@askexenow/exe-os 0.9.339 → 0.9.341

package/dist/bin/stack-update.js

@@ -19,23 +19,23 @@ import {
   runStackUpdate,
   saveServiceSelection,
   verifyManifestImagesAvailable
-} from "../chunk-XWHE4LZK.js";
+} from "../chunk-4LWV633D.js";
+import {
+  runVerifyStack
+} from "../chunk-5KLQCGI5.js";
 import {
   assertPreflightGate,
   runPreflightOnManifest
 } from "../chunk-3QWOO74G.js";
-import {
-  runVerifyStack
-} from "../chunk-5KLQCGI5.js";
 import {
   preDeployBackup
 } from "../chunk-5DMAMQNU.js";
 import {
   logResult,
   runHealthGate
-} from "../chunk-FNZR3B7U.js";
-import "../chunk-XACL67CS.js";
-import "../chunk-5Z5NATNS.js";
+} from "../chunk-DGGDUKH6.js";
+import "../chunk-7SEC2AG5.js";
+import "../chunk-PPZOWQHP.js";
 import "../chunk-7Y5UDEVM.js";
 import "../chunk-SHIICYJW.js";
 import {
@@ -496,6 +496,7 @@ function parseArgs(args) {
     deploymentPersona: process.env.EXE_STACK_DEPLOYMENT_PERSONA === "askexe-control-plane" ? "askexe-control-plane" : "customer",
     yes: false,
     allowedBreakingChangeIds: [],
+    allowCanary: process.env.EXE_STACK_ALLOW_CANARY === "1",
     noBootstrap: false,
     skipHardening: false,
     verifyManifestSignature: true,
@@ -561,6 +562,7 @@ function parseArgs(args) {
     else if (arg === "--skip-hardening") opts.skipHardening = true;
     else if (arg === "--cleanup-volumes") opts.cleanupVolumes = true;
     else if (arg === "--allow-red") opts.allowRed = true;
+    else if (arg === "--allow-canary") opts.allowCanary = true;
     else if (arg === "--no-verify-manifest-signature") opts.verifyManifestSignature = false;
     else if (arg === "--require-manifest-signature") opts.requireManifestSignature = true;
     else if (arg === "--dry-run") opts.dryRun = true;
@@ -632,6 +634,9 @@ Options:
   --allow-red                Break-glass: apply even when the static preflight gate is RED
                              (also via EXE_PREFLIGHT_OVERRIDE=1). Loudly logged. By default a
                              RED manifest is REFUSED so a broken stack can't be pushed mid-update.
+  --allow-canary             Explicit opt-in to install a CANARY-stage version implicitly
+                             (also via EXE_STACK_ALLOW_CANARY=1). Not needed when --target names
+                             the canary version directly. See: exe-os stack-promote --help
   --no-verify-manifest-signature  Explicitly allow unsigned stack manifests (break-glass only)
   --require-manifest-signature    Strict: fail unless EXE_STACK_PUBLIC_KEY is configured and the
                              manifest signature is valid (default is opt-in: warn + proceed when
@@ -911,6 +916,7 @@ async function main(args = process.argv.slice(2)) {
         const markers = [];
         if (v.isCurrent) markers.push("installed");
         if (v.isLatest) markers.push("latest");
+        if (v.rolloutStage === "canary") markers.push("CANARY \u2014 requires --target or --allow-canary");
         const markerStr = markers.length > 0 ? ` \u2190 ${markers.join(", ")}` : "";
         console.log(`  ${v.version}${markerStr}${v.releasedAt ? `  (${v.releasedAt.slice(0, 10)})` : ""}`);
       }

package/dist/bin/vps-health-gate.js

@@ -8,7 +8,7 @@ import {
   logResult,
   main,
   runHealthGate
-} from "../chunk-FNZR3B7U.js";
+} from "../chunk-DGGDUKH6.js";
 import "../chunk-MLKGABMK.js";
 export {
   checkCRM,

package/dist/boot-generation-GSMPJOWM.js

@@ -0,0 +1,22 @@
+import {
+  _resetBootGenerationCache,
+  bumpBootGeneration,
+  getBootGeneration,
+  getCachedBootGeneration
+} from "./chunk-W6K4XB6G.js";
+import "./chunk-RWSLVYTE.js";
+import "./chunk-2I23RPSI.js";
+import "./chunk-BV6GBSRP.js";
+import "./chunk-PNQDP3OA.js";
+import "./chunk-H73TUI4Y.js";
+import "./chunk-7HLWBYH7.js";
+import "./chunk-FXU7JOXK.js";
+import "./chunk-7Y5UDEVM.js";
+import "./chunk-SHIICYJW.js";
+import "./chunk-MLKGABMK.js";
+export {
+  _resetBootGenerationCache,
+  bumpBootGeneration,
+  getBootGeneration,
+  getCachedBootGeneration
+};

