@askexenow/exe-os 0.9.302 → 0.9.310

package/dist/chunk-7ODTYODO.js

@@ -0,0 +1,350 @@
+// src/lib/preflight-checks.ts
+import { readFileSync, existsSync } from "fs";
+import path from "path";
+var REQUIRED_INFRA = {
+  postgres: ["exe-db", "postgres", "db", "exe-db-jkt"],
+  redis: ["redis"],
+  clickhouse: ["clickhouse"],
+  "exe-sso-edge": ["exe-sso-edge", "sso-edge"],
+  cloudflared: ["cloudflared"]
+};
+var FORBIDDEN_HOST_SUBSTRINGS = ["askexe.com", "askexenow.com"];
+var CLIENT_FACING_HOST_FIELDS = ["healthHost", "healthUrl"];
+var BYOK_ENFORCEMENT_VARS = ["EXE_ALLOW_DIRECT_PROVIDER_KEYS", "EXE_BILLING_MODE"];
+var BYOK_LEGACY_VARS = ["BYOK_ENABLED"];
+function resolveDefaultManifest() {
+  let dir = path.dirname(new URL(import.meta.url).pathname);
+  for (let i = 0; i < 6; i++) {
+    const candidate = path.join(dir, "deploy", "stack-manifests", "v0.9.json");
+    if (existsSync(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return path.join(process.cwd(), "deploy", "stack-manifests", "v0.9.json");
+}
+function parseImageRef(image) {
+  const hasDigest = /@sha256:[0-9a-f]{64}/i.test(image);
+  const withoutDigest = image.replace(/@sha256:[0-9a-f]{64}/i, "");
+  const lastSlash = withoutDigest.lastIndexOf("/");
+  const namePart = lastSlash >= 0 ? withoutDigest.slice(lastSlash + 1) : withoutDigest;
+  const colonIdx = namePart.indexOf(":");
+  const hasTag = colonIdx >= 0;
+  const tag = hasTag ? namePart.slice(colonIdx + 1) : "";
+  return { hasDigest, hasTag, tag };
+}
+function loadEnvLikeFile(filePath) {
+  const vars = /* @__PURE__ */ new Set();
+  if (!filePath || !existsSync(filePath)) return { vars, exists: false };
+  const raw = readFileSync(filePath, "utf8");
+  for (const line of raw.split("\n")) {
+    const m = line.match(/^\s*#?\s*([A-Z][A-Z0-9_]+)\s*=/);
+    if (m) vars.add(m[1]);
+  }
+  return { vars, exists: true };
+}
+function readComposeText(composePath) {
+  if (!composePath || !existsSync(composePath)) return { text: "", exists: false };
+  return { text: readFileSync(composePath, "utf8"), exists: true };
+}
+function resolveStack(manifest, requested) {
+  if (manifest.services && !manifest.stacks) {
+    return { version: manifest.version ?? "(single)", services: manifest.services };
+  }
+  if (!manifest.stacks) return { version: "(none)", services: {} };
+  const version = requested ?? manifest.latest ?? Object.keys(manifest.stacks).sort().pop() ?? "";
+  const entry = manifest.stacks[version];
+  return { version, services: entry?.services ?? {} };
+}
+function checkDigestPinning(services) {
+  const bug = "ee16e7ef (digest-pinning)";
+  const offenders = [];
+  for (const [name, svc] of Object.entries(services)) {
+    if (!svc.image) continue;
+    const { hasDigest } = parseImageRef(svc.image);
+    if (!hasDigest) offenders.push(`${name}=${svc.image}`);
+  }
+  if (offenders.length > 0) {
+    return {
+      check: "digest-pinning",
+      status: "fail",
+      bug,
+      offenders,
+      message: `${offenders.length} image(s) tag-pinned WITHOUT @sha256 digest (release claims digest-pinning): ${offenders.join(", ")}`
+    };
+  }
+  return { check: "digest-pinning", status: "pass", bug, message: "all images @sha256 digest-pinned" };
+}
+function checkNoLatest(services) {
+  const bug = "monitor :latest / no-:latest";
+  const offenders = [];
+  for (const [name, svc] of Object.entries(services)) {
+    if (!svc.image) continue;
+    const { hasDigest, hasTag, tag } = parseImageRef(svc.image);
+    if (tag === "latest") offenders.push(`${name}=${svc.image}`);
+    else if (!hasTag && !hasDigest) offenders.push(`${name}=${svc.image} (untagged \u2192 implicit :latest)`);
+  }
+  if (offenders.length > 0) {
+    return {
+      check: "no-latest",
+      status: "fail",
