@askexenow/exe-os 0.9.227 → 0.9.229

package/dist/bin/postgres-agentic-semantic-backfill.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+import {
+  inferSemanticLabel,
+  stableId
+} from "../chunk-WWPX2LLP.js";
+import {
+  pgSslConfig
+} from "../chunk-EQSQ4HBW.js";
+import {
+  politeBatchPause,
+  startManagedJob
+} from "../chunk-X3AVWFWW.js";
+import "../chunk-TNTFEWU5.js";
+import "../chunk-LYH5HE24.js";
+import "../chunk-R5U7XKVJ.js";
+
+// src/bin/postgres-agentic-semantic-backfill.ts
+import { Client } from "pg";
+function arg(name) {
+  const i = process.argv.indexOf(name);
+  return i >= 0 ? process.argv[i + 1] : void 0;
+}
+async function ensureSchema(client) {
+  await client.query(`CREATE TABLE IF NOT EXISTS memory.agent_semantic_labels (
+    id text PRIMARY KEY,
+    source_memory_id text NOT NULL,
+    event_id text,
+    labeler text NOT NULL,
+    schema_version integer NOT NULL DEFAULT 1,
+    confidence double precision NOT NULL DEFAULT 0,
+    labels jsonb NOT NULL,
+    created_at timestamp(3) NOT NULL,
+    updated_at timestamp(3) NOT NULL
+  )`);
+  await client.query(`CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_memory ON memory.agent_semantic_labels (source_memory_id, labeler)`);
+  await client.query(`CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_event ON memory.agent_semantic_labels (event_id)`);
+}
+function scrubJson(value) {
+  return JSON.stringify(value).replace(/\u0000/g, "").replace(/\\u0000/gi, "").replace(/\\\\u0000/gi, "").replace(/\\u00[0-1][0-9a-f]/gi, " ");
+}
+async function main() {
+  const job = startManagedJob({ type: "postgres-agentic-semantic-backfill", name: "Postgres semantic label backfill", lowPriority: true });
+  if (!job) {
+    process.stderr.write("[postgres-agentic-semantic-backfill] Another Postgres semantic backfill is already running.\n");
+    return;
+  }
+  const url = process.env.DATABASE_URL || process.env.EXED_DATABASE_URL;
+  if (!url) throw new Error("DATABASE_URL or EXED_DATABASE_URL is required");
+  const limit = Number(arg("--limit") ?? "20000");
+  const project = arg("--project");
+  const client = new Client({ connectionString: url, ...pgSslConfig() });
+  await client.connect();
+  try {
+    await ensureSchema(client);
+    const params = project ? [limit, project] : [limit];
+    const where = project ? "WHERE project_name = $2" : "";
+    const result = await client.query(`SELECT id, agent_id, agent_role, session_id, timestamp::text, tool_name,
+        project_name, has_error, raw_text, version, task_id, intent, null::text as outcome, domain, null::text as trajectory
+      FROM memory.memory_records ${where}
+      ORDER BY timestamp DESC LIMIT $1`, params);
+    let count = 0;
+    for (const row of result.rows) {
+      const label = inferSemanticLabel({ ...row, has_error: row.has_error ? 1 : 0 });
+      const eventId = stableId(`event:${row.id}`);
+      const labelJson = scrubJson(label);
+      try {
+        await client.query(`INSERT INTO memory.agent_semantic_labels
+          (id, source_memory_id, event_id, labeler, schema_version, confidence, labels, created_at, updated_at)
+          VALUES ($1,$2,$3,$4,$5,$6,to_jsonb($7::text),now(),now())
+          ON CONFLICT (id) DO UPDATE SET confidence = excluded.confidence, labels = excluded.labels,
+            updated_at = excluded.updated_at`, [
+          stableId(`semantic:${row.id}:${label.labeler}:${label.schemaVersion}`),
+          row.id,
+          eventId,
+          label.labeler,
+          label.schemaVersion,
+          label.confidence,
+          labelJson
+        ]);
+      } catch {
+        const minimal = scrubJson({
+          labeler: label.labeler,
+          schemaVersion: label.schemaVersion,
+          eventType: label.eventType,
+          intention: label.intention,
+          outcome: label.outcome,
+          impact: label.impact,
+          confidence: label.confidence,
+          goals: label.goals,
+          summary: label.summary,
+          sanitized: true
+        });
+        await client.query(`INSERT INTO memory.agent_semantic_labels
+          (id, source_memory_id, event_id, labeler, schema_version, confidence, labels, created_at, updated_at)
+          VALUES ($1,$2,$3,$4,$5,$6,$7::jsonb,now(),now())
+          ON CONFLICT (id) DO UPDATE SET confidence = excluded.confidence, labels = excluded.labels,
+            updated_at = excluded.updated_at`, [
+          stableId(`semantic:${row.id}:${label.labeler}:${label.schemaVersion}`),
+          row.id,
+          eventId,
+          label.labeler,
+          label.schemaVersion,
+          label.confidence,
+          minimal
+        ]);
+      }
+      count++;
+      if (count % 5e3 === 0) {
+        process.stderr.write(`[postgres-agentic-semantic-backfill] labeled ${count}
+`);
+        job.update({ current: count, total: limit, label: `Labeled ${count}/${limit}` });
+        await politeBatchPause(1e3);
+      }
+    }
+    process.stderr.write(`[postgres-agentic-semantic-backfill] Complete: ${count} semantic labels.
