@askexenow/exe-os 0.9.66 → 0.9.67

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (99) hide show
  1. package/deploy/stack-manifests/v0.9.json +54 -5
  2. package/dist/bin/age-ontology-load.js +61 -0
  3. package/dist/bin/agentic-ontology-backfill.js +4708 -0
  4. package/dist/bin/agentic-reflection-backfill.js +4144 -0
  5. package/dist/bin/{exe-link.js → agentic-semantic-label.js} +1523 -2275
  6. package/dist/bin/backfill-conversations.js +506 -20
  7. package/dist/bin/backfill-responses.js +506 -20
  8. package/dist/bin/backfill-vectors.js +233 -20
  9. package/dist/bin/bulk-sync-postgres.js +4876 -0
  10. package/dist/bin/cleanup-stale-review-tasks.js +507 -21
  11. package/dist/bin/cli.js +2450 -1530
  12. package/dist/bin/exe-assign.js +506 -20
  13. package/dist/bin/exe-boot.js +410 -60
  14. package/dist/bin/exe-cloud.js +795 -105
  15. package/dist/bin/exe-dispatch.js +516 -22
  16. package/dist/bin/exe-doctor.js +587 -30
  17. package/dist/bin/exe-export-behaviors.js +518 -24
  18. package/dist/bin/exe-forget.js +507 -21
  19. package/dist/bin/exe-gateway.js +571 -25
  20. package/dist/bin/exe-heartbeat.js +518 -24
  21. package/dist/bin/exe-kill.js +507 -21
  22. package/dist/bin/exe-launch-agent.js +2312 -1069
  23. package/dist/bin/exe-new-employee.js +197 -165
  24. package/dist/bin/exe-pending-messages.js +507 -21
  25. package/dist/bin/exe-pending-notifications.js +507 -21
  26. package/dist/bin/exe-pending-reviews.js +507 -21
  27. package/dist/bin/exe-rename.js +507 -21
  28. package/dist/bin/exe-review.js +507 -21
  29. package/dist/bin/exe-search.js +518 -24
  30. package/dist/bin/exe-session-cleanup.js +516 -22
  31. package/dist/bin/exe-settings.js +4 -0
  32. package/dist/bin/exe-start-codex.js +682 -143
  33. package/dist/bin/exe-start-opencode.js +627 -79
  34. package/dist/bin/exe-status.js +507 -21
  35. package/dist/bin/exe-team.js +507 -21
  36. package/dist/bin/git-sweep.js +516 -22
  37. package/dist/bin/graph-backfill.js +558 -21
  38. package/dist/bin/graph-export.js +507 -21
  39. package/dist/bin/graph-layer-benchmark.js +109 -0
  40. package/dist/bin/install.js +305 -288
  41. package/dist/bin/intercom-check.js +516 -22
  42. package/dist/bin/postgres-agentic-reflection-backfill.js +187 -0
  43. package/dist/bin/postgres-agentic-semantic-backfill.js +237 -0
  44. package/dist/bin/scan-tasks.js +516 -22
  45. package/dist/bin/setup.js +412 -62
  46. package/dist/bin/shard-migrate.js +506 -20
  47. package/dist/gateway/index.js +569 -23
  48. package/dist/hooks/bug-report-worker.js +519 -25
  49. package/dist/hooks/codex-stop-task-finalizer.js +516 -22
  50. package/dist/hooks/commit-complete.js +516 -22
  51. package/dist/hooks/error-recall.js +518 -24
  52. package/dist/hooks/ingest.js +516 -22
  53. package/dist/hooks/instructions-loaded.js +507 -21
  54. package/dist/hooks/notification.js +507 -21
  55. package/dist/hooks/post-compact.js +507 -21
  56. package/dist/hooks/post-tool-combined.js +519 -25
  57. package/dist/hooks/pre-compact.js +516 -22
  58. package/dist/hooks/pre-tool-use.js +507 -21
  59. package/dist/hooks/prompt-submit.js +519 -25
  60. package/dist/hooks/session-end.js +516 -22
  61. package/dist/hooks/session-start.js +520 -26
  62. package/dist/hooks/stop.js +517 -23
  63. package/dist/hooks/subagent-stop.js +507 -21
  64. package/dist/hooks/summary-worker.js +411 -61
  65. package/dist/index.js +569 -23
  66. package/dist/lib/cloud-sync.js +391 -53
  67. package/dist/lib/config.js +13 -1
  68. package/dist/lib/consolidation.js +1 -1
  69. package/dist/lib/database.js +124 -0
  70. package/dist/lib/db.js +124 -0
  71. package/dist/lib/device-registry.js +124 -0
  72. package/dist/lib/embedder.js +13 -1
  73. package/dist/lib/exe-daemon.js +2184 -561
  74. package/dist/lib/hybrid-search.js +518 -24
  75. package/dist/lib/identity.js +3 -0
  76. package/dist/lib/keychain.js +178 -22
  77. package/dist/lib/messaging.js +3 -0
  78. package/dist/lib/reminders.js +3 -0
  79. package/dist/lib/schedules.js +233 -20
  80. package/dist/lib/skill-learning.js +16 -1
  81. package/dist/lib/store.js +506 -20
  82. package/dist/lib/tasks.js +16 -1
  83. package/dist/lib/tmux-routing.js +16 -1
  84. package/dist/lib/token-spend.js +3 -0
  85. package/dist/mcp/server.js +1757 -428
  86. package/dist/mcp/tools/complete-reminder.js +3 -0
  87. package/dist/mcp/tools/create-reminder.js +3 -0
  88. package/dist/mcp/tools/create-task.js +16 -1