package/dist/{capability-cards-YOKVMMOL.js → capability-cards-OBYQNAKZ.js}

@@ -1,9 +1,9 @@
 import {
   getIdentity,
   loadEmployeesSync
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-ATOU6CYR.js";
+import "./chunk-BV6GBSRP.js";
 import {
   getRoleCapabilities
 } from "./chunk-PNQDP3OA.js";

package/dist/{capacity-monitor-S54IOWRL.js → capacity-monitor-MG3FTUD5.js}

@@ -8,43 +8,43 @@ import {
   isAtCapacity,
   isWithinRelaunchCooldown,
   pollCapacityDead
-} from "./chunk-LMZISHSJ.js";
-import "./chunk-T4KZ2Z2N.js";
-import "./chunk-PLRIJALF.js";
-import "./chunk-OFX5B2S7.js";
-import "./chunk-B76TSEP3.js";
-import "./chunk-RLRT2BVM.js";
+} from "./chunk-MC4ATFJV.js";
+import "./chunk-IELUDZAA.js";
+import "./chunk-KKOLHBNC.js";
+import "./chunk-ATKW3SYL.js";
+import "./chunk-BJOBR6P2.js";
+import "./chunk-6D2PI4QD.js";
+import "./chunk-E23LNUWJ.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-EIKATSE4.js";
-import "./chunk-E23LNUWJ.js";
-import "./chunk-UIV2WPBT.js";
-import "./chunk-SSTLTIF3.js";
+import "./chunk-HNLXMD2V.js";
 import "./chunk-RMOBQ6A5.js";
 import "./chunk-54QCG45Y.js";
-import "./chunk-FUIIVSW6.js";
-import "./chunk-65SVQELL.js";
+import "./chunk-SSTLTIF3.js";
+import "./chunk-WH7XN5ER.js";
+import "./chunk-GFDGDFBF.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-MW2GJJ53.js";
+import "./chunk-2UGGBIDL.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-2233TQCA.js";
+import "./chunk-LLU6WZLK.js";
 import "./chunk-HCJCW7X4.js";
 import "./chunk-OPU3NYOO.js";
-import "./chunk-7TS64TBG.js";
+import "./chunk-UU4UINUX.js";
 import "./chunk-AFNRE2RV.js";
 import "./chunk-3NGZ4PL7.js";
 import "./chunk-NLEW62VC.js";
 import "./chunk-HYZV25LY.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-HEPR6QTL.js";
+import "./chunk-RWSLVYTE.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-ATOU6CYR.js";
+import "./chunk-BV6GBSRP.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-XACL67CS.js";
-import "./chunk-5Z5NATNS.js";
+import "./chunk-7SEC2AG5.js";
+import "./chunk-PPZOWQHP.js";
 import "./chunk-7Y5UDEVM.js";
 import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";

package/dist/{catchup-brief-DIOMTEW5.js → catchup-brief-BVJOF3GL.js}

@@ -1,35 +1,35 @@
 import {
   lightweightSearch
-} from "./chunk-GQQHDEEM.js";
+} from "./chunk-FOV57K47.js";
 import "./chunk-AB4PAQYK.js";
-import "./chunk-H37HHX3E.js";
+import "./chunk-EDH54E5A.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-HHIBOU3P.js";
-import "./chunk-Y25OJWOQ.js";
+import "./chunk-7LF5DS3A.js";
+import "./chunk-RP5GETX5.js";
 import {
   sessionScopeFilter,
   strictSessionScopeFilter
-} from "./chunk-PLRIJALF.js";
-import "./chunk-OFX5B2S7.js";
-import "./chunk-B76TSEP3.js";
-import "./chunk-RLRT2BVM.js";
+} from "./chunk-KKOLHBNC.js";
+import "./chunk-ATKW3SYL.js";
+import "./chunk-BJOBR6P2.js";
+import "./chunk-6D2PI4QD.js";
+import "./chunk-E23LNUWJ.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-EIKATSE4.js";
-import "./chunk-E23LNUWJ.js";
-import "./chunk-UIV2WPBT.js";
-import "./chunk-SSTLTIF3.js";
+import "./chunk-HNLXMD2V.js";
 import "./chunk-RMOBQ6A5.js";
 import "./chunk-54QCG45Y.js";
-import "./chunk-FUIIVSW6.js";
-import "./chunk-65SVQELL.js";
+import "./chunk-SSTLTIF3.js";
+import "./chunk-WH7XN5ER.js";
+import "./chunk-GFDGDFBF.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-MW2GJJ53.js";
+import "./chunk-2UGGBIDL.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-2233TQCA.js";
+import "./chunk-LLU6WZLK.js";
 import "./chunk-HCJCW7X4.js";
 import "./chunk-OPU3NYOO.js";
-import "./chunk-7TS64TBG.js";
+import "./chunk-UU4UINUX.js";
 import "./chunk-AFNRE2RV.js";
 import "./chunk-3NGZ4PL7.js";
 import "./chunk-NLEW62VC.js";
@@ -38,16 +38,16 @@ import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-ATOU6CYR.js";
+import "./chunk-BV6GBSRP.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-Z42MXYWW.js";
-import "./chunk-XACL67CS.js";
-import "./chunk-5Z5NATNS.js";
+import "./chunk-7SEC2AG5.js";
+import "./chunk-PPZOWQHP.js";
 import "./chunk-7Y5UDEVM.js";
 import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";
@@ -156,7 +156,7 @@ ${msgLines}`);
   } catch {
   }
   try {
-    const { getPendingProspective, markSurfaced } = await import("./prospective-memory-W6S67LZZ.js");
+    const { getPendingProspective, markSurfaced } = await import("./prospective-memory-UACFTYXK.js");
     const due = await getPendingProspective(agentId, { projectName, limit: 5 });
     if (due.length > 0) {
       const now = Date.now();

