@askexenow/exe-os 0.9.65 → 0.9.66

package/dist/bin/exe-link.js

@@ -137,8 +137,8 @@ function deriveMachineKey() {
 }
 function readMachineId() {
   try {
-    const { readFileSync: readFileSync8 } = __require("fs");
-    return readFileSync8("/etc/machine-id", "utf-8").trim();
+    const { readFileSync: readFileSync9 } = __require("fs");
+    return readFileSync9("/etc/machine-id", "utf-8").trim();
   } catch {
     return "";
   }
@@ -460,6 +460,11 @@ function normalizeAutoUpdate(raw) {
   const userAU = raw.autoUpdate ?? {};
   raw.autoUpdate = { ...defaultAU, ...userAU };
 }
+function normalizeOrchestration(raw) {
+  const defaultOrg = DEFAULT_CONFIG.orchestration;
+  const userOrg = raw.orchestration ?? {};
+  raw.orchestration = { ...defaultOrg, ...userOrg };
+}
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
   await ensurePrivateDir(dir);
@@ -484,6 +489,7 @@ async function loadConfig() {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     const config = { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db"), ...migratedCfg };
     if (config.dbPath.startsWith("~")) {
       config.dbPath = config.dbPath.replace(/^~/, os2.homedir());
@@ -507,6 +513,7 @@ function loadConfigSync() {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db"), ...migratedCfg };
   } catch {
     return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
@@ -528,6 +535,7 @@ async function loadConfigFrom(configPath) {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     return { ...DEFAULT_CONFIG, ...migratedCfg };
   } catch {
     return { ...DEFAULT_CONFIG };
@@ -599,6 +607,10 @@ var init_config = __esm({
         checkOnBoot: true,
         autoInstall: false,
         checkIntervalMs: 24 * 60 * 60 * 1e3
+      },
+      orchestration: {
+        phase: "phase_1_coo",
+        phaseSetBy: "default"
       }
     };
     CONFIG_MIGRATIONS = [
@@ -614,6 +626,47 @@ var init_config = __esm({
   }
 });
 
+// src/lib/key-backup-status.ts
+var key_backup_status_exports = {};
+__export(key_backup_status_exports, {
+  getKeyBackupStatus: () => getKeyBackupStatus,
+  keyBackupMarkerPath: () => keyBackupMarkerPath,
+  markKeyBackupConfirmed: () => markKeyBackupConfirmed
+});
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import path3 from "path";
+function keyBackupMarkerPath() {
+  return path3.join(EXE_AI_DIR, "key-backup-confirmed.json");
+}
+function getKeyBackupStatus() {
+  const marker = keyBackupMarkerPath();
+  if (!existsSync4(marker)) return { exists: false };
+  try {
+    const parsed = JSON.parse(readFileSync2(marker, "utf8"));
+    return {
+      exists: true,
+      confirmedAt: parsed.confirmedAt,
+      source: parsed.source
+    };
+  } catch {
+    return { exists: true };
+  }
+}
+function markKeyBackupConfirmed(source) {
+  mkdirSync2(EXE_AI_DIR, { recursive: true, mode: 448 });
+  writeFileSync(
+    keyBackupMarkerPath(),
+    JSON.stringify({ confirmedAt: (/* @__PURE__ */ new Date()).toISOString(), source }, null, 2) + "\n",
+    { mode: 384 }
+  );
+}
+var init_key_backup_status = __esm({
+  "src/lib/key-backup-status.ts"() {
+    "use strict";
+    init_config();
+  }
+});
+
 // src/lib/crypto.ts
 var crypto_exports = {};
 __export(crypto_exports, {
@@ -730,9 +783,9 @@ var init_db_retry = __esm({
 
 // src/lib/employees.ts
 import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3 } from "fs/promises";
-import { existsSync as existsSync4, symlinkSync, readlinkSync, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
+import { existsSync as existsSync5, symlinkSync, readlinkSync, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
 import { execSync as execSync2 } from "child_process";
-import path3 from "path";
+import path4 from "path";
 import os3 from "os";
 function normalizeRole(role) {
   return (role ?? "").trim().toLowerCase();
@@ -747,7 +800,7 @@ function getCoordinatorName(employees = loadEmployeesSync()) {
   return getCoordinatorEmployee(employees)?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME;
 }
 async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync4(employeesPath)) {
+  if (!existsSync5(employeesPath)) {
     return [];
   }
   const raw = await readFile3(employeesPath, "utf-8");
@@ -758,13 +811,13 @@ async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
   }
 }
 async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
-  await mkdir3(path3.dirname(employeesPath), { recursive: true });
+  await mkdir3(path4.dirname(employeesPath), { recursive: true });
   await writeFile3(employeesPath, JSON.stringify(employees, null, 2) + "\n", "utf-8");
 }
 function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync4(employeesPath)) return [];
+  if (!existsSync5(employeesPath)) return [];
   try {
-    return JSON.parse(readFileSync2(employeesPath, "utf-8"));
+    return JSON.parse(readFileSync3(employeesPath, "utf-8"));
   } catch {
     return [];
   }
@@ -785,7 +838,7 @@ function registerBinSymlinks(name) {
     errors.push("Could not find 'exe-os' in PATH");