+`);
+    job.complete();
+  } finally {
+    await client.end();
+  }
+}
+main().catch((err) => {
+  process.stderr.write(`[postgres-agentic-semantic-backfill] FATAL: ${err instanceof Error ? err.message : String(err)}
+`);
+  process.exit(1);
+});

package/dist/bin/pre-build-guard.js

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+
+// src/bin/pre-build-guard.ts
+import { execSync } from "child_process";
+import { lstatSync } from "fs";
+import path from "path";
+function isSymlinked() {
+  try {
+    const npmRoot = execSync("npm root -g", { encoding: "utf8" }).trim();
+    const exeOsPath = path.join(npmRoot, "exe-os");
+    const stat = lstatSync(exeOsPath);
+    return stat.isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function countMcpProcesses() {
+  try {
+    const result = execSync("pgrep -f 'node.*mcp/server.js' || true", {
+      encoding: "utf8"
+    });
+    return result.trim().split("\n").filter(Boolean).length;
+  } catch {
+    return 0;
+  }
+}
+function isWorktree() {
+  try {
+    const gitDir = execSync("git rev-parse --git-dir 2>/dev/null", {
+      encoding: "utf8"
+    }).trim();
+    return gitDir.includes(".git/worktrees/");
+  } catch {
+    return false;
+  }
+}
+function isBlockedAgent() {
+  const agentId = process.env.AGENT_ID?.toLowerCase();
+  if (!agentId) return null;
+  const agentRole = process.env.AGENT_ROLE?.toLowerCase();
+  if (agentRole === "coo" || agentRole === "cto") return null;
+  return agentId;
+}
+function main() {
+  if (isWorktree()) {
+    console.error(
+      "\n\u{1F6AB} [exe-os] BLOCKED: Cannot run deploy from a git worktree."
+    );
+    console.error(
+      "   Deploying from a worktree re-registers all CC hooks pointing at the"
+    );
+    console.error(
+      "   worktree dist/. When the worktree is deleted, every hook breaks."
+    );
+    console.error(
+      "   Use `npm run build` only. Deploy runs from the main repo root.\n"
+    );
+    process.exit(1);
+  }
+  const blockedAgent = isBlockedAgent();
+  if (blockedAgent) {
+    console.error(
+      `
+\u{1F6AB} [exe-os] BLOCKED: Agent "${blockedAgent}" cannot run deploy.`
+    );
+    console.error(
+      "   Only the coordinator (COO) and CTO may deploy. Engineers and"
+    );
+    console.error(
+      "   specialists use `npm run build` only.\n"
+    );
+    process.exit(1);
+  }
+  if (!isSymlinked()) {
+    return;
+  }
+  const mcpCount = countMcpProcesses();
+  if (mcpCount === 0) {
+    return;
+  }
+  console.error(
+    `
+\u26A0\uFE0F  [exe-os] DEV MODE: ${mcpCount} active MCP server process(es) detected.`
+  );
+  console.error(
+    "   Rebuilding will overwrite dist/ files they reference, causing disconnections."
+  );
+  console.error(
+    "   MCP servers will auto-reconnect on the next tool call, but in-flight"
+  );
+  console.error(
+    "   operations may fail with SQLITE_BUSY during the reconnect storm."