+      bug,
+      offenders,
+      message: `${offenders.length} image(s) use :latest / are untagged: ${offenders.join(", ")}`
+    };
+  }
+  return { check: "no-latest", status: "pass", bug, message: "no :latest / untagged images" };
+}
+function checkDependencyClosure(services) {
+  const bug = "4948fc48 (dependency-closure)";
+  const present = /* @__PURE__ */ new Set();
+  for (const [name, svc] of Object.entries(services)) {
+    present.add(name);
+    if (svc.composeService) present.add(svc.composeService);
+  }
+  const missing = [];
+  for (const [canonical, aliases] of Object.entries(REQUIRED_INFRA)) {
+    if (!aliases.some((a) => present.has(a))) missing.push(canonical);
+  }
+  if (missing.length > 0) {
+    return {
+      check: "dependency-closure",
+      status: "fail",
+      bug,
+      offenders: missing,
+      message: `manifest missing required infra dependency closure \u2014 selected/fresh installs would skip: ${missing.join(", ")}`
+    };
+  }
+  return { check: "dependency-closure", status: "pass", bug, message: `all required infra present (${Object.keys(REQUIRED_INFRA).join(", ")})` };
+}
+function checkNoHardcodedHost(services) {
+  const bug = "ERP white-label-leak (no-hardcoded-askexe-host)";
+  const offenders = [];
+  for (const [name, svc] of Object.entries(services)) {
+    for (const field of CLIENT_FACING_HOST_FIELDS) {
+      const val = svc[field];
+      if (typeof val !== "string") continue;
+      const hit = FORBIDDEN_HOST_SUBSTRINGS.find((h) => val.includes(h));
+      if (hit) offenders.push(`${name}.${field}=${val}`);
+    }
+  }
+  if (offenders.length > 0) {
+    return {
+      check: "no-hardcoded-askexe-host",
+      status: "fail",
+      bug,
+      offenders,
+      message: `client-facing field(s) hardcode an AskExe host (white-label leak): ${offenders.join(", ")}`
+    };
+  }
+  return { check: "no-hardcoded-askexe-host", status: "pass", bug, message: "no hardcoded AskExe hosts in client-facing fields" };
+}
+function checkEnvContract(env, compose) {
+  const bug = "BYOK env-contract-mismatch";
+  if (!env.exists && !compose.exists) {
+    return {
+      check: "env-contract",
+      status: "warn",
+      bug,
+      message: "env example + compose not provided \u2014 BYOK enforcement contract not verified (pass --env / --compose to enforce)"
+    };
+  }
+  const declared = new Set(env.vars);
+  if (compose.exists) {
+    for (const m of compose.text.matchAll(/\$\{?([A-Z][A-Z0-9_]+)/g)) declared.add(m[1]);
+  }
+  const missingEnforcement = BYOK_ENFORCEMENT_VARS.filter((v) => !declared.has(v));
+  const exposedLegacy = BYOK_LEGACY_VARS.filter((v) => declared.has(v));
+  if (missingEnforcement.length > 0 && exposedLegacy.length > 0) {
+    return {
+      check: "env-contract",
+      status: "fail",
+      bug,
+      offenders: [...exposedLegacy.map((v) => `exposes ${v}`), ...missingEnforcement.map((v) => `missing ${v}`)],
+      message: `BYOK env-contract mismatch \u2014 customer surface exposes ${exposedLegacy.join("/")} but billing enforcement reads ${BYOK_ENFORCEMENT_VARS.join("+")} (absent). BYOK can bypass billing.`
+    };
+  }
+  if (missingEnforcement.length > 0) {
+    return {
+      check: "env-contract",
+      status: "warn",
+      bug,
+      offenders: missingEnforcement.map((v) => `missing ${v}`),
+      message: `billing enforcement vars not declared: ${missingEnforcement.join(", ")}`
+    };
+  }
+  return { check: "env-contract", status: "pass", bug, message: `BYOK enforcement vars present (${BYOK_ENFORCEMENT_VARS.join(", ")})` };
+}
+function checkNoHostNet(composeTexts) {
+  const bug = "monitor host-networking (no-host-net)";
+  const available = composeTexts.filter((c) => c.exists);
+  if (available.length === 0) {
