@askexenow/exe-os 0.9.66 → 0.9.67

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (99) hide show
  1. package/deploy/stack-manifests/v0.9.json +54 -5
  2. package/dist/bin/age-ontology-load.js +61 -0
  3. package/dist/bin/agentic-ontology-backfill.js +4708 -0
  4. package/dist/bin/agentic-reflection-backfill.js +4144 -0
  5. package/dist/bin/{exe-link.js → agentic-semantic-label.js} +1523 -2275
  6. package/dist/bin/backfill-conversations.js +506 -20
  7. package/dist/bin/backfill-responses.js +506 -20
  8. package/dist/bin/backfill-vectors.js +233 -20
  9. package/dist/bin/bulk-sync-postgres.js +4876 -0
  10. package/dist/bin/cleanup-stale-review-tasks.js +507 -21
  11. package/dist/bin/cli.js +2450 -1530
  12. package/dist/bin/exe-assign.js +506 -20
  13. package/dist/bin/exe-boot.js +410 -60
  14. package/dist/bin/exe-cloud.js +795 -105
  15. package/dist/bin/exe-dispatch.js +516 -22
  16. package/dist/bin/exe-doctor.js +587 -30
  17. package/dist/bin/exe-export-behaviors.js +518 -24
  18. package/dist/bin/exe-forget.js +507 -21
  19. package/dist/bin/exe-gateway.js +571 -25
  20. package/dist/bin/exe-heartbeat.js +518 -24
  21. package/dist/bin/exe-kill.js +507 -21
  22. package/dist/bin/exe-launch-agent.js +2312 -1069
  23. package/dist/bin/exe-new-employee.js +197 -165
  24. package/dist/bin/exe-pending-messages.js +507 -21
  25. package/dist/bin/exe-pending-notifications.js +507 -21
  26. package/dist/bin/exe-pending-reviews.js +507 -21
  27. package/dist/bin/exe-rename.js +507 -21
  28. package/dist/bin/exe-review.js +507 -21
  29. package/dist/bin/exe-search.js +518 -24
  30. package/dist/bin/exe-session-cleanup.js +516 -22
  31. package/dist/bin/exe-settings.js +4 -0
  32. package/dist/bin/exe-start-codex.js +682 -143
  33. package/dist/bin/exe-start-opencode.js +627 -79
  34. package/dist/bin/exe-status.js +507 -21
  35. package/dist/bin/exe-team.js +507 -21
  36. package/dist/bin/git-sweep.js +516 -22
  37. package/dist/bin/graph-backfill.js +558 -21
  38. package/dist/bin/graph-export.js +507 -21
  39. package/dist/bin/graph-layer-benchmark.js +109 -0
  40. package/dist/bin/install.js +305 -288
  41. package/dist/bin/intercom-check.js +516 -22
  42. package/dist/bin/postgres-agentic-reflection-backfill.js +187 -0
  43. package/dist/bin/postgres-agentic-semantic-backfill.js +237 -0
  44. package/dist/bin/scan-tasks.js +516 -22
  45. package/dist/bin/setup.js +412 -62
  46. package/dist/bin/shard-migrate.js +506 -20
  47. package/dist/gateway/index.js +569 -23
  48. package/dist/hooks/bug-report-worker.js +519 -25
  49. package/dist/hooks/codex-stop-task-finalizer.js +516 -22
  50. package/dist/hooks/commit-complete.js +516 -22
  51. package/dist/hooks/error-recall.js +518 -24
  52. package/dist/hooks/ingest.js +516 -22
  53. package/dist/hooks/instructions-loaded.js +507 -21
  54. package/dist/hooks/notification.js +507 -21
  55. package/dist/hooks/post-compact.js +507 -21
  56. package/dist/hooks/post-tool-combined.js +519 -25
  57. package/dist/hooks/pre-compact.js +516 -22
  58. package/dist/hooks/pre-tool-use.js +507 -21
  59. package/dist/hooks/prompt-submit.js +519 -25
  60. package/dist/hooks/session-end.js +516 -22
  61. package/dist/hooks/session-start.js +520 -26
  62. package/dist/hooks/stop.js +517 -23
  63. package/dist/hooks/subagent-stop.js +507 -21
  64. package/dist/hooks/summary-worker.js +411 -61
  65. package/dist/index.js +569 -23
  66. package/dist/lib/cloud-sync.js +391 -53
  67. package/dist/lib/config.js +13 -1
  68. package/dist/lib/consolidation.js +1 -1
  69. package/dist/lib/database.js +124 -0
  70. package/dist/lib/db.js +124 -0
  71. package/dist/lib/device-registry.js +124 -0
  72. package/dist/lib/embedder.js +13 -1
  73. package/dist/lib/exe-daemon.js +2184 -561
  74. package/dist/lib/hybrid-search.js +518 -24
  75. package/dist/lib/identity.js +3 -0
  76. package/dist/lib/keychain.js +178 -22
  77. package/dist/lib/messaging.js +3 -0
  78. package/dist/lib/reminders.js +3 -0
  79. package/dist/lib/schedules.js +233 -20
  80. package/dist/lib/skill-learning.js +16 -1
  81. package/dist/lib/store.js +506 -20
  82. package/dist/lib/tasks.js +16 -1
  83. package/dist/lib/tmux-routing.js +16 -1
