@askexenow/exe-os 0.9.66 → 0.9.67

package/dist/bin/exe-cloud.js

@@ -20,12 +20,13 @@ var keychain_exports = {};
 __export(keychain_exports, {
   deleteMasterKey: () => deleteMasterKey,
   exportMnemonic: () => exportMnemonic,
+  getKeyStorageInfo: () => getKeyStorageInfo,
   getMasterKey: () => getMasterKey,
   importMnemonic: () => importMnemonic,
   setMasterKey: () => setMasterKey
 });
 import { readFile, writeFile, unlink, mkdir, chmod } from "fs/promises";
-import { existsSync } from "fs";
+import { existsSync, statSync } from "fs";
 import { execSync } from "child_process";
 import path from "path";
 import os from "os";
@@ -35,29 +36,65 @@ function getKeyDir() {
 function getKeyPath() {
   return path.join(getKeyDir(), "master.key");
 }
-function macKeychainGet() {
+function nativeKeychainAllowed() {
+  return process.env.EXE_OS_DISABLE_NATIVE_KEYCHAIN !== "1";
+}
+function linuxSecretAvailable() {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "linux") return false;
+  if (linuxSecretAvailability !== null) return linuxSecretAvailability;
+  try {
+    execSync("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
+  } catch {
+    linuxSecretAvailability = false;
+    return false;
+  }
+  try {
+    execSync("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
+    linuxSecretAvailability = true;
+  } catch {
+    linuxSecretAvailability = false;
+  }
+  return linuxSecretAvailability;
+}
+function isRootOnlyTrustedServerKeyFile(keyPath) {
+  if (process.platform !== "linux") return false;
+  try {
+    const uid = typeof os.userInfo().uid === "number" ? os.userInfo().uid : -1;
+    const st = statSync(keyPath);
+    if (!st.isFile() || (st.mode & 63) !== 0) return false;
+    if (uid === 0) return true;
+    const exeOsDir = process.env.EXE_OS_DIR;
+    return Boolean(exeOsDir && path.resolve(keyPath).startsWith(path.resolve(exeOsDir) + path.sep));
+  } catch {
+    return false;
+  }
+}
+function macKeychainGet(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return null;
   if (process.platform !== "darwin") return null;
   try {
     return execSync(
-      `security find-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w 2>/dev/null`,
+      `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
   } catch {
     return null;
   }
 }
-function macKeychainSet(value) {
+function macKeychainSet(value, service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "darwin") return false;
   try {
     try {
       execSync(
-        `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
+        `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
         { timeout: 5e3 }
       );
     } catch {
     }
     execSync(
-      `security add-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w "${value}"`,
+      `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
       { timeout: 5e3 }
     );
     return true;
@@ -65,11 +102,12 @@ function macKeychainSet(value) {
     return false;
   }
 }
-function macKeychainDelete() {
+function macKeychainDelete(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "darwin") return false;
   try {
     execSync(
-      `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
+      `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
     return true;
@@ -77,22 +115,22 @@ function macKeychainDelete() {
     return false;
   }
 }
-function linuxSecretGet() {
-  if (process.platform !== "linux") return null;
+function linuxSecretGet(service = SERVICE) {
+  if (!linuxSecretAvailable()) return null;
   try {
     return execSync(
-      `secret-tool lookup service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
+      `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
   } catch {
     return null;
   }
 }
-function linuxSecretSet(value) {
-  if (process.platform !== "linux") return false;
+function linuxSecretSet(value, service = SERVICE) {
+  if (!linuxSecretAvailable()) return false;
   try {
     execSync(
-      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${SERVICE}" account "${ACCOUNT}"`,
+      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
     return true;
@@ -100,11 +138,12 @@ function linuxSecretSet(value) {
     return false;
   }
 }
-function linuxSecretDelete() {
+function linuxSecretDelete(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "linux") return false;
   try {
     execSync(
-      `secret-tool clear service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
+      `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
     return true;
@@ -113,6 +152,7 @@ function linuxSecretDelete() {
   }
 }
 async function tryKeytar() {
+  if (!nativeKeychainAllowed()) return null;
   try {
     return await import("keytar");
   } catch {
@@ -186,7 +226,19 @@ async function writeMachineBoundFileFallback(b64) {
   return "plaintext";
 }
 async function getMasterKey() {
-  const nativeValue = macKeychainGet() ?? linuxSecretGet();
+  let nativeValue = macKeychainGet() ?? linuxSecretGet();
+  if (!nativeValue) {
+    const legacyValue = macKeychainGet(LEGACY_SERVICE) ?? linuxSecretGet(LEGACY_SERVICE);
+    if (legacyValue) {
+      const migrated = macKeychainSet(legacyValue) || linuxSecretSet(legacyValue);
+      if (migrated) {
+        macKeychainDelete(LEGACY_SERVICE);
+        linuxSecretDelete(LEGACY_SERVICE);
+        process.stderr.write("[keychain] Migrated keychain service from exe-mem to exe-os.\n");
+      }
+      nativeValue = legacyValue;
+    }
+  }
   if (nativeValue) {
     return Buffer.from(nativeValue, "base64");
   }
@@ -194,12 +246,17 @@ async function getMasterKey() {
   if (keytar) {
     try {
       const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
-      if (keytarValue) {
-        const migrated = macKeychainSet(keytarValue) || linuxSecretSet(keytarValue);
+      const legacyKeytarValue = keytarValue ?? await keytar.getPassword(LEGACY_SERVICE, ACCOUNT);
+      if (legacyKeytarValue) {
+        const migrated = macKeychainSet(legacyKeytarValue) || linuxSecretSet(legacyKeytarValue);
         if (migrated) {
           process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
+          try {
+            await keytar.deletePassword(LEGACY_SERVICE, ACCOUNT);
+          } catch {
+          }
         }
-        return Buffer.from(keytarValue, "base64");
+        return Buffer.from(legacyKeytarValue, "base64");
       }
     } catch {
     }
@@ -224,7 +281,7 @@ async function getMasterKey() {
       const decrypted = decryptWithMachineKey(content, machineKey);
       if (!decrypted) {
         process.stderr.write(
-          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase: exe-os link import\n"
+          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase during setup: exe-os setup\n"
         );
         return null;
       }
@@ -233,6 +290,9 @@ async function getMasterKey() {
       b64Value = content;
     }
     const key = Buffer.from(b64Value, "base64");
+    if (!content.startsWith(ENCRYPTED_PREFIX) && isRootOnlyTrustedServerKeyFile(keyPath)) {
+      return key;
+    }
     const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
     if (migrated) {
       process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
