@askexenow/exe-os 0.9.239 → 0.9.243

package/dist/bin/intercom-check.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   fastDbInit
-} from "../chunk-H42LEGLB.js";
+} from "../chunk-AQBEG33D.js";
 import "../chunk-MLKGABMK.js";
 
 // src/bin/intercom-check.ts
@@ -17,7 +17,7 @@ async function main() {
   }
   if (isCoordinator) {
     try {
-      const { listPendingReviews, cleanupOrphanedReviews, formatAge, isStale } = await import("../tasks-review-PGPYJQF5.js");
+      const { listPendingReviews, cleanupOrphanedReviews, formatAge, isStale } = await import("../tasks-review-XPFJ4DSJ.js");
       const { extractRootExe } = await import("../lib/tmux-routing.js");
       let sessionScope = process.env.EXE_SESSION ? extractRootExe(process.env.EXE_SESSION) ?? void 0 : void 0;
       if (!sessionScope) {
@@ -94,7 +94,7 @@ async function main() {
   }
   if (!isCoordinator) {
     try {
-      const { listBehaviors } = await import("../behaviors-6BGALYGW.js");
+      const { listBehaviors } = await import("../behaviors-BL3QCHBT.js");
       const sessionStart = process.env.EXE_SESSION_START_ISO ?? "";
       if (sessionStart) {
         const behaviors = await listBehaviors(agent);
@@ -113,7 +113,7 @@ async function main() {
     }
   }
   try {
-    const { readUnreadNotifications, markAsRead } = await import("../notifications-4P2PVEOT.js");
+    const { readUnreadNotifications, markAsRead } = await import("../notifications-P3XQZDTH.js");
     const { resolveExeSession } = await import("../lib/tmux-routing.js");
     const sessionScope = resolveExeSession();
     const notifications = await readUnreadNotifications(agent, sessionScope);

package/dist/bin/mcp-sessions.js

@@ -45,10 +45,10 @@ async function collectSessions() {
   const registryMap = new Map(registry.map((r) => [r.windowName, r]));
   const taskMap = /* @__PURE__ */ new Map();
   try {
-    const { fastDbInit } = await import("../fast-db-init-HIJWWKAO.js");
+    const { fastDbInit } = await import("../fast-db-init-YSR7RMVZ.js");
     await fastDbInit();
     const { getClient } = await import("../lib/database.js");
-    const { sessionScopeFilter } = await import("../task-scope-YHALISIB.js");
+    const { sessionScopeFilter } = await import("../task-scope-R3XKBIHL.js");
     const client = getClient();
     const scope = sessionScopeFilter();
     const result = await client.execute({

package/dist/bin/orchestration-metrics.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import {
   fastDbInit
-} from "../chunk-H42LEGLB.js";
+} from "../chunk-AQBEG33D.js";
 import {
   formatOrchestrationMetrics,
   getOrchestrationMetrics
-} from "../chunk-5NJ4A4ZA.js";
-import "../chunk-2H55BIV2.js";
-import "../chunk-WSHMBME6.js";
+} from "../chunk-HCBMPZDT.js";
+import "../chunk-CEJO7244.js";
+import "../chunk-AWRL5FGM.js";
 import "../chunk-FXU7JOXK.js";
-import "../chunk-TRZ5KA2R.js";
+import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";
 import {
   isMainModule

package/dist/bin/postgres-agentic-reflection-backfill.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import {
   buildReflectionCheckpoint
-} from "../chunk-YPYDLW75.js";
-import "../chunk-NOLIN2YI.js";
+} from "../chunk-OEMX65EA.js";
+import "../chunk-XAYRZHLV.js";
 import {
   pgSslConfig
 } from "../chunk-EQSQ4HBW.js";
 import {
   politeBatchPause,
   startManagedJob
-} from "../chunk-BRFH5X7G.js";
-import "../chunk-TRZ5KA2R.js";
+} from "../chunk-Z7VDUS6L.js";
+import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/bin/postgres-agentic-semantic-backfill.js

@@ -2,15 +2,15 @@
 import {
   inferSemanticLabel,
   stableId
-} from "../chunk-NOLIN2YI.js";
+} from "../chunk-XAYRZHLV.js";
 import {
   pgSslConfig
 } from "../chunk-EQSQ4HBW.js";
 import {
   politeBatchPause,
   startManagedJob
-} from "../chunk-BRFH5X7G.js";
-import "../chunk-TRZ5KA2R.js";
+} from "../chunk-Z7VDUS6L.js";
+import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/bin/scan-tasks.js