  84. package/dist/lib/token-spend.js +3 -0
  85. package/dist/mcp/server.js +1757 -428
  86. package/dist/mcp/tools/complete-reminder.js +3 -0
  87. package/dist/mcp/tools/create-reminder.js +3 -0
  88. package/dist/mcp/tools/create-task.js +16 -1
  89. package/dist/mcp/tools/deactivate-behavior.js +3 -0
  90. package/dist/mcp/tools/list-reminders.js +3 -0
  91. package/dist/mcp/tools/list-tasks.js +3 -0
  92. package/dist/mcp/tools/send-message.js +3 -0
  93. package/dist/mcp/tools/update-task.js +16 -1
  94. package/dist/runtime/index.js +516 -22
  95. package/dist/tui/App.js +594 -29
  96. package/package.json +8 -5
  97. package/src/commands/exe/cloud.md +6 -10
  98. package/stack.release.json +3 -3
  99. package/src/commands/exe/link.md +0 -18
@@ -476,6 +476,10 @@ async function loadConfig() {
476
476
  if (config.dbPath.startsWith("~")) {
477
477
  config.dbPath = config.dbPath.replace(/^~/, os2.homedir());
478
478
  }
479
+ const envDbPath = path2.join(dir, "memories.db");
480
+ if (process.env.EXE_OS_DIR && config.dbPath !== envDbPath && !existsSync3(config.dbPath) && existsSync3(envDbPath)) {
481
+ config.dbPath = envDbPath;
482
+ }
479
483
  return config;
480
484
  } catch {
481
485
  return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
@@ -496,7 +500,15 @@ function loadConfigSync() {
496
500
  normalizeSessionLifecycle(migratedCfg);
497
501
  normalizeAutoUpdate(migratedCfg);
498
502
  normalizeOrchestration(migratedCfg);
499
- return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db"), ...migratedCfg };
503
+ const config = { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db"), ...migratedCfg };
504
+ if (config.dbPath.startsWith("~")) {
505
+ config.dbPath = config.dbPath.replace(/^~/, os2.homedir());
506
+ }
507
+ const envDbPath = path2.join(dir, "memories.db");
508
+ if (process.env.EXE_OS_DIR && config.dbPath !== envDbPath && !existsSync3(config.dbPath) && existsSync3(envDbPath)) {
509
+ config.dbPath = envDbPath;
510
+ }
511
+ return config;
500
512
  } catch {
501
513
  return { ...DEFAULT_CONFIG, dbPath: path2.join(dir, "memories.db") };
502
514
  }
@@ -2325,6 +2337,9 @@ function getClient() {
2325
2337
  if (_daemonClient && _daemonClient._isDaemonActive()) {
2326
2338
  return _daemonClient;
2327
2339
  }
2340
+ if (!_resilientClient) {
2341
+ return _adapterClient;
2342
+ }
2328
2343
  return _resilientClient;
2329
2344
  }
2330
2345
  async function initDaemonClient() {
@@ -3357,6 +3372,127 @@ async function ensureSchema() {
3357
3372
  VALUES (new.rowid, new.content, new.subject, new.predicate, new.object);
3358
3373
  END;
3359
3374
  `);
3375
+ await client.executeMultiple(`
3376
+ CREATE TABLE IF NOT EXISTS agent_sessions (
3377
+ id TEXT PRIMARY KEY,
3378
+ agent_id TEXT NOT NULL,
3379
+ project_name TEXT,
3380
+ started_at TEXT NOT NULL,
3381
+ last_event_at TEXT NOT NULL,
3382
+ event_count INTEGER NOT NULL DEFAULT 0,
3383
+ properties TEXT DEFAULT '{}'
3384
+ );
3385
+
3386
+ CREATE INDEX IF NOT EXISTS idx_agent_sessions_agent_time
3387
+ ON agent_sessions(agent_id, started_at);
3388
+
3389
+ CREATE TABLE IF NOT EXISTS agent_goals (
3390
+ id TEXT PRIMARY KEY,
3391
+ statement TEXT NOT NULL,
3392
+ owner_agent_id TEXT,
3393
+ project_name TEXT,
3394
+ status TEXT NOT NULL DEFAULT 'open',
3395
+ priority INTEGER NOT NULL DEFAULT 5,
3396
+ success_criteria TEXT,
3397
+ parent_goal_id TEXT,
3398
+ due_at TEXT,
3399
+ achieved_at TEXT,
3400
+ supersedes_id TEXT,
3401
+ created_at TEXT NOT NULL,
3402
+ updated_at TEXT NOT NULL,
3403
+ source_memory_id TEXT
3404
+ );
3405
+
3406
+ CREATE INDEX IF NOT EXISTS idx_agent_goals_project_status
3407
+ ON agent_goals(project_name, status, priority);
3408
+
3409
+ CREATE TABLE IF NOT EXISTS agent_events (
3410
+ id TEXT PRIMARY KEY,
3411
+ event_type TEXT NOT NULL,
3412
+ occurred_at TEXT NOT NULL,
3413
+ sequence_index INTEGER NOT NULL,
3414
+ actor_agent_id TEXT,
3415
+ agent_role TEXT,
3416
+ project_name TEXT,
3417
+ session_id TEXT,
3418
+ task_id TEXT,
3419
+ goal_id TEXT,
3420
+ parent_event_id TEXT,
3421
+ intention TEXT,
3422
+ outcome TEXT,
3423
+ evidence_memory_id TEXT,
3424
+ impact TEXT,
3425
+ payload TEXT DEFAULT '{}',
