkerForTests: () => resetProjectionWorkerForTests,
   setProjectionWorkerPrismaClientForTests: () => setProjectionWorkerPrismaClientForTests,
+  shouldStartProjectionWorker: () => shouldStartProjectionWorker,
   startProjectionWorker: () => startProjectionWorker,
   stopProjectionWorker: () => stopProjectionWorker
 });
@@ -3552,8 +3542,12 @@ function resetProjectionWorkerForTests() {
     clearTimeout(pollTimer);
     pollTimer = null;
   }
+  consecutivePollErrors = 0;
   prismaPromise = null;
 }
+function isTruthyEnv(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 async function processBatch() {
   const prisma = await loadPrisma();
   const events = await prisma.$queryRawUnsafe(
@@ -3595,36 +3589,65 @@ async function processBatch() {
   }
   return processed;
 }
+async function shouldStartProjectionWorker() {
+  try {
+    const config2 = await loadConfig();
+    const envEnabled = isTruthyEnv(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+    if (!envEnabled && config2.cloud?.syncToPostgres !== true) {
+      return { start: false, reason: "cloud.syncToPostgres is not enabled" };
+    }
+  } catch (err) {
+    return { start: false, reason: `config unavailable: ${err instanceof Error ? err.message : String(err)}` };
+  }
+  if (!process.env.DATABASE_URL) {
+    return { start: false, reason: "DATABASE_URL is not set" };
+  }
+  const exeDbRoot = process.env.EXE_DB_ROOT ?? path8.join(os5.homedir(), "exe-db");
+  if (!existsSync8(path8.join(exeDbRoot, "package.json")) && !process.env.EXE_OS_PRISMA_CLIENT_PATH) {
+    return { start: false, reason: "exe-db Prisma client not found" };
+  }
+  return { start: true };
+}
+function computeProjectionBackoffMs(errorCount) {
+  if (errorCount <= 0) return POLL_INTERVAL_MS;
+  return Math.min(POLL_INTERVAL_MS * 2 ** Math.min(errorCount, 5), MAX_POLL_BACKOFF_MS);
+}
 function startProjectionWorker() {
   if (running) return;
-  if (!process.env.DATABASE_URL) {
-    const exeDbRoot = process.env.EXE_DB_ROOT ?? path8.join(os5.homedir(), "exe-db");
-    if (!existsSync8(path8.join(exeDbRoot, "package.json"))) {
-      process.stderr.write("[projection-worker] Skipped \u2014 no exe-db found. Set DATABASE_URL or EXE_DB_ROOT to enable.\n");
+  void (async () => {
+    const decision = await shouldStartProjectionWorker();
+    if (!decision.start) {
+      process.stderr.write(`[projection-worker] Skipped \u2014 ${decision.reason}.
+`);
       return;
     }
-  }
-  running = true;
-  process.stderr.write("[projection-worker] Starting...\n");
-  const tick = async () => {
-    if (!running) return;
-    try {
-      const count = await processBatch();
-      if (count > 0) {
-        process.stderr.write(`[projection-worker] Processed ${count} events.
+    running = true;
+    consecutivePollErrors = 0;
+    process.stderr.write("[projection-worker] Starting...\n");
+    const tick = async () => {
+      if (!running) return;
+      let nextDelay = POLL_INTERVAL_MS;
+      try {
+        const count = await processBatch();
+        consecutivePollErrors = 0;
+        if (count > 0) {
+          process.stderr.write(`[projection-worker] Processed ${count} events.