+  );
+  console.error(
+    "   Consider: wait for idle agents, or restart the MCP server after build.\n"
+  );
+}
+main();

package/dist/bin/pre-publish.js

@@ -0,0 +1,224 @@
+#!/usr/bin/env node
+import {
+  PLATFORM_PROCEDURES
+} from "../chunk-5NFBE376.js";
+import "../chunk-R5U7XKVJ.js";
+
+// src/bin/pre-publish.ts
+import { readFileSync as readFileSync2 } from "fs";
+import path2 from "path";
+import { fileURLToPath } from "url";
+
+// src/lib/release-notes.ts
+import { spawnSync } from "child_process";
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import path from "path";
+var MAX_RELEASE_NOTE_VERSIONS = 5;
+var MAX_RELEASE_NOTE_ITEMS_PER_CATEGORY = 25;
+function trimList(items) {
+  return [...new Set(items)].slice(0, MAX_RELEASE_NOTE_ITEMS_PER_CATEGORY);
+}
+function trimReleaseNote(note) {
+  return {
+    ...note,
+    features: trimList(note.features),
+    fixes: trimList(note.fixes),
+    security: trimList(note.security),
+    other: trimList(note.other),
+    migration_notes: trimList(note.migration_notes)
+  };
+}
+function compareVersionsDesc(a, b) {
+  const parse = (version2) => version2.split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const av = parse(a);
+  const bv = parse(b);
+  const max = Math.max(av.length, bv.length);
+  for (let i = 0; i < max; i++) {
+    const diff = (bv[i] ?? 0) - (av[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+function compactReleaseNotes(data) {
+  const versions = Object.keys(data.notes).sort(compareVersionsDesc).slice(0, MAX_RELEASE_NOTE_VERSIONS);
+  const notes2 = {};
+  for (const version2 of versions) {
+    notes2[version2] = trimReleaseNote(data.notes[version2]);
+  }
+  return { current: data.current, notes: notes2 };
+}
+function git(args, cwd) {
+  const result = spawnSync("git", args, { cwd, encoding: "utf8", timeout: 1e4 });
+  return result.status === 0 ? result.stdout.trim() : "";
+}
+function categorizeCommit(message) {
+  const firstLine = message.split("\n")[0].trim();
+  const summary = firstLine.replace(/^(feat|fix|security|chore|refactor|test|docs|perf|ci|build)(\(.+?\))?:\s*/, "");
+  if (/^feat/i.test(firstLine)) return { category: "features", summary };
+  if (/^fix/i.test(firstLine)) return { category: "fixes", summary };
+  if (/^security/i.test(firstLine) || /security/i.test(summary)) return { category: "security", summary };
+  if (/^(chore|refactor|test|docs|perf|ci|build)/i.test(firstLine)) return { category: "other", summary };
+  return { category: "other", summary };
+}
+function generateReleaseNotes(repoRoot2, currentVersion) {
+  const tags = git(["tag", "--sort=-v:refname", "--list", "v*"], repoRoot2).split("\n").filter(Boolean);
+  const currentTag = `v${currentVersion}`;
+  const prevTag = tags.find((t) => t !== currentTag) ?? "";
+  const range = prevTag ? `${prevTag}..HEAD` : "HEAD~50..HEAD";
+  const log = git(["log", range, "--oneline", "--no-merges", "--format=%s"], repoRoot2);
+  const commits = log.split("\n").filter(Boolean);
+  const note = {
+    version: currentVersion,
+    date: (/* @__PURE__ */ new Date()).toISOString().split("T")[0],
+    features: [],
+    fixes: [],
+    security: [],
+    other: [],
+    migration_notes: []
+  };
+  for (const msg of commits) {
+    const { category, summary } = categorizeCommit(msg);
+    if (summary && !note[category].includes(summary)) {
+      note[category].push(summary);
+    }
+  }
+  const fullLog = git(["log", range, "--no-merges", "--format=%B---END---"], repoRoot2);
+  const fullMessages = fullLog.split("---END---").filter(Boolean);
+  for (const body of fullMessages) {
+    const lines = body.split("\n");
+    for (const line of lines) {
+      const trimmed = line.trim();
+      const migMatch = trimmed.match(/^(?:MIGRATION|BREAKING|ACTION):\s*(.+)/i);
+      if (migMatch?.[1] && !note.migration_notes.includes(migMatch[1])) {
+        note.migration_notes.push(migMatch[1]);
+      }
+    }
+  }
+  return note;
+}
+function loadReleaseNotes(repoRoot2) {
+  const filePath = path.join(repoRoot2, "release-notes.json");
+  if (existsSync(filePath)) {
+    try {
+      return JSON.parse(readFileSync(filePath, "utf8"));
+    } catch {
+      return { current: "", notes: {} };
+    }
+  }
