@askexenow/exe-os 0.9.64 → 0.9.65

package/dist/bin/cli.js

@@ -5671,31 +5671,43 @@ function logError(msg) {
   } catch {
   }
 }
+function isTruthyEnv(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 function loadPgClient() {
   if (_pgFailed) return null;
-  const postgresUrl = process.env.DATABASE_URL;
   const configPath = path14.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
+  let configEnabled = false;
   try {
     if (existsSync14(configPath)) {
       const cfg = JSON.parse(readFileSync10(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
-      if (cfg.cloud?.syncToPostgres === false) {
-        _pgFailed = true;
-        return null;
-      }
+      configEnabled = cfg.cloud?.syncToPostgres === true;
     }
   } catch {
   }
-  const url = postgresUrl || cloudPostgresUrl;
+  const envEnabled = isTruthyEnv(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+  if (!envEnabled && !configEnabled) {
+    return null;
+  }
+  const url = process.env.DATABASE_URL || cloudPostgresUrl;
   if (!url) {
     _pgFailed = true;
     return null;
   }
   if (!_pgPromise) {
     _pgPromise = (async () => {
+      if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url;
       const { createRequire: createRequire3 } = await import("module");
       const { pathToFileURL: pathToFileURL3 } = await import("url");
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL3(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path14.join(homedir2(), "exe-db");
       const req = createRequire3(path14.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
@@ -5892,6 +5904,15 @@ async function cloudSync(config) {
   } catch {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
+  try {
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    if (String(relink.rows[0]?.value ?? "") === "1") {
+      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Paused after key rotation")) throw err;
+  }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");

package/dist/bin/exe-boot.js

@@ -9061,31 +9061,43 @@ function logError(msg) {
   } catch {
   }
 }
+function isTruthyEnv(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 function loadPgClient() {
   if (_pgFailed) return null;
-  const postgresUrl = process.env.DATABASE_URL;
   const configPath = path25.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
+  let configEnabled = false;
   try {
     if (existsSync21(configPath)) {
       const cfg = JSON.parse(readFileSync15(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
-      if (cfg.cloud?.syncToPostgres === false) {
-        _pgFailed = true;
-        return null;
-      }
+      configEnabled = cfg.cloud?.syncToPostgres === true;
     }
   } catch {
   }
-  const url = postgresUrl || cloudPostgresUrl;
+  const envEnabled = isTruthyEnv(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+  if (!envEnabled && !configEnabled) {
+    return null;
+  }
+  const url = process.env.DATABASE_URL || cloudPostgresUrl;
   if (!url) {
     _pgFailed = true;
     return null;
   }
   if (!_pgPromise) {
     _pgPromise = (async () => {
+      if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url;
       const { createRequire: createRequire3 } = await import("module");
       const { pathToFileURL: pathToFileURL3 } = await import("url");
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL3(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path25.join(homedir2(), "exe-db");
       const req = createRequire3(path25.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
@@ -9282,6 +9294,15 @@ async function cloudSync(config) {
   } catch {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
+  try {
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    if (String(relink.rows[0]?.value ?? "") === "1") {
+      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Paused after key rotation")) throw err;
+  }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");

package/dist/bin/exe-link.js

@@ -3621,31 +3621,43 @@ function logError(msg) {
   } catch {
   }
 }
+function isTruthyEnv(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 function loadPgClient() {
   if (_pgFailed) return null;
-  const postgresUrl = process.env.DATABASE_URL;
   const configPath = path10.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
+  let configEnabled = false;
   try {
     if (existsSync10(configPath)) {
       const cfg = JSON.parse(readFileSync7(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
-      if (cfg.cloud?.syncToPostgres === false) {
-        _pgFailed = true;
-        return null;
-      }
+      configEnabled = cfg.cloud?.syncToPostgres === true;
     }
   } catch {
   }
-  const url = postgresUrl || cloudPostgresUrl;
+  const envEnabled = isTruthyEnv(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+  if (!envEnabled && !configEnabled) {
+    return null;
+  }
+  const url = process.env.DATABASE_URL || cloudPostgresUrl;
   if (!url) {
     _pgFailed = true;
     return null;
   }
   if (!_pgPromise) {
     _pgPromise = (async () => {
+      if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url;
       const { createRequire: createRequire3 } = await import("module");
       const { pathToFileURL: pathToFileURL3 } = await import("url");
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL3(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path10.join(homedir2(), "exe-db");
       const req = createRequire3(path10.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
@@ -3842,6 +3854,15 @@ async function cloudSync(config) {
   } catch {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
+  try {
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    if (String(relink.rows[0]?.value ?? "") === "1") {
+      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Paused after key rotation")) throw err;
+  }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");

