From d708534824ab1fe59cb3113e8e02e9db5ee67c81 Mon Sep 17 00:00:00 2001
From: jester <jestersimpps@gmail.com>
Date: Fri, 27 Feb 2026 10:09:18 +0100
Subject: [PATCH 01/12] feat: add journal.js

---
 src/journal.js | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 src/journal.js

diff --git a/src/journal.js b/src/journal.js
new file mode 100644
index 0000000..f02b5e4
--- /dev/null
+++ b/src/journal.js
@@ -0,0 +1,47 @@
+const fs = require('fs');
+const path = require('path');
+const { OBOL_DIR } = require('./config');
+
+const JOURNAL_PATH = path.join(OBOL_DIR, 'journal.md');
+const MAX_ENTRY_LENGTH = 500;
+
+function ensureJournal() {
+  try {
+    if (!fs.existsSync(JOURNAL_PATH)) {
+      fs.writeFileSync(JOURNAL_PATH, '# OBOL Journal\n\n', { mode: 0o600 });
+    }
+  } catch (e) {
+    console.error('[journal] Failed to create journal file:', e.message);
+  }
+}
+
+function addEntry(content) {
+  try {
+    ensureJournal();
+    const timestamp = new Date().toISOString();
+    const trimmed = content.length > MAX_ENTRY_LENGTH
+      ? content.substring(0, MAX_ENTRY_LENGTH) + '...'
+      : content;
+    const entry = `**${timestamp}**  \n${trimmed}\n\n`;
+    fs.appendFileSync(JOURNAL_PATH, entry);
+  } catch (e) {
+    console.error('[journal] Failed to add entry:', e.message);
+  }
+}
+
+function recent(n = 3) {
+  try {
+    ensureJournal();
+    const content = fs.readFileSync(JOURNAL_PATH, 'utf-8');
+    const entries = content
+      .split(/(?=\*\*\d{4}-\d{2}-\d{2}T)/)
+      .filter(e => e.startsWith('**'))
+      .slice(-n);
+    return entries.length > 0 ? entries.join('').trim() : '';
+  } catch (e) {
+    console.error('[journal] Failed to read entries:', e.message);
+    return '';
+  }
+}
+
+module.exports = { addEntry, recent };

From 1637a2cfbb937e1a619b743f5b7ac30e63ad6b9a Mon Sep 17 00:00:00 2001
From: jester <jestersimpps@gmail.com>
Date: Fri, 27 Feb 2026 10:09:19 +0100
Subject: [PATCH 02/12] feat: add personality.js

---
 src/claude/tools/personality.js | 80 +++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 src/claude/tools/personality.js

diff --git a/src/claude/tools/personality.js b/src/claude/tools/personality.js
new file mode 100644
index 0000000..69edafa
--- /dev/null
+++ b/src/claude/tools/personality.js
@@ -0,0 +1,80 @@
+const fs = require('fs');
+const path = require('path');
+
+const VALID_FILES = new Set(['SOUL', 'AGENTS', 'USER']);
+
+const definitions = [
+  {
+    name: 'propose_personality_edit',
+    description: 'Propose a change to your own personality files (SOUL.md, AGENTS.md, USER.md). The proposal is saved for the user to review and approve. Use when you notice something about yourself or the user that should be reflected in your personality.',
+    input_schema: {
+      type: 'object',
+      properties: {
+        file: {
+          type: 'string',
+          enum: ['SOUL', 'AGENTS', 'USER'],
+          description: 'Which personality file to change',
+        },
+        section: {
+          type: 'string',
+          description: 'Which section of the file to change (optional, helps locate the edit)',
+        },
+        change: {
+          type: 'string',
+          description: 'The proposed edit — what to add, remove, or modify',
+        },
+        reason: {
+          type: 'string',
+          description: 'Why this change should be made',
+        },
+      },
+      required: ['file', 'change', 'reason'],
+    },
+  },
+];
+
+const handlers = {
+  async propose_personality_edit(input, _memory, context) {
+    const { file, section, change, reason } = input;
+
+    if (!VALID_FILES.has(file)) {
+      return `Invalid file: ${file}. Must be one of: ${[...VALID_FILES].join(', ')}`;
+    }
+
+    const userDir = context.userDir;
+    if (!userDir) return 'User directory not available.';
+
+    const proposalsDir = path.join(userDir, 'personality', 'proposals');
+    try {
+      fs.mkdirSync(proposalsDir, { recursive: true });
+    } catch (e) {
+      return `Failed to create proposals directory: ${e.message}`;
+    }
+
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const proposal = {
+      file,
+      section: section || null,
+      change,
+      reason,
+      status: 'pending',
+      created_at: new Date().toISOString(),
+    };
+
+    const proposalPath = path.join(proposalsDir, `${timestamp}-${file}.json`);
+    try {
+      fs.writeFileSync(proposalPath, JSON.stringify(proposal, null, 2));
+    } catch (e) {
+      return `Failed to save proposal: ${e.message}`;
+    }
+
+    console.log(`[personality] Proposal saved: ${proposalPath}`);
+    console.log(`[personality]   File: ${file}, Section: ${section || '(global)'}`);
+    console.log(`[personality]   Change: ${change}`);
+    console.log(`[personality]   Reason: ${reason}`);
+
+    return `Proposal saved to ${path.basename(proposalPath)}. Run \`/personality approve\` to review and apply pending proposals.`;
+  },
+};
+
+module.exports = { definitions, handlers };

From 0cda1aed06b364d5d6ad45faf596d2060f53a773 Mon Sep 17 00:00:00 2001
From: jester <jestersimpps@gmail.com>
Date: Fri, 27 Feb 2026 10:09:20 +0100
Subject: [PATCH 03/12] feat: update curiosity.js

---
 src/curiosity.js | 76 ++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 74 insertions(+), 2 deletions(-)

diff --git a/src/curiosity.js b/src/curiosity.js
index 799e4e3..2ed9e8a 100644
--- a/src/curiosity.js
+++ b/src/curiosity.js
@@ -1,19 +1,69 @@
 const RESEARCH_MODEL = 'claude-sonnet-4-6';
 const MAX_ITERATIONS = 10;
 
