@askexenow/exe-os 0.9.362 → 0.9.365

package/dist/{chunk-6Y3KUO7Q.js → chunk-ZSZPMUNX.js}

@@ -1,6 +1,12 @@
+import {
+  REVISION_LABEL,
+  VERSION_LABEL,
+  checkImageVersionLabels,
+  isFirstPartyImage
+} from "./chunk-L25OAFOU.js";
 import {
   loadLicense
-} from "./chunk-HSKABJE6.js";
+} from "./chunk-ZDUO6QBH.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync as spawnSync2 } from "child_process";
@@ -106,7 +112,50 @@ function saveServiceSelection(envFile, selectedServices) {
     selectedServices,
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  writeFileSync(selPath, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+  writeFileSync(selPath, JSON.stringify(data, null, 2) + "\n", { mode: 420 });
+  chmodSync(selPath, 420);
+}
+function mergeServiceSelection(envFile, services) {
+  const existing = loadServiceSelection(envFile)?.selectedServices;
+  const result = computeServiceSelectionMerge(existing, services);
+  saveServiceSelection(envFile, result.selectedServices);
+  return result;
+}
+function computeServiceSelectionMerge(existingServices, requestedServices) {
+  const existing = existingServices ?? [];
+  const existingSet = new Set(existing);
+  const requestedSet = new Set(requestedServices);
+  const added = requestedServices.filter((name, i) => !existingSet.has(name) && requestedServices.indexOf(name) === i);
+  const preserved = existing.filter((name) => !requestedSet.has(name));
+  const selectedServices = [...existing.filter((name, i) => existing.indexOf(name) === i), ...added];
+  return { selectedServices, added, preserved };
+}
+function runScopedServiceSelection(services, now = () => /* @__PURE__ */ new Date()) {
+  return { selectedServices: [...services], updatedAt: now().toISOString() };
+}
+function unmanagedManifestServices(release, selection) {
+  if (!selection) return [];
+  const selected = new Set(selection.selectedServices);
+  return Object.entries(release.services).filter(([name, service]) => !service.required && !selected.has(name) && !selected.has(service.composeService ?? name)).map(([name]) => name);
+}
+function warnUnmanagedManifestServices(release, selection, options = { targetVersion: "", envFile: "" }) {
+  const skipped = unmanagedManifestServices(release, selection);
+  if (skipped.length === 0) return skipped;
+  const warn = options.warn ?? ((message) => console.warn(message));
+  const border = "!".repeat(72);
+  const origin = options.scope === "run" ? "this run's --services scope" : `the managed set (${serviceSelectionPath(options.envFile)})`;
+  const remedy = options.scope === "run" ? "  Drop --services to update the whole managed set." : `  These services will NOT be updated. If that is not what you want, run:
+` + skipped.map((name) => `    exe-os stack-update --add-service ${name}`).join("\n");
+  warn(
+    `
+${border}
+[stack-update] \u26A0\uFE0F  SKIPPING ${skipped.length} service(s) present in manifest ${options.targetVersion || "(target)"} but NOT in ${origin}:
+` + skipped.map((name) => `    - ${name}`).join("\n") + `
+${remedy}
+${border}
+`
+  );
+  return skipped;
 }
 function parseComposeDependsOn(composeRaw) {
   const deps = /* @__PURE__ */ new Map();
@@ -562,7 +611,8 @@ function readStackUpdateLock(lockFile) {
   }
 }
 function writeStackUpdateLock(lockFile, data) {
-  writeFileSync(lockFile, JSON.stringify(data, null, 2) + "\n");
+  writeFileSync(lockFile, JSON.stringify(data, null, 2) + "\n", { mode: 420 });
+  chmodSync(lockFile, 420);
 }
 function composeOverrideFileFor(composeFile) {
   return path.join(path.dirname(composeFile), "docker-compose.override.yml");
@@ -641,8 +691,37 @@ function parseStackManifest(raw, publicKey) {
   return parsed;
 }
 async function loadStackManifest(ref, fetchText = defaultFetchText, publicKey, authToken) {
-  if (/^https?:\/\//.test(ref)) return parseStackManifest(await fetchTextWithAuth(ref, fetchText, authToken), publicKey);
-  return parseStackManifest(readFileSync(ref, "utf8"), publicKey);
+  return parseStackManifest(await readStackManifestRaw(ref, fetchText, authToken), publicKey);
+}
+async function readStackManifestRaw(ref, fetchText = defaultFetchText, authToken) {
+  if (/^https?:\/\//.test(ref)) return fetchTextWithAuth(ref, fetchText, authToken);
+  return readFileSync(ref, "utf8");
+}
+async function loadStackManifestWithFallback(primaryRef, fallbackRef, fetchText = defaultFetchText, publicKey, authToken) {
+  let raw;
+  let source = primaryRef;
+  let usedFallback = false;
+  let fallbackReason;
+  try {
+    raw = await readStackManifestRaw(primaryRef, fetchText, authToken);
+  } catch (err) {
+    if (!fallbackRef || fallbackRef === primaryRef) throw err;
+    fallbackReason = err instanceof Error ? err.message : String(err);
+    raw = await readStackManifestRaw(fallbackRef, fetchText, authToken);
+    source = fallbackRef;
+    usedFallback = true;
+  }
+  const manifest = parseStackManifest(raw, publicKey);
+  return { manifest, source, usedFallback, fallbackReason };
