@askexenow/exe-os 0.9.244 → 0.9.245

package/deploy/compose/.env.customer.example

@@ -63,12 +63,24 @@ API_ROUTER_KEY=exe_rk_CHANGEME_API_ROUTER_KEY
 GATEWAY_HTTP_HOST_PORT=3100
 GATEWAY_WS_HOST_PORT=3101
 
+# --- Monitoring hub (PocketBase — local per-customer instance) ---
+MONITOR_HUB_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-hub:v0.9.3
+MONITOR_HUB_PORT=8090
+# Bootstrap superuser created on first start. Use your admin email + a strong password.
+# After first boot these values are no longer used (stored in pb_data volume).
+# SECURITY: access /_/ admin panel via SSH tunnel only — it is blocked in the Cloudflare Tunnel.
+#   ssh -L 8090:127.0.0.1:8090 <vps>  then open  http://localhost:8090/_/
+MONITOR_HUB_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
+MONITOR_HUB_ADMIN_PASSWORD=CHANGEME_MONITOR_HUB_ADMIN_PASSWORD
+
 # --- Monitoring agent (standard for managed customer VPSs) ---
 MONITOR_AGENT_IMAGE_TAG=update.askexe.com/askexe/exe-monitor-agent:v0.9.3
+# Reports to the local hub. Auto-populated by `exe-os stack-update` during bootstrap.
 MONITOR_HUB_URL=http://exe-monitor-hub:8090
-# Required: values copied from the local exe-monitor-hub when adding the Hygo/customer system.
-MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN_FROM_MONITOR_HUB
-MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_PUBLIC_KEY_FROM_MONITOR_HUB
+# TOKEN and KEY are written automatically by stack-update via /api/register-agent.
+# Leave as CHANGEME — stack-update fills them on first deploy.
+MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN
+MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_KEY
 MONITOR_AGENT_LISTEN=:45876
 
 # --- AskExe central monitoring hub ---

package/deploy/compose/.env.example

@@ -79,12 +79,24 @@ ERP_WS_PORT=9069
 # ERP_SENTRY_DSN=
 # MONITOR_API_KEY=   # shared with gateway error forwarding
 
+# --- Monitoring hub (PocketBase — local per-customer instance) ---
+MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v0.9.4
+MONITOR_HUB_PORT=8090
+# Bootstrap superuser created on first start. Use your admin email + a strong password.
+# After first boot these values are no longer used (stored in pb_data volume).
+# SECURITY: access /_/ admin panel via SSH tunnel only — it is blocked in the Cloudflare Tunnel.
+#   ssh -L 8090:127.0.0.1:8090 <vps>  then open  http://localhost:8090/_/
+MONITOR_HUB_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
+MONITOR_HUB_ADMIN_PASSWORD=CHANGEME_MONITOR_HUB_ADMIN_PASSWORD
+
 # --- Monitoring agent (standard for managed customer VPSs) ---
 MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v0.9.4
+# Reports to the local hub. Auto-populated by `exe-os stack-update` during bootstrap.
 MONITOR_HUB_URL=http://exe-monitor-hub:8090
-# Values copied from monitor.askexe.com when adding a new system.
-MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN_FROM_MONITOR_HUB
-MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_PUBLIC_KEY_FROM_MONITOR_HUB
+# TOKEN and KEY are written automatically by stack-update via /api/register-agent.
+# Leave as CHANGEME — stack-update fills them on first deploy.
+MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN
+MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_KEY
 MONITOR_AGENT_LISTEN=:45876
 
