@askexenow/exe-os 0.9.98 → 0.9.100

package/dist/bin/agentic-ontology-backfill.js

@@ -3516,6 +3516,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/agentic-reflection-backfill.js

@@ -3516,6 +3516,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/agentic-semantic-label.js

@@ -3516,6 +3516,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/backfill-conversations.js

@@ -3656,6 +3656,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/backfill-responses.js

@@ -3656,6 +3656,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/backfill-vectors.js

@@ -3652,6 +3652,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/bulk-sync-postgres.js

@@ -3824,6 +3824,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/cleanup-stale-review-tasks.js

@@ -4299,6 +4299,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/cli.js

@@ -2896,20 +2896,39 @@ async function getKeyStorageInfo() {
 }
 async function setMasterKey(key) {
   const b64 = key.toString("base64");
-  if (macKeychainSet(b64) || linuxSecretSet(b64)) {
-    return;
+  let keychainOk = false;
+  if (macKeychainSet(b64)) {
+    const readBack = macKeychainGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write(
+        "[keychain] macOS Keychain write appeared to succeed but read-back failed.\n  This can happen on macOS Tahoe with new permission patterns.\n"
+      );
+    }
+  } else if (linuxSecretSet(b64)) {
+    const readBack = linuxSecretGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write("[keychain] Linux secret-tool write appeared to succeed but read-back failed.\n");
+    }
   }
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      await keytar.setPassword(SERVICE, ACCOUNT, b64);
-      return;
-    } catch {
+  if (!keychainOk) {
+    const keytar = await tryKeytar();
+    if (keytar) {
+      try {
+        await keytar.setPassword(SERVICE, ACCOUNT, b64);
+        keychainOk = true;
+      } catch {
+      }
     }
   }
   const fallback = await writeMachineBoundFileFallback(b64);
-  if (fallback === "encrypted") {
-    process.stderr.write("[keychain] Key stored encrypted (machine-bound).\n");
+  if (keychainOk) {
+    process.stderr.write("[keychain] Key stored in OS keychain (file backup also written).\n");
+  } else if (fallback === "encrypted") {
+    process.stderr.write("[keychain] Key stored encrypted (machine-bound file fallback).\n");
   } else {
     process.stderr.write(
       "[keychain] WARNING: Key stored in plaintext file \u2014 no OS keychain available.\n"
@@ -8986,6 +9005,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-agent.js

@@ -1493,6 +1493,13 @@ var PLATFORM_PROCEDURES = [
     priority: "p0",
     content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
   },
+  // --- Encryption key + cloud sync ---
+  {
+    title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+    domain: "security",
+    priority: "p0",
+    content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+  },
   // --- MCP is the ONLY data interface ---
   {
     title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-assign.js

@@ -3666,6 +3666,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-boot.js

@@ -3403,6 +3403,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",
@@ -3935,20 +3942,39 @@ async function getKeyStorageInfo() {
 }
 async function setMasterKey(key) {
   const b64 = key.toString("base64");
-  if (macKeychainSet(b64) || linuxSecretSet(b64)) {
-    return;
+  let keychainOk = false;
+  if (macKeychainSet(b64)) {
+    const readBack = macKeychainGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write(
+        "[keychain] macOS Keychain write appeared to succeed but read-back failed.\n  This can happen on macOS Tahoe with new permission patterns.\n"
+      );
+    }
+  } else if (linuxSecretSet(b64)) {
+    const readBack = linuxSecretGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write("[keychain] Linux secret-tool write appeared to succeed but read-back failed.\n");
+    }
   }
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      await keytar.setPassword(SERVICE, ACCOUNT, b64);
-      return;
-    } catch {
+  if (!keychainOk) {
+    const keytar = await tryKeytar();
+    if (keytar) {
+      try {
+        await keytar.setPassword(SERVICE, ACCOUNT, b64);
+        keychainOk = true;
+      } catch {
+      }
     }
   }
   const fallback = await writeMachineBoundFileFallback(b64);
-  if (fallback === "encrypted") {
-    process.stderr.write("[keychain] Key stored encrypted (machine-bound).\n");
+  if (keychainOk) {
+    process.stderr.write("[keychain] Key stored in OS keychain (file backup also written).\n");
+  } else if (fallback === "encrypted") {
+    process.stderr.write("[keychain] Key stored encrypted (machine-bound file fallback).\n");
   } else {
     process.stderr.write(
       "[keychain] WARNING: Key stored in plaintext file \u2014 no OS keychain available.\n"

