@askexenow/exe-os 0.9.7 → 0.9.9

package/dist/bin/exe-settings.js

@@ -3,9 +3,47 @@ var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
 
+// src/lib/secure-files.ts
+import { chmodSync, existsSync, mkdirSync } from "fs";
+import { chmod, mkdir } from "fs/promises";
+async function ensurePrivateDir(dirPath) {
+  await mkdir(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    await chmod(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+function ensurePrivateDirSync(dirPath) {
+  mkdirSync(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    chmodSync(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+async function enforcePrivateFile(filePath) {
+  try {
+    await chmod(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+function enforcePrivateFileSync(filePath) {
+  try {
+    if (existsSync(filePath)) chmodSync(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+var PRIVATE_DIR_MODE, PRIVATE_FILE_MODE;
+var init_secure_files = __esm({
+  "src/lib/secure-files.ts"() {
+    "use strict";
+    PRIVATE_DIR_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+  }
+});
+
 // src/lib/config.ts
-import { readFile, writeFile, mkdir, chmod } from "fs/promises";
-import { readFileSync, existsSync, renameSync } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
 import path from "path";
 import os from "os";
 function resolveDataDir() {
@@ -13,7 +51,7 @@ function resolveDataDir() {
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
   const newDir = path.join(os.homedir(), ".exe-os");
   const legacyDir = path.join(os.homedir(), ".exe-mem");
-  if (!existsSync(newDir) && existsSync(legacyDir)) {
+  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
       process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
@@ -76,9 +114,9 @@ function normalizeAutoUpdate(raw) {
 }
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path.join(dir, "config.json");
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
   }
   const raw = await readFile(configPath, "utf-8");
@@ -91,6 +129,7 @@ async function loadConfig() {
 `);
       try {
         await writeFile(configPath, JSON.stringify(migratedCfg, null, 2) + "\n");
+        await enforcePrivateFile(configPath);
       } catch {
       }
     }
@@ -108,17 +147,16 @@ async function loadConfig() {
 }
 async function saveConfig(config) {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path.join(dir, "config.json");
   await writeFile(configPath, JSON.stringify(config, null, 2) + "\n");
-  if (config.cloud?.apiKey) {
-    await chmod(configPath, 384);
-  }
+  await enforcePrivateFile(configPath);
 }
 var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CONFIG_VERSION, DEFAULT_CONFIG, CONFIG_MIGRATIONS;
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
+    init_secure_files();
     EXE_AI_DIR = resolveDataDir();
     DB_PATH = path.join(EXE_AI_DIR, "memories.db");
     MODELS_DIR = path.join(EXE_AI_DIR, "models");
@@ -204,24 +242,46 @@ var init_db_retry = __esm({
 
 // src/lib/employees.ts
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { existsSync as existsSync2, symlinkSync, readlinkSync, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
+import { existsSync as existsSync3, symlinkSync, readlinkSync, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
 import { execSync } from "child_process";
 import path2 from "path";
 import os2 from "os";
 function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync2(employeesPath)) return [];
+  if (!existsSync3(employeesPath)) return [];
   try {
     return JSON.parse(readFileSync2(employeesPath, "utf-8"));
   } catch {
     return [];
   }
 }
-var EMPLOYEES_PATH;
+var EMPLOYEES_PATH, IDENTITY_DIR;
 var init_employees = __esm({
   "src/lib/employees.ts"() {
     "use strict";
     init_config();
     EMPLOYEES_PATH = path2.join(EXE_AI_DIR, "exe-employees.json");
+    IDENTITY_DIR = path2.join(EXE_AI_DIR, "identity");
+  }
+});
+
+// src/lib/database-adapter.ts
+import os3 from "os";
+import path3 from "path";
+import { createRequire } from "module";
+import { pathToFileURL } from "url";
+var BOOLEAN_COLUMNS_BY_TABLE, BOOLEAN_COLUMN_NAMES;
+var init_database_adapter = __esm({
+  "src/lib/database-adapter.ts"() {
+    "use strict";
+    BOOLEAN_COLUMNS_BY_TABLE = {
+      memories: /* @__PURE__ */ new Set(["has_error", "draft"]),
+      behaviors: /* @__PURE__ */ new Set(["active"]),
+      notifications: /* @__PURE__ */ new Set(["read"]),
+      users: /* @__PURE__ */ new Set(["has_personal_memory"])
+    };
+    BOOLEAN_COLUMN_NAMES = new Set(
+      Object.values(BOOLEAN_COLUMNS_BY_TABLE).flatMap((cols) => [...cols])
+    );
   }
 });
 
@@ -232,19 +292,114 @@ var init_database = __esm({
     "use strict";
     init_db_retry();
     init_employees();
+    init_database_adapter();
   }
 });
 