     return { created, skipped, errors };
   }
-  const binDir = path3.dirname(exeBinPath);
+  const binDir = path4.dirname(exeBinPath);
   let target;
   try {
     target = readlinkSync(exeBinPath);
@@ -795,8 +848,8 @@ function registerBinSymlinks(name) {
   }
   for (const suffix of ["", "-opencode"]) {
     const linkName = `${name}${suffix}`;
-    const linkPath = path3.join(binDir, linkName);
-    if (existsSync4(linkPath)) {
+    const linkPath = path4.join(binDir, linkName);
+    if (existsSync5(linkPath)) {
       skipped.push(linkName);
       continue;
     }
@@ -814,16 +867,16 @@ var init_employees = __esm({
   "src/lib/employees.ts"() {
     "use strict";
     init_config();
-    EMPLOYEES_PATH = path3.join(EXE_AI_DIR, "exe-employees.json");
+    EMPLOYEES_PATH = path4.join(EXE_AI_DIR, "exe-employees.json");
     DEFAULT_COORDINATOR_TEMPLATE_NAME = "exe";
     COORDINATOR_ROLE = "COO";
-    IDENTITY_DIR = path3.join(EXE_AI_DIR, "identity");
+    IDENTITY_DIR = path4.join(EXE_AI_DIR, "identity");
   }
 });
 
 // src/lib/database-adapter.ts
 import os4 from "os";
-import path4 from "path";
+import path5 from "path";
 import { createRequire } from "module";
 import { pathToFileURL } from "url";
 function quotedIdentifier(identifier) {
@@ -1134,8 +1187,8 @@ async function loadPrismaClient() {
         }
         return new PrismaClient2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path4.join(os4.homedir(), "exe-db");
-      const requireFromExeDb = createRequire(path4.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path5.join(os4.homedir(), "exe-db");
+      const requireFromExeDb = createRequire(path5.join(exeDbRoot, "package.json"));
       const prismaEntry = requireFromExeDb.resolve("@prisma/client");
       const module = await import(pathToFileURL(prismaEntry).href);
       const PrismaClient = module.PrismaClient ?? module.default?.PrismaClient;
@@ -1416,8 +1469,8 @@ var init_memory = __esm({
 
 // src/lib/daemon-auth.ts
 import crypto2 from "crypto";
-import path5 from "path";
-import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import path6 from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 function normalizeToken(token) {
   if (!token) return null;
   const trimmed = token.trim();
@@ -1425,8 +1478,8 @@ function normalizeToken(token) {
 }
 function readDaemonToken() {
   try {
-    if (!existsSync5(DAEMON_TOKEN_PATH)) return null;
-    return normalizeToken(readFileSync3(DAEMON_TOKEN_PATH, "utf8"));
+    if (!existsSync6(DAEMON_TOKEN_PATH)) return null;
+    return normalizeToken(readFileSync4(DAEMON_TOKEN_PATH, "utf8"));
   } catch {
     return null;
   }
@@ -1436,7 +1489,7 @@ function ensureDaemonToken(seed) {
   if (existing) return existing;
   const token = normalizeToken(seed) ?? crypto2.randomBytes(32).toString("hex");
   ensurePrivateDirSync(EXE_AI_DIR);
-  writeFileSync2(DAEMON_TOKEN_PATH, `${token}
+  writeFileSync3(DAEMON_TOKEN_PATH, `${token}
 `, "utf8");
   enforcePrivateFileSync(DAEMON_TOKEN_PATH);
   return token;
@@ -1447,7 +1500,7 @@ var init_daemon_auth = __esm({
     "use strict";
     init_config();
     init_secure_files();
-    DAEMON_TOKEN_PATH = path5.join(EXE_AI_DIR, "exed.token");
+    DAEMON_TOKEN_PATH = path6.join(EXE_AI_DIR, "exed.token");
   }
 });
 
@@ -1456,8 +1509,8 @@ import net from "net";
 import os5 from "os";
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync6, unlinkSync as unlinkSync2, readFileSync as readFileSync4, openSync, closeSync, statSync } from "fs";
-import path6 from "path";
+import { existsSync as existsSync7, unlinkSync as unlinkSync2, readFileSync as readFileSync5, openSync, closeSync, statSync } from "fs";
+import path7 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function handleData(chunk) {
   _buffer += chunk.toString();
@@ -1485,9 +1538,9 @@ function handleData(chunk) {
   }
 }
 function cleanupStaleFiles() {
-  if (existsSync6(PID_PATH)) {
+  if (existsSync7(PID_PATH)) {
     try {
-      const pid = parseInt(readFileSync4(PID_PATH, "utf8").trim(), 10);
+      const pid = parseInt(readFileSync5(PID_PATH, "utf8").trim(), 10);
       if (pid > 0) {
         try {
           process.kill(pid, 0);
@@ -1508,11 +1561,11 @@ function cleanupStaleFiles() {
   }
 }
 function findPackageRoot() {
-  let dir = path6.dirname(fileURLToPath2(import.meta.url));
-  const { root } = path6.parse(dir);
+  let dir = path7.dirname(fileURLToPath2(import.meta.url));
+  const { root } = path7.parse(dir);
   while (dir !== root) {
-    if (existsSync6(path6.join(dir, "package.json"))) return dir;
-    dir = path6.dirname(dir);
+    if (existsSync7(path7.join(dir, "package.json"))) return dir;
+    dir = path7.dirname(dir);
   }
   return null;
 }
@@ -1559,8 +1612,8 @@ function spawnDaemon() {
     process.stderr.write("[exed-client] WARN: cannot find package root\n");
     return;
   }
-  const daemonPath = path6.join(pkgRoot, "dist", "lib", "exe-daemon.js");
-  if (!existsSync6(daemonPath)) {