 # --- AskExe central monitoring hub auth (AskExe-owned infra only) ---

package/deploy/compose/docker-compose.yml

@@ -162,6 +162,12 @@ services:
     environment:
       EXE_MONITOR_ADMIN_TOKEN: ${EXE_MONITOR_ADMIN_TOKEN:-}
       GOTRUE_URL: http://gotrue:9999
+      # Bootstrap superuser on first start — required so the hub is never empty
+      # after stack-update. Set these in .env before first deploy.
+      # After first boot these values are no longer used (PocketBase persists the
+      # superadmin in pb_data). They can be left set in .env for idempotent re-runs.
+      PB_ADMIN_EMAIL: ${MONITOR_HUB_ADMIN_EMAIL:-}
+      PB_ADMIN_PASSWORD: ${MONITOR_HUB_ADMIN_PASSWORD:-}
     ports:
       - "127.0.0.1:${MONITOR_HUB_PORT:-8090}:8090"
     volumes:
@@ -436,10 +442,19 @@ services:
     image: ${MONITOR_AGENT_IMAGE_TAG:-ghcr.io/askexe/exe-monitor-agent:v0.9.4}
     container_name: exe-monitor-agent
     restart: unless-stopped
+    # Depends on hub so pairing can succeed on first boot.
+    depends_on:
+      exe-monitor-hub:
+        condition: service_healthy
     environment:
+      # Reports to the local hub by default. stack-update auto-pairs this agent
+      # with the hub via /api/register-agent and writes TOKEN + KEY back to .env.
       HUB_URL: ${MONITOR_HUB_URL:-http://exe-monitor-hub:8090}
-      TOKEN: ${MONITOR_AGENT_TOKEN:?MONITOR_AGENT_TOKEN is required — create Hygo system in monitor.askexe.com}
-      KEY: ${MONITOR_AGENT_KEY:?MONITOR_AGENT_KEY is required — copy public key from monitor.askexe.com}
+      # TOKEN and KEY are written automatically by `exe-os stack-update` during
+      # bootstrap. They start empty; the agent retries connecting until the hub
+      # is paired. Do NOT make these :? required — the hub must be up first.
+      TOKEN: ${MONITOR_AGENT_TOKEN:-}
+      KEY: ${MONITOR_AGENT_KEY:-}
       LISTEN: ${MONITOR_AGENT_LISTEN:-:45876}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro

package/deploy/compose/generate-env.ts

@@ -124,15 +124,26 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "# ERP_SENTRY_DSN=",
     "# MONITOR_API_KEY=   # shared with gateway error forwarding",
     "",
-    "# --- Monitoring ---",
+    "# --- Monitoring hub (PocketBase — local per-customer instance) ---",
     `MONITOR_HUB_IMAGE_TAG=${MONITOR_HUB_IMAGE_TAG}`,
+    "MONITOR_HUB_PORT=8090",
+    "# Bootstrap superuser created on first start. Use your admin email + a strong password.",
+    "# After first boot these values are no longer used (stored in pb_data volume).",
+    "# SECURITY: access /_/ admin panel via SSH tunnel only — it is blocked in the Cloudflare Tunnel.",
+    "#   ssh -L 8090:127.0.0.1:8090 <vps>  then open  http://localhost:8090/_/",
+    `MONITOR_HUB_ADMIN_EMAIL=admin@${normalizedDomain}`,
+    `MONITOR_HUB_ADMIN_PASSWORD=${randomSecret(24)}`,
+    "",
+    "# --- Monitoring agent (standard for managed customer VPSs) ---",
     `MONITOR_AGENT_IMAGE_TAG=${MONITOR_AGENT_IMAGE_TAG}`,
-    `EXE_MONITOR_ADMIN_TOKEN=${randomSecret(RANDOM_SECRET_48)}`,
+    "# Reports to the local hub. Auto-populated by `exe-os stack-update` during bootstrap.",
     `MONITOR_HUB_URL=${DEFAULT_MONITOR_HUB_URL}`,
-    "MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN_FROM_MONITOR_HUB",
-    "MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_PUBLIC_KEY_FROM_MONITOR_HUB",
+    "# TOKEN and KEY are written automatically by stack-update via /api/register-agent.",
+    "# Leave as CHANGEME — stack-update fills them on first deploy.",
+    "MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN",
+    "MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_KEY",
     `MONITOR_AGENT_LISTEN=${DEFAULT_MONITOR_AGENT_LISTEN}`,
-    "MONITOR_HUB_PORT=8090",
+    `EXE_MONITOR_ADMIN_TOKEN=${randomSecret(RANDOM_SECRET_48)}`,
     "",
     "# --- Cloudflare Tunnel ---",
     "# Token-based tunnel (recommended). Get your token:",
@@ -231,12 +242,24 @@ export function generateExampleEnv(): string {
     "# ERP_SENTRY_DSN=",
     "# MONITOR_API_KEY=   # shared with gateway error forwarding",
     "",
+    "# --- Monitoring hub (PocketBase — local per-customer instance) ---",
+    `MONITOR_HUB_IMAGE_TAG=${MONITOR_HUB_IMAGE_TAG}`,
+    "MONITOR_HUB_PORT=8090",
+    "# Bootstrap superuser created on first start. Use your admin email + a strong password.",
+    "# After first boot these values are no longer used (stored in pb_data volume).",
+    "# SECURITY: access /_/ admin panel via SSH tunnel only — it is blocked in the Cloudflare Tunnel.",
+    "#   ssh -L 8090:127.0.0.1:8090 <vps>  then open  http://localhost:8090/_/",
+    "MONITOR_HUB_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL",
+    "MONITOR_HUB_ADMIN_PASSWORD=CHANGEME_MONITOR_HUB_ADMIN_PASSWORD",
+    "",
     "# --- Monitoring agent (standard for managed customer VPSs) ---",
     `MONITOR_AGENT_IMAGE_TAG=${MONITOR_AGENT_IMAGE_TAG}`,
+    "# Reports to the local hub. Auto-populated by `exe-os stack-update` during bootstrap.",
     `MONITOR_HUB_URL=${DEFAULT_MONITOR_HUB_URL}`,
-    "# Values copied from monitor.askexe.com when adding a new system.",
-    "MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN_FROM_MONITOR_HUB",
-    "MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_PUBLIC_KEY_FROM_MONITOR_HUB",
+    "# TOKEN and KEY are written automatically by stack-update via /api/register-agent.",
+    "# Leave as CHANGEME — stack-update fills them on first deploy.",
+    "MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN",
+    "MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_KEY",
     `MONITOR_AGENT_LISTEN=${DEFAULT_MONITOR_AGENT_LISTEN}`,
     "",
     "# --- AskExe central monitoring hub auth (AskExe-owned infra only) ---",

