@askexenow/exe-os 0.9.217 → 0.9.219

package/dist/chunk-I3MJHU76.js

@@ -0,0 +1,225 @@
+import {
+  conversationsToMemories,
+  detectFormat,
+  parseChatGPT,
+  parseClaude,
+  parseGeneric
+} from "./chunk-Q2G5C3HV.js";
+import {
+  extractMemoryGraph
+} from "./chunk-7WEP4DNC.js";
+import {
+  flushBatch,
+  writeMemory
+} from "./chunk-IEAXNG3H.js";
+import {
+  extractKeywords,
+  keywordsToString
+} from "./chunk-CHCA3ZM2.js";
+import {
+  getActiveAgent
+} from "./chunk-BXLA6CQM.js";
+
+// src/mcp/tools/import-conversations.ts
+import { z } from "zod";
+import crypto from "crypto";
+import { readFile, readdir, stat } from "fs/promises";
+import path from "path";
+var DEFAULT_MAX_MEMORIES = 5e4;
+var YIELD_INTERVAL = 50;
+async function parseFile(filePath, format) {
+  const content = await readFile(filePath, "utf-8");
+  const detectedFormat = format === "auto" ? detectFormat(content, filePath) : format;
+  let conversations;
+  switch (detectedFormat) {
+    case "chatgpt":
+      conversations = parseChatGPT(content, filePath);
+      break;
+    case "claude":
+      conversations = parseClaude(content, filePath);
+      break;
+    case "markdown":
+    case "generic":
+    default:
+      conversations = parseGeneric(content, filePath);
+      break;
+  }
+  return { conversations, detectedFormat };
+}
+async function collectFiles(dirPath) {
+  const entries = await readdir(dirPath, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const full = path.join(dirPath, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...await collectFiles(full));
+    } else if (entry.isFile()) {
+      const ext = path.extname(entry.name).toLowerCase();
+      if ([".json", ".md", ".markdown", ".txt"].includes(ext)) {
+        files.push(full);
+      }
+    }
+  }
+  return files;
+}
+function registerImportConversations(server) {
+  server.registerTool(
+    "import_conversations",
+    {
+      title: "Import Conversations",
+      description: "Import conversation history from ChatGPT, Claude, or generic exports. Parses conversations, extracts keywords and graph entities, stores as memories. Supports conversations.json (ChatGPT), Claude JSON export, markdown files, and generic JSON arrays. Deduplicates by content hash.",
+      inputSchema: {
+        path: z.string().describe("File path or directory to import from"),
+        format: z.enum(["chatgpt", "claude", "generic", "markdown", "auto"]).default("auto").describe("Conversation format. 'auto' detects from content."),
+        project_name: z.string().optional().describe("Project name for memory scoping"),
+        dry_run: z.boolean().default(false).describe("Parse and report counts without storing"),
+        force: z.boolean().default(false).describe("Override the 50K memory safety cap"),
+        max_memories: z.number().optional().describe("Custom memory cap (default 50000)")
+      }
+    },
+    async ({ path: inputPath, format, project_name, dry_run, force, max_memories }) => {
+      const { agentId, agentRole } = getActiveAgent();
+      const cap = max_memories ?? DEFAULT_MAX_MEMORIES;
+      const resolvedPath = path.resolve(inputPath);
+      let files;
+      try {
+        const stats = await stat(resolvedPath);
+        if (stats.isDirectory()) {
+          files = await collectFiles(resolvedPath);
+        } else {
+          files = [resolvedPath];
+        }
+      } catch (err) {
+        return {
+          content: [{
+            type: "text",
+            text: `Path not found: ${resolvedPath}
+${err instanceof Error ? err.message : String(err)}`
+          }],
+          isError: true
+        };
+      }
+      if (files.length === 0) {
+        return {
+          content: [{
+            type: "text",
+            text: `No importable files found in ${resolvedPath}. Supported: .json, .md, .markdown, .txt`
+          }],
+          isError: true
+        };
+      }