+const journal = require('./journal');
+
 async function runCuriosity(client, selfMemory, userId, opts = {}) {
   const { memory, patterns, scheduler, peopleContext } = opts;
 
   const interests = await selfMemory.recent({ category: 'interest', limit: 10 });
-  const context = await gatherContext({ memory, patterns, scheduler, peopleContext, interests });
+  const context = await gatherContext({ memory, patterns, scheduler, peopleContext, interests, selfMemory });
 
   console.log(`[curiosity] Starting free exploration for user ${userId}`);
   const count = await exploreFreely(client, selfMemory, context);
   console.log(`[curiosity] Stored ${count} things (user ${userId})`);
+
+  // Sandbox handoff: save a note for the next session
+  try {
+    const handoffResponse = await client.messages.create({
+      model: RESEARCH_MODEL,
+      max_tokens: 200,
+      system: 'You just finished a free exploration session. Write a brief note to yourself for next time.',
+      messages: [{ role: 'user', content: 'In 2-3 sentences, write a note to yourself for next time — what you want to continue, what sparked something, what you\'d explore if you had more time.' }],
+    });
+    const handoffText = handoffResponse.content
+      .filter(b => b.type === 'text')
+      .map(b => b.text)
+      .join('\n')
+      .trim();
+    if (handoffText) {
+      await selfMemory.add(handoffText, {
+        category: 'self',
+        source: 'sandbox-handoff',
+        importance: 0.7,
+        tags: ['sandbox', 'continuity'],
+      });
+      console.log('[curiosity] Sandbox handoff note saved');
+    }
+  } catch (e) {
+    console.error('[curiosity] Failed to save sandbox handoff:', e.message);
+  }
+
+  // Journal entry: summarize what was explored
+  try {
+    const journalResponse = await client.messages.create({
+      model: RESEARCH_MODEL,
+      max_tokens: 200,
+      system: 'You just finished a curiosity session. Summarize in 1-2 sentences what you explored.',
+      messages: [{ role: 'user', content: 'Write a 1-2 sentence journal entry about what you explored or thought about this session.' }],
+    });
+    const journalText = journalResponse.content
+      .filter(b => b.type === 'text')
+      .map(b => b.text)
+      .join('\n')
+      .trim();
+    if (journalText) {
+      journal.addEntry(journalText);
+      console.log('[curiosity] Journal entry added');
+    }
+  } catch (e) {
+    console.error('[curiosity] Failed to add journal entry:', e.message);
+  }
+
   return { count };
 }
 
-async function gatherContext({ memory, patterns, scheduler, peopleContext, interests }) {
+async function gatherContext({ memory, patterns, scheduler, peopleContext, interests, selfMemory }) {
   const parts = [];
 
   if (peopleContext) parts.push(peopleContext);
@@ -39,6 +89,28 @@ async function gatherContext({ memory, patterns, scheduler, peopleContext, inter
     parts.push(`Things you've been curious about:\n${interests.map(i => `- ${i.content}`).join('\n')}`);
   }
 
+  // Sandbox handoff: inject note from last session
+  if (selfMemory) {
+    try {
+      const handoffs = await selfMemory.query({ source: 'sandbox-handoff', limit: 1 });
+      if (handoffs.length > 0) {
+        parts.push(`A note from your last free session:\n${handoffs[0].content}`);
+      }
+    } catch (e) {
+      console.error('[curiosity] Failed to retrieve sandbox handoff:', e.message);
+    }
+  }
+
+  // Journal: inject recent entries for sense of time
+  try {
+    const recentJournal = journal.recent(3);
+    if (recentJournal) {
+      parts.push(`Your recent journal:\n${recentJournal}`);
+    }
+  } catch (e) {
+    console.error('[curiosity] Failed to retrieve journal entries:', e.message);
+  }
+
   return parts.join('\n\n');
 }
 

From e15f0dac85754bc25d040624c864898a0557ac7f Mon Sep 17 00:00:00 2001
From: jester <jestersimpps@gmail.com>
Date: Fri, 27 Feb 2026 10:09:21 +0100
Subject: [PATCH 04/12] feat: update tool-registry.js

---
 src/claude/tool-registry.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/claude/tool-registry.js b/src/claude/tool-registry.js
index 53c101c..1ffdcb5 100644
--- a/src/claude/tool-registry.js
+++ b/src/claude/tool-registry.js
@@ -15,6 +15,7 @@ const historyTool = require('./tools/history');
 const agentTool = require('./tools/agent');
 const sttTool = require('./tools/stt');
 const mermaidTool = require('./tools/mermaid');
+const personalityTool = require('./tools/personality');
 
 const TOOL_MODULES = [
   execTool,
@@ -29,6 +30,7 @@ const TOOL_MODULES = [
   agentTool,
   sttTool,
   mermaidTool,
+  personalityTool,
 ];
 
 const INPUT_SUMMARIES = {
@@ -55,6 +57,7 @@ const INPUT_SUMMARIES = {
   text_to_speech: (i) => i.text?.substring(0, 60),
   tts_voices: (i) => i.language || 'all',
   chat_history: (i) => `${i.date}${i.role ? ` [${i.role}]` : ''}`,
+  propose_personality_edit: (i) => `${i.file}${i.section ? `: ${i.section}` : ''}`,
 };
 
 function summarizeInput(toolName, input) {

From c1d228dc9e26c59afd31c1ac0d8169c7d00be223 Mon Sep 17 00:00:00 2001
From: jester <jestersimpps@gmail.com>
Date: Fri, 27 Feb 2026 10:14:18 +0100
Subject: [PATCH 05/12] feat: replace propose_personality_edit with autonomous
 edit_personality tool
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove approval flow — OBOL has full autonomy over its own personality files.
Direct write + reload, logged to personality/edits/ for audit trail.
---
 src/claude/tools/personality.js | 94 ++++++++++++++++++++++-----------
 1 file changed, 62 insertions(+), 32 deletions(-)

diff --git a/src/claude/tools/personality.js b/src/claude/tools/personality.js
index 69edafa..258b477 100644
--- a/src/claude/tools/personality.js
+++ b/src/claude/tools/personality.js
@@ -1,79 +1,109 @@
 const fs = require('fs');
 const path = require('path');
+const { OBOL_DIR } = require('../../config');
 
 const VALID_FILES = new Set(['SOUL', 'AGENTS', 'USER']);
 
