@askexenow/exe-os 0.9.347 → 0.9.349

package/deploy/compose/cloudflared/config.yml.example

@@ -8,8 +8,9 @@
 #        wiki.<domain>    → http://exe-sso-edge:80   (unified SSO redirect)
 #        erp.<domain>     → http://exe-sso-edge:80   (unified SSO redirect)
 #        gateway.<domain> → http://exe-gateway:3100
+#        dashboard.askexe.com → http://exe-dashboard:80
 #        monitor.<domain> → http://exe-monitor-hub:8090
-#        auth.<domain>    → http://exe-auth:80    (auth gateway — NOT raw gotrue:9999; bug 802661a5)
+#        auth.<domain>    → http://exe-sso-edge:80  (auth gateway + real health aliases)
 #        api.<domain>     → http://exe-os:8765
 #   No config.yml or credentials file needed — the token embeds everything.
 #
@@ -43,6 +44,9 @@ ingress:
   # Gateway (WhatsApp, webhooks, pairing)
   - hostname: gateway.CHANGEME_DOMAIN
     service: http://exe-gateway:3100
+  # AskExe customer dashboard (nginx in exe-dashboard listens on container port 80).
+  - hostname: dashboard.askexe.com
+    service: http://exe-dashboard:80
   # Monitor — /_/ admin panel blocked; only the API and UI are exposed publicly.
   # The PocketBase superadmin UI must be accessed via SSH tunnel:
   #   ssh -L 8090:127.0.0.1:8090 <vps> then open http://localhost:8090/_/
@@ -51,12 +55,11 @@ ingress:
     service: http_status:404
   - hostname: monitor.CHANGEME_DOMAIN
     service: http://exe-monitor-hub:8090
-  # Auth gateway (login SPA + /api/ proxy to GoTrue). Bug 802661a5: routing
-  # auth.<domain> straight to raw gotrue:9999 bypasses the exe-auth gateway —
-  # no login UI, no CORS/domain templating, and GoTrue's API is exposed as the
-  # public front door. Always route through the exe-auth container.
+  # Auth gateway (login SPA + /api/ proxy to GoTrue) through the SSO edge.
+  # Bug d3ba1136: the edge maps /health and /healthz to GoTrue /health so public
+  # monitors never get the auth SPA HTML as a false-healthy 200.
   - hostname: auth.CHANGEME_DOMAIN
-    service: http://exe-auth:80
+    service: http://exe-sso-edge:80
   # exe-os daemon (MCP)
   - hostname: api.CHANGEME_DOMAIN
     service: http://exe-os:8765