package/deploy/compose/setup.sh

@@ -103,10 +103,13 @@ MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v0.9.4
 MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v0.9.4
 EXE_MONITOR_ADMIN_TOKEN=$(gen 48)
 MONITOR_HUB_URL=http://exe-monitor-hub:8090
+MONITOR_HUB_PORT=8090
+# Bootstrap superuser — created on first start, stored in pb_data afterwards.
+MONITOR_HUB_ADMIN_EMAIL=admin@${DOMAIN}
+MONITOR_HUB_ADMIN_PASSWORD=$(gen 24)
 MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN
 MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_KEY
 MONITOR_AGENT_LISTEN=:45876
-MONITOR_HUB_PORT=8090
 # --- R2 (Cloudflare) — shared by media uploads + VPS backups ---
 R2_MEDIA_BUCKET=CHANGEME_R2_BUCKET
 R2_MEDIA_ENDPOINT=CHANGEME_https://ACCOUNT_ID.r2.cloudflarestorage.com

package/dist/bin/exe-forget.js

@@ -4,7 +4,7 @@ import {
 } from "../chunk-AQBEG33D.js";
 import {
   lightweightSearch
-} from "../chunk-DLZYAYVM.js";
+} from "../chunk-2MNLSUC6.js";
 import "../chunk-222SI7QC.js";
 import "../chunk-CHCA3ZM2.js";
 import "../chunk-IZVKWBIP.js";

package/dist/bin/exe-search.js

@@ -2,7 +2,7 @@
 import {
   hybridSearch,
   lightweightSearch
-} from "../chunk-DLZYAYVM.js";
+} from "../chunk-2MNLSUC6.js";
 import {
   initStore
 } from "../chunk-222SI7QC.js";

package/dist/bin/stack-update.js

@@ -10,7 +10,7 @@ import {
   loadStackManifest,
   patchEnv,
   runStackUpdate
-} from "../chunk-BYCNUKII.js";
+} from "../chunk-OCLP7WP4.js";
 import {
   runVerifyStack
 } from "../chunk-IRHNV4GY.js";
@@ -20,7 +20,7 @@ import {
 import {
   logResult,
   runHealthGate
-} from "../chunk-TD5CADZ5.js";
+} from "../chunk-ZYRMTXBF.js";
 import "../chunk-MOZ2YQ54.js";
 import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";

package/dist/bin/vps-health-gate.js

@@ -8,7 +8,7 @@ import {
   logResult,
   main,
   runHealthGate
-} from "../chunk-TD5CADZ5.js";
+} from "../chunk-ZYRMTXBF.js";
 import "../chunk-MLKGABMK.js";
 export {
   checkCRM,