@@ -1,31 +1,31 @@
 #!/usr/bin/env node
 import {
   queryTaskRows
-} from "../chunk-HNLPLLE6.js";
-import "../chunk-YFE6W75D.js";
-import "../chunk-QI4IXJN7.js";
+} from "../chunk-F7JLZXHC.js";
+import "../chunk-ZKFPHJIJ.js";
+import "../chunk-5CHYEKMH.js";
 import "../chunk-4JERP7NT.js";
-import "../chunk-BZNI4OK5.js";
+import "../chunk-GHEWRYMY.js";
 import "../chunk-MVW62NIZ.js";
 import "../chunk-OYNKIAVW.js";
 import "../chunk-CX6GL3ZJ.js";
-import "../chunk-5NJ4A4ZA.js";
-import "../chunk-6OJJF4WP.js";
+import "../chunk-HCBMPZDT.js";
+import "../chunk-XJUUWHVN.js";
 import "../chunk-NGP6LSV2.js";
-import "../chunk-IQSCZDBQ.js";
+import "../chunk-I5PIBL56.js";
 import {
   getSessionRuntime
 } from "../chunk-CVYC6DUW.js";
 import "../chunk-OPU3NYOO.js";
 import "../chunk-GJV3WDWM.js";
 import "../chunk-MP2AFCGL.js";
-import "../chunk-4SC65UBG.js";
+import "../chunk-JLNXKG3K.js";
 import "../chunk-HYZV25LY.js";
-import "../chunk-2H55BIV2.js";
-import "../chunk-WSHMBME6.js";
+import "../chunk-CEJO7244.js";
+import "../chunk-AWRL5FGM.js";
 import "../chunk-FXU7JOXK.js";
-import "../chunk-D5C56WO3.js";
-import "../chunk-TRZ5KA2R.js";
+import "../chunk-MOZ2YQ54.js";
+import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";
 import {
   isMainModule
@@ -73,7 +73,7 @@ function checkMcpHealth() {
   }
 }
 async function scanFromDb(agentId, tmuxSession, projectName) {
-  const { fastDbInit } = await import("../fast-db-init-HIJWWKAO.js");
+  const { fastDbInit } = await import("../fast-db-init-YSR7RMVZ.js");
   try {
     await fastDbInit();
   } catch (err) {

package/dist/bin/setup.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   runSetupWizard
-} from "../chunk-DHVC4RN7.js";
-import "../chunk-KDJRFJDL.js";
-import "../chunk-TRZ5KA2R.js";
+} from "../chunk-CBDPEJOR.js";
+import "../chunk-K333WOW4.js";
+import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/bin/shard-migrate.js

@@ -4,24 +4,24 @@ import {
   getReadyShardClient,
   getShardsDir,
   initShardManager
-} from "../chunk-2ORPA23Y.js";
+} from "../chunk-YMXXD2GW.js";
 import {
   disposeStore,
   initStore
-} from "../chunk-FGJUGDNM.js";
+} from "../chunk-222SI7QC.js";
 import "../chunk-CHCA3ZM2.js";
-import "../chunk-4HROS3GJ.js";
-import "../chunk-F7LU65PQ.js";
+import "../chunk-IZVKWBIP.js";
+import "../chunk-Y25OJWOQ.js";
 import "../chunk-MP2AFCGL.js";
 import {
   getClient
-} from "../chunk-2H55BIV2.js";
-import "../chunk-WSHMBME6.js";
+} from "../chunk-CEJO7244.js";
+import "../chunk-AWRL5FGM.js";
 import "../chunk-FXU7JOXK.js";
 import {
   getMasterKey
-} from "../chunk-KDJRFJDL.js";
-import "../chunk-TRZ5KA2R.js";
+} from "../chunk-K333WOW4.js";
+import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/bin/stack-update.js

@@ -10,9 +10,19 @@ import {
   loadStackManifest,
   patchEnv,
   runStackUpdate
-} from "../chunk-F4TCKCKK.js";
-import "../chunk-D5C56WO3.js";
-import "../chunk-TRZ5KA2R.js";
+} from "../chunk-ITZVPCBQ.js";
+import {
+  runVerifyStack
+} from "../chunk-IRHNV4GY.js";
+import {
+  preDeployBackup
+} from "../chunk-5DMAMQNU.js";
+import {
+  logResult,
+  runHealthGate
+} from "../chunk-UIRWDGMB.js";
+import "../chunk-MOZ2YQ54.js";
+import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";
 import {
   isMainModule
@@ -20,10 +30,304 @@ import {
 import "../chunk-MLKGABMK.js";
 