package/deploy/compose/docker-compose.yml

@@ -140,10 +140,10 @@ services:
     # whole secret file). A compromise of one app container cannot read another
     # service's GOTRUE_JWT_SECRET / DB passwords / CLOUDFLARE_TUNNEL_TOKEN, etc.
     command: ["redis-server", "--requirepass", "${REDIS_PASSWORD:?REDIS_PASSWORD is required}", "--save", "60", "1", "--appendonly", "yes"]
-    # bug f1e79d3b: the in-container healthcheck reads $${REDIS_PASSWORD} at
-    # runtime, but #199 (bug 67d62490) dropped `env_file: .env`, so the password
-    # was no longer a container env var (only compose-time interpolated into
-    # `command:`). Provide it explicitly so redis-cli -a can authenticate.
+    # bug a9d34705/f1e79d3b: the in-container healthcheck reads $$REDIS_PASSWORD
+    # at runtime. Compose must not interpolate this at parse time, and the
+    # variable must be passed into the container explicitly now that blanket
+    # `env_file: .env` is gone, so redis-cli can authenticate against requirepass.
     environment:
       REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
     volumes:
@@ -151,7 +151,7 @@ services:
     networks:
       - backend
     healthcheck:
-      test: ["CMD-SHELL", "redis-cli -a $${REDIS_PASSWORD:?REDIS_PASSWORD is required} ping | grep -q PONG"]
+      test: ["CMD-SHELL", "test -n \"$$REDIS_PASSWORD\" && redis-cli -a \"$$REDIS_PASSWORD\" ping | grep -q PONG"]
       interval: 10s
       timeout: 5s
       start_period: 10s
@@ -300,10 +300,13 @@ services:
       - backend
     healthcheck:
       # bug a54ac364: the hub is a scratch image with NO shell, wget, or curl —
-      # the only executable is the hub binary. `/beszel health --url <url>` does
-      # an in-binary HTTP GET against /api/health and exits non-zero on failure
-      # (matches the image's own HEALTHCHECK in internal/dockerfile_hub).
-      test: ["CMD", "/beszel", "health", "--url", "http://127.0.0.1:8090"]
+      # the only executable is the hub binary, invoked directly.
+      # bug ae971a4d: the binary lives at /app/beszel (Dockerfile.hub COPY
+      # --from=builder /out/beszel /app/beszel); there is NO /beszel. Verified on
+      # the live exe-db-jkt container (image v0.9.4): /app/beszel exists,
+      # /beszel does not → the old `/beszel` healthcheck failed on every probe
+      # (permanent false-unhealthy). Match the image's own HEALTHCHECK path.
+      test: ["CMD", "/app/beszel", "health", "--url", "http://127.0.0.1:8090"]
       interval: 30s
       timeout: 5s
       start_period: 15s
@@ -948,6 +951,11 @@ services:
       # presence, so the edge needs GoTrue resolvable and healthy at start.
       gotrue:
         condition: service_healthy
+      # Bug d3ba1136: auth.<domain> also routes through the edge so /health and
+      # /healthz can proxy to GoTrue /health instead of falling through to the
+      # auth SPA HTML page.
+      exe-auth:
+        condition: service_healthy
     environment:
       DOMAIN: ${DOMAIN:?DOMAIN is required — set to your customer apex domain (e.g. hygo.co)}
       # Neutralize nginx:alpine's built-in 20-envsubst-on-templates.sh: it would
@@ -998,10 +1006,12 @@ services:
   #   wiki.<domain>    → http://exe-sso-edge:80   (NOT exe-wiki:3001)
   #   erp.<domain>     → http://exe-sso-edge:80   (NOT exe-erp / exe-erp-nginx)
   #   gateway.<domain> → http://exe-gateway:3100  (routed directly — no SSO gate)
+  #   dashboard.askexe.com → http://exe-dashboard:80
   #   monitor.<domain> → http://exe-monitor-hub:8090
-  #   auth.<domain>    → http://gotrue:9999
+  #   auth.<domain>    → http://exe-sso-edge:80  (auth UI + real /health proxy)
   #   api.<domain>     → http://exe-os:8765
-  # exe-sso-edge selects crm/wiki/erp by Host header, so all three share one route.
+  # exe-sso-edge selects crm/wiki/erp/auth by Host header, so those routes share
+  # one edge.
   #
   # Advanced (config file): set CLOUDFLARE_TUNNEL_TOKEN= (empty) and
   # populate cloudflared/config.yml with tunnel ID + credentials.
@@ -1025,8 +1035,8 @@ services:
       run
       --token ${CLOUDFLARE_TUNNEL_TOKEN:?CLOUDFLARE_TUNNEL_TOKEN is required — create a tunnel in the Cloudflare dashboard and paste the token in .env}
     depends_on:
-      # App subdomains (crm/wiki/erp) are fronted by exe-sso-edge for the unified
-      # SSO redirect (bug 96f8b2b2); gateway is routed directly.
+      # App subdomains (crm/wiki/erp) and auth.<domain> are fronted by
+      # exe-sso-edge; gateway is routed directly.
       exe-sso-edge:
         condition: service_healthy
       exe-gateway:
@@ -1305,7 +1315,10 @@ services:
       - backend
     healthcheck:
       # Verify the bench worker process is alive and Redis queue is reachable.
-      test: ["CMD-SHELL", "pgrep -f 'rq worker' > /dev/null"]
+      # bug c8fb434f: pgrep is NOT in the Frappe image (exit 127) → permanent
+      # false-unhealthy. ps + grep are present; the [r] bracket avoids matching
+      # the grep process itself.
+      test: ["CMD-SHELL", "ps -ef | grep -q '[r]q worker'"]
       interval: 30s
       timeout: 5s
       start_period: 30s
@@ -1351,7 +1364,10 @@ services:
       - backend
     healthcheck:
       # Verify the bench schedule process is alive.
-      test: ["CMD-SHELL", "pgrep -f 'bench schedule' > /dev/null"]
+      # bug c8fb434f: pgrep is NOT in the Frappe image (exit 127) → permanent
+      # false-unhealthy. ps + grep are present; the [b] bracket avoids matching
+      # the grep process itself.
+      test: ["CMD-SHELL", "ps -ef | grep -q '[b]ench schedule'"]
       interval: 30s
       timeout: 5s
       start_period: 30s

