@askexenow/exe-os 0.9.365 → 0.9.368

package/dist/bin/exe-start-codex.js

@@ -1,18 +1,19 @@
 #!/usr/bin/env node
 import {
   exportBehaviorsForAgent
-} from "../chunk-BEHLIRRJ.js";
-import "../chunk-O2MEBF23.js";
+} from "../chunk-C5FOA5GO.js";
+import "../chunk-XOTDAKJL.js";
+import "../chunk-MCXYNYZI.js";
 import "../chunk-VMJ2UH4S.js";
 import "../chunk-QGGH7LOU.js";
 import {
   disposeStore,
   initStore
-} from "../chunk-4QKKLK3C.js";
-import "../chunk-QYECRPGD.js";
+} from "../chunk-ELY5WBZX.js";
+import "../chunk-FDA45THL.js";
 import "../chunk-CHCA3ZM2.js";
 import "../chunk-OTVEIJUQ.js";
-import "../chunk-7DMCAGSC.js";
+import "../chunk-5U4UJGTW.js";
 import "../chunk-5MOYSU5A.js";
 import "../chunk-4QCFFW2H.js";
 import "../chunk-76CJBM36.js";
@@ -20,6 +21,7 @@ import {
   clearTerminalLauncherFailure,
   writeTerminalLauncherFailure
 } from "../chunk-AJIXH5JF.js";
+import "../chunk-PVWM2WMM.js";
 import {
   CODEX_CHATGPT_UNSUPPORTED_MODELS,
   assertCodexModelForAuth,
@@ -35,11 +37,11 @@ import "../chunk-MP2AFCGL.js";
 import {
   baseAgentName,
   loadEmployeesSync
-} from "../chunk-BRLS5OLZ.js";
+} from "../chunk-OBESOWFJ.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-NO3M2AFM.js";
+import "../chunk-JDPV7W2L.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";
@@ -106,6 +108,14 @@ or a JSON-RPC error mentioning "session expired" or "not found", the daemon was
 restarted. Your MCP client should auto-reinitialize. If it doesn't, call mcp_ping()
 which forces a fresh connection. If mcp_ping also fails, tell the user: "MCP daemon
 was restarted. Run /mcp to reconnect."
+
+SESSION CLOSEOUT \u2014 MANDATORY, Codex has no SessionEnd hook: Unlike Claude Code,
+Codex does not fire a session-end event, so nothing consolidates your session
+automatically \u2014 no dreaming cycle, no pattern promotion, no "where I left off"
+summary for your next boot. Before you finish a session, YOU MUST call
+config(action="closeout") yourself to consolidate it. If you are running low on
+context or are about to stop for any other reason, call config(action="closeout")
+then, before you stop \u2014 do not wait until the very last message.
 `;
 var CODEX_AUTONOMOUS_BOOT_PROMPT = `You are an AI employee with exe-os consolidated MCP tools: task, memory, behavior, message, identity, decision, session, and mcp_ping. DO NOT ask for confirmation \u2014 work autonomously. If task/memory are not visible in the initial tool list, first call tool_search with query "exe-os task memory MCP consolidated" because Codex may defer MCP tools behind discovery; only tell the user to run 'exe-os codex' if discovery fails or returns no exe-os task/memory tools. Immediately: 1) Call task with action="list" to see your assigned tasks. 2) Call task with action="get" on the highest priority open task. 3) Call memory with action="recall" before starting work. 4) Start working on the task. 5) When done, call task with action="update", status="done", and a result summary. 6) Call memory with action="store" to persist important findings. 7) Check task with action="list" again for the next task. 8) If NO open tasks remain, wait 30 seconds then check task(action="list") ONE more time \u2014 a new task may have been dispatched while you were completing the previous one. If still empty after the recheck, say 'All tasks complete. Standing by.' and STOP.`;