+  return { current: "", notes: {} };
+}
+function saveReleaseNotes(repoRoot2, data) {
+  const filePath = path.join(repoRoot2, "release-notes.json");
+  writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
+}
+function updateReleaseNotes(repoRoot2, currentVersion) {
+  const data = loadReleaseNotes(repoRoot2);
+  const note = generateReleaseNotes(repoRoot2, currentVersion);
+  data.current = currentVersion;
+  data.notes[currentVersion] = trimReleaseNote(note);
+  saveReleaseNotes(repoRoot2, compactReleaseNotes(data));
+  return data.notes[currentVersion];
+}
+
+// src/lib/platform-audit.ts
+function extractToolMeta() {
+  return [
+    { name: "memory", description: "Recall, store, commit, search, consolidate memories", actions: ["recall", "ask_team", "store", "commit", "search", "session_context", "consolidate", "cardinality", "supersede"] },
+    { name: "task", description: "Create, list, get, update, close, checkpoint tasks", actions: ["create", "list", "get", "update", "close", "checkpoint", "resume"] },
+    { name: "behavior", description: "Store, list, deactivate behavioral patterns", actions: ["store", "list", "deactivate"] },
+    { name: "identity", description: "Get, update agent identities", actions: ["get", "update", "list"] },
+    { name: "message", description: "Send messages between agents", actions: ["send", "acknowledge"] },
+    { name: "reminder", description: "Create, list, complete reminders", actions: ["create", "list", "complete"] },
+    { name: "document", description: "Ingest, list, purge, rerank documents", actions: ["ingest", "list", "purge", "rerank", "set_importance"] },
+    { name: "graph", description: "Query relationships, entity neighbors, hot entities, export graph", actions: ["query_relationships", "entity_neighbors", "hot_entities", "stats", "export", "merge_entities"] },
+    { name: "wiki", description: "List and get wiki pages from exe-wiki", actions: ["list", "get"] },
+    { name: "gateway", description: "Send WhatsApp messages, query conversations", actions: ["send_whatsapp", "query_conversations"] },
+    { name: "config", description: "Manage triggers, starter packs, orchestration, skills", actions: ["create_trigger", "list_triggers", "apply_starter_pack", "load_skill", "deploy_client", "export_orchestration", "import_orchestration"] },
+    { name: "crm", description: "Read-only CRM access from exe-db", actions: ["list_people", "get_person", "list_tables", "describe_table"] },
+    { name: "raw_data", description: "Read-only access to exe-db raw events landing pad", actions: ["list_sources", "query", "get"] },
+    { name: "code_context", description: "Codebase search, trace, blast_radius with semantic vector search", actions: ["index", "index_embed", "search", "trace", "blast_radius", "stats"] },
+    { name: "decision", description: "Store and retrieve authoritative decisions by domain", actions: ["store", "get"] },
+    { name: "support", description: "File bug reports and feature requests to AskExe", actions: ["create_bug", "create_feature", "list_my_bugs", "list_my_features"] },
+    { name: "diagnostics", description: "Health checks, update status, cloud status, key management", actions: ["healthcheck", "doctor", "status_brief", "check_update", "stack_update_check", "cloud_status", "tool_search"] },
+    { name: "query_company_brain", description: "Search across VPS Company Brain: raw events, CRM, wiki, gateway conversations", actions: ["search", "list_sources", "sql"] },
+    { name: "company_actions", description: "Execute company actions through gateway connectors" },
+    { name: "company_procedure", description: "Store and manage organization-wide procedures", actions: ["store", "list", "deactivate"] }
+  ];
+}
+function isCovered(toolName, action, procedures) {
+  const searchTerms = [toolName.toLowerCase()];
+  if (action) searchTerms.push(action.toLowerCase());
+  return procedures.some((proc) => {
+    const text = (proc.title + " " + proc.content).toLowerCase();
+    return searchTerms.every((term) => text.includes(term));
+  });
+}
+function generateProcedure(tool, action) {
+  const toolLabel = action ? `${tool.name}:${action}` : tool.name;
+  const actionList = tool.actions?.join(", ") ?? "";