  89. package/dist/mcp/tools/deactivate-behavior.js +3 -0
  90. package/dist/mcp/tools/list-reminders.js +3 -0
  91. package/dist/mcp/tools/list-tasks.js +3 -0
  92. package/dist/mcp/tools/send-message.js +3 -0
  93. package/dist/mcp/tools/update-task.js +16 -1
  94. package/dist/runtime/index.js +516 -22
  95. package/dist/tui/App.js +594 -29
  96. package/package.json +8 -5
  97. package/src/commands/exe/cloud.md +6 -10
  98. package/stack.release.json +3 -3
  99. package/src/commands/exe/link.md +0 -18
@@ -183,6 +183,10 @@ async function loadConfig() {
183
183
  if (config.dbPath.startsWith("~")) {
184
184
  config.dbPath = config.dbPath.replace(/^~/, os.homedir());
185
185
  }
186
+ const envDbPath = path.join(dir, "memories.db");
187
+ if (process.env.EXE_OS_DIR && config.dbPath !== envDbPath && !existsSync2(config.dbPath) && existsSync2(envDbPath)) {
188
+ config.dbPath = envDbPath;
189
+ }
186
190
  return config;
187
191
  } catch {
188
192
  return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
@@ -203,7 +207,15 @@ function loadConfigSync() {
203
207
  normalizeSessionLifecycle(migratedCfg);
204
208
  normalizeAutoUpdate(migratedCfg);
205
209
  normalizeOrchestration(migratedCfg);
206
- return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
210
+ const config = { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
211
+ if (config.dbPath.startsWith("~")) {
212
+ config.dbPath = config.dbPath.replace(/^~/, os.homedir());
213
+ }
214
+ const envDbPath = path.join(dir, "memories.db");
215
+ if (process.env.EXE_OS_DIR && config.dbPath !== envDbPath && !existsSync2(config.dbPath) && existsSync2(envDbPath)) {
216
+ config.dbPath = envDbPath;
217
+ }
218
+ return config;
207
219
  } catch {
208
220
  return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
209
221
  }
@@ -2080,6 +2092,9 @@ function getClient() {
2080
2092
  if (_daemonClient && _daemonClient._isDaemonActive()) {
2081
2093
  return _daemonClient;
2082
2094
  }
2095
+ if (!_resilientClient) {
2096
+ return _adapterClient;
2097
+ }
2083
2098
  return _resilientClient;
2084
2099
  }
2085
2100
  async function initDaemonClient() {
@@ -3112,6 +3127,127 @@ async function ensureSchema() {
3112
3127
  VALUES (new.rowid, new.content, new.subject, new.predicate, new.object);
3113
3128
  END;
3114
3129
  `);
3130
+ await client.executeMultiple(`
3131
+ CREATE TABLE IF NOT EXISTS agent_sessions (
3132
+ id TEXT PRIMARY KEY,
3133
+ agent_id TEXT NOT NULL,
3134
+ project_name TEXT,
3135
+ started_at TEXT NOT NULL,
3136
+ last_event_at TEXT NOT NULL,
3137
+ event_count INTEGER NOT NULL DEFAULT 0,
3138
+ properties TEXT DEFAULT '{}'
3139
+ );
3140
+
3141
+ CREATE INDEX IF NOT EXISTS idx_agent_sessions_agent_time
3142
+ ON agent_sessions(agent_id, started_at);
3143
+
3144
+ CREATE TABLE IF NOT EXISTS agent_goals (
3145
+ id TEXT PRIMARY KEY,
3146
+ statement TEXT NOT NULL,
3147
+ owner_agent_id TEXT,
3148
+ project_name TEXT,
3149
+ status TEXT NOT NULL DEFAULT 'open',
3150
+ priority INTEGER NOT NULL DEFAULT 5,
3151
+ success_criteria TEXT,
3152
+ parent_goal_id TEXT,
3153
+ due_at TEXT,
3154
+ achieved_at TEXT,
3155
+ supersedes_id TEXT,
3156
+ created_at TEXT NOT NULL,
3157
+ updated_at TEXT NOT NULL,
3158
+ source_memory_id TEXT
3159
+ );
3160
+
3161
+ CREATE INDEX IF NOT EXISTS idx_agent_goals_project_status
3162
+ ON agent_goals(project_name, status, priority);
3163
+
3164
+ CREATE TABLE IF NOT EXISTS agent_events (
3165
+ id TEXT PRIMARY KEY,
3166
+ event_type TEXT NOT NULL,
3167
+ occurred_at TEXT NOT NULL,
3168
+ sequence_index INTEGER NOT NULL,
3169
+ actor_agent_id TEXT,
3170
+ agent_role TEXT,
3171
+ project_name TEXT,
3172
+ session_id TEXT,
3173
+ task_id TEXT,
3174
+ goal_id TEXT,
3175
+ parent_event_id TEXT,
3176
+ intention TEXT,
3177
+ outcome TEXT,
3178
+ evidence_memory_id TEXT,
3179
+ impact TEXT,
3180
+ payload TEXT DEFAULT '{}',
3181
+ created_at TEXT NOT NULL
3182
+ );
3183
+
3184
+ CREATE INDEX IF NOT EXISTS idx_agent_events_time
3185
+ ON agent_events(occurred_at, sequence_index);
3186
+
3187
+ CREATE INDEX IF NOT EXISTS idx_agent_events_session_seq
3188
+ ON agent_events(session_id, sequence_index);
3189
+
3190
+ CREATE INDEX IF NOT EXISTS idx_agent_events_goal_time
3191
+ ON agent_events(goal_id, occurred_at);
3192
+
3193
+ CREATE INDEX IF NOT EXISTS idx_agent_events_memory
3194
+ ON agent_events(evidence_memory_id);
3195
+
3196
+ CREATE TABLE IF NOT EXISTS agent_goal_links (
3197
+ id TEXT PRIMARY KEY,
3198
+ goal_id TEXT NOT NULL,