+}
+function reportStackManifestSource(result) {
+  if (!result.usedFallback) {
+    console.log(`[stack-update] Manifest source: ${result.source} (live)`);
+    return;
+  }
+  console.warn(
+    `[stack-update] \u26A0\uFE0F  Live manifest unreachable \u2014 using OFFLINE PACKAGED manifest ${result.source}. It is frozen at the installed exe-os version and may not list newer stack releases. Reason: ${result.fallbackReason}`
+  );
 }
 async function fetchTextWithAuth(ref, fetchText, authToken) {
   if (!authToken || fetchText !== defaultFetchText) return fetchText(ref);
@@ -799,9 +878,30 @@ function createStackUpdatePlan(manifest, envRaw, targetVersion, serviceNames, se
 var ASKEXE_GHCR_IMAGE = /^(?:ghcr\.io\/askexe|update\.askexe\.com\/askexe)\/[a-z0-9._/-]+(?:(?::[^:@$/{]+)(?:@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$/i;
 var OFFICIAL_COMPOSE_IMAGE = /^(?:postgres|pgvector\/pgvector|clickhouse\/clickhouse-server|redis|nginx|postgrest\/postgrest|supabase\/gotrue|cloudflare\/cloudflared|otel\/opentelemetry-collector-contrib)(?:(?::[^:@$/{]+)(?:@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$/i;
 var IMAGE_DIGEST = /@sha256:[a-f0-9]{64}/;
+var TRUTHY = /^(1|true|yes)$/i;
+function isUnpinnedImageBreakGlassEnabled() {
+  return TRUTHY.test((process.env.EXE_STACK_ALLOW_UNPINNED_IMAGES ?? "").trim());
+}
 function isStrictDigestEnabled(option) {
   if (typeof option === "boolean") return option;
-  return /^(1|true|yes)$/i.test((process.env.EXE_STACK_STRICT_DIGEST ?? "").trim());
+  if (isUnpinnedImageBreakGlassEnabled()) return false;
+  return true;
+}
+function unpinnedImageBreakGlassBanner() {
+  const border = "=".repeat(72);
+  return [
+    "",
+    border,
+    "  !!!  DIGEST PINNING GATE DISABLED  !!!",
+    border,
+    "  EXE_STACK_ALLOW_UNPINNED_IMAGES=1 \u2014 unpinned images are warnings, not errors.",
+    "  A tag can be repointed at different bytes after you reviewed it. This deploy",
+    "  cannot tell you what it is actually running.",
+    "",
+    "  Break-glass only. Resolve the digest and unset this.",
+    border,
+    ""
+  ].join("\n");
 }
 function imageTag(image) {
   const noDigest = image.replace(/@sha256:[a-f0-9]{64}$/i, "");
@@ -941,6 +1041,13 @@ function collectProductionDeployGateIssues(plan, envRaw, composeRaw, options = {
         if (resolved) {
           const composeIssue = validateComposeImageLiteral(resolved, `compose image resolved value on line ${index + 1}`, strictDigest);
           if (composeIssue) issues.push(composeIssue);
+        } else {
+          const vars = [...image.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)/g)].map((m) => m[1]);
+          issues.push({
+            kind: "compose-image",
+            message: `compose image on line ${index + 1} resolves to nothing (${image}) \u2014 no image is pinned for this service. Set ${vars.join(" or ") || "the image variable"} to a digest-pinned ref before enabling it`,
+            severity: "warn"
+          });
         }
       } else {
         const composeIssue = validateComposeImageLiteral(image, `compose image on line ${index + 1}`, strictDigest);
@@ -1029,10 +1136,9 @@ function assertProductionDeployGate(plan, envRaw, composeRaw, options = {}) {
   const issues = collectProductionDeployGateIssues(plan, envRaw, composeRaw, { strictDigest: options.strictDigest });
   const warnings = issues.filter((i) => i.severity === "warn");
   const errors = issues.filter((i) => i.severity !== "warn");
+  if (isUnpinnedImageBreakGlassEnabled()) console.warn(unpinnedImageBreakGlassBanner());
   for (const w of warnings) {
-    console.warn(
-      `[stack-update] \u26A0\uFE0F  digest policy: [${w.kind}] ${w.message}. Set EXE_STACK_STRICT_DIGEST=1 (or --strict-digest) to make this a hard failure once the manifest is digest-pinned.`
-    );
+    console.warn(`[stack-update] \u26A0\uFE0F  digest policy: [${w.kind}] ${w.message}.`);
   }
   if (errors.length === 0) return;
   if (options.breakGlassReason?.trim()) {
@@ -1284,6 +1390,52 @@ ${details}
 The registry is serving code that does not match the signed manifest's recorded commit. Break-glass override requires --break-glass <reason>.`
   );
 }
+function collectImageVersionLabelIssues(plan, readLabel = defaultImageLabelReader) {
+  const issues = [];
+  const checked = /* @__PURE__ */ new Set();
+  for (const [serviceName, service] of Object.entries(plan.release.services)) {
+    const pinned = service.image;
+    if (!isFirstPartyImage(pinned)) continue;
+    if (checked.has(pinned)) continue;
+    checked.add(pinned);
+    const readRef = imagePullRef(pinned);
+    issues.push(
+      ...checkImageVersionLabels({
+        service: serviceName,
+        image: pinned,
+        versionLabel: readLabel(readRef, VERSION_LABEL),
+        revisionLabel: readLabel(readRef, REVISION_LABEL)
+      })
+    );
+  }
+  return issues;
+}
+function assertImageVersionLabels(plan, options = {}) {
