@askexenow/exe-os 0.9.311 → 0.9.312

package/deploy/stack-manifests/v0.9.json

@@ -1488,7 +1488,7 @@
       "version": "0.9.25",
       "releasedAt": "2026-06-22T07:00:00Z",
       "notes": "17 bug fixes: monitor volume/key (P1), CI flaky tests (P2), CRM bridge contract (P0), stack manifest infra deps (P0), DB image pin (P0), BYOK env alias (P1), SQL race (P2), ERP hardcoded defaults (P1), task resume DB init (P1), monitor :latest images (P1), docs/setup stale claims (P2), monitor healthcheck self-heal (P0), concurrent build chunk corruption (P1), monitor auto-pairing/alerts (P1), SSO CORS whitelist (P1), wiki SSO callback (P1), exe-chat JWT fallback (P3). Baileys WA version floor for WhatsApp pairing. Gateway v0.9.24 with all fixes.",
-      "npmVersion": "0.9.310",
+      "npmVersion": "0.9.312",
       "services": {
         "exe-db": {
           "image": "pgvector/pgvector:0.8.0-pg16",
@@ -1498,19 +1498,19 @@
           "description": "Postgres (pgvector) \u2014 pinned versioned tag (bug ee16e7ef)"
         },
         "exe-os": {
-          "image": "update.askexe.com/askexe/exe-os:v0.9.297@sha256:9fb38b3972202c410bb03d437a7fbaaf34a474f123285f45cbd9ceb039d276c1",
+          "image": "update.askexe.com/askexe/exe-os:v0.9.311@sha256:011730042f55277724dbe83fde1a6416db2f3e8bf62d3254738d68d8de33e1f9",
           "env": "EXE_OS_IMAGE_TAG",
           "required": true,
           "category": "core",
           "description": "exe-os daemon + MCP server"
         },
         "crm": {
-          "image": "update.askexe.com/askexe/exe-crm:v0.9.49@sha256:656512528d2cecc7c0424f917a9b3d0a999f91b160c7b7e7e05778dd8b1319cc",
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.51@sha256:73864ce14aaac06b73d67100bbf88e669fd13c7da39edd9644107037211559b7",
           "env": "CRM_IMAGE_TAG",
           "category": "app"
         },
         "wiki": {
-          "image": "update.askexe.com/askexe/exe-wiki:v0.9.24@sha256:3acf72b992d34ce1e802b075cef8e4e1dd5e4b5681a4681398545f1f7e13e331",
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.26@sha256:e6c1b67d5c431898248f845abfd36dc136575795f35e3652bb4f6164e8a9dd34",
           "env": "WIKI_IMAGE_TAG",
           "category": "app"
         },

package/dist/bin/exe-watchdog.js

@@ -25,7 +25,7 @@ var SIGTERM_GRACE_MS = 1e4;
 var KICKSTART_SUPPRESS_TICKS = 3;
 var MIN_DAEMON_AGE_S = 60;
 var STEAL_SUPPRESS_PERCENT = 20;
-var LOAD_PER_CORE_SUPPRESS = 4;
+var LOAD_PER_CORE_SUPPRESS = 2;
 var consecutiveFailures = 0;
 var suppressTicks = 0;
 function log(msg) {

package/dist/bin/stack-update.js

@@ -17,7 +17,7 @@ import {
   runStackUpdate,
   saveServiceSelection,
   verifyManifestImagesAvailable
-} from "../chunk-DKHBMIVE.js";
+} from "../chunk-KMIAYKIH.js";
 import {
   runVerifyStack
 } from "../chunk-IRHNV4GY.js";
@@ -31,7 +31,7 @@ import {
 import {
   logResult,
   runHealthGate
-} from "../chunk-JDYO76PI.js";
+} from "../chunk-JMHKK7A5.js";
 import "../chunk-JV225JBX.js";
 import "../chunk-2EJ636HI.js";
 import "../chunk-DFIOOK5R.js";

package/dist/bin/vps-health-gate.js

@@ -8,7 +8,7 @@ import {
   logResult,
   main,
   runHealthGate
-} from "../chunk-JDYO76PI.js";
+} from "../chunk-JMHKK7A5.js";
 import "../chunk-MLKGABMK.js";
 export {
   checkCRM,