3426
+ created_at TEXT NOT NULL
3427
+ );
3428
+
3429
+ CREATE INDEX IF NOT EXISTS idx_agent_events_time
3430
+ ON agent_events(occurred_at, sequence_index);
3431
+
3432
+ CREATE INDEX IF NOT EXISTS idx_agent_events_session_seq
3433
+ ON agent_events(session_id, sequence_index);
3434
+
3435
+ CREATE INDEX IF NOT EXISTS idx_agent_events_goal_time
3436
+ ON agent_events(goal_id, occurred_at);
3437
+
3438
+ CREATE INDEX IF NOT EXISTS idx_agent_events_memory
3439
+ ON agent_events(evidence_memory_id);
3440
+
3441
+ CREATE TABLE IF NOT EXISTS agent_goal_links (
3442
+ id TEXT PRIMARY KEY,
3443
+ goal_id TEXT NOT NULL,
3444
+ link_type TEXT NOT NULL,
3445
+ target_id TEXT NOT NULL,
3446
+ target_type TEXT NOT NULL,
3447
+ created_at TEXT NOT NULL
3448
+ );
3449
+
3450
+ CREATE INDEX IF NOT EXISTS idx_agent_goal_links_goal
3451
+ ON agent_goal_links(goal_id, target_type);
3452
+
3453
+ CREATE TABLE IF NOT EXISTS agent_semantic_labels (
3454
+ id TEXT PRIMARY KEY,
3455
+ source_memory_id TEXT NOT NULL,
3456
+ event_id TEXT,
3457
+ labeler TEXT NOT NULL,
3458
+ schema_version INTEGER NOT NULL DEFAULT 1,
3459
+ confidence REAL NOT NULL DEFAULT 0,
3460
+ labels TEXT NOT NULL,
3461
+ created_at TEXT NOT NULL,
3462
+ updated_at TEXT NOT NULL
3463
+ );
3464
+
3465
+ CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_memory
3466
+ ON agent_semantic_labels(source_memory_id, labeler);
3467
+
3468
+ CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_event
3469
+ ON agent_semantic_labels(event_id);
3470
+
3471
+ CREATE TABLE IF NOT EXISTS agent_reflection_checkpoints (
3472
+ id TEXT PRIMARY KEY,
3473
+ project_name TEXT,
3474
+ session_id TEXT,
3475
+ window_start_at TEXT NOT NULL,
3476
+ window_end_at TEXT NOT NULL,
3477
+ event_count INTEGER NOT NULL DEFAULT 0,
3478
+ goal_count INTEGER NOT NULL DEFAULT 0,
3479
+ success_count INTEGER NOT NULL DEFAULT 0,
3480
+ failure_count INTEGER NOT NULL DEFAULT 0,
3481
+ risk_count INTEGER NOT NULL DEFAULT 0,
3482
+ summary TEXT NOT NULL,
3483
+ learnings TEXT NOT NULL DEFAULT '[]',
3484
+ next_actions TEXT NOT NULL DEFAULT '[]',
3485
+ evidence_event_ids TEXT NOT NULL DEFAULT '[]',
3486
+ confidence REAL NOT NULL DEFAULT 0,
3487
+ created_at TEXT NOT NULL
3488
+ );
3489
+
3490
+ CREATE INDEX IF NOT EXISTS idx_agent_reflection_project_time
3491
+ ON agent_reflection_checkpoints(project_name, window_end_at);
3492
+
3493
+ CREATE INDEX IF NOT EXISTS idx_agent_reflection_session_time
3494
+ ON agent_reflection_checkpoints(session_id, window_end_at);
3495
+ `);
3360
3496
  try {
3361
3497
  await client.execute({
3362
3498
  sql: `ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3`,
@@ -6738,7 +6874,7 @@ var init_tmux_routing = __esm({
6738
6874
 
6739
6875
  // src/lib/keychain.ts
6740
6876
  import { readFile as readFile4, writeFile as writeFile5, unlink, mkdir as mkdir4, chmod as chmod2 } from "fs/promises";
6741
- import { existsSync as existsSync16 } from "fs";
6877
+ import { existsSync as existsSync16, statSync as statSync2 } from "fs";
6742
6878
  import { execSync as execSync7 } from "child_process";
6743
6879
  import path19 from "path";
6744
6880
  import os12 from "os";
@@ -6748,29 +6884,78 @@ function getKeyDir() {
6748
6884
  function getKeyPath() {
6749
6885
  return path19.join(getKeyDir(), "master.key");
6750
6886
  }
6751
- function macKeychainGet() {
6887
+ function nativeKeychainAllowed() {
6888
+ return process.env.EXE_OS_DISABLE_NATIVE_KEYCHAIN !== "1";
6889
+ }
6890
+ function linuxSecretAvailable() {
6891
+ if (!nativeKeychainAllowed()) return false;
6892
+ if (process.platform !== "linux") return false;
6893
+ if (linuxSecretAvailability !== null) return linuxSecretAvailability;
6894
+ try {
6895
+ execSync7("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
6896
+ } catch {
6897
+ linuxSecretAvailability = false;
6898
+ return false;
6899
+ }
6900
+ try {
6901
+ execSync7("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
6902
+ linuxSecretAvailability = true;
6903
+ } catch {
6904
+ linuxSecretAvailability = false;
6905
+ }
6906
+ return linuxSecretAvailability;
6907
+ }
6908
+ function isRootOnlyTrustedServerKeyFile(keyPath) {
6909
+ if (process.platform !== "linux") return false;
