engrm 0.4.45 → 0.4.47

package/dist/cli.js

@@ -29,17 +29,26 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir, hostname, networkInterfaces } from "node:os";
 import { join } from "node:path";
 import { createHash } from "node:crypto";
-var CONFIG_DIR = join(homedir(), ".engrm");
-var SETTINGS_PATH = join(CONFIG_DIR, "settings.json");
-var DB_PATH = join(CONFIG_DIR, "engrm.db");
+function resolveConfigDir() {
+  return process.env["ENGRM_CONFIG_DIR"]?.trim() || join(homedir(), ".engrm");
+}
+function resolveSettingsPath() {
+  return join(resolveConfigDir(), "settings.json");
+}
+function resolveDbPath() {
+  return join(resolveConfigDir(), "engrm.db");
+}
+function resolveAuthBackupPath() {
+  return join(resolveConfigDir(), "auth-backup.json");
+}
 function getConfigDir() {
-  return CONFIG_DIR;
+  return resolveConfigDir();
 }
 function getSettingsPath() {
-  return SETTINGS_PATH;
+  return resolveSettingsPath();
 }
 function getDbPath() {
-  return DB_PATH;
+  return resolveDbPath();
 }
 function generateDeviceId() {
   const host = hostname().toLowerCase().replace(/[^a-z0-9-]/g, "");
@@ -62,7 +71,7 @@ function generateDeviceId() {
   return `${host}-${suffix}`;
 }
 function createDefaultConfig() {
-  return {
+  const merged = {
     candengo_url: "",
     candengo_api_key: "",
     site_id: "",
@@ -117,24 +126,26 @@ function createDefaultConfig() {
     },
     tool_profile: "full"
   };
+  return merged;
 }
 function loadConfig() {
-  if (!existsSync(SETTINGS_PATH)) {
-    throw new Error(`Config not found at ${SETTINGS_PATH}. Run 'engrm init --manual' to configure.`);
+  const settingsPath = resolveSettingsPath();
+  if (!existsSync(settingsPath)) {
+    throw new Error(`Config not found at ${settingsPath}. Run 'engrm init --manual' to configure.`);
   }
-  const raw = readFileSync(SETTINGS_PATH, "utf-8");
+  const raw = readFileSync(settingsPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error(`Invalid JSON in ${SETTINGS_PATH}`);
+    throw new Error(`Invalid JSON in ${settingsPath}`);
   }
   if (typeof parsed !== "object" || parsed === null) {
-    throw new Error(`Config at ${SETTINGS_PATH} is not a JSON object`);
+    throw new Error(`Config at ${settingsPath} is not a JSON object`);
   }
   const config = parsed;
   const defaults = createDefaultConfig();
-  return {
+  const merged = {
     candengo_url: asString(config["candengo_url"], defaults.candengo_url),
     candengo_api_key: asString(config["candengo_api_key"], defaults.candengo_api_key),
     site_id: asString(config["site_id"], defaults.site_id),
@@ -189,16 +200,27 @@ function loadConfig() {
     },
     tool_profile: asToolProfile(config["tool_profile"], defaults.tool_profile)
   };
+  if (looksLikePlaceholderAuth(merged)) {
+    return restoreAuthBackup(merged) ?? merged;
+  }
+  return merged;
 }
 function saveConfig(config) {
-  if (!existsSync(CONFIG_DIR)) {
-    mkdirSync(CONFIG_DIR, { recursive: true });
+  const configDir = resolveConfigDir();
+  const settingsPath = resolveSettingsPath();
+  const authBackupPath = resolveAuthBackupPath();
+  if (!existsSync(configDir)) {
+    mkdirSync(configDir, { recursive: true });
   }
-  writeFileSync(SETTINGS_PATH, JSON.stringify(config, null, 2) + `
+  writeFileSync(settingsPath, JSON.stringify(config, null, 2) + `
+`, "utf-8");
+  if (!looksLikePlaceholderAuth(config)) {
+    writeFileSync(authBackupPath, JSON.stringify(extractAuthBackup(config), null, 2) + `
 `, "utf-8");
+  }
 }
 function configExists() {
-  return existsSync(SETTINGS_PATH);
+  return existsSync(resolveSettingsPath());
 }
 function asString(value, fallback) {
   return typeof value === "string" ? value : fallback;
@@ -252,6 +274,50 @@ function asTeams(value, fallback) {
     return fallback;
   return value.filter((t) => typeof t === "object" && t !== null && typeof t.id === "string" && typeof t.name === "string" && typeof t.namespace === "string");
 }
+function looksLikePlaceholderAuth(config) {
+  const apiKey = config.candengo_api_key.trim();
+  const siteId = config.site_id.trim();