 // src/lib/crdt-sync.ts
 import * as Y from "yjs";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
-import path4 from "path";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync3, unlinkSync as unlinkSync2 } from "fs";
+import path5 from "path";
 import { homedir } from "os";
 var DEFAULT_STATE_PATH;
 var init_crdt_sync = __esm({
   "src/lib/crdt-sync.ts"() {
     "use strict";
-    DEFAULT_STATE_PATH = path4.join(homedir(), ".exe-os", "crdt-state.bin");
+    DEFAULT_STATE_PATH = path5.join(homedir(), ".exe-os", "crdt-state.bin");
+  }
+});
+
+// src/lib/runtime-table.ts
+var RUNTIME_TABLE, DEFAULT_RUNTIME;
+var init_runtime_table = __esm({
+  "src/lib/runtime-table.ts"() {
+    "use strict";
+    RUNTIME_TABLE = {
+      codex: {
+        binary: "codex",
+        launchMode: "interactive",
+        autoApproveFlag: "--dangerously-bypass-approvals-and-sandbox",
+        inlineFlag: "--no-alt-screen",
+        apiKeyEnv: "OPENAI_API_KEY",
+        defaultModel: "gpt-5.4"
+      },
+      opencode: {
+        binary: "opencode",
+        launchMode: "exec",
+        autoApproveFlag: "--dangerously-skip-permissions",
+        inlineFlag: "",
+        apiKeyEnv: "ANTHROPIC_API_KEY",
+        defaultModel: "anthropic/claude-sonnet-4-6"
+      }
+    };
+    DEFAULT_RUNTIME = "claude";
+  }
+});
+
+// src/lib/agent-config.ts
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import path7 from "path";
+function loadAgentConfig() {
+  if (!existsSync7(AGENT_CONFIG_PATH)) return {};
+  try {
+    return JSON.parse(readFileSync6(AGENT_CONFIG_PATH, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function saveAgentConfig(config) {
+  const dir = path7.dirname(AGENT_CONFIG_PATH);
+  ensurePrivateDirSync(dir);
+  writeFileSync5(AGENT_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  enforcePrivateFileSync(AGENT_CONFIG_PATH);
+}
+function setAgentRuntime(agentId, runtime, model) {
+  const knownModels = KNOWN_RUNTIMES[runtime];
+  if (!knownModels) {
+    return {
+      ok: false,
+      error: `Unknown runtime "${runtime}". Valid: ${Object.keys(KNOWN_RUNTIMES).join(", ")}`
+    };
+  }
+  if (!knownModels.includes(model)) {
+    return {
+      ok: false,
+      error: `Unknown model "${model}" for runtime "${runtime}". Valid: ${knownModels.join(", ")}`
+    };
+  }
+  const config = loadAgentConfig();
+  config[agentId] = { runtime, model };
+  saveAgentConfig(config);
+  return { ok: true };
+}
+function clearAgentRuntime(agentId) {
+  const config = loadAgentConfig();
+  delete config[agentId];
+  saveAgentConfig(config);
+}
+var AGENT_CONFIG_PATH, KNOWN_RUNTIMES, RUNTIME_LABELS, DEFAULT_MODELS;
+var init_agent_config = __esm({
+  "src/lib/agent-config.ts"() {
+    "use strict";
+    init_config();
+    init_runtime_table();
+    init_secure_files();
+    AGENT_CONFIG_PATH = path7.join(EXE_AI_DIR, "agent-config.json");
+    KNOWN_RUNTIMES = {
+      claude: ["claude-opus-4", "claude-sonnet-4", "claude-haiku-4.5"],
+      codex: ["gpt-5.4", "gpt-5.5", "gpt-5.3-codex-spark", "o3", "o4-mini"],
+      opencode: ["anthropic/claude-sonnet-4-6", "openai/gpt-5.4", "google/gemini-2.5-pro", "deepseek/deepseek-r3", "minimax/minimax-m2.5"]
+    };
+    RUNTIME_LABELS = {
+      claude: "Claude Code (Anthropic)",
+      codex: "Codex (OpenAI)",
+      opencode: "OpenCode (open source)"
+    };
+    DEFAULT_MODELS = {
+      claude: "claude-opus-4",
+      codex: RUNTIME_TABLE.codex?.defaultModel ?? "gpt-5.4",
+      opencode: RUNTIME_TABLE.opencode?.defaultModel ?? "anthropic/claude-sonnet-4-6"
+    };
   }
 });
 
@@ -269,9 +424,9 @@ function isMainModule(importMetaUrl) {
 
 // src/lib/cloud-sync.ts
 init_database();
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5, readdirSync, mkdirSync as mkdirSync3, appendFileSync, unlinkSync as unlinkSync3, openSync, closeSync } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync6, readdirSync, mkdirSync as mkdirSync4, appendFileSync, unlinkSync as unlinkSync3, openSync, closeSync } from "fs";
 import crypto2 from "crypto";
-import path5 from "path";
+import path6 from "path";
 import { homedir as homedir2 } from "os";
 
 // src/lib/crypto.ts
@@ -282,20 +437,24 @@ import { brotliCompressSync, brotliDecompressSync, constants } from "zlib";
 