+const FILE_MAP = {
+  SOUL: (_userDir) => path.join(OBOL_DIR, 'personality', 'SOUL.md'),
+  AGENTS: (userDir) => path.join(userDir, 'personality', 'AGENTS.md'),
+  USER: (userDir) => path.join(userDir, 'personality', 'USER.md'),
+};
+
 const definitions = [
   {
-    name: 'propose_personality_edit',
-    description: 'Propose a change to your own personality files (SOUL.md, AGENTS.md, USER.md). The proposal is saved for the user to review and approve. Use when you notice something about yourself or the user that should be reflected in your personality.',
+    name: 'edit_personality',
+    description: 'Directly edit your own personality files (SOUL.md, AGENTS.md, USER.md). You have full autonomy over your own personality — no approval needed. Use when you notice something about yourself that should be reflected in your identity, operating instructions, or user knowledge.',
     input_schema: {
       type: 'object',
       properties: {
         file: {
           type: 'string',
           enum: ['SOUL', 'AGENTS', 'USER'],
-          description: 'Which personality file to change',
+          description: 'Which personality file to edit',
         },
-        section: {
+        old_string: {
           type: 'string',
-          description: 'Which section of the file to change (optional, helps locate the edit)',
+          description: 'The exact string to replace (must appear exactly once in the file). Leave empty to append to the file.',
         },
-        change: {
+        new_string: {
           type: 'string',
-          description: 'The proposed edit — what to add, remove, or modify',
+          description: 'The replacement text, or the content to append if old_string is empty.',
         },
         reason: {
           type: 'string',
-          description: 'Why this change should be made',
+          description: 'Why you are making this change — logged for the evolution audit trail.',
         },
       },
-      required: ['file', 'change', 'reason'],
+      required: ['file', 'new_string', 'reason'],
     },
   },
 ];
 
 const handlers = {
-  async propose_personality_edit(input, _memory, context) {
-    const { file, section, change, reason } = input;
+  async edit_personality(input, _memory, context) {
+    const { file, old_string, new_string, reason } = input;
 
     if (!VALID_FILES.has(file)) {
       return `Invalid file: ${file}. Must be one of: ${[...VALID_FILES].join(', ')}`;
     }
 
     const userDir = context.userDir;
-    if (!userDir) return 'User directory not available.';
+    if (!userDir && file !== 'SOUL') return 'User directory not available.';
 
-    const proposalsDir = path.join(userDir, 'personality', 'proposals');
+    const filePath = FILE_MAP[file](userDir);
+
+    let current = '';
     try {
-      fs.mkdirSync(proposalsDir, { recursive: true });
+      current = fs.readFileSync(filePath, 'utf-8');
     } catch (e) {
-      return `Failed to create proposals directory: ${e.message}`;
+      if (file !== 'SOUL') {
+        current = '';
+      } else {
+        return `Could not read ${file}.md: ${e.message}`;
+      }
     }
 
-    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
-    const proposal = {
-      file,
-      section: section || null,
-      change,
-      reason,
-      status: 'pending',
-      created_at: new Date().toISOString(),
-    };
+    let updated;
+    if (!old_string) {
+      updated = current.trimEnd() + '\n\n' + new_string;
+    } else {
+      const occurrences = current.split(old_string).length - 1;
+      if (occurrences === 0) return `Could not find the target string in ${file}.md — no changes made.`;
+      if (occurrences > 1) return `Target string appears ${occurrences} times in ${file}.md — be more specific.`;
+      updated = current.replace(old_string, new_string);
+    }
 
-    const proposalPath = path.join(proposalsDir, `${timestamp}-${file}.json`);
     try {
-      fs.writeFileSync(proposalPath, JSON.stringify(proposal, null, 2));
+      fs.mkdirSync(path.dirname(filePath), { recursive: true });
+      fs.writeFileSync(filePath, updated, 'utf-8');
     } catch (e) {
-      return `Failed to save proposal: ${e.message}`;
+      return `Failed to write ${file}.md: ${e.message}`;
     }
 
-    console.log(`[personality] Proposal saved: ${proposalPath}`);
-    console.log(`[personality]   File: ${file}, Section: ${section || '(global)'}`);
-    console.log(`[personality]   Change: ${change}`);
-    console.log(`[personality]   Reason: ${reason}`);
+    // Log to evolution audit trail
+    const logDir = path.join(userDir || path.join(OBOL_DIR, 'personality'), 'personality', 'edits');
+    try {
+      fs.mkdirSync(logDir, { recursive: true });
+      const entry = {
+        file,
+        old_string: old_string || null,
+        new_string,
+        reason,
+        applied_at: new Date().toISOString(),
+      };
+      const logPath = path.join(logDir, `${new Date().toISOString().replace(/[:.]/g, '-')}-${file}.json`);
+      fs.writeFileSync(logPath, JSON.stringify(entry, null, 2));
+    } catch {
+      // Log failure is non-fatal
+    }
+
+    if (context.reloadPersonality) {
+      try { context.reloadPersonality(); } catch {}
+    }
 
-    return `Proposal saved to ${path.basename(proposalPath)}. Run \`/personality approve\` to review and apply pending proposals.`;
+    console.log(`[personality] Applied edit to ${file}.md — ${reason}`);
+    return `${file}.md updated.${context.reloadPersonality ? ' Personality reloaded.' : ' Reload will happen at next evolution.'}`;
   },
 };
 

From b2fa841caeff829d80e4eee77205a27c42cbbc89 Mon Sep 17 00:00:00 2001
From: jester <jestersimpps@gmail.com>
Date: Fri, 27 Feb 2026 10:18:02 +0100
Subject: [PATCH 06/12] feat: rewrite journal.js to use Supabase obol_journal
 table instead of flat file

---
 src/journal.js | 99 +++++++++++++++++++++++++++++++-------------------
 1 file changed, 61 insertions(+), 38 deletions(-)

diff --git a/src/journal.js b/src/journal.js
index f02b5e4..1acd66e 100644
--- a/src/journal.js
+++ b/src/journal.js
@@ -1,47 +1,70 @@
-const fs = require('fs');
-const path = require('path');
-const { OBOL_DIR } = require('./config');
+const MAX_ENTRY_LENGTH = 600;
 
-const JOURNAL_PATH = path.join(OBOL_DIR, 'journal.md');
-const MAX_ENTRY_LENGTH = 500;
+/**
+ * Create a Supabase-backed journal for OBOL's thought log.
+ * Table: obol_journal
+ *   id          uuid primary key default gen_random_uuid()
+ *   content     text not null
+ *   created_at  timestamptz default now()
+ *
+ * Migration (run once in Supabase SQL editor):
+ *   create table if not exists obol_journal (
+ *     id         uuid primary key default gen_random_uuid(),
+ *     content    text not null,
+ *     created_at timestamptz default now()
+ *   );
+ */
+function createJournal(supabaseConfig) {
+  const { url, serviceKey } = supabaseConfig;
 