+      let totalConversations = 0;
+      let allDetectedFormat = "generic";
+      const allConversations = [];
+      for (const file of files) {
+        try {
+          const { conversations, detectedFormat } = await parseFile(file, format);
+          allConversations.push(...conversations);
+          totalConversations += conversations.length;
+          allDetectedFormat = detectedFormat;
+        } catch (err) {
+          console.warn(`[import] Skipping ${file}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      if (allConversations.length === 0) {
+        return {
+          content: [{
+            type: "text",
+            text: `No conversations found in ${files.length} file(s). Format: ${format}. Path: ${resolvedPath}`
+          }]
+        };
+      }
+      const memories = conversationsToMemories(allConversations, allDetectedFormat);
+      if (memories.length > cap && !force) {
+        return {
+          content: [{
+            type: "text",
+            text: `Import would create ${memories.length} memories (cap: ${cap}). Use force=true to override.
+Files: ${files.length} | Conversations: ${totalConversations} | Format: ${allDetectedFormat}`
+          }]
+        };
+      }
+      if (dry_run) {
+        return {
+          content: [{
+            type: "text",
+            text: `[dry run] Import summary:
+  Files: ${files.length}
+  Format: ${allDetectedFormat}
+  Conversations: ${totalConversations}
+  Memories to create: ${memories.length}
+  Path: ${resolvedPath}`
+          }]
+        };
+      }
+      let stored = 0;
+      let skipped = 0;
+      const projectName = project_name ?? "import";
+      const sessionId = process.env.SESSION_ID ?? "import";
+      for (let i = 0; i < memories.length; i++) {
+        const mem = memories[i];
+        const keywords = extractKeywords(mem.text);
+        const graphResult = extractMemoryGraph(
+          mem.text,
+          agentId,
+          projectName,
+          "import_conversations"
+        );
+        const memoryId = crypto.randomUUID();
+        try {
+          await writeMemory({
+            id: memoryId,
+            agent_id: agentId,
+            agent_role: agentRole,
+            session_id: sessionId,
+            timestamp: mem.metadata.original_timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+            tool_name: "import_conversations",
+            project_name: projectName,
+            has_error: false,
+            raw_text: mem.text,
+            vector: null,
+            // NULL vectors — backfill later
+            source_path: mem.metadata.source_path,
+            source_type: "conversation_import",
+            memory_type: "conversation",
+            tier: 3,
+            // Passive ingestion
+            importance: 4,
+            // Imported conversations are moderate importance
+            intent: "import",
+            domain: "conversation",
+            keywords: keywordsToString(keywords),
+            referenced_entities: graphResult.entities.length > 0 ? JSON.stringify(graphResult.entities.map((e) => e.name)) : null
+          });
+          stored++;
+        } catch {
+          skipped++;
+        }
+        if ((i + 1) % YIELD_INTERVAL === 0) {
+          await flushBatch();
+          await new Promise((r) => setTimeout(r, 0));
+          if ((i + 1) % (YIELD_INTERVAL * 10) === 0) {
+            console.log(`[import] ${i + 1}/${memories.length} memories processed, ${stored} stored`);
+          }
+        }
+      }
+      await flushBatch();
+      return {
+        content: [{
+          type: "text",
+          text: `Import complete.
+  Files: ${files.length}
+  Format: ${allDetectedFormat}
+  Conversations: ${totalConversations}
+  Memories stored: ${stored}
+  Skipped (duplicates): ${skipped}
+  Path: ${resolvedPath}`
+        }]
+      };
+    }
+  );
+}
+
+export {
+  registerImportConversations
+};