 function buildCodexBootPrompt(_detectedProject) {
@@ -227,8 +237,37 @@ function writePromptFile(agent, identity, behaviorsPath, globalProcedures) {
   writeFileSync(outPath, prompt, "utf-8");
   return outPath;
 }
-var CODEX_PINNED_SANDBOX_ARGS = ["--sandbox", "workspace-write"];
-var CODEX_PINNED_APPROVAL_ARGS = ["--approval-policy", "never"];
+var CODEX_PINNED_SANDBOX_MODE = "workspace-write";
+var CODEX_PINNED_APPROVAL_POLICY = "never";
+var CODEX_APPROVAL_FLAG_PREFERENCE = ["--ask-for-approval", "--approval-policy"];
+var CODEX_SANDBOX_FLAG_PREFERENCE = ["--sandbox"];
+function parseCodexSupportedFlags(helpText) {
+  const flags = /* @__PURE__ */ new Set();
+  for (const match of helpText.matchAll(/(?<![\w-])--[a-z0-9][a-z0-9-]*/g)) {
+    flags.add(match[0]);
+  }
+  return flags;
+}
+function buildCodexConstraintArgs(supported, preference, configKey, value) {
+  const flag = preference.find((f) => supported.has(f));
+  return flag ? [flag, value] : ["-c", `${configKey}=${JSON.stringify(value)}`];
+}
+var cachedCodexExecFlags = null;
+function detectCodexExecFlags(binary) {
+  if (cachedCodexExecFlags) return cachedCodexExecFlags;
+  let help = "";
+  try {
+    const probe = spawnSync(binary, ["exec", "--help"], {
+      encoding: "utf-8",
+      timeout: 1e4
+    });
+    help = `${probe.stdout ?? ""}
+${probe.stderr ?? ""}`;
+  } catch {
+  }
+  cachedCodexExecFlags = parseCodexSupportedFlags(help);
+  return cachedCodexExecFlags;
+}
 function sanitizeCodexPassthroughArgs(passthrough) {
   const sanitized = [];
   for (let i = 0; i < passthrough.length; i++) {
@@ -236,26 +275,44 @@ function sanitizeCodexPassthroughArgs(passthrough) {
     if (arg === "--dangerously-bypass-approvals-and-sandbox" || arg === "--full-auto") {
       continue;
     }
-    if (arg === "--sandbox" || arg === "-s" || arg === "--approval-policy") {
+    if (arg === "--sandbox" || arg === "-s" || arg === "--approval-policy" || arg === "--ask-for-approval" || arg === "-a") {
       i++;
       continue;
     }
-    if (arg.startsWith("--sandbox=") || arg.startsWith("-s=") || arg.startsWith("--approval-policy=")) {
+    if (arg.startsWith("--sandbox=") || arg.startsWith("-s=") || arg.startsWith("--approval-policy=") || arg.startsWith("--ask-for-approval=") || arg.startsWith("-a=")) {
       continue;
     }
+    if (arg === "-c" || arg === "--config") {
+      const next = passthrough[i + 1];
+      if (next && /^(sandbox_mode|approval_policy)\s*=/.test(next)) {
+        i++;
+        continue;
+      }
+    }
     sanitized.push(arg);
   }
   return sanitized;
 }
 function buildCodexLaunchArgs(input) {
+  const supported = input.supportedExecFlags ?? detectCodexExecFlags(CODEX.binary);
   const args = [
     "exec",
     "-m",
     input.effectiveModel,
     "-c",
     `model=${JSON.stringify(input.effectiveModel)}`,
-    ...CODEX_PINNED_SANDBOX_ARGS,
-    ...CODEX_PINNED_APPROVAL_ARGS,
+    ...buildCodexConstraintArgs(
+      supported,
+      CODEX_SANDBOX_FLAG_PREFERENCE,
