@askexenow/exe-os 0.9.239 → 0.9.244

package/dist/chunk-5DMAMQNU.js

@@ -0,0 +1,168 @@
+// src/bin/vps-backup.ts
+import { spawnSync } from "child_process";
+import { existsSync, mkdirSync, readdirSync, statSync, unlinkSync } from "fs";
+import path from "path";
+var BACKUP_DIR = "/opt/exe-stack/backups";
+var DEFAULT_DATABASE_URL = "postgres://exe@localhost:5432/exedb";
+var MAX_SNAPSHOTS = 28;
+var KEEP_DAYS = 7;
+function runPgBackup(tag) {
+  mkdirSync(BACKUP_DIR, { recursive: true });
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const filename = tag ? `pg-${tag}-${timestamp}.dump` : `pg-${timestamp}.dump`;
+  const filepath = path.join(BACKUP_DIR, filename);
+  const databaseUrl = process.env.DATABASE_URL || DEFAULT_DATABASE_URL;
+  const result = spawnSync("pg_dump", ["-Fc", "-d", databaseUrl, "-f", filepath], {
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 3e5,
+    // 5 minutes max
+    env: { ...process.env }
+  });
+  if (result.status !== 0) {
+    const stderr = result.stderr?.toString() || "";
+    throw new Error(`pg_dump failed (exit ${result.status}): ${stderr}`);
+  }
+  const size = existsSync(filepath) ? statSync(filepath).size : 0;
+  console.log(`[vps-backup] \u2713 Backup created: ${filepath} (${formatBytes(size)})`);
+  return filepath;
+}
+function cleanOldBackups(keepDays = KEEP_DAYS) {
+  if (!existsSync(BACKUP_DIR)) return 0;
+  const files = readdirSync(BACKUP_DIR).filter((f) => f.startsWith("pg-") && f.endsWith(".dump")).map((f) => ({
+    name: f,
+    path: path.join(BACKUP_DIR, f),
+    mtime: statSync(path.join(BACKUP_DIR, f)).mtimeMs
+  })).sort((a, b) => b.mtime - a.mtime);
+  const cutoff = Date.now() - keepDays * 24 * 60 * 60 * 1e3;
+  let removed = 0;
+  for (let i = 0; i < files.length; i++) {
+    const file = files[i];
+    if (file.mtime >= cutoff && i < MAX_SNAPSHOTS) continue;
+    if (file.name.includes("pre-deploy-") && file.mtime >= cutoff) continue;
+    try {
+      unlinkSync(file.path);
+      removed++;
+      console.log(`[vps-backup] Removed old backup: ${file.name}`);
+    } catch (err) {
+      console.warn(`[vps-backup] Failed to remove ${file.name}: ${err instanceof Error ? err.message : err}`);
+    }
+  }
+  if (removed > 0) {
+    console.log(`[vps-backup] \u2713 Cleaned ${removed} old backup(s)`);
+  } else {
+    console.log("[vps-backup] \u2713 No old backups to clean");
+  }
+  return removed;
+}
+function preDeployBackup(version) {
+  const sanitized = version.replace(/[^a-zA-Z0-9._-]/g, "_");
+  console.log(`[vps-backup] Creating pre-deploy backup for version ${version}...`);
+  return runPgBackup(`pre-deploy-${sanitized}`);
+}
+function setupCron() {
+  const which = spawnSync("which", ["exe-os"], { encoding: "utf8", timeout: 5e3 });
+  const exeOsBin = which.stdout?.trim() || "/usr/local/bin/exe-os";
+  const cronLine = `0 */6 * * * ${exeOsBin} vps-backup --clean 2>&1 | tail -5 >> /var/log/exe-backup.log`;
+  const cronComment = "# exe-os automated postgres backup (every 6 hours)";