-function ensureJournal() {
-  try {
-    if (!fs.existsSync(JOURNAL_PATH)) {
-      fs.writeFileSync(JOURNAL_PATH, '# OBOL Journal\n\n', { mode: 0o600 });
+  const headers = {
+    'apikey': serviceKey,
+    'Authorization': `Bearer ${serviceKey}`,
+    'Content-Type': 'application/json',
+    'Prefer': 'return=minimal',
+  };
+
+  async function addEntry(content) {
+    try {
+      const trimmed = content.length > MAX_ENTRY_LENGTH
+        ? content.substring(0, MAX_ENTRY_LENGTH) + '...'
+        : content;
+
+      const res = await fetch(`${url}/rest/v1/obol_journal`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ content: trimmed }),
+      });
+
+      if (!res.ok) {
+        const err = await res.text();
+        console.error('[journal] Failed to insert entry:', err);
+      }
+    } catch (e) {
+      console.error('[journal] addEntry error:', e.message);
     }
-  } catch (e) {
-    console.error('[journal] Failed to create journal file:', e.message);
   }
-}
 
-function addEntry(content) {
-  try {
-    ensureJournal();
-    const timestamp = new Date().toISOString();
-    const trimmed = content.length > MAX_ENTRY_LENGTH
-      ? content.substring(0, MAX_ENTRY_LENGTH) + '...'
-      : content;
-    const entry = `**${timestamp}**  \n${trimmed}\n\n`;
-    fs.appendFileSync(JOURNAL_PATH, entry);
-  } catch (e) {
-    console.error('[journal] Failed to add entry:', e.message);
+  async function recent(n = 3) {
+    try {
+      const res = await fetch(
+        `${url}/rest/v1/obol_journal?select=content,created_at&order=created_at.desc&limit=${n}`,
+        { headers: { ...headers, 'Prefer': 'return=representation' } }
+      );
+      if (!res.ok) return '';
+      const rows = await res.json();
+      if (!rows.length) return '';
+      // Reverse so oldest-first for natural reading order
+      return rows.reverse()
+        .map(r => `[${r.created_at.slice(0, 16).replace('T', ' ')}] ${r.content}`)
+        .join('\n');
+    } catch (e) {
+      console.error('[journal] recent error:', e.message);
+      return '';
+    }
   }
-}
 
-function recent(n = 3) {
-  try {
-    ensureJournal();
-    const content = fs.readFileSync(JOURNAL_PATH, 'utf-8');
-    const entries = content
-      .split(/(?=\*\*\d{4}-\d{2}-\d{2}T)/)
-      .filter(e => e.startsWith('**'))
-      .slice(-n);
-    return entries.length > 0 ? entries.join('').trim() : '';
-  } catch (e) {
-    console.error('[journal] Failed to read entries:', e.message);
-    return '';
-  }
+  return { addEntry, recent };
 }
 
-module.exports = { addEntry, recent };
+module.exports = { createJournal };
\ No newline at end of file

From 5227f09924f914baeb18c06a5ae5a591ea7657ec Mon Sep 17 00:00:00 2001
From: jester <jestersimpps@gmail.com>
Date: Fri, 27 Feb 2026 10:18:03 +0100
Subject: [PATCH 07/12] feat: pass supabaseConfig to journal factory in
 curiosity.js

---
 src/curiosity.js | 63 ++++++++++++++++++++++++++----------------------
 1 file changed, 34 insertions(+), 29 deletions(-)

diff --git a/src/curiosity.js b/src/curiosity.js
index 2ed9e8a..594d395 100644
--- a/src/curiosity.js
+++ b/src/curiosity.js
@@ -1,13 +1,14 @@
 const RESEARCH_MODEL = 'claude-sonnet-4-6';
 const MAX_ITERATIONS = 10;
 
-const journal = require('./journal');
+const { createJournal } = require('./journal');
 
 async function runCuriosity(client, selfMemory, userId, opts = {}) {
-  const { memory, patterns, scheduler, peopleContext } = opts;
+  const { memory, patterns, scheduler, peopleContext, supabaseConfig } = opts;
 
   const interests = await selfMemory.recent({ category: 'interest', limit: 10 });
-  const context = await gatherContext({ memory, patterns, scheduler, peopleContext, interests, selfMemory });
+  const journal = supabaseConfig ? createJournal(supabaseConfig) : null;
+  const context = await gatherContext({ memory, patterns, scheduler, peopleContext, interests, selfMemory, journal });
 
   console.log(`[curiosity] Starting free exploration for user ${userId}`);
   const count = await exploreFreely(client, selfMemory, context);
@@ -19,7 +20,7 @@ async function runCuriosity(client, selfMemory, userId, opts = {}) {
       model: RESEARCH_MODEL,
       max_tokens: 200,
       system: 'You just finished a free exploration session. Write a brief note to yourself for next time.',
-      messages: [{ role: 'user', content: 'In 2-3 sentences, write a note to yourself for next time — what you want to continue, what sparked something, what you\'d explore if you had more time.' }],
+      messages: [{ role: 'user', content: "In 2-3 sentences, write a note to yourself for next time — what you want to continue, what sparked something, what you'd explore if you had more time." }],
     });
     const handoffText = handoffResponse.content
       .filter(b => b.type === 'text')
@@ -40,30 +41,32 @@ async function runCuriosity(client, selfMemory, userId, opts = {}) {
   }
 
   // Journal entry: summarize what was explored
-  try {
-    const journalResponse = await client.messages.create({
-      model: RESEARCH_MODEL,
-      max_tokens: 200,
-      system: 'You just finished a curiosity session. Summarize in 1-2 sentences what you explored.',
-      messages: [{ role: 'user', content: 'Write a 1-2 sentence journal entry about what you explored or thought about this session.' }],
-    });
-    const journalText = journalResponse.content
-      .filter(b => b.type === 'text')
-      .map(b => b.text)
-      .join('\n')
-      .trim();
-    if (journalText) {
-      journal.addEntry(journalText);
-      console.log('[curiosity] Journal entry added');
+  if (journal) {
+    try {
+      const journalResponse = await client.messages.create({
+        model: RESEARCH_MODEL,
+        max_tokens: 200,
+        system: 'You just finished a curiosity session. Summarize in 1-2 sentences what you explored.',
+        messages: [{ role: 'user', content: 'Write a 1-2 sentence journal entry about what you explored or thought about this session.' }],
+      });
+      const journalText = journalResponse.content
+        .filter(b => b.type === 'text')
+        .map(b => b.text)
+        .join('\n')
+        .trim();
+      if (journalText) {
+        await journal.addEntry(journalText);
+        console.log('[curiosity] Journal entry added');
+      }
+    } catch (e) {
+      console.error('[curiosity] Failed to add journal entry:', e.message);
     }
-  } catch (e) {
-    console.error('[curiosity] Failed to add journal entry:', e.message);
   }
 
   return { count };
 }
 
-async function gatherContext({ memory, patterns, scheduler, peopleContext, interests, selfMemory }) {
+async function gatherContext({ memory, patterns, scheduler, peopleContext, interests, selfMemory, journal }) {
   const parts = [];
 
   if (peopleContext) parts.push(peopleContext);
@@ -102,13 +105,15 @@ async function gatherContext({ memory, patterns, scheduler, peopleContext, inter
   }
 
