@askexenow/exe-os 0.9.8 → 0.9.9

package/dist/bin/exe-settings.js

@@ -3,9 +3,47 @@ var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
 
+// src/lib/secure-files.ts
+import { chmodSync, existsSync, mkdirSync } from "fs";
+import { chmod, mkdir } from "fs/promises";
+async function ensurePrivateDir(dirPath) {
+  await mkdir(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    await chmod(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+function ensurePrivateDirSync(dirPath) {
+  mkdirSync(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    chmodSync(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+async function enforcePrivateFile(filePath) {
+  try {
+    await chmod(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+function enforcePrivateFileSync(filePath) {
+  try {
+    if (existsSync(filePath)) chmodSync(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+var PRIVATE_DIR_MODE, PRIVATE_FILE_MODE;
+var init_secure_files = __esm({
+  "src/lib/secure-files.ts"() {
+    "use strict";
+    PRIVATE_DIR_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+  }
+});
+
 // src/lib/config.ts
-import { readFile, writeFile, mkdir, chmod } from "fs/promises";
-import { readFileSync, existsSync, renameSync } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
 import path from "path";
 import os from "os";
 function resolveDataDir() {
@@ -13,7 +51,7 @@ function resolveDataDir() {
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
   const newDir = path.join(os.homedir(), ".exe-os");
   const legacyDir = path.join(os.homedir(), ".exe-mem");
-  if (!existsSync(newDir) && existsSync(legacyDir)) {
+  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
       process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
@@ -76,9 +114,9 @@ function normalizeAutoUpdate(raw) {
 }
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path.join(dir, "config.json");
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
   }
   const raw = await readFile(configPath, "utf-8");
@@ -91,6 +129,7 @@ async function loadConfig() {
 `);
       try {
         await writeFile(configPath, JSON.stringify(migratedCfg, null, 2) + "\n");
+        await enforcePrivateFile(configPath);
       } catch {
       }
     }
@@ -108,17 +147,16 @@ async function loadConfig() {
 }
 async function saveConfig(config) {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path.join(dir, "config.json");
   await writeFile(configPath, JSON.stringify(config, null, 2) + "\n");
-  if (config.cloud?.apiKey) {
-    await chmod(configPath, 384);
-  }
+  await enforcePrivateFile(configPath);
 }
 var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CONFIG_VERSION, DEFAULT_CONFIG, CONFIG_MIGRATIONS;
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
+    init_secure_files();
     EXE_AI_DIR = resolveDataDir();
     DB_PATH = path.join(EXE_AI_DIR, "memories.db");
     MODELS_DIR = path.join(EXE_AI_DIR, "models");
@@ -204,12 +242,12 @@ var init_db_retry = __esm({
 
 // src/lib/employees.ts
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { existsSync as existsSync2, symlinkSync, readlinkSync, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
+import { existsSync as existsSync3, symlinkSync, readlinkSync, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
 import { execSync } from "child_process";
 import path2 from "path";
 import os2 from "os";
 function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync2(employeesPath)) return [];
+  if (!existsSync3(employeesPath)) return [];
   try {
     return JSON.parse(readFileSync2(employeesPath, "utf-8"));
   } catch {
@@ -260,7 +298,7 @@ var init_database = __esm({
 
 // src/lib/crdt-sync.ts
 import * as Y from "yjs";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync3, unlinkSync as unlinkSync2 } from "fs";
 import path5 from "path";
 import { homedir } from "os";
 var DEFAULT_STATE_PATH;
@@ -299,10 +337,10 @@ var init_runtime_table = __esm({
 });
 