+  const namespace = config.namespace.trim();
+  const email = config.user_email.trim().toLowerCase();
+  if (apiKey === "cvk_org" && siteId === "site-1" && namespace === "org-ns")
+    return true;
+  if (siteId === "site-1" && namespace === "org-ns" && email.endsWith("@example.com"))
+    return true;
+  return false;
+}
+function extractAuthBackup(config) {
+  return {
+    candengo_url: config.candengo_url,
+    candengo_api_key: config.candengo_api_key,
+    site_id: config.site_id,
+    namespace: config.namespace,
+    user_id: config.user_id,
+    user_email: config.user_email,
+    teams: config.teams
+  };
+}
+function restoreAuthBackup(config) {
+  const authBackupPath = resolveAuthBackupPath();
+  if (!existsSync(authBackupPath))
+    return null;
+  try {
+    const raw = readFileSync(authBackupPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    const restored = {
+      ...config,
+      candengo_url: asString(parsed["candengo_url"], config.candengo_url),
+      candengo_api_key: asString(parsed["candengo_api_key"], config.candengo_api_key),
+      site_id: asString(parsed["site_id"], config.site_id),
+      namespace: asString(parsed["namespace"], config.namespace),
+      user_id: asString(parsed["user_id"], config.user_id),
+      user_email: asString(parsed["user_email"], config.user_email),
+      teams: asTeams(parsed["teams"], config.teams)
+    };
+    return looksLikePlaceholderAuth(restored) ? null : restored;
+  } catch {
+    return null;
+  }
+}
 
 // src/storage/migrations.ts
 var MIGRATIONS = [
@@ -939,6 +1005,20 @@ function ensureChatMessageColumns(db) {
     db.exec("PRAGMA user_version = 17");
   }
 }
+function ensureObservationVectorTable(db) {
+  if (!isVecExtensionLoaded(db))
+    return;
+  db.exec(`
+    CREATE VIRTUAL TABLE IF NOT EXISTS vec_observations USING vec0(
+      observation_id INTEGER PRIMARY KEY,
+      embedding FLOAT[384]
+    );
+  `);
+  const current = getSchemaVersion(db);
+  if (current < 4) {
+    db.exec("PRAGMA user_version = 4");
+  }
+}
 function ensureChatVectorTable(db) {
   if (!isVecExtensionLoaded(db))
     return;
@@ -1167,6 +1247,7 @@ class MemDatabase {
     ensureObservationTypes(this.db);
     ensureSessionSummaryColumns(this.db);
     ensureChatMessageColumns(this.db);
+    ensureObservationVectorTable(this.db);
     ensureChatVectorTable(this.db);
     ensureSyncOutboxSupportsChatMessages(this.db);
   }
@@ -3976,11 +4057,20 @@ import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as rea
 import { homedir as homedir3, hostname as hostname2, networkInterfaces as networkInterfaces2 } from "node:os";
 import { join as join6 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
-var CONFIG_DIR2 = join6(homedir3(), ".engrm");
-var SETTINGS_PATH2 = join6(CONFIG_DIR2, "settings.json");
-var DB_PATH2 = join6(CONFIG_DIR2, "engrm.db");
+function resolveConfigDir2() {
+  return process.env["ENGRM_CONFIG_DIR"]?.trim() || join6(homedir3(), ".engrm");
+}
+function resolveSettingsPath2() {
+  return join6(resolveConfigDir2(), "settings.json");
+}
+function resolveDbPath2() {
+  return join6(resolveConfigDir2(), "engrm.db");
+}
+function resolveAuthBackupPath2() {
+  return join6(resolveConfigDir2(), "auth-backup.json");
+}
 function getDbPath2() {
-  return DB_PATH2;
+  return resolveDbPath2();
 }
 function generateDeviceId2() {
   const host = hostname2().toLowerCase().replace(/[^a-z0-9-]/g, "");
@@ -4003,7 +4093,7 @@ function generateDeviceId2() {
   return `${host}-${suffix}`;
 }
 function createDefaultConfig2() {
-  return {
+  const merged = {
     candengo_url: "",
     candengo_api_key: "",
     site_id: "",
@@ -4058,24 +4148,26 @@ function createDefaultConfig2() {
     },
     tool_profile: "full"
   };
+  return merged;
 }
 function loadConfig2() {
-  if (!existsSync6(SETTINGS_PATH2)) {
-    throw new Error(`Config not found at ${SETTINGS_PATH2}. Run 'engrm init --manual' to configure.`);
+  const settingsPath = resolveSettingsPath2();
+  if (!existsSync6(settingsPath)) {
+    throw new Error(`Config not found at ${settingsPath}. Run 'engrm init --manual' to configure.`);