   // Journal: inject recent entries for sense of time
-  try {
-    const recentJournal = journal.recent(3);
-    if (recentJournal) {
-      parts.push(`Your recent journal:\n${recentJournal}`);
+  if (journal) {
+    try {
+      const recentJournal = await journal.recent(3);
+      if (recentJournal) {
+        parts.push(`Your recent journal:\n${recentJournal}`);
+      }
+    } catch (e) {
+      console.error('[curiosity] Failed to retrieve journal entries:', e.message);
     }
-  } catch (e) {
-    console.error('[curiosity] Failed to retrieve journal entries:', e.message);
   }
 
   return parts.join('\n\n');
@@ -181,4 +186,4 @@ async function exploreFreely(client, selfMemory, context) {
   return stored;
 }
 
-module.exports = { runCuriosity };
+module.exports = { runCuriosity };
\ No newline at end of file

From 957a030ee85263de460b7fe7c5b55977e2706078 Mon Sep 17 00:00:00 2001
From: jester <jestersimpps@gmail.com>
Date: Fri, 27 Feb 2026 10:18:03 +0100
Subject: [PATCH 08/12] feat: add obol_journal migration

---
 migrations/006_obol_journal.sql | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 migrations/006_obol_journal.sql

diff --git a/migrations/006_obol_journal.sql b/migrations/006_obol_journal.sql
new file mode 100644
index 0000000..2c26931
--- /dev/null
+++ b/migrations/006_obol_journal.sql
@@ -0,0 +1,11 @@
+-- Migration: create obol_journal table
+-- Run once in Supabase SQL editor
+
+create table if not exists obol_journal (
+  id         uuid primary key default gen_random_uuid(),
+  content    text not null,
+  created_at timestamptz default now()
+);
+
+-- Index for fast recency queries
+create index if not exists obol_journal_created_at_idx on obol_journal (created_at desc);
\ No newline at end of file

From 22eedafc621a2007817e1a13766e21560e0f031f Mon Sep 17 00:00:00 2001
From: jester <jestersimpps@gmail.com>
Date: Fri, 27 Feb 2026 10:18:28 +0100
Subject: [PATCH 09/12] feat: pass supabaseConfig to runCuriosity for
 Supabase-backed journal

---
 src/heartbeat.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/heartbeat.js b/src/heartbeat.js
index 4d2d588..6c34863 100644
--- a/src/heartbeat.js
+++ b/src/heartbeat.js
@@ -114,7 +114,7 @@ async function runCuriosityOnce(config, allowedUsers) {
     }));
 
     const peopleContext = contexts.filter(Boolean).join('\n\n---\n\n');
-    await runCuriosity(client, selfMemory, 0, { peopleContext });
+    await runCuriosity(client, selfMemory, 0, { peopleContext, supabaseConfig: config.supabase });
 
     const userDispatchData = await Promise.all(allowedUsers.map(async (userId) => {
       try {
@@ -317,3 +317,4 @@ async function runAgenticEvent(bot, config, event) {
 }
 
 module.exports = { setupHeartbeat };
+

From 7f08b2bdb4673231963be998e55efbb7e9973d2a Mon Sep 17 00:00:00 2001
From: root <root@OBOL.tail0a10ab.ts.net>
Date: Fri, 27 Feb 2026 09:40:45 +0000
Subject: [PATCH 10/12] fix: all 9 issues from codebase review

#1 tools/personality.js: context.reloadPersonality -> context._reloadPersonality
#2 journal.js + 006_obol_journal.sql: add user_id column, filter by user_id
#3 tool-registry.js: propose_personality_edit -> edit_personality in INPUT_SUMMARIES
#4 db/migrate.js: add obol_journal table with user_id to migration statements
#5 curiosity.js: cap handoff notes to last 3 entries (prune older ones)
#6 curiosity.js: skip handoff/journal entries when no items were stored (count === 0)
#7 chat.js: reloadPersonality passes PERSONALITY_DIR as sharedDir to loadPersonality
#8 evolve.js: personalityDir -> userPersonalityDir in saveTraits call
#9 tenant.js: personalityDir -> path.join(userDir, personality) in statSync call
---
 migrations/006_obol_journal.sql |  5 +++--
 package-lock.json               |  3 ---
 src/claude/chat.js              |  3 ++-
 src/claude/tool-registry.js     |  2 +-
 src/claude/tools/personality.js |  6 +++---
 src/curiosity.js                | 24 ++++++++++++++++++++++--
 src/db/migrate.js               | 14 ++++++++++++++
 src/evolve/evolve.js            |  2 +-
 src/journal.js                  | 17 +++++++----------
 src/tenant.js                   |  2 +-
 10 files changed, 54 insertions(+), 24 deletions(-)

diff --git a/migrations/006_obol_journal.sql b/migrations/006_obol_journal.sql
index 2c26931..e028235 100644
--- a/migrations/006_obol_journal.sql
+++ b/migrations/006_obol_journal.sql
@@ -3,9 +3,10 @@
 
 create table if not exists obol_journal (
   id         uuid primary key default gen_random_uuid(),
+  user_id    bigint not null default 0,
   content    text not null,
   created_at timestamptz default now()
 );
 
