@askexenow/exe-os 0.9.239 → 0.9.244

package/dist/{chunk-RWFGXC35.js → chunk-NEYQAEYU.js}

@@ -589,7 +589,7 @@ function auditHookOwnership() {
 }
 async function auditShards() {
   try {
-    const { auditShardHealth } = await import("./shard-manager-G6MHCO7X.js");
+    const { auditShardHealth } = await import("./shard-manager-VGA2TYHM.js");
     const report = await auditShardHealth();
     return {
       total: report.total,
@@ -607,7 +607,7 @@ async function auditShards() {
 async function auditKeyHealth() {
   try {
     const { getMasterKey } = await import("./lib/keychain.js");
-    const { getKeyBackupStatus } = await import("./key-backup-status-OZ2CXUDW.js");
+    const { getKeyBackupStatus } = await import("./key-backup-status-4YKCV4ZV.js");
     const key = await getMasterKey();
     const backup = getKeyBackupStatus();
     return {
@@ -859,7 +859,7 @@ function formatReport(report, flags) {
   return lines.join("\n");
 }
 async function fixNullVectors() {
-  const { tryAcquireWorkerSlot, registerWorkerPid } = await import("./worker-gate-SCSN6IHI.js");
+  const { tryAcquireWorkerSlot, registerWorkerPid } = await import("./worker-gate-PRCKA23W.js");
   if (!tryAcquireWorkerSlot()) {
     process.stderr.write("[exe-doctor] Worker gate full \u2014 waiting for existing backfill workers to finish\n");
     await new Promise((r) => setTimeout(r, 5e3));
@@ -943,7 +943,7 @@ async function fixBloated(client, bloated, dryRun) {
   return chunksCreated;
 }
 async function fixShards(dryRun) {
-  const { auditShardHealth } = await import("./shard-manager-G6MHCO7X.js");
+  const { auditShardHealth } = await import("./shard-manager-VGA2TYHM.js");
   const report = await auditShardHealth({ repair: true, dryRun });
   return {
     total: report.total,
@@ -982,7 +982,7 @@ function splitAtSentences(text, maxChunkSize) {
 }
 async function main(argv = process.argv.slice(2)) {
   const flags = parseFlags(argv);
-  const { fastDbInit } = await import("./fast-db-init-HIJWWKAO.js");
+  const { fastDbInit } = await import("./fast-db-init-YSR7RMVZ.js");
   const client = await fastDbInit();
   const report = await runAudit(client, flags);
   console.log(formatReport(report, flags));
@@ -993,8 +993,8 @@ ${mode} Applying repairs...
 `);
     if (!flags.dryRun) {
       try {
-        const { createBackup } = await import("./db-backup-HLX5OLIV.js");
-        const backupPath = createBackup("pre-fix");
+        const { createBackup } = await import("./db-backup-EWS52P2W.js");
+        const backupPath = await createBackup("pre-fix");
         if (backupPath) {
           console.log(`  Backup created: ${backupPath.split("/").pop()}`);
         }

package/dist/{chunk-MBHZDXGN.js → chunk-NL35XNLI.js}

@@ -1,7 +1,7 @@
 import {
   loadConfig,
   saveConfig
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/orchestration-phase.ts
 var ORCHESTRATION_PHASES = [

package/dist/{chunk-TPQVLYSV.js → chunk-NLGMHPEN.js}

@@ -1,6 +1,6 @@
 import {
   listReminders
-} from "./chunk-5WLMF6PL.js";
+} from "./chunk-YMZHTTOQ.js";
 
 // src/mcp/tools/list-reminders.ts
 import { z } from "zod";

package/dist/{chunk-5LMH4YHG.js → chunk-NRVV4Y5V.js}

@@ -1,11 +1,11 @@
-import {
-  ingest
-} from "./chunk-ELRRL2NC.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-FE45RXGC.js";
+} from "./chunk-V2GZMY6O.js";
+import {
+  ingest
+} from "./chunk-A4K2ZT6N.js";
 import {
   initCRMBridge
 } from "./chunk-ONKIWA3R.js";

package/dist/{chunk-GN5VHPPR.js → chunk-NVZR7T4E.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-K77WC6HA.js";
 import {
   getClient
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/global-procedures.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-Y2L7RMGH.js → chunk-NWBHL5PI.js}

@@ -1,6 +1,6 @@
 import {
   writeMemoryViaDaemon
-} from "./chunk-BZWKTFEB.js";
+} from "./chunk-ENVRFBTB.js";
 