package/deploy/compose/erp-nginx/nginx.conf

@@ -1,16 +1,23 @@
 # exe-erp nginx — serves static assets, proxies API to gunicorn
-upstream erp_backend {
-    server exe-erp:8000;
-}
-
-upstream erp_websocket {
-    server exe-erp-websocket:9000;
-}
+#
+# bug 9bd1d9f7: an `upstream { server exe-erp:8000; }` block resolves the name
+# ONCE at config load and caches the IP for the worker's life. When a
+# stack-update recreates exe-erp it gets a new container IP and nginx keeps
+# proxying to the dead address → erp.askexe.com 502s forever until erp-nginx is
+# manually restarted. Fix: drop the upstream blocks and resolve the upstream
+# names at REQUEST time via Docker's embedded DNS (127.0.0.11), using variable
+# proxy_pass. None of the proxy_pass rules rewrite the path (no URI on
+# proxy_pass), so the variable form preserves the original routing exactly.
 
 server {
     listen 80;
     server_name _;
 
+    # Re-resolve upstream container names at request time (Docker embedded DNS).
+    resolver 127.0.0.11 valid=10s ipv6=off;
+    set $erp_backend   "exe-erp:8000";
+    set $erp_websocket "exe-erp-websocket:9000";
+
     client_max_body_size 50m;
 
     # Static assets — proxied to gunicorn with aggressive caching.
@@ -23,7 +30,7 @@ server {
     # into the volume on boot. We still proxy /assets/ to gunicorn (it owns asset
     # resolution + the live frappe symlink) rather than serving from the volume.
     location /assets/ {
-        proxy_pass http://erp_backend;
+        proxy_pass http://$erp_backend;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         expires 1y;
@@ -38,7 +45,7 @@ server {
 
     # Socket.IO
     location /socket.io {
-        proxy_pass http://erp_websocket;
+        proxy_pass http://$erp_websocket;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
@@ -50,7 +57,7 @@ server {
 
     # Everything else → gunicorn
     location / {
-        proxy_pass http://erp_backend;
+        proxy_pass http://$erp_backend;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;

package/deploy/compose/sso-edge/default.conf.template

@@ -18,6 +18,7 @@
 
 upstream sso_crm  { server exe-crm:3000; }
 upstream sso_wiki { server exe-wiki:3001; }
+upstream sso_auth { server exe-auth:80; }
 # ERP must be reached through its own nginx (gunicorn can't serve /assets/ — bug 6776edf0)
 upstream sso_erp  { server exe-erp-nginx:80; }
 # Shared GoTrue — the sso-redirect snippet's /_sso_gate validates ?access_token=
@@ -59,6 +60,12 @@ server {
     set $sso_session_cookie $cookie_tokenPair;        # Twenty/CRM session cookie
     include /etc/nginx/snippets/sso-redirect.conf;
 
+    # Bug d3ba1136: public monitors hit /health as well as /healthz. Keep both
+    # exact paths outside the SSO gate and proxy them to CRM's real health
+    # endpoint so they never fall through to the app shell HTML.
+    location = /health  { auth_request off; proxy_pass http://sso_crm/healthz; }
+    location = /healthz { auth_request off; proxy_pass http://sso_crm/healthz; }
+
     location / { proxy_pass http://sso_crm; }
 }
 