@@ -260,6 +320,97 @@ async function getMasterKey() {
     return null;
   }
 }
+async function getKeyStorageInfo() {
+  if (macKeychainGet()) {
+    return {
+      kind: "macos-keychain",
+      secure: true,
+      note: "stored in macOS Keychain via built-in security CLI"
+    };
+  }
+  if (macKeychainGet(LEGACY_SERVICE)) {
+    return {
+      kind: "macos-keychain",
+      secure: true,
+      note: "stored in legacy macOS Keychain service exe-mem; next key read migrates it to exe-os"
+    };
+  }
+  if (linuxSecretGet()) {
+    return {
+      kind: "linux-secret-service",
+      secure: true,
+      note: "stored in Linux Secret Service via secret-tool"
+    };
+  }
+  if (linuxSecretGet(LEGACY_SERVICE)) {
+    return {
+      kind: "linux-secret-service",
+      secure: true,
+      note: "stored in legacy Linux Secret Service service exe-mem; next key read migrates it to exe-os"
+    };
+  }
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      if (await keytar.getPassword(SERVICE, ACCOUNT)) {
+        return {
+          kind: "legacy-keytar",
+          secure: true,
+          note: "stored in legacy keytar backend; will migrate to native keychain when possible"
+        };
+      }
+      if (await keytar.getPassword(LEGACY_SERVICE, ACCOUNT)) {
+        return {
+          kind: "legacy-keytar",
+          secure: true,
+          note: "stored in legacy keytar service exe-mem; will migrate to native exe-os keychain when possible"
+        };
+      }
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (!existsSync(keyPath)) {
+    return {
+      kind: "missing",
+      secure: false,
+      path: keyPath,
+      note: "no key found in OS keychain, legacy keytar, or file fallback"
+    };
+  }
+  try {
+    const content = (await readFile(keyPath, "utf-8")).trim();
+    if (content.startsWith(ENCRYPTED_PREFIX)) {
+      return {
+        kind: "encrypted-file",
+        secure: true,
+        path: keyPath,
+        note: "stored in machine-bound encrypted file fallback"
+      };
+    }
+    if (isRootOnlyTrustedServerKeyFile(keyPath)) {
+      return {
+        kind: "server-secret-file",
+        secure: true,
+        path: keyPath,
+        note: "stored as root-only trusted server secret file"
+      };
+    }
+    return {
+      kind: "plaintext-file",
+      secure: false,
+      path: keyPath,
+      note: "stored in legacy plaintext file; reading it will migrate or encrypt it"
+    };
+  } catch {
+    return {
+      kind: "missing",
+      secure: false,
+      path: keyPath,
+      note: "key file exists but could not be read"
+    };
+  }
+}
 async function setMasterKey(key) {
   const b64 = key.toString("base64");
   if (macKeychainSet(b64) || linuxSecretSet(b64)) {
@@ -285,10 +436,13 @@ async function setMasterKey(key) {
 async function deleteMasterKey() {
   macKeychainDelete();
   linuxSecretDelete();
+  macKeychainDelete(LEGACY_SERVICE);
+  linuxSecretDelete(LEGACY_SERVICE);
   const keytar = await tryKeytar();
   if (keytar) {
     try {
       await keytar.deletePassword(SERVICE, ACCOUNT);
+      await keytar.deletePassword(LEGACY_SERVICE, ACCOUNT);
     } catch {
     }
   }
@@ -326,12 +480,14 @@ async function importMnemonic(mnemonic) {
   const entropy = mnemonicToEntropy(trimmed);
   return Buffer.from(entropy, "hex");
 }
-var SERVICE, ACCOUNT, ENCRYPTED_PREFIX;
+var SERVICE, LEGACY_SERVICE, ACCOUNT, linuxSecretAvailability, ENCRYPTED_PREFIX;
 var init_keychain = __esm({
   "src/lib/keychain.ts"() {
     "use strict";
-    SERVICE = "exe-mem";
+    SERVICE = "exe-os";
+    LEGACY_SERVICE = "exe-mem";
     ACCOUNT = "master-key";
+    linuxSecretAvailability = null;
     ENCRYPTED_PREFIX = "enc:";
   }
 });
@@ -479,6 +635,10 @@ async function loadConfig() {
     if (config.dbPath.startsWith("~")) {
       config.dbPath = config.dbPath.replace(/^~/, os2.homedir());
     }
+    const envDbPath = path2.join(dir, "memories.db");
+    if (process.env.EXE_OS_DIR && config.dbPath !== envDbPath && !existsSync3(config.dbPath) && existsSync3(envDbPath)) {
+      config.dbPath = envDbPath;
+    }
     return config;
   } catch {
     return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
@@ -1370,7 +1530,7 @@ import net from "net";
 import os5 from "os";
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync6, unlinkSync as unlinkSync2, readFileSync as readFileSync4, openSync, closeSync, statSync } from "fs";
+import { existsSync as existsSync6, unlinkSync as unlinkSync2, readFileSync as readFileSync4, openSync, closeSync, statSync as statSync2 } from "fs";
 import path6 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function handleData(chunk) {
@@ -1520,7 +1680,7 @@ function acquireSpawnLock() {
     return true;
   } catch {
     try {
-      const stat = statSync(SPAWN_LOCK_PATH);
+      const stat = statSync2(SPAWN_LOCK_PATH);
       if (Date.now() - stat.mtimeMs > SPAWN_LOCK_STALE_MS) {
         try {
           unlinkSync2(SPAWN_LOCK_PATH);
@@ -1681,7 +1841,7 @@ function killAndRespawnDaemon() {
 }
 function isDaemonTooYoung() {
   try {
-    const stat = statSync(PID_PATH);
+    const stat = statSync2(PID_PATH);
     return Date.now() - stat.mtimeMs < MIN_DAEMON_AGE_MS;
   } catch {
     return false;
@@ -2092,6 +2252,9 @@ function getClient() {
   if (_daemonClient && _daemonClient._isDaemonActive()) {
     return _daemonClient;
   }
+  if (!_resilientClient) {
+    return _adapterClient;
+  }
   return _resilientClient;
 }
 async function initDaemonClient() {
@@ -3124,6 +3287,127 @@ async function ensureSchema() {
       VALUES (new.rowid, new.content, new.subject, new.predicate, new.object);
     END;
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS agent_sessions (
+      id              TEXT PRIMARY KEY,
+      agent_id        TEXT NOT NULL,
+      project_name    TEXT,
+      started_at      TEXT NOT NULL,
+      last_event_at   TEXT NOT NULL,
+      event_count     INTEGER NOT NULL DEFAULT 0,
+      properties      TEXT DEFAULT '{}'
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_sessions_agent_time
+      ON agent_sessions(agent_id, started_at);
+
+    CREATE TABLE IF NOT EXISTS agent_goals (
+      id                TEXT PRIMARY KEY,
+      statement         TEXT NOT NULL,
+      owner_agent_id    TEXT,
+      project_name      TEXT,
+      status            TEXT NOT NULL DEFAULT 'open',
+      priority          INTEGER NOT NULL DEFAULT 5,
+      success_criteria  TEXT,
+      parent_goal_id    TEXT,
+      due_at            TEXT,
+      achieved_at       TEXT,
+      supersedes_id     TEXT,
+      created_at        TEXT NOT NULL,
+      updated_at        TEXT NOT NULL,
+      source_memory_id  TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_goals_project_status
+      ON agent_goals(project_name, status, priority);
+
+    CREATE TABLE IF NOT EXISTS agent_events (
+      id                  TEXT PRIMARY KEY,
+      event_type          TEXT NOT NULL,
+      occurred_at         TEXT NOT NULL,
+      sequence_index      INTEGER NOT NULL,
+      actor_agent_id      TEXT,
+      agent_role          TEXT,
+      project_name        TEXT,
+      session_id          TEXT,
+      task_id             TEXT,
