@askexenow/exe-os 0.9.365 → 0.9.368

package/dist/chunk-TX3Q2GIL.js

@@ -0,0 +1,97 @@
+// src/lib/deploy-staleness.ts
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import os from "os";
+import path from "path";
+var SETTLED_STATUSES = /* @__PURE__ */ new Set(["completed", "skipped", "unchanged"]);
+var MAX_ERROR_CHARS = 240;
+function evaluateDeployStaleness(lock, now = () => /* @__PURE__ */ new Date()) {
+  if (!lock) return null;
+  const entries = Object.entries(lock.serviceStatus ?? {});
+  const failedServices = entries.filter(([, svc]) => !SETTLED_STATUSES.has(String(svc?.status ?? "").toLowerCase())).map(([name]) => name).sort();
+  const runningVersion = lock.stackVersion ?? "unknown";
+  const targetVersion = lock.targetVersion ?? lock.stackVersion ?? "unknown";
+  const versionStuck = Boolean(lock.targetVersion) && lock.targetVersion !== lock.stackVersion;
+  if (failedServices.length === 0 && !versionStuck) return null;
+  const sampleError = entries.map(([, svc]) => typeof svc?.error === "string" ? svc.error.trim() : "").find((err) => err.length > 0);
+  const scope = failedServices.length === entries.length && entries.length > 0 ? `ALL ${entries.length} service(s)` : `${failedServices.length} of ${entries.length} service(s)`;
+  return {
+    detectedAt: now().toISOString(),
+    runningVersion,
+    targetVersion,
+    attemptedAt: lock.updatedAt,
+    failedServices,
+    totalServices: entries.length,
+    sampleError: sampleError ? sampleError.slice(0, MAX_ERROR_CHARS) : void 0,
+    reason: `The last stack deploy attempt did not land: ${scope} failed and production is still running ${runningVersion} while the manifest target was ${targetVersion}. The stack keeps serving the OLD images, so nothing looks broken \u2014 which is exactly how this went unnoticed for five weeks (bug f1c36209).`,
+    recovery: {
+      inspect: "Read serviceStatus in .exe-stack-lock.json for the per-service error.",
+      retry: "Re-run the stack update once the cause is fixed; a successful deploy clears this alert.",
+      acknowledge: `Delete ${deployStalenessAlertPath()} to silence it deliberately.`
+    }
+  };
+}
+function deployStalenessAlertPath() {
+  const home = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
+  return path.join(home, "deploy-staleness.ALERT.json");
+}
+function writeDeployStalenessAlert(alert, alertPath = deployStalenessAlertPath()) {
+  try {
+    mkdirSync(path.dirname(alertPath), { recursive: true });
+    writeFileSync(alertPath, JSON.stringify(alert, null, 2));
+  } catch {
+  }
+  console.error(
+    `
+[stack-update] ========================================================================
+[stack-update] DEPLOY DID NOT LAND \u2014 production is STALE.
+[stack-update] Running ${alert.runningVersion}, target ${alert.targetVersion}. Failed: ${alert.failedServices.join(", ") || "(version never committed)"}
+[stack-update] This will be re-surfaced in the boot brief on EVERY boot until a deploy succeeds.
+[stack-update] Alert: ${alertPath}
+[stack-update] ========================================================================
+`
+  );
+}
+function clearDeployStalenessAlert(alertPath = deployStalenessAlertPath()) {
+  try {
+    if (existsSync(alertPath)) rmSync(alertPath, { force: true });
+  } catch {
+  }
+}
+function readDeployStalenessAlert(alertPath = deployStalenessAlertPath()) {
+  try {
+    if (!existsSync(alertPath)) return null;
+    return JSON.parse(readFileSync(alertPath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function buildDeployStalenessBanner(alert) {
+  if (!alert) return [];
+  const lines = [];
+  const age = alert.attemptedAt ? Date.parse(alert.attemptedAt) : NaN;
+  const days = Number.isFinite(age) ? Math.floor((Date.now() - age) / 864e5) : null;
+  lines.push("\u{1F534} PRODUCTION IS STALE \u2014 the last stack deploy did not land");
+  lines.push("");
+  lines.push(`  Running: ${alert.runningVersion}   Target: ${alert.targetVersion}`);
+  if (days !== null && days >= 1) lines.push(`  Last attempt: ${days} day(s) ago \u2014 the stack has been stale since.`);
+  if (alert.failedServices.length > 0) {
+    lines.push(`  Failed service(s): ${alert.failedServices.join(", ")}`);
+  } else {
+    lines.push("  The version stamp never committed \u2014 the attempt died mid-flight.");
+  }
+  if (alert.sampleError) lines.push(`  Error: ${alert.sampleError}`);
+  lines.push("");
+  lines.push("  \u{1F527} TO FIX:");
+  lines.push(`    1. ${alert.recovery.inspect}`);
+  lines.push(`    2. ${alert.recovery.retry}`);
+  lines.push(`    3. ${alert.recovery.acknowledge}`);
+  return lines;
+}
+
+export {
+  evaluateDeployStaleness,
+  writeDeployStalenessAlert,
+  clearDeployStalenessAlert,
+  readDeployStalenessAlert,
+  buildDeployStalenessBanner
+};