3199
+ link_type TEXT NOT NULL,
3200
+ target_id TEXT NOT NULL,
3201
+ target_type TEXT NOT NULL,
3202
+ created_at TEXT NOT NULL
3203
+ );
3204
+
3205
+ CREATE INDEX IF NOT EXISTS idx_agent_goal_links_goal
3206
+ ON agent_goal_links(goal_id, target_type);
3207
+
3208
+ CREATE TABLE IF NOT EXISTS agent_semantic_labels (
3209
+ id TEXT PRIMARY KEY,
3210
+ source_memory_id TEXT NOT NULL,
3211
+ event_id TEXT,
3212
+ labeler TEXT NOT NULL,
3213
+ schema_version INTEGER NOT NULL DEFAULT 1,
3214
+ confidence REAL NOT NULL DEFAULT 0,
3215
+ labels TEXT NOT NULL,
3216
+ created_at TEXT NOT NULL,
3217
+ updated_at TEXT NOT NULL
3218
+ );
3219
+
3220
+ CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_memory
3221
+ ON agent_semantic_labels(source_memory_id, labeler);
3222
+
3223
+ CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_event
3224
+ ON agent_semantic_labels(event_id);
3225
+
3226
+ CREATE TABLE IF NOT EXISTS agent_reflection_checkpoints (
3227
+ id TEXT PRIMARY KEY,
3228
+ project_name TEXT,
3229
+ session_id TEXT,
3230
+ window_start_at TEXT NOT NULL,
3231
+ window_end_at TEXT NOT NULL,
3232
+ event_count INTEGER NOT NULL DEFAULT 0,
3233
+ goal_count INTEGER NOT NULL DEFAULT 0,
3234
+ success_count INTEGER NOT NULL DEFAULT 0,
3235
+ failure_count INTEGER NOT NULL DEFAULT 0,
3236
+ risk_count INTEGER NOT NULL DEFAULT 0,
3237
+ summary TEXT NOT NULL,
3238
+ learnings TEXT NOT NULL DEFAULT '[]',
3239
+ next_actions TEXT NOT NULL DEFAULT '[]',
3240
+ evidence_event_ids TEXT NOT NULL DEFAULT '[]',
3241
+ confidence REAL NOT NULL DEFAULT 0,
3242
+ created_at TEXT NOT NULL
3243
+ );
3244
+
3245
+ CREATE INDEX IF NOT EXISTS idx_agent_reflection_project_time
3246
+ ON agent_reflection_checkpoints(project_name, window_end_at);
3247
+
3248
+ CREATE INDEX IF NOT EXISTS idx_agent_reflection_session_time
3249
+ ON agent_reflection_checkpoints(session_id, window_end_at);
3250
+ `);
3115
3251
  try {
3116
3252
  await client.execute({
3117
3253
  sql: `ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3`,
@@ -3261,7 +3397,7 @@ var init_database = __esm({
3261
3397
 
3262
3398
  // src/lib/keychain.ts
3263
3399
  import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
3264
- import { existsSync as existsSync7 } from "fs";
3400
+ import { existsSync as existsSync7, statSync as statSync2 } from "fs";
3265
3401
  import { execSync as execSync2 } from "child_process";
3266
3402
  import path7 from "path";
3267
3403
  import os5 from "os";
@@ -3271,29 +3407,78 @@ function getKeyDir() {
3271
3407
  function getKeyPath() {
3272
3408
  return path7.join(getKeyDir(), "master.key");
3273
3409
  }
3274
- function macKeychainGet() {
3410
+ function nativeKeychainAllowed() {
3411
+ return process.env.EXE_OS_DISABLE_NATIVE_KEYCHAIN !== "1";
3412
+ }
3413
+ function linuxSecretAvailable() {
3414
+ if (!nativeKeychainAllowed()) return false;
3415
+ if (process.platform !== "linux") return false;
3416
+ if (linuxSecretAvailability !== null) return linuxSecretAvailability;
3417
+ try {
3418
+ execSync2("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
3419
+ } catch {
3420
+ linuxSecretAvailability = false;
3421
+ return false;
3422
+ }
3423
+ try {
3424
+ execSync2("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
3425
+ linuxSecretAvailability = true;
3426
+ } catch {
3427
+ linuxSecretAvailability = false;
3428
+ }
3429
+ return linuxSecretAvailability;
3430
+ }
3431
+ function isRootOnlyTrustedServerKeyFile(keyPath) {
3432
+ if (process.platform !== "linux") return false;
3433
+ try {
3434
+ const uid = typeof os5.userInfo().uid === "number" ? os5.userInfo().uid : -1;
3435
+ const st = statSync2(keyPath);
3436
+ if (!st.isFile() || (st.mode & 63) !== 0) return false;
3437
+ if (uid === 0) return true;
3438
+ const exeOsDir = process.env.EXE_OS_DIR;
3439
+ return Boolean(exeOsDir && path7.resolve(keyPath).startsWith(path7.resolve(exeOsDir) + path7.sep));
3440
+ } catch {
3441
+ return false;
3442
+ }
3443
+ }
3444
+ function macKeychainGet(service = SERVICE) {
3445
+ if (!nativeKeychainAllowed()) return null;
3275
3446
  if (process.platform !== "darwin") return null;
3276
3447
  try {
3277
3448
  return execSync2(
3278
- `security find-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w 2>/dev/null`,
3449
+ `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
3279
3450
  { encoding: "utf-8", timeout: 5e3 }
3280
3451
  ).trim();
3281
3452
  } catch {
3282
3453
  return null;
3283
3454
  }
3284
3455
  }
3285