+      goal_id             TEXT,
+      parent_event_id     TEXT,
+      intention           TEXT,
+      outcome             TEXT,
+      evidence_memory_id  TEXT,
+      impact              TEXT,
+      payload             TEXT DEFAULT '{}',
+      created_at          TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_time
+      ON agent_events(occurred_at, sequence_index);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_session_seq
+      ON agent_events(session_id, sequence_index);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_goal_time
+      ON agent_events(goal_id, occurred_at);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_memory
+      ON agent_events(evidence_memory_id);
+
+    CREATE TABLE IF NOT EXISTS agent_goal_links (
+      id           TEXT PRIMARY KEY,
+      goal_id      TEXT NOT NULL,
+      link_type    TEXT NOT NULL,
+      target_id    TEXT NOT NULL,
+      target_type  TEXT NOT NULL,
+      created_at   TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_goal_links_goal
+      ON agent_goal_links(goal_id, target_type);
+
+    CREATE TABLE IF NOT EXISTS agent_semantic_labels (
+      id                TEXT PRIMARY KEY,
+      source_memory_id  TEXT NOT NULL,
+      event_id          TEXT,
+      labeler           TEXT NOT NULL,
+      schema_version    INTEGER NOT NULL DEFAULT 1,
+      confidence        REAL NOT NULL DEFAULT 0,
+      labels            TEXT NOT NULL,
+      created_at        TEXT NOT NULL,
+      updated_at        TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_memory
+      ON agent_semantic_labels(source_memory_id, labeler);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_event
+      ON agent_semantic_labels(event_id);
+
+    CREATE TABLE IF NOT EXISTS agent_reflection_checkpoints (
+      id                  TEXT PRIMARY KEY,
+      project_name        TEXT,
+      session_id          TEXT,
+      window_start_at     TEXT NOT NULL,
+      window_end_at       TEXT NOT NULL,
+      event_count         INTEGER NOT NULL DEFAULT 0,
+      goal_count          INTEGER NOT NULL DEFAULT 0,
+      success_count       INTEGER NOT NULL DEFAULT 0,
+      failure_count       INTEGER NOT NULL DEFAULT 0,
+      risk_count          INTEGER NOT NULL DEFAULT 0,
+      summary             TEXT NOT NULL,
+      learnings           TEXT NOT NULL DEFAULT '[]',
+      next_actions        TEXT NOT NULL DEFAULT '[]',
+      evidence_event_ids  TEXT NOT NULL DEFAULT '[]',
+      confidence          REAL NOT NULL DEFAULT 0,
+      created_at          TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_reflection_project_time
+      ON agent_reflection_checkpoints(project_name, window_end_at);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_reflection_session_time
+      ON agent_reflection_checkpoints(session_id, window_end_at);
+  `);
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3`,
@@ -3611,8 +3895,8 @@ async function validateLicense(apiKey, deviceId) {
 }
 function getCacheAgeMs() {
   try {
-    const { statSync: statSync5 } = __require("fs");
-    const s = statSync5(CACHE_PATH);
+    const { statSync: statSync6 } = __require("fs");
+    const s = statSync6(CACHE_PATH);
     return Date.now() - s.mtimeMs;
   } catch {
     return Infinity;
@@ -4053,7 +4337,7 @@ __export(db_backup_exports, {
   listBackups: () => listBackups,
   rotateBackups: () => rotateBackups
 });
-import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync4, readdirSync, unlinkSync as unlinkSync4, statSync as statSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync4, readdirSync, unlinkSync as unlinkSync4, statSync as statSync3 } from "fs";
 import path9 from "path";
 function findActiveDb() {
   for (const name of DB_NAMES) {
@@ -4097,7 +4381,7 @@ function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
       if (!file.endsWith(".db") && !file.endsWith(".db-wal") && !file.endsWith(".db-shm")) continue;
       const filePath = path9.join(BACKUP_DIR, file);
       try {
-        const stat = statSync2(filePath);
+        const stat = statSync3(filePath);
         if (stat.mtimeMs < cutoff) {
           unlinkSync4(filePath);
           deleted++;
@@ -4115,7 +4399,7 @@ function listBackups() {
     const files = readdirSync(BACKUP_DIR).filter((f) => f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm"));
     return files.map((name) => {
       const p = path9.join(BACKUP_DIR, name);
-      const stat = statSync2(p);
+      const stat = statSync3(p);
       return { path: p, name, size: stat.size, date: stat.mtime };
     }).sort((a, b) => b.date.getTime() - a.date.getTime());
   } catch {
@@ -4148,10 +4432,10 @@ var init_db_backup = __esm({
 // src/lib/cloud-sync.ts
 var cloud_sync_exports = {};
 __export(cloud_sync_exports, {
-  CLOUD_RELINK_REQUIRED_MESSAGE: () => CLOUD_RELINK_REQUIRED_MESSAGE,
+  CLOUD_REUPLOAD_REQUIRED_MESSAGE: () => CLOUD_REUPLOAD_REQUIRED_MESSAGE,
   assertSecureEndpoint: () => assertSecureEndpoint,
   buildRosterBlob: () => buildRosterBlob,
-  clearCloudRelinkRequired: () => clearCloudRelinkRequired,
+  clearCloudReuploadRequired: () => clearCloudReuploadRequired,
   cloudPull: () => cloudPull,
   cloudPullBehaviors: () => cloudPullBehaviors,
   cloudPullBlob: () => cloudPullBlob,
@@ -4170,14 +4454,16 @@ __export(cloud_sync_exports, {
   cloudPushGraphRAG: () => cloudPushGraphRAG,
   cloudPushRoster: () => cloudPushRoster,
   cloudPushTasks: () => cloudPushTasks,
+  cloudResetMemoryBlobs: () => cloudResetMemoryBlobs,
   cloudSync: () => cloudSync,
-  getCloudRelinkRequired: () => getCloudRelinkRequired,
+  getCloudReuploadRequired: () => getCloudReuploadRequired,
+  markCloudReuploadRequired: () => markCloudReuploadRequired,
   mergeConfig: () => mergeConfig,
   mergeRosterFromRemote: () => mergeRosterFromRemote,
   pushToPostgres: () => pushToPostgres,
   recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync10, readdirSync as readdirSync2, mkdirSync as mkdirSync5, appendFileSync, unlinkSync as unlinkSync5, openSync as openSync2, closeSync as closeSync2, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync10, readdirSync as readdirSync2, mkdirSync as mkdirSync5, appendFileSync, unlinkSync as unlinkSync5, openSync as openSync2, closeSync as closeSync2, statSync as statSync4 } from "fs";
 import crypto4 from "crypto";
 import path10 from "path";
 import { homedir as homedir2 } from "os";
@@ -4224,18 +4510,36 @@ function loadPgClient() {
       const { pathToFileURL: pathToFileURL3 } = await import("url");
       const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
       if (explicitPath) {
-        const mod2 = await import(pathToFileURL3(explicitPath).href);
-        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
-        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
-        return new Ctor2();
+        const mod = await import(pathToFileURL3(explicitPath).href);
+        const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+        if (!Ctor) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor();
       }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path10.join(homedir2(), "exe-db");
-      const req = createRequire3(path10.join(exeDbRoot, "package.json"));