 // src/bin/stack-update.ts
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import path2 from "path";
+import { existsSync as existsSync2 } from "fs";
+
+// src/bin/preflight.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
 import { spawnSync } from "child_process";
 import path from "path";
-import { existsSync } from "fs";
+var REQUIRED_ENV_VARS = [
+  "POSTGRES_USER",
+  "POSTGRES_PASSWORD",
+  "POSTGRES_DB",
+  "GOTRUE_JWT_SECRET",
+  "EXE_LICENSE_KEY",
+  "EXED_MCP_TOKEN",
+  "EXE_GATEWAY_AUTH_TOKEN",
+  "EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN",
+  "WIKI_AUTH_TOKEN",
+  "WIKI_JWT_SECRET",
+  "WIKI_SIG_KEY",
+  "WIKI_SIG_SALT",
+  "REDIS_PASSWORD",
+  "CLICKHOUSE_PASSWORD",
+  "CRM_APP_SECRET"
+];
+var CONDITIONAL_ENV_VARS = [
+  {
+    key: "ANTHROPIC_API_KEY",
+    condition: (env) => env.get("BYOK_ENABLED") === "true",
+    reason: "BYOK_ENABLED=true requires ANTHROPIC_API_KEY"
+  },
+  {
+    key: "API_ROUTER_URL",
+    condition: (env) => env.get("BYOK_ENABLED") !== "true",
+    reason: "API Router mode (BYOK_ENABLED!=true) requires API_ROUTER_URL"
+  },
+  {
+    key: "API_ROUTER_KEY",
+    condition: (env) => env.get("BYOK_ENABLED") !== "true",
+    reason: "API Router mode (BYOK_ENABLED!=true) requires API_ROUTER_KEY"
+  }
+];
+var VOLUME_REQUIREMENTS = [
+  { service: "exe-db", description: "PostgreSQL data" },
+  { service: "redis", description: "Redis AOF/RDB" },
+  { service: "exe-gateway", description: "Baileys WhatsApp auth state" },
+  { service: "exe-wiki", description: "Wiki document storage" },
+  { service: "exe-os", description: "Daemon state + memories DB" },
+  { service: "exe-monitor-hub", description: "PocketBase monitoring data" }
+];
+function parseEnvFile(content) {
+  const env = /* @__PURE__ */ new Map();
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx < 0) continue;
+    const key = trimmed.slice(0, eqIdx);
+    let value = trimmed.slice(eqIdx + 1);
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    env.set(key, value);
+  }
+  return env;
+}
+function checkImageIdentity(image) {
+  if (!image) return { check: "image_identity", status: "skip", message: "No --image specified, skipping" };
+  try {
+    const pull = spawnSync("docker", ["pull", image], { encoding: "utf8", timeout: 12e4 });
+    if (pull.status !== 0) {
+      return { check: "image_identity", status: "fail", message: `Failed to pull ${image}: ${pull.stderr?.slice(0, 200)}` };
+    }
+    const inspect = spawnSync("docker", [
+      "run",
+      "--rm",
+      "--entrypoint",
+      "cat",
+      image,
+      "/app/package.json"
+    ], { encoding: "utf8", timeout: 3e4 });
+    if (inspect.status !== 0) {
+      return { check: "image_identity", status: "warn", message: "Could not read package.json from image (non-Node image?)" };
+    }
+    const pkg = JSON.parse(inspect.stdout);
+    const expectedRepo = image.includes("exe-gateway") ? "exe-gateway" : image.includes("exe-wiki") ? "exe-wiki" : image.includes("exe-crm") ? "exe-crm" : image.includes("exe-os") ? "exe-os" : null;
+    if (expectedRepo && !pkg.name?.includes(expectedRepo)) {
+      return {
+        check: "image_identity",
+        status: "fail",
+        message: `Image identity mismatch: expected ${expectedRepo} but package.json name is "${pkg.name}"`
+      };
+    }
+    return { check: "image_identity", status: "pass", message: `Image identity verified: ${pkg.name}@${pkg.version}` };
+  } catch (e) {
+    return { check: "image_identity", status: "fail", message: `Image identity check failed: ${e instanceof Error ? e.message : String(e)}` };
+  }
+}
+function checkVolumePreservation(composeContent) {
+  const missing = [];
+  for (const req of VOLUME_REQUIREMENTS) {
+    const serviceRegex = new RegExp(`^\\s+${req.service}:`, "m");
+    if (!serviceRegex.test(composeContent)) continue;
+    const lines = composeContent.split("\n");
+    let serviceBlock = "";
+    let inService = false;
+    let serviceIndent = -1;
+    for (const line of lines) {
+      if (!inService) {