+  const daemonPath = path7.join(pkgRoot, "dist", "lib", "exe-daemon.js");
+  if (!existsSync7(daemonPath)) {
     process.stderr.write(`[exed-client] WARN: daemon script not found at ${daemonPath}
 `);
     return;
@@ -1569,7 +1622,7 @@ function spawnDaemon() {
   const daemonToken = ensureDaemonToken(process.env[DAEMON_TOKEN_ENV] ?? null);
   process.stderr.write(`[exed-client] Spawning daemon: ${resolvedPath}
 `);
-  const logPath = path6.join(path6.dirname(SOCKET_PATH), "exed.log");
+  const logPath = path7.join(path7.dirname(SOCKET_PATH), "exed.log");
   let stderrFd = "ignore";
   try {
     stderrFd = openSync(logPath, "a");
@@ -1719,9 +1772,9 @@ var init_exe_daemon_client = __esm({
     "use strict";
     init_config();
     init_daemon_auth();
-    SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path6.join(EXE_AI_DIR, "exed.sock");
-    PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path6.join(EXE_AI_DIR, "exed.pid");
-    SPAWN_LOCK_PATH = path6.join(EXE_AI_DIR, "exed-spawn.lock");
+    SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path7.join(EXE_AI_DIR, "exed.sock");
+    PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path7.join(EXE_AI_DIR, "exed.pid");
+    SPAWN_LOCK_PATH = path7.join(EXE_AI_DIR, "exed-spawn.lock");
     SPAWN_LOCK_STALE_MS = 3e4;
     CONNECT_TIMEOUT_MS = 15e3;
     REQUEST_TIMEOUT_MS = 3e4;
@@ -3209,32 +3262,32 @@ var init_compress = __esm({
 });
 
 // src/lib/license.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync7, mkdirSync as mkdirSync2 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync8, mkdirSync as mkdirSync3 } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
 import { createRequire as createRequire2 } from "module";
 import { pathToFileURL as pathToFileURL2 } from "url";
 import os6 from "os";
-import path7 from "path";
+import path8 from "path";
 import { jwtVerify, importSPKI } from "jose";
 function loadDeviceId() {
-  const deviceJsonPath = path7.join(EXE_AI_DIR, "device.json");
+  const deviceJsonPath = path8.join(EXE_AI_DIR, "device.json");
   try {
-    if (existsSync7(deviceJsonPath)) {
-      const data = JSON.parse(readFileSync5(deviceJsonPath, "utf8"));
+    if (existsSync8(deviceJsonPath)) {
+      const data = JSON.parse(readFileSync6(deviceJsonPath, "utf8"));
       if (data.deviceId) return data.deviceId;
     }
   } catch {
   }
   try {
-    if (existsSync7(DEVICE_ID_PATH)) {
-      const id2 = readFileSync5(DEVICE_ID_PATH, "utf8").trim();
+    if (existsSync8(DEVICE_ID_PATH)) {
+      const id2 = readFileSync6(DEVICE_ID_PATH, "utf8").trim();
       if (id2) return id2;
     }
   } catch {
   }
   const id = randomUUID2();
-  mkdirSync2(EXE_AI_DIR, { recursive: true });
-  writeFileSync3(DEVICE_ID_PATH, id, "utf8");
+  mkdirSync3(EXE_AI_DIR, { recursive: true });
+  writeFileSync4(DEVICE_ID_PATH, id, "utf8");
   return id;
 }
 var LICENSE_PATH, CACHE_PATH, DEVICE_ID_PATH;
@@ -3242,9 +3295,9 @@ var init_license = __esm({
   "src/lib/license.ts"() {
     "use strict";
     init_config();
-    LICENSE_PATH = path7.join(EXE_AI_DIR, "license.key");
-    CACHE_PATH = path7.join(EXE_AI_DIR, "license-cache.json");
-    DEVICE_ID_PATH = path7.join(EXE_AI_DIR, "device-id");
+    LICENSE_PATH = path8.join(EXE_AI_DIR, "license.key");
+    CACHE_PATH = path8.join(EXE_AI_DIR, "license-cache.json");
+    DEVICE_ID_PATH = path8.join(EXE_AI_DIR, "device-id");
   }
 });
 
@@ -3267,8 +3320,8 @@ __export(crdt_sync_exports, {
   rebuildFromDb: () => rebuildFromDb
 });
 import * as Y from "yjs";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync8, mkdirSync as mkdirSync3, unlinkSync as unlinkSync3 } from "fs";
-import path8 from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync9, mkdirSync as mkdirSync4, unlinkSync as unlinkSync3 } from "fs";
+import path9 from "path";
 import { homedir } from "os";
 function getStatePath() {
   return _statePathOverride ?? DEFAULT_STATE_PATH;
@@ -3280,9 +3333,9 @@ function initCrdtDoc() {
   if (doc) return doc;
   doc = new Y.Doc();
   const sp = getStatePath();
-  if (existsSync8(sp)) {
+  if (existsSync9(sp)) {
     try {
-      const state = readFileSync6(sp);
+      const state = readFileSync7(sp);
       Y.applyUpdate(doc, new Uint8Array(state));
     } catch {
       console.warn("[crdt-sync] WARN: corrupted state file, rebuilding from DB");
@@ -3424,10 +3477,10 @@ function persistState() {
   if (!doc) return;
   try {
     const sp = getStatePath();
-    const dir = path8.dirname(sp);
-    if (!existsSync8(dir)) mkdirSync3(dir, { recursive: true });
+    const dir = path9.dirname(sp);
+    if (!existsSync9(dir)) mkdirSync4(dir, { recursive: true });
     const state = Y.encodeStateAsUpdate(doc);
-    writeFileSync4(sp, Buffer.from(state));
+    writeFileSync5(sp, Buffer.from(state));
   } catch {
   }
 }
@@ -3468,7 +3521,7 @@ var DEFAULT_STATE_PATH, _statePathOverride, doc;
 var init_crdt_sync = __esm({
   "src/lib/crdt-sync.ts"() {
     "use strict";