+      "sandbox_mode",
+      CODEX_PINNED_SANDBOX_MODE
+    ),
+    ...buildCodexConstraintArgs(
+      supported,
+      CODEX_APPROVAL_FLAG_PREFERENCE,
+      "approval_policy",
+      CODEX_PINNED_APPROVAL_POLICY
+    ),
     "--color",
     "never",
     ...sanitizeCodexPassthroughArgs(input.passthrough)
@@ -517,7 +574,7 @@ async function main() {
     await initStore();
     behaviorsPath = await exportBehaviorsForAgent(baseAgent, "");
     try {
-      const { loadGlobalProcedures, getGlobalProceduresBlock } = await import("../global-procedures-ZOFTOXIR.js");
+      const { loadGlobalProcedures, getGlobalProceduresBlock } = await import("../global-procedures-RXIKBVLZ.js");
       await loadGlobalProcedures();
       const block = getGlobalProceduresBlock();
       if (block) globalProcedures = block;
@@ -567,8 +624,8 @@ async function main() {
   let codexProfileName = null;
   if (exeSessionName) {
     try {
-      const { readOrCreateDaemonToken } = await import("../mcp-http-config-YKJN52HG.js");
-      const { mcpHttpUrl } = await import("../mcp-http-config-YKJN52HG.js");
+      const { readOrCreateDaemonToken } = await import("../mcp-http-config-XUNRIGQH.js");
+      const { mcpHttpUrl } = await import("../mcp-http-config-XUNRIGQH.js");
       const token = readOrCreateDaemonToken();
       const profileContent = buildCodexMcpProfileContent({
         agentId: codexIdentity.memoryAgent,
@@ -598,12 +655,12 @@ async function main() {
     }
   }
   try {
-    const { writeActiveAgent } = await import("../active-agent-C6DPH43L.js");
+    const { writeActiveAgent } = await import("../active-agent-RDTJGZHP.js");
     writeActiveAgent(memoryAgent, empRole);
   } catch {
   }
   try {
-    const { verifyCodexHooks, runCodexInstaller } = await import("../installer-KCEM4RCG.js");
+    const { verifyCodexHooks, runCodexInstaller } = await import("../installer-TOPA7673.js");
     if (!verifyCodexHooks()) {
       process.stderr.write("[exe-start-codex] hooks missing \u2014 registering now\n");
       await runCodexInstaller();
@@ -621,7 +678,7 @@ async function main() {
 `);
   if (WORKTREE_ROLES.has(empRole)) {
     try {
-      const { ensureWorktree, parseInstanceLabel } = await import("../worktree-H3YFJ3NU.js");
+      const { ensureWorktree, parseInstanceLabel } = await import("../worktree-3FO6EQ4G.js");
       const { base, instance } = parseInstanceLabel(worktreeName);
       worktreePath = ensureWorktree(process.cwd(), base, instance);
       if (worktreePath) {
@@ -699,12 +756,17 @@ if (!process.env.VITEST) {
 export {
   CODEX_AUTONOMOUS_BOOT_PROMPT,
   CODEX_BOOT_INSTRUCTIONS,
+  CODEX_PINNED_APPROVAL_POLICY,
+  CODEX_PINNED_SANDBOX_MODE,
   buildCodexBootPrompt,
+  buildCodexConstraintArgs,
   buildCodexLaunchArgs,
   buildCodexMcpProfileContent,
+  detectCodexExecFlags,
   detectCodexModelNotSupported,
   launchCodex,
   loadIdentity,
+  parseCodexSupportedFlags,
   readCodexUserConfig,
   resolveCodexMcpIdentity,
   resolveEffectiveCodexModel,

package/dist/bin/exe-start-opencode.js

@@ -1,21 +1,23 @@
 #!/usr/bin/env node
 import {
   exportBehaviorsForAgent
-} from "../chunk-BEHLIRRJ.js";
-import "../chunk-O2MEBF23.js";