6910
+ try {
6911
+ const uid = typeof os12.userInfo().uid === "number" ? os12.userInfo().uid : -1;
6912
+ const st = statSync2(keyPath);
6913
+ if (!st.isFile() || (st.mode & 63) !== 0) return false;
6914
+ if (uid === 0) return true;
6915
+ const exeOsDir = process.env.EXE_OS_DIR;
6916
+ return Boolean(exeOsDir && path19.resolve(keyPath).startsWith(path19.resolve(exeOsDir) + path19.sep));
6917
+ } catch {
6918
+ return false;
6919
+ }
6920
+ }
6921
+ function macKeychainGet(service = SERVICE) {
6922
+ if (!nativeKeychainAllowed()) return null;
6752
6923
  if (process.platform !== "darwin") return null;
6753
6924
  try {
6754
6925
  return execSync7(
6755
- `security find-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w 2>/dev/null`,
6926
+ `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
6756
6927
  { encoding: "utf-8", timeout: 5e3 }
6757
6928
  ).trim();
6758
6929
  } catch {
6759
6930
  return null;
6760
6931
  }
6761
6932
  }
6762
- function macKeychainSet(value) {
6933
+ function macKeychainSet(value, service = SERVICE) {
6934
+ if (!nativeKeychainAllowed()) return false;
6763
6935
  if (process.platform !== "darwin") return false;
6764
6936
  try {
6765
6937
  try {
6766
6938
  execSync7(
6767
- `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
6939
+ `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
6768
6940
  { timeout: 5e3 }
6769
6941
  );
6770
6942
  } catch {
6771
6943
  }
6772
6944
  execSync7(
6773
- `security add-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w "${value}"`,
6945
+ `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
6946
+ { timeout: 5e3 }
6947
+ );
6948
+ return true;
6949
+ } catch {
6950
+ return false;
6951
+ }
6952
+ }
6953
+ function macKeychainDelete(service = SERVICE) {
6954
+ if (!nativeKeychainAllowed()) return false;
6955
+ if (process.platform !== "darwin") return false;
6956
+ try {
6957
+ execSync7(
6958
+ `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
6774
6959
  { timeout: 5e3 }
6775
6960
  );
6776
6961
  return true;
@@ -6778,22 +6963,35 @@ function macKeychainSet(value) {
6778
6963
  return false;
6779
6964
  }
6780
6965
  }
6781
- function linuxSecretGet() {
6782
- if (process.platform !== "linux") return null;
6966
+ function linuxSecretGet(service = SERVICE) {
6967
+ if (!linuxSecretAvailable()) return null;
6783
6968
  try {
6784
6969
  return execSync7(
6785
- `secret-tool lookup service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
6970
+ `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
6786
6971
  { encoding: "utf-8", timeout: 5e3 }
6787
6972
  ).trim();
6788
6973
  } catch {
6789
6974
  return null;
6790
6975
  }
6791
6976
  }
6792
- function linuxSecretSet(value) {
6977
+ function linuxSecretSet(value, service = SERVICE) {
6978
+ if (!linuxSecretAvailable()) return false;
6979
+ try {
6980
+ execSync7(
6981
+ `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
6982
+ { timeout: 5e3 }
6983
+ );
6984
+ return true;
6985
+ } catch {
6986
+ return false;
6987
+ }
6988
+ }
6989
+ function linuxSecretDelete(service = SERVICE) {
6990
+ if (!nativeKeychainAllowed()) return false;
6793
6991
  if (process.platform !== "linux") return false;
6794
6992
  try {
6795
6993
  execSync7(
6796
- `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${SERVICE}" account "${ACCOUNT}"`,
6994
+ `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
6797
6995
  { timeout: 5e3 }
6798
6996
  );
6799
6997
  return true;
@@ -6802,6 +7000,7 @@ function linuxSecretSet(value) {
6802
7000
  }
6803
7001
  }
6804
7002
  async function tryKeytar() {
7003
+ if (!nativeKeychainAllowed()) return null;
6805
7004
  try {
6806
7005
  return await import("keytar");
6807
7006
  } catch {
@@ -6875,7 +7074,19 @@ async function writeMachineBoundFileFallback(b64) {
6875
7074
  return "plaintext";
6876
7075
  }
6877
7076
  async function getMasterKey() {
6878
- const nativeValue = macKeychainGet() ?? linuxSecretGet();
7077
+ let nativeValue = macKeychainGet() ?? linuxSecretGet();
7078
+ if (!nativeValue) {
7079
+ const legacyValue = macKeychainGet(LEGACY_SERVICE) ?? linuxSecretGet(LEGACY_SERVICE);
7080
+ if (legacyValue) {
7081