-    DEFAULT_STATE_PATH = path8.join(homedir(), ".exe-os", "crdt-state.bin");
+    DEFAULT_STATE_PATH = path9.join(homedir(), ".exe-os", "crdt-state.bin");
     _statePathOverride = null;
     doc = null;
   }
@@ -3485,33 +3538,33 @@ __export(db_backup_exports, {
   listBackups: () => listBackups,
   rotateBackups: () => rotateBackups
 });
-import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync4, readdirSync, unlinkSync as unlinkSync4, statSync as statSync2 } from "fs";
-import path9 from "path";
+import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync5, readdirSync, unlinkSync as unlinkSync4, statSync as statSync2 } from "fs";
+import path10 from "path";
 function findActiveDb() {
   for (const name of DB_NAMES) {
-    const p = path9.join(EXE_AI_DIR, name);
-    if (existsSync9(p)) return p;
+    const p = path10.join(EXE_AI_DIR, name);
+    if (existsSync10(p)) return p;
   }
   return null;
 }
 function createBackup(reason = "manual") {
   const dbPath = findActiveDb();
   if (!dbPath) return null;
-  mkdirSync4(BACKUP_DIR, { recursive: true });
-  const dbName = path9.basename(dbPath, ".db");
+  mkdirSync5(BACKUP_DIR, { recursive: true });
+  const dbName = path10.basename(dbPath, ".db");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const backupName = `${dbName}-${reason}-${timestamp}.db`;
-  const backupPath = path9.join(BACKUP_DIR, backupName);
+  const backupPath = path10.join(BACKUP_DIR, backupName);
   copyFileSync(dbPath, backupPath);
   const walPath = dbPath + "-wal";
-  if (existsSync9(walPath)) {
+  if (existsSync10(walPath)) {
     try {
       copyFileSync(walPath, backupPath + "-wal");
     } catch {
     }
   }
   const shmPath = dbPath + "-shm";
-  if (existsSync9(shmPath)) {
+  if (existsSync10(shmPath)) {
     try {
       copyFileSync(shmPath, backupPath + "-shm");
     } catch {
@@ -3520,14 +3573,14 @@ function createBackup(reason = "manual") {
   return backupPath;
 }
 function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
-  if (!existsSync9(BACKUP_DIR)) return 0;
+  if (!existsSync10(BACKUP_DIR)) return 0;
   const cutoff = Date.now() - keepDays * 24 * 60 * 60 * 1e3;
   let deleted = 0;
   try {
     const files = readdirSync(BACKUP_DIR);
     for (const file of files) {
       if (!file.endsWith(".db") && !file.endsWith(".db-wal") && !file.endsWith(".db-shm")) continue;
-      const filePath = path9.join(BACKUP_DIR, file);
+      const filePath = path10.join(BACKUP_DIR, file);
       try {
         const stat = statSync2(filePath);
         if (stat.mtimeMs < cutoff) {
@@ -3542,11 +3595,11 @@ function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
   return deleted;
 }
 function listBackups() {
-  if (!existsSync9(BACKUP_DIR)) return [];
+  if (!existsSync10(BACKUP_DIR)) return [];
   try {
     const files = readdirSync(BACKUP_DIR).filter((f) => f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm"));
     return files.map((name) => {
-      const p = path9.join(BACKUP_DIR, name);
+      const p = path10.join(BACKUP_DIR, name);
       const stat = statSync2(p);
       return { path: p, name, size: stat.size, date: stat.mtime };
     }).sort((a, b) => b.date.getTime() - a.date.getTime());
@@ -3571,7 +3624,7 @@ var init_db_backup = __esm({
   "src/lib/db-backup.ts"() {
     "use strict";
     init_config();
-    BACKUP_DIR = path9.join(EXE_AI_DIR, "backups");
+    BACKUP_DIR = path10.join(EXE_AI_DIR, "backups");
     DEFAULT_KEEP_DAYS = 3;
     DB_NAMES = ["memories.db", "exe-mem.db", "exe-os.db", "exe.db"];
   }
@@ -3580,8 +3633,10 @@ var init_db_backup = __esm({
 // src/lib/cloud-sync.ts
 var cloud_sync_exports = {};
 __export(cloud_sync_exports, {
+  CLOUD_RELINK_REQUIRED_MESSAGE: () => CLOUD_RELINK_REQUIRED_MESSAGE,
   assertSecureEndpoint: () => assertSecureEndpoint,
   buildRosterBlob: () => buildRosterBlob,
+  clearCloudRelinkRequired: () => clearCloudRelinkRequired,
   cloudPull: () => cloudPull,
   cloudPullBehaviors: () => cloudPullBehaviors,
   cloudPullBlob: () => cloudPullBlob,
@@ -3601,21 +3656,22 @@ __export(cloud_sync_exports, {
   cloudPushRoster: () => cloudPushRoster,
   cloudPushTasks: () => cloudPushTasks,
   cloudSync: () => cloudSync,
+  getCloudRelinkRequired: () => getCloudRelinkRequired,
   mergeConfig: () => mergeConfig,
   mergeRosterFromRemote: () => mergeRosterFromRemote,
   pushToPostgres: () => pushToPostgres,
   recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync10, readdirSync as readdirSync2, mkdirSync as mkdirSync5, appendFileSync, unlinkSync as unlinkSync5, openSync as openSync2, closeSync as closeSync2, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync11, readdirSync as readdirSync2, mkdirSync as mkdirSync6, appendFileSync, unlinkSync as unlinkSync5, openSync as openSync2, closeSync as closeSync2, statSync as statSync3 } from "fs";
 import crypto3 from "crypto";
-import path10 from "path";
+import path11 from "path";
 import { homedir as homedir2 } from "os";
 function sqlSafe(v) {
   return v === void 0 ? null : v;
 }