+    return {
+      check: "no-host-net",
+      status: "warn",
+      bug,
+      message: "no compose file provided \u2014 host-networking not verified (pass --compose / --monitor-compose to enforce)"
+    };
+  }
+  const HOST_NET = /^\s*network_mode\s*:\s*["']?host["']?\s*$/;
+  const HOST_NET_FLAG = /--network(?:=|\s+)["']?host["']?/;
+  const offenders = [];
+  for (const compose of available) {
+    const lines = compose.text.split("\n");
+    let currentService = null;
+    let serviceIndent = -1;
+    for (const rawLine of lines) {
+      const line = rawLine.replace(/\r$/, "");
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const indent = line.match(/^(\s*)/)?.[1]?.length ?? 0;
+      const headerMatch = line.match(/^(\s+)([A-Za-z0-9._-]+):\s*$/);
+      if (headerMatch && (currentService === null || indent <= serviceIndent)) {
+        currentService = headerMatch[2];
+        serviceIndent = headerMatch[1].length;
+      }
+      if (HOST_NET.test(line) || HOST_NET_FLAG.test(line)) {
+        const where = currentService ? `${compose.label}:${currentService}` : compose.label;
+        offenders.push(`${where} (${trimmed})`);
+      }
+    }
+  }
+  if (offenders.length > 0) {
+    return {
+      check: "no-host-net",
+      status: "fail",
+      bug,
+      offenders,
+      message: `compose service(s) use host networking (network_mode: host) \u2014 bypasses Docker isolation + SSO edge: ${offenders.join(", ")}`
+    };
+  }
+  return { check: "no-host-net", status: "pass", bug, message: "no host networking (network_mode: host) in compose" };
+}
+function runChecks(services, env, compose, monitorCompose, customerComposeLabel) {
+  return [
+    checkDigestPinning(services),
+    checkNoLatest(services),
+    checkDependencyClosure(services),
+    checkNoHardcodedHost(services),
+    checkEnvContract(env, compose),
+    checkNoHostNet([
+      { label: customerComposeLabel, text: compose.text, exists: compose.exists },
+      monitorCompose
+    ])
+  ];
+}
+function tally(findings) {
+  const passed = findings.filter((f) => f.status === "pass").length;
+  const warned = findings.filter((f) => f.status === "warn").length;
+  const failed = findings.filter((f) => f.status === "fail").length;
+  const verdict = failed > 0 ? "RED" : warned > 0 ? "YELLOW" : "GREEN";
+  return { verdict, passed, warned, failed };
+}
+function runPreflight(options) {
+  const manifestPath = options?.manifestPath ?? resolveDefaultManifest();
+  if (!existsSync(manifestPath)) {
+    return {
+      verdict: "RED",
+      manifestPath,
+      stackVersion: "(missing)",
+      findings: [{ check: "manifest-load", status: "fail", bug: "preflight", message: `manifest not found: ${manifestPath}` }],
+      passed: 0,
+      warned: 0,
+      failed: 1
+    };
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  } catch (err) {
+    return {
+      verdict: "RED",
+      manifestPath,
+      stackVersion: "(parse-error)",
+      findings: [{ check: "manifest-load", status: "fail", bug: "preflight", message: `manifest parse error: ${err instanceof Error ? err.message : String(err)}` }],
+      passed: 0,
+      warned: 0,
+      failed: 1
+    };
+  }
+  const { version, services } = resolveStack(manifest, options?.stackVersion);
+  const repoRoot = path.resolve(path.dirname(manifestPath), "..", "..");
+  const envExamplePath = options?.envExamplePath ?? path.join(repoRoot, "deploy", "compose", ".env.example");
+  const composePath = options?.composePath ?? path.join(repoRoot, "deploy", "compose", "docker-compose.yml");
+  const monitorComposePath = options?.monitorComposePath ?? path.join(repoRoot, "deploy", "monitor", "docker-compose.hub.yml");
+  const env = loadEnvLikeFile(envExamplePath);