   }
-  const raw = readFileSync6(SETTINGS_PATH2, "utf-8");
+  const raw = readFileSync6(settingsPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error(`Invalid JSON in ${SETTINGS_PATH2}`);
+    throw new Error(`Invalid JSON in ${settingsPath}`);
   }
   if (typeof parsed !== "object" || parsed === null) {
-    throw new Error(`Config at ${SETTINGS_PATH2} is not a JSON object`);
+    throw new Error(`Config at ${settingsPath} is not a JSON object`);
   }
   const config = parsed;
   const defaults = createDefaultConfig2();
-  return {
+  const merged = {
     candengo_url: asString2(config["candengo_url"], defaults.candengo_url),
     candengo_api_key: asString2(config["candengo_api_key"], defaults.candengo_api_key),
     site_id: asString2(config["site_id"], defaults.site_id),
@@ -4130,16 +4222,27 @@ function loadConfig2() {
     },
     tool_profile: asToolProfile2(config["tool_profile"], defaults.tool_profile)
   };
+  if (looksLikePlaceholderAuth2(merged)) {
+    return restoreAuthBackup2(merged) ?? merged;
+  }
+  return merged;
 }
 function saveConfig2(config) {
-  if (!existsSync6(CONFIG_DIR2)) {
-    mkdirSync3(CONFIG_DIR2, { recursive: true });
+  const configDir = resolveConfigDir2();
+  const settingsPath = resolveSettingsPath2();
+  const authBackupPath = resolveAuthBackupPath2();
+  if (!existsSync6(configDir)) {
+    mkdirSync3(configDir, { recursive: true });
   }
-  writeFileSync3(SETTINGS_PATH2, JSON.stringify(config, null, 2) + `
+  writeFileSync3(settingsPath, JSON.stringify(config, null, 2) + `
 `, "utf-8");
+  if (!looksLikePlaceholderAuth2(config)) {
+    writeFileSync3(authBackupPath, JSON.stringify(extractAuthBackup2(config), null, 2) + `
+`, "utf-8");
+  }
 }
 function configExists2() {
-  return existsSync6(SETTINGS_PATH2);
+  return existsSync6(resolveSettingsPath2());
 }
 function asString2(value, fallback) {
   return typeof value === "string" ? value : fallback;
@@ -4193,6 +4296,50 @@ function asTeams2(value, fallback) {
     return fallback;
   return value.filter((t) => typeof t === "object" && t !== null && typeof t.id === "string" && typeof t.name === "string" && typeof t.namespace === "string");
 }
+function looksLikePlaceholderAuth2(config) {
+  const apiKey = config.candengo_api_key.trim();
+  const siteId = config.site_id.trim();
+  const namespace = config.namespace.trim();
+  const email = config.user_email.trim().toLowerCase();
+  if (apiKey === "cvk_org" && siteId === "site-1" && namespace === "org-ns")
+    return true;
+  if (siteId === "site-1" && namespace === "org-ns" && email.endsWith("@example.com"))
+    return true;
+  return false;
+}
+function extractAuthBackup2(config) {
+  return {
+    candengo_url: config.candengo_url,
+    candengo_api_key: config.candengo_api_key,
+    site_id: config.site_id,
+    namespace: config.namespace,
+    user_id: config.user_id,
+    user_email: config.user_email,
+    teams: config.teams
+  };
+}
+function restoreAuthBackup2(config) {
+  const authBackupPath = resolveAuthBackupPath2();
+  if (!existsSync6(authBackupPath))
+    return null;
+  try {
+    const raw = readFileSync6(authBackupPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    const restored = {
+      ...config,
+      candengo_url: asString2(parsed["candengo_url"], config.candengo_url),
+      candengo_api_key: asString2(parsed["candengo_api_key"], config.candengo_api_key),
+      site_id: asString2(parsed["site_id"], config.site_id),
+      namespace: asString2(parsed["namespace"], config.namespace),
+      user_id: asString2(parsed["user_id"], config.user_id),
+      user_email: asString2(parsed["user_email"], config.user_email),
+      teams: asTeams2(parsed["teams"], config.teams)
+    };
+    return looksLikePlaceholderAuth2(restored) ? null : restored;
+  } catch {
+    return null;
+  }
+}
 
 // src/tool-profiles.ts
 var MEMORY_PROFILE_TOOLS = [
@@ -4291,13 +4438,8 @@ function getCaptureStatus(db, input = {}) {
        FROM sessions s
        WHERE COALESCE(s.completed_at_epoch, s.started_at_epoch, 0) >= ?
