@askexenow/exe-os 0.9.347 → 0.9.348

package/dist/{capacity-monitor-4NJTN5QQ.js → capacity-monitor-CG2IGONS.js}

@@ -8,24 +8,24 @@ import {
   isAtCapacity,
   isWithinRelaunchCooldown,
   pollCapacityDead
-} from "./chunk-M3NSYVE3.js";
-import "./chunk-W666YWFU.js";
-import "./chunk-EWWCMMES.js";
-import "./chunk-XOVHWGPV.js";
-import "./chunk-7667KFAG.js";
-import "./chunk-JLYQD2XF.js";
+} from "./chunk-YAIFZXOM.js";
+import "./chunk-Y3JXLIZV.js";
+import "./chunk-ZXSFUR77.js";
+import "./chunk-RBRGSOK5.js";
+import "./chunk-OBWIVRD6.js";
+import "./chunk-A42356G7.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-EIKATSE4.js";
-import "./chunk-FDOURKUO.js";
+import "./chunk-HYZE3MNS.js";
 import "./chunk-AD2VCHSS.js";
 import "./chunk-WOYADZF5.js";
 import "./chunk-SKGMF2SO.js";
-import "./chunk-MT6YGWJ6.js";
+import "./chunk-AMC2OPYP.js";
 import "./chunk-AJIXH5JF.js";
-import "./chunk-3EMAJBBN.js";
+import "./chunk-A3YHWWE6.js";
 import "./chunk-AM7S2TY6.js";
-import "./chunk-Y7637VDZ.js";
+import "./chunk-RFRUDXOI.js";
 import "./chunk-OSKWCKUC.js";
 import "./chunk-KI5PFRG6.js";
 import "./chunk-CVYC6DUW.js";
@@ -39,16 +39,17 @@ import "./chunk-NLEW62VC.js";
 import "./chunk-HYZV25LY.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-ZY2ABBVR.js";
+import "./chunk-QNKR7WEL.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-FM4ZI5ZP.js";
+import "./chunk-FE6WBI2M.js";
 import "./chunk-OMXJMOBD.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-YMUZWC33.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-WNBZJSQT.js";
-import "./chunk-ZK53K7OR.js";
-import "./chunk-SJLZ53ZR.js";
+import "./chunk-MMOONM6D.js";
+import "./chunk-XF2D4CDA.js";
 import "./chunk-BCZF3AGJ.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-MLKGABMK.js";

package/dist/{catchup-brief-AMBXLHXU.js → catchup-brief-QFVNMTU5.js}

@@ -1,34 +1,34 @@
 import {
   lightweightSearch
-} from "./chunk-PO64LWTM.js";
+} from "./chunk-HL24OHHS.js";
 import "./chunk-AB4PAQYK.js";
-import "./chunk-TQSAPNFW.js";
-import "./chunk-FFUEDKYK.js";
+import "./chunk-H5QNVWU4.js";
+import "./chunk-H4JKOLXU.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-VBHLE3TR.js";
+import "./chunk-GPZQZTJB.js";
 import "./chunk-5MOYSU5A.js";
 import "./chunk-4QCFFW2H.js";
 import "./chunk-76CJBM36.js";
 import {
   sessionScopeFilter,
   strictSessionScopeFilter
-} from "./chunk-EWWCMMES.js";
-import "./chunk-XOVHWGPV.js";
-import "./chunk-7667KFAG.js";
-import "./chunk-JLYQD2XF.js";
+} from "./chunk-ZXSFUR77.js";
+import "./chunk-RBRGSOK5.js";
+import "./chunk-OBWIVRD6.js";
+import "./chunk-A42356G7.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-EIKATSE4.js";
-import "./chunk-FDOURKUO.js";
+import "./chunk-HYZE3MNS.js";
 import "./chunk-AD2VCHSS.js";
 import "./chunk-WOYADZF5.js";
 import "./chunk-SKGMF2SO.js";
-import "./chunk-MT6YGWJ6.js";
+import "./chunk-AMC2OPYP.js";
 import "./chunk-AJIXH5JF.js";
-import "./chunk-3EMAJBBN.js";
+import "./chunk-A3YHWWE6.js";
 import "./chunk-AM7S2TY6.js";
-import "./chunk-Y7637VDZ.js";
+import "./chunk-RFRUDXOI.js";
 import "./chunk-OSKWCKUC.js";
 import "./chunk-KI5PFRG6.js";
 import "./chunk-CVYC6DUW.js";
@@ -44,17 +44,18 @@ import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
 import {
   getClient
-} from "./chunk-ZY2ABBVR.js";
+} from "./chunk-QNKR7WEL.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-FM4ZI5ZP.js";
+import "./chunk-FE6WBI2M.js";
 import "./chunk-OMXJMOBD.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-YMUZWC33.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-QWVXN224.js";
 import "./chunk-WNBZJSQT.js";
-import "./chunk-ZK53K7OR.js";
-import "./chunk-SJLZ53ZR.js";
+import "./chunk-MMOONM6D.js";
+import "./chunk-XF2D4CDA.js";
 import "./chunk-BCZF3AGJ.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-MLKGABMK.js";
@@ -163,7 +164,7 @@ ${msgLines}`);
   } catch {
   }
   try {
-    const { getPendingProspective, markSurfaced } = await import("./prospective-memory-UDQWFP5Y.js");
+    const { getPendingProspective, markSurfaced } = await import("./prospective-memory-V7LFCPU4.js");
     const due = await getPendingProspective(agentId, { projectName, limit: 5 });
     if (due.length > 0) {
       const now = Date.now();