+        const headerMatch = line.match(new RegExp(`^(\\s+)${req.service}:\\s*`));
+        if (headerMatch) {
+          inService = true;
+          serviceIndent = headerMatch[1].length;
+          serviceBlock += line + "\n";
+        }
+        continue;
+      }
+      if (line.trim() === "" || line.trim().startsWith("#")) {
+        serviceBlock += line + "\n";
+        continue;
+      }
+      const currentIndent = line.match(/^(\s*)/)?.[1]?.length ?? 0;
+      if (currentIndent <= serviceIndent) {
+        break;
+      }
+      serviceBlock += line + "\n";
+    }
+    if (serviceBlock && !serviceBlock.includes("volumes:")) {
+      missing.push(`${req.service} (${req.description})`);
+    }
+  }
+  if (missing.length > 0) {
+    return {
+      check: "volume_preservation",
+      status: "fail",
+      message: `Stateful services without volume mounts: ${missing.join(", ")}`
+    };
+  }
+  return { check: "volume_preservation", status: "pass", message: "All stateful services have volume mounts" };
+}
+function checkEnvContract(envContent) {
+  const env = parseEnvFile(envContent);
+  const issues = [];
+  for (const key of REQUIRED_ENV_VARS) {
+    const val = env.get(key);
+    if (!val || val === "CHANGEME" || val === "") {
+      issues.push(key);
+    }
+  }
+  for (const cond of CONDITIONAL_ENV_VARS) {
+    if (cond.condition(env)) {
+      const val = env.get(cond.key);
+      if (!val || val === "CHANGEME" || val === "") {
+        issues.push(`${cond.key} (${cond.reason})`);
+      }
+    }
+  }
+  if (issues.length > 0) {
+    return {
+      check: "env_contract",
+      status: "fail",
+      message: `Missing or placeholder env vars: ${issues.join(", ")}`
+    };
+  }
+  return { check: "env_contract", status: "pass", message: `All ${REQUIRED_ENV_VARS.length} required env vars present` };
+}
+function checkSmoke(composeFile, envFile) {
+  const ps = spawnSync("docker", [
+    "compose",
+    "--file",
+    composeFile,
+    "--env-file",
+    envFile,
+    "ps",
+    "--format",
+    "json"
+  ], { encoding: "utf8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] });
+  if (ps.status !== 0) {
+    return { check: "smoke_test", status: "skip", message: "Docker compose not available or stack not running" };
+  }
+  const lines = ps.stdout.trim().split("\n").filter(Boolean);
+  if (lines.length === 0) {
+    return { check: "smoke_test", status: "skip", message: "No containers running \u2014 fresh deploy" };
+  }
+  const unhealthy = [];
+  for (const line of lines) {
+    try {
+      const container = JSON.parse(line);
+      if (container.State !== "running") {
+        unhealthy.push(`${container.Name} (${container.State})`);
+      } else if (container.Health && container.Health !== "healthy" && container.Health !== "") {
+        unhealthy.push(`${container.Name} (${container.Health})`);
+      }
+    } catch {
+    }
+  }
+  if (unhealthy.length > 0) {
+    return { check: "smoke_test", status: "warn", message: `Unhealthy containers: ${unhealthy.join(", ")}` };
+  }
+  return { check: "smoke_test", status: "pass", message: `${lines.length} containers running and healthy` };
+}
+function checkRollbackSnapshot(composeFile, envFile, stackDir) {
+  const rollbackFile = path.join(stackDir, ".rollback.json");
+  try {
+    const envContent = readFileSync(envFile, "utf8");
+    const env = parseEnvFile(envContent);
+    const imageTags = {};
+    for (const [key, val] of env) {
+      if (key.endsWith("_IMAGE_TAG") || key.endsWith("_IMAGE")) {
+        imageTags[key] = val;
+      }
+    }
+    const snapshot = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      images: imageTags,
+      envFile,
+      composeFile
+    };
+    writeFileSync(rollbackFile, JSON.stringify(snapshot, null, 2) + "\n", { mode: 384 });
+    return {
+      check: "rollback_snapshot",
+      status: "pass",
+      message: `Rollback snapshot saved: ${Object.keys(imageTags).length} image tags \u2192 ${rollbackFile}`
+    };
+  } catch (e) {
+    return {
+      check: "rollback_snapshot",
+      status: "warn",