+ const migrated = macKeychainSet(legacyValue) || linuxSecretSet(legacyValue);
7082
+ if (migrated) {
7083
+ macKeychainDelete(LEGACY_SERVICE);
7084
+ linuxSecretDelete(LEGACY_SERVICE);
7085
+ process.stderr.write("[keychain] Migrated keychain service from exe-mem to exe-os.\n");
7086
+ }
7087
+ nativeValue = legacyValue;
7088
+ }
7089
+ }
6879
7090
  if (nativeValue) {
6880
7091
  return Buffer.from(nativeValue, "base64");
6881
7092
  }
@@ -6883,12 +7094,17 @@ async function getMasterKey() {
6883
7094
  if (keytar) {
6884
7095
  try {
6885
7096
  const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
6886
- if (keytarValue) {
6887
- const migrated = macKeychainSet(keytarValue) || linuxSecretSet(keytarValue);
7097
+ const legacyKeytarValue = keytarValue ?? await keytar.getPassword(LEGACY_SERVICE, ACCOUNT);
7098
+ if (legacyKeytarValue) {
7099
+ const migrated = macKeychainSet(legacyKeytarValue) || linuxSecretSet(legacyKeytarValue);
6888
7100
  if (migrated) {
6889
7101
  process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
7102
+ try {
7103
+ await keytar.deletePassword(LEGACY_SERVICE, ACCOUNT);
7104
+ } catch {
7105
+ }
6890
7106
  }
6891
- return Buffer.from(keytarValue, "base64");
7107
+ return Buffer.from(legacyKeytarValue, "base64");
6892
7108
  }
6893
7109
  } catch {
6894
7110
  }
@@ -6913,7 +7129,7 @@ async function getMasterKey() {
6913
7129
  const decrypted = decryptWithMachineKey(content, machineKey);
6914
7130
  if (!decrypted) {
6915
7131
  process.stderr.write(
6916
- "[keychain] Key decryption failed \u2014 machine may have changed.\n Use your 24-word recovery phrase: exe-os link import\n"
7132
+ "[keychain] Key decryption failed \u2014 machine may have changed.\n Use your 24-word recovery phrase during setup: exe-os setup\n"
6917
7133
  );
6918
7134
  return null;
6919
7135
  }
@@ -6922,6 +7138,9 @@ async function getMasterKey() {
6922
7138
  b64Value = content;
6923
7139
  }
6924
7140
  const key = Buffer.from(b64Value, "base64");
7141
+ if (!content.startsWith(ENCRYPTED_PREFIX) && isRootOnlyTrustedServerKeyFile(keyPath)) {
7142
+ return key;
7143
+ }
6925
7144
  const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
6926
7145
  if (migrated) {
6927
7146
  process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
@@ -6949,12 +7168,14 @@ async function getMasterKey() {
6949
7168
  return null;
6950
7169
  }
6951
7170
  }
6952
- var SERVICE, ACCOUNT, ENCRYPTED_PREFIX;
7171
+ var SERVICE, LEGACY_SERVICE, ACCOUNT, linuxSecretAvailability, ENCRYPTED_PREFIX;
6953
7172
  var init_keychain = __esm({
6954
7173
  "src/lib/keychain.ts"() {
6955
7174
  "use strict";
6956
- SERVICE = "exe-mem";
7175
+ SERVICE = "exe-os";
7176
+ LEGACY_SERVICE = "exe-mem";
6957
7177
  ACCOUNT = "master-key";
7178
+ linuxSecretAvailability = null;
6958
7179
  ENCRYPTED_PREFIX = "enc:";
6959
7180
  }
6960
7181
  });
@@ -7169,7 +7390,7 @@ __export(shard_manager_exports, {
7169
7390
  shardExists: () => shardExists
7170
7391
  });
7171
7392
  import path20 from "path";
7172
- import { existsSync as existsSync17, mkdirSync as mkdirSync8, readdirSync as readdirSync4, renameSync as renameSync4, statSync as statSync2 } from "fs";
7393
+ import { existsSync as existsSync17, mkdirSync as mkdirSync8, readdirSync as readdirSync4, renameSync as renameSync4, statSync as statSync3 } from "fs";
7173
7394
  import { createClient as createClient2 } from "@libsql/client";
7174
7395
  function initShardManager(encryptionKey) {
7175
7396
  _encryptionKey = encryptionKey;
@@ -7233,7 +7454,7 @@ async function auditShardHealth(options = {}) {
7233
7454
  const shards = [];
7234
7455
  for (const name of names) {
7235
7456
  const dbPath = path20.join(SHARDS_DIR, `${name}.db`);
7236
- const stat = statSync2(dbPath);
7457
+ const stat = statSync3(dbPath);
7237
7458
  const item = {
7238
7459
  name,
7239
7460
  path: dbPath,
@@ -7486,7 +7707,7 @@ async function getReadyShardClient(projectName) {
7486
7707
  _shardLastAccess.delete(safeName);
7487
7708
  const dbPath = path20.join(SHARDS_DIR, `${safeName}.db`);
7488
7709
  if (existsSync17(dbPath)) {
7489
- const stat = statSync2(dbPath);
7710
+ const stat = statSync3(dbPath);
7490
7711
  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