package/dist/{chunk-PYNWGP72.js → chunk-23O6LHII.js}

@@ -1,6 +1,6 @@
 import {
   listReminders
-} from "./chunk-XDVLCS64.js";
+} from "./chunk-UAKGNQWE.js";
 
 // src/mcp/tools/list-reminders.ts
 import { z } from "zod";

package/dist/{chunk-VDJUATQJ.js → chunk-27REQ7KR.js}

@@ -2,7 +2,7 @@ import {
   getGitRoot,
   isWorktreeDirty,
   isWorktreeDirtyAsync
-} from "./chunk-7667KFAG.js";
+} from "./chunk-OBWIVRD6.js";
 
 // src/lib/worktree-sweep.ts
 import { execFile } from "child_process";

package/dist/{chunk-G4HOMQY7.js → chunk-2AD2GAPC.js}

@@ -1,7 +1,7 @@
 import {
   getIdentity,
   loadEmployeesSync
-} from "./chunk-ZY2ABBVR.js";
+} from "./chunk-QNKR7WEL.js";
 
 // src/lib/drift-probes.ts
 var DRIFT_THRESHOLD = 80;

package/dist/{chunk-QZA5NG6Z.js → chunk-2WJYLXPF.js}

@@ -119,7 +119,7 @@ function releaseBackfillLock() {
 }
 async function getTaskAwareCapacity() {
   const { getClient } = await import("./lib/database.js");
-  const { sessionScopeFilter } = await import("./task-scope-5OSP2MUP.js");
+  const { sessionScopeFilter } = await import("./task-scope-PSVAE3EM.js");
   const client = getClient();
   const scope = sessionScopeFilter();
   const result = await client.execute({

package/dist/{chunk-G6IANQKD.js → chunk-43RTUMUT.js}

@@ -1,7 +1,7 @@
 import {
   executeAction,
   substituteTemplate
-} from "./chunk-MDK7E653.js";
+} from "./chunk-PIUDQ7P2.js";
 
 // src/automation/workflow-engine.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-WOKPKILI.js → chunk-5C46Y4AK.js}