+      message: `Could not save rollback snapshot: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+}
+function runPreflight(options) {
+  const results = [];
+  const stackDir = path.dirname(options.envFile);
+  results.push(checkImageIdentity(options.image));
+  if (existsSync(options.composeFile)) {
+    const composeContent = readFileSync(options.composeFile, "utf8");
+    results.push(checkVolumePreservation(composeContent));
+  } else {
+    results.push({ check: "volume_preservation", status: "skip", message: "Compose file not found" });
+  }
+  if (existsSync(options.envFile)) {
+    const envContent = readFileSync(options.envFile, "utf8");
+    results.push(checkEnvContract(envContent));
+  } else {
+    results.push({ check: "env_contract", status: "fail", message: ".env file not found" });
+  }
+  results.push(checkSmoke(options.composeFile, options.envFile));
+  results.push(checkRollbackSnapshot(options.composeFile, options.envFile, stackDir));
+  const passed = results.every((r) => r.status === "pass" || r.status === "skip" || r.status === "warn");
+  return {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    results,
+    passed
+  };
+}
+function printReport(report) {
+  console.log("\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557");
+  console.log("\u2551       exe-os preflight report            \u2551");
+  console.log("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D\n");
+  const icons = { pass: "\u2705", fail: "\u274C", warn: "\u26A0\uFE0F ", skip: "\u23ED\uFE0F " };
+  for (const r of report.results) {
+    console.log(`  ${icons[r.status]} ${r.check}: ${r.message}`);
+  }
+  console.log("");
+  if (report.passed) {
+    console.log("  \u2705 PREFLIGHT PASSED \u2014 safe to deploy\n");
+  } else {
+    console.log("  \u274C PREFLIGHT BLOCKED \u2014 fix issues before deploying\n");
+  }
+}
+if (process.argv[1]?.endsWith("preflight.ts") || process.argv[1]?.endsWith("preflight.js")) {
+  const args = process.argv.slice(2);
+  const getArg = (flag) => {
+    const idx = args.indexOf(flag);
+    return idx >= 0 && idx + 1 < args.length ? args[idx + 1] : void 0;
+  };
+  const composeFile = getArg("--compose") ?? "/opt/exe-stack/docker-compose.yml";
+  const envFile = getArg("--env") ?? "/opt/exe-stack/.env";
+  const image = getArg("--image");
+  const report = runPreflight({ composeFile, envFile, image });
+  printReport(report);
+  process.exit(report.passed ? 0 : 1);
+}
+
+// src/bin/stack-update.ts
+function withRuntimeHooks(opts) {
+  return {
+    ...opts,
+    preflight: runPreflight,
+    preDeployBackup,
+    healthGate: runHealthGate,
+    logHealthGateResult: logResult,
+    verifyStack: runVerifyStack
+  };
+}
 function parseArgs(args) {
   const defaults = defaultStackPaths();
   const opts = {
@@ -57,8 +361,8 @@ function parseArgs(args) {
     else if (arg === "--env-file" || arg === "--stack-env-file") opts.envFile = next();
     else if (arg.startsWith("--env-file=") || arg.startsWith("--stack-env-file=")) opts.envFile = arg.split("=").slice(1).join("=");
     else if (arg === "--lock-file") opts.lockFile = next();
-    else if (arg === "--public-key") opts.manifestPublicKey = readFileSync(next(), "utf8");
-    else if (arg.startsWith("--public-key=")) opts.manifestPublicKey = readFileSync(arg.split("=").slice(1).join("="), "utf8");
+    else if (arg === "--public-key") opts.manifestPublicKey = readFileSync2(next(), "utf8");
+    else if (arg.startsWith("--public-key=")) opts.manifestPublicKey = readFileSync2(arg.split("=").slice(1).join("="), "utf8");
     else if (arg === "--auth-token") opts.manifestAuthToken = next();
     else if (arg.startsWith("--auth-token=")) opts.manifestAuthToken = arg.split("=").slice(1).join("=");
     else if (arg === "--auth-token-env") opts.manifestAuthToken = process.env[next()] ?? "";
@@ -139,9 +443,9 @@ Options:
 `);
 }
 function readInstalledVersion(lockFile) {
-  if (!existsSync(lockFile)) return void 0;
+  if (!existsSync2(lockFile)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync(lockFile, "utf8"));
+    const parsed = JSON.parse(readFileSync2(lockFile, "utf8"));