 // src/lib/auto-checkpoint.ts
 var FILE_RE = /(?:^|\s)([\w./-]+\.(?:ts|tsx|js|jsx|json|md|yml|yaml|sql|go|py|css|scss|html|sh))(?:\b|$)/g;

package/dist/{chunk-YPYDLW75.js → chunk-OEMX65EA.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-NOLIN2YI.js";
+} from "./chunk-XAYRZHLV.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-UAFUGPKO.js → chunk-ONAQAL3O.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/behaviors.ts
 import crypto from "crypto";

package/dist/{chunk-AVM7XZE4.js → chunk-OWQ3CCYJ.js}

@@ -1,10 +1,10 @@
 import {
   sessionScopeFilter
-} from "./chunk-HNLPLLE6.js";
+} from "./chunk-F7JLZXHC.js";
 import {
   getClient,
   getIdentity
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/dreaming.ts
 var DreamingEngine = class {
@@ -131,6 +131,7 @@ var DreamingEngine = class {
    */
   identifyPatterns(review) {
     const patterns = [];
+    const investigations = review.investigations ?? [];
     const errorTasks = review.tasks.filter(
       (t) => /\b(fix|bug|error|fail|broken|crash|revert)\b/i.test(t.title) || t.result && /\b(error|failed|broken|crash)\b/i.test(t.result)
     );
@@ -188,12 +189,12 @@ var DreamingEngine = class {
         confidence: 0.7
       });
     }
-    if (review.investigations.length > 0) {
+    if (investigations.length > 0) {
       const catTotals = /* @__PURE__ */ new Map();
       let totalFailed = 0;
       let totalAttempts = 0;
       let totalWastedMs = 0;
-      for (const inv of review.investigations) {
+      for (const inv of investigations) {
         totalAttempts += inv.totalAttempts;
         totalFailed += inv.failedAttempts;
         totalWastedMs += inv.wastedMs;
@@ -203,7 +204,7 @@ var DreamingEngine = class {
         patterns.push({
           type: "mistake",
           description: `Investigation failure rate: ${Math.round(totalFailed / totalAttempts * 100)}% of ${totalAttempts} attempts failed (${Math.round(totalWastedMs / 6e4)}min wasted)`,
-          evidence: review.investigations.map((i) => `${i.investigationKey}: ${i.failedAttempts}/${i.totalAttempts} failed (${i.topFailureCategory})`),
+          evidence: investigations.map((i) => `${i.investigationKey}: ${i.failedAttempts}/${i.totalAttempts} failed (${i.topFailureCategory})`),
           frequency: totalFailed,
           confidence: Math.min(0.6 + totalFailed * 0.05, 0.95)
         });
@@ -214,7 +215,7 @@ var DreamingEngine = class {
         patterns.push({
           type: "inefficiency",
           description: `Top debugging failure: "${topCat}" (${topCount} times). ${topCat === "lack_of_context" ? "Agent didn't have enough code context before editing" : topCat === "lack_of_tools" ? "Agent couldn't verify the fix (missing tools)" : topCat === "lack_of_reasoning" ? "Agent had the info but drew wrong conclusion" : topCat === "lack_of_measurement" ? "Agent tested the wrong thing (API vs browser)" : topCat === "wrong_diagnosis" ? "Agent misidentified the root cause" : "Recurring failure pattern"}`,
-          evidence: review.investigations.filter((i) => i.topFailureCategory === topCat).map((i) => `${i.investigationKey}: ${i.failedAttempts} failed attempts`),
+          evidence: investigations.filter((i) => i.topFailureCategory === topCat).map((i) => `${i.investigationKey}: ${i.failedAttempts} failed attempts`),
           frequency: topCount,
           confidence: Math.min(0.7 + topCount * 0.05, 0.95)
         });

package/dist/{chunk-K525WLL7.js → chunk-PI6V23GF.js}

@@ -1,16 +1,16 @@
 import {
   extractMemoryGraph
-} from "./chunk-O6DAF2TY.js";
+} from "./chunk-QUZVAHO7.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-FGJUGDNM.js";
+} from "./chunk-222SI7QC.js";
 import {
   extractKeywords
 } from "./chunk-CHCA3ZM2.js";
 import {
   getActiveAgent
-} from "./chunk-RA2RO27E.js";
+} from "./chunk-MCESA5UW.js";
 