7491
7712
  const archivedPath = path20.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
7492
7713
  renameSync4(dbPath, archivedPath);
@@ -7993,6 +8214,274 @@ var init_memory_cards = __esm({
7993
8214
  }
7994
8215
  });
7995
8216
 
8217
+ // src/lib/agentic-ontology.ts
8218
+ var agentic_ontology_exports = {};
8219
+ __export(agentic_ontology_exports, {
8220
+ clean: () => clean,
8221
+ extractGoalCandidates: () => extractGoalCandidates,
8222
+ inferIntention: () => inferIntention,
8223
+ inferOntologyEventType: () => inferOntologyEventType,
8224
+ inferOutcome: () => inferOutcome,
8225
+ inferSemanticLabel: () => inferSemanticLabel,
8226
+ insertOntologyForBatch: () => insertOntologyForBatch,
8227
+ insertOntologyForMemory: () => insertOntologyForMemory,
8228
+ ontologyPayload: () => ontologyPayload,
8229
+ stableId: () => stableId2
8230
+ });
8231
+ import { createHash as createHash3 } from "crypto";
8232
+ function stableId2(...parts) {
8233
+ return createHash3("sha256").update(parts.map((p) => String(p ?? "")).join("::")).digest("hex").slice(0, 32);
8234
+ }
8235
+ function clean(text, max = 240) {
8236
+ return text.replace(/\u0000/g, "").replace(/```[\s\S]*?```/g, " ").replace(/\s+/g, " ").trim().slice(0, max);
8237
+ }
8238
+ function inferOntologyEventType(row) {
8239
+ const lower = row.raw_text.toLowerCase();
8240
+ if (row.has_error) return "error";
8241
+ if (/\b(done|complete|completed|fixed|resolved|shipped|deployed|pushed|published)\b/.test(lower)) return "milestone";
8242
+ if (/\b(blocked|failed|error|bug|regression|broken)\b/.test(lower)) return "problem";
8243
+ if (/\b(decided|decision|adr|we chose|approved|rejected)\b/.test(lower)) return "decision";
8244
+ if (/\b(goal|need to|we need|want to|trying to|objective)\b/.test(lower)) return "goal_signal";
8245
+ if (["Bash", "Read", "Edit", "Write", "Grep", "Glob"].includes(row.tool_name)) return "tool_action";
8246
+ if (row.tool_name.startsWith("memory_card")) return "memory_card";
8247
+ return "memory_observation";
8248
+ }
8249
+ function inferIntention(row) {
8250
+ if (row.intent) return clean(row.intent, 220);
8251
+ const text = clean(row.raw_text, 1e3);
8252
+ const patterns = [
8253
+ /(?:we need to|need to|let'?s|i want to|we should|goal is to|objective is to|trying to)\s+([^.!?\n]{8,220})/i,
8254
+ /(?:so that|in order to)\s+([^.!?\n]{8,220})/i,
8255
+ /(?:task|plan):\s*([^.!?\n]{8,220})/i
8256
+ ];
8257
+ for (const p of patterns) {
8258
+ const m = text.match(p);
8259
+ if (m?.[1]) return clean(m[1], 220);
8260
+ }
8261
+ if (["Bash", "Read", "Edit", "Write", "Grep", "Glob"].includes(row.tool_name)) {
8262
+ return `${row.tool_name} during ${row.project_name}`;
8263
+ }
8264
+ return null;
8265
+ }
8266
+ function inferOutcome(row) {
8267
+ if (row.outcome) return clean(row.outcome, 220);
8268
+ if (row.has_error) return "error";
8269
+ const lower = row.raw_text.toLowerCase();
8270
+ if (/\b(done|complete|completed|fixed|resolved|shipped|deployed|pushed|published|passed)\b/.test(lower)) return "success_signal";
8271
+ if (/\b(blocked|failed|error|regression|broken|not working|could not)\b/.test(lower)) return "failure_signal";
8272
+ if (/\b(warning|risk|concern|caveat)\b/.test(lower)) return "risk_signal";
8273
+ return null;
8274
+ }
8275
+ function extractGoalCandidates(row) {
8276
+ const text = clean(row.raw_text, 1600);
8277
+ const patterns = [
8278
+ /(?:we need to|need to|i want to|we should|goal is to|objective is to|trying to|let'?s)\s+([^.!?\n]{12,220})/gi,
8279
+ /(?:success means|success criteria|so that)\s+([^.!?\n]{12,220})/gi
8280
+ ];
8281
+ const out = [];
8282
+ for (const pattern of patterns) {
8283
+ for (const m of text.matchAll(pattern)) {
8284
+ const candidate = clean(m[1] ?? "", 220);
8285
+ if (candidate.length >= 12 && !out.some((x) => x.toLowerCase() === candidate.toLowerCase())) out.push(candidate);
8286
+ if (out.length >= 3) return out;
8287
+ }
8288
+ }
8289
+ return out;
8290
+ }
8291
+ function uniq(values, max = 6) {
8292
+ const out = [];
8293
+ for (const value of values.map((v) => clean(v, 220)).filter(Boolean)) {
8294
+ if (!out.some((x) => x.toLowerCase() === value.toLowerCase())) out.push(value);
