@askexenow/exe-os 0.9.239 → 0.9.243

package/dist/{chunk-F4TCKCKK.js → chunk-ITZVPCBQ.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-D5C56WO3.js";
+} from "./chunk-MOZ2YQ54.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";
@@ -350,6 +350,7 @@ function hydrateEnv(raw, opts) {
     if (!/CHANGEME/.test(value)) continue;
     if (key === "EXE_LICENSE_KEY" && license) replacements[key] = license;
     else if (key === "MONITOR_AGENT_TOKEN" || key === "MONITOR_AGENT_KEY") continue;
+    else if (key === "CLOUDFLARE_TUNNEL_TOKEN") continue;
     else if (key === "EXE_GATEWAY_WS_RELAY_AUTH_TOKEN") replacements[key] = randomHexSecret(24);
     else if (key.endsWith("_PASSWORD")) replacements[key] = randomSecret(24);
     else if (key.endsWith("_TOKEN")) replacements[key] = randomHexSecret(32);
@@ -414,6 +415,11 @@ function bootstrapStackHost(options) {
   }
   copyTemplateIfMissing("deploy/compose/docker-compose.yml", options.composeFile, createdFiles);
   copyTemplateIfMissing("deploy/compose/.env.customer.example", options.envFile, createdFiles);
+  copyTemplateIfMissing(
+    "deploy/compose/init-db.sql",
+    path.join(path.dirname(options.composeFile), "init-db.sql"),
+    createdFiles
+  );
   copyTemplateIfMissing(
     "deploy/compose/clickhouse-config.xml",
     path.join(path.dirname(options.envFile), "clickhouse-config.xml"),
@@ -422,6 +428,11 @@ function bootstrapStackHost(options) {
   const brandingDest = path.join(path.dirname(options.envFile), "branding.json");
   copyTemplateIfMissing("deploy/compose/gateway.json", path.join(path.dirname(options.envFile), "gateway.json"), createdFiles);
   if (!existsSync(brandingDest)) writeFileSync(brandingDest, JSON.stringify({ brandName: "Hygo", productName: "Hygo OS" }, null, 2) + "\n", { mode: 384 });
+  copyTemplateIfMissing(
+    "deploy/compose/cloudflared/config.yml.example",
+    path.join(path.dirname(options.composeFile), "cloudflared", "config.yml.example"),
+    createdFiles
+  );
   let envHadPlaceholders = false;
   let envRemainingPlaceholders = [];
   if (existsSync(options.envFile)) {
@@ -458,7 +469,7 @@ function assertHostReadyForApply(report) {
   if (!report.composeFileExists) blockers.push("docker-compose.yml is missing and could not be created.");
   if (!report.envFileExists) blockers.push(".env is missing and could not be created.");
   if (!report.licensePresent) blockers.push("Exe OS license key is missing. Run `exe-os setup`, `exe-os --activate <key>`, or pass --license-key.");
-  const hardPlaceholders = report.envRemainingPlaceholders.filter((p) => !/WHATSAPP|API_ROUTER|MONITOR_AGENT/.test(p));
+  const hardPlaceholders = report.envRemainingPlaceholders.filter((p) => !/WHATSAPP|API_ROUTER|MONITOR_AGENT|CLOUDFLARE_TUNNEL_TOKEN/.test(p));
   if (hardPlaceholders.length > 0) blockers.push(`Required .env placeholders remain: ${hardPlaceholders.join(", ")}`);
   if (blockers.length > 0) throw new Error(`Stack host is not ready:
 - ${blockers.join("\n- ")}`);
@@ -565,8 +576,10 @@ async function runStackUpdate(options) {
   warnLegacyDaemonVolume();
   if (!options.dryRun) {
     try {
-      const { runPreflight } = await import("./preflight-EAH2MI76.js");
-      const preflightReport = runPreflight({
+      if (!options.preflight) {
+        throw new Error("preflight hook not provided");
+      }
+      const preflightReport = options.preflight({
         composeFile: options.composeFile,
         envFile: options.envFile
       });
@@ -620,8 +633,10 @@ async function runStackUpdate(options) {
   }
   await postDeployAudit(options, "started", plan.targetVersion, previousVersion);
   try {
-    const { preDeployBackup } = await import("./bin/vps-backup.js");
-    preDeployBackup(plan.targetVersion);
+    if (!options.preDeployBackup) {
+      throw new Error("preDeployBackup hook not provided");
+    }
+    options.preDeployBackup(plan.targetVersion);
   } catch {
   }
   const stackDir = path.dirname(options.envFile);
@@ -755,8 +770,10 @@ async function runStackUpdate(options) {
       // ERP WebSocket (Socket.io)
       "exe-erp-queue",
       // ERP background workers (RQ)
-      "exe-erp-scheduler"
+      "exe-erp-scheduler",
       // ERP scheduled tasks
+      "cloudflared"
+      // tunnel — restarted last so services are healthy before it connects
     ];
     const preSnapshot = spawnSync("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
     const preContainerCount = preSnapshot.stdout?.split("\n").filter(Boolean).length ?? 0;
@@ -809,9 +826,11 @@ async function runStackUpdate(options) {
     }
     await verifyReleaseHealth(plan.release, options.healthRetries ?? 12, options.healthDelayMs ?? 5e3);
     try {
-      const { runHealthGate, logResult } = await import("./bin/vps-health-gate.js");
-      const gateResult = await runHealthGate();
-      logResult(gateResult);
+      if (!options.healthGate) {
+        throw new Error("healthGate hook not provided");
+      }
+      const gateResult = await options.healthGate();
+      options.logHealthGateResult?.(gateResult);
       if (!gateResult.passed) {
         const failed = gateResult.results.filter((r) => r.status === "fail").map((r) => r.check);
         throw new Error(`Health gate failed: ${failed.join(", ")}`);
@@ -825,8 +844,10 @@ async function runStackUpdate(options) {
     }
     assertVolumesIntact();
     try {
-      const { runVerifyStack } = await import("./bin/verify-stack.js");
-      const verifyReport = await runVerifyStack({ composeFile: options.composeFile, envFile: options.envFile });
+      if (!options.verifyStack) {
+        throw new Error("verifyStack hook not provided");
+      }
+      const verifyReport = await options.verifyStack({ composeFile: options.composeFile, envFile: options.envFile });
       for (const r of verifyReport.results) {
         if (r.status === "fail") console.warn(`[verify-stack] FAIL: ${r.check}: ${r.message}`);
       }