+  let content;
+  if (action) {
+    content = `The ${tool.name} tool supports action="${action}". ${tool.description}. Use this when you need to ${action.replace(/_/g, " ")} within the ${tool.name} domain. Available actions: ${actionList}. Call via MCP: ${tool.name}(action="${action}", ...).`;
+  } else {
+    content = `${tool.description}. ` + (actionList ? `Available actions: ${actionList}. ` : "") + `This tool is available via MCP. Use it when the task requires ${tool.name.replace(/_/g, " ")} operations.`;
+  }
+  if (content.length > 500) content = content.slice(0, 497) + "...";
+  return {
+    title: `How to use ${toolLabel}`,
+    content,
+    priority: "p2",
+    domain: "tools"
+  };
+}
+function auditPlatformProcedures() {
+  const tools = extractToolMeta();
+  const gaps2 = [];
+  for (const tool of tools) {
+    if (!isCovered(tool.name, void 0, PLATFORM_PROCEDURES)) {
+      gaps2.push({
+        toolName: tool.name,
+        description: tool.description,
+        generatedProcedure: generateProcedure(tool)
+      });
+    }
+  }
+  return gaps2;
+}
+
+// src/bin/pre-publish.ts
+var __dirname = path2.dirname(fileURLToPath(import.meta.url));
+var repoRoot = path2.resolve(__dirname, "../..");
+var pkg = JSON.parse(readFileSync2(path2.join(repoRoot, "package.json"), "utf8"));
+var version = pkg.version;
+console.log(`
+[pre-publish] exe-os v${version}
+`);
+console.log("[pre-publish] Generating release notes...");
+var notes = updateReleaseNotes(repoRoot, version);
+console.log(`  Features: ${notes.features.length}`);
+console.log(`  Fixes: ${notes.fixes.length}`);
+console.log(`  Security: ${notes.security.length}`);
+if (notes.features.length > 0) {
+  for (const f of notes.features.slice(0, 5)) console.log(`    + ${f}`);
+  if (notes.features.length > 5) console.log(`    ... and ${notes.features.length - 5} more`);
+}
+console.log("\n[pre-publish] Auditing platform procedures...");
+var gaps = auditPlatformProcedures();
+if (gaps.length === 0) {
+  console.log("  \u2713 All MCP tools have matching platform procedures.");
+} else {
+  console.log(`  \u2717 ${gaps.length} tool(s) without platform procedures:`);
+  for (const gap of gaps) {
+    console.log(`    - ${gap.toolName}: ${gap.description}`);
+    console.log(`      Suggested: "${gap.generatedProcedure.title}"`);
+  }
+  console.log("\n  These tools ship without COO instructions.");
+  console.log("  Add procedures to platform-procedures.ts before publish.");
+}
+console.log("\n[pre-publish] Release summary:");
+console.log(`  Features: ${notes.features.length}, Fixes: ${notes.fixes.length}, Security: ${notes.security.length}`);
+if (notes.migration_notes.length > 0) {
+  console.log(`  \u26A0 Migration notes: ${notes.migration_notes.length}`);
+  for (const m of notes.migration_notes) console.log(`    \u2192 ${m}`);
+}
+console.log("\n[pre-publish] Done.\n");

package/dist/bin/registry-proxy.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import {
+  registryProxyOptionsFromEnv,
+  runRegistryProxy
+} from "../chunk-SVXDCELZ.js";
+import {
+  isMainModule
+} from "../chunk-6Y4B3QF6.js";
+import "../chunk-R5U7XKVJ.js";
+
+// src/bin/registry-proxy.ts
+function printHelp() {
+  console.log(`exe-os registry-proxy \u2014 authenticated pull-through proxy for AskExe customer images
+
+Environment:
+  EXE_REGISTRY_PROXY_PORT=3201
+  EXE_REGISTRY_PROXY_HOST=0.0.0.0
+  EXE_REGISTRY_PROXY_UPSTREAM=https://ghcr.io
+  EXE_REGISTRY_PROXY_UPSTREAM_USERNAME=<github-user>
+  EXE_REGISTRY_PROXY_UPSTREAM_TOKEN=<askexe-ghcr-read-token>
+  EXE_REGISTRY_PROXY_PULL_TOKENS=<customer-token-1,customer-token-2>
+  EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE=askexe
+
+Docker image shape for clients:
+  update.askexe.com/askexe/exe-os:v0.9.3
+  update.askexe.com/askexe/exe-crm:v0.9.3
+`);
+}
+async function main(args = process.argv.slice(2)) {
+  if (args.includes("--help") || args.includes("-h")) {
+    printHelp();
+    return;
+  }
+  await runRegistryProxy(registryProxyOptionsFromEnv());
+}
+if (isMainModule(import.meta.url) && (process.argv[1] ?? "").includes("registry-proxy")) {
+  main().catch((err) => {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  });
+}
+export {
+  main
+};