 function logError(msg) {
   try {
-    const logPath = path10.join(homedir2(), ".exe-os", "workers.log");
+    const logPath = path11.join(homedir2(), ".exe-os", "workers.log");
     appendFileSync(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
@@ -3626,12 +3682,12 @@ function isTruthyEnv(value) {
 }
 function loadPgClient() {
   if (_pgFailed) return null;
-  const configPath = path10.join(EXE_AI_DIR, "config.json");
+  const configPath = path11.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
   let configEnabled = false;
   try {
-    if (existsSync10(configPath)) {
-      const cfg = JSON.parse(readFileSync7(configPath, "utf8"));
+    if (existsSync11(configPath)) {
+      const cfg = JSON.parse(readFileSync8(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
       configEnabled = cfg.cloud?.syncToPostgres === true;
     }
@@ -3658,8 +3714,8 @@ function loadPgClient() {
         if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
         return new Ctor2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path10.join(homedir2(), "exe-db");
-      const req = createRequire3(path10.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path11.join(homedir2(), "exe-db");
+      const req = createRequire3(path11.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
       const mod = await import(pathToFileURL3(entry).href);
       const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
@@ -3704,18 +3760,18 @@ async function withRosterLock(fn) {
   try {
     const fd = openSync2(ROSTER_LOCK_PATH, "wx");
     closeSync2(fd);
-    writeFileSync5(ROSTER_LOCK_PATH, String(Date.now()));
+    writeFileSync6(ROSTER_LOCK_PATH, String(Date.now()));
   } catch (err) {
     if (err.code === "EEXIST") {
       try {
-        const ts = parseInt(readFileSync7(ROSTER_LOCK_PATH, "utf-8"), 10);
+        const ts = parseInt(readFileSync8(ROSTER_LOCK_PATH, "utf-8"), 10);
         if (Date.now() - ts < LOCK_STALE_MS) {
           throw new Error("Roster merge already in progress \u2014 another sync is running");
         }
         unlinkSync5(ROSTER_LOCK_PATH);
         const fd = openSync2(ROSTER_LOCK_PATH, "wx");
         closeSync2(fd);
-        writeFileSync5(ROSTER_LOCK_PATH, String(Date.now()));
+        writeFileSync6(ROSTER_LOCK_PATH, String(Date.now()));
       } catch (retryErr) {
         if (retryErr instanceof Error && retryErr.message.includes("already in progress")) throw retryErr;
         throw new Error("Roster merge already in progress \u2014 another sync is running");
@@ -3834,6 +3890,24 @@ async function cloudPull(sinceVersion, config) {
     return { records: [], maxVersion: sinceVersion };
   }
 }
+async function getCloudRelinkRequired(client = getClient()) {
+  try {
+    await client.execute("CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    return String(relink.rows[0]?.value ?? "") === "1";
+  } catch {
+    return false;
+  }
+}
+async function clearCloudRelinkRequired(client = getClient()) {
+  await client.execute("CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+  await client.execute("INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_relink_required', '0')");
+  await client.execute({
+    sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_relinked_at', ?)",
+    args: [(/* @__PURE__ */ new Date()).toISOString()]
+  });
+  await client.execute("DELETE FROM sync_meta WHERE key IN ('last_cloud_pull_version', 'last_cloud_push_version')");
+}
 async function cloudSync(config) {
   if (!isSyncCryptoInitialized()) {
     try {
@@ -3855,10 +3929,7 @@ async function cloudSync(config) {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
   try {
-    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
-    if (String(relink.rows[0]?.value ?? "") === "1") {
-      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
-    }
+    if (await getCloudRelinkRequired(client)) throw new Error(CLOUD_RELINK_REQUIRED_MESSAGE);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (msg.includes("Paused after key rotation")) throw err;
@@ -4108,8 +4179,8 @@ async function cloudSync(config) {
   try {
     const employees = await loadEmployees();
     rosterResult.employees = employees.length;
-    const idDir = path10.join(EXE_AI_DIR, "identity");
-    if (existsSync10(idDir)) {
+    const idDir = path11.join(EXE_AI_DIR, "identity");
+    if (existsSync11(idDir)) {
       rosterResult.identities = readdirSync2(idDir).filter((f) => f.endsWith(".md")).length;
     }
   } catch {
@@ -4122,7 +4193,7 @@ async function cloudSync(config) {
       const backupSize = statSync3(latestBackup).size;
       const MAX_CLOUD_BACKUP_BYTES = 50 * 1024 * 1024;
       if (backupSize <= MAX_CLOUD_BACKUP_BYTES) {
-        const backupData = readFileSync7(latestBackup);
+        const backupData = readFileSync8(latestBackup);
         const deviceId = loadDeviceId() ?? "unknown";
         const encrypted = encryptSyncBlob(backupData);
         const backupRes = await fetchWithRetry(`${config.endpoint}/sync/push-db-backup`, {