package/dist/{chunk-X425OEYF.js → chunk-2C455MU3.js}

@@ -8,10 +8,10 @@ import {
 } from "./chunk-L3TB7CC3.js";
 import {
   buildClaudeHttpMcpEntry
-} from "./chunk-AVKXCSBI.js";
+} from "./chunk-4QSJVMMT.js";
 import {
   ensureAllAgentSymlinks
-} from "./chunk-OFX5B2S7.js";
+} from "./chunk-ATKW3SYL.js";
 import {
   MCP_LEGACY_KEY,
   MCP_PRIMARY_KEY

package/dist/{chunk-N5I7RL3I.js → chunk-2IWBY7XK.js}

@@ -119,7 +119,7 @@ function releaseBackfillLock() {
 }
 async function getTaskAwareCapacity() {
   const { getClient } = await import("./lib/database.js");
-  const { sessionScopeFilter } = await import("./task-scope-CQEG5SSJ.js");
+  const { sessionScopeFilter } = await import("./task-scope-EKYDCVUF.js");
   const client = getClient();
   const scope = sessionScopeFilter();
   const result = await client.execute({

package/dist/{chunk-X7H3HMFH.js → chunk-2P4WJNN5.js}

@@ -4,17 +4,17 @@ import {
   resolveExeSession,
   sendIntercom,
   strictSessionScopeFilter
-} from "./chunk-PLRIJALF.js";
+} from "./chunk-KKOLHBNC.js";
 import {
   parseMessage,
   serializeMessage
 } from "./chunk-4JERP7NT.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-FUIIVSW6.js";
+} from "./chunk-WH7XN5ER.js";
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 
 // src/lib/messaging.ts
 import crypto from "crypto";

package/dist/{chunk-MW2GJJ53.js → chunk-2UGGBIDL.js}

@@ -3,12 +3,12 @@ import {
   getClient,
   isInitialized,
   loadEmployees
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 import {
   PLAN_LIMITS,
   checkLicense,
   isFeatureAllowed
-} from "./chunk-XACL67CS.js";
+} from "./chunk-7SEC2AG5.js";
 import {
   EXE_AI_DIR
 } from "./chunk-7Y5UDEVM.js";

package/dist/{chunk-BPC5LZ6Y.js → chunk-2WMTTIAZ.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 import {
   loadConfigSync
 } from "./chunk-7Y5UDEVM.js";

package/dist/{chunk-BU2QQWBQ.js → chunk-2YCFNBC4.js}

@@ -1,6 +1,6 @@
 import {
   listReminders
-} from "./chunk-KMBEL7VB.js";
+} from "./chunk-PVIH3ZGV.js";
 
 // src/mcp/tools/list-reminders.ts
 import { z } from "zod";

package/dist/{chunk-RRWDYOQS.js → chunk-32YHCHWW.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 
 // src/lib/token-budget.ts
 var WARN_THRESHOLD = 0.8;

package/dist/{chunk-I5RLNOFK.js → chunk-3BRVLPPA.js}

@@ -11,12 +11,15 @@ function daemonReadyPath() {
 function eventLoopBlockedMarkerPath() {
   return join(exeDir(), "session-cache", "event-loop-blocked.marker");
 }
+var _readyGeneration;
+function setDaemonReadyGeneration(generation) {
+  _readyGeneration = generation;
+}
 function writeDaemonReady(info) {
   try {
-    writeFileSync(
-      daemonReadyPath(),
-      JSON.stringify({ pid: info.pid, port: info.port, ts: (/* @__PURE__ */ new Date()).toISOString() })
-    );
+    const payload = { pid: info.pid, port: info.port, ts: (/* @__PURE__ */ new Date()).toISOString() };
+    if (_readyGeneration !== void 0) payload.generation = _readyGeneration;
+    writeFileSync(daemonReadyPath(), JSON.stringify(payload));
   } catch {
   }
 }
@@ -55,6 +58,7 @@ function isDaemonReady(maxAgeMs = 3e4) {
 