package/dist/bin/setup.js

@@ -4544,31 +4544,43 @@ function logError(msg) {
   } catch {
   }
 }
+function isTruthyEnv(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 function loadPgClient() {
   if (_pgFailed) return null;
-  const postgresUrl = process.env.DATABASE_URL;
   const configPath = path12.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
+  let configEnabled = false;
   try {
     if (existsSync12(configPath)) {
       const cfg = JSON.parse(readFileSync8(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
-      if (cfg.cloud?.syncToPostgres === false) {
-        _pgFailed = true;
-        return null;
-      }
+      configEnabled = cfg.cloud?.syncToPostgres === true;
     }
   } catch {
   }
-  const url = postgresUrl || cloudPostgresUrl;
+  const envEnabled = isTruthyEnv(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+  if (!envEnabled && !configEnabled) {
+    return null;
+  }
+  const url = process.env.DATABASE_URL || cloudPostgresUrl;
   if (!url) {
     _pgFailed = true;
     return null;
   }
   if (!_pgPromise) {
     _pgPromise = (async () => {
+      if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url;
       const { createRequire: createRequire3 } = await import("module");
       const { pathToFileURL: pathToFileURL3 } = await import("url");
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL3(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path12.join(homedir2(), "exe-db");
       const req = createRequire3(path12.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
@@ -4765,6 +4777,15 @@ async function cloudSync(config) {
   } catch {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
+  try {
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    if (String(relink.rows[0]?.value ?? "") === "1") {
+      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Paused after key rotation")) throw err;
+  }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");

package/dist/hooks/summary-worker.js

@@ -5679,31 +5679,43 @@ function logError(msg) {
   } catch {
   }
 }
+function isTruthyEnv(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 function loadPgClient() {
   if (_pgFailed) return null;
-  const postgresUrl = process.env.DATABASE_URL;
   const configPath = path20.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
+  let configEnabled = false;
   try {
     if (existsSync19(configPath)) {
       const cfg = JSON.parse(readFileSync13(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
-      if (cfg.cloud?.syncToPostgres === false) {
-        _pgFailed = true;
-        return null;
-      }
+      configEnabled = cfg.cloud?.syncToPostgres === true;
     }
   } catch {
   }
-  const url = postgresUrl || cloudPostgresUrl;
+  const envEnabled = isTruthyEnv(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+  if (!envEnabled && !configEnabled) {
+    return null;
+  }
+  const url = process.env.DATABASE_URL || cloudPostgresUrl;
   if (!url) {
     _pgFailed = true;
     return null;
   }
   if (!_pgPromise) {
     _pgPromise = (async () => {
+      if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url;
       const { createRequire: createRequire3 } = await import("module");
       const { pathToFileURL: pathToFileURL3 } = await import("url");
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL3(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path20.join(homedir2(), "exe-db");
       const req = createRequire3(path20.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
@@ -5900,6 +5912,15 @@ async function cloudSync(config) {
   } catch {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
+  try {
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    if (String(relink.rows[0]?.value ?? "") === "1") {
+      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Paused after key rotation")) throw err;
+  }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");

package/dist/lib/cloud-sync.js

@@ -3421,31 +3421,43 @@ var ROSTER_LOCK_PATH = path10.join(EXE_AI_DIR, "roster-merge.lock");
 var LOCK_STALE_MS = 3e4;
 var _pgPromise = null;
 var _pgFailed = false;
+function isTruthyEnv(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 function loadPgClient() {
   if (_pgFailed) return null;
-  const postgresUrl = process.env.DATABASE_URL;
   const configPath = path10.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
+  let configEnabled = false;
   try {
     if (existsSync10(configPath)) {
       const cfg = JSON.parse(readFileSync7(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
-      if (cfg.cloud?.syncToPostgres === false) {
-        _pgFailed = true;
-        return null;
-      }
+      configEnabled = cfg.cloud?.syncToPostgres === true;
     }
   } catch {
   }
-  const url = postgresUrl || cloudPostgresUrl;
+  const envEnabled = isTruthyEnv(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+  if (!envEnabled && !configEnabled) {
+    return null;
+  }
+  const url = process.env.DATABASE_URL || cloudPostgresUrl;
   if (!url) {
     _pgFailed = true;
     return null;
   }
   if (!_pgPromise) {
     _pgPromise = (async () => {
+      if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url;
       const { createRequire: createRequire3 } = await import("module");
       const { pathToFileURL: pathToFileURL3 } = await import("url");
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL3(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path10.join(homedir2(), "exe-db");
       const req = createRequire3(path10.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
@@ -3642,6 +3654,15 @@ async function cloudSync(config) {
   } catch {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
+  try {
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    if (String(relink.rows[0]?.value ?? "") === "1") {
+      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Paused after key rotation")) throw err;
+  }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");