@@ -4130,7 +4201,7 @@ async function cloudSync(config) {
           headers: { "Content-Type": "application/json", Authorization: `Bearer ${config.apiKey}` },
           body: JSON.stringify({
             device_id: deviceId,
-            filename: path10.basename(latestBackup),
+            filename: path11.basename(latestBackup),
             blob: encrypted,
             size: backupData.length
           })
@@ -4158,56 +4229,56 @@ async function cloudSync(config) {
 function recordRosterDeletion(name) {
   let deletions = [];
   try {
-    if (existsSync10(ROSTER_DELETIONS_PATH)) {
-      deletions = JSON.parse(readFileSync7(ROSTER_DELETIONS_PATH, "utf-8"));
+    if (existsSync11(ROSTER_DELETIONS_PATH)) {
+      deletions = JSON.parse(readFileSync8(ROSTER_DELETIONS_PATH, "utf-8"));
     }
   } catch {
   }
   if (!deletions.includes(name)) deletions.push(name);
-  writeFileSync5(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
+  writeFileSync6(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
 }
 function consumeRosterDeletions() {
   try {
-    if (!existsSync10(ROSTER_DELETIONS_PATH)) return [];
-    const deletions = JSON.parse(readFileSync7(ROSTER_DELETIONS_PATH, "utf-8"));
-    writeFileSync5(ROSTER_DELETIONS_PATH, "[]");
+    if (!existsSync11(ROSTER_DELETIONS_PATH)) return [];
+    const deletions = JSON.parse(readFileSync8(ROSTER_DELETIONS_PATH, "utf-8"));
+    writeFileSync6(ROSTER_DELETIONS_PATH, "[]");
     return deletions;
   } catch {
     return [];
   }
 }
 function buildRosterBlob(paths) {
-  const rosterPath = paths?.rosterPath ?? path10.join(EXE_AI_DIR, "exe-employees.json");
-  const identityDir = paths?.identityDir ?? path10.join(EXE_AI_DIR, "identity");
-  const configPath = paths?.configPath ?? path10.join(EXE_AI_DIR, "config.json");
+  const rosterPath = paths?.rosterPath ?? path11.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path11.join(EXE_AI_DIR, "identity");
+  const configPath = paths?.configPath ?? path11.join(EXE_AI_DIR, "config.json");
   let roster = [];
-  if (existsSync10(rosterPath)) {
+  if (existsSync11(rosterPath)) {
     try {
-      roster = JSON.parse(readFileSync7(rosterPath, "utf-8"));
+      roster = JSON.parse(readFileSync8(rosterPath, "utf-8"));
     } catch {
     }
   }
   const identities = {};
-  if (existsSync10(identityDir)) {
+  if (existsSync11(identityDir)) {
     for (const file of readdirSync2(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
-        identities[file] = readFileSync7(path10.join(identityDir, file), "utf-8");
+        identities[file] = readFileSync8(path11.join(identityDir, file), "utf-8");
       } catch {
       }
     }
   }
   let config;
-  if (existsSync10(configPath)) {
+  if (existsSync11(configPath)) {
     try {
-      config = JSON.parse(readFileSync7(configPath, "utf-8"));
+      config = JSON.parse(readFileSync8(configPath, "utf-8"));
     } catch {
     }
   }
   let agentConfig;
-  const agentConfigPath = path10.join(EXE_AI_DIR, "agent-config.json");
-  if (existsSync10(agentConfigPath)) {
+  const agentConfigPath = path11.join(EXE_AI_DIR, "agent-config.json");
+  if (existsSync11(agentConfigPath)) {
     try {
-      agentConfig = JSON.parse(readFileSync7(agentConfigPath, "utf-8"));
+      agentConfig = JSON.parse(readFileSync8(agentConfigPath, "utf-8"));
     } catch {
     }
   }
@@ -4283,24 +4354,24 @@ async function cloudPullRoster(config) {
   }
 }
 function mergeConfig(remoteConfig, configPath) {
-  const cfgPath = configPath ?? path10.join(EXE_AI_DIR, "config.json");
+  const cfgPath = configPath ?? path11.join(EXE_AI_DIR, "config.json");
   let local = {};
-  if (existsSync10(cfgPath)) {
+  if (existsSync11(cfgPath)) {
     try {
-      local = JSON.parse(readFileSync7(cfgPath, "utf-8"));
+      local = JSON.parse(readFileSync8(cfgPath, "utf-8"));
     } catch {
     }
   }
   const merged = { ...remoteConfig, ...local };
-  const dir = path10.dirname(cfgPath);
+  const dir = path11.dirname(cfgPath);
   ensurePrivateDirSync(dir);
-  writeFileSync5(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
+  writeFileSync6(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
   enforcePrivateFileSync(cfgPath);
 }
 async function mergeRosterFromRemote(remote, paths) {
   return withRosterLock(async () => {
     const rosterPath = paths?.rosterPath ?? void 0;
-    const identityDir = paths?.identityDir ?? path10.join(EXE_AI_DIR, "identity");
+    const identityDir = paths?.identityDir ?? path11.join(EXE_AI_DIR, "identity");
     const localEmployees = await loadEmployees(rosterPath);
     const localNames = new Set(localEmployees.map((e) => e.name));
     let added = 0;
@@ -4321,15 +4392,15 @@ async function mergeRosterFromRemote(remote, paths) {
       ) ?? lookupKey;
       const remoteIdentity = remote.identities[matchedKey];
       if (remoteIdentity) {
-        if (!existsSync10(identityDir)) mkdirSync5(identityDir, { recursive: true });