-      const entry = req.resolve("@prisma/client");
-      const mod = await import(pathToFileURL3(entry).href);
-      const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
-      if (!Ctor) throw new Error("No PrismaClient");
-      return new Ctor();
+      const packagePath = path10.join(exeDbRoot, "package.json");
+      if (existsSync10(packagePath)) {
+        const req = createRequire3(packagePath);
+        const entry = req.resolve("@prisma/client");
+        const mod = await import(pathToFileURL3(entry).href);
+        const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+        if (!Ctor) throw new Error("No PrismaClient");
+        return new Ctor();
+      }
+      const { Pool } = await import("pg");
+      const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+      return {
+        async $queryRawUnsafe(query, ...values) {
+          const result = await pool.query(query, values);
+          return result.rows;
+        },
+        async $executeRawUnsafe(query, ...values) {
+          const result = await pool.query(query, values);
+          return result.rowCount ?? 0;
+        },
+        async $disconnect() {
+          await pool.end();
+        }
+      };
     })().catch(() => {
       _pgFailed = true;
       _pgPromise = null;
@@ -4256,7 +4560,7 @@ async function pushToPostgres(records) {
   let inserted = 0;
   for (const rec of records) {
     try {
-      await prisma.$executeRawUnsafe(
+      const changed = await prisma.$executeRawUnsafe(
         `INSERT INTO raw.raw_events (id, source, source_id, event_type, payload, metadata, timestamp)
          VALUES (gen_random_uuid(), 'cloud_sync', $1, 'memory', $2::jsonb, $3::jsonb, $4)
          ON CONFLICT (source, source_id, event_type) DO NOTHING`,
@@ -4265,7 +4569,7 @@ async function pushToPostgres(records) {
         JSON.stringify({ agent_id: rec.agent_id, project_name: rec.project_name, tool_name: rec.tool_name }),
         rec.timestamp ? new Date(String(rec.timestamp)) : /* @__PURE__ */ new Date()
       );
-      inserted++;
+      inserted += Number(changed ?? 0);
     } catch {
     }
   }
@@ -4370,6 +4674,23 @@ async function cloudPush(records, maxVersion, config) {
     return false;
   }
 }
+async function cloudResetMemoryBlobs(config) {
+  assertSecureEndpoint(config.endpoint);
+  const resp = await fetchWithRetry(`${config.endpoint}/sync/reset-memory`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${config.apiKey}`,
+      "Content-Type": "application/json",
+      "X-Device-Id": loadDeviceId()
+    },
+    body: JSON.stringify({ confirm: "LOCAL DB IS SOURCE OF TRUTH" })
+  });
+  if (!resp.ok) {
+    throw new Error(`cloud reset failed: HTTP ${resp.status}`);
+  }
+  const data = await resp.json();
+  return { deleted: Number(data.deleted ?? 0), freedBytes: Number(data.freed_bytes ?? 0) };
+}
 async function cloudPull(sinceVersion, config) {
   assertSecureEndpoint(config.endpoint);
   try {
@@ -4389,40 +4710,61 @@ async function cloudPull(sinceVersion, config) {
     if (!response.ok) return { records: [], maxVersion: sinceVersion };
     const data = await response.json();
     const allRecords = [];
-    for (const { blob } of data.blobs ?? []) {
+    let maxReadableVersion = sinceVersion;
+    let skippedBlobs = 0;
+    for (const { version, blob } of data.blobs ?? []) {
       try {
         const compressed = decryptSyncBlob(blob);
         const json = decompress(compressed).toString("utf8");
         const records = JSON.parse(json);
         allRecords.push(...records);
+        const recordMax = records.reduce((max, rec) => {
+          const v = Number(rec.version ?? 0);
+          return Number.isFinite(v) ? Math.max(max, v) : max;
+        }, 0);
+        const blobVersion = Number(version ?? 0);
+        maxReadableVersion = Math.max(
+          maxReadableVersion,
+          Number.isFinite(blobVersion) ? blobVersion : 0,
+          recordMax
+        );
       } catch {
+        skippedBlobs++;
         continue;
       }
     }
-    return { records: allRecords, maxVersion: data.max_version ?? sinceVersion };
+    if (skippedBlobs > 0) {
+      logError(`[cloud-sync] PULL skipped ${skippedBlobs} undecryptable blob(s); pull cursor advanced only to last readable version ${maxReadableVersion}`);
+    }
+    return { records: allRecords, maxVersion: maxReadableVersion };
   } catch (err) {
     logError(`[cloud-sync] PULL FAILED: ${err instanceof Error ? err.message : String(err)}`);
     return { records: [], maxVersion: sinceVersion };
   }
 }
-async function getCloudRelinkRequired(client = getClient()) {
+async function getCloudReuploadRequired(client = getClient()) {
   try {
     await client.execute("CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
-    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
-    return String(relink.rows[0]?.value ?? "") === "1";
+    const result = await client.execute("SELECT key, value FROM sync_meta WHERE key IN ('cloud_reupload_required', 'cloud_relink_required')");
+    return result.rows.some((row) => String(row.value ?? "") === "1");
   } catch {
     return false;
   }
 }
-async function clearCloudRelinkRequired(client = getClient()) {
+async function clearCloudReuploadRequired(client = getClient()) {
   await client.execute("CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+  await client.execute("INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_reupload_required', '0')");
   await client.execute("INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_relink_required', '0')");
   await client.execute({
-    sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_relinked_at', ?)",
+    sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_reuploaded_at', ?)",
     args: [(/* @__PURE__ */ new Date()).toISOString()]
   });
   await client.execute("DELETE FROM sync_meta WHERE key IN ('last_cloud_pull_version', 'last_cloud_push_version')");
 }
+async function markCloudReuploadRequired(client = getClient()) {
+  await client.execute("CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+  await client.execute("INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_reupload_required', '1')");
+}
 async function cloudSync(config) {
   if (!isSyncCryptoInitialized()) {
     try {
@@ -4444,10 +4786,10 @@ async function cloudSync(config) {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
   try {
-    if (await getCloudRelinkRequired(client)) throw new Error(CLOUD_RELINK_REQUIRED_MESSAGE);
+    if (await getCloudReuploadRequired(client)) throw new Error(CLOUD_REUPLOAD_REQUIRED_MESSAGE);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    if (msg.includes("Paused after key rotation")) throw err;
+    if (msg === CLOUD_REUPLOAD_REQUIRED_MESSAGE || msg.includes("key rotation")) throw err;
   }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
@@ -4705,7 +5047,7 @@ async function cloudSync(config) {
     const { getLatestBackup: getLatestBackup2 } = await Promise.resolve().then(() => (init_db_backup(), db_backup_exports));
     const latestBackup = getLatestBackup2();
     if (latestBackup) {
-      const backupSize = statSync3(latestBackup).size;
+      const backupSize = statSync4(latestBackup).size;