@@ -263,7 +263,7 @@ async function runRegistryProxy(options = registryProxyOptionsFromEnv()) {
   await new Promise((resolve) => server.listen(options.port, options.host, resolve));
   console.log(`exe-registry-proxy listening on ${options.host ?? "0.0.0.0"}:${options.port}`);
   console.log(`proxying /v2/${options.allowedNamespace ?? "askexe"}/* -> ${options.upstream ?? "https://ghcr.io"}`);
-  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-GU3L66JR.js");
+  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-CQHBDUQE.js");
   const syncConfig = licenseSyncConfigFromEnv();
   if (syncConfig) {
     startLicenseSyncScheduler(syncConfig);

package/dist/{chunk-IMHERTUL.js → chunk-5KCC26FB.js}

@@ -1,9 +1,9 @@
 import {
   storeBehavior
-} from "./chunk-4VLRGKNY.js";
+} from "./chunk-MGMXYI7Y.js";
 import {
   getClient
-} from "./chunk-ZY2ABBVR.js";
+} from "./chunk-QNKR7WEL.js";
 import {
   loadConfig
 } from "./chunk-BCZF3AGJ.js";

package/dist/{chunk-XRX7F7XW.js → chunk-5RPCWLXE.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentSessionScope,
   strictSessionScopeFilter
-} from "./chunk-EWWCMMES.js";
+} from "./chunk-ZXSFUR77.js";
 import {
   getProjectName
 } from "./chunk-OPU3NYOO.js";

package/dist/{chunk-DZJL775P.js → chunk-6GSYN262.js}

@@ -1,6 +1,6 @@
 import {
   getGlobalProceduresBlock
-} from "./chunk-T7ZLJZAO.js";
+} from "./chunk-AUILJKSM.js";
 