package/dist/{chunk-2IMUAL3X.js → chunk-IEAXNG3H.js}

@@ -6,7 +6,7 @@ import {
   findScopedDuplicate,
   governMemoryRecord,
   schedulePostWriteMemoryHygiene
-} from "./chunk-Y2B6MB3J.js";
+} from "./chunk-PN7MTAYN.js";
 import {
   orgBus
 } from "./chunk-MP2AFCGL.js";
@@ -15,7 +15,7 @@ import {
   ensureSchema,
   getClient,
   initTurso
-} from "./chunk-4GXXYDNU.js";
+} from "./chunk-3XGZAFHE.js";
 import {
   EMBEDDING_DIM
 } from "./chunk-FXU7JOXK.js";
@@ -65,7 +65,7 @@ function recordShardFailure(project, error) {
       `[store] Shard circuit OPEN for "${project}" after ${state.failures} consecutive failures. Will retry in ${SHARD_CB_COOLDOWN_MS / 6e4}min. Last error: ${error}
 `
     );
-    void import("./orchestration-events-RDW7BTCK.js").then(({ recordOrchestrationEventBestEffort }) => {
+    void import("./orchestration-events-7XAYQ2MT.js").then(({ recordOrchestrationEventBestEffort }) => {
       recordOrchestrationEventBestEffort({
         eventType: "shard.circuit_open",
         source: "store.recordShardFailure",
@@ -162,7 +162,7 @@ async function initStore(options) {
     );
     _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
     try {
-      const { loadGlobalProcedures } = await import("./global-procedures-EYWKFVOO.js");
+      const { loadGlobalProcedures } = await import("./global-procedures-74U75Y2I.js");
       await loadGlobalProcedures();
     } catch (e) {
       logStoreWarn("catch", e);
@@ -289,7 +289,7 @@ async function writeMemory(record) {
     keywords: record.keywords ?? keywordsToString(extractKeywords(record.raw_text))
   };
   try {
-    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-UXB75NB7.js");
+    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-KBBWI6ZL.js");
     const poisonResult = await checkMemoryPoisoning({
       memoryId: dbRow.id,
       vector: Array.isArray(dbRow.vector) ? dbRow.vector : void 0,
@@ -475,19 +475,19 @@ async function flushBatch() {
     }
     _nextVersion = baseVersion;
     try {
-      const { insertMemoryCardsForBatch } = await import("./memory-cards-I55OBMVE.js");
+      const { insertMemoryCardsForBatch } = await import("./memory-cards-HU5WIUTY.js");
       await insertMemoryCardsForBatch(batch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { insertOntologyForBatch } = await import("./agentic-ontology-CHAWPTEY.js");
+      const { insertOntologyForBatch } = await import("./agentic-ontology-VZWBROYO.js");
       await insertOntologyForBatch(batch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { extractGraphForBatch } = await import("./memory-graph-extractor-6M6J5FNX.js");
+      const { extractGraphForBatch } = await import("./memory-graph-extractor-PNRAGL4V.js");
       await extractGraphForBatch(batch);
     } catch (e) {
       logStoreWarn("catch", e);

package/dist/{chunk-YJNRRQOG.js → chunk-ILTZBCLW.js}

@@ -859,7 +859,7 @@ function formatReport(report, flags) {
   return lines.join("\n");
 }
 async function fixNullVectors() {
-  const { tryAcquireWorkerSlot, registerWorkerPid } = await import("./worker-gate-K5YTO2H5.js");
+  const { tryAcquireWorkerSlot, registerWorkerPid } = await import("./worker-gate-WQV3FR4R.js");
   if (!tryAcquireWorkerSlot()) {
     process.stderr.write("[exe-doctor] Worker gate full \u2014 waiting for existing backfill workers to finish\n");
     await new Promise((r) => setTimeout(r, 5e3));
@@ -982,7 +982,7 @@ function splitAtSentences(text, maxChunkSize) {
 }
 async function main(argv = process.argv.slice(2)) {
   const flags = parseFlags(argv);
-  const { fastDbInit } = await import("./fast-db-init-5VDTKVKX.js");
+  const { fastDbInit } = await import("./fast-db-init-6DG7B7NO.js");
   const client = await fastDbInit();
   const report = await runAudit(client, flags);
   console.log(formatReport(report, flags));

package/dist/{chunk-SDQSOQOE.js → chunk-JEBWC4VU.js}

@@ -1,6 +1,6 @@
 import {
   sessionScopeFilter
-} from "./chunk-HW46Q4AR.js";
+} from "./chunk-DZE2MBOW.js";
 