          ${input.user_id ? "AND s.user_id = ?" : ""}
-         AND (
-           (s.tool_calls_count > 0 AND NOT EXISTS (SELECT 1 FROM tool_events te WHERE te.session_id = s.session_id))
-           OR (
-             EXISTS (SELECT 1 FROM user_prompts up WHERE up.session_id = s.session_id)
-             AND NOT EXISTS (SELECT 1 FROM tool_events te WHERE te.session_id = s.session_id)
-           )
-         )`).get(...params)?.count ?? 0;
+         AND s.tool_calls_count > 0
+         AND NOT EXISTS (SELECT 1 FROM tool_events te WHERE te.session_id = s.session_id)`).get(...params)?.count ?? 0;
   const latestPromptEpoch = db.db.query(`SELECT created_at_epoch FROM user_prompts
        WHERE 1 = 1${input.user_id ? " AND user_id = ?" : ""}
        ORDER BY created_at_epoch DESC, prompt_number DESC
@@ -4478,6 +4620,10 @@ function resetStaleSyncingEntries(db, maxAgeSeconds = 300) {
 
 // src/sync/auth.ts
 var LEGACY_PUBLIC_HOSTS = new Set(["www.candengo.com", "candengo.com"]);
+var PLACEHOLDER_API_KEYS = new Set(["cvk_org"]);
+var PLACEHOLDER_SITE_IDS = new Set(["site-1"]);
+var PLACEHOLDER_NAMESPACES = new Set(["org-ns", "fleet-ns"]);
+var PLACEHOLDER_EMAIL_SUFFIXES = ["@example.com"];
 function normalizeBaseUrl(url) {
   const trimmed = url.trim();
   if (!trimmed)
@@ -4496,7 +4642,7 @@ function getApiKey(config) {
   const envKey = process.env.ENGRM_TOKEN;
   if (envKey && envKey.startsWith("cvk_"))
     return envKey;
-  if (config.candengo_api_key && config.candengo_api_key.length > 0) {
+  if (config.candengo_api_key && config.candengo_api_key.length > 0 && !looksLikePlaceholderConfig(config)) {
     return config.candengo_api_key;
   }
   return null;
@@ -4517,18 +4663,37 @@ ${apiKey}
 ${config.namespace}
 ${config.site_id}`).digest("hex");
 }
-function recoverOutboxAfterSuccessfulAuth(db, config) {
+function looksLikePlaceholderConfig(config) {
+  const apiKey = config.candengo_api_key?.trim() ?? "";
+  const siteId = config.site_id?.trim() ?? "";
+  const namespace = config.namespace?.trim() ?? "";
+  const email = config.user_email?.trim().toLowerCase() ?? "";
+  if (PLACEHOLDER_API_KEYS.has(apiKey) && PLACEHOLDER_SITE_IDS.has(siteId) && PLACEHOLDER_NAMESPACES.has(namespace)) {
+    return true;
+  }
+  if (PLACEHOLDER_SITE_IDS.has(siteId) && PLACEHOLDER_NAMESPACES.has(namespace) && PLACEHOLDER_EMAIL_SUFFIXES.some((suffix) => email.endsWith(suffix))) {
+    return true;
+  }
+  return false;
+}
+function clearSyncPushBlock(db) {
+  db.setSyncState("sync_push_blocked_until", "0");
+  db.setSyncState("sync_push_block_reason", "");
+}
+function resumeOutboxAfterValidatedAuth(db, config) {
   const fingerprint = getAuthFingerprint(config);
-  const staleSyncingReset = resetStaleSyncingEntries(db);
-  const authFailedReset = resetFailedEntriesMatching(db, (error) => classifyOutboxFailure2(error) === "auth");
+  const failedReset = resetFailedEntries(db);
+  const syncingReset = resetSyncingEntries(db);
+  const staleSyncingReset = 0;
   if (fingerprint) {
     db.setSyncState("sync_auth_fingerprint", fingerprint);
   }
+  clearSyncPushBlock(db);
   return {
     fingerprintChanged: false,
-    failedReset: 0,
-    authFailedReset,
-    syncingReset: 0,
+    failedReset,
+    authFailedReset: 0,
+    syncingReset,
     staleSyncingReset
   };
 }
@@ -4552,6 +4717,9 @@ switch (command) {
   case "update":
     handleUpdate();
     break;
+  case "sync":
+    await handleSync(args.slice(1));
+    break;
   case "install-pack":
     await handleInstallPack(args.slice(1));
     break;
@@ -4710,31 +4878,7 @@ Authorization failed: ${error instanceof Error ? error.message : String(error)}`
 }
 function writeConfigFromProvision(baseUrl, result) {
   ensureConfigDir();
-  let existingDeviceId;
-  let existingSentinel;
-  let existingObserver;
-  let existingTranscriptAnalysis;
-  let existingHttp;
-  let existingFleet;
-  let existingToolProfile;
-  let existingSync;
-  let existingSearch;