+  const compose = readComposeText(composePath);
+  const monitorComposeRead = readComposeText(monitorComposePath);
+  const monitorCompose = { label: "monitor-compose", text: monitorComposeRead.text, exists: monitorComposeRead.exists };
+  const findings = runChecks(services, env, compose, monitorCompose, "customer-compose");
+  const { verdict, passed, warned, failed } = tally(findings);
+  return { verdict, manifestPath, stackVersion: version, findings, passed, warned, failed };
+}
+function runPreflightOnManifest(input) {
+  const label = input.label ?? "(in-memory manifest)";
+  const { version, services } = resolveStack(input.manifest, input.stackVersion);
+  const env = loadEnvLikeFile(input.envExamplePath);
+  const compose = readComposeText(input.composePath);
+  const monitorComposeRead = readComposeText(input.monitorComposePath);
+  const monitorCompose = { label: "monitor-compose", text: monitorComposeRead.text, exists: monitorComposeRead.exists };
+  const findings = runChecks(services, env, compose, monitorCompose, "customer-compose");
+  const { verdict, passed, warned, failed } = tally(findings);
+  return { verdict, manifestPath: label, stackVersion: version, findings, passed, warned, failed };
+}
+var ICONS = { pass: "\u{1F7E2}", warn: "\u{1F7E0}", fail: "\u{1F534}" };
+function formatPreflightFindings(report, all = false) {
+  const lines = [];
+  for (const f of report.findings) {
+    if (!all && f.status === "pass") continue;
+    lines.push(`  ${ICONS[f.status]} ${f.check} [guards ${f.bug}]: ${f.message}`);
+  }
+  return lines.join("\n");
+}
+function isPreflightOverrideEnabled(env = process.env) {
+  return /^(1|true|yes|on)$/i.test((env.EXE_PREFLIGHT_OVERRIDE ?? "").trim());
+}
+function assertPreflightGate(report, options = {}) {
+  const ctx = options.context ? `[${options.context}] ` : "";
+  const log = options.log ?? ((m) => console.log(m));
+  const warn = options.warn ?? ((m) => console.warn(m));
+  const override = options.allowRed === true || isPreflightOverrideEnabled();
+  if (report.verdict === "GREEN") {
+    log(`${ctx}\u{1F7E2} preflight GREEN (pass ${report.passed} / warn ${report.warned} / fail ${report.failed}) \u2014 stack ${report.stackVersion}`);
+    return report;
+  }
+  if (report.verdict === "YELLOW") {
+    warn(`${ctx}\u{1F7E0} preflight YELLOW (${report.warned} warning(s)) \u2014 stack ${report.stackVersion}. Proceeding; warnings are non-blocking:`);
+    warn(formatPreflightFindings(report));
+    return report;
+  }
+  const findings = formatPreflightFindings(report);
+  if (override) {
+    warn(`${ctx}\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557`);
+    warn(`${ctx}\u2551  \u26A0\uFE0F  BREAK-GLASS: preflight is RED but override is engaged       \u2551`);
+    warn(`${ctx}\u2551  A RED manifest is shipping INTENTIONALLY. This is logged.       \u2551`);
+    warn(`${ctx}\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D`);
+    warn(`${ctx}RED findings (overridden):
+${findings}`);
+    warn(`${ctx}Override via: ${options.allowRed === true ? "--allow-red flag" : "EXE_PREFLIGHT_OVERRIDE env"}. Remediate the manifest immediately after.`);
+    return report;
+  }
+  throw new Error(
+    `${ctx}Preflight gate FAILED (RED) \u2014 stack ${report.stackVersion}. Company procedure: no manifest published or stack-update applied until preflight is GREEN.
+${findings}
+Break-glass: re-run with --allow-red or EXE_PREFLIGHT_OVERRIDE=1 to ship a RED manifest intentionally (LOUDLY logged).`
+  );
+}
+
+export {
+  resolveDefaultManifest,
+  resolveStack,
+  checkDigestPinning,
+  checkNoLatest,
+  checkDependencyClosure,
+  checkNoHardcodedHost,
+  checkEnvContract,
+  checkNoHostNet,
+  runPreflight,
+  runPreflightOnManifest,
+  assertPreflightGate
+};