 `);
-      }
-    } catch (err) {
-      process.stderr.write(
-        `[projection-worker] Poll error: ${err instanceof Error ? err.message : String(err)}
+        }
+      } catch (err) {
+        consecutivePollErrors++;
+        nextDelay = computeProjectionBackoffMs(consecutivePollErrors);
+        process.stderr.write(
+          `[projection-worker] Poll error (${consecutivePollErrors}; next retry ${Math.round(nextDelay / 1e3)}s): ${err instanceof Error ? err.message : String(err)}
 `
-      );
-    }
-    if (running) {
-      pollTimer = setTimeout(tick, POLL_INTERVAL_MS);
-    }
-  };
-  void tick();
+        );
+      }
+      if (running) {
+        pollTimer = setTimeout(tick, nextDelay);
+      }
+    };
+    void tick();
+  })();
 }
 function stopProjectionWorker() {
   running = false;
@@ -3637,10 +3660,11 @@ function stopProjectionWorker() {
 async function processProjectionBatch() {
   return processBatch();
 }
-var prismaPromise, projectionHandlers, projectionHandlersForTests, defaultHandler, BATCH_SIZE, POLL_INTERVAL_MS, running, pollTimer;
+var prismaPromise, projectionHandlers, projectionHandlersForTests, defaultHandler, BATCH_SIZE, POLL_INTERVAL_MS, MAX_POLL_BACKOFF_MS, running, pollTimer, consecutivePollErrors;
 var init_projection_worker = __esm({
   "src/lib/projection-worker.ts"() {
     "use strict";
+    init_config();
     prismaPromise = null;
     projectionHandlers = {
       async whatsapp(event, prisma) {
@@ -3751,8 +3775,10 @@ var init_projection_worker = __esm({
     };
     BATCH_SIZE = 50;
     POLL_INTERVAL_MS = 1e4;
+    MAX_POLL_BACKOFF_MS = 5 * 6e4;
     running = false;
     pollTimer = null;
+    consecutivePollErrors = 0;
   }
 });
 
@@ -21003,218 +21029,6 @@ var init_conflict_detector = __esm({
   }
 });
 
-// src/adapters/runtime-hook-manifest.ts
-function manifestEntryForCommand(command) {
-  return EXE_HOOK_MANIFEST.find((entry) => command.includes(entry.commandMarker));
-}
-var EXE_HOOKS, EXE_HOOK_MANIFEST, LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS;
-var init_runtime_hook_manifest = __esm({
-  "src/adapters/runtime-hook-manifest.ts"() {
-    "use strict";
-    EXE_HOOKS = {
-      postToolCombined: "dist/hooks/post-tool-combined.js",
-      sessionStart: "dist/hooks/session-start.js",
-      promptSubmit: "dist/hooks/prompt-submit.js",
-      heartbeat: "dist/hooks/exe-heartbeat-hook.js",
-      stop: "dist/hooks/stop.js",
-      preToolUse: "dist/hooks/pre-tool-use.js",
-      subagentStop: "dist/hooks/subagent-stop.js",
-      preCompact: "dist/hooks/pre-compact.js",
-      postCompact: "dist/hooks/post-compact.js",
-      sessionEnd: "dist/hooks/session-end.js",
-      notification: "dist/hooks/notification.js",
-      instructionsLoaded: "dist/hooks/instructions-loaded.js"
-    };
-    EXE_HOOK_MANIFEST = [
-      {
-        key: "postToolCombined",
-        event: "PostToolUse",
-        commandMarker: EXE_HOOKS.postToolCombined,
-        owner: "exe-os",
-        purpose: "Single PostToolUse entrypoint for ingestion, error recall, summaries, and bug detection.",
-        runtimes: ["claude", "codex", "opencode"],
-        checkpointRole: "none"
-      },
-      {
-        key: "sessionStart",
-        event: "SessionStart",
-        commandMarker: EXE_HOOKS.sessionStart,
-        owner: "exe-os",
-        purpose: "Loads agent identity, procedures, and boot context.",
-        runtimes: ["claude", "codex", "opencode"],
-        checkpointRole: "none"
-      },
-      {
-        key: "promptSubmit",
-        event: "UserPromptSubmit",
-        commandMarker: EXE_HOOKS.promptSubmit,
-        owner: "exe-os",
-        purpose: "Injects current tasks, pending reviews, and local context before each prompt.",
-        runtimes: ["claude", "codex", "opencode"],