package/dist/{chunk-Q7BU5Q6I.js → chunk-UATT6BNO.js}

@@ -1,16 +1,16 @@
 import {
   extractMemoryGraph
-} from "./chunk-M7EES2KM.js";
+} from "./chunk-BEPO36MW.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-4QKKLK3C.js";
+} from "./chunk-ELY5WBZX.js";
 import {
   extractKeywords
 } from "./chunk-CHCA3ZM2.js";
 import {
   getActiveAgent
-} from "./chunk-ZNEBZCZR.js";
+} from "./chunk-NNXPIJRB.js";
 
 // src/mcp/tools/import-conversations.ts
 import { z } from "zod";

package/dist/{chunk-PPGPCWRC.js → chunk-UVM5ZXO2.js}

@@ -1,13 +1,13 @@
 import {
   buildSystemStateMemoryTypeExclusion
-} from "./chunk-4QKKLK3C.js";
+} from "./chunk-ELY5WBZX.js";
 import {
   sessionScopeFilter
-} from "./chunk-ORNCMRIX.js";
+} from "./chunk-Y4AYNLXU.js";
 import {
   getClient,
   getIdentity
-} from "./chunk-BRLS5OLZ.js";
+} from "./chunk-OBESOWFJ.js";
 import {
   getEmotionalBaseline
 } from "./chunk-NJFJWQNN.js";
@@ -646,7 +646,7 @@ var DreamingEngine = class {
     }
     let overdueProspective = [];
     try {
-      const { getOverdueProspective, completeProspective } = await import("./prospective-memory-QLHSAPSG.js");
+      const { getOverdueProspective, completeProspective } = await import("./prospective-memory-HI3WUY4U.js");
       const overdue = await getOverdueProspective(agentId);
       overdueProspective = overdue.map((o) => ({
         id: o.id,

package/dist/{chunk-BATQKSLI.js → chunk-V7E37GE3.js}

@@ -1,11 +1,11 @@
 import {
   ingest
-} from "./chunk-U373MEF5.js";
+} from "./chunk-VD3CVNGB.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-P47MPWNU.js";
+} from "./chunk-CXHRNESJ.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";

package/dist/{chunk-U373MEF5.js → chunk-VD3CVNGB.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-BRLS5OLZ.js";
+} from "./chunk-OBESOWFJ.js";
 