 // src/mcp/tools/import-conversations.ts
 import { z } from "zod";
@@ -350,7 +350,8 @@ function registerImportConversations(server) {
           await flushBatch();
           await new Promise((r) => setTimeout(r, 0));
           if ((i + 1) % (YIELD_INTERVAL * 10) === 0) {
-            console.log(`[import] ${i + 1}/${allMemories.length} memories processed, ${stored} stored`);
+            process.stderr.write(`[import] ${i + 1}/${allMemories.length} memories processed, ${stored} stored
+`);
           }
         }
       }

package/dist/{chunk-AURM7FOT.js → chunk-Q2OAQPWY.js}

@@ -6,7 +6,7 @@ import {
   getIdentity,
   listIdentities,
   updateIdentity
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 import {
   atomicWriteJsonSync
 } from "./chunk-LYH5HE24.js";

package/dist/{chunk-FB5VRO5S.js → chunk-QLDWASTX.js}

@@ -1,6 +1,6 @@
 import {
   isCrdtSyncEnabled
-} from "./chunk-YFDDTHNM.js";
+} from "./chunk-JXI4XUTV.js";
 import {
   decryptSyncBlob,
   encryptSyncBlob,
@@ -12,13 +12,13 @@ import {
   loadEmployees,
   registerBinSymlinks,
   saveEmployees
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 import {
   loadDeviceId
-} from "./chunk-D5C56WO3.js";
+} from "./chunk-MOZ2YQ54.js";
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 import {
   atomicWriteJsonSync,
   atomicWriteSync,
@@ -70,6 +70,21 @@ var FETCH_TIMEOUT_MS = 3e4;
 var PUSH_BATCH_SIZE = 5e3;
 var ROSTER_LOCK_PATH = path.join(EXE_AI_DIR, "roster-merge.lock");
 var LOCK_STALE_MS = 3e4;
+var _daemonCrdtSkipLogged = false;
+function shouldUseCrdtMergeForCloudSync() {
+  if (!isCrdtSyncEnabled()) return false;
+  if (process.env.EXE_IS_DAEMON === "1" && process.env.EXE_DAEMON_CRDT_SYNC !== "1") {
+    return false;
+  }
+  return true;
+}
+function logDaemonCrdtSkipOnce() {
+  if (_daemonCrdtSkipLogged) return;
+  _daemonCrdtSkipLogged = true;
+  process.stderr.write(
+    "[cloud-sync] CRDT merge disabled inside daemon; using bounded SQL upsert path. Set EXE_DAEMON_CRDT_SYNC=1 only for diagnostics.\n"
+  );
+}
 var SYNC_COOLDOWN_MS = 1e4;
 var _lastSyncPushVersion = -1;
 var _lastSyncPushTimestamp = 0;
@@ -505,8 +520,8 @@ async function cloudSync(config) {
     const pullResult = await cloudPull(lastPullVersion, config);
     let pulled = 0;
     if (pullResult.records.length > 0) {
-      if (isCrdtSyncEnabled()) {
-        const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-KXETGV45.js");
+      if (shouldUseCrdtMergeForCloudSync()) {
+        const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-R6YROKDH.js");
         initCrdtDoc();
         importExistingMemories(
           pullResult.records.map((rec) => ({
@@ -571,6 +586,9 @@ async function cloudSync(config) {
         if (stmts.length > 0) await client.batch(stmts, "write");
         pulled = pullResult.records.length;
       } else {
+        if (process.env.EXE_IS_DAEMON === "1" && isCrdtSyncEnabled()) {
+          logDaemonCrdtSkipOnce();
+        }
         try {
           const incomingIds = pullResult.records.map((r) => sqlSafe(r.id));
           if (incomingIds.length > 0) {
@@ -935,7 +953,7 @@ async function cloudSync(config) {
     }
     const totalMemories = await countRows("SELECT COUNT(*) as cnt FROM memories WHERE status = 'active' OR status IS NULL");
     try {
-      const { getLatestBackup } = await import("./db-backup-HLX5OLIV.js");
+      const { getLatestBackup } = await import("./db-backup-EWS52P2W.js");
       const latestBackup = getLatestBackup();
       if (latestBackup) {
         const backupSize = statSync(latestBackup).size;
@@ -1577,34 +1595,11 @@ async function cloudPullTasks(config) {
   if (!remoteTasks || remoteTasks.length === 0) return { pulled: 0 };
   const client = getClient();
   const stmts = remoteTasks.map((t) => ({
-    sql: `INSERT INTO tasks
+    sql: `INSERT OR IGNORE INTO tasks
           (id, title, assigned_to, assigned_by, project_name, priority, status, task_file, created_at, updated_at,
            blocked_by, parent_task_id, budget_tokens, budget_fallback_model, tokens_used, tokens_warned_at,
            reviewer, context, complexity, session_scope, spawn_runtime, spawn_model, result)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-          ON CONFLICT(id) DO UPDATE SET
-            title = excluded.title,
-            assigned_to = excluded.assigned_to,
-            assigned_by = excluded.assigned_by,
-            project_name = excluded.project_name,
-            priority = excluded.priority,
-            status = excluded.status,
-            task_file = excluded.task_file,
-            updated_at = excluded.updated_at,
-            blocked_by = excluded.blocked_by,
-            parent_task_id = excluded.parent_task_id,
-            budget_tokens = excluded.budget_tokens,
-            budget_fallback_model = excluded.budget_fallback_model,
-            tokens_used = excluded.tokens_used,
-            tokens_warned_at = excluded.tokens_warned_at,
-            reviewer = excluded.reviewer,
-            context = excluded.context,
-            complexity = excluded.complexity,
-            session_scope = excluded.session_scope,
-            spawn_runtime = excluded.spawn_runtime,
-            spawn_model = excluded.spawn_model,
-            result = excluded.result
-          WHERE COALESCE(excluded.updated_at, '') > COALESCE(tasks.updated_at, '')`,
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
     args: [
       sqlSafe(t.id),
       sqlSafe(t.title),
@@ -2045,6 +2040,7 @@ async function cloudPullCoreMemory(config) {
 }
 