package/dist/{chunk-5YL4Y27D.js → chunk-7WDIGRSO.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-UZATXREL.js";
+} from "./chunk-AE74NOE6.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-WIL6LXNG.js → chunk-AC6DKMVS.js}

@@ -1,6 +1,6 @@
 import {
   processCRMEvent
-} from "./chunk-XDE5IGBX.js";
+} from "./chunk-2NS3QRMJ.js";
 
 // src/gateway/adapters/crm-webhook.ts
 function parseTwentyWebhook(payload) {

package/dist/{chunk-HZEAAKCR.js → chunk-B2J3BBJC.js}

@@ -1,20 +1,20 @@
 import {
   cleanupCardsForMemories,
   cleanupGraphLinksForMemories
-} from "./chunk-LUGWK6QB.js";
+} from "./chunk-FF5DA4XP.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-PROQW3NL.js";
 import {
   vectorToBlob
-} from "./chunk-Y5ASPRP7.js";
+} from "./chunk-WBJXJ2R4.js";
 import {
   extractKeywords,
   keywordsToString
 } from "./chunk-CHCA3ZM2.js";
 import {
   isCoordinatorName
-} from "./chunk-P3SIFDES.js";
+} from "./chunk-SCYWCWKY.js";
 
 // src/lib/consolidation.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-LE7CDIOA.js → chunk-BUOMSIXH.js}

@@ -9,7 +9,7 @@ import {
   getCoordinatorEmployee,
   getEmployee,
   loadEmployeesSync
-} from "./chunk-P3SIFDES.js";
+} from "./chunk-SCYWCWKY.js";
 import {
   EXE_AI_DIR
 } from "./chunk-DFIOOK5R.js";

package/dist/{chunk-XKGNKH6V.js → chunk-DFUCFLZH.js}

@@ -1,6 +1,6 @@
 import {
   listBehaviors
-} from "./chunk-N76VTMMF.js";
+} from "./chunk-PMEOSD6S.js";
 import {
   loadConfigSync
 } from "./chunk-DFIOOK5R.js";