+  const issues = collectImageVersionLabelIssues(plan, options.readLabel ?? defaultImageLabelReader);
+  if (issues.length === 0) return;
+  for (const issue of issues) {
+    console.warn(`[stack-update] \u26A0\uFE0F  version-label (G4b): ${issue.message}`);
+  }
+  const enforce = options.strictVersionLabel ?? process.env.EXE_STACK_ENFORCE_VERSION_LABEL === "1";
+  if (options.breakGlassReason?.trim()) {
+    console.warn(
+      `[stack-update] BREAK-GLASS: proceeding despite ${issues.length} image version-label issue(s). Reason: ${options.breakGlassReason.trim()}`
+    );
+    return;
+  }
+  if (!enforce) {
+    console.warn(
+      `[stack-update] \u26A0\uFE0F  image version-label check is WARN-first \u2014 ${issues.length} issue(s) logged but NOT blocking the deploy. Set EXE_STACK_ENFORCE_VERSION_LABEL=1 (or --strict-version-label) once every first-party image is stamped to fail closed.`
+    );
+    return;
+  }
+  const details = issues.map((i) => `  - ${i.message}`).join("\n");
+  throw new Error(
+    `Deploy-time image version-label check failed (G4b, fail-closed) \u2014 aborting before any container swap.
+${details}
+A first-party image whose version label does not match its tag cannot be traced to a release. Break-glass override requires --break-glass <reason>.`
+  );
+}
 var PROBE_TIMEOUT_MS = 1e4;
 function commandSucceeds(cmd, args = []) {
   const res = spawnSync2(cmd, args, {
@@ -1615,7 +1767,7 @@ function bootstrapStackHost(options) {
     createdFiles
   );
   ensureOverlayDir(path.join(path.dirname(options.composeFile), "overlay"), actions);
-  for (const helper of ["gateway-watchdog.sh", "add-routes.sh"]) {
+  for (const helper of ["gateway-watchdog.sh", "add-routes.sh", "wiki-schema-guard.sh"]) {
     const dest = path.join(path.dirname(options.composeFile), helper);
     copyTemplate(`deploy/compose/${helper}`, dest, createdFiles, { overwrite: true });
     try {
@@ -2049,7 +2201,15 @@ async function runStackUpdate(options) {
       }
     }
   }
-  const manifest = await loadStackManifest(options.manifestRef, options.fetchText, options.manifestPublicKey, options.manifestAuthToken);
+  const manifestLoad = await loadStackManifestWithFallback(
+    options.manifestRef,
+    options.manifestFallbackRef,
+    options.fetchText,
+    options.manifestPublicKey,
+    options.manifestAuthToken
+  );
+  reportStackManifestSource(manifestLoad);
+  const manifest = manifestLoad.manifest;
   if (options.addService || options.removeService) {
     const effectiveVersion = options.targetVersion ?? manifest.latest;
     const manifestRelease = manifest.stacks[effectiveVersion];
@@ -2060,7 +2220,11 @@ async function runStackUpdate(options) {
       if (!manifestRelease.services[options.addService]) {
         throw new Error(`Service "${options.addService}" not found in manifest ${effectiveVersion}. Available: ${Object.keys(manifestRelease.services).join(", ")}`);
       }
-      currentServices.add(options.addService);
+      currentServices.clear();
+      for (const name of computeServiceSelectionMerge(
+        currentSelection?.selectedServices ?? buildDefaultServiceSelection(manifestRelease),
+        [options.addService]
+      ).selectedServices) currentServices.add(name);
       console.log(`[stack-update] Added service: ${options.addService}`);
     }
     if (options.removeService) {
@@ -2072,11 +2236,13 @@ async function runStackUpdate(options) {
     saveServiceSelection(options.envFile, [...currentServices]);
     console.log(`[stack-update] Saved service selection: ${[...currentServices].join(", ")}`);
   }
-  if (options.services && options.services.length > 0) {
-    saveServiceSelection(options.envFile, options.services);
-    console.log(`[stack-update] Service selection overridden via --services: ${options.services.join(", ")}`);
+  const isRunScoped = Boolean(options.services && options.services.length > 0);
+  const serviceSelection = isRunScoped ? runScopedServiceSelection(options.services, now) : loadServiceSelection(options.envFile);
+  if (isRunScoped) {
+    console.log(
+      `[stack-update] Service scope for THIS RUN ONLY: ${options.services.join(", ")} (the managed set in ${serviceSelectionPath(options.envFile)} is unchanged)`
+    );
   }
-  const serviceSelection = loadServiceSelection(options.envFile);
   const envRaw = readFileSync(options.envFile, "utf8");
   const lockFile = options.lockFile ?? path.join(path.dirname(options.envFile), ".exe-stack-lock.json");
   const resumeLock = options.resume ? readStackUpdateLock(lockFile) : void 0;
@@ -2088,6 +2254,14 @@ async function runStackUpdate(options) {
   const composeRaw = readFileSync(options.composeFile, "utf8");
   const stagedCompose = readStagedComposeTemplate(options, composeRaw);
   const plan = createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, scopedServiceNames, serviceSelection, composeRaw);
+  const targetRelease = manifest.stacks[plan.targetVersion];
+  if (targetRelease) {
+    warnUnmanagedManifestServices(targetRelease, serviceSelection, {