 // src/lib/employee-templates.ts
 var BASE_OPERATING_PROCEDURES = `

package/dist/{chunk-UMK7TNCF.js → chunk-6JQTSKDR.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-ZK53K7OR.js";
+} from "./chunk-MMOONM6D.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";
@@ -299,6 +299,8 @@ async function rollbackStackUpdate(options) {
   } catch {
   }
   const backupComposeFile = lockData?.backupComposeFile;
+  const backupComposeOverrideFile = lockData?.backupComposeOverrideFile;
+  const composeOverrideFile = composeOverrideFileFor(options.composeFile);
   if (!options.serviceName) {
     try {
       if (existsSync(options.composeFile)) {
@@ -307,27 +309,41 @@ async function rollbackStackUpdate(options) {
     } catch {
     }
     if (backupComposeFile && existsSync(backupComposeFile)) {
-      console.log(
-        `[stack-update] Keeping current (superset) docker-compose.yml for recovery so newly-added services are not dropped; rolling back image tags via .env. Previous compose preserved at ${backupComposeFile}.`
-      );
+      copyFileSync(backupComposeFile, options.composeFile);
+      console.log(`[stack-update] Restored docker-compose.yml from ${backupComposeFile}`);
     } else {
       console.log("[stack-update] No backed-up docker-compose.yml in lock \u2014 rolling back image tags via .env on the current compose.");
     }
+    try {
+      if (backupComposeOverrideFile && existsSync(backupComposeOverrideFile)) {
+        copyFileSync(backupComposeOverrideFile, composeOverrideFile);
+        console.log(`[stack-update] Restored docker-compose.override.yml from ${backupComposeOverrideFile}`);
+      } else if (lockData?.hadComposeOverrideFile === false && existsSync(composeOverrideFile)) {
+        rmSync(composeOverrideFile, { force: true });
+        console.log("[stack-update] Removed docker-compose.override.yml because it was absent from the pre-update snapshot.");
+      }
+    } catch (overrideErr) {
+      const reason = overrideErr instanceof Error ? overrideErr.message : String(overrideErr);
+      console.warn(`[stack-update] Could not restore docker-compose.override.yml (${reason}); continuing rollback.`);
+    }
   }
   const scopedServiceNames = options.serviceName ? Object.entries(lockData?.services ?? {}).filter(([name, service]) => name === options.serviceName || (service.composeService ?? name) === options.serviceName).map(([name]) => name) : [];
   const rollbackEnvRaw = readFileSync(rollbackEnv, "utf8");
   if (scopedServiceNames.length > 0 && lockData?.services) {
     const rollbackEnvMap = parseEnv(rollbackEnvRaw);
+    const scopedEnvKeys = scopedServiceNames.map((serviceName) => lockData.services[serviceName].env).filter((key) => Boolean(key));
+    const mutatedEnvKeys = lockData.mutatedEnvKeys ?? [];
+    const restoreEnvKeys = [.../* @__PURE__ */ new Set([...scopedEnvKeys, ...mutatedEnvKeys])];
     const scopedUpdates = Object.fromEntries(
-      scopedServiceNames.map((serviceName) => lockData.services[serviceName].env).filter((key) => Boolean(key)).map((key) => [key, rollbackEnvMap.get(key) ?? ""])
+      restoreEnvKeys.map((key) => [key, rollbackEnvMap.get(key) ?? ""])
     );
-    console.log(`[stack-update] Restoring env keys for service ${scopedServiceNames.join(", ")} from ${rollbackEnv}`);
+    console.log(`[stack-update] Restoring env keys for service ${scopedServiceNames.join(", ")} from ${rollbackEnv}: ${restoreEnvKeys.join(", ")}`);
     writeSecretFile(options.envFile, patchEnv(readFileSync(options.envFile, "utf8"), scopedUpdates));
   } else {
     console.log(`[stack-update] Restoring env from ${rollbackEnv}`);
     writeSecretFile(options.envFile, rollbackEnvRaw);
   }
-  const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
+  const composeArgs = composeArgsForStack(options.composeFile, options.envFile);
   if (lockData?.services) {
     for (const [serviceName, service] of Object.entries(lockData.services)) {
       if (scopedServiceNames.length > 0 && !scopedServiceNames.includes(serviceName)) continue;
@@ -440,6 +456,22 @@ function manifestImagesForPull(release) {
     Object.values(release.services).map((service) => imagePullRef(service.image.trim())).filter(Boolean)
   ));
 }
+var COMPOSE_SIDECARS = {
+  // exe-crm-worker uses the same CRM_IMAGE_TAG as exe-crm but is a distinct