 export {
+  shouldUseCrdtMergeForCloudSync,
   loadPgClient,
   disposeCloudSync,
   pushToPostgres,

package/dist/{chunk-EPWDTS2Q.js → chunk-QMTGMCWB.js}

@@ -2,7 +2,7 @@ import {
   connectEmbedDaemon,
   disconnectClient,
   embedViaClient
-} from "./chunk-VHKL4S4T.js";
+} from "./chunk-RRHSONV5.js";
 import {
   EMBEDDING_DIM
 } from "./chunk-FXU7JOXK.js";

package/dist/{chunk-VI2FJY2M.js → chunk-QP4FHME2.js}

@@ -1,11 +1,11 @@
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-D5C56WO3.js";
+} from "./chunk-MOZ2YQ54.js";
 import {
   EXE_AI_DIR,
   loadConfig
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/bin/exe-support.ts
 import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";

package/dist/{chunk-NJWK6J4N.js → chunk-QUNKPR6Y.js}

@@ -1,6 +1,6 @@
 import {
   MultiAgentOrchestrator
-} from "./chunk-FKWZVO2T.js";
+} from "./chunk-CPXGLSIL.js";
 import {
   createQuietRenderer,
   createTerminalRenderer,
@@ -206,7 +206,7 @@ function createExeOSHooks(config) {
         );
       }
       try {
-        const { listBehaviors } = await import("./behaviors-6BGALYGW.js");
+        const { listBehaviors } = await import("./behaviors-BL3QCHBT.js");
         const behaviors = await listBehaviors(config.agentId, config.projectName, 12);
         if (behaviors.length > 0) {
           process.stderr.write(
@@ -244,7 +244,7 @@ function createExeOSHooks(config) {
       const ALLOWED_RE = /^(Bash|Edit|Write|Read|Glob|Grep|Agent|mcp__.*)$/;
       if (!ALLOWED_RE.test(toolName)) return;
       try {
-        const { extractSemanticText } = await import("./content-extractor-SPSH5X33.js");
+        const { extractSemanticText } = await import("./content-extractor-EYRVGD6O.js");
         const { writeMemory } = await import("./lib/store.js");
         const toolInput = block.input ?? {};
         const toolResponse = result.isError ? { error: result.content } : { output: result.content };
@@ -327,7 +327,7 @@ function createExeOSHooks(config) {
     async onSubagentStop(_reason) {
       try {
         const { getClient } = await import("./lib/database.js");
-        const { sessionScopeFilter } = await import("./task-scope-YHALISIB.js");
+        const { sessionScopeFilter } = await import("./task-scope-R3XKBIHL.js");
         const client = getClient();
         const ehScope = sessionScopeFilter();
         const tasks = await client.execute({
@@ -419,7 +419,7 @@ function createExeOSHooks(config) {
         try {
           const { writeMemory, flushBatch } = await import("./lib/store.js");
           const { getClient } = await import("./lib/database.js");
-          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-YHALISIB.js");
+          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-R3XKBIHL.js");
           const client = getClient();
           const cpScope = cpScopeFilter();
           const tasks = await client.execute({