+      targetVersion: plan.targetVersion,
+      envFile: options.envFile,
+      scope: isRunScoped ? "run" : "persisted"
+    });
+  }
   const fullTargetPlan = scopedServiceNames.length > 0 ? createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, void 0, serviceSelection, composeRaw) : plan;
   assertRolloutStageAllowed(plan, {
     explicitTarget: Boolean(effectiveTargetVersion),
@@ -2142,6 +2316,9 @@ ${lines.join("\n")}`
     console.log("[stack-update] Deploy-time image-provenance check (G4) started");
     assertImageProvenance(plan, options);
     console.log("[stack-update] \u2713 Deploy-time image-provenance check (G4) passed");
+    console.log("[stack-update] Deploy-time image version-label check (G4b) started");
+    assertImageVersionLabels(plan, options);
+    console.log("[stack-update] \u2713 Deploy-time image version-label check (G4b) passed");
   }
   await postDeployAudit(options, "started", plan.targetVersion, previousVersion);
   try {
@@ -2483,6 +2660,18 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       });
       if (psResult.status !== 0) continue;
       progress.logServiceStep(restartIndex, service, "Restarting");
+      if (service === "exe-wiki") {
+        const guard = spawnSync2(
+          "docker",
+          [...composeArgs, "run", "--rm", "--no-deps", "exe-wiki-schema-guard"],
+          { encoding: "utf8", stdio: ["pipe", "inherit", "inherit"], timeout: 12e4 }
+        );
+        if (guard.status !== null && guard.status !== 0) {
+          throw new Error(
+            "exe-wiki schema guard refused the restart (bug 2a8d3003): the wiki would start against a schema holding no account and no documents, and come up looking wiped. Its output above names the schema your data is actually in. Fix WIKI_DB_SCHEMA in the stack .env (or the compose override) and re-run. Do NOT restore from backup \u2014 the rows are still there."
+          );
+        }
+      }
       exec("docker", [...composeArgs, "up", "-d", "--remove-orphans", "--no-deps", service]);
       restartedAnyService = true;
       updateServiceStatus(lockFile, manifestServiceName, "restarted", now);
@@ -2973,7 +3162,10 @@ function defaultStackPaths() {
   const cwdCompose = path.resolve("docker-compose.yml");
   const cwdEnv = path.resolve(".env");
   const packagedManifest = path.join(resolvePackageRoot(), "deploy", "stack-manifests", "v0.9.json");
-  const manifestRef = process.env.EXE_STACK_MANIFEST || (existsSync(packagedManifest) ? packagedManifest : "https://update.askexe.com/v1/stack-manifest.json");
+  const manifestOverride = process.env.EXE_STACK_MANIFEST;
+  const liveManifest = process.env.EXE_STACK_MANIFEST_URL || "https://update.askexe.com/v1/stack-manifest.json";
+  const manifestRef = manifestOverride || liveManifest;
+  const manifestFallbackRef = manifestOverride || !existsSync(packagedManifest) ? void 0 : packagedManifest;
   const licenseKey = process.env.EXE_LICENSE_KEY || loadLicense() || process.env.EXE_STACK_UPDATE_TOKEN || void 0;
   const isRemoteManifest = /^https?:\/\//.test(manifestRef);
   const hasLicenseForRemote = !!licenseKey;
@@ -2982,6 +3174,7 @@ function defaultStackPaths() {
     composeFile: process.env.EXE_STACK_COMPOSE_FILE || (existsSync(cwdCompose) ? cwdCompose : "/opt/exe-stack/docker-compose.yml"),
     envFile: process.env.EXE_STACK_ENV_FILE || (existsSync(cwdEnv) ? cwdEnv : "/opt/exe-stack/.env"),
     manifestRef,
+    manifestFallbackRef,
     auditUrl: process.env.EXE_STACK_AUDIT_URL || (isRemoteManifest || hasLicenseForRemote ? `${apiBaseUrl}/v1/deploy-audits` : void 0),
     imageCredentialsUrl: process.env.EXE_STACK_IMAGE_CREDENTIALS_URL || (isRemoteManifest || hasLicenseForRemote ? `${apiBaseUrl}/v1/image-credentials` : void 0),
     // License key IS the auth token for update.askexe.com — no separate update token needed.
@@ -3166,12 +3359,27 @@ function printVolumeCleanupResult(result) {
     }
   }
 }
-function loadDefaultPublicKey() {
+var BUILTIN_STACK_MANIFEST_KEY_ID = "exe-stack-1";
+function builtinStackManifestPublicKeyPath() {
+  return path.join(resolvePackageRoot(), "deploy", "stack-manifests", "signing-key.pub");
+}
+function builtinStackManifestPublicKey() {
+  const keyPath = builtinStackManifestPublicKeyPath();
+  if (!existsSync(keyPath)) return void 0;
+  const pem = readFileSync(keyPath, "utf8").trim();
+  return pem ? `${pem}
+` : void 0;
+}
+function resolveStackManifestPublicKey() {
   if (process.env.EXE_STACK_PUBLIC_KEY) return process.env.EXE_STACK_PUBLIC_KEY;
-  if (process.env.EXE_STACK_PUBLIC_KEY_FILE && existsSync(process.env.EXE_STACK_PUBLIC_KEY_FILE)) {
+  if (process.env.EXE_STACK_PUBLIC_KEY_FILE) {
+    if (!existsSync(process.env.EXE_STACK_PUBLIC_KEY_FILE)) return void 0;
     return readFileSync(process.env.EXE_STACK_PUBLIC_KEY_FILE, "utf8");
   }
-  return void 0;
+  return builtinStackManifestPublicKey();
+}
+function loadDefaultPublicKey() {
+  return resolveStackManifestPublicKey();
 }
 