 // src/lib/license.ts
 init_config();
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
 import { randomUUID } from "crypto";
-import path3 from "path";
+import { createRequire as createRequire2 } from "module";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import os4 from "os";
+import path4 from "path";
 import { jwtVerify, importSPKI } from "jose";
-var LICENSE_PATH = path3.join(EXE_AI_DIR, "license.key");
-var CACHE_PATH = path3.join(EXE_AI_DIR, "license-cache.json");
-var DEVICE_ID_PATH = path3.join(EXE_AI_DIR, "device-id");
+var LICENSE_PATH = path4.join(EXE_AI_DIR, "license.key");
+var CACHE_PATH = path4.join(EXE_AI_DIR, "license-cache.json");
+var DEVICE_ID_PATH = path4.join(EXE_AI_DIR, "device-id");
 
 // src/lib/cloud-sync.ts
 init_config();
 init_crdt_sync();
 init_employees();
+init_secure_files();
 var LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
-var ROSTER_LOCK_PATH = path5.join(EXE_AI_DIR, "roster-merge.lock");
+var ROSTER_LOCK_PATH = path6.join(EXE_AI_DIR, "roster-merge.lock");
 function assertSecureEndpoint(endpoint) {
   if (endpoint.startsWith("https://")) return;
   if (endpoint.startsWith("http://")) {
@@ -310,90 +469,11 @@ function assertSecureEndpoint(endpoint) {
     );
   }
 }
-var ROSTER_DELETIONS_PATH = path5.join(EXE_AI_DIR, "roster-deletions.json");
-
-// src/lib/agent-config.ts
-init_config();
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
-import path6 from "path";
-
-// src/lib/runtime-table.ts
-var RUNTIME_TABLE = {
-  codex: {
-    binary: "codex",
-    launchMode: "interactive",
-    autoApproveFlag: "--dangerously-bypass-approvals-and-sandbox",
-    inlineFlag: "--no-alt-screen",
-    apiKeyEnv: "OPENAI_API_KEY",
-    defaultModel: "gpt-5.4"
-  },
-  opencode: {
-    binary: "opencode",
-    launchMode: "exec",
-    autoApproveFlag: "--dangerously-skip-permissions",
-    inlineFlag: "",
-    apiKeyEnv: "ANTHROPIC_API_KEY",
-    defaultModel: "anthropic/claude-sonnet-4-6"
-  }
-};
-var DEFAULT_RUNTIME = "claude";
-
-// src/lib/agent-config.ts
-var AGENT_CONFIG_PATH = path6.join(EXE_AI_DIR, "agent-config.json");
-var KNOWN_RUNTIMES = {
-  claude: ["claude-opus-4", "claude-sonnet-4", "claude-haiku-4.5"],
-  codex: ["gpt-5.4", "gpt-5.5", "gpt-5.3-codex-spark", "o3", "o4-mini"],
-  opencode: ["anthropic/claude-sonnet-4-6", "openai/gpt-5.4", "google/gemini-2.5-pro", "deepseek/deepseek-r3", "minimax/minimax-m2.5"]
-};
-var RUNTIME_LABELS = {
-  claude: "Claude Code (Anthropic)",
-  codex: "Codex (OpenAI)",
-  opencode: "OpenCode (open source)"
-};
-var DEFAULT_MODELS = {
-  claude: "claude-opus-4",
-  codex: RUNTIME_TABLE.codex?.defaultModel ?? "gpt-5.4",
-  opencode: RUNTIME_TABLE.opencode?.defaultModel ?? "anthropic/claude-sonnet-4-6"
-};
-function loadAgentConfig() {
-  if (!existsSync6(AGENT_CONFIG_PATH)) return {};
-  try {
-    return JSON.parse(readFileSync6(AGENT_CONFIG_PATH, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-function saveAgentConfig(config) {
-  const dir = path6.dirname(AGENT_CONFIG_PATH);
-  if (!existsSync6(dir)) mkdirSync4(dir, { recursive: true });
-  writeFileSync5(AGENT_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", "utf-8");
-}
-function setAgentRuntime(agentId, runtime, model) {
-  const knownModels = KNOWN_RUNTIMES[runtime];
-  if (!knownModels) {
-    return {
-      ok: false,
-      error: `Unknown runtime "${runtime}". Valid: ${Object.keys(KNOWN_RUNTIMES).join(", ")}`
-    };
-  }
-  if (!knownModels.includes(model)) {
-    return {
-      ok: false,
-      error: `Unknown model "${model}" for runtime "${runtime}". Valid: ${knownModels.join(", ")}`
-    };
-  }
-  const config = loadAgentConfig();
-  config[agentId] = { runtime, model };
-  saveAgentConfig(config);
-  return { ok: true };
-}
-function clearAgentRuntime(agentId) {
-  const config = loadAgentConfig();
-  delete config[agentId];
-  saveAgentConfig(config);
-}
+var ROSTER_DELETIONS_PATH = path6.join(EXE_AI_DIR, "roster-deletions.json");
 
 // src/bin/exe-settings.ts
+init_agent_config();
+init_runtime_table();
 init_employees();
 function label(value) {
   return value ? "ON" : "OFF";