-        checkpointRole: "none"
-      },
-      {
-        key: "heartbeat",
-        event: "UserPromptSubmit",
-        commandMarker: EXE_HOOKS.heartbeat,
-        owner: "exe-os",
-        purpose: "Lightweight heartbeat/status sidecar for Claude Code sessions.",
-        runtimes: ["claude"],
-        checkpointRole: "none"
-      },
-      {
-        key: "stop",
-        event: "Stop",
-        commandMarker: EXE_HOOKS.stop,
-        owner: "exe-os",
-        purpose: "Finalizes task state, capacity signals, and emergency checkpointing.",
-        runtimes: ["claude", "codex", "opencode"],
-        checkpointRole: "capacity_checkpoint"
-      },
-      {
-        key: "preToolUse",
-        event: "PreToolUse",
-        commandMarker: EXE_HOOKS.preToolUse,
-        owner: "exe-os",
-        purpose: "Preflight guardrails before shell/tool execution.",
-        runtimes: ["claude", "codex", "opencode"],
-        checkpointRole: "none"
-      },
-      {
-        key: "subagentStop",
-        event: "SubagentStop",
-        commandMarker: EXE_HOOKS.subagentStop,
-        owner: "exe-os",
-        purpose: "Captures subagent completion context.",
-        runtimes: ["claude"],
-        checkpointRole: "none"
-      },
-      {
-        key: "preCompact",
-        event: "PreCompact",
-        commandMarker: EXE_HOOKS.preCompact,
-        owner: "exe-os",
-        purpose: "Writes active-task snapshot and compaction recovery context.",
-        runtimes: ["claude"],
-        checkpointRole: "recovery_context"
-      },
-      {
-        key: "postCompact",
-        event: "PostCompact",
-        commandMarker: EXE_HOOKS.postCompact,
-        owner: "exe-os",
-        purpose: "Rehydrates recovery context after compaction.",
-        runtimes: ["claude"],
-        checkpointRole: "recovery_context"
-      },
-      {
-        key: "sessionEnd",
-        event: "SessionEnd",
-        commandMarker: EXE_HOOKS.sessionEnd,
-        owner: "exe-os",
-        purpose: "Stores session-end checkpoint and triages orphaned in-progress tasks.",
-        runtimes: ["claude"],
-        checkpointRole: "session_summary"
-      },
-      {
-        key: "notification",
-        event: "Notification",
-        commandMarker: EXE_HOOKS.notification,
-        owner: "exe-os",
-        purpose: "Captures runtime notifications and nudges.",
-        runtimes: ["claude"],
-        checkpointRole: "none"
-      },
-      {
-        key: "instructionsLoaded",
-        event: "InstructionsLoaded",
-        commandMarker: EXE_HOOKS.instructionsLoaded,
-        owner: "exe-os",
-        purpose: "Applies runtime instruction post-processing.",
-        runtimes: ["claude"],
-        checkpointRole: "none"
-      }
-    ];
-    LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS = [
-      "dist/hooks/ingest.js",
-      "dist/hooks/error-recall.js",
-      "dist/hooks/ingest-worker.js"
-    ];
-  }
-});
-
-// src/bin/fast-db-init.ts
-var fast_db_init_exports = {};
-__export(fast_db_init_exports, {
-  fastDbInit: () => fastDbInit
-});
-async function fastDbInit() {
-  const { isInitialized: isInitialized2, getClient: getClient2, setExternalClient: setExternalClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
-  if (isInitialized2()) {
-    return getClient2();
-  }
-  try {
-    const { connectEmbedDaemon: connectEmbedDaemon2, sendDaemonRequest: sendDaemonRequest2, isClientConnected: isClientConnected2 } = await Promise.resolve().then(() => (init_exe_daemon_client(), exe_daemon_client_exports));
-    const { deserializeResultSet: deserializeResultSet2 } = await Promise.resolve().then(() => (init_daemon_protocol(), daemon_protocol_exports));
-    await connectEmbedDaemon2();
-    if (isClientConnected2()) {
-      const daemonClient = {
-        async execute(stmt) {