8295
+ if (out.length >= max) break;
8296
+ }
8297
+ return out;
8298
+ }
8299
+ function extractMatches(text, patterns, max = 5) {
8300
+ const out = [];
8301
+ for (const pattern of patterns) {
8302
+ for (const match of text.matchAll(pattern)) {
8303
+ const value = match[1] ?? match[0];
8304
+ if (value) out.push(value);
8305
+ if (out.length >= max) return uniq(out, max);
8306
+ }
8307
+ }
8308
+ return uniq(out, max);
8309
+ }
8310
+ function inferSemanticLabel(row) {
8311
+ const text = clean(row.raw_text, 2400);
8312
+ const eventType = inferOntologyEventType(row);
8313
+ const intention = inferIntention(row);
8314
+ const outcome = inferOutcome(row);
8315
+ const goals = extractGoalCandidates(row);
8316
+ const milestones = extractMatches(text, [
8317
+ /\b(?:completed|finished|fixed|resolved|shipped|deployed|published|pushed|passed)\b([^.!?\n]{0,180})/gi,
8318
+ /(?:milestone|done):\s*([^.!?\n]{8,220})/gi
8319
+ ]);
8320
+ const problems = extractMatches(text, [
8321
+ /\b(?:blocked by|failed because|bug|regression|broken|not working|error)\b([^.!?\n]{0,180})/gi,
8322
+ /(?:problem|issue|risk):\s*([^.!?\n]{8,220})/gi
8323
+ ]);
8324
+ const decisions = extractMatches(text, [
8325
+ /(?:decided|decision|adr|we chose|approved|rejected)\s+([^.!?\n]{8,220})/gi
8326
+ ]);
8327
+ const temporalAnchors = extractMatches(text, [
8328
+ /\b(\d{4}-\d{2}-\d{2}(?:[T ][0-9:.+-Z]+)?)\b/g,
8329
+ /\b(today|yesterday|tomorrow|this week|next week|last week|morning|afternoon|tonight)\b/gi
8330
+ ], 8);
8331
+ const nextActions = extractMatches(text, [
8332
+ /(?:next|todo|follow[- ]?up|remaining|need to)\s*:?\s*([^.!?\n]{8,220})/gi
8333
+ ]);
8334
+ const actors = uniq([
8335
+ row.agent_id,
8336
+ ...extractMatches(text, [/\b(?:agent|employee|owner|assignee)[:= ]+([a-zA-Z][a-zA-Z0-9_-]{1,40})/gi], 5)
8337
+ ], 6);
8338
+ const successSignals = milestones.length ? milestones : outcome === "success_signal" ? [clean(text, 180)] : [];
8339
+ const failureSignals = problems.length ? problems : outcome === "failure_signal" || row.has_error ? [clean(text, 180)] : [];
8340
+ const impact = successSignals.length && failureSignals.length ? "mixed" : failureSignals.length ? "negative" : successSignals.length ? "positive" : "neutral";
8341
+ const signalCount = goals.length + milestones.length + problems.length + decisions.length + nextActions.length;
8342
+ return {
8343
+ labeler: "deterministic",
8344
+ schemaVersion: 1,
8345
+ eventType,
8346
+ intention,
8347
+ outcome,
8348
+ impact,
8349
+ confidence: Math.min(0.95, 0.45 + signalCount * 0.08 + (intention ? 0.1 : 0) + (outcome ? 0.1 : 0)),
8350
+ goals,
8351
+ milestones,
8352
+ problems,
8353
+ decisions,
8354
+ actors,
8355
+ temporalAnchors,
8356
+ successSignals,
8357
+ failureSignals,
8358
+ nextActions,
8359
+ summary: clean(text, 280)
8360
+ };
8361
+ }
8362
+ function ontologyPayload(row) {
8363
+ const semantic = inferSemanticLabel(row);
8364
+ return {
8365
+ tool_name: row.tool_name,
8366
+ memory_version: row.version ?? null,
8367
+ domain: row.domain ?? null,
8368
+ trajectory: row.trajectory ? safeJson(row.trajectory) : null,
8369
+ semantic
8370
+ };
8371
+ }
8372
+ function safeJson(value) {
8373
+ try {
8374
+ return JSON.parse(value);
8375
+ } catch {
8376
+ return value.slice(0, 1e3);
8377
+ }
8378
+ }
8379
+ async function resolveClient(client) {
8380
+ if (client) return client;
8381
+ const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
8382
+ return getClient2();
8383
+ }
8384
+ async function insertOntologyForMemory(row, client) {
8385
+ const db = await resolveClient(client);
8386
+ const occurredAt = row.timestamp;
8387
+ const sequence = Number(row.version ?? 0) || Math.floor(new Date(occurredAt).getTime() / 1e3);
8388
+ const eventType = inferOntologyEventType(row);
8389
+ const intention = inferIntention(row);
8390
+ const outcome = inferOutcome(row);
8391
+ const eventId = stableId2("event", row.id);
8392
+ const now = (/* @__PURE__ */ new Date()).toISOString();
8393
+ await db.execute({
8394
+ sql: `INSERT INTO agent_sessions (id, agent_id, project_name, started_at, last_event_at, event_count, properties)
8395
+ VALUES (?, ?, ?, ?, ?, 1, ?)