 // src/lib/git-task-sweep.ts
 import { execSync } from "child_process";
@@ -178,7 +178,7 @@ async function sweepTasks(projectName, options = {}) {
     }
     if (!dryRun) {
       try {
-        const { updateTaskStatus } = await import("./tasks-crud-RIUHZJGR.js");
+        const { updateTaskStatus } = await import("./tasks-crud-AVVOQKZY.js");
         await updateTaskStatus({
           taskId: task.id,
           status: "needs_review",

package/dist/{chunk-7X6QKJGM.js → chunk-JHEABI3I.js}

@@ -13,7 +13,7 @@ import {
 import {
   createCRMWebhookHandler,
   parseTwentyWebhook
-} from "./chunk-S2T7CE4P.js";
+} from "./chunk-BMRLKOGT.js";
 import {
   WhatsAppAdapter
 } from "./chunk-ECSNSHZ7.js";
@@ -49,7 +49,7 @@ import {
   retryWithBackoff,
   routeMessage,
   validateGatewayConfig
-} from "./chunk-T43SC2XX.js";
+} from "./chunk-FJQPH2W3.js";
 import {
   getAccountByName,
   getAccountByPhoneNumberId,

package/dist/{chunk-R2MZDZTQ.js → chunk-JUWC7V2I.js}

@@ -4,13 +4,13 @@ import {
   resolveExeSession,
   sendIntercom,
   strictSessionScopeFilter
-} from "./chunk-HW46Q4AR.js";
+} from "./chunk-DZE2MBOW.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-HURS5JVX.js";
+} from "./chunk-BCREJ6FD.js";
 import {
   getClient
-} from "./chunk-4GXXYDNU.js";
+} from "./chunk-3XGZAFHE.js";
 
 // src/lib/messaging.ts
 import crypto from "crypto";

package/dist/{chunk-6I7O6YW3.js → chunk-OM3CETSN.js}

@@ -1,6 +1,6 @@
 import {
   isCrdtSyncEnabled
-} from "./chunk-WRVFZ433.js";
+} from "./chunk-QSWZI7NH.js";
 import {
   decryptSyncBlob,
   encryptSyncBlob,
@@ -12,7 +12,7 @@ import {
   loadEmployees,
   registerBinSymlinks,
   saveEmployees
-} from "./chunk-4GXXYDNU.js";
+} from "./chunk-3XGZAFHE.js";
 import {
   loadDeviceId
 } from "./chunk-72DJ42IE.js";
@@ -489,7 +489,7 @@ async function cloudSync(config) {
   let pulled = 0;
   if (pullResult.records.length > 0) {
     if (isCrdtSyncEnabled()) {
-      const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-TSO4O67N.js");
+      const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-KFPZWAIE.js");
       initCrdtDoc();
       importExistingMemories(
         pullResult.records.map((rec) => ({

package/dist/{chunk-WEJ45ZFF.js → chunk-PBI526CO.js}

@@ -1,9 +1,9 @@
 import {
   sendMessage
-} from "./chunk-R2MZDZTQ.js";
+} from "./chunk-JUWC7V2I.js";
 import {
   getActiveAgent
-} from "./chunk-S4I3UITZ.js";
+} from "./chunk-BXLA6CQM.js";
 
 // src/mcp/tools/send-message.ts
 import { z } from "zod";

package/dist/{chunk-I22ZH3XF.js → chunk-PXO6SF6L.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-4GXXYDNU.js";
+} from "./chunk-3XGZAFHE.js";
 
 // src/lib/reminders.ts
 import crypto from "crypto";

package/dist/{chunk-B7NO5U7H.js → chunk-Q4GGIM3A.js}

@@ -1,6 +1,6 @@
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-HURS5JVX.js";
+} from "./chunk-BCREJ6FD.js";
 