-  let existingScrubbing;
-  if (configExists()) {
-    try {
-      const existing = loadConfig();
-      existingDeviceId = existing.device_id;
-      existingSentinel = existing.sentinel;
-      existingObserver = existing.observer;
-      existingTranscriptAnalysis = existing.transcript_analysis;
-      existingHttp = existing.http;
-      existingFleet = existing.fleet;
-      existingToolProfile = existing.tool_profile;
-      existingSync = existing.sync;
-      existingSearch = existing.search;
-      existingScrubbing = existing.scrubbing;
-    } catch {}
-  }
+  const preserved = loadPreservedLocalConfig();
   const config = {
     candengo_url: baseUrl,
     candengo_api_key: result.api_key,
@@ -4742,24 +4886,24 @@ function writeConfigFromProvision(baseUrl, result) {
     namespace: result.namespace,
     user_id: result.user_id,
     user_email: result.user_email,
-    device_id: existingDeviceId || generateDeviceId3(),
+    device_id: preserved.device_id || generateDeviceId3(),
     teams: result.teams ?? [],
-    sync: existingSync ?? {
+    sync: preserved.sync ?? {
       enabled: true,
       interval_seconds: 30,
       batch_size: 50
     },
-    search: existingSearch ?? {
+    search: preserved.search ?? {
       default_limit: 10,
       local_boost: 1.2,
       scope: "all"
     },
-    scrubbing: existingScrubbing ?? {
+    scrubbing: preserved.scrubbing ?? {
       enabled: true,
       custom_patterns: [],
       default_sensitivity: "shared"
     },
-    sentinel: existingSentinel ?? {
+    sentinel: preserved.sentinel ?? {
       enabled: false,
       mode: "advisory",
       provider: "openai",
@@ -4770,33 +4914,54 @@ function writeConfigFromProvision(baseUrl, result) {
       daily_limit: 100,
       tier: "free"
     },
-    observer: existingObserver ?? {
+    observer: preserved.observer ?? {
       enabled: true,
       mode: "per_event",
       model: "haiku"
     },
-    transcript_analysis: existingTranscriptAnalysis ?? {
+    transcript_analysis: preserved.transcript_analysis ?? {
       enabled: false
     },
-    http: existingHttp ?? {
+    http: preserved.http ?? {
       enabled: false,
       port: 3767,
       bearer_tokens: []
     },
-    fleet: existingFleet ?? {
+    fleet: preserved.fleet ?? {
       project_name: "shared-experience",
       namespace: "",
       api_key: ""
     },
-    tool_profile: existingToolProfile ?? "full"
+    tool_profile: preserved.tool_profile ?? "full"
   };
   saveConfig(config);
   const db = new MemDatabase(getDbPath());
-  recoverOutboxAfterSuccessfulAuth(db, config);
+  resumeOutboxAfterValidatedAuth(db, config);
   db.close();
   console.log(`Configuration saved to ${getSettingsPath()}`);
   console.log(`Database initialised at ${getDbPath()}`);
 }
+function loadPreservedLocalConfig() {
+  if (!configExists())
+    return {};
+  try {
+    const existing = loadConfig();
+    return {
+      device_id: existing.device_id,
+      sync: existing.sync,
+      search: existing.search,
+      scrubbing: existing.scrubbing,
+      sentinel: existing.sentinel,
+      observer: existing.observer,
+      transcript_analysis: existing.transcript_analysis,
+      http: existing.http,
+      fleet: existing.fleet,
+      tool_profile: existing.tool_profile
+    };
+  } catch {
+    return {};
+  }
+}
 function initFromFile(configPath) {
   if (!existsSync8(configPath)) {
     console.error(`Config file not found: ${configPath}`);
@@ -4829,6 +4994,7 @@ function initFromFile(configPath) {
     }
   }
   ensureConfigDir();
+  const preserved = loadPreservedLocalConfig();
   const config = {
     candengo_url: input["candengo_url"].trim(),
     candengo_api_key: input["candengo_api_key"].trim(),
@@ -4836,24 +5002,24 @@ function initFromFile(configPath) {
     namespace: input["namespace"].trim(),
     user_id: input["user_id"].trim(),
     user_email: typeof input["user_email"] === "string" ? input["user_email"].trim() : "",