+  // compose service. Pull/restart it whenever the CRM API image changes so the
+  // API and worker cannot drift to different versions. (bug 9e324fd2)
+  "exe-crm": ["exe-crm-worker"],
+  "exe-erp": ["exe-erp-nginx", "exe-erp-websocket", "exe-erp-queue", "exe-erp-scheduler"]
+};
+function expandComposeServicesWithSidecars(primaryComposeServices) {
+  const expanded = [...primaryComposeServices];
+  for (const primary of primaryComposeServices) {
+    for (const sidecar of COMPOSE_SIDECARS[primary] ?? []) {
+      if (!expanded.includes(sidecar)) expanded.push(sidecar);
+    }
+  }
+  return expanded;
+}
 function cloneReleaseWithServices(release, serviceNames) {
   const wanted = new Set(serviceNames);
   const services = {};
@@ -463,6 +495,18 @@ function readStackUpdateLock(lockFile) {
 function writeStackUpdateLock(lockFile, data) {
   writeFileSync(lockFile, JSON.stringify(data, null, 2) + "\n");
 }
+function composeOverrideFileFor(composeFile) {
+  return path.join(path.dirname(composeFile), "docker-compose.override.yml");
+}
+function composeArgsForStack(composeFile, envFile, includeOverride = true) {
+  const args = ["compose", "--file", composeFile];
+  const overrideFile = composeOverrideFileFor(composeFile);
+  if (includeOverride && existsSync(overrideFile)) {
+    args.push("--file", overrideFile);
+  }
+  args.push("--env-file", envFile);
+  return args;
+}
 function buildInitialServiceStatus(plan, envRaw, now, activeServices) {
   const env = parseEnv(envRaw);
   const at = now().toISOString();
@@ -1017,6 +1061,8 @@ async function resolveStackImageCredentials(options, release) {
 async function verifyManifestImagesAvailable(plan, options) {
   const exec = options.exec ?? defaultExec;
   const images = manifestImagesForPull(plan.release);
+  const maxAttempts = Math.max(1, Math.floor(options.verifyImageMaxAttempts ?? 3));
+  const baseDelayMs = Math.max(0, Math.floor(options.verifyImageRetryBaseDelayMs ?? 1e3));
   let registryForLogout;
   const creds = await resolveStackImageCredentials(options, plan.release);
   if (creds) {
@@ -1024,15 +1070,29 @@ async function verifyManifestImagesAvailable(plan, options) {
     registryForLogout = creds.registry;
   }
   try {
-    return images.map((image) => {
-      try {
-        exec("docker", ["manifest", "inspect", image]);
-        return { image, ok: true };
-      } catch (err) {
-        const reason = err instanceof Error ? err.message : String(err);
-        return { image, ok: false, error: reason };
+    const results = [];
+    for (const image of images) {
+      let lastError = "";
+      let ok = false;
+      for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+          exec("docker", ["manifest", "inspect", image]);
+          ok = true;
+          break;
+        } catch (err) {
+          lastError = err instanceof Error ? err.message : String(err);
+          if (attempt < maxAttempts) {
+            const delayMs = baseDelayMs * Math.pow(2, attempt - 1);
+            console.warn(
+              `[stack-update] manifest inspect failed for ${image} (attempt ${attempt}/${maxAttempts}): ${lastError}. Retrying in ${delayMs}ms.`
+            );
+            if (delayMs > 0) await new Promise((resolve) => setTimeout(resolve, delayMs));
+          }
+        }
       }
-    });
+      results.push(ok ? { image, ok: true } : { image, ok: false, error: `manifest inspect failed after ${maxAttempts} attempt(s): ${lastError}` });
+    }
+    return results;
   } finally {
     if (registryForLogout) {
       try {
@@ -1058,6 +1118,17 @@ function allServiceList(release) {
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
+function packagedComposeTemplatePath(options) {
+  return options.composeTemplateFileForUpdate ?? path.join(resolvePackageRoot(), "deploy", "compose", "docker-compose.yml");
+}
+function readStagedComposeTemplate(options, currentComposeRaw) {
+  const templatePath = packagedComposeTemplatePath(options);
+  if (!existsSync(templatePath)) {
+    return { raw: currentComposeRaw, templatePath, templateFound: false, shouldRefresh: false };
+  }
+  const raw = readFileSync(templatePath, "utf8");
+  return { raw, templatePath, templateFound: true, shouldRefresh: raw !== currentComposeRaw };
+}
 async function assertPreDeployImagesPullable(plan, options) {