 export {
@@ -3179,6 +3387,11 @@ export {
   serviceSelectionPath,
   loadServiceSelection,
   saveServiceSelection,
+  mergeServiceSelection,
+  computeServiceSelectionMerge,
+  runScopedServiceSelection,
+  unmanagedManifestServices,
+  warnUnmanagedManifestServices,
   parseComposeDependsOn,
   parseComposeServiceNames,
   isUsableTunnelToken,
@@ -3199,6 +3412,8 @@ export {
   composeArgsForStack,
   parseStackManifest,
   loadStackManifest,
+  loadStackManifestWithFallback,
+  reportStackManifestSource,
   parseEnv,
   patchEnv,
   resolveServerImageOverride,
@@ -3206,7 +3421,9 @@ export {
   parseRequiredEnvRefs,
   detectMissingRequiredEnvVars,
   createStackUpdatePlan,
+  isUnpinnedImageBreakGlassEnabled,
   isStrictDigestEnabled,
+  unpinnedImageBreakGlassBanner,
   isThirdPartyImage,
   stripImageDigest,
   imagePullRef,
@@ -3219,6 +3436,8 @@ export {
   verifyManifestImagesAvailable,
   collectImageProvenanceIssues,
   assertImageProvenance,
+  collectImageVersionLabelIssues,
+  assertImageVersionLabels,
   applyGatewayOverlays,
   backupStackConfig,
   pairMonitorAgent,
@@ -3240,5 +3459,9 @@ export {
   detectDanglingVolumes,
   removeDanglingVolumes,
   printDanglingVolumes,
-  printVolumeCleanupResult
+  printVolumeCleanupResult,
+  BUILTIN_STACK_MANIFEST_KEY_ID,
+  builtinStackManifestPublicKeyPath,
+  builtinStackManifestPublicKey,
+  resolveStackManifestPublicKey
 };