package/dist/{chunk-JDYO76PI.js → chunk-JMHKK7A5.js}

@@ -45,8 +45,7 @@ async function checkGateway() {
 }
 function checkPostgres() {
   const start = Date.now();
-  const databaseUrl = process.env.DATABASE_URL || "postgres://exe@localhost:5432/exedb";
-  const result = spawnSync("psql", [databaseUrl, "-c", "SELECT 1"], {
+  const result = spawnSync("docker", ["exec", "exe-db", "pg_isready", "-U", "exe"], {
     encoding: "utf8",
     stdio: ["pipe", "pipe", "pipe"],
     timeout: 1e4
@@ -54,16 +53,15 @@ function checkPostgres() {
   return {
     check: "postgres",
     status: result.status === 0 ? "pass" : "fail",
-    message: result.status === 0 ? "Postgres responding" : `Postgres failed: ${result.stderr?.trim() || `exit ${result.status}`}`,
+    message: result.status === 0 ? "Postgres responding (container)" : `Postgres failed: ${result.stderr?.trim() || result.stdout?.trim() || `exit ${result.status}`}`,
     durationMs: Date.now() - start
   };
 }
 function checkRawEvents(probe) {
   const start = Date.now();
-  const databaseUrl = process.env.DATABASE_URL || "postgres://exe@localhost:5432/exedb";
   const result = probe ?? spawnSync(
-    "psql",
-    [databaseUrl, "-t", "-c", "SELECT count(*) FROM raw.raw_events"],
+    "docker",
+    ["exec", "exe-db", "psql", "-U", "exe", "-d", "exedb", "-t", "-c", "SELECT count(*) FROM raw.raw_events"],
     {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
@@ -149,9 +147,19 @@ function restorePreDeployBackup() {
   }
   const latest = backups[0];
   const filepath = path.join(BACKUP_DIR, latest);
-  const databaseUrl = process.env.DATABASE_URL || "postgres://exe@localhost:5432/exedb";
   console.log(`[health-gate] Restoring pre-deploy backup: ${latest}`);
-  const result = spawnSync("pg_restore", ["-d", databaseUrl, "--clean", "--if-exists", filepath], {
+  const result = spawnSync("docker", [
+    "exec",
+    "exe-db",
+    "pg_restore",
+    "-U",
+    "exe",
+    "-d",
+    "exedb",
+    "--clean",
+    "--if-exists",
+    filepath
+  ], {
     encoding: "utf8",
     stdio: ["pipe", "pipe", "pipe"],
     timeout: 3e5
@@ -204,7 +212,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-XHQJRJEP.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-TUBZTY7Z.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/{chunk-DKHBMIVE.js → chunk-KMIAYKIH.js}