package/dist/{chunk-U724Z3S3.js → chunk-DKHBMIVE.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-VME3UH4D.js";
+} from "./chunk-JV225JBX.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";
@@ -902,6 +902,65 @@ function refreshPackagedInitSql(dest, created = []) {
 function refreshPackagedErpNginxConf(dest, created = []) {
   copyTemplate("deploy/compose/erp-nginx/nginx.conf", dest, created, { overwrite: true });
 }
+function ensureOverlayDir(dest, actions = []) {
+  try {
+    if (existsSync(dest) && !lstatSync(dest).isDirectory()) {
+      rmSync(dest, { force: true });
+    }
+    if (!existsSync(dest)) {
+      mkdirSync(dest, { recursive: true, mode: 493 });
+      actions.push("create_overlay_dir");
+    }
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.warn(`[stack-update] Could not ensure overlay dir ${dest} (${reason}); customer overlays may not mount.`);
+  }
+}
+function listOverlayFiles(overlayDir) {
+  try {
+    if (!existsSync(overlayDir) || !lstatSync(overlayDir).isDirectory()) return [];
+    return readdirSync(overlayDir).filter((name) => {
+      try {
+        return lstatSync(path.join(overlayDir, name)).isFile();
+      } catch {
+        return false;
+      }
+    }).sort();
+  } catch {
+    return [];
+  }
+}
+function composeMountsOverlay(composeRaw) {
+  return /\.\/overlay:\/data\/overlay/.test(composeRaw);
+}
+function applyGatewayOverlays(stackDir, composeRaw, exec) {
+  const overlayDir = path.join(stackDir, "overlay");
+  const overlayFiles = listOverlayFiles(overlayDir);
+  if (overlayFiles.length === 0) {
+    return { applied: false, warned: false, overlayFiles };
+  }
+  let warned = false;
+  if (!composeMountsOverlay(composeRaw)) {
+    console.warn(
+      `[stack-update] \u26A0 OVERLAY WARNING (bug 02bc1bb8): ${overlayFiles.length} customer overlay file(s) found in ${overlayDir} (${overlayFiles.join(", ")}), but the live docker-compose.yml does NOT bind-mount ./overlay into the gateway. These overlays will be SILENTLY DROPPED on the next container recreate. Add '- ./overlay:/data/overlay:ro' to the exe-gateway service volumes and re-deploy.`
+    );
+    warned = true;
+  }
+  const addRoutes = path.join(stackDir, "add-routes.sh");
+  if (!existsSync(addRoutes)) {
+    console.warn(`[stack-update] \u26A0 overlay re-apply hook missing at ${addRoutes}; overlays NOT re-applied. Re-run bootstrap.`);
+    return { applied: false, warned: true, overlayFiles };
+  }
+  try {
+    console.log(`[stack-update] Re-applying ${overlayFiles.length} customer overlay file(s) via add-routes.sh (bug 02bc1bb8)\u2026`);
+    exec("bash", [addRoutes], { cwd: stackDir });
+    return { applied: true, warned, overlayFiles };
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.warn(`[stack-update] \u26A0 Overlay re-apply failed (non-fatal): ${reason}. Overlays remain at ${overlayDir}; apply manually with: bash ${addRoutes}`);
+    return { applied: false, warned: true, overlayFiles };
+  }
+}
 var BOOTSTRAP_OVERWRITTEN_CONFIG_FILES = [
   "init-db.sql",
   "erp-nginx/nginx.conf",
@@ -1009,6 +1068,7 @@ function hydrateEnv(raw, opts) {
     else if (key.endsWith("_PASSWORD")) replacements[key] = randomSecret(24);
     else if (key.endsWith("_TOKEN")) replacements[key] = randomHexSecret(32);
     else if (key.endsWith("_SECRET") || key.endsWith("_SALT")) replacements[key] = randomSecret(32);
+    else if (key === "EXE_MONITOR_KEY") replacements[key] = randomSecret(32);
     else if (key.endsWith("_KEY") && key !== "EXE_LICENSE_KEY") continue;
   }
   if (domain) next = next.replaceAll("CHANGEME_DOMAIN", domain);
@@ -1016,44 +1076,23 @@ function hydrateEnv(raw, opts) {
   const remaining = [...parseEnv(next).entries()].filter(([, value]) => /CHANGEME/.test(value)).map(([key, value]) => `${key}=${value}`);
   return { raw: next, hadPlaceholders: /CHANGEME/.test(raw), remaining: [...new Set(remaining)] };
 }
-async function pairMonitorAgent(hubUrl, licenseKey, domain, envFile) {
-  if (!hubUrl || !licenseKey || !domain) {
-    return { paired: false, error: "Missing hubUrl, licenseKey, or domain for monitor pairing" };
+async function pairMonitorAgent(hubUrl, _licenseKey, _domain, envFile) {
+  if (!hubUrl) {
+    return { paired: false, error: "Missing hubUrl for monitor pairing check" };
   }
-  const registrationUrl = `${hubUrl.replace(/\/+$/, "")}/api/register-agent`;
-  try {
-    const res = await fetch(registrationUrl, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${licenseKey}`
-      },
-      body: JSON.stringify({ name: domain, host: domain, port: 45876 }),
-      signal: AbortSignal.timeout(15e3)
-    });
-    if (!res.ok) {
-      const body = await res.text().catch(() => "");