 // src/lib/session-registry.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";

package/dist/{chunk-I6474EQW.js → chunk-QG6IPAT6.js}

@@ -1,6 +1,6 @@
 import {
   createReminder
-} from "./chunk-I22ZH3XF.js";
+} from "./chunk-PXO6SF6L.js";
 
 // src/mcp/tools/create-reminder.ts
 import { z } from "zod";

package/dist/{chunk-NO5GHSNU.js → chunk-QPU5QQLX.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GNHN5HRQ.js";
 import {
   buildClaudeHttpMcpEntry
-} from "./chunk-S5TTV7PC.js";
+} from "./chunk-A24RUKU6.js";
 import {
   EXE_HOOKS,
   isLegacyHomeDirHookCommand,
@@ -11,7 +11,7 @@ import {
 } from "./chunk-L3TB7CC3.js";
 import {
   ensureAllAgentSymlinks
-} from "./chunk-5QKUR5KS.js";
+} from "./chunk-4UHKYQZJ.js";
 import {
   MCP_LEGACY_KEY,
   MCP_PRIMARY_KEY
@@ -864,6 +864,7 @@ function setupTmux(home) {
   const userTmuxConf = path.join(homeDir, ".tmux.conf");
   const backupPath = path.join(homeDir, ".tmux.conf.backup");
   const sourceLine = "source-file ~/.exe-os/tmux.conf";
+  const shellQuote = (value) => `'${value.replace(/'/g, "'\\''")}'`;
   const pkgRoot = resolvePackageRoot();
   const assetPath = path.join(pkgRoot, "dist", "assets", "tmux.conf");
   if (!existsSync(assetPath)) {
@@ -913,7 +914,7 @@ ${sourceLine}
 `);
   }
   try {
-    execSync(`tmux source-file ${exeTmuxConf} 2>/dev/null`);
+    execSync(`tmux source-file ${shellQuote(userTmuxConf)} 2>/dev/null`);
   } catch {
   }
   process.stderr.write("exe-os: tmux config installed\n");

package/dist/{chunk-4ANCHFE2.js → chunk-R6JBGFSE.js}

@@ -111,7 +111,7 @@ function releaseBackfillLock() {
 }
 async function getTaskAwareCapacity() {
   const { getClient } = await import("./lib/database.js");
-  const { sessionScopeFilter } = await import("./task-scope-ODSOEGTH.js");
+  const { sessionScopeFilter } = await import("./task-scope-NM2C2QZX.js");
   const client = getClient();
   const scope = sessionScopeFilter();
   const result = await client.execute({

package/dist/{chunk-ALVYUOBW.js → chunk-RQJDO6LP.js}

@@ -1,6 +1,6 @@
 import {
   getGlobalProceduresBlock
-} from "./chunk-JXJV64JW.js";
+} from "./chunk-D7DRYXDE.js";
 
 // src/lib/employee-templates.ts
 var BASE_OPERATING_PROCEDURES = `

package/dist/{chunk-BFLBZGPZ.js → chunk-S5KQLCYU.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-4GXXYDNU.js";
+} from "./chunk-3XGZAFHE.js";
 
 // src/lib/behaviors.ts
 import crypto from "crypto";

package/dist/{chunk-NUUAYDD6.js → chunk-SRJLG6RC.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-4GXXYDNU.js";
+} from "./chunk-3XGZAFHE.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-O6LFXATW.js → chunk-SURCM7EO.js}

@@ -1,6 +1,6 @@
 import {
   routeTask
-} from "./chunk-NUUAYDD6.js";
+} from "./chunk-SRJLG6RC.js";
 import {
   createTaskCore,
   employeeSessionName,
@@ -9,11 +9,11 @@ import {
   isEmployeeAlive,
   sessionScopeFilter,
   updateTaskStatus
-} from "./chunk-HW46Q4AR.js";
+} from "./chunk-DZE2MBOW.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   getCoordinatorName
-} from "./chunk-4GXXYDNU.js";
+} from "./chunk-3XGZAFHE.js";
 