package/dist/{catchup-brief-LF5Z6Q6E.js → catchup-brief-KTDI32BO.js}

@@ -1,6 +1,6 @@
 import {
   lightweightSearch
-} from "./chunk-DLZYAYVM.js";
+} from "./chunk-2MNLSUC6.js";
 import "./chunk-222SI7QC.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-IZVKWBIP.js";

package/dist/{chunk-DLZYAYVM.js → chunk-2MNLSUC6.js}

@@ -288,7 +288,7 @@ async function hybridSearch(queryText, agentId, options) {
   let rerankerAvailable = false;
   if (process.env.EXE_IS_DAEMON === "1") {
     try {
-      const { isRerankerAvailable } = await import("./reranker-UCPLQZE2.js");
+      const { isRerankerAvailable } = await import("./reranker-XHONNVBD.js");
       rerankerAvailable = isRerankerAvailable();
     } catch {
     }
@@ -452,7 +452,7 @@ async function hybridSearch(queryText, agentId, options) {
     try {
       let rerankedRecords;
       if (graphContextMap.size > 0) {
-        const { rerankWithContext } = await import("./reranker-UCPLQZE2.js");
+        const { rerankWithContext } = await import("./reranker-XHONNVBD.js");
         const candidates = merged.map((m) => ({
           text: m.raw_text,
           context: graphContextMap.get(m.id)
@@ -460,7 +460,7 @@ async function hybridSearch(queryText, agentId, options) {
         const scored = await rerankWithContext(effectiveQuery, candidates, rerankReturnLimit);
         rerankedRecords = scored.map((s) => merged[s.index]);
       } else {
-        const { rerank } = await import("./reranker-UCPLQZE2.js");
+        const { rerank } = await import("./reranker-XHONNVBD.js");
         rerankedRecords = await rerank(effectiveQuery, merged, rerankReturnLimit);
       }
       if (rerankedRecords.length > 0) {

package/dist/{chunk-BYCNUKII.js → chunk-OCLP7WP4.js}

@@ -469,7 +469,7 @@ function assertHostReadyForApply(report) {
   if (!report.composeFileExists) blockers.push("docker-compose.yml is missing and could not be created.");
   if (!report.envFileExists) blockers.push(".env is missing and could not be created.");
   if (!report.licensePresent) blockers.push("Exe OS license key is missing. Run `exe-os setup`, `exe-os --activate <key>`, or pass --license-key.");
-  const hardPlaceholders = report.envRemainingPlaceholders.filter((p) => !/WHATSAPP|API_ROUTER|MONITOR_AGENT|CLOUDFLARE_TUNNEL_TOKEN/.test(p));
+  const hardPlaceholders = report.envRemainingPlaceholders.filter((p) => !/WHATSAPP|API_ROUTER|MONITOR_AGENT|MONITOR_HUB_ADMIN|CLOUDFLARE_TUNNEL_TOKEN/.test(p));
   if (hardPlaceholders.length > 0) blockers.push(`Required .env placeholders remain: ${hardPlaceholders.join(", ")}`);
   if (blockers.length > 0) throw new Error(`Stack host is not ready:
 - ${blockers.join("\n- ")}`);