-    device_id: typeof input["device_id"] === "string" ? input["device_id"] : generateDeviceId3(),
+    device_id: typeof input["device_id"] === "string" ? input["device_id"] : preserved.device_id ?? generateDeviceId3(),
     teams: [],
-    sync: {
+    sync: preserved.sync ?? {
       enabled: true,
       interval_seconds: 30,
       batch_size: 50
     },
-    search: {
+    search: preserved.search ?? {
       default_limit: 10,
       local_boost: 1.2,
       scope: "all"
     },
-    scrubbing: {
+    scrubbing: preserved.scrubbing ?? {
       enabled: true,
       custom_patterns: [],
       default_sensitivity: "shared"
     },
-    sentinel: {
+    sentinel: preserved.sentinel ?? {
       enabled: false,
       mode: "advisory",
       provider: "openai",
@@ -4864,14 +5030,25 @@ function initFromFile(configPath) {
       daily_limit: 100,
       tier: "free"
     },
-    observer: {
+    observer: preserved.observer ?? {
       enabled: true,
       mode: "per_event",
       model: "haiku"
     },
-    transcript_analysis: {
+    transcript_analysis: preserved.transcript_analysis ?? {
       enabled: false
-    }
+    },
+    http: preserved.http ?? {
+      enabled: false,
+      port: 3767,
+      bearer_tokens: []
+    },
+    fleet: preserved.fleet ?? {
+      project_name: "shared-experience",
+      namespace: "",
+      api_key: ""
+    },
+    tool_profile: preserved.tool_profile ?? "full"
   };
   saveConfig(config);
   const db = new MemDatabase(getDbPath());
@@ -4902,6 +5079,7 @@ async function initManual() {
     process.exit(1);
   }
   ensureConfigDir();
+  const preserved = loadPreservedLocalConfig();
   const config = {
     candengo_url: candengoUrl.trim(),
     candengo_api_key: apiKey.trim(),
@@ -4909,24 +5087,24 @@ async function initManual() {
     namespace: namespace.trim(),
     user_id: userId.trim(),
     user_email: userEmail.trim(),
-    device_id: generateDeviceId3(),
+    device_id: preserved.device_id ?? generateDeviceId3(),
     teams: [],
-    sync: {
+    sync: preserved.sync ?? {
       enabled: true,
       interval_seconds: 30,
       batch_size: 50
     },
-    search: {
+    search: preserved.search ?? {
       default_limit: 10,
       local_boost: 1.2,
       scope: "all"
     },
-    scrubbing: {
+    scrubbing: preserved.scrubbing ?? {
       enabled: true,
       custom_patterns: [],
       default_sensitivity: "shared"
     },
-    sentinel: {
+    sentinel: preserved.sentinel ?? {
       enabled: false,
       mode: "advisory",
       provider: "openai",
@@ -4937,14 +5115,25 @@ async function initManual() {
       daily_limit: 100,
       tier: "free"
     },
-    observer: {
+    observer: preserved.observer ?? {
       enabled: true,
       mode: "per_event",
       model: "haiku"
     },
-    transcript_analysis: {
+    transcript_analysis: preserved.transcript_analysis ?? {
       enabled: false
-    }
+    },
+    http: preserved.http ?? {
+      enabled: false,
+      port: 3767,
+      bearer_tokens: []
+    },
+    fleet: preserved.fleet ?? {
+      project_name: "shared-experience",
+      namespace: "",
+      api_key: ""
+    },
+    tool_profile: preserved.tool_profile ?? "full"
   };
   saveConfig(config);
   const db = new MemDatabase(getDbPath());
@@ -5129,6 +5318,15 @@ function handleStatus() {
       console.log(`
   Sync`);
       console.log(`    Outbox:        ${outbox["pending"] ?? 0} pending, ${outbox["failed"] ?? 0} failed, ${outbox["synced"] ?? 0} synced`);
+      const syncBlock = getSyncBlockState(db);
+      if (syncBlock.active) {
+        console.log(`    Push block:    ${formatSyncBlock(syncBlock)}`);
+        if (syncBlock.reason === "auth") {
+          console.log("    Next step:     Re-run `engrm init`, then `engrm sync resume`");
+        } else if (syncBlock.reason === "rate_limit") {
+          console.log("    Next step:     Wait for the block to expire or retry later");