   let results;
   try {
@@ -1238,6 +1309,18 @@ function backupStackConfig(stackDir, composeFile, envRaw, now = () => /* @__PURE
   } catch {
     backupComposeFile = void 0;
   }
+  const composeOverrideFile = composeOverrideFileFor(composeFile);
+  const hadComposeOverrideFile = existsSync(composeOverrideFile);
+  let backupComposeOverrideFile;
+  try {
+    if (hadComposeOverrideFile) {
+      backupComposeOverrideFile = path.join(updateBackupDir, "docker-compose.override.yml.bak");
+      copyFileSync(composeOverrideFile, backupComposeOverrideFile);
+      copyFileSync(composeOverrideFile, path.join(updateBackupDir, "docker-compose.override.yml"));
+    }
+  } catch {
+    backupComposeOverrideFile = void 0;
+  }
   for (const f of [...PROTECTED_CONFIG_FILES, ...BOOTSTRAP_OVERWRITTEN_CONFIG_FILES]) {
     const src = path.join(stackDir, f);
     try {
@@ -1271,7 +1354,7 @@ function backupStackConfig(stackDir, composeFile, envRaw, now = () => /* @__PURE
   } catch {
   }
   console.log(`[stack-update] Config backed up to ${updateBackupDir}`);
-  return { updateBackupDir, backupEnvFile, backupComposeFile };
+  return { updateBackupDir, backupEnvFile, backupComposeFile, backupComposeOverrideFile, hadComposeOverrideFile };
 }
 function installDockerUbuntu(exec) {
   if (process.platform !== "linux") throw new Error("Docker auto-install is only supported on Linux. Install Docker manually, then retry.");
@@ -1643,7 +1726,7 @@ function hardenSsh(exec, result) {
 }
 function areStackContainersRunning(composeFile, envFile) {
   try {
-    const result = spawnSync("docker", ["compose", "--file", composeFile, "--env-file", envFile, "ps", "-q"], {
+    const result = spawnSync("docker", [...composeArgsForStack(composeFile, envFile), "ps", "-q"], {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 15e3
     });
@@ -1854,6 +1937,7 @@ async function runStackUpdate(options) {
   const scopedServiceNames = options.serviceName ? [options.serviceName] : resumeServices;
   const effectiveTargetVersion = options.targetVersion ?? resumeLock?.stackVersion;
   const composeRaw = readFileSync(options.composeFile, "utf8");
+  const stagedCompose = readStagedComposeTemplate(options, composeRaw);
   const plan = createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, scopedServiceNames, serviceSelection, composeRaw);
   const fullTargetPlan = scopedServiceNames.length > 0 ? createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, void 0, serviceSelection, composeRaw) : plan;
   assertRolloutStageAllowed(plan, {
@@ -1862,7 +1946,20 @@ async function runStackUpdate(options) {
   });
   assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
   assertDeploymentScopeAllowed(plan, options.deploymentPersona ?? "customer");
-  const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
+  const requiredEnvValidation = options.dryRun ? { derived: {}, unresolvable: [] } : detectMissingRequiredEnvVars(stagedCompose.raw, envRaw);
+  const migratedEnvVars = requiredEnvValidation.derived;
+  if (requiredEnvValidation.unresolvable.length > 0) {
+    const lines = requiredEnvValidation.unresolvable.map((r) => `  - ${r.key}${r.message ? ` (${r.message})` : ""}`);
+    throw new Error(
+      `Stack update aborted before any changes: the updated compose template requires env vars that are missing from ${options.envFile} and cannot be derived automatically.
+Set these in ${options.envFile}, then re-run stack-update:
+${lines.join("\n")}`
+    );
+  }
+  const plannedEnvRaw = patchEnv(envRaw, {
+    ...migratedEnvVars,
+    ...Object.fromEntries(plan.changes.map((c) => [c.key, c.after]))
+  });
   assertProductionDeployGate(plan, plannedEnvRaw, composeRaw, {
     breakGlassReason: options.breakGlassReason,
     breakGlassAuditFile: options.breakGlassAuditFile,
@@ -1907,13 +2004,13 @@ async function runStackUpdate(options) {
   const updateBackupDir = configBackup.updateBackupDir;
   const backupEnvFile = configBackup.backupEnvFile;
   const backupComposeFile = configBackup.backupComposeFile;
+  const backupComposeOverrideFile = configBackup.backupComposeOverrideFile;
+  const hadComposeOverrideFile = configBackup.hadComposeOverrideFile;
   try {
-    const templateCompose = path.join(resolvePackageRoot(), "deploy", "compose", "docker-compose.yml");