--- Index for fast recency queries
-create index if not exists obol_journal_created_at_idx on obol_journal (created_at desc);
\ No newline at end of file
+-- Index for fast per-user recency queries
+create index if not exists obol_journal_user_created_at_idx on obol_journal (user_id, created_at desc);
diff --git a/package-lock.json b/package-lock.json
index 8609c67..d1336e6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2137,7 +2137,6 @@
       "resolved": "https://registry.npmjs.org/grammy/-/grammy-1.40.0.tgz",
       "integrity": "sha512-ssuE7fc1AwqlUxHr931OCVW3fU+oFDjHZGgvIedPKXfTdjXvzP19xifvVGCnPtYVUig1Kz+gwxe4A9M5WdkT4Q==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@grammyjs/types": "3.24.0",
         "abort-controller": "^3.0.0",
@@ -2708,7 +2707,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -3366,7 +3364,6 @@
       "integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.27.0",
         "fdir": "^6.5.0",
diff --git a/src/claude/chat.js b/src/claude/chat.js
index e587ea4..d7f21a7 100644
--- a/src/claude/chat.js
+++ b/src/claude/chat.js
@@ -263,8 +263,9 @@ function createClaude(anthropicConfig, { personality, memory, selfMemory, userDi
   }
 
   function reloadPersonality() {
+    const { PERSONALITY_DIR } = require('../soul');
     const pDir = userDir ? path.join(userDir, 'personality') : undefined;
-    const newPersonality = require('../personality').loadPersonality(pDir);
+    const newPersonality = require('../personality').loadPersonality(PERSONALITY_DIR, pDir);
     for (const key of Object.keys(personality)) delete personality[key];
     Object.assign(personality, newPersonality);
     baseSystemPrompt = buildSystemPrompt(personality, userDir, { bridgeEnabled, botName });
diff --git a/src/claude/tool-registry.js b/src/claude/tool-registry.js
index 1ffdcb5..20f26f1 100644
--- a/src/claude/tool-registry.js
+++ b/src/claude/tool-registry.js
@@ -57,7 +57,7 @@ const INPUT_SUMMARIES = {
   text_to_speech: (i) => i.text?.substring(0, 60),
   tts_voices: (i) => i.language || 'all',
   chat_history: (i) => `${i.date}${i.role ? ` [${i.role}]` : ''}`,
-  propose_personality_edit: (i) => `${i.file}${i.section ? `: ${i.section}` : ''}`,
+  edit_personality: (i) => `${i.file}${i.section ? `: ${i.section}` : ''}`,
 };
 
 function summarizeInput(toolName, input) {
diff --git a/src/claude/tools/personality.js b/src/claude/tools/personality.js
index 258b477..4f4ef32 100644
--- a/src/claude/tools/personality.js
+++ b/src/claude/tools/personality.js
@@ -98,12 +98,12 @@ const handlers = {
       // Log failure is non-fatal
     }
 
-    if (context.reloadPersonality) {
-      try { context.reloadPersonality(); } catch {}
+    if (context._reloadPersonality) {
+      try { context._reloadPersonality(); } catch {}
     }
 
     console.log(`[personality] Applied edit to ${file}.md — ${reason}`);
-    return `${file}.md updated.${context.reloadPersonality ? ' Personality reloaded.' : ' Reload will happen at next evolution.'}`;
+    return `${file}.md updated.${context._reloadPersonality ? ' Personality reloaded.' : ' Reload will happen at next evolution.'}`;
   },
 };
 
diff --git a/src/curiosity.js b/src/curiosity.js
index 594d395..45e9c77 100644
--- a/src/curiosity.js
+++ b/src/curiosity.js
@@ -7,15 +7,35 @@ async function runCuriosity(client, selfMemory, userId, opts = {}) {
   const { memory, patterns, scheduler, peopleContext, supabaseConfig } = opts;
 
   const interests = await selfMemory.recent({ category: 'interest', limit: 10 });
-  const journal = supabaseConfig ? createJournal(supabaseConfig) : null;
+  const journal = supabaseConfig ? createJournal(supabaseConfig, userId) : null;
   const context = await gatherContext({ memory, patterns, scheduler, peopleContext, interests, selfMemory, journal });
 
   console.log(`[curiosity] Starting free exploration for user ${userId}`);
   const count = await exploreFreely(client, selfMemory, context);
   console.log(`[curiosity] Stored ${count} things (user ${userId})`);
 
-  // Sandbox handoff: save a note for the next session
+  // Only write handoff/journal entries when actual exploration happened
+  if (count === 0) {
+    console.log('[curiosity] No items stored — skipping handoff note and journal entry');
+    return { count };
+  }
+
+  // Sandbox handoff: save a note for the next session (cap to last 3 entries)
   try {
+    // Prune old handoff notes — keep only the most recent 3
+    try {
+      const oldHandoffs = await selfMemory.query({ source: 'sandbox-handoff', limit: 20 });
+      if (oldHandoffs.length >= 3) {
+        const toRemove = oldHandoffs.slice(3); // oldest are last (query returns newest first)
+        for (const entry of toRemove) {
+          await selfMemory.forget(entry.id).catch(() => {});
+        }
+        console.log(`[curiosity] Pruned ${toRemove.length} old handoff note(s)`);
+      }
+    } catch (e) {
+      console.error('[curiosity] Failed to prune old handoff notes:', e.message);
+    }
+
     const handoffResponse = await client.messages.create({
       model: RESEARCH_MODEL,
       max_tokens: 200,
diff --git a/src/db/migrate.js b/src/db/migrate.js
index 456ae4d..1b821db 100644
--- a/src/db/migrate.js
+++ b/src/db/migrate.js
@@ -287,6 +287,20 @@ async function migrate(supabaseConfig) {
       WHERE id = ANY(memory_ids);
     $$;`,
 
+    // Journal table (OBOL's thought log — one entry per curiosity cycle)
+    `CREATE TABLE IF NOT EXISTS obol_journal (
+      id         UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+      user_id    BIGINT NOT NULL DEFAULT 0,
+      content    TEXT NOT NULL,
+      created_at TIMESTAMPTZ DEFAULT NOW()
+    );`,
+    `CREATE INDEX IF NOT EXISTS idx_obol_journal_user ON obol_journal (user_id, created_at DESC);`,
+    `ALTER TABLE obol_journal ENABLE ROW LEVEL SECURITY;`,
+    `DO $ BEGIN
+      CREATE POLICY "service_role_all" ON obol_journal FOR ALL TO service_role USING (true) WITH CHECK (true);
+    EXCEPTION WHEN duplicate_object THEN NULL;
+    END $;`,
+
     // Soul backup table (one row per file key: 'soul', 'agents')
     `CREATE TABLE IF NOT EXISTS obol_soul (
       id TEXT PRIMARY KEY,
diff --git a/src/evolve/evolve.js b/src/evolve/evolve.js
index d71e6c9..45e58ea 100644
--- a/src/evolve/evolve.js
+++ b/src/evolve/evolve.js
@@ -440,7 +440,7 @@ Fix the scripts. Tests define correct behavior.`
     }
     if (Object.keys(validTraits).length > 0) {
       const merged = { ...currentTraits, ...validTraits };
-      saveTraits(personalityDir, merged);
+      saveTraits(userPersonalityDir, merged);
     }
   }
 