       const MAX_CLOUD_BACKUP_BYTES = 50 * 1024 * 1024;
       if (backupSize <= MAX_CLOUD_BACKUP_BYTES) {
         const backupData = readFileSync7(latestBackup);
@@ -5376,7 +5718,7 @@ async function cloudPullDocuments(config) {
   }
   return { pulled };
 }
-var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, _pgPromise, _pgFailed, CLOUD_RELINK_REQUIRED_MESSAGE, ROSTER_DELETIONS_PATH;
+var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, _pgPromise, _pgFailed, CLOUD_REUPLOAD_REQUIRED_MESSAGE, ROSTER_DELETIONS_PATH;
 var init_cloud_sync = __esm({
   "src/lib/cloud-sync.ts"() {
     "use strict";
@@ -5395,7 +5737,7 @@ var init_cloud_sync = __esm({
     LOCK_STALE_MS = 3e4;
     _pgPromise = null;
     _pgFailed = false;
-    CLOUD_RELINK_REQUIRED_MESSAGE = "[cloud-sync] Paused after key rotation. Run `exe-os cloud relink --dry-run` for the safe relink checklist.";
+    CLOUD_REUPLOAD_REQUIRED_MESSAGE = "Cloud sync is blocked because this device rotated its memory encryption key. Run `exe-os cloud reupload` first to re-upload the cloud backup with the new key.";
     ROSTER_DELETIONS_PATH = path10.join(EXE_AI_DIR, "roster-deletions.json");
   }
 });
@@ -5665,7 +6007,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path11 from "path";
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readdirSync as readdirSync3, renameSync as renameSync3, statSync as statSync4 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readdirSync as readdirSync3, renameSync as renameSync3, statSync as statSync5 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -5729,7 +6071,7 @@ async function auditShardHealth(options = {}) {
   const shards = [];
   for (const name of names) {
     const dbPath = path11.join(SHARDS_DIR, `${name}.db`);
-    const stat = statSync4(dbPath);
+    const stat = statSync5(dbPath);
     const item = {
       name,
       path: dbPath,
@@ -5982,7 +6324,7 @@ async function getReadyShardClient(projectName) {
     _shardLastAccess.delete(safeName);
     const dbPath = path11.join(SHARDS_DIR, `${safeName}.db`);
     if (existsSync11(dbPath)) {
-      const stat = statSync4(dbPath);
+      const stat = statSync5(dbPath);
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
       const archivedPath = path11.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
       renameSync3(dbPath, archivedPath);
@@ -6489,6 +6831,274 @@ var init_memory_cards = __esm({
   }
 });
 
+// src/lib/agentic-ontology.ts
+var agentic_ontology_exports = {};
+__export(agentic_ontology_exports, {
+  clean: () => clean,
+  extractGoalCandidates: () => extractGoalCandidates,
+  inferIntention: () => inferIntention,
+  inferOntologyEventType: () => inferOntologyEventType,
+  inferOutcome: () => inferOutcome,
+  inferSemanticLabel: () => inferSemanticLabel,
+  insertOntologyForBatch: () => insertOntologyForBatch,
+  insertOntologyForMemory: () => insertOntologyForMemory,
+  ontologyPayload: () => ontologyPayload,
+  stableId: () => stableId2
+});
+import { createHash as createHash3 } from "crypto";
+function stableId2(...parts) {
+  return createHash3("sha256").update(parts.map((p) => String(p ?? "")).join("::")).digest("hex").slice(0, 32);
+}
+function clean(text, max = 240) {
+  return text.replace(/\u0000/g, "").replace(/```[\s\S]*?```/g, " ").replace(/\s+/g, " ").trim().slice(0, max);
+}
+function inferOntologyEventType(row) {
+  const lower = row.raw_text.toLowerCase();
+  if (row.has_error) return "error";
+  if (/\b(done|complete|completed|fixed|resolved|shipped|deployed|pushed|published)\b/.test(lower)) return "milestone";
+  if (/\b(blocked|failed|error|bug|regression|broken)\b/.test(lower)) return "problem";
+  if (/\b(decided|decision|adr|we chose|approved|rejected)\b/.test(lower)) return "decision";
+  if (/\b(goal|need to|we need|want to|trying to|objective)\b/.test(lower)) return "goal_signal";
+  if (["Bash", "Read", "Edit", "Write", "Grep", "Glob"].includes(row.tool_name)) return "tool_action";
+  if (row.tool_name.startsWith("memory_card")) return "memory_card";
+  return "memory_observation";
+}
+function inferIntention(row) {
+  if (row.intent) return clean(row.intent, 220);
+  const text = clean(row.raw_text, 1e3);
+  const patterns = [
+    /(?:we need to|need to|let'?s|i want to|we should|goal is to|objective is to|trying to)\s+([^.!?\n]{8,220})/i,
+    /(?:so that|in order to)\s+([^.!?\n]{8,220})/i,
+    /(?:task|plan):\s*([^.!?\n]{8,220})/i
+  ];
+  for (const p of patterns) {
+    const m = text.match(p);
+    if (m?.[1]) return clean(m[1], 220);
+  }
+  if (["Bash", "Read", "Edit", "Write", "Grep", "Glob"].includes(row.tool_name)) {
+    return `${row.tool_name} during ${row.project_name}`;
+  }
+  return null;
+}
+function inferOutcome(row) {
+  if (row.outcome) return clean(row.outcome, 220);
+  if (row.has_error) return "error";
+  const lower = row.raw_text.toLowerCase();
+  if (/\b(done|complete|completed|fixed|resolved|shipped|deployed|pushed|published|passed)\b/.test(lower)) return "success_signal";
+  if (/\b(blocked|failed|error|regression|broken|not working|could not)\b/.test(lower)) return "failure_signal";
+  if (/\b(warning|risk|concern|caveat)\b/.test(lower)) return "risk_signal";
+  return null;
+}
+function extractGoalCandidates(row) {
+  const text = clean(row.raw_text, 1600);
+  const patterns = [
+    /(?:we need to|need to|i want to|we should|goal is to|objective is to|trying to|let'?s)\s+([^.!?\n]{12,220})/gi,
+    /(?:success means|success criteria|so that)\s+([^.!?\n]{12,220})/gi
+  ];
+  const out = [];
+  for (const pattern of patterns) {
+    for (const m of text.matchAll(pattern)) {
+      const candidate = clean(m[1] ?? "", 220);
+      if (candidate.length >= 12 && !out.some((x) => x.toLowerCase() === candidate.toLowerCase())) out.push(candidate);
+      if (out.length >= 3) return out;
+    }
+  }
+  return out;
+}
+function uniq(values, max = 6) {
+  const out = [];
+  for (const value of values.map((v) => clean(v, 220)).filter(Boolean)) {
+    if (!out.some((x) => x.toLowerCase() === value.toLowerCase())) out.push(value);
+    if (out.length >= max) break;
+  }
+  return out;
+}
+function extractMatches(text, patterns, max = 5) {
+  const out = [];
+  for (const pattern of patterns) {
+    for (const match of text.matchAll(pattern)) {
+      const value = match[1] ?? match[0];
+      if (value) out.push(value);
+      if (out.length >= max) return uniq(out, max);
+    }
+  }
+  return uniq(out, max);
+}
+function inferSemanticLabel(row) {
+  const text = clean(row.raw_text, 2400);
+  const eventType = inferOntologyEventType(row);
+  const intention = inferIntention(row);
+  const outcome = inferOutcome(row);
+  const goals = extractGoalCandidates(row);
+  const milestones = extractMatches(text, [
+    /\b(?:completed|finished|fixed|resolved|shipped|deployed|published|pushed|passed)\b([^.!?\n]{0,180})/gi,
+    /(?:milestone|done):\s*([^.!?\n]{8,220})/gi
+  ]);
+  const problems = extractMatches(text, [
+    /\b(?:blocked by|failed because|bug|regression|broken|not working|error)\b([^.!?\n]{0,180})/gi,
+    /(?:problem|issue|risk):\s*([^.!?\n]{8,220})/gi
+  ]);
+  const decisions = extractMatches(text, [