-      return { paired: false, error: `Monitor hub returned HTTP ${res.status}: ${body}` };
-    }
-    const data = await res.json();
-    if (!data.token || !data.key) {
-      return { paired: false, error: "Monitor hub response missing token or key" };
-    }
-    if (existsSync(envFile)) {
-      const envRaw = readFileSync(envFile, "utf8");
-      const patched = patchEnv(envRaw, {
-        MONITOR_AGENT_TOKEN: data.token,
-        MONITOR_AGENT_KEY: data.key
-      });
-      if (patched !== envRaw) {
-        writeSecretFile(envFile, patched);
-      }
+  if (existsSync(envFile)) {
+    const envRaw = readFileSync(envFile, "utf8");
+    const parsed = parseEnv(envRaw);
+    const token = (parsed.get("MONITOR_AGENT_TOKEN") ?? "").trim();
+    const key = (parsed.get("MONITOR_AGENT_KEY") ?? "").trim();
+    if (token && !/CHANGEME/.test(token) && key && !/CHANGEME/.test(key)) {
+      return { paired: true, systemName: "(existing credentials)" };
     }
-    return { paired: true, systemName: data.name ?? domain };
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    return { paired: false, error: `Monitor hub unreachable: ${reason}` };
   }
+  return {
+    paired: false,
+    error: "The monitor hub (Beszel) does not expose a REST registration endpoint. Pair the agent manually: open the hub UI \u2192 Settings \u2192 Add System, then write the generated MONITOR_AGENT_TOKEN and MONITOR_AGENT_KEY into " + envFile
+  };
 }
 function bootstrapStackHost(options) {
   const exec = options.exec ?? defaultExec;
@@ -1098,6 +1137,15 @@ function bootstrapStackHost(options) {
     path.join(path.dirname(options.composeFile), "cloudflared", "config.yml.example"),
     createdFiles
   );
+  ensureOverlayDir(path.join(path.dirname(options.composeFile), "overlay"), actions);
+  for (const helper of ["gateway-watchdog.sh", "add-routes.sh"]) {
+    const dest = path.join(path.dirname(options.composeFile), helper);
+    copyTemplate(`deploy/compose/${helper}`, dest, createdFiles, { overwrite: true });
+    try {
+      chmodSync(dest, 493);
+    } catch {
+    }
+  }
   let envHadPlaceholders = false;
   let envRemainingPlaceholders = [];
   if (existsSync(options.envFile)) {
@@ -1504,7 +1552,7 @@ async function runStackUpdate(options) {
         console.log(`[stack-update] Monitor agent paired: ${result.systemName}`);
       } else {
         console.warn(
-          `[stack-update] \u26A0\uFE0F  Monitor agent pairing FAILED \u2014 the agent is enabled (COMPOSE_PROFILES=monitor-agent) but has no usable TOKEN/KEY, so it will NOT report fleet health. Reason: ${result.error}. Fix the hub at ${hubUrl} (POST /api/register-agent) and re-run \`exe-os stack-update\`, or pair the agent manually from the hub UI and write MONITOR_AGENT_TOKEN/MONITOR_AGENT_KEY into ${options.envFile}.`
+          `[stack-update] \u26A0\uFE0F  Monitor agent pairing INCOMPLETE \u2014 the agent is enabled (COMPOSE_PROFILES=monitor-agent) but has no usable TOKEN/KEY, so it will NOT report fleet health. ${result.error}`
         );
       }
     }
@@ -1663,6 +1711,13 @@ ${lines.join("\n")}`
   } catch {
   }
   const updates = { ...migratedEnvVars, ...Object.fromEntries(plan.changes.map((c) => [c.key, c.after])) };
+  {
+    const currentMonitorKey = parseEnv(readFileSync(options.envFile, "utf8")).get("EXE_MONITOR_KEY") ?? "";
+    if (!currentMonitorKey.trim() || /CHANGEME/.test(currentMonitorKey)) {
+      updates.EXE_MONITOR_KEY = randomSecret(32);
+      console.log("[stack-update] Generated EXE_MONITOR_KEY (bug 84d9a74a: was missing/empty \u2014 monitor error ingestion was failing 503)");
+    }
+  }
   const currentEnvMap = parseEnv(envRaw);
   const manifestExeOsPin = updates.EXE_OS_IMAGE_TAG ?? currentEnvMap.get("EXE_OS_IMAGE_TAG");
   const overrideInFile = /^\s*EXE_OS_SERVER_IMAGE_TAG\s*=/m.test(envRaw);
@@ -1956,6 +2011,13 @@ ${lines.join("\n")}`
         endReleasePost();
       }
     }
+    try {
+      const liveCompose = existsSync(options.composeFile) ? readFileSync(options.composeFile, "utf8") : composeRaw;
+      applyGatewayOverlays(stackDir, liveCompose, exec);
+    } catch (overlayErr) {
+      const reason = overlayErr instanceof Error ? overlayErr.message : String(overlayErr);
+      console.warn(`[stack-update] \u26A0 Overlay re-apply step failed (non-fatal): ${reason}`);
+    }
     for (const serviceName of Object.keys(plan.release.services)) {
       updateServiceStatus(lockFile, serviceName, "completed", now);
     }
@@ -2488,6 +2550,7 @@ export {
   assertProductionDeployGate,
   assertBreakingChangesAllowed,
   verifyManifestImagesAvailable,
+  applyGatewayOverlays,
   backupStackConfig,
   pairMonitorAgent,
   bootstrapStackHost,