-    if (existsSync(templateCompose)) {
-      const templateRaw = readFileSync(templateCompose, "utf8");
-      if (templateRaw !== composeRaw) {
+    if (stagedCompose.templateFound) {
+      if (stagedCompose.shouldRefresh) {
         const tmpCompose = `${options.composeFile}.tmp-${process.pid}`;
-        writeFileSync(tmpCompose, templateRaw, { mode: 420 });
+        writeFileSync(tmpCompose, stagedCompose.raw, { mode: 420 });
         renameSync(tmpCompose, options.composeFile);
         console.log(
           `[stack-update] Refreshed docker-compose.yml from packaged template (old saved to ${path.join(updateBackupDir, "docker-compose.yml")}). Customer overrides should live in docker-compose.override.yml.`
@@ -1921,44 +2018,19 @@ async function runStackUpdate(options) {
       }
     } else {
       console.warn(
-        `[stack-update] Packaged compose template not found at ${templateCompose}; keeping existing docker-compose.yml. Shipped compose fixes will not apply.`
+        `[stack-update] Packaged compose template not found at ${stagedCompose.templatePath}; keeping existing docker-compose.yml. Shipped compose fixes will not apply.`
       );
     }
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     console.warn(`[stack-update] Could not refresh docker-compose.yml (${reason}); using existing compose.`);
   }
-  let migratedEnvVars = {};
-  try {
-    const refreshedComposeRaw = readFileSync(options.composeFile, "utf8");
-    const { derived, unresolvable } = detectMissingRequiredEnvVars(refreshedComposeRaw, envRaw);
-    if (unresolvable.length > 0) {
-      const lines = unresolvable.map((r) => `  - ${r.key}${r.message ? ` (${r.message})` : ""}`);
-      throw new Error(
-        `Stack update aborted before any changes: the updated compose template requires env vars that are missing from ${options.envFile} and cannot be derived automatically.
-Set these in ${options.envFile}, then re-run stack-update:
-${lines.join("\n")}`
-      );
-    }
-    migratedEnvVars = derived;
-    if (Object.keys(derived).length > 0) {
-      console.log(
-        `[stack-update] Migrating ${Object.keys(derived).length} newly-required env var(s) into ${options.envFile} with derived defaults: ${Object.keys(derived).join(", ")}`
-      );
-    }
-  } catch (err) {
-    throw err instanceof Error ? err : new Error(String(err));
+  if (Object.keys(migratedEnvVars).length > 0) {
+    console.log(
+      `[stack-update] Migrating ${Object.keys(migratedEnvVars).length} newly-required env var(s) into ${options.envFile} with derived defaults: ${Object.keys(migratedEnvVars).join(", ")}`
+    );
   }
   const initialServiceStatus = options.resume && resumeLock?.serviceStatus ? resumeLock.serviceStatus : buildInitialServiceStatus(fullTargetPlan, envRaw, now, new Set(Object.keys(plan.release.services)));
-  writeStackUpdateLock(lockFile, {
-    stackVersion: plan.targetVersion,
-    previousVersion,
-    updatedAt: now().toISOString(),
-    backupEnvFile: resumeLock?.backupEnvFile ?? backupEnvFile,
-    backupComposeFile: resumeLock?.backupComposeFile ?? backupComposeFile,
-    services: { ...fullTargetPlan.release.services, ...resumeLock?.services ?? {}, ...plan.release.services },
-    serviceStatus: initialServiceStatus
-  });
   try {
     const { spawnSync: sp } = await import("child_process");
     const backupSh = path.join(stackDir, "backup.sh");
@@ -2003,6 +2075,19 @@ ${lines.join("\n")}`
     if (overrideResolution.warn) console.warn(overrideResolution.notice);
     else console.log(overrideResolution.notice);
   }
+  const mutatedEnvKeys = Object.keys(updates);
+  writeStackUpdateLock(lockFile, {
+    stackVersion: plan.targetVersion,
+    previousVersion,
+    updatedAt: now().toISOString(),
+    backupEnvFile: resumeLock?.backupEnvFile ?? backupEnvFile,
+    backupComposeFile: resumeLock?.backupComposeFile ?? backupComposeFile,
+    backupComposeOverrideFile: resumeLock?.backupComposeOverrideFile ?? backupComposeOverrideFile,
+    hadComposeOverrideFile: resumeLock?.hadComposeOverrideFile ?? hadComposeOverrideFile,
+    mutatedEnvKeys: [.../* @__PURE__ */ new Set([...resumeLock?.mutatedEnvKeys ?? [], ...mutatedEnvKeys])],
+    services: { ...fullTargetPlan.release.services, ...resumeLock?.services ?? {}, ...plan.release.services },