- function macKeychainSet(value) {
3456
+ function macKeychainSet(value, service = SERVICE) {
3457
+ if (!nativeKeychainAllowed()) return false;
3286
3458
  if (process.platform !== "darwin") return false;
3287
3459
  try {
3288
3460
  try {
3289
3461
  execSync2(
3290
- `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
3462
+ `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
3291
3463
  { timeout: 5e3 }
3292
3464
  );
3293
3465
  } catch {
3294
3466
  }
3295
3467
  execSync2(
3296
- `security add-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w "${value}"`,
3468
+ `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
3469
+ { timeout: 5e3 }
3470
+ );
3471
+ return true;
3472
+ } catch {
3473
+ return false;
3474
+ }
3475
+ }
3476
+ function macKeychainDelete(service = SERVICE) {
3477
+ if (!nativeKeychainAllowed()) return false;
3478
+ if (process.platform !== "darwin") return false;
3479
+ try {
3480
+ execSync2(
3481
+ `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
3297
3482
  { timeout: 5e3 }
3298
3483
  );
3299
3484
  return true;
@@ -3301,22 +3486,35 @@ function macKeychainSet(value) {
3301
3486
  return false;
3302
3487
  }
3303
3488
  }
3304
- function linuxSecretGet() {
3305
- if (process.platform !== "linux") return null;
3489
+ function linuxSecretGet(service = SERVICE) {
3490
+ if (!linuxSecretAvailable()) return null;
3306
3491
  try {
3307
3492
  return execSync2(
3308
- `secret-tool lookup service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
3493
+ `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
3309
3494
  { encoding: "utf-8", timeout: 5e3 }
3310
3495
  ).trim();
3311
3496
  } catch {
3312
3497
  return null;
3313
3498
  }
3314
3499
  }
3315
- function linuxSecretSet(value) {
3500
+ function linuxSecretSet(value, service = SERVICE) {
3501
+ if (!linuxSecretAvailable()) return false;
3502
+ try {
3503
+ execSync2(
3504
+ `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
3505
+ { timeout: 5e3 }
3506
+ );
3507
+ return true;
3508
+ } catch {
3509
+ return false;
3510
+ }
3511
+ }
3512
+ function linuxSecretDelete(service = SERVICE) {
3513
+ if (!nativeKeychainAllowed()) return false;
3316
3514
  if (process.platform !== "linux") return false;
3317
3515
  try {
3318
3516
  execSync2(
3319
- `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${SERVICE}" account "${ACCOUNT}"`,
3517
+ `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
3320
3518
  { timeout: 5e3 }
3321
3519
  );
3322
3520
  return true;
@@ -3325,6 +3523,7 @@ function linuxSecretSet(value) {
3325
3523
  }
3326
3524
  }
3327
3525
  async function tryKeytar() {
3526
+ if (!nativeKeychainAllowed()) return null;
3328
3527
  try {
3329
3528
  return await import("keytar");
3330
3529
  } catch {
@@ -3398,7 +3597,19 @@ async function writeMachineBoundFileFallback(b64) {
3398
3597
  return "plaintext";
3399
3598
  }
3400
3599
  async function getMasterKey() {
3401
- const nativeValue = macKeychainGet() ?? linuxSecretGet();
3600
+ let nativeValue = macKeychainGet() ?? linuxSecretGet();
3601
+ if (!nativeValue) {
3602
+ const legacyValue = macKeychainGet(LEGACY_SERVICE) ?? linuxSecretGet(LEGACY_SERVICE);
3603
+ if (legacyValue) {
3604
+ const migrated = macKeychainSet(legacyValue) || linuxSecretSet(legacyValue);
3605
+ if (migrated) {
3606
+ macKeychainDelete(LEGACY_SERVICE);
3607
+ linuxSecretDelete(LEGACY_SERVICE);
3608
+ process.stderr.write("[keychain] Migrated keychain service from exe-mem to exe-os.\n");
3609
+ }
3610
+ nativeValue = legacyValue;
3611
+ }
3612
+ }
3402
3613
  if (nativeValue) {
3403
3614
  return Buffer.from(nativeValue, "base64");
3404
3615
  }
@@ -3406,12 +3617,17 @@ async function getMasterKey() {
3406
3617
  if (keytar) {
3407
3618
  try {
3408
3619
  const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
3409
- if (keytarValue) {
3410
- const migrated = macKeychainSet(keytarValue) || linuxSecretSet(keytarValue);
3620
+ const legacyKeytarValue = keytarValue ?? await keytar.getPassword(LEGACY_SERVICE, ACCOUNT);
3621
+ if (legacyKeytarValue) {
3622
+ const migrated = macKeychainSet(legacyKeytarValue) || linuxSecretSet(legacyKeytarValue);
3411
3623
  if (migrated) {
3412
3624
  process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
3625
+ try {
3626
+ await keytar.deletePassword(LEGACY_SERVICE, ACCOUNT);
3627
+ } catch {
3628
+ }
3413
3629
  }
3414
- return Buffer.from(keytarValue, "base64");
3630
+ return Buffer.from(legacyKeytarValue, "base64");
3415
3631
  }