@@ -81,9 +88,28 @@ server {
     set $sso_session_cookie $cookie_exe_access_token; # exe-wiki SSO session cookie (canonical)
     include /etc/nginx/snippets/sso-redirect.conf;
 
+    # Bug d3ba1136: wiki's actual health probe is /api/ping. Expose the standard
+    # monitor aliases as exact, ungated health routes so /health cannot return
+    # a false-healthy SPA HTML page.
+    location = /health  { auth_request off; proxy_pass http://sso_wiki/api/ping; }
+    location = /healthz { auth_request off; proxy_pass http://sso_wiki/api/ping; }
+
     location / { proxy_pass http://sso_wiki; }
 }
 
+# ── Auth ─────────────────────────────────────────────────────────────────────
+server {
+    listen 80;
+    server_name auth.${DOMAIN};
+
+    # Route auth.<domain> through this edge too, so exact health aliases can
+    # probe GoTrue instead of the auth SPA's nginx fallback.
+    location = /health  { proxy_pass http://sso_gotrue/health; }
+    location = /healthz { proxy_pass http://sso_gotrue/health; }
+
+    location / { proxy_pass http://sso_auth; }
+}
+
 # ── ERP ──────────────────────────────────────────────────────────────────────
 server {
     listen 80;

package/deploy/stack-manifests/v0.9.30-apps.json

@@ -0,0 +1,81 @@
+{
+  "schemaVersion": 1,
+  "latest": "0.9.30",
+  "stacks": {
+    "0.9.30": {
+      "version": "0.9.30",
+      "releasedAt": "2026-07-21T14:00:00.000Z",
+      "notes": "Fixes exe-auth pin regression introduced in 0.9.29: auth v0.1.0 -> v0.3.0 (bug 5f5b4795). Scoped apps-only manifest: stock Docker Hub infra images omitted because they are unchanged and the host has an unreliable Docker Hub path.",
+      "npmVersion": "0.9.324",
+      "services": {
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.27@sha256:a422e787f06850a5302dc560bfb1b944d8b35927607ded762bbda610fb7db48d",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v0.9.28@sha256:b3ab35cf00490711c4ae945d06da042cb285ca1c07902ea1c2e28ca540741a5d",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — CRM bridge fix, BYOK alias, SQL race fix, Baileys WA version floor. Pinned by digest only because tag v0.9.28 was overwritten upstream (bug b817e34c)."
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.3.0@sha256:546febcb819d1590dbf9284666ebe86d4c8cf026dc35728f7f22f1a16614a7ed",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/api/health",
+          "category": "auth",
+          "description": "Corrects the 0.9.29 exe-auth downgrade regression to v0.1.0; pins v0.3.0 (bug 5f5b4795)."
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.2.0-final8@sha256:15bb6020b109b4dfd51d245273ffa88bbfbaf0de09da05a09e6b6f9344b00c46",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "erp.askexe.com",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v0.9.4@sha256:d593bec5a4b248388d0d85353fae1ba8f93cab628a03833aa79acd0632fd11cb",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v0.9.4@sha256:9ca4e75577b2ff2abb754140ccfaf8df19161bcef601faf37d1fce743fe814fc",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring"
+        }
+      }
+    }
+  },
+  "signature": {
+    "keyId": "exe-stack-1",
+    "alg": "ed25519",
+    "signature": "ib9CL9sD/5c2q6M1UQDA1BUf9WT6iI18gUyCmY3+TitjVhIeAf5bTTyfs/FiWAAn8penUVWp21p65KJgSW1PCA=="
+  }
+}