package/dist/{chunk-YRVW57UW.js → chunk-WAO67AYG.js}

@@ -10,7 +10,7 @@ import {
 import {
   isRerankerAvailable,
   rerankWithScores
-} from "./chunk-AHXEU5XB.js";
+} from "./chunk-QHVOFVSL.js";
 import {
   getCachedLicenseGate
 } from "./chunk-2WBBVEIB.js";
@@ -187,7 +187,7 @@ import {
 import {
   hybridSearch,
   recentRecords
-} from "./chunk-DLZYAYVM.js";
+} from "./chunk-2MNLSUC6.js";
 import {
   attachDocumentMetadata,
   flushBatch,
@@ -257,6 +257,7 @@ import {
   getIdentity,
   isCoordinatorName,
   isCoordinatorRole,
+  isInitialized,
   listIdentities,
   loadEmployees,
   loadEmployeesSync,
@@ -425,6 +426,10 @@ function registerRecallMyMemory(server) {
       session_scope
     }) => {
       try {
+        if (!isInitialized()) {
+          const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-YSR7RMVZ.js");
+          await fastDbInit2();
+        }
         if (!recent && !query) {
           return {
             content: [{ type: "text", text: "query is required when recent mode is not enabled." }],
@@ -527,7 +532,16 @@ ${formatted}${federatedNote}`
         };
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        const friendly = msg.includes("SQLITE_BUSY") ? "Memory system is busy \u2014 please retry." : "Failed to search memories. Please retry.";
+        let friendly;
+        if (msg.includes("SQLITE_BUSY") || msg.includes("database is locked")) {
+          friendly = "Memory system is busy \u2014 please retry.";
+        } else if (msg.includes("not initialized") || msg.includes("Call initDatabase")) {
+          friendly = "Memory system is still starting up \u2014 please retry in a moment.";
+        } else if (msg.includes("Daemon not running") || msg.includes("FTS5 corruption")) {
+          friendly = "Memory daemon is not running \u2014 please restart the daemon and retry.";
+        } else {
+          friendly = `Failed to search memories: ${msg}`;
+        }
         return {
           content: [{ type: "text", text: friendly }],
           isError: true

package/dist/{chunk-TD5CADZ5.js → chunk-ZYRMTXBF.js}

@@ -204,7 +204,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-7F2E2MBJ.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-ZBK34WTB.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/hooks/error-recall.js

@@ -4,7 +4,7 @@ import {
 import {
   hybridSearch,
   lightweightSearch
-} from "../chunk-DLZYAYVM.js";
+} from "../chunk-2MNLSUC6.js";
 import {
   initStore
 } from "../chunk-222SI7QC.js";

package/dist/hooks/manifest.json

@@ -1,11 +1,11 @@
 {
   "version": 1,
-  "generatedAt": "2026-06-09T11:17:57.737Z",
+  "generatedAt": "2026-06-09T11:34:40.567Z",
   "hashes": {
     "bug-report-worker.js": "a6039ded4fe88f726e8abee1943ab0b3eb041caadf6b31c62fdf26cc4b44ed15",
     "codex-stop-task-finalizer.js": "14c012358cec82d3e45631d8fbf680b5801300dbcacfc518f6db5865160fd8f9",
     "commit-complete.js": "cdff7e603781d8edc7f99586f6042a5a7af69bf1ad54cb22827bfa01228373b0",
-    "error-recall.js": "340af628634bb2c85a571691e779f92cb2339844653307479de22ddaed94d6f8",
+    "error-recall.js": "47c685b1a4ba96c41597b49f19d3af7e022874569231b88fa265cefef3648b52",
     "exe-heartbeat-hook.js": "83edb81ef4961f2846a07998ac8eaceaa9fb0345fa429fea60f5c30b7943f803",
     "ingest-worker.js": "141c5a2091320796bca5f8ef1b1243e405808eda945e5aa0a1d5a384eaae141b",
     "ingest.js": "5705cebcf45dc67b1aa5fca9d42b61591ec66bdab2e6c57852abd3aa8f6c03eb",
@@ -15,9 +15,9 @@
     "post-tool-combined.js": "0f9db77b099ea6a6863a45521e629fedbf23da48bf71647c42f2d5b3502bfa68",
     "pre-compact.js": "9aa324537fa703b3db44e3bb03067c9b531e026e7f0362bf40a99c4d617474cb",
     "pre-tool-use.js": "d219add8c432350b4de26a37f616bba5bd098e35cf0136d80684f57f253dc0bb",
-    "prompt-submit.js": "2670bb292a3a1ef2b42be9e48784da0e1d119e42c068b1131c04ce4789a454ca",
+    "prompt-submit.js": "70bd8885072d7ccaf84929daec753c726be1b0baaa41a5b7aeef4f2b162f7cf3",
     "session-end.js": "51230f562e9fd1b66a72f04b68a47ed6bb2a20ff9d4435c0ae312581ad7015c4",
-    "session-start.js": "ae16569cb8bc689105ec5212ba0134ca79c7818d785cc48e887ce76596d6d584",
+    "session-start.js": "1aa116305aef5b361c3f221a52bd13a22a22a90b3a41595fd2d190a593c586f4",
     "stop.js": "585e82b998b280549441640c72ba278625719edc011e6295ac3f5a172fe92a4e",
     "subagent-stop.js": "854de3a24da865b71945bce5b8d7ddbdb836a5753e8bf6d0c50e05e96455a3ec",
     "summary-worker.js": "317443adac4012fdcafcb4ec79dac2f9d9abb34a4d0c825761ece3de868bb6a4"