3416
3632
  } catch {
3417
3633
  }
@@ -3436,7 +3652,7 @@ async function getMasterKey() {
3436
3652
  const decrypted = decryptWithMachineKey(content, machineKey);
3437
3653
  if (!decrypted) {
3438
3654
  process.stderr.write(
3439
- "[keychain] Key decryption failed \u2014 machine may have changed.\n Use your 24-word recovery phrase: exe-os link import\n"
3655
+ "[keychain] Key decryption failed \u2014 machine may have changed.\n Use your 24-word recovery phrase during setup: exe-os setup\n"
3440
3656
  );
3441
3657
  return null;
3442
3658
  }
@@ -3445,6 +3661,9 @@ async function getMasterKey() {
3445
3661
  b64Value = content;
3446
3662
  }
3447
3663
  const key = Buffer.from(b64Value, "base64");
3664
+ if (!content.startsWith(ENCRYPTED_PREFIX) && isRootOnlyTrustedServerKeyFile(keyPath)) {
3665
+ return key;
3666
+ }
3448
3667
  const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
3449
3668
  if (migrated) {
3450
3669
  process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
@@ -3472,12 +3691,14 @@ async function getMasterKey() {
3472
3691
  return null;
3473
3692
  }
3474
3693
  }
3475
- var SERVICE, ACCOUNT, ENCRYPTED_PREFIX;
3694
+ var SERVICE, LEGACY_SERVICE, ACCOUNT, linuxSecretAvailability, ENCRYPTED_PREFIX;
3476
3695
  var init_keychain = __esm({
3477
3696
  "src/lib/keychain.ts"() {
3478
3697
  "use strict";
3479
- SERVICE = "exe-mem";
3698
+ SERVICE = "exe-os";
3699
+ LEGACY_SERVICE = "exe-mem";
3480
3700
  ACCOUNT = "master-key";
3701
+ linuxSecretAvailability = null;
3481
3702
  ENCRYPTED_PREFIX = "enc:";
3482
3703
  }
3483
3704
  });
@@ -3747,7 +3968,7 @@ __export(shard_manager_exports, {
3747
3968
  shardExists: () => shardExists
3748
3969
  });
3749
3970
  import path8 from "path";
3750
- import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync2 } from "fs";
3971
+ import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync3 } from "fs";
3751
3972
  import { createClient as createClient2 } from "@libsql/client";
3752
3973
  function initShardManager(encryptionKey) {
3753
3974
  _encryptionKey = encryptionKey;
@@ -3811,7 +4032,7 @@ async function auditShardHealth(options = {}) {
3811
4032
  const shards = [];
3812
4033
  for (const name of names) {
3813
4034
  const dbPath = path8.join(SHARDS_DIR, `${name}.db`);
3814
- const stat = statSync2(dbPath);
4035
+ const stat = statSync3(dbPath);
3815
4036
  const item = {
3816
4037
  name,
3817
4038
  path: dbPath,
@@ -4064,7 +4285,7 @@ async function getReadyShardClient(projectName) {
4064
4285
  _shardLastAccess.delete(safeName);
4065
4286
  const dbPath = path8.join(SHARDS_DIR, `${safeName}.db`);
4066
4287
  if (existsSync8(dbPath)) {
4067
- const stat = statSync2(dbPath);
4288
+ const stat = statSync3(dbPath);
4068
4289
  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
4069
4290
  const archivedPath = path8.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
4070
4291
  renameSync3(dbPath, archivedPath);
@@ -4571,6 +4792,274 @@ var init_memory_cards = __esm({
4571
4792
  }
4572
4793
  });
4573
4794
 
4795
+ // src/lib/agentic-ontology.ts
4796
+ var agentic_ontology_exports = {};
4797
+ __export(agentic_ontology_exports, {
4798
+ clean: () => clean,
4799
+ extractGoalCandidates: () => extractGoalCandidates,
4800
+ inferIntention: () => inferIntention,
4801
+ inferOntologyEventType: () => inferOntologyEventType,
4802
+ inferOutcome: () => inferOutcome,
4803
+ inferSemanticLabel: () => inferSemanticLabel,
4804
+ insertOntologyForBatch: () => insertOntologyForBatch,
4805
+ insertOntologyForMemory: () => insertOntologyForMemory,
4806
+ ontologyPayload: () => ontologyPayload,
4807
+ stableId: () => stableId2
4808
+ });
4809
+ import { createHash as createHash3 } from "crypto";
4810
+ function stableId2(...parts) {
4811
+ return createHash3("sha256").update(parts.map((p) => String(p ?? "")).join("::")).digest("hex").slice(0, 32);
4812
+ }
4813
+ function clean(text, max = 240) {
4814
+ return text.replace(/\u0000/g, "").replace(/```[\s\S]*?```/g, " ").replace(/\s+/g, " ").trim().slice(0, max);
4815
+ }
4816
+ function inferOntologyEventType(row) {
4817
+ const lower = row.raw_text.toLowerCase();
4818
+ if (row.has_error) return "error";
4819
+ if (/\b(done|complete|completed|fixed|resolved|shipped|deployed|pushed|published)\b/.test(lower)) return "milestone";
4820
+ if (/\b(blocked|failed|error|bug|regression|broken)\b/.test(lower)) return "problem";
4821
+ if (/\b(decided|decision|adr|we chose|approved|rejected)\b/.test(lower)) return "decision";