package/dist/lib/exe-daemon.js

@@ -3498,10 +3498,12 @@ var init_memory_write_governor = __esm({
 // src/lib/projection-worker.ts
 var projection_worker_exports = {};
 __export(projection_worker_exports, {
+  computeProjectionBackoffMs: () => computeProjectionBackoffMs,
   processProjectionBatch: () => processProjectionBatch,
   projectionHandlersForTests: () => projectionHandlersForTests,
   resetProjectionWorkerForTests: () => resetProjectionWorkerForTests,
   setProjectionWorkerPrismaClientForTests: () => setProjectionWorkerPrismaClientForTests,
+  shouldStartProjectionWorker: () => shouldStartProjectionWorker,
   startProjectionWorker: () => startProjectionWorker,
   stopProjectionWorker: () => stopProjectionWorker
 });
@@ -3540,8 +3542,12 @@ function resetProjectionWorkerForTests() {
     clearTimeout(pollTimer);
     pollTimer = null;
   }
+  consecutivePollErrors = 0;
   prismaPromise = null;
 }
+function isTruthyEnv(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 async function processBatch() {
   const prisma = await loadPrisma();
   const events = await prisma.$queryRawUnsafe(
@@ -3583,36 +3589,65 @@ async function processBatch() {
   }
   return processed;
 }
+async function shouldStartProjectionWorker() {
+  try {
+    const config2 = await loadConfig();
+    const envEnabled = isTruthyEnv(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+    if (!envEnabled && config2.cloud?.syncToPostgres !== true) {
+      return { start: false, reason: "cloud.syncToPostgres is not enabled" };
+    }
+  } catch (err) {
+    return { start: false, reason: `config unavailable: ${err instanceof Error ? err.message : String(err)}` };
+  }
+  if (!process.env.DATABASE_URL) {
+    return { start: false, reason: "DATABASE_URL is not set" };
+  }
+  const exeDbRoot = process.env.EXE_DB_ROOT ?? path8.join(os5.homedir(), "exe-db");
+  if (!existsSync8(path8.join(exeDbRoot, "package.json")) && !process.env.EXE_OS_PRISMA_CLIENT_PATH) {
+    return { start: false, reason: "exe-db Prisma client not found" };
+  }
+  return { start: true };
+}
+function computeProjectionBackoffMs(errorCount) {
+  if (errorCount <= 0) return POLL_INTERVAL_MS;
+  return Math.min(POLL_INTERVAL_MS * 2 ** Math.min(errorCount, 5), MAX_POLL_BACKOFF_MS);
+}
 function startProjectionWorker() {
   if (running) return;
-  if (!process.env.DATABASE_URL) {
-    const exeDbRoot = process.env.EXE_DB_ROOT ?? path8.join(os5.homedir(), "exe-db");
-    if (!existsSync8(path8.join(exeDbRoot, "package.json"))) {
-      process.stderr.write("[projection-worker] Skipped \u2014 no exe-db found. Set DATABASE_URL or EXE_DB_ROOT to enable.\n");
+  void (async () => {
+    const decision = await shouldStartProjectionWorker();
+    if (!decision.start) {
+      process.stderr.write(`[projection-worker] Skipped \u2014 ${decision.reason}.
+`);
       return;
     }
-  }
-  running = true;
-  process.stderr.write("[projection-worker] Starting...\n");
-  const tick = async () => {
-    if (!running) return;
-    try {
-      const count = await processBatch();
-      if (count > 0) {
-        process.stderr.write(`[projection-worker] Processed ${count} events.
+    running = true;
+    consecutivePollErrors = 0;
+    process.stderr.write("[projection-worker] Starting...\n");
+    const tick = async () => {
+      if (!running) return;
+      let nextDelay = POLL_INTERVAL_MS;
+      try {
+        const count = await processBatch();
+        consecutivePollErrors = 0;
+        if (count > 0) {
+          process.stderr.write(`[projection-worker] Processed ${count} events.
 `);
-      }
-    } catch (err) {
-      process.stderr.write(
-        `[projection-worker] Poll error: ${err instanceof Error ? err.message : String(err)}
+        }
+      } catch (err) {
+        consecutivePollErrors++;
+        nextDelay = computeProjectionBackoffMs(consecutivePollErrors);
+        process.stderr.write(
+          `[projection-worker] Poll error (${consecutivePollErrors}; next retry ${Math.round(nextDelay / 1e3)}s): ${err instanceof Error ? err.message : String(err)}
 `
-      );
-    }
-    if (running) {
-      pollTimer = setTimeout(tick, POLL_INTERVAL_MS);
-    }
-  };
-  void tick();
+        );
+      }
+      if (running) {
+        pollTimer = setTimeout(tick, nextDelay);
+      }
+    };
+    void tick();
+  })();
 }
 function stopProjectionWorker() {
   running = false;
@@ -3625,10 +3660,11 @@ function stopProjectionWorker() {
 async function processProjectionBatch() {
   return processBatch();
 }
-var prismaPromise, projectionHandlers, projectionHandlersForTests, defaultHandler, BATCH_SIZE, POLL_INTERVAL_MS, running, pollTimer;
+var prismaPromise, projectionHandlers, projectionHandlersForTests, defaultHandler, BATCH_SIZE, POLL_INTERVAL_MS, MAX_POLL_BACKOFF_MS, running, pollTimer, consecutivePollErrors;
 var init_projection_worker = __esm({
   "src/lib/projection-worker.ts"() {
     "use strict";
+    init_config();
     prismaPromise = null;
     projectionHandlers = {
       async whatsapp(event, prisma) {
@@ -3739,8 +3775,10 @@ var init_projection_worker = __esm({
     };
     BATCH_SIZE = 50;
     POLL_INTERVAL_MS = 1e4;
+    MAX_POLL_BACKOFF_MS = 5 * 6e4;
     running = false;
     pollTimer = null;
+    consecutivePollErrors = 0;
   }
 });
 