 export {
   daemonReadyPath,
+  setDaemonReadyGeneration,
   writeDaemonReady,
   clearDaemonReady,
   readDaemonReady,

package/dist/{chunk-KTY7I7UH.js → chunk-4FJZ6SO7.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-D3QASX2W.js";
+} from "./chunk-C2SRRCRK.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-XWHE4LZK.js → chunk-4LWV633D.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-XACL67CS.js";
+} from "./chunk-7SEC2AG5.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";
@@ -955,6 +955,17 @@ function writeBreakGlassAudit(plan, issues, options) {
   writeFileSync(auditFile, body, { mode: 384 });
   console.warn(`[stack-update] BREAK-GLASS deploy override recorded: ${auditFile}`);
 }
+function assertRolloutStageAllowed(plan, options) {
+  const stage = plan.release.rolloutStage ?? "ga";
+  if (stage !== "canary") return;
+  if (options.explicitTarget || options.allowCanary) return;
+  throw new Error(
+    `Stack ${plan.targetVersion} is a CANARY release (not yet promoted to general availability). Refusing to install it implicitly via manifest.latest \u2014 this protects the fleet from an unpromoted rollout reaching every customer at once. To deploy it anyway:
+  - as the designated canary host: exe-os stack-update --target ${plan.targetVersion} --yes
+  - or explicitly opt in: exe-os stack-update --allow-canary --yes
+Once the canary host is verified healthy, promote it with: exe-os stack-promote --version ${plan.targetVersion} --yes`
+  );
+}
 function assertBreakingChangesAllowed(plan, allowedIds) {
   const required = plan.breakingChanges.filter((c) => c.requiresConfirmation !== false);
   const missing = required.filter((c) => !allowedIds.includes(c.id));
@@ -1786,6 +1797,10 @@ async function runStackUpdate(options) {
   const composeRaw = readFileSync(options.composeFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, scopedServiceNames, serviceSelection, composeRaw);
   const fullTargetPlan = scopedServiceNames.length > 0 ? createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, void 0, serviceSelection, composeRaw) : plan;
+  assertRolloutStageAllowed(plan, {
+    explicitTarget: Boolean(effectiveTargetVersion),
+    allowCanary: options.allowCanary ?? process.env.EXE_STACK_ALLOW_CANARY === "1"
+  });
   assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
   assertDeploymentScopeAllowed(plan, options.deploymentPersona ?? "customer");
   const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
@@ -2416,7 +2431,10 @@ function listAvailableVersions(manifest, currentVersion) {
     releasedAt: manifest.stacks[v]?.releasedAt,
     notes: manifest.stacks[v]?.notes,
     isCurrent: v === currentVersion,
-    isLatest: v === manifest.latest
+    isLatest: v === manifest.latest,
+    // Backward compatible: manifest entries published before rolloutStage existed
+    // are "ga" (see assertRolloutStageAllowed).
+    rolloutStage: manifest.stacks[v]?.rolloutStage ?? "ga"
   }));
 }
 function compareVersions(a, b) {
@@ -2865,6 +2883,7 @@ export {
   collectImageAvailabilityIssues,
   assertDeploymentScopeAllowed,
   assertProductionDeployGate,
+  assertRolloutStageAllowed,
   assertBreakingChangesAllowed,
   verifyManifestImagesAvailable,
   applyGatewayOverlays,

package/dist/{chunk-AVKXCSBI.js → chunk-4QSJVMMT.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-X2FHTDIU.js";
 import {
   loadEmployeesSync
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 
 // src/adapters/mcp-http-config.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

package/dist/{chunk-I3XKO3KQ.js → chunk-6BQG7EKO.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-A47MXY2I.js";
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 
 // src/lib/global-procedures.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-RLRT2BVM.js → chunk-6D2PI4QD.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 
 // src/lib/skill-refinement.ts
 import crypto from "crypto";

package/dist/{chunk-7EA7LYW4.js → chunk-6MVC43X7.js}

@@ -1,11 +1,11 @@
+import {
+  ingest
+} from "./chunk-TWXZM34M.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-QXSBB26A.js";
-import {
-  ingest
-} from "./chunk-7WDXEKUL.js";
+} from "./chunk-DNVFWFYF.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";