4822
+ if (/\b(goal|need to|we need|want to|trying to|objective)\b/.test(lower)) return "goal_signal";
4823
+ if (["Bash", "Read", "Edit", "Write", "Grep", "Glob"].includes(row.tool_name)) return "tool_action";
4824
+ if (row.tool_name.startsWith("memory_card")) return "memory_card";
4825
+ return "memory_observation";
4826
+ }
4827
+ function inferIntention(row) {
4828
+ if (row.intent) return clean(row.intent, 220);
4829
+ const text = clean(row.raw_text, 1e3);
4830
+ const patterns = [
4831
+ /(?:we need to|need to|let'?s|i want to|we should|goal is to|objective is to|trying to)\s+([^.!?\n]{8,220})/i,
4832
+ /(?:so that|in order to)\s+([^.!?\n]{8,220})/i,
4833
+ /(?:task|plan):\s*([^.!?\n]{8,220})/i
4834
+ ];
4835
+ for (const p of patterns) {
4836
+ const m = text.match(p);
4837
+ if (m?.[1]) return clean(m[1], 220);
4838
+ }
4839
+ if (["Bash", "Read", "Edit", "Write", "Grep", "Glob"].includes(row.tool_name)) {
4840
+ return `${row.tool_name} during ${row.project_name}`;
4841
+ }
4842
+ return null;
4843
+ }
4844
+ function inferOutcome(row) {
4845
+ if (row.outcome) return clean(row.outcome, 220);
4846
+ if (row.has_error) return "error";
4847
+ const lower = row.raw_text.toLowerCase();
4848
+ if (/\b(done|complete|completed|fixed|resolved|shipped|deployed|pushed|published|passed)\b/.test(lower)) return "success_signal";
4849
+ if (/\b(blocked|failed|error|regression|broken|not working|could not)\b/.test(lower)) return "failure_signal";
4850
+ if (/\b(warning|risk|concern|caveat)\b/.test(lower)) return "risk_signal";
4851
+ return null;
4852
+ }
4853
+ function extractGoalCandidates(row) {
4854
+ const text = clean(row.raw_text, 1600);
4855
+ const patterns = [
4856
+ /(?:we need to|need to|i want to|we should|goal is to|objective is to|trying to|let'?s)\s+([^.!?\n]{12,220})/gi,
4857
+ /(?:success means|success criteria|so that)\s+([^.!?\n]{12,220})/gi
4858
+ ];
4859
+ const out = [];
4860
+ for (const pattern of patterns) {
4861
+ for (const m of text.matchAll(pattern)) {
4862
+ const candidate = clean(m[1] ?? "", 220);
4863
+ if (candidate.length >= 12 && !out.some((x) => x.toLowerCase() === candidate.toLowerCase())) out.push(candidate);
4864
+ if (out.length >= 3) return out;
4865
+ }
4866
+ }
4867
+ return out;
4868
+ }
4869
+ function uniq(values, max = 6) {
4870
+ const out = [];
4871
+ for (const value of values.map((v) => clean(v, 220)).filter(Boolean)) {
4872
+ if (!out.some((x) => x.toLowerCase() === value.toLowerCase())) out.push(value);
4873
+ if (out.length >= max) break;
4874
+ }
4875
+ return out;
4876
+ }
4877
+ function extractMatches(text, patterns, max = 5) {
4878
+ const out = [];
4879
+ for (const pattern of patterns) {
4880
+ for (const match of text.matchAll(pattern)) {
4881
+ const value = match[1] ?? match[0];
4882
+ if (value) out.push(value);
4883
+ if (out.length >= max) return uniq(out, max);
4884
+ }
4885
+ }
4886
+ return uniq(out, max);
4887
+ }
4888
+ function inferSemanticLabel(row) {
4889
+ const text = clean(row.raw_text, 2400);
4890
+ const eventType = inferOntologyEventType(row);
4891
+ const intention = inferIntention(row);
4892
+ const outcome = inferOutcome(row);
4893
+ const goals = extractGoalCandidates(row);
4894
+ const milestones = extractMatches(text, [
4895
+ /\b(?:completed|finished|fixed|resolved|shipped|deployed|published|pushed|passed)\b([^.!?\n]{0,180})/gi,
4896
+ /(?:milestone|done):\s*([^.!?\n]{8,220})/gi
4897
+ ]);
4898
+ const problems = extractMatches(text, [
4899
+ /\b(?:blocked by|failed because|bug|regression|broken|not working|error)\b([^.!?\n]{0,180})/gi,
4900
+ /(?:problem|issue|risk):\s*([^.!?\n]{8,220})/gi
4901
+ ]);
4902
+ const decisions = extractMatches(text, [
4903
+ /(?:decided|decision|adr|we chose|approved|rejected)\s+([^.!?\n]{8,220})/gi
4904
+ ]);
4905
+ const temporalAnchors = extractMatches(text, [
4906
+ /\b(\d{4}-\d{2}-\d{2}(?:[T ][0-9:.+-Z]+)?)\b/g,
4907
+ /\b(today|yesterday|tomorrow|this week|next week|last week|morning|afternoon|tonight)\b/gi
4908
+ ], 8);
4909
+ const nextActions = extractMatches(text, [
4910
+ /(?:next|todo|follow[- ]?up|remaining|need to)\s*:?\s*([^.!?\n]{8,220})/gi
4911
+ ]);
4912
+ const actors = uniq([
4913
+ row.agent_id,
4914
+ ...extractMatches(text, [/\b(?:agent|employee|owner|assignee)[:= ]+([a-zA-Z][a-zA-Z0-9_-]{1,40})/gi], 5)
4915
+ ], 6);
4916
+ const successSignals = milestones.length ? milestones : outcome === "success_signal" ? [clean(text, 180)] : [];
4917