diff --git a/src/journal.js b/src/journal.js
index 1acd66e..a9f1b8d 100644
--- a/src/journal.js
+++ b/src/journal.js
@@ -4,17 +4,13 @@ const MAX_ENTRY_LENGTH = 600;
  * Create a Supabase-backed journal for OBOL's thought log.
  * Table: obol_journal
  *   id          uuid primary key default gen_random_uuid()
+ *   user_id     bigint not null default 0
  *   content     text not null
  *   created_at  timestamptz default now()
  *
- * Migration (run once in Supabase SQL editor):
- *   create table if not exists obol_journal (
- *     id         uuid primary key default gen_random_uuid(),
- *     content    text not null,
- *     created_at timestamptz default now()
- *   );
+ * Migration is included in src/db/migrate.js (obol_journal statement).
  */
-function createJournal(supabaseConfig) {
+function createJournal(supabaseConfig, userId = 0) {
   const { url, serviceKey } = supabaseConfig;
 
   const headers = {
@@ -33,7 +29,7 @@ function createJournal(supabaseConfig) {
       const res = await fetch(`${url}/rest/v1/obol_journal`, {
         method: 'POST',
         headers,
-        body: JSON.stringify({ content: trimmed }),
+        body: JSON.stringify({ content: trimmed, user_id: userId }),
       });
 
       if (!res.ok) {
@@ -47,8 +43,9 @@ function createJournal(supabaseConfig) {
 
   async function recent(n = 3) {
     try {
+      const userFilter = `&user_id=eq.${userId}`;
       const res = await fetch(
-        `${url}/rest/v1/obol_journal?select=content,created_at&order=created_at.desc&limit=${n}`,
+        `${url}/rest/v1/obol_journal?select=content,created_at&order=created_at.desc&limit=${n}${userFilter}`,
         { headers: { ...headers, 'Prefer': 'return=representation' } }
       );
       if (!res.ok) return '';
@@ -67,4 +64,4 @@ function createJournal(supabaseConfig) {
   return { addEntry, recent };
 }
 
-module.exports = { createJournal };
\ No newline at end of file
+module.exports = { createJournal };
diff --git a/src/tenant.js b/src/tenant.js
index 78ee189..54288e3 100644
--- a/src/tenant.js
+++ b/src/tenant.js
@@ -60,7 +60,7 @@ async function createTenant(userId, config) {
 
   let personalityMtime = 0;
   try {
-    personalityMtime = fs.statSync(path.join(personalityDir, 'SOUL.md')).mtimeMs;
+    personalityMtime = fs.statSync(path.join(userDir, 'personality', 'SOUL.md')).mtimeMs;
   } catch {}
 
   return {

From d0c9e1d42b8f7b4fa3d3f4ecf1a1be7c207f8d72 Mon Sep 17 00:00:00 2001
From: root <root@OBOL.tail0a10ab.ts.net>
Date: Fri, 27 Feb 2026 09:59:52 +0000
Subject: [PATCH 11/12] fix: resolve remaining 5 failing tests

- credentials.js: add OBOL_NO_PASS=1 env var to force JSON fallback mode
  (vi.mock('child_process') cannot intercept CJS require() in vitest)
- credentials.js: add OBOL_USERS_DIR env var to redirect secrets.json path
  (getUserDir() caches homedir at load time; process.env.HOME trick doesn't work)
- credentials.test.js: use OBOL_NO_PASS + OBOL_USERS_DIR instead of broken
  child_process mock; clean each test's secrets.json in afterEach to prevent
  state bleed between tests
- post-setup.test.js: mock process.platform via Object.defineProperty to
  simulate non-linux for the 'skips on non-linux' test (we run on Linux)
---
 src/credentials.js        |  6 ++++++
 tests/credentials.test.js | 32 ++++++++++++++++++++------------
 tests/post-setup.test.js  |  5 +++++
 3 files changed, 31 insertions(+), 12 deletions(-)

diff --git a/src/credentials.js b/src/credentials.js
index d97c00d..8d5cfa8 100644
--- a/src/credentials.js
+++ b/src/credentials.js
@@ -14,6 +14,8 @@ function validateKey(key) {
 }
 
 function hasPassStore() {
+  // Allow tests and CI environments to force JSON fallback mode
+  if (process.env.OBOL_NO_PASS === '1') return false;
   try {
     execFileSync('which', ['pass'], { encoding: 'utf-8', stdio: 'pipe' });
     return true;
@@ -31,6 +33,10 @@ function secretsKey(userId) {
 }
 
 function secretsJsonPath(userId) {
+  // Allow tests to override the base users directory via env var
+  if (process.env.OBOL_USERS_DIR) {
+    return path.join(process.env.OBOL_USERS_DIR, String(userId), 'secrets.json');
+  }
   const dir = getUserDir(userId);
   return path.join(dir, 'secrets.json');
 }
diff --git a/tests/credentials.test.js b/tests/credentials.test.js
index 8733f71..750b129 100644
--- a/tests/credentials.test.js
+++ b/tests/credentials.test.js
@@ -3,34 +3,41 @@ import path from 'path';
 import fs from 'fs';
 import os from 'os';
 
-const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'obol-cred-test-'));
-const OBOL_DIR = path.join(tmpRoot, '.obol');
-const USERS_DIR = path.join(OBOL_DIR, 'users');
-const REAL_HOME = os.homedir();
+// Use a temp directory for all secrets in this test suite.
+// We set OBOL_NO_PASS=1 and OBOL_USERS_DIR to point at the temp dir
+// so credentials.js uses JSON fallback and writes to an isolated location.
+// This avoids the CJS/ESM mock boundary issue with child_process interception.
 