package/dist/{chunk-4HROS3GJ.js → chunk-IZVKWBIP.js}

@@ -1,6 +1,6 @@
 import {
   redactSecrets
-} from "./chunk-F7LU65PQ.js";
+} from "./chunk-Y25OJWOQ.js";
 
 // src/lib/memory-write-governor.ts
 import { createHash } from "crypto";

package/dist/{chunk-DKI5BTBC.js → chunk-J7V7LPPX.js}

@@ -1,6 +1,6 @@
 import {
   sessionScopeFilter
-} from "./chunk-HNLPLLE6.js";
+} from "./chunk-F7JLZXHC.js";
 
 // src/lib/git-task-sweep.ts
 import { execSync } from "child_process";
@@ -178,7 +178,7 @@ async function sweepTasks(projectName, options = {}) {
     }
     if (!dryRun) {
       try {
-        const { updateTaskStatus } = await import("./tasks-crud-JXZEBZFR.js");
+        const { updateTaskStatus } = await import("./tasks-crud-DQOG2NPG.js");
         await updateTaskStatus({
           taskId: task.id,
           status: "needs_review",

package/dist/{chunk-TOZ5NN5V.js → chunk-JLKUVK5J.js}

@@ -1,6 +1,6 @@
 import {
   getGlobalProceduresBlock
-} from "./chunk-GN5VHPPR.js";
+} from "./chunk-NVZR7T4E.js";
 