+  const current = spawnSync("crontab", ["-l"], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  const existingCron = current.status === 0 ? current.stdout : "";
+  if (existingCron.includes("exe-os vps-backup") || existingCron.includes("exe-os vps-backup")) {
+    console.log("[vps-backup] \u2713 Cron job already installed");
+    return;
+  }
+  const newCron = existingCron.trimEnd() + "\n\n" + cronComment + "\n" + cronLine + "\n";
+  const install = spawnSync("crontab", ["-"], {
+    input: newCron,
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  if (install.status !== 0) {
+    throw new Error(`Failed to install cron: ${install.stderr}`);
+  }
+  console.log("[vps-backup] \u2713 Cron job installed (every 6 hours)");
+  console.log(`[vps-backup]   ${cronLine}`);
+}
+function listBackups() {
+  if (!existsSync(BACKUP_DIR)) {
+    console.log("[vps-backup] No backups directory found");
+    return;
+  }
+  const files = readdirSync(BACKUP_DIR).filter((f) => f.startsWith("pg-") && f.endsWith(".dump")).map((f) => {
+    const stat = statSync(path.join(BACKUP_DIR, f));
+    return { name: f, size: stat.size, mtime: stat.mtimeMs };
+  }).sort((a, b) => b.mtime - a.mtime);
+  if (files.length === 0) {
+    console.log("[vps-backup] No backups found");
+    return;
+  }
+  console.log(`
+  Backups in ${BACKUP_DIR} (${files.length} total):
+`);
+  for (const f of files) {
+    const age = formatAge(Date.now() - f.mtime);
+    console.log(`  ${f.name}  ${formatBytes(f.size).padStart(10)}  ${age} ago`);
+  }
+  console.log("");
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+}
+function formatAge(ms) {
+  const hours = Math.floor(ms / (1e3 * 60 * 60));
+  if (hours < 1) return `${Math.floor(ms / (1e3 * 60))}m`;
+  if (hours < 48) return `${hours}h`;
+  return `${Math.floor(hours / 24)}d`;
+}
+async function main(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(`
+  exe-os vps-backup \u2014 Postgres backup manager
+
+  Usage:
+    exe-os vps-backup              Run backup now
+    exe-os vps-backup --setup      Install cron job (every 6 hours)
+    exe-os vps-backup --clean      Run backup + clean old backups
+    exe-os vps-backup --list       List current backups
+    exe-os vps-backup --pre-deploy <version>  Pre-deploy snapshot
+`);
+    return;
+  }
+  if (args.includes("--setup")) {
+    setupCron();
+    return;
+  }
+  if (args.includes("--list")) {
+    listBackups();
+    return;
+  }
+  const preDeployIdx = args.indexOf("--pre-deploy");
+  if (preDeployIdx !== -1) {
+    const version = args[preDeployIdx + 1];
+    if (!version) {
+      console.error("[vps-backup] --pre-deploy requires a version argument");
+      process.exitCode = 1;
+      return;
+    }
+    preDeployBackup(version);
+    return;
+  }
+  runPgBackup();
+  if (args.includes("--clean")) {
+    cleanOldBackups();
+  }
+}
+
+export {
+  runPgBackup,
+  cleanOldBackups,
+  preDeployBackup,
+  setupCron,
+  listBackups,
+  main
+};