+ const failureSignals = problems.length ? problems : outcome === "failure_signal" || row.has_error ? [clean(text, 180)] : [];
4918
+ const impact = successSignals.length && failureSignals.length ? "mixed" : failureSignals.length ? "negative" : successSignals.length ? "positive" : "neutral";
4919
+ const signalCount = goals.length + milestones.length + problems.length + decisions.length + nextActions.length;
4920
+ return {
4921
+ labeler: "deterministic",
4922
+ schemaVersion: 1,
4923
+ eventType,
4924
+ intention,
4925
+ outcome,
4926
+ impact,
4927
+ confidence: Math.min(0.95, 0.45 + signalCount * 0.08 + (intention ? 0.1 : 0) + (outcome ? 0.1 : 0)),
4928
+ goals,
4929
+ milestones,
4930
+ problems,
4931
+ decisions,
4932
+ actors,
4933
+ temporalAnchors,
4934
+ successSignals,
4935
+ failureSignals,
4936
+ nextActions,
4937
+ summary: clean(text, 280)
4938
+ };
4939
+ }
4940
+ function ontologyPayload(row) {
4941
+ const semantic = inferSemanticLabel(row);
4942
+ return {
4943
+ tool_name: row.tool_name,
4944
+ memory_version: row.version ?? null,
4945
+ domain: row.domain ?? null,
4946
+ trajectory: row.trajectory ? safeJson(row.trajectory) : null,
4947
+ semantic
4948
+ };
4949
+ }
4950
+ function safeJson(value) {
4951
+ try {
4952
+ return JSON.parse(value);
4953
+ } catch {
4954
+ return value.slice(0, 1e3);
4955
+ }
4956
+ }
4957
+ async function resolveClient(client) {
4958
+ if (client) return client;
4959
+ const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
4960
+ return getClient2();
4961
+ }
4962
+ async function insertOntologyForMemory(row, client) {
4963
+ const db = await resolveClient(client);
4964
+ const occurredAt = row.timestamp;
4965
+ const sequence = Number(row.version ?? 0) || Math.floor(new Date(occurredAt).getTime() / 1e3);
4966
+ const eventType = inferOntologyEventType(row);
4967
+ const intention = inferIntention(row);
4968
+ const outcome = inferOutcome(row);
4969
+ const eventId = stableId2("event", row.id);
4970
+ const now = (/* @__PURE__ */ new Date()).toISOString();
4971
+ await db.execute({
4972
+ sql: `INSERT INTO agent_sessions (id, agent_id, project_name, started_at, last_event_at, event_count, properties)
4973
+ VALUES (?, ?, ?, ?, ?, 1, ?)
4974
+ ON CONFLICT(id) DO UPDATE SET last_event_at = MAX(last_event_at, excluded.last_event_at),
4975
+ event_count = event_count + 1`,
4976
+ args: [row.session_id, row.agent_id, row.project_name, occurredAt, occurredAt, JSON.stringify({ agent_role: row.agent_role })]
4977
+ });
4978
+ await db.execute({
4979
+ sql: `INSERT OR IGNORE INTO agent_events
4980
+ (id, event_type, occurred_at, sequence_index, actor_agent_id, agent_role, project_name,
4981
+ session_id, task_id, goal_id, parent_event_id, intention, outcome, evidence_memory_id,
4982
+ impact, payload, created_at)
4983
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?, ?, ?, ?, ?)`,
4984
+ args: [
4985
+ eventId,
4986
+ eventType,
4987
+ occurredAt,
4988
+ sequence,
4989
+ row.agent_id,
4990
+ row.agent_role,
4991
+ row.project_name,
4992
+ row.session_id,
4993
+ row.task_id ?? null,
4994
+ intention,
4995
+ outcome,
4996
+ row.id,
4997
+ row.has_error ? "negative" : outcome === "success_signal" ? "positive" : "neutral",
4998
+ JSON.stringify(ontologyPayload(row)),
4999
+ now
5000
+ ]
5001
+ });
5002
+ const semantic = inferSemanticLabel(row);
5003
+ await db.execute({
5004
+ sql: `INSERT INTO agent_semantic_labels
5005
+ (id, source_memory_id, event_id, labeler, schema_version, confidence, labels, created_at, updated_at)
5006
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
5007
+ ON CONFLICT(id) DO UPDATE SET confidence = excluded.confidence,
5008
+ labels = excluded.labels, updated_at = excluded.updated_at`,
5009
+ args: [
5010
+ stableId2("semantic", row.id, semantic.labeler, semantic.schemaVersion),
5011
+ row.id,
5012
+ eventId,
5013
+ semantic.labeler,
5014
+ semantic.schemaVersion,
5015
+ semantic.confidence,
5016
+ JSON.stringify(semantic),
5017
+ now,
5018
+ now
5019
+ ]
5020
+ });
5021
+ for (const statement of extractGoalCandidates(row)) {
5022
+ const goalId = stableId2("goal", row.project_name, statement.toLowerCase());
5023
+ await db.execute({
5024
+ sql: `INSERT INTO agent_goals
5025
+ (id, statement, owner_agent_id, project_name, status, priority, success_criteria,
5026
+ parent_goal_id, due_at, achieved_at, supersedes_id, created_at, updated_at, source_memory_id)
5027
+ VALUES (?, ?, ?, ?, 'open', 5, NULL, NULL, NULL, NULL, NULL, ?, ?, ?)