package/dist/hooks/prompt-submit.js

@@ -1,7 +1,7 @@
 import {
   hybridSearch,
   lightweightSearch
-} from "../chunk-DLZYAYVM.js";
+} from "../chunk-2MNLSUC6.js";
 import {
   initStore
 } from "../chunk-222SI7QC.js";

package/dist/hooks/session-start.js

@@ -163,7 +163,7 @@ You are **${ag.agentId}** (${ag.agentRole}). Daemon is degraded \u2014 memory un
       query = `last actions on ${projectName}`;
       header = "## Resuming Session\nHere's where you left off:";
       try {
-        const { buildCatchupBrief } = await import("../catchup-brief-LF5Z6Q6E.js");
+        const { buildCatchupBrief } = await import("../catchup-brief-KTDI32BO.js");
         const brief = await buildCatchupBrief(
           agentId,
           projectName,

package/dist/lib/exe-daemon.js

@@ -777,6 +777,13 @@ var OOM_MARKER_PATH = path3.join(os2.homedir(), ".exe-os", "embedding-oom-marker
 var MIN_FREE_MEM_BYTES = 2 * 1024 ** 3;
 var MAX_SMALL_TOTAL_BYTES = 16 * 1024 ** 3;
 async function loadModel() {
+  const forceEmbeddings = process.env.EXE_EMBEDDINGS === "1" || process.env.EXE_EMBEDDINGS === "true";
+  if (!forceEmbeddings) {
+    process.stderr.write(`[exed] Embeddings OFF by default (FTS+Graph only). Set EXE_EMBEDDINGS=1 to enable.
+`);
+    _embeddingsDisabledByDesign = true;
+    return;
+  }
   const modelPath = path3.join(MODELS_DIR, MODEL_FILE);
   if (!existsSync3(modelPath)) {
     process.stderr.write(`[exed] No model at ${modelPath} \u2014 running without embeddings (VPS mode).

package/dist/lib/hybrid-search.js

@@ -5,7 +5,7 @@ import {
   recentRecords,
   rrfMerge,
   rrfMergeMulti
-} from "../chunk-DLZYAYVM.js";
+} from "../chunk-2MNLSUC6.js";
 import "../chunk-222SI7QC.js";
 import "../chunk-CHCA3ZM2.js";
 import "../chunk-IZVKWBIP.js";

package/dist/mcp/register-tools.js

@@ -1,11 +1,11 @@
 import {
   registerAllTools
-} from "../chunk-YRVW57UW.js";
+} from "../chunk-WAO67AYG.js";
 import "../chunk-FFLILAG6.js";
 import "../chunk-557C2IGL.js";
 import "../chunk-KEZXW3RP.js";
 import "../chunk-VQAP35DA.js";
-import "../chunk-AHXEU5XB.js";
+import "../chunk-QHVOFVSL.js";
 import "../chunk-2WBBVEIB.js";
 import "../chunk-VBPC7IC7.js";
 import "../chunk-U3DUFHOT.js";
@@ -59,7 +59,7 @@ import "../chunk-AQBEG33D.js";
 import "../chunk-LAOB5BKV.js";
 import "../chunk-RRHSONV5.js";
 import "../chunk-7IZWLMTP.js";
-import "../chunk-DLZYAYVM.js";
+import "../chunk-2MNLSUC6.js";
 import "../chunk-222SI7QC.js";
 import "../chunk-CHCA3ZM2.js";
 import "../chunk-IZVKWBIP.js";