package/dist/{chunk-4P2BFNSB.js → chunk-ZVTKWWLV.js}

@@ -1,10 +1,10 @@
 import {
   enqueueMemory
-} from "./chunk-MZYNW5OY.js";
+} from "./chunk-CDUB5Q6J.js";
 import {
   isClientConnected,
   sendDaemonRequest
-} from "./chunk-6EM6USV7.js";
+} from "./chunk-BNHAZ65R.js";
 
 // src/lib/memory-queue-client.ts
 async function writeMemoryViaDaemon(entry) {

package/dist/{chunk-RCOIKTHM.js → chunk-ZZXMB5F2.js}

@@ -1,7 +1,7 @@
 import {
   loadConfig,
   saveConfig
-} from "./chunk-BRIZ6OZ3.js";
+} from "./chunk-QMSEL5YS.js";
 
 // src/lib/orchestration-phase.ts
 var ORCHESTRATION_PHASES = [

package/dist/{cleanup-graph-garbage-6F22Y5SD.js → cleanup-graph-garbage-CAA625RJ.js}

@@ -1,32 +1,33 @@
 #!/usr/bin/env node
-import "./chunk-35FD67ZB.js";
+import "./chunk-M7EES2KM.js";
 import {
   isGarbageEntity
-} from "./chunk-RNSAVQEU.js";
+} from "./chunk-EWZYFG5Q.js";
 import "./chunk-GUMRIUI5.js";
 import "./chunk-Z6BZQHP5.js";
-import "./chunk-L4LPJMPV.js";
+import "./chunk-VGMACSEV.js";
+import "./chunk-QYECRPGD.js";
 import "./chunk-CHCA3ZM2.js";
-import "./chunk-FIPUVCKC.js";
+import "./chunk-7DMCAGSC.js";
 import {
   fastDbInit
-} from "./chunk-BN26LSME.js";
+} from "./chunk-LKYGSJ2E.js";
 import "./chunk-5MOYSU5A.js";
 import "./chunk-4QCFFW2H.js";
 import "./chunk-76CJBM36.js";
 import {
   getClient
-} from "./chunk-HLU52KTO.js";
+} from "./chunk-BRLS5OLZ.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-Q7J2SQJ6.js";
+import "./chunk-NO3M2AFM.js";
 import "./chunk-YYB5PMTK.js";
-import "./chunk-BRZR76TS.js";
+import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-BRIZ6OZ3.js";
+import "./chunk-QMSEL5YS.js";
 import "./chunk-HSGBZSCA.js";
 import {
   isMainModule