package/dist/{chunk-PLQAFB3Z.js → chunk-5JIG2FP2.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-UWQ3XCDG.js → chunk-5WK7X5CF.js}

@@ -1,10 +1,10 @@
 import {
   readMcpHttpEvents,
   summarizeMcpTransport
-} from "./chunk-UODVZGBQ.js";
+} from "./chunk-KN7LPTIB.js";
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";

package/dist/{chunk-DDPAQ4LT.js → chunk-6JAGJN77.js}

@@ -1,9 +1,9 @@
 import {
   sendMessage
-} from "./chunk-5GG7MTRJ.js";
+} from "./chunk-DGBGIXCC.js";
 import {
   getActiveAgent
-} from "./chunk-RA2RO27E.js";
+} from "./chunk-MCESA5UW.js";
 
 // src/mcp/tools/send-message.ts
 import { z } from "zod";

package/dist/{chunk-7F37NMKB.js → chunk-73UE2PHT.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/token-spend.ts
 import { readdir, stat } from "fs/promises";

package/dist/{chunk-JL3K5OTS.js → chunk-7IZWLMTP.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 import {
   enforcePrivateFileSync,
   ensurePrivateDirSync

package/dist/{chunk-ELRRL2NC.js → chunk-A4K2ZT6N.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/pipeline-router.ts
 import crypto from "crypto";
@@ -116,12 +116,12 @@ async function sinkCRM(msg, agentResponse, agentName) {
 }
 async function sinkWiki(msg, agentResponse) {
   try {
-    const { createWikiClient } = await import("./wiki-client-MAFYBXCQ.js");
+    const { createWikiClient } = await import("./wiki-client-GBPR45BQ.js");
     const client = await createWikiClient();
     if (!client) return false;
     const content = msg.text ?? "";
     if (content.length < 50) return false;
-    const { chatInWorkspace } = await import("./wiki-client-MAFYBXCQ.js");
+    const { chatInWorkspace } = await import("./wiki-client-GBPR45BQ.js");
     const ingestText = [
       `[${msg.platform}] Message from ${msg.senderName ?? msg.senderId} (${msg.timestamp}):`,
       content,
@@ -149,7 +149,7 @@ async function sinkEntityExtraction(msg, agentResponse, agentName) {
     const client = getClient();
     const memoryId = `conv:${msg.messageId}`;
     await storeExtraction(client, extraction, memoryId, msg.timestamp);
-    import("./conversation-wiki-populator-YU35LNRK.js").then(
+    import("./conversation-wiki-populator-L7O6F3BB.js").then(
       ({ populateWikiFromExtraction }) => populateWikiFromExtraction(extraction, msg, agentResponse, agentName)
     ).catch((err) => {
       process.stderr.write(

package/dist/{chunk-GWYADLIW.js → chunk-AHXEU5XB.js}

@@ -1,6 +1,6 @@
 import {
   MODELS_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/reranker.ts
 import path from "path";