@@ -47,9 +47,86 @@ function saveServiceSelection(envFile, selectedServices) {
   };
   writeFileSync(selPath, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
 }
-function filterServicesBySelection(release, selection) {
+function parseComposeDependsOn(composeRaw) {
+  const deps = /* @__PURE__ */ new Map();
+  const lines = composeRaw.split(/\r?\n/);
+  let currentService = null;
+  let inDependsOn = false;
+  let dependsOnIndent = 0;
+  for (const line of lines) {
+    if (!line.trim() || line.trim().startsWith("#")) {
+      continue;
+    }
+    const indent = line.length - line.trimStart().length;
+    const trimmed = line.trim();
+    if (indent === 2 && /^[a-zA-Z0-9_-]+:\s*$/.test(trimmed)) {
+      currentService = trimmed.replace(/:.*$/, "");
+      inDependsOn = false;
+      continue;
+    }
+    if (!currentService) continue;
+    if (indent <= 2 && /^[a-zA-Z0-9_-]+:/.test(trimmed)) {
+      currentService = indent === 2 ? trimmed.replace(/:.*$/, "") : null;
+      inDependsOn = false;
+      continue;
+    }
+    if (indent === 4 && trimmed.startsWith("depends_on:")) {
+      inDependsOn = true;
+      dependsOnIndent = 4;
+      if (!deps.has(currentService)) deps.set(currentService, /* @__PURE__ */ new Set());
+      const inlineMatch = trimmed.match(/depends_on:\s*\[([^\]]*)\]/);
+      if (inlineMatch) {
+        for (const dep of inlineMatch[1].split(",").map((s) => s.trim()).filter(Boolean)) {
+          deps.get(currentService).add(dep);
+        }
+        inDependsOn = false;
+      }
+      continue;
+    }
+    if (inDependsOn && indent === 6 && /^[a-zA-Z0-9_-]+:/.test(trimmed)) {
+      deps.get(currentService).add(trimmed.replace(/:.*$/, ""));
+      continue;
+    }
+    if (inDependsOn && indent <= dependsOnIndent && !trimmed.startsWith("#")) {
+      inDependsOn = false;
+    }
+  }
+  return deps;
+}
+function resolveTransitiveDeps(selected, depsMap) {
+  const resolved = new Set(selected);
+  const queue = [...selected];
+  while (queue.length > 0) {
+    const svc = queue.pop();
+    const deps = depsMap.get(svc);
+    if (!deps) continue;
+    for (const dep of deps) {
+      if (!resolved.has(dep)) {
+        resolved.add(dep);
+        queue.push(dep);
+      }
+    }
+  }
+  return resolved;
+}
+function filterServicesBySelection(release, selection, composeRaw) {
   if (!selection) return release;
   const selected = new Set(selection.selectedServices);
+  if (composeRaw) {
+    const depsMap = parseComposeDependsOn(composeRaw);
+    const composeNames = /* @__PURE__ */ new Set();
+    for (const [name, service] of Object.entries(release.services)) {
+      if (selected.has(name) || selected.has(service.composeService ?? name) || service.required) {
+        composeNames.add(service.composeService ?? name);
+      }
+    }
+    const closedComposeNames = resolveTransitiveDeps(composeNames, depsMap);
+    for (const [name, service] of Object.entries(release.services)) {
+      if (closedComposeNames.has(service.composeService ?? name)) {
+        selected.add(name);
+      }
+    }
+  }
   const filteredServices = {};
   for (const [name, service] of Object.entries(release.services)) {
     if (service.required) {
@@ -543,11 +620,11 @@ function detectMissingRequiredEnvVars(composeRaw, envRaw) {
   }
   return { derived, unresolvable };
 }
-function createStackUpdatePlan(manifest, envRaw, targetVersion, serviceNames, selection) {
+function createStackUpdatePlan(manifest, envRaw, targetVersion, serviceNames, selection, composeRaw) {
   const version = targetVersion ?? manifest.latest;
   const manifestRelease = manifest.stacks[version];
   if (!manifestRelease) throw new Error(`Stack version ${version} not found in manifest`);
-  const selectedRelease = filterServicesBySelection(manifestRelease, selection);
+  const selectedRelease = filterServicesBySelection(manifestRelease, selection, composeRaw);
   const release = serviceNames && serviceNames.length > 0 ? cloneReleaseWithServices(selectedRelease, serviceNames) : selectedRelease;
   const env = parseEnv(envRaw);
   const changes = [];
@@ -1593,12 +1670,12 @@ async function runStackUpdate(options) {
   if (options.resume && resumeServices.length === 0) throw new Error("Cannot resume stack update: no incomplete services found in lock file");
   const scopedServiceNames = options.serviceName ? [options.serviceName] : resumeServices;
   const effectiveTargetVersion = options.targetVersion ?? resumeLock?.stackVersion;
-  const plan = createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, scopedServiceNames, serviceSelection);
-  const fullTargetPlan = scopedServiceNames.length > 0 ? createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, void 0, serviceSelection) : plan;
+  const composeRaw = readFileSync(options.composeFile, "utf8");
+  const plan = createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, scopedServiceNames, serviceSelection, composeRaw);
+  const fullTargetPlan = scopedServiceNames.length > 0 ? createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, void 0, serviceSelection, composeRaw) : plan;
   assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
   assertDeploymentScopeAllowed(plan, options.deploymentPersona ?? "customer");
   const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
-  const composeRaw = readFileSync(options.composeFile, "utf8");
   assertProductionDeployGate(plan, plannedEnvRaw, composeRaw, {
     breakGlassReason: options.breakGlassReason,
     breakGlassAuditFile: options.breakGlassAuditFile,
@@ -2523,6 +2600,8 @@ export {
   serviceSelectionPath,
   loadServiceSelection,
   saveServiceSelection,
+  parseComposeDependsOn,
+  resolveTransitiveDeps,
   filterServicesBySelection,
   buildDefaultServiceSelection,
   ProgressReporter,