5028
+ ON CONFLICT(id) DO UPDATE SET updated_at = excluded.updated_at`,
5029
+ args: [goalId, statement, row.agent_id, row.project_name, now, now, row.id]
5030
+ });
5031
+ await db.execute({
5032
+ sql: `INSERT OR IGNORE INTO agent_goal_links
5033
+ (id, goal_id, link_type, target_id, target_type, created_at)
5034
+ VALUES (?, ?, 'evidence', ?, 'memory', ?)`,
5035
+ args: [stableId2("goal_link", goalId, row.id, "memory"), goalId, row.id, now]
5036
+ });
5037
+ await db.execute({
5038
+ sql: `INSERT OR IGNORE INTO agent_goal_links
5039
+ (id, goal_id, link_type, target_id, target_type, created_at)
5040
+ VALUES (?, ?, 'event', ?, 'event', ?)`,
5041
+ args: [stableId2("goal_link", goalId, eventId, "event"), goalId, eventId, now]
5042
+ });
5043
+ }
5044
+ }
5045
+ async function insertOntologyForBatch(rows, client) {
5046
+ const db = await resolveClient(client);
5047
+ let count = 0;
5048
+ for (const row of rows) {
5049
+ try {
5050
+ await insertOntologyForMemory(row, db);
5051
+ count++;
5052
+ } catch {
5053
+ }
5054
+ }
5055
+ return count;
5056
+ }
5057
+ var init_agentic_ontology = __esm({
5058
+ "src/lib/agentic-ontology.ts"() {
5059
+ "use strict";
5060
+ }
5061
+ });
5062
+
4574
5063
  // src/lib/store.ts
4575
5064
  var store_exports = {};
4576
5065
  __export(store_exports, {
@@ -4914,6 +5403,11 @@ async function flushBatch() {
4914
5403
  await insertMemoryCardsForBatch2(batch);
4915
5404
  } catch {
4916
5405
  }
5406
+ try {
5407
+ const { insertOntologyForBatch: insertOntologyForBatch2 } = await Promise.resolve().then(() => (init_agentic_ontology(), agentic_ontology_exports));
5408
+ await insertOntologyForBatch2(batch);
5409
+ } catch {
5410
+ }
4917
5411
  schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
4918
5412
  _pendingRecords.splice(0, batch.length);
4919
5413
  try {
@@ -5532,7 +6026,7 @@ __export(file_grep_exports, {
5532
6026
  grepProjectFiles: () => grepProjectFiles
5533
6027
  });
5534
6028
  import { execSync as execSync4 } from "child_process";
5535
- import { readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3, existsSync as existsSync10 } from "fs";
6029
+ import { readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync4, existsSync as existsSync10 } from "fs";
5536
6030
  import path11 from "path";
5537
6031
  import crypto2 from "crypto";
5538
6032
  function hasRipgrep() {
@@ -5649,7 +6143,7 @@ function grepWithNodeFs(pattern, projectRoot, patterns) {
5649
6143
  for (const filePath of files.slice(0, MAX_FILES)) {
5650
6144
  const absPath = path11.join(projectRoot, filePath);
5651
6145
  try {
5652
- const stat = statSync3(absPath);
6146
+ const stat = statSync4(absPath);
5653
6147
  if (stat.size > MAX_FILE_SIZE) continue;
5654
6148
  const content = readFileSync6(absPath, "utf8");
5655
6149
  const lines = content.split("\n");
@@ -10202,7 +10696,7 @@ var init_messaging = __esm({
10202
10696
  });
10203
10697
 
10204
10698
  // src/lib/memory-queue.ts
10205
- import { appendFileSync as appendFileSync2, readFileSync as readFileSync16, renameSync as renameSync5, unlinkSync as unlinkSync9, existsSync as existsSync21, statSync as statSync4 } from "fs";
10699
+ import { appendFileSync as appendFileSync2, readFileSync as readFileSync16, renameSync as renameSync5, unlinkSync as unlinkSync9, existsSync as existsSync21, statSync as statSync5 } from "fs";
10206
10700
  import path25 from "path";
10207
10701
  function enqueueMemory(entry) {
10208
10702
  appendFileSync2(QUEUE_PATH2, JSON.stringify(entry) + "\n");