package/dist/bin/exe-call.js

@@ -431,6 +431,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-cloud.js

@@ -413,20 +413,39 @@ async function getKeyStorageInfo() {
 }
 async function setMasterKey(key) {
   const b64 = key.toString("base64");
-  if (macKeychainSet(b64) || linuxSecretSet(b64)) {
-    return;
+  let keychainOk = false;
+  if (macKeychainSet(b64)) {
+    const readBack = macKeychainGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write(
+        "[keychain] macOS Keychain write appeared to succeed but read-back failed.\n  This can happen on macOS Tahoe with new permission patterns.\n"
+      );
+    }
+  } else if (linuxSecretSet(b64)) {
+    const readBack = linuxSecretGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write("[keychain] Linux secret-tool write appeared to succeed but read-back failed.\n");
+    }
   }
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      await keytar.setPassword(SERVICE, ACCOUNT, b64);
-      return;
-    } catch {
+  if (!keychainOk) {
+    const keytar = await tryKeytar();
+    if (keytar) {
+      try {
+        await keytar.setPassword(SERVICE, ACCOUNT, b64);
+        keychainOk = true;
+      } catch {
+      }
     }
   }
   const fallback = await writeMachineBoundFileFallback(b64);
-  if (fallback === "encrypted") {
-    process.stderr.write("[keychain] Key stored encrypted (machine-bound).\n");
+  if (keychainOk) {
+    process.stderr.write("[keychain] Key stored in OS keychain (file backup also written).\n");
+  } else if (fallback === "encrypted") {
+    process.stderr.write("[keychain] Key stored encrypted (machine-bound file fallback).\n");
   } else {
     process.stderr.write(
       "[keychain] WARNING: Key stored in plaintext file \u2014 no OS keychain available.\n"
@@ -6795,6 +6814,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-dispatch.js

@@ -8106,6 +8106,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-doctor.js

@@ -1068,20 +1068,39 @@ async function getKeyStorageInfo() {
 }
 async function setMasterKey(key) {
   const b64 = key.toString("base64");
-  if (macKeychainSet(b64) || linuxSecretSet(b64)) {
-    return;
+  let keychainOk = false;
+  if (macKeychainSet(b64)) {
+    const readBack = macKeychainGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write(
+        "[keychain] macOS Keychain write appeared to succeed but read-back failed.\n  This can happen on macOS Tahoe with new permission patterns.\n"
+      );
+    }
+  } else if (linuxSecretSet(b64)) {
+    const readBack = linuxSecretGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write("[keychain] Linux secret-tool write appeared to succeed but read-back failed.\n");
+    }
   }
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      await keytar.setPassword(SERVICE, ACCOUNT, b64);
-      return;
-    } catch {
+  if (!keychainOk) {
+    const keytar = await tryKeytar();
+    if (keytar) {
+      try {
+        await keytar.setPassword(SERVICE, ACCOUNT, b64);
+        keychainOk = true;
+      } catch {
+      }
     }
   }
   const fallback = await writeMachineBoundFileFallback(b64);
-  if (fallback === "encrypted") {
-    process.stderr.write("[keychain] Key stored encrypted (machine-bound).\n");
+  if (keychainOk) {
+    process.stderr.write("[keychain] Key stored in OS keychain (file backup also written).\n");
+  } else if (fallback === "encrypted") {
+    process.stderr.write("[keychain] Key stored encrypted (machine-bound file fallback).\n");
   } else {
     process.stderr.write(
       "[keychain] WARNING: Key stored in plaintext file \u2014 no OS keychain available.\n"
@@ -4608,6 +4627,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-export-behaviors.js

@@ -4364,6 +4364,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-forget.js

@@ -4288,6 +4288,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-gateway.js

@@ -4972,6 +4972,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-heartbeat.js

@@ -4327,6 +4327,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-kill.js

@@ -4288,6 +4288,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-launch-agent.js

@@ -4386,6 +4386,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-new-employee.js

@@ -2808,6 +2808,13 @@ var PLATFORM_PROCEDURES = [
     priority: "p0",
     content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
   },
+  // --- Encryption key + cloud sync ---
+  {
+    title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+    domain: "security",
+    priority: "p0",
+    content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+  },
   // --- MCP is the ONLY data interface ---
   {
     title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-pending-messages.js

@@ -4767,6 +4767,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",

package/dist/bin/exe-pending-notifications.js

@@ -4833,6 +4833,13 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Tasks live in the DB. Intercom (tmux send-keys) is fire-and-forget \u2014 it may fail, get garbled, or arrive mid-work. Never rely on intercom for task delivery. The UserPromptSubmit hook checks the DB for new tasks on every prompt. Your operating procedures step 7 says check for next work. The daemon nudges idle agents as a speedup. If you have no tasks, you found them all."
       },
+      // --- Encryption key + cloud sync ---
+      {
+        title: "Encryption key lives in Keychain, not on disk \u2014 never expose the recovery phrase",
+        domain: "security",
+        priority: "p0",
+        content: "The master encryption key is stored in macOS Keychain (Secure Enclave) or Linux secret-tool \u2014 NOT as a file. There is no ~/.exe-os/master.key on modern installs. If an older install had one, it was auto-migrated to Keychain and the file deleted. Device linking uses a 24-word BIP39 recovery phrase: Device 1 runs `exe-os cloud link --show-full` in their local Terminal to reveal it, Device 2 runs `exe-os cloud` and pastes the phrase to import the key into its own Keychain, then cloud sync pulls encrypted memories. NEVER display, log, or return the recovery phrase in agent output. MCP tools are hardened \u2014 they cannot reveal it. If the user needs the phrase, tell them: 'Run exe-os cloud link --show-full in your Terminal.' If searching for master.key returns nothing, that is CORRECT \u2014 the key is in Keychain."
+      },
       // --- MCP is the ONLY data interface ---
       {
         title: "MCP disconnect \u2014 ask the user, never work around it",