package/dist/cloud-sync-command-DBB7WRHL.js

@@ -0,0 +1,96 @@
+import "./chunk-MLKGABMK.js";
+
+// src/bin/cloud-sync-command.ts
+async function disposeCloudSyncCommandResources(disposeStore, disconnectClient) {
+  try {
+    await disposeStore();
+  } catch {
+  }
+  try {
+    disconnectClient();
+  } catch {
+  }
+}
+async function runCloudSyncCli() {
+  const { loadConfig } = await import("./lib/config.js");
+  const config = await loadConfig();
+  if (!config.cloud?.apiKey) {
+    console.error("Cloud sync is not configured. Run \x1B[36mexe-os cloud\x1B[0m to set up.");
+    process.exit(1);
+  }
+  const { disposeStore } = await import("./lib/store.js");
+  const { cloudSync } = await import("./lib/cloud-sync.js");
+  const { getMasterKey } = await import("./lib/keychain.js");
+  const { initSyncCrypto } = await import("./lib/crypto.js");
+  const { assertCloudSyncReachable, withTimeout } = await import("./bin/exe-cloud.js");
+  const { runCloudSyncShutdown } = await import("./cloud-sync-shutdown-2D3B73CJ.js");
+  const { disconnectClient } = await import("./lib/exe-daemon-client.js");
+  let shuttingDown = false;
+  const handleShutdown = (signal) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    void runCloudSyncShutdown(signal, { disposeStore, disconnectClient }).finally(() => process.exit(143));
+  };
+  process.on("SIGTERM", handleShutdown);
+  process.on("SIGINT", handleShutdown);
+  let exitCode = null;
+  try {
+    try {
+      await assertCloudSyncReachable(config.cloud.endpoint);
+    } catch (err) {
+      console.error(`Cloud sync aborted: ${err instanceof Error ? err.message : String(err)}`);
+      exitCode = 1;
+      return;
+    }
+    try {
+      const { isPostgresBackendEnabled } = await import("./db-backend-ODVJ3Q3D.js");
+      if (isPostgresBackendEnabled()) {
+        const { initPostgresOnlyDatabase } = await import("./lib/database.js");
+        await initPostgresOnlyDatabase();
+      } else {
+        const { initCloudSyncDatabase } = await import("./cloud-sync-db-init-V7IB23W5.js");
+        await initCloudSyncDatabase();
+      }
+      const masterKey = await getMasterKey();
+      if (masterKey) {
+        initSyncCrypto(masterKey);
+      } else {
+        console.error("No encryption key found. Run \x1B[36mexe-os setup\x1B[0m first.");
+        exitCode = 1;
+        return;
+      }
+      console.log("Syncing with Exe Cloud now... (Normally this runs automatically in the background.)");
+      const syncTimeoutMs = Number(process.env.EXE_CLOUD_SYNC_TIMEOUT_MS ?? 6e5);
+      const result = await withTimeout(cloudSync(config.cloud), syncTimeoutMs, "Cloud sync");
+      console.log("");
+      console.log(`  Active memories: ${result.totalMemories}  (\u2191 ${result.pushed} syncable rows pushed, \u2193 ${result.pulled} pulled)`);
+      console.log(`  Behaviors:      ${result.behaviors.pushed} total  (\u2193 ${result.behaviors.pulled} pulled)`);
+      console.log(`  Roster:         ${result.roster.employees} employees, ${result.roster.identities} identities`);
+      console.log(`  Tasks:          ${result.tasks.pushed} total  (\u2193 ${result.tasks.pulled} pulled)`);
+      console.log(`  Conversations:  ${result.conversations.pushed} total  (\u2193 ${result.conversations.pulled} pulled)`);
+      console.log(`  Documents:      ${result.documents.pushed} total  (\u2193 ${result.documents.pulled} pulled)`);
+      console.log(`  GraphRAG:       ${result.graphrag.pushed} entities`);
+      const elapsedDisplay = result.elapsedMs != null ? `${(result.elapsedMs / 1e3).toFixed(1)}s` : "n/a";
+      console.log(`
+\x1B[32mSync complete.\x1B[0m (${elapsedDisplay})`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (message.includes("Cloud sync is blocked because this device rotated")) {
+        console.error("\nCloud sync is blocked for safety.");
+        console.error("This device changed its memory encryption key, so Exe Cloud must be re-uploaded with the new key first.");
+        console.error("Run: exe-os cloud reupload");
+      } else {
+        console.error(`Sync failed: ${message}`);
+      }
+      exitCode = 1;
+    }
+  } finally {
+    await disposeCloudSyncCommandResources(disposeStore, disconnectClient);
+    process.off("SIGTERM", handleShutdown);
+    process.off("SIGINT", handleShutdown);
+    if (exitCode !== null) process.exit(exitCode);
+  }
+}
+export {
+  runCloudSyncCli
+};