package/dist/{chunk-WSHMBME6.js → chunk-AWRL5FGM.js}

@@ -1,11 +1,10 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 
 // src/lib/db-backup.ts
-import { copyFileSync, existsSync, mkdirSync, readdirSync, unlinkSync, statSync } from "fs";
+import { existsSync, readdirSync, unlinkSync, statSync } from "fs";
 import { copyFile, mkdir, unlink } from "fs/promises";
-import { execFileSync } from "child_process";
 import path from "path";
 var BACKUP_DIR = path.join(EXE_AI_DIR, "backups");
 var DEFAULT_KEEP_DAYS = 3;
@@ -17,60 +16,8 @@ function findActiveDb() {
   }
   return null;
 }
-function createBackup(reason = "manual") {
-  const dbPath = findActiveDb();
-  if (!dbPath) return null;
-  mkdirSync(BACKUP_DIR, { recursive: true });
-  const dbName = path.basename(dbPath, ".db");
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
-  const backupName = `${dbName}-${reason}-${timestamp}.db`;
-  const backupPath = path.join(BACKUP_DIR, backupName);
-  try {
-    execFileSync("sqlite3", [dbPath, "PRAGMA wal_checkpoint(TRUNCATE);"], {
-      timeout: 3e4,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-  } catch {
-    process.stderr.write(`[db-backup] WAL checkpoint skipped (sqlite3 CLI unavailable or encrypted DB)
-`);
-  }
-  copyFileSync(dbPath, backupPath);
-  try {
-    const result = execFileSync("sqlite3", [backupPath, "PRAGMA quick_check;"], {
-      encoding: "utf8",
-      timeout: 1e4,
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-    if (result !== "ok") {
-      process.stderr.write(`[db-backup] WARNING: backup failed quick_check (${reason}): ${result}
-`);
-      try {
-        unlinkSync(backupPath);
-      } catch {
-      }
-      return null;
-    }
-  } catch (err) {
-    process.stderr.write(
-      `[db-backup] Backup validation skipped: ${err instanceof Error ? err.message : String(err)}
-`
-    );
-  }
-  const walPath = dbPath + "-wal";
-  if (existsSync(walPath)) {
-    try {
-      copyFileSync(walPath, backupPath + "-wal");
-    } catch {
-    }
-  }
-  const shmPath = dbPath + "-shm";
-  if (existsSync(shmPath)) {
-    try {
-      copyFileSync(shmPath, backupPath + "-shm");
-    } catch {
-    }
-  }
-  return backupPath;
+async function createBackup(reason = "manual") {
+  return createBackupAsync(reason);
 }
 async function createBackupAsync(reason = "manual") {
   const dbPath = findActiveDb();
@@ -97,16 +44,12 @@ async function createBackupAsync(reason = "manual") {
   }
   await copyFile(dbPath, backupPath);
   try {
-    const { execFile } = await import("child_process");
-    const { promisify } = await import("util");
-    const execFileAsync = promisify(execFile);
-    const { stdout } = await execFileAsync("sqlite3", [backupPath, "PRAGMA quick_check;"], {
-      encoding: "utf8",
-      timeout: 1e4
-    });
-    const result = String(stdout ?? "").trim();
-    if (result !== "ok") {
-      process.stderr.write(`[db-backup] WARNING: backup failed quick_check (${reason}): ${result}
+    const { getClient } = await import("./lib/database.js");
+    const client = getClient();
+    const chk = await client.execute("PRAGMA quick_check;");
+    const result = String(chk.rows[0]?.quick_check ?? chk.rows[0]?.[0] ?? "").trim();
+    if (result && result !== "ok") {
+      process.stderr.write(`[db-backup] WARNING: backup source failed quick_check (${reason}): ${result}
 `);
       try {
         await unlink(backupPath);
@@ -114,11 +57,9 @@ async function createBackupAsync(reason = "manual") {
       }
       return null;
     }
-  } catch (err) {
-    process.stderr.write(
-      `[db-backup] Backup validation skipped: ${err instanceof Error ? err.message : String(err)}
-`
-    );
+  } catch {
+    process.stderr.write(`[db-backup] Backup validation skipped (encrypted DB or CLI context) \u2014 proceeding with checkpoint-consistent copy.
+`);
   }
   const walPath = dbPath + "-wal";
   if (existsSync(walPath)) {
@@ -180,25 +121,25 @@ function getLatestBackup() {
   const backups = listBackups();
   return backups.length > 0 ? backups[0].path : null;
 }
-function restoreBackup(backupPath) {
+async function restoreBackup(backupPath) {
   const dbPath = findActiveDb();
   if (!dbPath) {
     const target = path.join(EXE_AI_DIR, DB_NAMES[0]);
     const source2 = backupPath ?? getLatestBackup();
     if (!source2 || !existsSync(source2)) return null;
-    copyFileSync(source2, target);
+    await copyFile(source2, target);
     return { restored: path.basename(source2), preRestoreBackup: null };
   }
   const source = backupPath ?? getLatestBackup();
   if (!source || !existsSync(source)) return null;
   if (path.resolve(source) === path.resolve(dbPath)) return null;
-  const preRestoreBackup = createBackup("pre-restore");
-  copyFileSync(source, dbPath);
+  const preRestoreBackup = await createBackup("pre-restore");
+  await copyFile(source, dbPath);
   const walPath = source + "-wal";
   const shmPath = source + "-shm";
   if (existsSync(walPath)) {
     try {
-      copyFileSync(walPath, dbPath + "-wal");
+      await copyFile(walPath, dbPath + "-wal");
     } catch {
     }
   } else {
@@ -209,7 +150,7 @@ function restoreBackup(backupPath) {
   }
   if (existsSync(shmPath)) {
     try {
-      copyFileSync(shmPath, dbPath + "-shm");
+      await copyFile(shmPath, dbPath + "-shm");
     } catch {
     }
   } else {

package/dist/{chunk-OMPCFLWA.js → chunk-BSPOEYAO.js}

@@ -1,6 +1,6 @@
 import {
   completeReminder
-} from "./chunk-5WLMF6PL.js";
+} from "./chunk-YMZHTTOQ.js";
 