package/dist/{chunk-O6DAF2TY.js → chunk-QUZVAHO7.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/memory-graph-extractor.ts
 function entityId(type, name) {
@@ -247,7 +247,7 @@ async function upsertMemoryGraph(result, memoryId) {
     });
   }
   try {
-    const { createCoOccurrenceEdges } = await import("./co-occurrence-XZQJJIBM.js");
+    const { createCoOccurrenceEdges } = await import("./co-occurrence-QARWYUAY.js");
     await createCoOccurrenceEdges(result.entities, memoryId);
   } catch {
   }

package/dist/{chunk-VHKL4S4T.js → chunk-RRHSONV5.js}

@@ -1,13 +1,13 @@
 import {
   ensureDaemonToken,
   readDaemonToken
-} from "./chunk-JL3K5OTS.js";
+} from "./chunk-7IZWLMTP.js";
 import {
   requestRestart
 } from "./chunk-PWMMIGVQ.js";
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/exe-daemon-client.ts
 import net from "net";

package/dist/{chunk-GPF6X6HE.js → chunk-RYDHEWYY.js}

@@ -19,7 +19,7 @@ import {
 import {
   createCRMWebhookHandler,
   parseTwentyWebhook
-} from "./chunk-MAN5LZQ4.js";
+} from "./chunk-LQSFP2BV.js";
 import {
   OllamaProvider
 } from "./chunk-FWFFZGSC.js";
@@ -49,7 +49,7 @@ import {
   retryWithBackoff,
   routeMessage,
   validateGatewayConfig
-} from "./chunk-5LMH4YHG.js";
+} from "./chunk-NRVV4Y5V.js";
 import {
   getAccountByName,
   getAccountByPhoneNumberId,

package/dist/{chunk-SVXDCELZ.js → chunk-SHN5O73O.js}

@@ -14,19 +14,39 @@ function registryProxyOptionsFromEnv(env = process.env) {
     upstreamUsername: env.EXE_REGISTRY_PROXY_UPSTREAM_USERNAME || env.GHCR_USERNAME || "askexe",
     upstreamToken,
     pullTokens,
-    allowedNamespace: env.EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE || "askexe"
+    allowedNamespace: env.EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE || "askexe",
+    licenseValidatorUrl: env.EXE_REGISTRY_PROXY_LICENSE_VALIDATOR_URL || ""
   };
 }
 function assertRegistryProxyConfig(options) {
   if (!options.upstreamToken) throw new Error("EXE_REGISTRY_PROXY_UPSTREAM_TOKEN or GHCR_TOKEN is required");
-  if (options.pullTokens.length === 0) throw new Error("EXE_REGISTRY_PROXY_PULL_TOKENS is required");
-  if (!options.allowedNamespace || !/^[a-z0-9._-]+$/i.test(options.allowedNamespace)) {
+  if (options.pullTokens.length === 0 && !options.licenseValidatorUrl) {
+    throw new Error("EXE_REGISTRY_PROXY_PULL_TOKENS or EXE_REGISTRY_PROXY_LICENSE_VALIDATOR_URL is required");
+  }
+  const namespace = options.allowedNamespace ?? "askexe";
+  if (!/^[a-z0-9._-]+$/i.test(namespace)) {
     throw new Error("EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE must be a registry-safe namespace");
   }
 }
 function timingSafeIncludes(values, candidate) {
   return values.some((value) => value === candidate);
 }
+function isLicenseKeyFormat(value) {
+  return value.startsWith("exe_sk_") || value.startsWith("exe_lk_");
+}
+async function validateLicenseKey(licenseKey, validatorUrl) {
+  try {
+    const res = await fetch(validatorUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ licenseKey }),
+      signal: AbortSignal.timeout(5e3)
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
 function parseBasicAuth(header) {
   if (!header?.startsWith("Basic ")) return null;
   try {
@@ -112,10 +132,18 @@ function createRegistryProxyServer(options) {
       return;
     }
     const auth = parseBasicAuth(req.headers.authorization);
-    if (!auth || !timingSafeIncludes(options.pullTokens, auth.password)) {
+    if (!auth) {
       unauthorized(res);
       return;
     }
+    const isPullToken = timingSafeIncludes(options.pullTokens, auth.password);
+    if (!isPullToken) {
+      const licenseOk = options.licenseValidatorUrl && isLicenseKeyFormat(auth.password) ? await validateLicenseKey(auth.password, options.licenseValidatorUrl) : false;
+      if (!licenseOk) {
+        unauthorized(res);
+        return;
+      }
+    }
     const upstreamUrl = new URL(requestUrl.pathname + requestUrl.search, upstream.origin);
     const headers = new Headers();
     for (const [key, value] of Object.entries(req.headers)) {