+    /(?:decided|decision|adr|we chose|approved|rejected)\s+([^.!?\n]{8,220})/gi
+  ]);
+  const temporalAnchors = extractMatches(text, [
+    /\b(\d{4}-\d{2}-\d{2}(?:[T ][0-9:.+-Z]+)?)\b/g,
+    /\b(today|yesterday|tomorrow|this week|next week|last week|morning|afternoon|tonight)\b/gi
+  ], 8);
+  const nextActions = extractMatches(text, [
+    /(?:next|todo|follow[- ]?up|remaining|need to)\s*:?\s*([^.!?\n]{8,220})/gi
+  ]);
+  const actors = uniq([
+    row.agent_id,
+    ...extractMatches(text, [/\b(?:agent|employee|owner|assignee)[:= ]+([a-zA-Z][a-zA-Z0-9_-]{1,40})/gi], 5)
+  ], 6);
+  const successSignals = milestones.length ? milestones : outcome === "success_signal" ? [clean(text, 180)] : [];
+  const failureSignals = problems.length ? problems : outcome === "failure_signal" || row.has_error ? [clean(text, 180)] : [];
+  const impact = successSignals.length && failureSignals.length ? "mixed" : failureSignals.length ? "negative" : successSignals.length ? "positive" : "neutral";
+  const signalCount = goals.length + milestones.length + problems.length + decisions.length + nextActions.length;
+  return {
+    labeler: "deterministic",
+    schemaVersion: 1,
+    eventType,
+    intention,
+    outcome,
+    impact,
+    confidence: Math.min(0.95, 0.45 + signalCount * 0.08 + (intention ? 0.1 : 0) + (outcome ? 0.1 : 0)),
+    goals,
+    milestones,
+    problems,
+    decisions,
+    actors,
+    temporalAnchors,
+    successSignals,
+    failureSignals,
+    nextActions,
+    summary: clean(text, 280)
+  };
+}
+function ontologyPayload(row) {
+  const semantic = inferSemanticLabel(row);
+  return {
+    tool_name: row.tool_name,
+    memory_version: row.version ?? null,
+    domain: row.domain ?? null,
+    trajectory: row.trajectory ? safeJson(row.trajectory) : null,
+    semantic
+  };
+}
+function safeJson(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value.slice(0, 1e3);
+  }
+}
+async function resolveClient(client) {
+  if (client) return client;
+  const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+  return getClient2();
+}
+async function insertOntologyForMemory(row, client) {
+  const db = await resolveClient(client);
+  const occurredAt = row.timestamp;
+  const sequence = Number(row.version ?? 0) || Math.floor(new Date(occurredAt).getTime() / 1e3);
+  const eventType = inferOntologyEventType(row);
+  const intention = inferIntention(row);
+  const outcome = inferOutcome(row);
+  const eventId = stableId2("event", row.id);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  await db.execute({
+    sql: `INSERT INTO agent_sessions (id, agent_id, project_name, started_at, last_event_at, event_count, properties)
+          VALUES (?, ?, ?, ?, ?, 1, ?)
+          ON CONFLICT(id) DO UPDATE SET last_event_at = MAX(last_event_at, excluded.last_event_at),
+            event_count = event_count + 1`,
+    args: [row.session_id, row.agent_id, row.project_name, occurredAt, occurredAt, JSON.stringify({ agent_role: row.agent_role })]
+  });
+  await db.execute({
+    sql: `INSERT OR IGNORE INTO agent_events
+          (id, event_type, occurred_at, sequence_index, actor_agent_id, agent_role, project_name,
+           session_id, task_id, goal_id, parent_event_id, intention, outcome, evidence_memory_id,
+           impact, payload, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?, ?, ?, ?, ?)`,
+    args: [
+      eventId,
+      eventType,
+      occurredAt,
+      sequence,
+      row.agent_id,
+      row.agent_role,
+      row.project_name,
+      row.session_id,
+      row.task_id ?? null,
+      intention,
+      outcome,
+      row.id,
+      row.has_error ? "negative" : outcome === "success_signal" ? "positive" : "neutral",
+      JSON.stringify(ontologyPayload(row)),
+      now
+    ]
+  });
+  const semantic = inferSemanticLabel(row);
+  await db.execute({
+    sql: `INSERT INTO agent_semantic_labels
+          (id, source_memory_id, event_id, labeler, schema_version, confidence, labels, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(id) DO UPDATE SET confidence = excluded.confidence,
+            labels = excluded.labels, updated_at = excluded.updated_at`,
+    args: [
+      stableId2("semantic", row.id, semantic.labeler, semantic.schemaVersion),
+      row.id,
+      eventId,
+      semantic.labeler,
+      semantic.schemaVersion,
+      semantic.confidence,
+      JSON.stringify(semantic),
+      now,
+      now
+    ]
+  });
+  for (const statement of extractGoalCandidates(row)) {
+    const goalId = stableId2("goal", row.project_name, statement.toLowerCase());
+    await db.execute({
+      sql: `INSERT INTO agent_goals
+            (id, statement, owner_agent_id, project_name, status, priority, success_criteria,
+             parent_goal_id, due_at, achieved_at, supersedes_id, created_at, updated_at, source_memory_id)
+            VALUES (?, ?, ?, ?, 'open', 5, NULL, NULL, NULL, NULL, NULL, ?, ?, ?)
+            ON CONFLICT(id) DO UPDATE SET updated_at = excluded.updated_at`,
+      args: [goalId, statement, row.agent_id, row.project_name, now, now, row.id]
+    });
+    await db.execute({
+      sql: `INSERT OR IGNORE INTO agent_goal_links
+            (id, goal_id, link_type, target_id, target_type, created_at)
+            VALUES (?, ?, 'evidence', ?, 'memory', ?)`,
+      args: [stableId2("goal_link", goalId, row.id, "memory"), goalId, row.id, now]
+    });
+    await db.execute({
+      sql: `INSERT OR IGNORE INTO agent_goal_links
+            (id, goal_id, link_type, target_id, target_type, created_at)
+            VALUES (?, ?, 'event', ?, 'event', ?)`,
+      args: [stableId2("goal_link", goalId, eventId, "event"), goalId, eventId, now]
+    });
+  }
+}
+async function insertOntologyForBatch(rows, client) {
+  const db = await resolveClient(client);
+  let count = 0;
+  for (const row of rows) {
+    try {
+      await insertOntologyForMemory(row, db);
+      count++;
+    } catch {
+    }
+  }
+  return count;
+}
+var init_agentic_ontology = __esm({
+  "src/lib/agentic-ontology.ts"() {
+    "use strict";
+  }
+});
+
 // src/lib/store.ts
 var store_exports = {};
 __export(store_exports, {
@@ -6832,6 +7442,11 @@ async function flushBatch() {
       await insertMemoryCardsForBatch2(batch);
     } catch {
     }
+    try {
+      const { insertOntologyForBatch: insertOntologyForBatch2 } = await Promise.resolve().then(() => (init_agentic_ontology(), agentic_ontology_exports));
+      await insertOntologyForBatch2(batch);
+    } catch {
+    }
     schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
     _pendingRecords.splice(0, batch.length);
     try {
@@ -7201,8 +7816,8 @@ function ask(rl, question) {
     rl.question(question, (answer) => resolve(answer.trim()));
   });
 }
-function shouldRunRelinkMutation(options) {
-  return options.relinkRequired && !options.dryRun && (options.force || options.interactive);
+function shouldRunReuploadMutation(options) {
+  return options.reuploadRequired && !options.dryRun && (options.force || options.interactive);
 }
 async function runCloudSyncOnce() {
   const { initStore: initStore2 } = await Promise.resolve().then(() => (init_store(), store_exports));
@@ -7240,12 +7855,12 @@ async function setupMode() {