 // src/mcp/tools/complete-reminder.ts
 import { z } from "zod";

package/dist/{chunk-F4TCKCKK.js → chunk-BYCNUKII.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-D5C56WO3.js";
+} from "./chunk-MOZ2YQ54.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";
@@ -350,6 +350,7 @@ function hydrateEnv(raw, opts) {
     if (!/CHANGEME/.test(value)) continue;
     if (key === "EXE_LICENSE_KEY" && license) replacements[key] = license;
     else if (key === "MONITOR_AGENT_TOKEN" || key === "MONITOR_AGENT_KEY") continue;
+    else if (key === "CLOUDFLARE_TUNNEL_TOKEN") continue;
     else if (key === "EXE_GATEWAY_WS_RELAY_AUTH_TOKEN") replacements[key] = randomHexSecret(24);
     else if (key.endsWith("_PASSWORD")) replacements[key] = randomSecret(24);
     else if (key.endsWith("_TOKEN")) replacements[key] = randomHexSecret(32);
@@ -414,6 +415,11 @@ function bootstrapStackHost(options) {
   }
   copyTemplateIfMissing("deploy/compose/docker-compose.yml", options.composeFile, createdFiles);
   copyTemplateIfMissing("deploy/compose/.env.customer.example", options.envFile, createdFiles);
+  copyTemplateIfMissing(
+    "deploy/compose/init-db.sql",
+    path.join(path.dirname(options.composeFile), "init-db.sql"),
+    createdFiles
+  );
   copyTemplateIfMissing(
     "deploy/compose/clickhouse-config.xml",
     path.join(path.dirname(options.envFile), "clickhouse-config.xml"),
@@ -422,6 +428,11 @@ function bootstrapStackHost(options) {
   const brandingDest = path.join(path.dirname(options.envFile), "branding.json");
   copyTemplateIfMissing("deploy/compose/gateway.json", path.join(path.dirname(options.envFile), "gateway.json"), createdFiles);
   if (!existsSync(brandingDest)) writeFileSync(brandingDest, JSON.stringify({ brandName: "Hygo", productName: "Hygo OS" }, null, 2) + "\n", { mode: 384 });
+  copyTemplateIfMissing(
+    "deploy/compose/cloudflared/config.yml.example",
+    path.join(path.dirname(options.composeFile), "cloudflared", "config.yml.example"),
+    createdFiles
+  );
   let envHadPlaceholders = false;
   let envRemainingPlaceholders = [];
   if (existsSync(options.envFile)) {
@@ -458,7 +469,7 @@ function assertHostReadyForApply(report) {
   if (!report.composeFileExists) blockers.push("docker-compose.yml is missing and could not be created.");
   if (!report.envFileExists) blockers.push(".env is missing and could not be created.");
   if (!report.licensePresent) blockers.push("Exe OS license key is missing. Run `exe-os setup`, `exe-os --activate <key>`, or pass --license-key.");
-  const hardPlaceholders = report.envRemainingPlaceholders.filter((p) => !/WHATSAPP|API_ROUTER|MONITOR_AGENT/.test(p));
+  const hardPlaceholders = report.envRemainingPlaceholders.filter((p) => !/WHATSAPP|API_ROUTER|MONITOR_AGENT|CLOUDFLARE_TUNNEL_TOKEN/.test(p));
   if (hardPlaceholders.length > 0) blockers.push(`Required .env placeholders remain: ${hardPlaceholders.join(", ")}`);
   if (blockers.length > 0) throw new Error(`Stack host is not ready:
 - ${blockers.join("\n- ")}`);
@@ -565,8 +576,10 @@ async function runStackUpdate(options) {
   warnLegacyDaemonVolume();
   if (!options.dryRun) {
     try {
-      const { runPreflight } = await import("./preflight-EAH2MI76.js");
-      const preflightReport = runPreflight({
+      if (!options.preflight) {
+        throw new Error("preflight hook not provided");
+      }
+      const preflightReport = options.preflight({
         composeFile: options.composeFile,
         envFile: options.envFile
       });