 // src/lib/agent-config.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
 import path7 from "path";
 function loadAgentConfig() {
-  if (!existsSync6(AGENT_CONFIG_PATH)) return {};
+  if (!existsSync7(AGENT_CONFIG_PATH)) return {};
   try {
     return JSON.parse(readFileSync6(AGENT_CONFIG_PATH, "utf-8"));
   } catch {
@@ -311,8 +349,9 @@ function loadAgentConfig() {
 }
 function saveAgentConfig(config) {
   const dir = path7.dirname(AGENT_CONFIG_PATH);
-  if (!existsSync6(dir)) mkdirSync4(dir, { recursive: true });
+  ensurePrivateDirSync(dir);
   writeFileSync5(AGENT_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  enforcePrivateFileSync(AGENT_CONFIG_PATH);
 }
 function setAgentRuntime(agentId, runtime, model) {
   const knownModels = KNOWN_RUNTIMES[runtime];
@@ -344,6 +383,7 @@ var init_agent_config = __esm({
     "use strict";
     init_config();
     init_runtime_table();
+    init_secure_files();
     AGENT_CONFIG_PATH = path7.join(EXE_AI_DIR, "agent-config.json");
     KNOWN_RUNTIMES = {
       claude: ["claude-opus-4", "claude-sonnet-4", "claude-haiku-4.5"],
@@ -384,7 +424,7 @@ function isMainModule(importMetaUrl) {
 
 // src/lib/cloud-sync.ts
 init_database();
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5, readdirSync, mkdirSync as mkdirSync3, appendFileSync, unlinkSync as unlinkSync3, openSync, closeSync } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync6, readdirSync, mkdirSync as mkdirSync4, appendFileSync, unlinkSync as unlinkSync3, openSync, closeSync } from "fs";
 import crypto2 from "crypto";
 import path6 from "path";
 import { homedir as homedir2 } from "os";
@@ -397,8 +437,11 @@ import { brotliCompressSync, brotliDecompressSync, constants } from "zlib";
 
 // src/lib/license.ts
 init_config();
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
 import { randomUUID } from "crypto";
+import { createRequire as createRequire2 } from "module";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import os4 from "os";
 import path4 from "path";
 import { jwtVerify, importSPKI } from "jose";
 var LICENSE_PATH = path4.join(EXE_AI_DIR, "license.key");
@@ -409,6 +452,7 @@ var DEVICE_ID_PATH = path4.join(EXE_AI_DIR, "device-id");
 init_config();
 init_crdt_sync();
 init_employees();
+init_secure_files();
 var LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
 var ROSTER_LOCK_PATH = path6.join(EXE_AI_DIR, "roster-merge.lock");
 function assertSecureEndpoint(endpoint) {

package/dist/bin/exe-start-codex.js

@@ -70,9 +70,34 @@ var init_db_retry = __esm({
   }
 });
 
+// src/lib/secure-files.ts
+import { chmodSync, existsSync, mkdirSync } from "fs";
+import { chmod, mkdir } from "fs/promises";
+async function ensurePrivateDir(dirPath) {
+  await mkdir(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    await chmod(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+async function enforcePrivateFile(filePath) {
+  try {
+    await chmod(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+var PRIVATE_DIR_MODE, PRIVATE_FILE_MODE;
+var init_secure_files = __esm({
+  "src/lib/secure-files.ts"() {
+    "use strict";
+    PRIVATE_DIR_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+  }
+});
+
 // src/lib/config.ts
-import { readFile, writeFile, mkdir, chmod } from "fs/promises";
-import { readFileSync, existsSync, renameSync } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
 import path from "path";
 import os from "os";
 function resolveDataDir() {
@@ -80,7 +105,7 @@ function resolveDataDir() {
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
   const newDir = path.join(os.homedir(), ".exe-os");
   const legacyDir = path.join(os.homedir(), ".exe-mem");
-  if (!existsSync(newDir) && existsSync(legacyDir)) {
+  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
       process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
@@ -143,9 +168,9 @@ function normalizeAutoUpdate(raw) {
 }
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
-  await mkdir(dir, { recursive: true });
+  await ensurePrivateDir(dir);
   const configPath = path.join(dir, "config.json");
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
   }
   const raw = await readFile(configPath, "utf-8");
@@ -158,6 +183,7 @@ async function loadConfig() {
 `);
       try {
         await writeFile(configPath, JSON.stringify(migratedCfg, null, 2) + "\n");
+        await enforcePrivateFile(configPath);
       } catch {
       }
     }
@@ -177,6 +203,7 @@ var EXE_AI_DIR, DB_PATH, MODELS_DIR, CONFIG_PATH, LEGACY_LANCE_PATH, CURRENT_CON
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
+    init_secure_files();
     EXE_AI_DIR = resolveDataDir();
     DB_PATH = path.join(EXE_AI_DIR, "memories.db");
     MODELS_DIR = path.join(EXE_AI_DIR, "models");
@@ -255,7 +282,7 @@ var init_config = __esm({
 