-          const sql = typeof stmt === "string" ? stmt : stmt.sql;
-          const args = typeof stmt === "string" ? [] : Array.isArray(stmt.args) ? stmt.args : [];
-          const resp = await sendDaemonRequest2({ type: "db-execute", sql, args });
-          if (resp.error) throw new Error(String(resp.error));
-          if (resp.db) return deserializeResultSet2(resp.db);
-          throw new Error("Unexpected daemon response");
-        },
-        async batch(stmts, mode) {
-          const statements = stmts.map((s) => {
-            const sql = typeof s === "string" ? s : s.sql;
-            const args = typeof s === "string" ? [] : Array.isArray(s.args) ? s.args : [];
-            return { sql, args };
-          });
-          const resp = await sendDaemonRequest2({ type: "db-batch", statements, mode: mode ?? "deferred" });
-          if (resp.error) throw new Error(String(resp.error));
-          const batchResults = resp["db-batch"];
-          if (batchResults) return batchResults.map(deserializeResultSet2);
-          throw new Error("Unexpected daemon batch response");
-        },
-        async transaction(_mode) {
-          throw new Error("Transactions not supported via daemon socket");
-        },
-        async executeMultiple(_sql) {
-          throw new Error("executeMultiple not supported via daemon socket");
-        },
-        async migrate(_stmts) {
-          throw new Error("migrate not supported via daemon socket");
-        },
-        sync() {
-          return Promise.resolve(void 0);
-        },
-        close() {
-        },
-        get closed() {
-          return false;
-        },
-        get protocol() {
-          return "file";
-        }
-      };
-      setExternalClient2(daemonClient);
-      return daemonClient;
-    }
-  } catch {
-  }
-  const { initStore: initStore2 } = await Promise.resolve().then(() => (init_store(), store_exports));
-  await initStore2({ lightweight: true });
-  return getClient2();
-}
-var init_fast_db_init = __esm({
-  "src/bin/fast-db-init.ts"() {
-    "use strict";
-  }
-});
-
 // src/lib/db-backup.ts
 var db_backup_exports = {};
 __export(db_backup_exports, {
@@ -21521,121 +21335,6 @@ function auditHookHealth() {
   const topPatterns = [...patternCounts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5).map(([pattern, count]) => ({ pattern, count }));
   return { logExists: true, totalLines, errorsLastHour, topPatterns };
 }
-function safeReadJson(filePath) {
-  if (!existsSync31(filePath)) return null;
-  try {
-    return JSON.parse(readFileSync23(filePath, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function collectHookCommandsFromClaudeSettings(settings) {
-  const hooks = settings?.hooks;
-  if (!hooks || typeof hooks !== "object") return [];
-  const commands = [];
-  for (const [event, groups] of Object.entries(hooks)) {
-    if (!Array.isArray(groups)) continue;
-    for (const group of groups) {
-      const hooksForGroup = group?.hooks;
-      if (!Array.isArray(hooksForGroup)) continue;
-      for (const hook of hooksForGroup) {
-        const command = hook?.command;
-        if (typeof command === "string") commands.push({ event, command });
-      }
-    }
-  }
-  return commands;
-}
-function collectHookCommandsFromCodexHooks(config2) {
-  const commands = [];
-  if (!config2 || typeof config2 !== "object") return commands;
-  const root = config2;
-  for (const [event, value] of Object.entries(root)) {
-    const entries = Array.isArray(value) ? value : value && typeof value === "object" ? Object.values(value) : [];
-    for (const entry of entries) {
-      if (typeof entry === "string") commands.push({ event, command: entry });
-      const command = entry?.command;
-      if (typeof command === "string") commands.push({ event, command });