 // src/runtime/orchestrator.ts
 var STALE_THRESHOLD_MS = 2 * 60 * 60 * 1e3;

package/dist/{chunk-CIANVJ3G.js → chunk-UVUA2DQM.js}

@@ -61,7 +61,7 @@ async function rollbackStackUpdate(options) {
   }
   writeFileSync(options.envFile, readFileSync(rollbackEnv), { mode: 384 });
   const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
-  exec("docker", [...composeArgs, "up", "-d"]);
+  exec("docker", [...composeArgs, "up", "-d", "--remove-orphans"]);
   return { status: "rolled_back", targetVersion: "previous", changes: [], backupEnvFile: rollbackEnv, lockFile: options.lockFile ?? path.join(path.dirname(options.envFile), ".exe-stack-lock.json") };
 }
 function parseStackManifest(raw, publicKey) {
@@ -414,6 +414,11 @@ function bootstrapStackHost(options) {
   }
   copyTemplateIfMissing("deploy/compose/docker-compose.yml", options.composeFile, createdFiles);
   copyTemplateIfMissing("deploy/compose/.env.customer.example", options.envFile, createdFiles);
+  copyTemplateIfMissing(
+    "deploy/compose/clickhouse-config.xml",
+    path.join(path.dirname(options.envFile), "clickhouse-config.xml"),
+    createdFiles
+  );
   const brandingDest = path.join(path.dirname(options.envFile), "branding.json");
   copyTemplateIfMissing("deploy/compose/gateway.json", path.join(path.dirname(options.envFile), "gateway.json"), createdFiles);
   if (!existsSync(brandingDest)) writeFileSync(brandingDest, JSON.stringify({ brandName: "Hygo", productName: "Hygo OS" }, null, 2) + "\n", { mode: 384 });
@@ -471,7 +476,8 @@ function areStackContainersRunning(composeFile, envFile) {
 }
 var CRITICAL_BIND_MOUNTS = [
   { file: ".env", description: "secrets and image tags" },
-  { file: "gateway.json", description: "gateway connector config" }
+  { file: "gateway.json", description: "gateway connector config" },
+  { file: "clickhouse-config.xml", description: "ClickHouse memory/log guardrails" }
 ];
 var CRITICAL_VOLUMES = [
   "postgres_data",
@@ -509,6 +515,44 @@ function assertVolumesIntact() {
     console.warn("[stack-update] Data may have been lost. Check if 'docker compose down -v' was used.");
   }
 }
+function warnLegacyDaemonVolume() {
+  const legacy = spawnSync("docker", ["volume", "inspect", "exe-os_exed_data"], {
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 5e3
+  });
+  const current = spawnSync("docker", ["volume", "inspect", "exe-os_exe_os_data"], {
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 5e3
+  });
+  if (legacy.status === 0 && current.status === 0) {
+    console.warn("[stack-update] \u26A0 Legacy volume exe-os_exed_data exists alongside exe-os_exe_os_data.");
+    console.warn("[stack-update] Keeping both volumes intact; after verifying exe_os_data has current daemon state, remove exed_data manually if desired.");
+  }
+}
+function applyPostgresInitSql(composeArgs, envFile, composeFile, exec) {
+  const initSql = path.join(path.dirname(composeFile), "init-db.sql");
+  if (!existsSync(initSql)) return;
+  const env = parseEnv(readFileSync(envFile, "utf8"));
+  const postgresUser = env.get("POSTGRES_USER") || "exe";
+  const postgresDb = env.get("POSTGRES_DB") || "exedb";
+  console.log("[stack-update] Applying idempotent Postgres init SQL for existing volumes...");
+  exec("docker", [
+    ...composeArgs,
+    "exec",
+    "-T",
+    "exe-db",
+    "psql",
+    "-v",
+    "ON_ERROR_STOP=1",
+    "-U",
+    postgresUser,
+    "-d",
+    postgresDb,
+    "-f",
+    "/docker-entrypoint-initdb.d/01-init.sql"
+  ]);
+  console.log("[stack-update] \u2713 Postgres init SQL applied");