package/dist/cloud-sync-db-init-V7IB23W5.js

@@ -0,0 +1,46 @@
+import {
+  fastDbInit,
+  isNoopFastDbClient
+} from "./chunk-LKYGSJ2E.js";
+import "./chunk-MLKGABMK.js";
+
+// src/lib/cloud-sync-db-init.ts
+var DEFAULT_CLOUD_SYNC_DAEMON_PROBE_TIMEOUT_MS = 1e4;
+var DEFAULT_CLOUD_SYNC_DAEMON_INIT_BUDGET_MS = 25e3;
+function positiveEnvMs(name, fallback) {
+  const raw = Number(process.env[name]);
+  return Number.isFinite(raw) && raw > 0 ? raw : fallback;
+}
+async function initCloudSyncDatabase(options = {}) {
+  const background = options.background ?? process.env.EXE_BACKGROUND_CLOUD_SYNC === "1";
+  const daemonProbeTimeoutMs = positiveEnvMs(
+    "EXE_CLOUD_SYNC_DAEMON_PROBE_TIMEOUT_MS",
+    DEFAULT_CLOUD_SYNC_DAEMON_PROBE_TIMEOUT_MS
+  );
+  const daemonFastPathBudgetMs = positiveEnvMs(
+    "EXE_CLOUD_SYNC_DAEMON_INIT_BUDGET_MS",
+    DEFAULT_CLOUD_SYNC_DAEMON_INIT_BUDGET_MS
+  );
+  let client;
+  try {
+    client = await fastDbInit({
+      caller: "cli",
+      socketOnly: background,
+      daemonProbeTimeoutMs,
+      daemonFastPathBudgetMs
+    });
+  } catch (err) {
+    throw new Error(
+      `[cloud-sync] Unable to initialize DB through the daemon socket within ${Math.round(daemonFastPathBudgetMs / 1e3)}s; refusing direct SQLite access from the background sync path to preserve the single-writer invariant. Retry on the next sync cycle. Cause: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (isNoopFastDbClient(client)) {
+    throw new Error(
+      "[cloud-sync] DB initialization returned a no-op fastDbInit client. Cloud sync refuses no-op DB access because reads would be empty and writes would be dropped; retry on the next sync cycle after the daemon socket responds."
+    );
+  }
+  return client;
+}
+export {
+  initCloudSyncDatabase
+};

package/dist/{cloud-sync-shutdown-FWERMZB5.js → cloud-sync-shutdown-2D3B73CJ.js}

@@ -1,16 +1,16 @@
 import {
   releaseDbLock
-} from "./chunk-HLU52KTO.js";
+} from "./chunk-BRLS5OLZ.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-Q7J2SQJ6.js";
+import "./chunk-NO3M2AFM.js";
 import "./chunk-YYB5PMTK.js";
-import "./chunk-BRZR76TS.js";
+import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-BRIZ6OZ3.js";
+import "./chunk-QMSEL5YS.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
@@ -40,6 +40,12 @@ async function runCloudSyncShutdown(reason, options = {}) {
     stderr.write(`cloud sync shutdown dispose failed: ${err instanceof Error ? err.message : String(err)}
 `);
   } finally {
+    try {
+      options.disconnectClient?.();
+    } catch (err) {
+      stderr.write(`cloud sync shutdown daemon disconnect failed: ${err instanceof Error ? err.message : String(err)}
+`);
+    }
     releaseDbLock();
   }
 }