@@ -620,8 +633,10 @@ async function runStackUpdate(options) {
   }
   await postDeployAudit(options, "started", plan.targetVersion, previousVersion);
   try {
-    const { preDeployBackup } = await import("./bin/vps-backup.js");
-    preDeployBackup(plan.targetVersion);
+    if (!options.preDeployBackup) {
+      throw new Error("preDeployBackup hook not provided");
+    }
+    options.preDeployBackup(plan.targetVersion);
   } catch {
   }
   const stackDir = path.dirname(options.envFile);
@@ -696,6 +711,20 @@ async function runStackUpdate(options) {
         }
       }
     }
+    if (!creds) {
+      const sampleImage = Object.values(plan.release.services)[0]?.image ?? "";
+      if (sampleImage.startsWith("update.askexe.com")) {
+        const stackEnvPullTokensRaw = process.env.EXE_REGISTRY_PROXY_PULL_TOKENS || (existsSync(options.envFile) ? (() => {
+          const envMap = parseEnv(readFileSync(options.envFile, "utf8"));
+          return envMap.get("EXE_REGISTRY_PROXY_PULL_TOKENS") ?? "";
+        })() : "");
+        const firstPullToken = stackEnvPullTokensRaw.split(/[\n,]/).map((s) => s.trim()).find(Boolean);
+        if (firstPullToken) {
+          creds = { registry: "update.askexe.com", username: "token", password: firstPullToken };
+          console.log("[stack-update] Using EXE_REGISTRY_PROXY_PULL_TOKENS for update.askexe.com registry auth.");
+        }
+      }
+    }
     if (!creds) {
       const sampleImage = Object.values(plan.release.services)[0]?.image ?? "";
       if (sampleImage.startsWith("update.askexe.com")) {
@@ -755,8 +784,10 @@ async function runStackUpdate(options) {
       // ERP WebSocket (Socket.io)
       "exe-erp-queue",
       // ERP background workers (RQ)
-      "exe-erp-scheduler"
+      "exe-erp-scheduler",
       // ERP scheduled tasks
+      "cloudflared"
+      // tunnel — restarted last so services are healthy before it connects
     ];
     const preSnapshot = spawnSync("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
     const preContainerCount = preSnapshot.stdout?.split("\n").filter(Boolean).length ?? 0;
@@ -809,9 +840,11 @@ async function runStackUpdate(options) {
     }
     await verifyReleaseHealth(plan.release, options.healthRetries ?? 12, options.healthDelayMs ?? 5e3);
     try {
-      const { runHealthGate, logResult } = await import("./bin/vps-health-gate.js");
-      const gateResult = await runHealthGate();
-      logResult(gateResult);
+      if (!options.healthGate) {
+        throw new Error("healthGate hook not provided");
+      }
+      const gateResult = await options.healthGate();
+      options.logHealthGateResult?.(gateResult);
       if (!gateResult.passed) {
         const failed = gateResult.results.filter((r) => r.status === "fail").map((r) => r.check);
         throw new Error(`Health gate failed: ${failed.join(", ")}`);
@@ -825,8 +858,10 @@ async function runStackUpdate(options) {
     }
     assertVolumesIntact();
     try {
-      const { runVerifyStack } = await import("./bin/verify-stack.js");
-      const verifyReport = await runVerifyStack({ composeFile: options.composeFile, envFile: options.envFile });
+      if (!options.verifyStack) {
+        throw new Error("verifyStack hook not provided");
+      }
+      const verifyReport = await options.verifyStack({ composeFile: options.composeFile, envFile: options.envFile });
       for (const r of verifyReport.results) {
         if (r.status === "fail") console.warn(`[verify-stack] FAIL: ${r.check}: ${r.message}`);
       }