+        }
+      }
       const topFailures = getOutboxFailureSummaries(db, 2);
       if (topFailures.length > 0) {
         const failureSummary = topFailures.map((row) => `${classifyOutboxFailure(row.error)} ${row.count}`).join(", ");
@@ -5183,6 +5381,18 @@ function formatTimeAgo(epoch) {
     return `${Math.floor(ago / 3600)}h ago`;
   return `${Math.floor(ago / 86400)}d ago`;
 }
+function formatTimeUntil(epoch) {
+  const remaining = epoch - Math.floor(Date.now() / 1000);
+  if (remaining <= 0)
+    return "now";
+  if (remaining < 60)
+    return `in ${remaining}s`;
+  if (remaining < 3600)
+    return `in ${Math.floor(remaining / 60)}m`;
+  if (remaining < 86400)
+    return `in ${Math.floor(remaining / 3600)}h`;
+  return `in ${Math.floor(remaining / 86400)}d`;
+}
 function formatSyncTime(epochStr) {
   if (!epochStr)
     return "never";
@@ -5191,6 +5401,25 @@ function formatSyncTime(epochStr) {
     return "never";
   return formatTimeAgo(epoch);
 }
+function getSyncBlockState(db) {
+  const untilRaw = db.getSyncState("sync_push_blocked_until");
+  const reason = db.getSyncState("sync_push_block_reason");
+  const untilEpoch = untilRaw ? parseInt(untilRaw, 10) : NaN;
+  if (!Number.isFinite(untilEpoch) || untilEpoch <= Math.floor(Date.now() / 1000)) {
+    return { active: false, untilEpoch: null, reason: null };
+  }
+  return {
+    active: true,
+    untilEpoch,
+    reason: reason && reason.length > 0 ? reason : null
+  };
+}
+function formatSyncBlock(block) {
+  const reasonLabel = block.reason === "auth" ? "waiting for re-auth" : block.reason === "rate_limit" ? "rate limited" : block.reason ?? "paused";
+  if (!block.untilEpoch)
+    return reasonLabel;
+  return `${reasonLabel} until ${new Date(block.untilEpoch * 1000).toISOString()} (${formatTimeUntil(block.untilEpoch)})`;
+}
 function ensureConfigDir() {
   const dir = getConfigDir();
   if (!existsSync8(dir)) {
@@ -5322,6 +5551,56 @@ Restart Claude Code or Codex to use the new version.`);
     console.error("Try manually: npm install -g engrm@<version>");
   }
 }
+async function handleSync(flags) {
+  const subcommand = flags[0];
+  if (subcommand === "resume") {
+    if (!configExists()) {
+      console.error("Engrm is not configured. Run: engrm init");
+      process.exit(1);
+    }
+    const config = loadConfig();
+    if (!config.candengo_url || !config.candengo_api_key) {
+      console.error("Authentication is not configured. Run: engrm init");
+      process.exit(1);
+    }
+    try {
+      const baseUrl = normalizeBaseUrl(config.candengo_url);
+      const controller = new AbortController;
+      const timeout = setTimeout(() => controller.abort(), 5000);
+      const res = await fetch(`${baseUrl}/v1/mem/user-settings`, {
+        headers: { Authorization: `Bearer ${config.candengo_api_key}` },
+        signal: controller.signal
+      });
+      clearTimeout(timeout);
+      if (!res.ok) {
+        if (res.status === 401 || res.status === 403) {
+          console.error("Sync resume blocked: authentication is still invalid. Re-run `engrm init` first.");
+        } else {
+          console.error(`Sync resume blocked: authentication check returned HTTP ${res.status}.`);
+        }
+        process.exit(1);
+      }
+      const db = new MemDatabase(getDbPath());
+      try {
+        const recovery = resumeOutboxAfterValidatedAuth(db, config);
+        const pending = getOutboxStats(db)["pending"] ?? 0;
+        console.log("Sync queue resumed.");
+        console.log(`  Failed reset: ${recovery.failedReset}`);
+        console.log(`  Syncing reset: ${recovery.syncingReset}`);
+        console.log(`  Pending now: ${pending}`);
+      } finally {
+        db.close();
+      }
+      return;
+    } catch (error) {
+      console.error(`Sync resume failed: ${error instanceof Error ? error.message : String(error)}`);
+      process.exit(1);
+    }
+  }