package/dist/mcp/server.js

@@ -3,12 +3,12 @@ import {
 } from "../chunk-V4TZI6EO.js";
 import {
   registerAllTools
-} from "../chunk-YRVW57UW.js";
+} from "../chunk-WAO67AYG.js";
 import "../chunk-FFLILAG6.js";
 import "../chunk-557C2IGL.js";
 import "../chunk-KEZXW3RP.js";
 import "../chunk-VQAP35DA.js";
-import "../chunk-AHXEU5XB.js";
+import "../chunk-QHVOFVSL.js";
 import {
   initLicenseGate
 } from "../chunk-2WBBVEIB.js";
@@ -69,7 +69,7 @@ import "../chunk-AQBEG33D.js";
 import "../chunk-LAOB5BKV.js";
 import "../chunk-RRHSONV5.js";
 import "../chunk-7IZWLMTP.js";
-import "../chunk-DLZYAYVM.js";
+import "../chunk-2MNLSUC6.js";
 import {
   disposeStore,
   initStore

package/dist/{reranker-UCPLQZE2.js → reranker-XHONNVBD.js}

@@ -5,7 +5,7 @@ import {
   rerank,
   rerankWithContext,
   rerankWithScores
-} from "./chunk-AHXEU5XB.js";
+} from "./chunk-QHVOFVSL.js";
 import "./chunk-VXIMSRTO.js";
 import "./chunk-LYH5HE24.js";
 import "./chunk-MLKGABMK.js";

package/dist/{stack-update-7F2E2MBJ.js → stack-update-ZBK34WTB.js}

@@ -20,7 +20,7 @@ import {
   runStackUpdate,
   verifyReleaseHealth,
   verifyStackManifestSignature
-} from "./chunk-BYCNUKII.js";
+} from "./chunk-OCLP7WP4.js";
 import "./chunk-MOZ2YQ54.js";
 import "./chunk-VXIMSRTO.js";
 import "./chunk-LYH5HE24.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.244",
+  "version": "0.9.245",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/release-notes.json