-    }
-  }
-  return commands;
-}
-function buildHookOwnershipIssues(runtime, commands) {
-  const issues = [];
-  for (const marker of LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS) {
-    const count = commands.filter((cmd) => cmd.command.includes(marker)).length;
-    if (count > 0) {
-      issues.push({
-        runtime,
-        event: "PostToolUse",
-        marker,
-        count,
-        message: `Legacy split PostToolUse hook still installed: ${marker}`
-      });
-    }
-  }
-  for (const entry of EXE_HOOK_MANIFEST.filter((hook) => hook.runtimes.includes(runtime))) {
-    const matching = commands.filter((cmd) => cmd.command.includes(entry.commandMarker));
-    if (matching.length > 1) {
-      issues.push({
-        runtime,
-        event: entry.event,
-        marker: entry.commandMarker,
-        count: matching.length,
-        message: `Duplicate exe-os hook owner for ${entry.event}: ${entry.commandMarker}`
-      });
-    }
-    for (const cmd of matching) {
-      if (cmd.event !== entry.event) {
-        issues.push({
-          runtime,
-          event: cmd.event,
-          marker: entry.commandMarker,
-          count: 1,
-          message: `exe-os hook ${entry.commandMarker} is registered under ${cmd.event}, expected ${entry.event}`
-        });
-      }
-    }
-  }
-  for (const cmd of commands) {
-    if (!cmd.command.includes("dist/hooks/")) continue;
-    if (!cmd.command.includes("exe-os")) continue;
-    const entry = manifestEntryForCommand(cmd.command);
-    const isLegacy = LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS.some((marker) => cmd.command.includes(marker));
-    if (!entry && !isLegacy) {
-      issues.push({
-        runtime,
-        event: cmd.event,
-        marker: "dist/hooks/",
-        count: 1,
-        message: `Unknown exe-os hook command not present in ownership manifest: ${cmd.command.slice(0, 160)}`
-      });
-    }
-  }
-  return issues;
-}
-function auditHookOwnership() {
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  const checkedFiles = [];
-  const issues = [];
-  const claudeSettingsPath = path36.join(home, ".claude", "settings.json");
-  const claudeSettings = safeReadJson(claudeSettingsPath);
-  if (claudeSettings) {
-    checkedFiles.push(claudeSettingsPath);
-    issues.push(...buildHookOwnershipIssues("claude", collectHookCommandsFromClaudeSettings(claudeSettings)));
-  }
-  const codexHooksPath = path36.join(home, ".codex", "hooks.json");
-  const codexHooks = safeReadJson(codexHooksPath);
-  if (codexHooks) {
-    checkedFiles.push(codexHooksPath);
-    issues.push(...buildHookOwnershipIssues("codex", collectHookCommandsFromCodexHooks(codexHooks)));
-  }
-  return {
-    checkedFiles,
-    issues,
-    staleLegacyHooks: issues.filter((issue) => issue.message.includes("Legacy split"))
-  };
-}
 async function auditShards() {
   try {
     const { auditShardHealth: auditShardHealth2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
@@ -21680,8 +21379,7 @@ async function runAudit(client, flags) {
   }
   const duplicateCount = duplicates.reduce((sum, d) => sum + d.delete_ids.length, 0);
   const hookHealth = auditHookHealth();
-  const hookOwnership = auditHookOwnership();
-  return { stats, nullVectors, duplicates, duplicateCount, bloated, fts, orphanedProjects, conflicts, hookHealth, hookOwnership, shards };
+  return { stats, nullVectors, duplicates, duplicateCount, bloated, fts, orphanedProjects, conflicts, hookHealth, shards };
 }
 function indicator(value, warn) {
   if (value === 0) return "\u{1F7E2}";
@@ -21760,15 +21458,6 @@ function formatReport(report, flags) {
       lines.push(`                     ${p.count}x: ${p.pattern}`);
     }
   }
-  const ho = report.hookOwnership;
-  if (ho.issues.length === 0) {