+    serviceStatus: initialServiceStatus
+  });
   const patched = patchEnv(envRaw, updates);
   const tmp = `${options.envFile}.tmp-${process.pid}`;
   writeSecretFile(tmp, patched);
@@ -2010,7 +2095,7 @@ ${lines.join("\n")}`
   for (const serviceName of Object.keys(plan.release.services)) {
     updateServiceStatus(lockFile, serviceName, "env_patched", now);
   }
-  const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
+  const composeArgs = composeArgsForStack(options.composeFile, options.envFile);
   let registryForLogout;
   try {
     let credsLogged = false;
@@ -2102,7 +2187,9 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         );
       }
     }
-    const composePullTargets = Object.entries(plan.release.services).map(([name, svc]) => svc.composeService ?? name);
+    const composePullTargets = expandComposeServicesWithSidecars(
+      Object.entries(plan.release.services).map(([name, svc]) => svc.composeService ?? name)
+    );
     try {
       if (composePullTargets.length > 0) {
         exec("docker", [...composeArgs, "pull", ...composePullTargets]);
@@ -2214,16 +2301,8 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       "cloudflared"
       // tunnel — restarted last so services are healthy before it connects
     ];
-    const COMPOSE_SIDECARS = {
-      "exe-erp": ["exe-erp-nginx", "exe-erp-websocket", "exe-erp-queue", "exe-erp-scheduler"]
-    };
     const primaryComposeServices = Object.entries(plan.release.services).map(([serviceName, service]) => service.composeService ?? serviceName);
-    const scopedComposeServices = [...primaryComposeServices];
-    for (const primary of primaryComposeServices) {
-      for (const sidecar of COMPOSE_SIDECARS[primary] ?? []) {
-        if (!scopedComposeServices.includes(sidecar)) scopedComposeServices.push(sidecar);
-      }
-    }
+    const scopedComposeServices = expandComposeServicesWithSidecars(primaryComposeServices);
     const restartOrder = [
       ...RESTART_ORDER.filter((service) => scopedComposeServices.includes(service)),
       ...scopedComposeServices.filter((service) => !RESTART_ORDER.includes(service))
@@ -2389,7 +2468,18 @@ Fix these before the stack is safe to operate.`);
     progress.logOverallSummary();
     printPhaseSummary();
     const finalLock = readStackUpdateLock(lockFile) ?? {};
-    writeStackUpdateLock(lockFile, { ...finalLock, stackVersion: plan.targetVersion, previousVersion, updatedAt: now().toISOString(), backupEnvFile: finalLock.backupEnvFile ?? backupEnvFile, services: { ...fullTargetPlan.release.services, ...finalLock.services ?? {}, ...plan.release.services } });
+    writeStackUpdateLock(lockFile, {
+      ...finalLock,
+      stackVersion: plan.targetVersion,
+      previousVersion,
+      updatedAt: now().toISOString(),
+      backupEnvFile: finalLock.backupEnvFile ?? backupEnvFile,
+      backupComposeFile: finalLock.backupComposeFile ?? backupComposeFile,
+      backupComposeOverrideFile: finalLock.backupComposeOverrideFile ?? backupComposeOverrideFile,
+      hadComposeOverrideFile: finalLock.hadComposeOverrideFile ?? hadComposeOverrideFile,
+      mutatedEnvKeys: finalLock.mutatedEnvKeys ?? mutatedEnvKeys,
+      services: { ...fullTargetPlan.release.services, ...finalLock.services ?? {}, ...plan.release.services }
+    });
     await postDeployAudit(options, "success", plan.targetVersion, previousVersion, void 0, { changes: plan.changes.length });
     return { status: "updated", targetVersion: plan.targetVersion, changes: plan.changes, backupEnvFile, lockFile, serviceStatus: readStackUpdateLock(lockFile)?.serviceStatus };
   } catch (err) {
@@ -2926,6 +3016,8 @@ export {
   buildReleaseMigrationArgs,
   runReleaseMigrations,
   isExecFormMigration,
+  expandComposeServicesWithSidecars,
+  composeArgsForStack,
   parseStackManifest,
   loadStackManifest,
   parseEnv,

package/dist/{chunk-2BOEUPL6.js → chunk-6QRS3IZF.js}

@@ -4,7 +4,7 @@ import {
 import {
   flushBatch,
   writeMemory
-} from "./chunk-TQSAPNFW.js";
+} from "./chunk-H5QNVWU4.js";
 import {
   redactSecrets
 } from "./chunk-4QCFFW2H.js";

package/dist/{chunk-M722B4DA.js → chunk-6WFXNQDJ.js}

@@ -1,6 +1,6 @@
 import {
   listBehaviors
-} from "./chunk-4VLRGKNY.js";
+} from "./chunk-MGMXYI7Y.js";
 import {
   loadConfigSync
 } from "./chunk-BCZF3AGJ.js";