package/dist/hooks/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-06-22T07:44:55.636Z",
+  "generatedAt": "2026-06-23T04:10:46.733Z",
   "hashes": {
     "bug-report-worker.js": "de2c15a312082f7dbc40c0cc54401fd09125e55f49bc88243b209a2d0b8cc74c",
     "codex-stop-task-finalizer.js": "7c2e9ec456c478b8bf87acb66f1c06a5e9a416049fb94deffe83e286832ba4e8",

package/dist/{stack-update-XHQJRJEP.js → stack-update-TUBZTY7Z.js}

@@ -28,6 +28,7 @@ import {
   loadServiceSelection,
   loadStackManifest,
   pairMonitorAgent,
+  parseComposeDependsOn,
   parseEnv,
   parseRequiredEnvRefs,
   parseStackManifest,
@@ -38,6 +39,7 @@ import {
   removeDanglingVolumes,
   resolveServerImageOverride,
   resolveServiceHealthTimeout,
+  resolveTransitiveDeps,
   rollbackStackUpdate,
   runReleaseMigrations,
   runStackUpdate,
@@ -48,7 +50,7 @@ import {
   verifyReleaseHealth,
   verifyStackManifestSignature,
   waitForHttpOk
-} from "./chunk-DKHBMIVE.js";
+} from "./chunk-KMIAYKIH.js";
 import "./chunk-JV225JBX.js";
 import "./chunk-2EJ636HI.js";
 import "./chunk-DFIOOK5R.js";
@@ -84,6 +86,7 @@ export {
   loadServiceSelection,
   loadStackManifest,
   pairMonitorAgent,
+  parseComposeDependsOn,
   parseEnv,
   parseRequiredEnvRefs,
   parseStackManifest,
@@ -94,6 +97,7 @@ export {
   removeDanglingVolumes,
   resolveServerImageOverride,
   resolveServiceHealthTimeout,
+  resolveTransitiveDeps,
   rollbackStackUpdate,
   runReleaseMigrations,
   runStackUpdate,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.311",
+  "version": "0.9.312",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/release-notes.json

@@ -1,30 +1,26 @@
 {
-  "current": "0.9.311",
+  "current": "0.9.312",
   "notes": {
-    "0.9.311": {
-      "version": "0.9.311",
-      "date": "2026-06-22",
-      "features": [],
-      "fixes": [],
-      "security": [],
-      "other": [
-        "bump v0.9.311 — CI release gate poll + build-lock fix"
-      ],
-      "migration_notes": []
-    },
-    "0.9.310": {
-      "version": "0.9.310",
-      "date": "2026-06-22",
+    "0.9.312": {
+      "version": "0.9.312",
+      "date": "2026-06-23",
       "features": [],
       "fixes": [
+        "stop excluding src/ from build context — builder stage needs it for tsup",
+        "bypass build-lock.sh in Docker — run tsup directly (no concurrency in container builds)",
+        "add bash to Alpine builder (build-lock.sh requires bash, Alpine only has sh)",
+        "add util-linux for flock in Alpine builder (build-lock.sh)",
+        "3 P0 bugs — health-gate container probe, watchdog starvation threshold, service dep closure (dad93c21, a77bbb7d, 600681b1)",
+        "null-safe signup DOM bindings + add .dockerignore (bugs 61184416 P0, d73073b2 P1)",
         "poll for CI completion in release gate + resilient build-lock.sh (was instant check, always failed on bump commits)",
         "kill the version-bump reload storm — surface-hash marker + reload debounce",
         "enforce canonical 4096 daemon heap cap, correct stale 6144 (bug f215433d)",
-        "fail-closed BYOK env-contract — direct keys only on explicit BYOK (bug df8823d0)",
-        "erp healthHost localhost not askexe.com (preflight gate)"
+        "fail-closed BYOK env-contract — direct keys only on explicit BYOK (bug df8823d0)"
       ],
       "security": [],
       "other": [
+        "stack 0.9.25 final — all 4 images fresh (exe-os v0.9.311, gateway v0.9.24, crm v0.9.51, wiki v0.9.26)",
+        "bump v0.9.311 — CI release gate poll + build-lock fix",
         "stack manifest v0.9.25 — 17 bug fixes, gateway v0.9.24 with WhatsApp/CRM/BYOK fixes"
       ],
       "migration_notes": []
@@ -289,6 +285,19 @@
         "bump v0.9.285 — deploy gate image verification"
       ],
       "migration_notes": []
+    },
+    "0.9.299": {
+      "version": "0.9.299",
+      "date": "2026-06-19",
+      "features": [],
+      "fixes": [
+        "report accurate per-version release notes (bug b69eac42 follow-up — entries no longer mirror the prior version)"
+      ],
+      "security": [],
+      "other": [
+        "release v0.9.299 — published after 0.9.298 SQLCipher/boot/SSO/plist wave"
+      ],
+      "migration_notes": []
     }
   }
 }