 // src/lib/employees.ts
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { existsSync as existsSync2, symlinkSync, readlinkSync, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
+import { existsSync as existsSync3, symlinkSync, readlinkSync, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
 import { execSync } from "child_process";
 import path2 from "path";
 import os2 from "os";
@@ -272,7 +299,7 @@ function getCoordinatorName(employees = loadEmployeesSync()) {
   return getCoordinatorEmployee(employees)?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME;
 }
 function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync2(employeesPath)) return [];
+  if (!existsSync3(employeesPath)) return [];
   try {
     return JSON.parse(readFileSync2(employeesPath, "utf-8"));
   } catch {
@@ -1228,6 +1255,7 @@ async function ensureSchema() {
       project     TEXT NOT NULL,
       summary     TEXT NOT NULL,
       task_file   TEXT,
+      session_scope TEXT,
       read        INTEGER NOT NULL DEFAULT 0,
       created_at  TEXT NOT NULL
     );
@@ -1236,7 +1264,7 @@ async function ensureSchema() {
       ON notifications(read);
 
     CREATE INDEX IF NOT EXISTS idx_notifications_agent
-      ON notifications(agent_id);
+      ON notifications(agent_id, session_scope);
 
     CREATE INDEX IF NOT EXISTS idx_notifications_task_file
       ON notifications(task_file);
@@ -1274,6 +1302,7 @@ async function ensureSchema() {
       target_agent    TEXT NOT NULL,
       target_project  TEXT,
       target_device   TEXT NOT NULL DEFAULT 'local',
+      session_scope   TEXT,
       content         TEXT NOT NULL,
       priority        TEXT DEFAULT 'normal',
       status          TEXT DEFAULT 'pending',
@@ -1287,10 +1316,31 @@ async function ensureSchema() {
     );
 
     CREATE INDEX IF NOT EXISTS idx_messages_target
-      ON messages(target_agent, status);
+      ON messages(target_agent, session_scope, status);
 