 // src/lib/pipeline-router.ts
 import crypto from "crypto";
@@ -140,8 +140,8 @@ Agent response: ${agentResponse}` : ""
 }
 async function sinkEntityExtraction(msg, agentResponse, agentName) {
   try {
-    const { extractFromConversation } = await import("./conversation-entity-extractor-JO56DB2E.js");
-    const { storeExtraction } = await import("./graph-rag-LSJLWGXV.js");
+    const { extractFromConversation } = await import("./conversation-entity-extractor-LFIDTD2O.js");
+    const { storeExtraction } = await import("./graph-rag-RLRQMY54.js");
     if ((msg.text?.length ?? 0) < 20) return false;
     if (msg.isHistorical) return false;
     const extraction = await extractFromConversation(msg, agentResponse, agentName);

package/dist/{chunk-ZSZPMUNX.js → chunk-VIW62NN5.js}

@@ -1,3 +1,8 @@
+import {
+  clearDeployStalenessAlert,
+  evaluateDeployStaleness,
+  writeDeployStalenessAlert
+} from "./chunk-TX3Q2GIL.js";
 import {
   REVISION_LABEL,
   VERSION_LABEL,
@@ -6,7 +11,7 @@ import {
 } from "./chunk-L25OAFOU.js";
 import {
   loadLicense
-} from "./chunk-ZDUO6QBH.js";
+} from "./chunk-6UZ3DEQI.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync as spawnSync2 } from "child_process";
@@ -411,6 +416,7 @@ async function rollbackStackUpdate(options) {
   const backupComposeFile = lockData?.backupComposeFile;
   const backupComposeOverrideFile = lockData?.backupComposeOverrideFile;
   const composeOverrideFile = composeOverrideFileFor(options.composeFile);
+  let composeRestored = false;
   if (!options.serviceName) {
     try {
       if (existsSync(options.composeFile)) {
@@ -420,6 +426,7 @@ async function rollbackStackUpdate(options) {
     }
     if (backupComposeFile && existsSync(backupComposeFile)) {
       copyFileSync(backupComposeFile, options.composeFile);
+      composeRestored = true;
       console.log(`[stack-update] Restored docker-compose.yml from ${backupComposeFile}`);
     } else {
       console.log("[stack-update] No backed-up docker-compose.yml in lock \u2014 rolling back image tags via .env on the current compose.");
@@ -439,19 +446,60 @@ async function rollbackStackUpdate(options) {
   }
   const scopedServiceNames = options.serviceName ? Object.entries(lockData?.services ?? {}).filter(([name, service]) => name === options.serviceName || (service.composeService ?? name) === options.serviceName).map(([name]) => name) : [];
   const rollbackEnvRaw = readFileSync(rollbackEnv, "utf8");
+  const rollbackEnvMap = parseEnv(rollbackEnvRaw);
+  const preUpdateImageDefaults = lockData?.preUpdateImageDefaults ?? {};
   if (scopedServiceNames.length > 0 && lockData?.services) {
-    const rollbackEnvMap = parseEnv(rollbackEnvRaw);
     const scopedEnvKeys = scopedServiceNames.map((serviceName) => lockData.services[serviceName].env).filter((key) => Boolean(key));
     const mutatedEnvKeys = lockData.mutatedEnvKeys ?? [];
     const restoreEnvKeys = [.../* @__PURE__ */ new Set([...scopedEnvKeys, ...mutatedEnvKeys])];
-    const scopedUpdates = Object.fromEntries(
-      restoreEnvKeys.map((key) => [key, rollbackEnvMap.get(key) ?? ""])
-    );
+    const scopedUpdates = {};
+    const scopedRemovals = [];
+    const scopedRepins = [];
+    for (const key of restoreEnvKeys) {
+      const previous = rollbackEnvMap.get(key);
+      if (previous !== void 0) {
+        scopedUpdates[key] = previous;
+        continue;
+      }
+      const previousDefault = preUpdateImageDefaults[key];
+      if (previousDefault !== void 0) {
+        scopedUpdates[key] = previousDefault;
+        scopedRepins.push(key);
+        continue;
+      }
+      scopedRemovals.push(key);
+    }
     console.log(`[stack-update] Restoring env keys for service ${scopedServiceNames.join(", ")} from ${rollbackEnv}: ${restoreEnvKeys.join(", ")}`);
-    writeSecretFile(options.envFile, patchEnv(readFileSync(options.envFile, "utf8"), scopedUpdates));
+    if (scopedRepins.length > 0) {