-        const idPath = path10.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync11(identityDir)) mkdirSync6(identityDir, { recursive: true });
+        const idPath = path11.join(identityDir, `${remoteEmp.name}.md`);
         let localIdentity = null;
         try {
-          localIdentity = existsSync10(idPath) ? readFileSync7(idPath, "utf-8") : null;
+          localIdentity = existsSync11(idPath) ? readFileSync8(idPath, "utf-8") : null;
         } catch {
         }
         if (localIdentity !== remoteIdentity) {
-          writeFileSync5(idPath, remoteIdentity, "utf-8");
+          writeFileSync6(idPath, remoteIdentity, "utf-8");
           identitiesUpdated++;
         }
       }
@@ -4355,17 +4426,17 @@ async function mergeRosterFromRemote(remote, paths) {
     }
     if (remote.agentConfig && Object.keys(remote.agentConfig).length > 0) {
       try {
-        const agentConfigPath = path10.join(EXE_AI_DIR, "agent-config.json");
+        const agentConfigPath = path11.join(EXE_AI_DIR, "agent-config.json");
         let local = {};
-        if (existsSync10(agentConfigPath)) {
+        if (existsSync11(agentConfigPath)) {
           try {
-            local = JSON.parse(readFileSync7(agentConfigPath, "utf-8"));
+            local = JSON.parse(readFileSync8(agentConfigPath, "utf-8"));
           } catch {
           }
         }
         const merged = { ...remote.agentConfig, ...local };
-        ensurePrivateDirSync(path10.dirname(agentConfigPath));
-        writeFileSync5(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+        ensurePrivateDirSync(path11.dirname(agentConfigPath));
+        writeFileSync6(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
         enforcePrivateFileSync(agentConfigPath);
       } catch {
       }
@@ -4790,7 +4861,7 @@ async function cloudPullDocuments(config) {
   }
   return { pulled };
 }
-var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, _pgPromise, _pgFailed, ROSTER_DELETIONS_PATH;
+var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, _pgPromise, _pgFailed, CLOUD_RELINK_REQUIRED_MESSAGE, ROSTER_DELETIONS_PATH;
 var init_cloud_sync = __esm({
   "src/lib/cloud-sync.ts"() {
     "use strict";
@@ -4805,11 +4876,12 @@ var init_cloud_sync = __esm({
     LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
     FETCH_TIMEOUT_MS = 3e4;
     PUSH_BATCH_SIZE = 5e3;
-    ROSTER_LOCK_PATH = path10.join(EXE_AI_DIR, "roster-merge.lock");
+    ROSTER_LOCK_PATH = path11.join(EXE_AI_DIR, "roster-merge.lock");
     LOCK_STALE_MS = 3e4;
     _pgPromise = null;
     _pgFailed = false;
-    ROSTER_DELETIONS_PATH = path10.join(EXE_AI_DIR, "roster-deletions.json");
+    CLOUD_RELINK_REQUIRED_MESSAGE = "[cloud-sync] Paused after key rotation. Run `exe-os cloud relink --dry-run` for the safe relink checklist.";
+    ROSTER_DELETIONS_PATH = path11.join(EXE_AI_DIR, "roster-deletions.json");
   }
 });
 
@@ -4833,74 +4905,113 @@ function isMainModule(importMetaUrl) {
 }
 
 // src/bin/exe-link.ts
-async function main() {
-  const mode = process.argv[2];
-  if (mode === "export") {
-    const key = await getMasterKey();
-    if (!key) {
-      console.error("No master key found. Run /exe-setup first.");
-      process.exit(1);
-    }
-    const mnemonic = await exportMnemonic(key);
-    console.log("Your 24-word recovery phrase:\n");
-    const showFull = process.argv.includes("--show-full");
-    if (showFull) {
-      console.log(`  ${mnemonic}
+function isInteractiveTerminal() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY && !process.env.CI);
+}
+function assertLocalTerminalExportAllowed() {
+  if (!isInteractiveTerminal()) {
+    throw new Error(
+      "Refusing to reveal the recovery phrase outside a local interactive terminal.\nRun this yourself in Terminal: exe-os link export --local-terminal-only"
+    );
+  }
+}
+async function printStatus() {
+  const key = await getMasterKey();
+  if (key) {
+    console.log("Master key: FOUND");
+    console.log(`Key length: ${key.length} bytes`);
+    console.log("Recovery export: available from a local interactive terminal");
+  } else {
+    console.log("Master key: MISSING");
+    console.log("Checked normal storage paths: OS keychain/keytar/file fallback");
+    process.exitCode = 1;
+  }
+}
+async function exportKey(argv = process.argv.slice(2)) {
+  const key = await getMasterKey();
+  if (!key) {
+    console.error("No master key found. Run /exe-setup first or import your recovery phrase with exe-os link import.");
+    process.exit(1);
+  }
+  const showFull = argv.includes("--show-full") || argv.includes("--local-terminal-only");
+  if (showFull) {
+    assertLocalTerminalExportAllowed();
+  }
+  const mnemonic = await exportMnemonic(key);
+  console.log("Your 24-word recovery phrase:\n");
+  if (showFull) {
+    console.log(`  ${mnemonic}
 `);
-    } else {
-      const words = mnemonic.split(" ");
-      const masked = words.length > 4 ? [...words.slice(0, 2), ...words.slice(2, -2).map(() => "****"), ...words.slice(-2)].join(" ") : mnemonic;