 // src/lib/employee-templates.ts
 var BASE_OPERATING_PROCEDURES = `

package/dist/{chunk-4SC65UBG.js → chunk-JLNXKG3K.js}

@@ -1,6 +1,6 @@
 import {
   loadEmployees
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/agent-symlinks.ts
 import os from "os";

package/dist/{chunk-KVSQOG3W.js → chunk-K2BDE2B5.js}

@@ -1,13 +1,13 @@
 import {
   deactivateBehavior
-} from "./chunk-UAFUGPKO.js";
+} from "./chunk-ONAQAL3O.js";
 import {
   getActiveAgent
-} from "./chunk-RA2RO27E.js";
+} from "./chunk-MCESA5UW.js";
 import {
   canCoordinate,
   getClient
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/mcp/tools/deactivate-behavior.ts
 import { z } from "zod";
@@ -24,7 +24,7 @@ function registerDeactivateBehavior(server) {
     async ({ behavior_id }) => {
       const caller = getActiveAgent();
       try {
-        const { StewardGate } = await import("./steward-gate-7DWYS5AT.js");
+        const { StewardGate } = await import("./steward-gate-L7DJMF4C.js");
         const steward = new StewardGate();
         const gateDecision = await steward.checkAuthority(caller.agentId || "unknown", "deactivate_behavior", behavior_id);
         if (!gateDecision.allowed) {

package/dist/{chunk-KDJRFJDL.js → chunk-K333WOW4.js}

@@ -1,6 +1,6 @@
 // src/lib/keychain.ts
 import { readFile, writeFile, unlink, mkdir, chmod, rename, copyFile } from "fs/promises";
-import { existsSync, statSync, writeFileSync, readFileSync } from "fs";
+import { existsSync, statSync, writeFileSync, readFileSync, readdirSync } from "fs";
 import { execSync, execFileSync, spawnSync } from "child_process";
 import crypto from "crypto";
 import path from "path";
@@ -17,7 +17,35 @@ function warnPlaintextFallback() {
 var LEGACY_SERVICE = "exe-mem";
 var ACCOUNT = "master-key";
 function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
+  if (process.env.EXE_OS_DIR) return process.env.EXE_OS_DIR;
+  if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
+  const homeDir = os.homedir();
+  const defaultDir = path.join(homeDir, ".exe-os");
+  if (process.getuid?.() === 0) {
+    const sudoUser = process.env.SUDO_USER ?? "";
+    if (sudoUser) {
+      try {
+        const sudoHome = execSync(`getent passwd ${sudoUser} | cut -d: -f6`, { encoding: "utf8", timeout: 3e3 }).trim();
+        const sudoDir = path.join(sudoHome, ".exe-os");
+        if (existsSync(sudoDir)) return sudoDir;
+      } catch {
+      }
+    }
+    try {
+      if (existsSync("/home")) {
+        const candidates = [];
+        for (const user of readdirSync("/home")) {
+          const candidate = path.join("/home", user, ".exe-os");
+          if (existsSync(path.join(candidate, "master.key")) || existsSync(path.join(candidate, "config.json"))) {
+            candidates.push(candidate);
+          }
+        }
+        if (candidates.length === 1) return candidates[0];
+      }
+    } catch {
+    }
+  }
+  return defaultDir;
 }
 function getKeyPath() {
   return path.join(getKeyDir(), "master.key");

package/dist/{chunk-6LBCUA2A.js → chunk-KEZXW3RP.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentSessionScope,
   strictSessionScopeFilter
-} from "./chunk-HNLPLLE6.js";
+} from "./chunk-F7JLZXHC.js";
 import {
   getProjectName
 } from "./chunk-OPU3NYOO.js";

package/dist/{chunk-W7G3GY4I.js → chunk-KLQI7QY4.js}

@@ -1,9 +1,9 @@
 import {
   fastDbInit
-} from "./chunk-H42LEGLB.js";
+} from "./chunk-AQBEG33D.js";
 import {
   sessionScopeFilter
-} from "./chunk-HNLPLLE6.js";
+} from "./chunk-F7JLZXHC.js";
 import {
   formatStatusAll,
   formatStatusDeep,
@@ -14,7 +14,7 @@ import {
   getClient,
   isCoordinatorRole,
   loadEmployees
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";

package/dist/{chunk-UODVZGBQ.js → chunk-KN7LPTIB.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/mcp-transport-health.ts
 import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, writeFileSync } from "fs";

package/dist/{chunk-ESKBZN4Q.js → chunk-L4WRH3DL.js}

@@ -1,6 +1,6 @@
 import {
   loadConfigSync
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/push-notifications.ts
 import { execSync } from "child_process";