     CREATE INDEX IF NOT EXISTS idx_messages_conversation_order
-      ON messages(target_agent, from_agent, server_seq);
+      ON messages(target_agent, session_scope, from_agent, server_seq);
+  `);
+  try {
+    await client.execute({
+      sql: `ALTER TABLE notifications ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  try {
+    await client.execute({
+      sql: `ALTER TABLE messages ADD COLUMN session_scope TEXT`,
+      args: []
+    });
+  } catch {
+  }
+  await client.executeMultiple(`
+    CREATE INDEX IF NOT EXISTS idx_notifications_agent_scope_read
+      ON notifications(agent_id, session_scope, read, created_at);
+
+    CREATE INDEX IF NOT EXISTS idx_messages_target_scope_status
+      ON messages(target_agent, session_scope, status, created_at);
   `);
   try {
     await client.execute({
@@ -1874,6 +1924,13 @@ async function ensureSchema() {
     } catch {
     }
   }
+  try {
+    await client.execute({
+      sql: `UPDATE tasks SET status = 'closed' WHERE status = 'done' AND result IS NOT NULL`,
+      args: []
+    });
+  } catch {
+  }
 }
 async function disposeDatabase() {
   if (_walCheckpointTimer) {
@@ -1916,6 +1973,7 @@ var shard_manager_exports = {};
 __export(shard_manager_exports, {
   disposeShards: () => disposeShards,
   ensureShardSchema: () => ensureShardSchema,
+  getOpenShardCount: () => getOpenShardCount,
   getReadyShardClient: () => getReadyShardClient,
   getShardClient: () => getShardClient,
   getShardsDir: () => getShardsDir,
@@ -1925,14 +1983,17 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path5 from "path";
-import { existsSync as existsSync4, mkdirSync, readdirSync } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readdirSync } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
-  if (!existsSync4(SHARDS_DIR)) {
-    mkdirSync(SHARDS_DIR, { recursive: true });
+  if (!existsSync5(SHARDS_DIR)) {
+    mkdirSync2(SHARDS_DIR, { recursive: true });
   }
   _shardingEnabled = true;
+  if (_evictionTimer) clearInterval(_evictionTimer);
+  _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
+  _evictionTimer.unref();
 }
 function isShardingEnabled() {
   return _shardingEnabled;
@@ -1949,21 +2010,28 @@ function getShardClient(projectName) {
     throw new Error(`Invalid project name for shard: "${projectName}"`);
   }
   const cached = _shards.get(safeName);
-  if (cached) return cached;
+  if (cached) {
+    _shardLastAccess.set(safeName, Date.now());
+    return cached;
+  }
+  while (_shards.size >= MAX_OPEN_SHARDS) {
+    evictLRU();
+  }
   const dbPath = path5.join(SHARDS_DIR, `${safeName}.db`);
   const client = createClient2({
     url: `file:${dbPath}`,
     encryptionKey: _encryptionKey
   });
   _shards.set(safeName, client);
+  _shardLastAccess.set(safeName, Date.now());
   return client;
 }
 function shardExists(projectName) {
   const safeName = projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return existsSync4(path5.join(SHARDS_DIR, `${safeName}.db`));
+  return existsSync5(path5.join(SHARDS_DIR, `${safeName}.db`));
 }
 function listShards() {
-  if (!existsSync4(SHARDS_DIR)) return [];
+  if (!existsSync5(SHARDS_DIR)) return [];
   return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
 }
 async function ensureShardSchema(client) {
@@ -2015,6 +2083,8 @@ async function ensureShardSchema(client) {
   for (const col of [
     "ALTER TABLE memories ADD COLUMN task_id TEXT",
     "ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN author_device_id TEXT",
+    "ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'",
     "ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5",
     "ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'",
     "ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0",
@@ -2152,21 +2222,69 @@ async function getReadyShardClient(projectName) {
   await ensureShardSchema(client);
   return client;
 }
+function evictLRU() {
+  let oldest = null;
+  let oldestTime = Infinity;
+  for (const [name, time] of _shardLastAccess) {
+    if (time < oldestTime) {
+      oldestTime = time;
+      oldest = name;
+    }
+  }
+  if (oldest) {
+    const client = _shards.get(oldest);
+    if (client) {
+      client.close();
+    }
+    _shards.delete(oldest);
+    _shardLastAccess.delete(oldest);
+  }
+}
+function evictIdleShards() {
+  const now = Date.now();
+  const toEvict = [];
+  for (const [name, lastAccess] of _shardLastAccess) {
+    if (now - lastAccess > SHARD_IDLE_MS) {
+      toEvict.push(name);
+    }
+  }
+  for (const name of toEvict) {
+    const client = _shards.get(name);
+    if (client) {
+      client.close();
+    }
+    _shards.delete(name);
+    _shardLastAccess.delete(name);
+  }
+}
+function getOpenShardCount() {
+  return _shards.size;
+}
 function disposeShards() {
+  if (_evictionTimer) {
+    clearInterval(_evictionTimer);
+    _evictionTimer = null;
+  }
   for (const [, client] of _shards) {
     client.close();
   }
   _shards.clear();
+  _shardLastAccess.clear();
   _shardingEnabled = false;
   _encryptionKey = null;
 }
-var SHARDS_DIR, _shards, _encryptionKey, _shardingEnabled;
+var SHARDS_DIR, SHARD_IDLE_MS, MAX_OPEN_SHARDS, EVICTION_INTERVAL_MS, _shards, _shardLastAccess, _evictionTimer, _encryptionKey, _shardingEnabled;
 var init_shard_manager = __esm({
   "src/lib/shard-manager.ts"() {
     "use strict";
     init_config();
     SHARDS_DIR = path5.join(EXE_AI_DIR, "shards");
+    SHARD_IDLE_MS = 5 * 60 * 1e3;
+    MAX_OPEN_SHARDS = 10;
+    EVICTION_INTERVAL_MS = 60 * 1e3;
     _shards = /* @__PURE__ */ new Map();
+    _shardLastAccess = /* @__PURE__ */ new Map();
+    _evictionTimer = null;
     _encryptionKey = null;
     _shardingEnabled = false;
   }
@@ -2463,7 +2581,7 @@ __export(active_agent_exports, {
   resolveActiveAgentFromTmuxSession: () => resolveActiveAgentFromTmuxSession,
   writeActiveAgent: () => writeActiveAgent
 });
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4, unlinkSync as unlinkSync3, readdirSync as readdirSync3 } from "fs";
 import { execSync as execSync3 } from "child_process";
 import path7 from "path";
 function isNameWithOptionalInstance(candidate, baseName) {
@@ -2513,7 +2631,7 @@ function getMarkerPath() {
 }
 function writeActiveAgent(agentId, agentRole) {
   try {
-    mkdirSync3(CACHE_DIR, { recursive: true });
+    mkdirSync4(CACHE_DIR, { recursive: true });
     writeFileSync3(
       getMarkerPath(),
       JSON.stringify({ agentId, agentRole, startedAt: (/* @__PURE__ */ new Date()).toISOString() })
@@ -2632,9 +2750,9 @@ var init_active_agent = __esm({
 import os6 from "os";
 import path8 from "path";
 import {
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   lstatSync,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   readlinkSync as readlinkSync2,
   symlinkSync as symlinkSync2
 } from "fs";
@@ -2660,12 +2778,12 @@ var init_mcp_prefix = __esm({
 });
 