-    lines.push(`\u{1F7E2} Hook ownership:  ${ho.checkedFiles.length > 0 ? "manifest clean" : "no local hook config found"}`);
-  } else {
-    lines.push(`\u{1F534} Hook ownership:  ${fmtNum(ho.issues.length)} issue(s)`);
-    for (const issue of ho.issues.slice(0, 5)) {
-      lines.push(`                     [${issue.runtime}/${issue.event}] ${issue.message}`);
-    }
-  }
   const sh = report.shards;
   if (sh.total > 0) {
     if (sh.unreadable === 0) {
@@ -21838,9 +21527,6 @@ function formatReport(report, flags) {
   if (report.conflicts.superseded > 0) {
     recs.push(`${fmtNum(report.conflicts.superseded)} superseded memories can be deactivated`);
   }
-  if (report.hookOwnership.issues.length > 0) {
-    recs.push(`Run exe-os install to refresh hook config; remove stale exe-os hook commands if they remain`);
-  }
   if (recs.length > 0) {
     lines.push("Recommendations:");
     for (const r of recs) {
@@ -21974,8 +21660,8 @@ function splitAtSentences(text3, maxChunkSize) {
 }
 async function main(argv = process.argv.slice(2)) {
   const flags = parseFlags(argv);
-  const { fastDbInit: fastDbInit2 } = await Promise.resolve().then(() => (init_fast_db_init(), fast_db_init_exports));
-  const client = await fastDbInit2();
+  await initStore();
+  const client = getClient();
   const report = await runAudit(client, flags);
   console.log(formatReport(report, flags));
   if (flags.fix || flags.dryRun) {
@@ -22035,9 +21721,10 @@ ${mode} Complete.`);
 var init_exe_doctor = __esm({
   "src/bin/exe-doctor.ts"() {
     "use strict";
+    init_store();
+    init_database();
     init_is_main();
     init_conflict_detector();
-    init_runtime_hook_manifest();
     if (isMainModule(import.meta.url) && (process.argv[1] ?? "").includes("exe-doctor")) {
       main().catch((err) => {
         console.error(err instanceof Error ? err.message : String(err));
@@ -22524,31 +22211,43 @@ function logError(msg) {
   } catch {
   }
 }
+function isTruthyEnv2(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 function loadPgClient() {
   if (_pgFailed) return null;
-  const postgresUrl = process.env.DATABASE_URL;
   const configPath = path38.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
+  let configEnabled = false;
   try {
     if (existsSync33(configPath)) {
       const cfg = JSON.parse(readFileSync25(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
-      if (cfg.cloud?.syncToPostgres === false) {
-        _pgFailed = true;
-        return null;
-      }
+      configEnabled = cfg.cloud?.syncToPostgres === true;
     }
   } catch {
   }
-  const url = postgresUrl || cloudPostgresUrl;
+  const envEnabled = isTruthyEnv2(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+  if (!envEnabled && !configEnabled) {
+    return null;
+  }
+  const url = process.env.DATABASE_URL || cloudPostgresUrl;
   if (!url) {
     _pgFailed = true;
     return null;
   }
   if (!_pgPromise) {
     _pgPromise = (async () => {
+      if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url;
       const { createRequire: createRequire7 } = await import("module");
       const { pathToFileURL: pathToFileURL7 } = await import("url");
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL7(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path38.join(homedir6(), "exe-db");
       const req = createRequire7(path38.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
@@ -22745,6 +22444,15 @@ async function cloudSync(config2) {
   } catch {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
+  try {
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    if (String(relink.rows[0]?.value ?? "") === "1") {
+      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Paused after key rotation")) throw err;
+  }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");