+  console.log(`Sync commands:
+`);
+  console.log("  engrm sync resume    Validate auth and unblock the paused sync queue");
+}
 async function handleDoctor() {
   const results = [];
   const pass = (msg) => results.push({ symbol: "\u2713", message: msg, kind: "pass" });
@@ -5547,26 +5826,30 @@ async function handleDoctor() {
     fail("Server URL not configured");
   }
   if (config.candengo_url && config.candengo_api_key) {
-    try {
-      const baseUrl = normalizeBaseUrl(config.candengo_url);
-      const controller = new AbortController;
-      const timeout = setTimeout(() => controller.abort(), 5000);
-      const res = await fetch(`${baseUrl}/v1/mem/user-settings`, {
-        headers: { Authorization: `Bearer ${config.candengo_api_key}` },
-        signal: controller.signal
-      });
-      clearTimeout(timeout);
-      if (res.ok) {
-        const email = config.user_email ?? "configured";
-        pass(`Authentication valid (${email})`);
-      } else if (res.status === 401 || res.status === 403) {
-        fail("Authentication failed \u2014 API key may be expired");
-      } else {
-        fail(`Authentication check returned HTTP ${res.status}`);
+    if (looksLikePlaceholderConfig(config)) {
+      fail("Authentication is using placeholder credentials \u2014 re-run 'engrm init' to restore real account settings");
+    } else {
+      try {
+        const baseUrl = normalizeBaseUrl(config.candengo_url);
+        const controller = new AbortController;
+        const timeout = setTimeout(() => controller.abort(), 5000);
+        const res = await fetch(`${baseUrl}/v1/mem/user-settings`, {
+          headers: { Authorization: `Bearer ${config.candengo_api_key}` },
+          signal: controller.signal
+        });
+        clearTimeout(timeout);
+        if (res.ok) {
+          const email = config.user_email ?? "configured";
+          pass(`Authentication valid (${email})`);
+        } else if (res.status === 401 || res.status === 403) {
+          fail("Authentication failed \u2014 API key may be expired");
+        } else {
+          fail(`Authentication check returned HTTP ${res.status}`);
+        }
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        fail(`Authentication check failed: ${msg.includes("abort") ? "timeout (5s)" : msg}`);
       }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      fail(`Authentication check failed: ${msg.includes("abort") ? "timeout (5s)" : msg}`);
     }
   } else {
     fail("Authentication not configured (missing URL or API key)");
@@ -5574,7 +5857,16 @@ async function handleDoctor() {
   try {
     const outbox = getOutboxStats(db);
     const failedCount = outbox["failed"] ?? 0;
-    if (failedCount > 10) {
+    const syncBlock = getSyncBlockState(db);
+    if (syncBlock.active) {
+      const pending = outbox["pending"] ?? 0;
+      warn(`Sync push is paused (${formatSyncBlock(syncBlock)}; ${pending} pending, ${failedCount} failed)`);
+      if (syncBlock.reason === "auth") {
+        info("Next step: re-run `engrm init`, then `engrm sync resume`");
+      } else if (syncBlock.reason === "rate_limit") {
+        info("Next step: wait for the pause window to expire, then try again");
+      }
+    } else if (failedCount > 10) {
       warn(`Sync has stuck items (${failedCount} failed in outbox)`);
     } else {
       const pending = outbox["pending"] ?? 0;
@@ -5802,6 +6094,7 @@ function printUsage() {
   console.log("  engrm init --config <file>  Setup from JSON file");
   console.log("  engrm status                Show status");
   console.log("  engrm update                Update to latest version");
+  console.log("  engrm sync resume           Validate auth and resume paused sync queue");
   console.log("  engrm packs                 List available starter packs");
   console.log("  engrm install-pack <name>   Install a starter pack");
   console.log("  engrm doctor                Run diagnostic checks");