 // src/lib/preferences.ts
-import { existsSync as existsSync7, readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
 import path9 from "path";
 import os7 from "os";
 function loadPreferences(homeDir = os7.homedir()) {
   const configPath = path9.join(homeDir, ".exe-os", "config.json");
-  if (!existsSync7(configPath)) return {};
+  if (!existsSync8(configPath)) return {};
   try {
     const config = JSON.parse(readFileSync4(configPath, "utf-8"));
     return config.preferences ?? {};
@@ -2676,12 +2794,13 @@ function loadPreferences(homeDir = os7.homedir()) {
 var init_preferences = __esm({
   "src/lib/preferences.ts"() {
     "use strict";
+    init_secure_files();
   }
 });
 
 // src/adapters/claude/installer.ts
 import { readFile as readFile4, writeFile as writeFile4, mkdir as mkdir4, readdir } from "fs/promises";
-import { existsSync as existsSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync5, copyFileSync, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync5, writeFileSync as writeFileSync5, copyFileSync, mkdirSync as mkdirSync6 } from "fs";
 import path10 from "path";
 import os8 from "os";
 import { execSync as execSync4 } from "child_process";
@@ -2692,7 +2811,7 @@ function resolvePackageRoot() {
   const root = path10.parse(dir).root;
   while (dir !== root) {
     const pkgPath = path10.join(dir, "package.json");
-    if (existsSync8(pkgPath)) {
+    if (existsSync9(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
@@ -2735,7 +2854,7 @@ __export(installer_exports, {
   verifyCodexHooks: () => verifyCodexHooks
 });
 import { readFile as readFile5, writeFile as writeFile5, mkdir as mkdir5 } from "fs/promises";
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import path11 from "path";
 import os9 from "os";
 async function mergeCodexHooks(packageRoot, homeDir = os9.homedir()) {
@@ -2747,7 +2866,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os9.homedir()) {
   await mkdir5(codexDir, { recursive: true });
   await mkdir5(logsDir, { recursive: true });
   let hooksJson = {};
-  if (existsSync9(hooksPath)) {
+  if (existsSync10(hooksPath)) {
     try {
       hooksJson = JSON.parse(await readFile5(hooksPath, "utf-8"));
     } catch {
@@ -2858,7 +2977,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os9.homedir()) {
 }
 function verifyCodexHooks(homeDir = os9.homedir()) {
   const hooksPath = path11.join(homeDir, ".codex", "hooks.json");
-  if (!existsSync9(hooksPath)) return false;
+  if (!existsSync10(hooksPath)) return false;
   try {
     const hooksJson = JSON.parse(
       __require("fs").readFileSync(hooksPath, "utf-8")
@@ -2885,7 +3004,7 @@ async function installCodexStatusLine(homeDir = os9.homedir()) {
   const configPath = path11.join(codexDir, "config.toml");
   await mkdir5(codexDir, { recursive: true });
   let content = "";
-  if (existsSync9(configPath)) {
+  if (existsSync10(configPath)) {
     content = await readFile5(configPath, "utf-8");
     if (/\[tui\][\s\S]*?status_line\s*=/.test(content)) {
       return "already-configured";
@@ -2936,7 +3055,7 @@ var init_installer2 = __esm({
 import os10 from "os";
 import path12 from "path";
 import {
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   readFileSync as readFileSync6,
   writeFileSync as writeFileSync6,
   mkdirSync as mkdirSync7,
@@ -2950,7 +3069,7 @@ init_database();
 