8396
+ ON CONFLICT(id) DO UPDATE SET last_event_at = MAX(last_event_at, excluded.last_event_at),
8397
+ event_count = event_count + 1`,
8398
+ args: [row.session_id, row.agent_id, row.project_name, occurredAt, occurredAt, JSON.stringify({ agent_role: row.agent_role })]
8399
+ });
8400
+ await db.execute({
8401
+ sql: `INSERT OR IGNORE INTO agent_events
8402
+ (id, event_type, occurred_at, sequence_index, actor_agent_id, agent_role, project_name,
8403
+ session_id, task_id, goal_id, parent_event_id, intention, outcome, evidence_memory_id,
8404
+ impact, payload, created_at)
8405
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?, ?, ?, ?, ?)`,
8406
+ args: [
8407
+ eventId,
8408
+ eventType,
8409
+ occurredAt,
8410
+ sequence,
8411
+ row.agent_id,
8412
+ row.agent_role,
8413
+ row.project_name,
8414
+ row.session_id,
8415
+ row.task_id ?? null,
8416
+ intention,
8417
+ outcome,
8418
+ row.id,
8419
+ row.has_error ? "negative" : outcome === "success_signal" ? "positive" : "neutral",
8420
+ JSON.stringify(ontologyPayload(row)),
8421
+ now
8422
+ ]
8423
+ });
8424
+ const semantic = inferSemanticLabel(row);
8425
+ await db.execute({
8426
+ sql: `INSERT INTO agent_semantic_labels
8427
+ (id, source_memory_id, event_id, labeler, schema_version, confidence, labels, created_at, updated_at)
8428
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
8429
+ ON CONFLICT(id) DO UPDATE SET confidence = excluded.confidence,
8430
+ labels = excluded.labels, updated_at = excluded.updated_at`,
8431
+ args: [
8432
+ stableId2("semantic", row.id, semantic.labeler, semantic.schemaVersion),
8433
+ row.id,
8434
+ eventId,
8435
+ semantic.labeler,
8436
+ semantic.schemaVersion,
8437
+ semantic.confidence,
8438
+ JSON.stringify(semantic),
8439
+ now,
8440
+ now
8441
+ ]
8442
+ });
8443
+ for (const statement of extractGoalCandidates(row)) {
8444
+ const goalId = stableId2("goal", row.project_name, statement.toLowerCase());
8445
+ await db.execute({
8446
+ sql: `INSERT INTO agent_goals
8447
+ (id, statement, owner_agent_id, project_name, status, priority, success_criteria,
8448
+ parent_goal_id, due_at, achieved_at, supersedes_id, created_at, updated_at, source_memory_id)
8449
+ VALUES (?, ?, ?, ?, 'open', 5, NULL, NULL, NULL, NULL, NULL, ?, ?, ?)
8450
+ ON CONFLICT(id) DO UPDATE SET updated_at = excluded.updated_at`,
8451
+ args: [goalId, statement, row.agent_id, row.project_name, now, now, row.id]
8452
+ });
8453
+ await db.execute({
8454
+ sql: `INSERT OR IGNORE INTO agent_goal_links
8455
+ (id, goal_id, link_type, target_id, target_type, created_at)
8456
+ VALUES (?, ?, 'evidence', ?, 'memory', ?)`,
8457
+ args: [stableId2("goal_link", goalId, row.id, "memory"), goalId, row.id, now]
8458
+ });
8459
+ await db.execute({
8460
+ sql: `INSERT OR IGNORE INTO agent_goal_links
8461
+ (id, goal_id, link_type, target_id, target_type, created_at)
8462
+ VALUES (?, ?, 'event', ?, 'event', ?)`,
8463
+ args: [stableId2("goal_link", goalId, eventId, "event"), goalId, eventId, now]
8464
+ });
8465
+ }
8466
+ }
8467
+ async function insertOntologyForBatch(rows, client) {
8468
+ const db = await resolveClient(client);
8469
+ let count = 0;
8470
+ for (const row of rows) {
8471
+ try {
8472
+ await insertOntologyForMemory(row, db);
8473
+ count++;
8474
+ } catch {
8475
+ }
8476
+ }
8477
+ return count;
8478
+ }
8479
+ var init_agentic_ontology = __esm({
8480
+ "src/lib/agentic-ontology.ts"() {
8481
+ "use strict";
8482
+ }
8483
+ });
8484
+
7996
8485
  // src/lib/store.ts
7997
8486
  var store_exports = {};
7998
8487
  __export(store_exports, {
@@ -8336,6 +8825,11 @@ async function flushBatch() {
8336
8825
  await insertMemoryCardsForBatch2(batch);
8337
8826
  } catch {
8338
8827
  }
8828
+ try {
8829
+ const { insertOntologyForBatch: insertOntologyForBatch2 } = await Promise.resolve().then(() => (init_agentic_ontology(), agentic_ontology_exports));
8830
+ await insertOntologyForBatch2(batch);
8831
+ } catch {
8832
+ }
8339
8833
  schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
8340
8834
  _pendingRecords.splice(0, batch.length);
8341
8835
  try {