package/deploy/stack-manifests/v0.9.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "latest": "0.9.29",
+  "latest": "0.9.30",
   "stacks": {
     "0.9.0": {
       "version": "0.9.0",
@@ -1966,7 +1966,7 @@
           "category": "monitoring"
         },
         "auth": {
-          "image": "update.askexe.com/askexe/exe-auth:v0.1.0@sha256:5de4fe282c60c9877b6a0e22cfba43f6222982d81eb315667e9479eb94d94d7a",
+          "image": "update.askexe.com/askexe/exe-auth:v0.2.0@sha256:8e1a17e5aff92b844be08c82120d91da0a4eaf6757c1071aec25ab5d7b560ba9",
           "env": "AUTH_IMAGE_TAG",
           "composeService": "exe-auth",
           "healthUrl": "http://127.0.0.1:3300/api/health",
@@ -2014,11 +2014,120 @@
           "category": "infra"
         }
       }
+    },
+    "0.9.30": {
+      "version": "0.9.30",
+      "releasedAt": "2026-07-21T14:00:00.000Z",
+      "notes": "Fixes exe-auth pin regression introduced in 0.9.29: auth v0.1.0 -> v0.3.0 (bug 5f5b4795).",
+      "npmVersion": "0.9.324",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.27@sha256:a422e787f06850a5302dc560bfb1b944d8b35927607ded762bbda610fb7db48d",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v0.9.28@sha256:b3ab35cf00490711c4ae945d06da042cb285ca1c07902ea1c2e28ca540741a5d",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — CRM bridge fix, BYOK alias, SQL race fix, Baileys WA version floor. Pinned by digest only because tag v0.9.28 was overwritten upstream (bug b817e34c)."
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v0.9.4@sha256:9ca4e75577b2ff2abb754140ccfaf8df19161bcef601faf37d1fce743fe814fc",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v0.9.4@sha256:d593bec5a4b248388d0d85353fae1ba8f93cab628a03833aa79acd0632fd11cb",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.3.0@sha256:546febcb819d1590dbf9284666ebe86d4c8cf026dc35728f7f22f1a16614a7ed",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/api/health",
+          "category": "auth",
+          "description": "Corrects the 0.9.29 exe-auth downgrade regression to v0.1.0; pins v0.3.0 (bug 5f5b4795)."
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.2.0-final8@sha256:15bb6020b109b4dfd51d245273ffa88bbfbaf0de09da05a09e6b6f9344b00c46",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        }
+      }
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "7e/1gwcJB83aPHZPJHEnZRI/Nc4Rr5NZn4qyqk3f9Bv6KruxygvvagcUs/u+NPjWrzyXIUK5nimpGsaulJf7DQ=="
+    "signature": "KIjkzkAVrY3R6jCp4T2OT4SvWGCkr9dnUXyEF6O9kBW8nrDLrDzuiXvbBBdYogLkLRT8+UtONs+cPP8Kl97DAA=="
   }
 }

package/dist/{active-agent-CMY7WTJL.js → active-agent-PX6KAEEQ.js}

@@ -5,15 +5,16 @@ import {
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
   writeActiveAgent
-} from "./chunk-HWK5GKE6.js";
+} from "./chunk-TF5E6O5Q.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-ZY2ABBVR.js";
+import "./chunk-QNKR7WEL.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-FM4ZI5ZP.js";
+import "./chunk-FE6WBI2M.js";
 import "./chunk-OMXJMOBD.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-YMUZWC33.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-BCZF3AGJ.js";
 import "./chunk-HSGBZSCA.js";

package/dist/{active-agent-US4KO4LV.js → active-agent-QVLZKWR2.js}

@@ -6,15 +6,16 @@ import {
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
   writeActiveAgent
-} from "./chunk-HWK5GKE6.js";
+} from "./chunk-TF5E6O5Q.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-ZY2ABBVR.js";
+import "./chunk-QNKR7WEL.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-FM4ZI5ZP.js";
+import "./chunk-FE6WBI2M.js";
 import "./chunk-OMXJMOBD.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-YMUZWC33.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-BCZF3AGJ.js";
 import "./chunk-HSGBZSCA.js";

package/dist/{agentic-ontology-3Y37SQYR.js → agentic-ontology-6MEXY5L7.js}

@@ -10,7 +10,7 @@ import {
   insertOntologyForMemory,
   ontologyPayload,
   stableId
-} from "./chunk-MA22RV3T.js";
+} from "./chunk-FXZRJT3H.js";
 import "./chunk-MLKGABMK.js";
 export {
   ONTOLOGY_YIELD_EVERY,