+      console.log(`[stack-update] Re-pinning previously-unset image var(s) to their pre-update compose default so the service does not stay on the new image: ${scopedRepins.join(", ")}`);
+    }
+    if (scopedRemovals.length > 0) {
+      console.log(`[stack-update] Removing env key(s) that did not exist before the update: ${scopedRemovals.join(", ")}`);
+    }
+    const patched = patchEnv(readFileSync(options.envFile, "utf8"), scopedUpdates);
+    writeSecretFile(options.envFile, removeEnvKeys(patched, scopedRemovals));
   } else {
     console.log(`[stack-update] Restoring env from ${rollbackEnv}`);
     writeSecretFile(options.envFile, rollbackEnvRaw);
+    if (!composeRestored) {
+      const touched = /* @__PURE__ */ new Set([
+        ...lockData?.mutatedEnvKeys ?? [],
+        ...Object.values(lockData?.services ?? {}).map((svc) => svc.env).filter((k) => Boolean(k))
+      ]);
+      const repins = {};
+      for (const [key, image] of Object.entries(preUpdateImageDefaults)) {
+        if (touched.size > 0 && !touched.has(key)) continue;
+        if (rollbackEnvMap.has(key)) continue;
+        repins[key] = image;
+      }
+      const repinKeys = Object.keys(repins);
+      if (repinKeys.length > 0) {
+        console.log(
+          `[stack-update] No pre-update compose to restore \u2014 re-pinning previously-unset image var(s) to their pre-update default so the service is not left on the NEW image: ${repinKeys.join(", ")}`
+        );
+        writeSecretFile(options.envFile, patchEnv(readFileSync(options.envFile, "utf8"), repins));
+      }
+    }
   }
   const composeArgs = composeArgsForStack(options.composeFile, options.envFile);
   if (lockData?.services) {
@@ -754,6 +802,59 @@ function patchEnv(raw, updates) {
   }
   return patched.join("\n").replace(/\n*$/, "\n");
 }
+function removeEnvKeys(raw, keys) {
+  if (keys.length === 0) return raw;
+  const drop = new Set(keys);
+  const kept = raw.replace(/\n$/, "").split(/\r?\n/).filter((line) => {
+    const idx = line.indexOf("=");
+    if (idx <= 0 || line.trim().startsWith("#")) return true;
+    return !drop.has(line.slice(0, idx).trim());
+  });
+  return kept.join("\n").replace(/\n*$/, "\n");
+}
+function expandComposeExpression(expr, env) {
+  let out = "";
+  for (let i = 0; i < expr.length; ) {
+    if (expr[i] === "$" && expr[i + 1] === "{") {
+      let depth = 1;
+      let j = i + 2;
+      for (; j < expr.length && depth > 0; j++) {
+        if (expr[j] === "{" && expr[j - 1] === "$") depth++;
+        else if (expr[j] === "}") depth--;
+      }
+      const body = expr.slice(i + 2, j - 1);
+      const sep = /^([A-Za-z_][A-Za-z0-9_]*)(:?-)?([\s\S]*)$/.exec(body);
+      if (sep) {
+        const [, name, operator, fallback] = sep;
+        const value = env.get(name);
+        const unset = operator === ":-" ? value === void 0 || value === "" : value === void 0;
+        out += unset && operator ? expandComposeExpression(fallback, env) : value ?? "";
+      }
+      i = j;
+      continue;
+    }
+    out += expr[i];
+    i++;
+  }
+  return out;
+}
+function snapshotComposeImageDefaults(composeRaw, env) {
+  const defaults = {};
+  for (const line of composeRaw.split(/\r?\n/)) {
+    const image = /^\s*image:\s*(\S.*?)\s*$/.exec(line);
+    if (!image) continue;
+    let expr = image[1];
+    for (; ; ) {
+      const head = /^\$\{([A-Za-z_][A-Za-z0-9_]*):?-([\s\S]*)\}$/.exec(expr);
+      if (!head) break;
+      const [, name, fallback] = head;
+      const resolved = expandComposeExpression(fallback, env);
+      if (resolved) defaults[name] = resolved;
+      expr = fallback;
+    }
+  }
+  return defaults;
+}
 var EXE_OS_ALLOW_IMAGE_OVERRIDE_DOC = "EXE_OS_ALLOW_IMAGE_OVERRIDE=1 (documented break-glass; manifest pin is authoritative for production)";
 function isBreakGlassImageOverrideEnabled(processEnv) {
   const v = (processEnv.EXE_OS_ALLOW_IMAGE_OVERRIDE ?? "").trim().toLowerCase();