   console.log(" EXE CLOUD SETUP");
   console.log(BAR);
   console.log("");
-  console.log("Step 1: Encryption Key");
+  console.log("Step 1: Memory encryption key");
   const existingKey = await getMasterKey();
   if (existingKey) {
-    console.log("  \u2713 Master key already present. Skipping.\n");
+    console.log("  \u2713 This device already has its memory encryption key. Skipping.\n");
   } else {
-    const hasPhrase = await ask(rl, "  Do you have a 24-word recovery phrase from another device? (y/n) ");
+    const hasPhrase = await ask(rl, "  Do you have a 24-word recovery phrase from another Exe OS device? (y/n) ");
     if (hasPhrase.toLowerCase().startsWith("y")) {
       const mnemonic = await ask(rl, "  Paste your 24 words: ");
       try {
@@ -7258,8 +7873,9 @@ async function setupMode() {
         process.exit(1);
       }
     } else {
-      console.log("  No recovery phrase \u2014 run /exe-setup on your first device to generate one.");
-      console.log("  Then use /exe-cloud link on that device to get the phrase.\n");
+      console.log("  No recovery phrase yet.");
+      console.log("  On your first device, run: exe-os setup");
+      console.log("  Then reveal the phrase there with: exe-os cloud link --show-full\n");
       rl.close();
       return;
     }
@@ -7287,9 +7903,9 @@ async function setupMode() {
       }
     }
   } else {
-    const apiKey = await ask(rl, "  Paste your API key (exe_sk_...): ");
+    const apiKey = await ask(rl, "  Paste your Exe Cloud API key (exe_sk_...): ");
     if (!apiKey) {
-      console.log("  Skipped. Use /exe-settings to configure later.");
+      console.log("  Skipped. You can configure cloud later with: exe-os cloud");
       rl.close();
       return;
     }
@@ -7379,7 +7995,7 @@ async function linkMode() {
   console.log(" EXE CLOUD \u2014 DEVICE SYNC INFO");
   console.log(BAR);
   console.log("");
-  console.log("Run /exe-cloud on the new device and paste these when prompted:\n");
+  console.log("On the new device, run `exe-os cloud` and paste these when prompted:\n");
   console.log("  24-word recovery phrase:");
   if (showFull) {
     console.log(`  ${mnemonic}
@@ -7412,6 +8028,38 @@ async function linkMode() {
 async function statusMode() {
   const key = await getMasterKey();
   const config = await loadConfig();
+  let reuploadRequired = false;
+  let localMemoryVersion = 0;
+  let lastPushedMemoryVersion = 0;
+  let pendingMemoryCount = 0;
+  let lastPullVersion = 0;
+  let cloudReuploadedAt = null;
+  try {
+    const { initStore: initStore2 } = await Promise.resolve().then(() => (init_store(), store_exports));
+    const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+    const { getCloudReuploadRequired: getCloudReuploadRequired2 } = await Promise.resolve().then(() => (init_cloud_sync(), cloud_sync_exports));
+    await initStore2({ lightweight: true });
+    const client = getClient2();
+    reuploadRequired = await getCloudReuploadRequired2(client);
+    const maxVersion = await client.execute("SELECT COALESCE(MAX(version), 0) as version FROM memories WHERE scope IS NULL OR scope != 'personal'");
+    localMemoryVersion = Number(maxVersion.rows[0]?.version ?? 0);
+    const meta = await client.execute("SELECT key, value FROM sync_meta WHERE key IN ('last_cloud_push_version', 'last_cloud_pull_version', 'cloud_reuploaded_at', 'cloud_relinked_at')");
+    for (const row of meta.rows) {
+      const keyName = String(row.key ?? "");
+      const value = String(row.value ?? "");
+      if (keyName === "last_cloud_push_version") lastPushedMemoryVersion = Number(value || 0);
+      if (keyName === "last_cloud_pull_version") lastPullVersion = Number(value || 0);
+      if (keyName === "cloud_reuploaded_at" || keyName === "cloud_relinked_at") cloudReuploadedAt = value;
+    }
+    const pending = await client.execute({
+      sql: "SELECT COUNT(*) as cnt FROM memories WHERE (scope IS NULL OR scope != 'personal') AND version > ?",
+      args: [lastPushedMemoryVersion]
+    });
+    pendingMemoryCount = Number(pending.rows[0]?.cnt ?? 0);
+  } catch {
+  } finally {
+    await disposeCloudCliResources();
+  }
   console.log(BAR);
   console.log(" EXE CLOUD STATUS");
   console.log(BAR);
@@ -7424,8 +8072,26 @@ async function statusMode() {
   }
   if (config.cloud?.apiKey) {
     const masked = config.cloud.apiKey.slice(0, 10) + "..." + config.cloud.apiKey.slice(-4);
-    console.log(`  Cloud sync:     \u2713 Exe Cloud (${masked})`);
+    console.log(`  Cloud account:  connected to Exe Cloud (${masked})`);
     console.log(`  Endpoint:       ${config.cloud.endpoint}`);
+    console.log("  Status check:   read-only; no data was uploaded or downloaded");
+    console.log("");
+    if (reuploadRequired) {
+      console.log("  Sync status:    NOT SYNCING \u2014 blocked for safety");
+      console.log("  Why:            this device changed its memory encryption key");
+      console.log("  Required fix:   run `exe-os cloud reupload`");
+      console.log("  After reupload: automatic background sync will resume");
+    } else if (pendingMemoryCount > 0) {
+      console.log("  Sync status:    SYNC ENABLED \u2014 waiting for background sync");
+      console.log(`  Pending upload: ${pendingMemoryCount} local memor${pendingMemoryCount === 1 ? "y" : "ies"}`);
+      console.log("  Manual option:  run `exe-os cloud sync` to sync now");
+    } else {
+      console.log("  Sync status:    SYNCED \u2014 no local memory changes waiting to upload");
+      console.log("  Auto sync:      enabled \u2014 daemon syncs in the background");
+    }
+    console.log("");
+    console.log(`  Memory cursor:  local=${localMemoryVersion} last pushed=${lastPushedMemoryVersion} last pulled=${lastPullVersion}`);
+    if (cloudReuploadedAt) console.log(`  Last re-upload: ${cloudReuploadedAt}`);
   } else if (config.turso?.url) {
     console.log(`  Cloud sync:     \u2713 libSQL (legacy) (${config.turso.url})`);
   } else {
@@ -7434,41 +8100,45 @@ async function statusMode() {
   console.log("");
   console.log(BAR);
 }
-async function relinkMode() {
+async function reuploadMode() {
   const dryRun = process.argv.includes("--dry-run");
   const force = process.argv.includes("--local-db-is-source-of-truth") || process.argv.includes("--yes");
   const { initStore: initStore2 } = await Promise.resolve().then(() => (init_store(), store_exports));
   const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
-  const { getCloudRelinkRequired: getCloudRelinkRequired2, clearCloudRelinkRequired: clearCloudRelinkRequired2 } = await Promise.resolve().then(() => (init_cloud_sync(), cloud_sync_exports));
+  const { getCloudReuploadRequired: getCloudReuploadRequired2, clearCloudReuploadRequired: clearCloudReuploadRequired2, markCloudReuploadRequired: markCloudReuploadRequired2, cloudResetMemoryBlobs: cloudResetMemoryBlobs2 } = await Promise.resolve().then(() => (init_cloud_sync(), cloud_sync_exports));
   await initStore2({ lightweight: true });
   try {
     const client = getClient2();
-    const required = await getCloudRelinkRequired2(client);
+    const required = await getCloudReuploadRequired2(client);
     console.log(BAR);