@@ -1,6 +1,106 @@
 {
-  "current": "0.9.244",
+  "current": "0.9.245",
   "notes": {
+    "0.9.245": {
+      "version": "0.9.245",
+      "date": "2026-06-09",
+      "features": [
+        "Entity Profile UI — knowledge graph explorer + entity detail view",
+        "log MCP session open/close to stderr for docker logs visibility",
+        "Graph→PostgreSQL sync timer — automatic SQLite→exe-db projection",
+        "project GraphRAG data to PostgreSQL during cloud sync pull",
+        "add behavior effectiveness tracking — attribution, conflicts, scoring, load",
+        "close the reinforcement loop — dreaming reads investigation data",
+        "add reviews to Cloudflare support system — separate from bugs/features",
+        "self-improvement auto-merges simple fixes, notifies on failures",
+        "automatic investigation record system for debugging cycle tracking",
+        "smoke test + Playwright E2E + self-improvement cron",
+        "P0 procedures — verify your own fix + confidence decay",
+        "boot output as formatted table with box-drawing characters",
+        "show auto-fix cycle status in exe-os boot",
+        "graceful daemon restart — persist MCP sessions for transparent recovery",
+        "default to keyword+graph search, embeddings opt-in",
+        "server-side telemetry storage + admin insights endpoint",
+        "enrich telemetry payload with usage counters and auto-insights",
+        "add telemetry auto-insight computation engine",
+        "auto-calibration in dreaming cycle + telemetry integration",
+        "first-class time estimation on tasks — auto-tracked, queryable",
+        "add agent assertion system — confidence tracking on task lifecycle",
+        "auto-run dreaming cycle on session end — zero-touch self-improvement",
+        "add dreaming system + structured handoffs to platform procedures",
+        "add snapshot + boot to platform procedures and operating procedures",
+        "add `exe-os boot --project X` CLI command for project boot verification"
+      ],
+      "fixes": [
+        "embeddings OFF by default for all users — opt-in via EXE_EMBEDDINGS=1",
+        "keep generated env templates in sync",
+        "bootstrap monitor env and lazy-init recall memory",
+        "registry proxy accepts license keys + stack-update reads .env license",
+        "stack-release uses defaultBranch per repo (wiki uses master)",
+        "prevent stale task intercom prompts",
+        "v0.9.241 — 13 more bug fixes (28 total this session)",
+        "sync lockfile for Docker build — npm ci --omit=dev works again",
+        "keep review notifications session-local and test-safe",
+        "CI Dockerfile reference — Dockerfile.exed → Dockerfile.exe-os",
+        "v0.9.240 — 15 bug fixes across HYGO, Jack, platform (stack v0.9.15)",
+        "keep daemon memory recall FTS bounded",
+        "keep daemon cloud sync off CRDT heap path",
+        "suppress ENOBUFS in reapers + skip boot-time sync execution",
+        "MCP health probe in prompt hook + Docker image build tolerance",
+        "plug MCP session memory leak — zombie McpServer instances accumulated",
+        "lower RSS watchdog to 1.5/2.5GB + add GC after heavy operations",
+        "snapshot crash — daemon fallback + dreaming scope binding",
+        "skip duplicate initStore in WS client — prevents 2-8s event loop block",
+        "add session scope imports to dreaming, project-boot, telemetry-upload",
+        "resolve typecheck errors for npm publish",
+        "add setImmediate yields to Graph→PG sync — prevent event loop blocking",
+        "convert SQLite short hex IDs to valid UUIDs for PostgreSQL projection",
+        "delay initial graph sync tick to 60s + add debug logging",
+        "share DB init state between MCP HTTP and timer ticks"
+      ],
+      "security": [
+        "fix shell injection, SSRF, socket leaks, backup validation",
+        "bump v0.9.139 — 2 CRITICAL security fixes, 14 bug fixes, 6 features, customer config preservation",
+        "fix 2 CRITICAL + 1 HIGH from post-fix audit",
+        "validate X-Agent-Role against roster — prevent privilege escalation",
+        "release: stack v0.9.8 — security hardening + Hygo bug fixes",
+        "add webhook HMAC-SHA256 validation + disable query param auth in prod",
+        "pin GitHub Actions to SHAs, update jose to 6.2.3",
+        "harden support intake against abuse and data leakage",
+        "bump to v0.9.22 — Codex MCP parity + customer bug fixes + security audit remediation",
+        "audit: pre-hygo exe-gateway security report",
+        "add SECURITY.md — trust document for pre-install security evaluation",
+        "fix 4 pricing tier bypass vulnerabilities (audit F1-F4)"
+      ],
+      "other": [
+        "bump v0.9.245",
+        "sync v0.9.244 published artifacts",
+        "bump v0.9.244",
+        "cover registry proxy license auth fallbacks",
+        "update release notes for v0.9.243",
+        "stack release v0.9.16",
+        "bump v0.9.243 for stack release",
+        "bump v0.9.242 for stack release",
+        "add STACK-RELEASE.md — full release process documentation",
+        "claurst competitive analysis — npm distribution + free-tier mode",
+        "bump stack.release.json to v0.9.240 for CI image build",
+        "update release notes for v0.9.238-239",
+        "release: stack v0.9.14 — gateway audit fixes",
+        "release: stack v0.9.13 — HYGO deployment readiness",
+        "incremental Graph→PG sync — 86K rows → deltas only",
+        "batch Graph→PG sync — 500 rows per INSERT instead of row-by-row",
+        "consolidate daemon timers into unified orchestration tick (#78)",
+        "revise GLiNER — Haiku API now, GLiNER when cost matters",
+        "capture GLiNER entity extraction in ARCHITECTURE.md",
+        "detailed design system structure + Phase 2 component list",
+        "exe-os-design-system — unified design system for all products",
+        "GoTrue JWT unified auth architecture — founder directive 2026-06-08",
+        "Thread + Graph Discovery architecture — unified knowledge view",
+        "move heavy jobs to 9 PM — GraphRAG, skill sweep, backup",
+        "Mode 3 Client-Side RAG architecture — memories never leave device"
+      ],
+      "migration_notes": []
+    },
     "0.9.244": {
       "version": "0.9.244",
       "date": "2026-06-09",
@@ -316,22 +416,6 @@
         "bump to v0.9.237"
       ],
       "migration_notes": []
-    },
-    "0.9.234": {
-      "version": "0.9.234",
-      "date": "2026-06-08",
-      "features": [],
-      "fixes": [
-        "daemon memory leak — 3 fixes prevent 3.5GB growth over 20 hours",
-        "P0 WAL checkpoint before backup — prevents SQLITE_CORRUPT on large DBs",
-        "6 launch blockers for July 1 public launch",
-        "remove duplicate sessionScope filter — corrupted SQL parameter binding"
-      ],
-      "security": [],
-      "other": [
-        "bump to v0.9.230 — P0 WAL backup corruption fix for Jack"
-      ],
-      "migration_notes": []
     }
   }
 }