@@ -1596,6 +1697,7 @@ function backupStackConfig(stackDir, composeFile, envRaw, now = () => /* @__PURE
   const backupEnvFile = path.join(updateBackupDir, "env.bak");
   writeSecretFile(backupEnvFile, envRaw);
   let backupComposeFile;
+  let preUpdateImageDefaults;
   try {
     if (existsSync(composeFile)) {
       backupComposeFile = path.join(updateBackupDir, "docker-compose.yml.bak");
@@ -1604,6 +1706,13 @@ function backupStackConfig(stackDir, composeFile, envRaw, now = () => /* @__PURE
   } catch {
     backupComposeFile = void 0;
   }
+  try {
+    if (existsSync(composeFile)) {
+      preUpdateImageDefaults = snapshotComposeImageDefaults(readFileSync(composeFile, "utf8"), parseEnv(envRaw));
+    }
+  } catch {
+    preUpdateImageDefaults = void 0;
+  }
   const composeOverrideFile = composeOverrideFileFor(composeFile);
   const hadComposeOverrideFile = existsSync(composeOverrideFile);
   let backupComposeOverrideFile;
@@ -1649,7 +1758,7 @@ function backupStackConfig(stackDir, composeFile, envRaw, now = () => /* @__PURE
   } catch {
   }
   console.log(`[stack-update] Config backed up to ${updateBackupDir}`);
-  return { updateBackupDir, backupEnvFile, backupComposeFile, backupComposeOverrideFile, hadComposeOverrideFile };
+  return { updateBackupDir, backupEnvFile, backupComposeFile, backupComposeOverrideFile, hadComposeOverrideFile, preUpdateImageDefaults };
 }
 function installDockerUbuntu(exec) {
   if (process.platform !== "linux") throw new Error("Docker auto-install is only supported on Linux. Install Docker manually, then retry.");
@@ -2420,6 +2529,9 @@ ${lines.join("\n")}`
     backupComposeOverrideFile: resumeLock?.backupComposeOverrideFile ?? backupComposeOverrideFile,
     hadComposeOverrideFile: resumeLock?.hadComposeOverrideFile ?? hadComposeOverrideFile,
     mutatedEnvKeys: [.../* @__PURE__ */ new Set([...resumeLock?.mutatedEnvKeys ?? [], ...mutatedEnvKeys])],
+    // Bug 879aad12: preserve the FIRST snapshot across --resume; the compose on
+    // disk may already be the new template by the time a resume runs.
+    preUpdateImageDefaults: resumeLock?.preUpdateImageDefaults ?? configBackup.preUpdateImageDefaults,
     services: { ...fullTargetPlan.release.services, ...resumeLock?.services ?? {}, ...plan.release.services },
     serviceStatus: initialServiceStatus
   });
@@ -2827,8 +2939,10 @@ Fix these before the stack is safe to operate.`);
       backupComposeOverrideFile: finalLock.backupComposeOverrideFile ?? backupComposeOverrideFile,
       hadComposeOverrideFile: finalLock.hadComposeOverrideFile ?? hadComposeOverrideFile,
       mutatedEnvKeys: finalLock.mutatedEnvKeys ?? mutatedEnvKeys,
+      preUpdateImageDefaults: finalLock.preUpdateImageDefaults ?? configBackup.preUpdateImageDefaults,
       services: { ...fullTargetPlan.release.services, ...finalLock.services ?? {}, ...plan.release.services }
     });
+    clearDeployStalenessAlert();
     await postDeployAudit(options, "success", plan.targetVersion, previousVersion, void 0, { changes: plan.changes.length });
     return { status: "updated", targetVersion: plan.targetVersion, changes: plan.changes, backupEnvFile, lockFile, serviceStatus: readStackUpdateLock(lockFile)?.serviceStatus };
   } catch (err) {
@@ -2868,6 +2982,8 @@ Fix these before the stack is safe to operate.`);
         }
       }
     }
+    const staleness = evaluateDeployStaleness(readStackUpdateLock(lockFile), now);
+    if (staleness) writeDeployStalenessAlert(staleness);
     await postDeployAudit(options, "failed", plan.targetVersion, previousVersion, reason, { rollbackAttempted: true });
     throw new Error(`Stack update failed and rollback was attempted: ${reason}`);
   } finally {
@@ -3416,6 +3532,9 @@ export {
   reportStackManifestSource,
   parseEnv,
   patchEnv,
+  removeEnvKeys,
+  expandComposeExpression,
+  snapshotComposeImageDefaults,
   resolveServerImageOverride,
   applyServerImageOverrideResolution,
   parseRequiredEnvRefs,