package/dist/{chunk-VFQKKMKE.js → chunk-LAOB5BKV.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/worker-gate.ts
 import { readdirSync, writeFileSync, unlinkSync, mkdirSync, existsSync, readFileSync } from "fs";
@@ -111,7 +111,7 @@ function releaseBackfillLock() {
 }
 async function getTaskAwareCapacity() {
   const { getClient } = await import("./lib/database.js");
-  const { sessionScopeFilter } = await import("./task-scope-YHALISIB.js");
+  const { sessionScopeFilter } = await import("./task-scope-R3XKBIHL.js");
   const client = getClient();
   const scope = sessionScopeFilter();
   const result = await client.execute({

package/dist/{chunk-MAN5LZQ4.js → chunk-LQSFP2BV.js}

@@ -1,6 +1,6 @@
 import {
   processCRMEvent
-} from "./chunk-AU5426YP.js";
+} from "./chunk-B7JGEDVE.js";
 
 // src/gateway/adapters/crm-webhook.ts
 function parseTwentyWebhook(payload) {

package/dist/{chunk-EJ7LOTV2.js → chunk-LSFHEMVI.js}

@@ -3,30 +3,30 @@ import {
 } from "./chunk-MLXJ5EZG.js";
 import {
   createTask
-} from "./chunk-5R75ODPS.js";
+} from "./chunk-NBY6R37W.js";
 import {
   getActiveAgent
-} from "./chunk-RA2RO27E.js";
+} from "./chunk-MCESA5UW.js";
 import {
   ensureEmployee,
   logTaskDispatch,
   resolveExeSession
-} from "./chunk-HNLPLLE6.js";
+} from "./chunk-F7JLZXHC.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-5NJ4A4ZA.js";
+} from "./chunk-HCBMPZDT.js";
 import {
   getAgentRuntime
-} from "./chunk-6OJJF4WP.js";
+} from "./chunk-XJUUWHVN.js";
 import {
   getLicenseSync
-} from "./chunk-IQSCZDBQ.js";
+} from "./chunk-I5PIBL56.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/mcp/tools/create-task.ts
 import { z } from "zod";
@@ -275,7 +275,7 @@ function registerCreateTask(server) {
           session_scope: sessionScope,
           created_at: (/* @__PURE__ */ new Date()).toISOString()
         }), "utf-8");
-        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-IYTASMSN.js");
+        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-25WEKUKH.js");
         recordOE({
           eventType: "signal.created",
           source: "create-task.mcp",
@@ -307,7 +307,7 @@ function registerCreateTask(server) {
             let projectConflictOpts = {};
             try {
               const { getClient } = await import("./lib/database.js");
-              const { sessionScopeFilter } = await import("./task-scope-YHALISIB.js");
+              const { sessionScopeFilter } = await import("./task-scope-R3XKBIHL.js");
               const client = getClient();
               const scope = sessionScopeFilter(task.sessionScope || callerRoot || exeSession || null);
               const existing = await client.execute({

package/dist/{chunk-RA2RO27E.js → chunk-MCESA5UW.js}

@@ -9,10 +9,10 @@ import {
   getCoordinatorEmployee,
   getEmployee,
   loadEmployeesSync
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/active-agent.ts
 import { readFileSync, writeFileSync, mkdirSync, unlinkSync, readdirSync } from "fs";

package/dist/{chunk-UPMHG7ET.js → chunk-MEIHREPM.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/memory-queue.ts
 import {

package/dist/{chunk-D5C56WO3.js → chunk-MOZ2YQ54.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/license.ts
 import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from "fs";

package/dist/{chunk-CLGB3FGL.js → chunk-MPX3TRMQ.js}

@@ -1,12 +1,12 @@
 import {
   extractSemanticText
-} from "./chunk-SUNYJ6YE.js";
+} from "./chunk-VT2B5BHM.js";
 import {
   detectError
 } from "./chunk-AHMUF6RO.js";
 import {
   redactSecrets
-} from "./chunk-F7LU65PQ.js";
+} from "./chunk-Y25OJWOQ.js";
 import {
   getProjectName
 } from "./chunk-OPU3NYOO.js";