-      console.log(`  ${masked}
+    const { markKeyBackupConfirmed: markKeyBackupConfirmed2 } = await Promise.resolve().then(() => (init_key_backup_status(), key_backup_status_exports));
+    markKeyBackupConfirmed2("exe-os link export --local-terminal-only");
+  } else {
+    const words = mnemonic.split(" ");
+    const masked = words.length > 4 ? [...words.slice(0, 2), ...words.slice(2, -2).map(() => "****"), ...words.slice(-2)].join(" ") : mnemonic;
+    console.log(`  ${masked}
 `);
-      console.log("To reveal full phrase: run with --show-full\n");
-    }
-    console.log("Write this down and enter it on your new device with /exe-link import.");
-    console.log("Anyone with this phrase can decrypt your memories.");
-    console.log("\u26A0  Clear your terminal history after copying.");
-  } else if (mode === "import") {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const mnemonic = await new Promise((resolve) => {
-      rl.question("Paste your 24-word recovery phrase: ", (answer) => {
-        rl.close();
-        resolve(answer.trim());
-      });
+    console.log("To reveal full phrase locally: exe-os link export --local-terminal-only\n");
+  }
+  console.log("Write this down and enter it on your new device with /exe-link import.");
+  console.log("Anyone with this phrase can decrypt your memories.");
+  console.log("\u26A0  Clear your terminal history after copying.");
+}
+async function importKey() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const mnemonic = await new Promise((resolve) => {
+    rl.question("Paste your 24-word recovery phrase: ", (answer) => {
+      rl.close();
+      resolve(answer.trim());
     });
+  });
+  try {
+    const key = await importMnemonic(mnemonic);
+    await setMasterKey(key);
+    console.log("Master key imported and stored securely.");
     try {
-      const key = await importMnemonic(mnemonic);
-      await setMasterKey(key);
-      console.log("Master key imported and stored securely.");
-      try {
-        const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-        const { initSyncCrypto: initSyncCrypto2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-        const { cloudPullRoster: cloudPullRoster2 } = await Promise.resolve().then(() => (init_cloud_sync(), cloud_sync_exports));
-        const config = await loadConfig2();
-        if (config.cloud?.apiKey && config.cloud?.endpoint) {
-          initSyncCrypto2(key);
-          const result = await cloudPullRoster2({ apiKey: config.cloud.apiKey, endpoint: config.cloud.endpoint });
-          if (result.added > 0) {
-            console.log(`Pulled ${result.added} employee(s) from Exe Cloud.`);
-          }
+      const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+      const { initSyncCrypto: initSyncCrypto2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
+      const { cloudPullRoster: cloudPullRoster2 } = await Promise.resolve().then(() => (init_cloud_sync(), cloud_sync_exports));
+      const config = await loadConfig2();
+      if (config.cloud?.apiKey && config.cloud?.endpoint) {
+        initSyncCrypto2(key);
+        const result = await cloudPullRoster2({ apiKey: config.cloud.apiKey, endpoint: config.cloud.endpoint });
+        if (result.added > 0) {
+          console.log(`Pulled ${result.added} employee(s) from Exe Cloud.`);
         }
-      } catch {
       }
-      console.log("Run /exe-setup to configure sync and download the embedding model.");
-    } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+    } catch {
     }
+    console.log("Run /exe-setup to configure sync and download the embedding model.");
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+async function main(argv = process.argv.slice(2)) {
+  const mode = argv[0];
+  if (mode === "status") {
+    await printStatus();
+  } else if (mode === "export") {
+    await exportKey(argv);
+  } else if (mode === "import") {
+    await importKey();
   } else {
     console.error("Usage:");
-    console.error("  exe-link export   \u2014 show 24-word mnemonic for current key");
-    console.error("  exe-link import   \u2014 paste mnemonic to import key on new device");
+    console.error("  exe-link status                         \u2014 verify key availability without printing it");
+    console.error("  exe-link export                         \u2014 show masked 24-word mnemonic");
+    console.error("  exe-link export --local-terminal-only   \u2014 reveal full phrase in local Terminal only");
+    console.error("  exe-link import                         \u2014 paste mnemonic to import key on new device");
     process.exit(1);
   }
 }
-if (isMainModule(import.meta.url)) {
+if (isMainModule(import.meta.url) && process.argv[1]?.includes("exe-link")) {
   main().catch((err) => {
     console.error(err instanceof Error ? err.message : String(err));
     process.exit(1);
   });
 }
 export {
+  assertLocalTerminalExportAllowed,
+  isInteractiveTerminal,
   main
 };