@@ -22173,31 +22211,43 @@ function logError(msg) {
   } catch {
   }
 }
+function isTruthyEnv2(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 function loadPgClient() {
   if (_pgFailed) return null;
-  const postgresUrl = process.env.DATABASE_URL;
   const configPath = path38.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
+  let configEnabled = false;
   try {
     if (existsSync33(configPath)) {
       const cfg = JSON.parse(readFileSync25(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
-      if (cfg.cloud?.syncToPostgres === false) {
-        _pgFailed = true;
-        return null;
-      }
+      configEnabled = cfg.cloud?.syncToPostgres === true;
     }
   } catch {
   }
-  const url = postgresUrl || cloudPostgresUrl;
+  const envEnabled = isTruthyEnv2(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+  if (!envEnabled && !configEnabled) {
+    return null;
+  }
+  const url = process.env.DATABASE_URL || cloudPostgresUrl;
   if (!url) {
     _pgFailed = true;
     return null;
   }
   if (!_pgPromise) {
     _pgPromise = (async () => {
+      if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url;
       const { createRequire: createRequire7 } = await import("module");
       const { pathToFileURL: pathToFileURL7 } = await import("url");
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL7(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path38.join(homedir6(), "exe-db");
       const req = createRequire7(path38.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
@@ -22394,6 +22444,15 @@ async function cloudSync(config2) {
   } catch {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
+  try {
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    if (String(relink.rows[0]?.value ?? "") === "1") {
+      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Paused after key rotation")) throw err;
+  }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");

package/dist/mcp/server.js

@@ -19775,31 +19775,43 @@ var ROSTER_LOCK_PATH = path34.join(EXE_AI_DIR, "roster-merge.lock");
 var LOCK_STALE_MS = 3e4;
 var _pgPromise = null;
 var _pgFailed = false;
+function isTruthyEnv(value) {
+  return /^(1|true|yes|on)$/i.test(value ?? "");
+}
 function loadPgClient() {
   if (_pgFailed) return null;
-  const postgresUrl = process.env.DATABASE_URL;
   const configPath = path34.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
+  let configEnabled = false;
   try {
     if (existsSync29(configPath)) {
       const cfg = JSON.parse(readFileSync22(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
-      if (cfg.cloud?.syncToPostgres === false) {
-        _pgFailed = true;
-        return null;
-      }
+      configEnabled = cfg.cloud?.syncToPostgres === true;
     }
   } catch {
   }
-  const url = postgresUrl || cloudPostgresUrl;
+  const envEnabled = isTruthyEnv(process.env.EXE_CLOUD_SYNC_TO_POSTGRES);
+  if (!envEnabled && !configEnabled) {
+    return null;
+  }
+  const url = process.env.DATABASE_URL || cloudPostgresUrl;
   if (!url) {
     _pgFailed = true;
     return null;
   }
   if (!_pgPromise) {
     _pgPromise = (async () => {
+      if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url;
       const { createRequire: createRequire6 } = await import("module");
       const { pathToFileURL: pathToFileURL6 } = await import("url");
+      const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
+      if (explicitPath) {
+        const mod2 = await import(pathToFileURL6(explicitPath).href);
+        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
+        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor2();
+      }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path34.join(homedir6(), "exe-db");
       const req = createRequire6(path34.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
@@ -19996,6 +20008,15 @@ async function cloudSync(config2) {
   } catch {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
+  try {
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    if (String(relink.rows[0]?.value ?? "") === "1") {
+      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("Paused after key rotation")) throw err;
+  }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
     await getRawClient2().execute("PRAGMA wal_checkpoint(PASSIVE)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.64",
+  "version": "0.9.65",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",