-    console.log(" EXE CLOUD RELINK AFTER KEY ROTATION");
+    console.log(" EXE CLOUD RE-UPLOAD AFTER KEY ROTATION");
     console.log(BAR);
     console.log("");
     if (!required) {
-      console.log("Cloud relink flag: not set. Normal cloud sync is allowed.");
+      console.log("Cloud status: connected");
+      console.log("Normal cloud sync is safe to run.");
       return;
     }
-    console.log("Cloud relink flag: REQUIRED");
+    console.log("Cloud status: needs cloud re-upload after key rotation");
     console.log("");
-    console.log("Why: this device rotated its memory encryption key. Old cloud blobs may be encrypted with the previous key.");
+    console.log("What this means:");
+    console.log("  This device now uses a new memory encryption key.");
+    console.log("  The cloud copy may still be encrypted with the old key.");
+    console.log("  Normal cloud sync is paused until this device re-uploads the cloud backup.");
     console.log("");
-    console.log("This wizard will:");
-    console.log("  1. Verify the local DB is open with the current key.");
-    console.log("  2. Confirm you saved the current 24-word recovery phrase.");
-    console.log("  3. Treat this local DB as source of truth.");
-    console.log("  4. Reset cloud cursors and reupload under the current key.");
+    console.log("Running `exe-os cloud reupload` will:");
+    console.log("  1. Open your local memory DB with the current key.");
+    console.log("  2. Ask you to confirm you saved the current 24-word recovery phrase.");
+    console.log("  3. Treat this device as the correct copy of your memory.");
+    console.log("  4. Re-upload your cloud backup encrypted with the current key.");
     console.log("");
     if (dryRun) {
-      console.log("No changes made.");
-      console.log("When ready, run: exe-os cloud relink");
+      console.log("Dry run only. No changes made.");
+      console.log("When ready, run: exe-os cloud reupload");
       return;
     }
-    if (!shouldRunRelinkMutation({ dryRun, force, interactive: isInteractiveTerminal(), relinkRequired: required })) {
-      console.error("Refusing to relink cloud from a non-interactive session. Use local Terminal or pass --local-db-is-source-of-truth for automation.");
+    if (!shouldRunReuploadMutation({ dryRun, force, interactive: isInteractiveTerminal(), reuploadRequired: required })) {
+      console.error("For safety, cloud re-upload must be run in your local Terminal: exe-os cloud reupload\nAutomation only: pass --local-db-is-source-of-truth if this device is definitely the correct copy.");
       process.exitCode = 1;
       return;
     }
@@ -7481,7 +8151,7 @@ async function relinkMode() {
           process.exitCode = 1;
           return;
         }
-        const confirm = await ask(rl, 'Type "LOCAL DB IS SOURCE OF TRUTH" to reupload cloud data: ');
+        const confirm = await ask(rl, 'Type "LOCAL DB IS SOURCE OF TRUTH" to re-upload cloud data: ');
         if (confirm !== "LOCAL DB IS SOURCE OF TRUTH") {
           console.log("Cancelled.");
           process.exitCode = 1;
@@ -7491,16 +8161,31 @@ async function relinkMode() {
         rl.close();
       }
     }
-    await clearCloudRelinkRequired2(client);
-    console.log("\u2713 Cloud relink flag cleared. Reuploading local DB under current key...");
-    const result = await runCloudSyncOnce();
+    console.log("\u2713 Local DB confirmed. Clearing old cloud memory blobs, then re-uploading with the current key...");
+    try {
+      const reset = await cloudResetMemoryBlobs2((await loadConfig()).cloud);
+      console.log(`\u2713 Cleared ${reset.deleted} old cloud memory blob(s) before re-upload.`);
+    } catch (err) {
+      console.error(`Cloud reset failed before re-upload: ${err instanceof Error ? err.message : String(err)}`);
+      console.error("Cloud sync remains paused. Try again after the endpoint is available.");
+      process.exitCode = 1;
+      return;
+    }
+    await clearCloudReuploadRequired2(client);
+    let result;
+    try {
+      result = await runCloudSyncOnce();
+    } catch (err) {
+      await markCloudReuploadRequired2(client);
+      throw err;
+    }
     console.log("");
-    console.log("Cloud relink complete.");
-    console.log(`  Memories:       ${result.totalMemories} total  (\u2191 ${result.pushed} pushed, \u2193 ${result.pulled} pulled)`);
+    console.log("Cloud re-upload complete. Normal cloud sync is safe again.");
+    console.log(`  Active memories: ${result.totalMemories}  (\u2191 ${result.pushed} syncable rows pushed, \u2193 ${result.pulled} pulled)`);
     console.log(`  Behaviors:      ${result.behaviors.pushed} total  (\u2193 ${result.behaviors.pulled} pulled)`);
     console.log(`  Roster:         ${result.roster.employees} employees, ${result.roster.identities} identities`);
     console.log(`  Tasks:          ${result.tasks.pushed} total  (\u2193 ${result.tasks.pulled} pulled)`);
-    console.log("Other devices must relink with the current recovery phrase.");
+    console.log("Other devices must reconnect using the current 24-word recovery phrase.");
   } finally {
     await disposeCloudCliResources();
   }
@@ -7510,21 +8195,26 @@ async function main() {
   if (mode === "link" || mode === "export") {
     await linkMode();
   } else if (mode === "sync") {
-    console.error("[deprecated] exe-cloud sync for device linking is now exe-cloud link. Use exe-os cloud sync for data sync.");
-    await linkMode();
+    console.error("Use `exe-os cloud sync` for data sync.");
+    console.error("Use `exe-os cloud link --show-full` to reveal the recovery phrase in your local Terminal.");
+    process.exitCode = 1;
   } else if (mode === "status") {
     await statusMode();
+  } else if (mode === "reupload") {
+    await reuploadMode();
   } else if (mode === "relink") {
-    await relinkMode();
+    console.error("`exe-os cloud relink` has been removed. Use: exe-os cloud reupload");
+    process.exitCode = 1;
   } else if (!mode || mode === "setup") {
     await setupMode();
   } else {
     console.error("Usage:");
-    console.error("  exe-cloud         \u2014 full device setup (key + cloud)");
-    console.error("  exe-cloud link    \u2014 export recovery phrase + cloud info for a new device");
-    console.error("  exe-cloud status  \u2014 show current sync status");
-    console.error("  exe-cloud relink  \u2014 guided post-key-rotation cloud reupload");
-    console.error("  exe-cloud relink --dry-run");
+    console.error("  exe-os cloud            \u2014 full device setup (key + cloud)");
+    console.error("  exe-os cloud link       \u2014 show recovery phrase + cloud info for a new device");
+    console.error("  exe-os cloud status     \u2014 show current cloud status");
+    console.error("  exe-os cloud sync       \u2014 run sync now (normally automatic)");
+    console.error("  exe-os cloud reupload   \u2014 re-upload cloud backup after key rotation");
+    console.error("  exe-os cloud reupload --dry-run");
     process.exit(1);
   }
 }
@@ -7536,5 +8226,5 @@ if (isMainModule(import.meta.url) && process.argv[1]?.includes("exe-cloud")) {
 }
 export {
   main,
-  shouldRunRelinkMutation
+  shouldRunReuploadMutation
 };