     return parsed.stackVersion;
   } catch {
     return void 0;
@@ -184,7 +488,7 @@ function printChanges(changes, composeFile, envFile) {
 }
 function areCliContainersRunning(composeFile, envFile) {
   try {
-    const result = spawnSync("docker", ["compose", "--file", composeFile, "--env-file", envFile, "ps", "-q"], {
+    const result = spawnSync2("docker", ["compose", "--file", composeFile, "--env-file", envFile, "ps", "-q"], {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 15e3
     });
@@ -195,7 +499,7 @@ function areCliContainersRunning(composeFile, envFile) {
 }
 function getContainerHealth(composeFile, envFile) {
   try {
-    const result = spawnSync(
+    const result = spawnSync2(
       "docker",
       ["compose", "--file", composeFile, "--env-file", envFile, "ps", "--format", "json"],
       { stdio: ["pipe", "pipe", "pipe"], timeout: 15e3 }
@@ -262,9 +566,9 @@ async function main(args = process.argv.slice(2)) {
   const opts = parseArgs(args);
   let usingPackagedCheckTemplates = false;
   if (opts.check && !opts.noBootstrap && !existsForCli(opts.composeFile) && !existsForCli(opts.envFile)) {
-    const packageRoot = path.resolve(new URL("../..", import.meta.url).pathname);
-    opts.composeFile = path.join(packageRoot, "deploy", "compose", "docker-compose.yml");
-    opts.envFile = path.join(packageRoot, "deploy", "compose", ".env.customer.example");
+    const packageRoot = path2.resolve(new URL("../..", import.meta.url).pathname);
+    opts.composeFile = path2.join(packageRoot, "deploy", "compose", "docker-compose.yml");
+    opts.envFile = path2.join(packageRoot, "deploy", "compose", ".env.customer.example");
     opts.noBootstrap = true;
     usingPackagedCheckTemplates = true;
   }
@@ -273,7 +577,7 @@ async function main(args = process.argv.slice(2)) {
       console.error("Refusing to rollback without --yes.");
       process.exit(2);
     }
-    const result2 = await runStackUpdate(opts);
+    const result2 = await runStackUpdate(withRuntimeHooks(opts));
     console.log(`\u2705 Stack rollback attempted using backup: ${result2.backupEnvFile ?? "latest backup"}`);
     return;
   }
@@ -284,14 +588,14 @@ async function main(args = process.argv.slice(2)) {
     if (!opts.check && !opts.dryRun) assertHostReadyForApply(hostReport);
   }
   const manifest = await loadStackManifest(opts.manifestRef, void 0, opts.manifestPublicKey, opts.manifestAuthToken);
-  const envRaw = readFileSync(opts.envFile, "utf8");
-  const lockFile = opts.lockFile ?? path.join(path.dirname(opts.envFile), ".exe-stack-lock.json");
+  const envRaw = readFileSync2(opts.envFile, "utf8");
+  const lockFile = opts.lockFile ?? path2.join(path2.dirname(opts.envFile), ".exe-stack-lock.json");
   const installedVersion = readInstalledVersion(lockFile);
   const effectiveTarget = opts.targetVersion ?? installedVersion;
   const plan = createStackUpdatePlan(manifest, envRaw, effectiveTarget);
   assertDeploymentScopeAllowed(plan, opts.deploymentPersona);
   const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
-  assertProductionDeployGate(plan, plannedEnvRaw, readFileSync(opts.composeFile, "utf8"), {
+  assertProductionDeployGate(plan, plannedEnvRaw, readFileSync2(opts.composeFile, "utf8"), {
     breakGlassReason: opts.breakGlassReason,
     breakGlassAuditFile: opts.breakGlassAuditFile,
     envFile: opts.envFile
@@ -347,7 +651,7 @@ async function main(args = process.argv.slice(2)) {
     console.error("\nRefusing to update without --yes. Re-run with --yes after reviewing the plan.");
     process.exit(2);
   }
-  const result = await runStackUpdate(opts);
+  const result = await runStackUpdate(withRuntimeHooks(opts));
   console.log(`
 \u2705 Stack ${result.status}: ${result.targetVersion}`);
   if (result.backupEnvFile) console.log(`Backup env: ${result.backupEnvFile}`);
@@ -355,7 +659,7 @@ async function main(args = process.argv.slice(2)) {
 }
 function existsForCli(filePath) {
   try {
-    readFileSync(filePath);
+    readFileSync2(filePath);
     return true;
   } catch {
     return false;