+}
 async function runStackUpdate(options) {
   const exec = options.exec ?? defaultExec;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
@@ -518,6 +562,7 @@ async function runStackUpdate(options) {
     if (!options.dryRun) assertHostReadyForApply(report);
   }
   assertBindMountsExist(path.dirname(options.envFile));
+  warnLegacyDaemonVolume();
   if (!options.dryRun) {
     try {
       const { runPreflight } = await import("./preflight-EAH2MI76.js");
@@ -587,7 +632,7 @@ async function runStackUpdate(options) {
   mkdirSync(updateBackupDir, { recursive: true });
   const backupEnvFile = path.join(updateBackupDir, "env.bak");
   writeFileSync(backupEnvFile, envRaw, { mode: 384 });
-  const protectedFiles = ["gateway.json", "branding.json"];
+  const protectedFiles = ["gateway.json", "branding.json", "clickhouse-config.xml"];
   for (const f of protectedFiles) {
     const src = path.join(stackDir, f);
     try {
@@ -690,9 +735,11 @@ async function runStackUpdate(options) {
     const RESTART_ORDER = [
       "exe-db",
       // data layer — must be healthy before apps
+      "gotrue",
+      // auth — depends on idempotent init-db.sql applied after exe-db
       "clickhouse",
       "redis",
-      "exed",
+      "exe-os",
       // daemon — has its own health endpoint
       "exe-crm",
       // CRM app
@@ -706,6 +753,7 @@ async function runStackUpdate(options) {
     const preSnapshot = spawnSync("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
     const preContainerCount = preSnapshot.stdout?.split("\n").filter(Boolean).length ?? 0;
     console.log(`[stack-update] Pre-update snapshot: ${preContainerCount} containers`);
+    let restartedAnyService = false;
     for (const service of RESTART_ORDER) {
       const psResult = spawnSync("docker", [...composeArgs, "ps", "--quiet", service], {
         encoding: "utf8",
@@ -713,7 +761,8 @@ async function runStackUpdate(options) {
         timeout: 1e4
       });
       if (psResult.status !== 0) continue;
-      exec("docker", [...composeArgs, "up", "-d", "--no-deps", service]);
+      exec("docker", [...composeArgs, "up", "-d", "--remove-orphans", "--no-deps", service]);
+      restartedAnyService = true;
       const maxWait = 60;
       let healthy = false;
       for (let i = 0; i < maxWait; i++) {
@@ -736,8 +785,14 @@ async function runStackUpdate(options) {
       if (!healthy) {
         throw new Error(`Service ${service} failed health check after ${maxWait}s \u2014 aborting update`);
       }
+      if (service === "exe-db") {
+        applyPostgresInitSql(composeArgs, options.envFile, options.composeFile, exec);
+      }
       console.log(`[stack-update] \u2713 ${service} restarted and healthy`);
     }
+    if (!restartedAnyService) {
+      exec("docker", [...composeArgs, "up", "-d", "--remove-orphans"]);
+    }
     const postSnapshot = spawnSync("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
     const postContainerCount = postSnapshot.stdout?.split("\n").filter(Boolean).length ?? 0;
     console.log(`[stack-update] Post-update snapshot: ${postContainerCount} containers (was ${preContainerCount})`);
@@ -785,7 +840,7 @@ async function runStackUpdate(options) {
   } catch (err) {
     writeFileSync(options.envFile, envRaw, { mode: 384 });
     try {
-      exec("docker", [...composeArgs, "up", "-d"]);
+      exec("docker", [...composeArgs, "up", "-d", "--remove-orphans"]);
     } catch {
     }
     const reason = err instanceof Error ? err.message : String(err);