package/dist/{chunk-MY36XDUK.js → chunk-DNFU56ZS.js}

@@ -6,7 +6,7 @@ import {
   connectEmbedDaemon,
   isClientConnected,
   sendDaemonRequest
-} from "./chunk-TCJEFW5V.js";
+} from "./chunk-PPXQE7AS.js";
 
 // src/lib/db-daemon-client.ts
 function normalizeStatement(stmt) {

package/dist/{chunk-GSWGOGP5.js → chunk-EOS7VPVT.js}

@@ -2,7 +2,7 @@ import {
   dispatchTaskToEmployee,
   markTaskNotificationsRead,
   notifyTaskDone
-} from "./chunk-3YJMI422.js";
+} from "./chunk-TN2YCFQE.js";
 import {
   cleanupReviewFile,
   createTaskCore,
@@ -11,7 +11,7 @@ import {
   sessionScopeFilter,
   updateTaskStatus,
   writeNotification
-} from "./chunk-OVKNFTCL.js";
+} from "./chunk-HED6D5KR.js";
 import {
   orgBus
 } from "./chunk-MP2AFCGL.js";
@@ -19,7 +19,7 @@ import {
   getClient,
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-P3SIFDES.js";
+} from "./chunk-SCYWCWKY.js";
 import {
   EXE_AI_DIR
 } from "./chunk-DFIOOK5R.js";
@@ -61,7 +61,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
   }
   if (unblockedRows.rows.length > 0 && !process.env.VITEST) {
     try {
-      const { dispatchTaskToEmployee: dispatchTaskToEmployee2 } = await import("./tasks-notify-NGS3DWUJ.js");
+      const { dispatchTaskToEmployee: dispatchTaskToEmployee2 } = await import("./tasks-notify-LAIU7UUI.js");
       const dispatched = /* @__PURE__ */ new Set();
       for (const ur of unblockedRows.rows) {
         const assignee = String(ur.assigned_to);
@@ -333,7 +333,7 @@ async function updateTask(input) {
     await markTaskNotificationsRead(taskFile);
     if (isCompletionReviewTransition && !isCoordinator && row.reviewer) {
       try {
-        const { writeNotification: writeNotification2 } = await import("./notifications-AMJ2K3MM.js");
+        const { writeNotification: writeNotification2 } = await import("./notifications-UP7WQGG4.js");
         const reviewer = String(row.reviewer);
         await writeNotification2({
           agentId: reviewer,

package/dist/{chunk-P33JVGSP.js → chunk-FM7XZDZI.js}

@@ -1,6 +1,6 @@
 import {
   writeMemoryViaDaemon
-} from "./chunk-KVHPBQV4.js";
+} from "./chunk-NCC3F6GM.js";
 
 // src/lib/auto-checkpoint.ts
 var FILE_RE = /(?:^|\s)([\w./-]+\.(?:ts|tsx|js|jsx|json|md|yml|yaml|sql|go|py|css|scss|html|sh))(?:\b|$)/g;