 // src/lib/keychain.ts
 import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import path4 from "path";
 import os4 from "os";
 var SERVICE = "exe-mem";
@@ -2980,7 +3099,7 @@ async function getMasterKey() {
     }
   }
   const keyPath = getKeyPath();
-  if (!existsSync3(keyPath)) {
+  if (!existsSync4(keyPath)) {
     process.stderr.write(
       `[keychain] Key not found at ${keyPath} (HOME=${os4.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
 `
@@ -3296,8 +3415,8 @@ function vectorToBlob(vector) {
 import os5 from "os";
 import path6 from "path";
 import {
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync6,
+  mkdirSync as mkdirSync3,
   readdirSync as readdirSync2,
   statSync,
   unlinkSync as unlinkSync2,
@@ -3344,7 +3463,7 @@ var BEHAVIORS_EXPORT_DIR = path6.join(
 var STALE_EXPORT_AGE_MS = 60 * 60 * 1e3;
 var EXPORT_BEHAVIOR_LIMIT = 30;
 function sweepStaleBehaviorExports(now = Date.now()) {
-  if (!existsSync5(BEHAVIORS_EXPORT_DIR)) return;
+  if (!existsSync6(BEHAVIORS_EXPORT_DIR)) return;
   let entries;
   try {
     entries = readdirSync2(BEHAVIORS_EXPORT_DIR);
@@ -3394,7 +3513,7 @@ function exportFilePath(agentId, projectName, sessionKey) {
   );
 }
 async function exportBehaviorsForAgent(agentId, projectName, sessionKey) {
-  mkdirSync2(BEHAVIORS_EXPORT_DIR, { recursive: true });
+  mkdirSync3(BEHAVIORS_EXPORT_DIR, { recursive: true });
   sweepStaleBehaviorExports();
   const behaviors = await listBehaviors(agentId, projectName, EXPORT_BEHAVIOR_LIMIT);
   if (behaviors.length === 0) return null;
@@ -3445,7 +3564,7 @@ function resolveAgent(argv) {
 function loadIdentity(agent) {
   const dir = path12.join(os10.homedir(), ".exe-os", "identity");
   const exact = path12.join(dir, `${agent}.md`);
-  if (existsSync10(exact)) {
+  if (existsSync11(exact)) {
     const content = readFileSync6(exact, "utf-8").trim();
     if (content) return content;
   }
@@ -3473,7 +3592,7 @@ function writePromptFile(agent, identity, behaviorsPath) {
   const promptDir = path12.join(os10.homedir(), ".exe-os", "codex-prompt");
   mkdirSync7(promptDir, { recursive: true });
   let prompt = identity;
-  if (behaviorsPath && existsSync10(behaviorsPath)) {
+  if (behaviorsPath && existsSync11(behaviorsPath)) {
     const behaviors = readFileSync6(behaviorsPath, "utf-8").trim();
     if (behaviors) {
       prompt += "\n\n" + behaviors;
@@ -3600,7 +3719,7 @@ async function main() {
       const { execSync: es } = await import("child_process");
       const worktreeDir = path12.join(process.cwd(), ".worktrees", worktreeName);
       const branchName = `${worktreeName}/codex-${Date.now()}`;
-      if (existsSync10(worktreeDir)) {
+      if (existsSync11(worktreeDir)) {
         worktreePath = worktreeDir;
         process.stderr.write(`[exe-start-codex] Reusing worktree at ${worktreeDir}
 `);