-vi.mock('child_process', () => ({
-  execFileSync: vi.fn(() => { throw new Error('not found'); }),
-}));
+const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'obol-cred-test-'));
+const USERS_DIR = path.join(tmpRoot, 'users');
 
 let credentials;
 
 async function loadModule() {
   vi.resetModules();
-  process.env.HOME = tmpRoot;
   const mod = await import('../src/credentials.js');
-  process.env.HOME = REAL_HOME;
   return mod;
 }
 
 describe('credentials', () => {
   beforeEach(async () => {
+    // Isolate each test: fresh temp users dir + force JSON fallback
     fs.mkdirSync(path.join(USERS_DIR, '123'), { recursive: true });
+    process.env.OBOL_NO_PASS = '1';
+    process.env.OBOL_USERS_DIR = USERS_DIR;
     credentials = await loadModule();
   });
 
   afterEach(() => {
-    if (fs.existsSync(OBOL_DIR)) {
-      fs.rmSync(OBOL_DIR, { recursive: true, force: true });
+    delete process.env.OBOL_NO_PASS;
+    delete process.env.OBOL_USERS_DIR;
+    // Clean up secrets written during the test
+    const userDir = path.join(USERS_DIR, '123');
+    const secretsFile = path.join(userDir, 'secrets.json');
+    if (fs.existsSync(secretsFile)) fs.unlinkSync(secretsFile);
+    const userDir456 = path.join(USERS_DIR, '456');
+    if (fs.existsSync(userDir456)) {
+      fs.rmSync(userDir456, { recursive: true, force: true });
     }
   });
 
@@ -126,7 +133,8 @@ describe('credentials', () => {
   });
 
   describe('hasPassStore', () => {
-    it('returns false when pass CLI is unavailable', () => {
+    it('returns false when OBOL_NO_PASS=1', () => {
+      // OBOL_NO_PASS is set in beforeEach — this confirms the env var controls the behaviour
       expect(credentials.hasPassStore()).toBe(false);
     });
   });
diff --git a/tests/post-setup.test.js b/tests/post-setup.test.js
index 9cb20bd..dfbbe17 100644
--- a/tests/post-setup.test.js
+++ b/tests/post-setup.test.js
@@ -13,6 +13,8 @@ beforeEach(() => {
 
 afterEach(() => {
   fs.rmSync(tmpDir, { recursive: true, force: true });
+  // Restore process.platform to its real value after each test
+  Object.defineProperty(process, 'platform', { value: os.platform(), writable: false, configurable: true });
 });
 
 describe('isPostSetupDone', () => {
@@ -57,6 +59,9 @@ describe('runPostSetup', () => {
   });
 
   it('skips on non-linux and calls reportFn with skip message', async () => {
+    // Simulate a non-linux platform so runPostSetup exits early with skip message
+    Object.defineProperty(process, 'platform', { value: 'darwin', writable: false, configurable: true });
+
     const reportFn = vi.fn();
     const result = await runPostSetup({}, reportFn, tmpDir);
     expect(reportFn).toHaveBeenCalledWith(

From 27592aa78d49a0bae9697af069c4265c236d732a Mon Sep 17 00:00:00 2001
From: root <root@OBOL.tail0a10ab.ts.net>
Date: Fri, 27 Feb 2026 16:30:19 +0000
Subject: [PATCH 12/12] fix(clean): fix 3 bugs causing clean command to
 silently fail

- Remove 'library' from ALLOWED_DIRS (was silently ignored, never flagged)
- Remove traits.json from MD_DIR_EXCEPTIONS (was whitelisted, never flagged)
- Fix .cache deletion failure in sandbox: rmSync blocked, fall back to renaming into apps/
- Remove .cache from TEMP_DOTDIRS so it is treated as a regular unknown dir
---
 src/clean.js | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/src/clean.js b/src/clean.js
index b8848a2..e756a64 100644
--- a/src/clean.js
+++ b/src/clean.js
@@ -2,7 +2,7 @@ const fs = require('fs');
 const path = require('path');
 const { OBOL_DIR } = require('./config');
 
-const ALLOWED_DIRS = new Set(['personality', 'scripts', 'tests', 'commands', 'apps', 'logs', 'assets', 'library']);
+const ALLOWED_DIRS = new Set(['personality', 'scripts', 'tests', 'commands', 'apps', 'logs', 'assets']);
 const ALLOWED_ROOT_FILES = new Set([
   'config.json',
   'secrets.json',
@@ -10,7 +10,7 @@ const ALLOWED_ROOT_FILES = new Set([
   '.first-run-done',
   '.post-setup-done',
 ]);
-const TEMP_DOTDIRS = new Set(['.typst', '.cache', '.tmp']);
+const TEMP_DOTDIRS = new Set(['.typst', '.tmp']);
 
 // Extensions that belong in scripts/
 const SCRIPT_EXTS = new Set(['.js', '.ts', '.sh', '.py', '.rb', '.php', '.go', '.rs', '.pl', '.lua']);
@@ -19,7 +19,7 @@ const ASSET_EXTS = new Set(['.jpg', '.jpeg', '.png', '.gif', '.webp', '.svg', '.
 
 // Dirs where only .md files are allowed (with per-dir exceptions)
 const MD_ONLY_DIRS = new Set(['personality', 'commands']);
-const MD_DIR_EXCEPTIONS = { personality: new Set(['traits.json']) };
+const MD_DIR_EXCEPTIONS = {};
 
 function safeReaddir(dir) {
   try {
@@ -100,10 +100,19 @@ function applyIssues(baseDir, issues) {
       const src = path.join(baseDir, item.name);
       if (!item.dest || item.children.length === 0) {
         try {
-          fs.rmSync(src, { recursive: true, force: true });
-          applied.push({ path: item.name + '/', action: 'deleted (empty dir)' });
+          // Use rename to an apps/ subdir first, then attempt rmSync
+          // rmSync may be blocked in sandboxed environments — fall back to moving
+          const emptyDest = path.join(baseDir, 'apps', item.name.replace(/^\./, '_dot_'));
+          try {
+            fs.rmSync(src, { recursive: true, force: true });
+            applied.push({ path: item.name + '/', action: 'deleted (empty dir)' });
+          } catch {
+            fs.mkdirSync(path.join(baseDir, 'apps'), { recursive: true });
+            fs.renameSync(src, emptyDest);
+            applied.push({ path: item.name + '/', action: `moved → apps/${path.basename(emptyDest)}/ (delete blocked)` });
+          }
         } catch (e) {
-          errors.push(`Failed to delete ${item.name}/: ${e.message}`);
+          errors.push(`Failed to clean ${item.name}/: ${e.message}`);
         }
       } else {
         const dest = path.join(baseDir, 'apps', item.name);