package/stack.release.json

@@ -4,58 +4,58 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.310",
-  "image": "ghcr.io/askexe/exe-os:v0.9.310",
+  "version": "0.9.312",
+  "image": "ghcr.io/askexe/exe-os:v0.9.312",
   "imageEnv": "EXE_OS_IMAGE_TAG",
   "components": {
     "erp": {
-      "image": "ghcr.io/askexe/exe-erp:v0.9.310",
+      "image": "ghcr.io/askexe/exe-erp:v0.9.312",
       "env": "ERP_IMAGE_TAG",
       "composeService": "exe-erp",
       "note": "Bug 790794e8: pinned to v0.2.0-final8 — first ERP image shipping the realtime/socketio entrypoint (exe-erp PR #15). Earlier final3/final7 crash-looped exe-erp-websocket (missing socketio.js)."
     },
     "exe-db": {
-      "image": "pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9:v0.9.310",
+      "image": "pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9:v0.9.312",
       "env": "EXE_DB_IMAGE",
       "composeService": "exe-db",
       "category": "infra",
       "note": "Bug ee16e7ef: pinned to versioned 0.8.0-pg16 tag (was mutable :pg16)."
     },
     "redis": {
-      "image": "redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99:v0.9.310",
+      "image": "redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99:v0.9.312",
       "env": "REDIS_IMAGE",
       "composeService": "redis",
       "category": "infra",
       "note": "Bug 4948fc48: compose-pinned infra dep required by CRM, gateway, ERP."
     },
     "clickhouse": {
-      "image": "clickhouse/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c:v0.9.310",
+      "image": "clickhouse/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c:v0.9.312",
       "env": "CLICKHOUSE_IMAGE",
       "composeService": "clickhouse",
       "category": "infra",
       "note": "Bug 4948fc48: compose-pinned infra dep required by CRM."
     },
     "cloudflared": {
-      "image": "cloudflare/cloudflared@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f:v0.9.310",
+      "image": "cloudflare/cloudflared@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f:v0.9.312",
       "composeService": "cloudflared",
       "category": "infra",
       "note": "Bug 4948fc48: digest-pinned tunnel — no env override, managed in compose."
     },
     "exe-sso-edge": {
-      "image": "nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c:v0.9.310",
+      "image": "nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c:v0.9.312",
       "composeService": "exe-sso-edge",
       "category": "infra",
       "note": "Bug 4948fc48: SSO reverse proxy for CRM/wiki/ERP — uses stock nginx:alpine."
     },
     "exe-otel-collector": {
-      "image": "otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197:v0.9.310",
+      "image": "otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197:v0.9.312",
       "env": "OTEL_COLLECTOR_IMAGE",
       "composeService": "exe-otel-collector",
       "category": "infra",
       "note": "Bug 4948fc48: OTLP collector for traces/metrics/logs."
     },
     "gotrue": {
-      "image": "supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4:v0.9.310",
+      "image": "supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4:v0.9.312",
       "composeService": "gotrue",
       "category": "infra",
       "note": "Bug 4948fc48: GoTrue auth backend — digest-pinned in compose."
@@ -102,5 +102,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.310"
+  "sourceVersion": "0.9.312"
 }