package/dist/{chunk-DHVC4RN7.js → chunk-CBDPEJOR.js}

@@ -1,13 +1,13 @@
 import {
   getMasterKey,
   setMasterKey
-} from "./chunk-KDJRFJDL.js";
+} from "./chunk-K333WOW4.js";
 import {
   LEGACY_LANCE_PATH,
   MODELS_DIR,
   loadConfig,
   saveConfig
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 import {
   atomicWriteJsonSync,
   atomicWriteSync
@@ -380,7 +380,7 @@ async function runSetupWizard(opts = {}) {
             "Setup cancelled: recovery phrase was not confirmed. Save the 24-word phrase before continuing \u2014 it is required to recover encrypted memories."
           );
         }
-        const { markKeyBackupConfirmed } = await import("./key-backup-status-OZ2CXUDW.js");
+        const { markKeyBackupConfirmed } = await import("./key-backup-status-4YKCV4ZV.js");
         markKeyBackupConfirmed("setup-wizard");
       }
       state.completedSteps.push(1);
@@ -534,7 +534,7 @@ async function runSetupWizard(opts = {}) {
       if (cloudConfig) {
         config.cloud = cloudConfig;
       }
-      const { applyDefaultOrchestrationPhase } = await import("./orchestration-phase-SGA7PJ5G.js");
+      const { applyDefaultOrchestrationPhase } = await import("./orchestration-phase-C26XVKLZ.js");
       applyDefaultOrchestrationPhase(config);
       await saveConfig(config);
       log("");
@@ -863,7 +863,7 @@ async function runSetupWizard(opts = {}) {
       log("  Phase 3: Parallel org \u2014 specialists execute in parallel with reviews");
       log("");
       const unlockExecutives = (await askOrEnv("Unlock Phase 2 executives now? (y/N): ", void 0, "n")).toLowerCase() === "y";
-      const { setOrchestrationPhase } = await import("./orchestration-phase-SGA7PJ5G.js");
+      const { setOrchestrationPhase } = await import("./orchestration-phase-C26XVKLZ.js");
       if (!unlockExecutives) {
         await setOrchestrationPhase("phase_1_coo", "setup-wizard");
         log("");

package/dist/{chunk-2H55BIV2.js → chunk-CEJO7244.js}

@@ -1,13 +1,13 @@
 import {
   listBackups
-} from "./chunk-WSHMBME6.js";
+} from "./chunk-AWRL5FGM.js";
 import {
   EMBEDDING_DIM
 } from "./chunk-FXU7JOXK.js";
 import {
   EXE_AI_DIR,
   loadConfigSync
-} from "./chunk-TRZ5KA2R.js";
+} from "./chunk-VXIMSRTO.js";
 import {
   atomicWriteJson
 } from "./chunk-LYH5HE24.js";

package/dist/{chunk-FKWZVO2T.js → chunk-CPXGLSIL.js}

@@ -1,6 +1,6 @@
 import {
   routeTask
-} from "./chunk-PLQAFB3Z.js";
+} from "./chunk-5JIG2FP2.js";
 import {
   createTaskCore,
   employeeSessionName,
@@ -9,11 +9,11 @@ import {
   isEmployeeAlive,
   sessionScopeFilter,
   updateTaskStatus
-} from "./chunk-HNLPLLE6.js";
+} from "./chunk-F7JLZXHC.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   getCoordinatorName
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/runtime/orchestrator.ts
 var STALE_THRESHOLD_MS = 2 * 60 * 60 * 1e3;

package/dist/{chunk-HX5G4AS4.js → chunk-CWITU7DW.js}

@@ -1,13 +1,13 @@
 import {
   vectorToBlob
-} from "./chunk-FGJUGDNM.js";
+} from "./chunk-222SI7QC.js";
 import {
   extractKeywords,
   keywordsToString
 } from "./chunk-CHCA3ZM2.js";
 import {
   isCoordinatorName
-} from "./chunk-2H55BIV2.js";
+} from "./chunk-CEJO7244.js";
 
 // src/lib/consolidation.ts
 import { randomUUID } from "crypto";