package/dist/{backfill-metadata-GK66TYQE.js → backfill-metadata-TUUT3QII.js}

@@ -2,11 +2,11 @@
 import {
   disposeStore,
   initStore
-} from "./chunk-TQSAPNFW.js";
-import "./chunk-FFUEDKYK.js";
+} from "./chunk-P3JQDXY6.js";
+import "./chunk-H4JKOLXU.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-VBHLE3TR.js";
+import "./chunk-GPZQZTJB.js";
 import "./chunk-5MOYSU5A.js";
 import "./chunk-4QCFFW2H.js";
 import "./chunk-76CJBM36.js";
@@ -15,12 +15,13 @@ import {
   getClient,
   getEmployeeNamesByRole,
   loadEmployeesSync
-} from "./chunk-ZY2ABBVR.js";
+} from "./chunk-QNKR7WEL.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-FM4ZI5ZP.js";
+import "./chunk-FE6WBI2M.js";
 import "./chunk-OMXJMOBD.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-YMUZWC33.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-QWVXN224.js";
 import "./chunk-BCZF3AGJ.js";

package/dist/{backup-verify-72XBKKHL.js → backup-verify-RGB3KKD4.js}

@@ -1,7 +1,8 @@
 import {
   getLatestBackup,
   reasonFromBackupName
-} from "./chunk-FM4ZI5ZP.js";
+} from "./chunk-FE6WBI2M.js";
+import "./chunk-YMUZWC33.js";
 import "./chunk-BCZF3AGJ.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-MLKGABMK.js";

package/dist/{behaviors-G7TR6LBM.js → behaviors-3DQM4PSA.js}

@@ -12,22 +12,23 @@ import {
   reactivateBehavior,
   storeBehavior,
   storeReflexBehavior
-} from "./chunk-4VLRGKNY.js";
-import "./chunk-TQSAPNFW.js";
-import "./chunk-FFUEDKYK.js";
+} from "./chunk-UPZQLFRJ.js";
+import "./chunk-P3JQDXY6.js";
+import "./chunk-H4JKOLXU.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-VBHLE3TR.js";
+import "./chunk-GPZQZTJB.js";
 import "./chunk-5MOYSU5A.js";
 import "./chunk-4QCFFW2H.js";
 import "./chunk-76CJBM36.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-ZY2ABBVR.js";
+import "./chunk-QNKR7WEL.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-FM4ZI5ZP.js";
+import "./chunk-FE6WBI2M.js";
 import "./chunk-OMXJMOBD.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-YMUZWC33.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-QWVXN224.js";
 import "./chunk-BCZF3AGJ.js";

package/dist/bin/agentic-ontology-backfill.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   insertOntologyForBatch
-} from "../chunk-MA22RV3T.js";
+} from "../chunk-FXZRJT3H.js";
 import {
   politeBatchPause,
   startManagedJob
@@ -9,23 +9,24 @@ import {
 import {
   disposeStore,
   initStore
-} from "../chunk-TQSAPNFW.js";
-import "../chunk-FFUEDKYK.js";
+} from "../chunk-P3JQDXY6.js";
+import "../chunk-H4JKOLXU.js";
 import "../chunk-CHCA3ZM2.js";
 import "../chunk-OTVEIJUQ.js";
-import "../chunk-VBHLE3TR.js";
+import "../chunk-GPZQZTJB.js";
 import "../chunk-5MOYSU5A.js";
 import "../chunk-4QCFFW2H.js";
 import "../chunk-76CJBM36.js";
 import "../chunk-MP2AFCGL.js";
 import {
   getClient
-} from "../chunk-ZY2ABBVR.js";
+} from "../chunk-QNKR7WEL.js";
 import "../chunk-2I23RPSI.js";
-import "../chunk-FM4ZI5ZP.js";
+import "../chunk-FE6WBI2M.js";
 import "../chunk-OMXJMOBD.js";
 import "../chunk-7HLWBYH7.js";
 import "../chunk-BBMTVAE3.js";
+import "../chunk-YMUZWC33.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-QWVXN224.js";
 import "../chunk-BCZF3AGJ.js";