package/dist/{chunk-EPNWEOOE.js → chunk-VTOO5UB3.js}

@@ -1,23 +1,23 @@
 import {
   MultiAgentOrchestrator
-} from "./chunk-JNVQGLPX.js";
+} from "./chunk-QT6CNCXO.js";
 import {
   createTokenBudgetMiddleware
-} from "./chunk-J6I7X272.js";
+} from "./chunk-2UGU3V63.js";
 import {
   createQuietRenderer,
   createTerminalRenderer,
   renderAgentEvents
 } from "./chunk-YZFZDJWZ.js";
-import {
-  checkDangerousPatterns,
-  hasCriticalPattern
-} from "./chunk-CMCYL2JC.js";
 import {
   checkPathSafety,
   checkReadPathSafety,
   containsPathTraversal
 } from "./chunk-NGVOA6ZQ.js";
+import {
+  checkDangerousPatterns,
+  hasCriticalPattern
+} from "./chunk-CMCYL2JC.js";
 import {
   ContextManager,
   agentLoop,
@@ -30,7 +30,7 @@ import {
   recordDenial,
   recordSuccess,
   shouldFallbackToAsk
-} from "./chunk-KSVLBATT.js";
+} from "./chunk-E5QQZDQN.js";
 import {
   ToolRegistry,
   partitionTools,
@@ -209,7 +209,7 @@ function createExeOSHooks(config) {
         );
       }
       try {
-        const { listBehaviors } = await import("./behaviors-R2IE3PEN.js");
+        const { listBehaviors } = await import("./behaviors-UCMAREU3.js");
         const behaviors = await listBehaviors(config.agentId, config.projectName, 12);
         if (behaviors.length > 0) {
           process.stderr.write(
@@ -330,7 +330,7 @@ function createExeOSHooks(config) {
     async onSubagentStop(_reason) {
       try {
         const { getClient } = await import("./lib/database.js");
-        const { sessionScopeFilter } = await import("./task-scope-GDLFE26E.js");
+        const { sessionScopeFilter } = await import("./task-scope-PQ67YRWP.js");
         const client = getClient();
         const ehScope = sessionScopeFilter();
         const tasks = await client.execute({
@@ -422,7 +422,7 @@ function createExeOSHooks(config) {
         try {
           const { writeMemory, flushBatch } = await import("./lib/store.js");
           const { getClient } = await import("./lib/database.js");
-          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-GDLFE26E.js");
+          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-PQ67YRWP.js");
           const client = getClient();
           const cpScope = cpScopeFilter();
           const tasks = await client.execute({