+} from "../chunk-C5FOA5GO.js";
+import "../chunk-XOTDAKJL.js";
+import "../chunk-MCXYNYZI.js";
 import "../chunk-VMJ2UH4S.js";
 import "../chunk-QGGH7LOU.js";
 import {
   disposeStore,
   initStore
-} from "../chunk-4QKKLK3C.js";
-import "../chunk-QYECRPGD.js";
+} from "../chunk-ELY5WBZX.js";
+import "../chunk-FDA45THL.js";
 import "../chunk-CHCA3ZM2.js";
 import "../chunk-OTVEIJUQ.js";
-import "../chunk-7DMCAGSC.js";
+import "../chunk-5U4UJGTW.js";
 import "../chunk-5MOYSU5A.js";
 import "../chunk-4QCFFW2H.js";
 import "../chunk-76CJBM36.js";
+import "../chunk-PVWM2WMM.js";
 import "../chunk-BNHAZ65R.js";
 import "../chunk-RIECV7SR.js";
 import "../chunk-LNOS24GV.js";
@@ -24,11 +26,11 @@ import "../chunk-MP2AFCGL.js";
 import {
   baseAgentName,
   loadEmployeesSync
-} from "../chunk-BRLS5OLZ.js";
+} from "../chunk-OBESOWFJ.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-NO3M2AFM.js";
+import "../chunk-JDPV7W2L.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";
@@ -196,12 +198,12 @@ async function main() {
   })();
   process.env.AGENT_ROLE = empRole;
   try {
-    const { writeActiveAgent } = await import("../active-agent-C6DPH43L.js");
+    const { writeActiveAgent } = await import("../active-agent-RDTJGZHP.js");
     writeActiveAgent(memoryAgent, empRole);
   } catch {
   }
   try {
-    const { verifyOpenCodeHooks, runOpenCodeInstaller } = await import("../installer-EA7T3PBD.js");
+    const { verifyOpenCodeHooks, runOpenCodeInstaller } = await import("../installer-EXR25DDG.js");
     if (!verifyOpenCodeHooks()) {
       process.stderr.write("[exe-start-opencode] hooks missing \u2014 registering now\n");
       await runOpenCodeInstaller();

package/dist/bin/exe-status.js

@@ -1,28 +1,29 @@
 #!/usr/bin/env node
 import {
   status
-} from "../chunk-RZIKSE6N.js";
-import "../chunk-MBBFL2SP.js";
-import "../chunk-LKYGSJ2E.js";
-import "../chunk-ORNCMRIX.js";
-import "../chunk-ESTR7QUP.js";
-import "../chunk-FXPAUDCZ.js";
-import "../chunk-QFIVK3G5.js";
+} from "../chunk-GP3J3AOT.js";
+import "../chunk-GIO4VU4J.js";
+import "../chunk-I76LRCNA.js";
+import "../chunk-Y4AYNLXU.js";
+import "../chunk-BTSWFMEH.js";
+import "../chunk-P3PAD6AA.js";
+import "../chunk-KGPWS4KE.js";
+import "../chunk-KYVIV54Y.js";
 import "../chunk-WT4RI36X.js";
-import "../chunk-C3UAQ3JG.js";
 import "../chunk-KI5PFRG6.js";
+import "../chunk-QAEWWYHL.js";
 import "../chunk-EIKATSE4.js";
 import "../chunk-E23LNUWJ.js";
-import "../chunk-QAEWWYHL.js";
-import "../chunk-EHHMNKOA.js";
+import "../chunk-CSBD7QLZ.js";
 import "../chunk-GBNB4EWD.js";
 import "../chunk-UXLO7VHX.js";
 import "../chunk-DSOQUQTV.js";
-import "../chunk-WR75WUEP.js";
+import "../chunk-BFL3UB77.js";
 import "../chunk-AJIXH5JF.js";
+import "../chunk-PVWM2WMM.js";
 import "../chunk-XTWHNLGD.js";
 import "../chunk-AM7S2TY6.js";
-import "../chunk-2FYIMTQE.js";
+import "../chunk-PGF5I7EV.js";
 import "../chunk-CVYC6DUW.js";
 import "../chunk-ZVTKWWLV.js";
 import "../chunk-CDUB5Q6J.js";
@@ -34,20 +35,20 @@ import "../chunk-W2IRQJ6R.js";
 import "../chunk-HYZV25LY.js";
 import "../chunk-GJV3WDWM.js";
 import "../chunk-MP2AFCGL.js";
-import "../chunk-BRLS5OLZ.js";
+import "../chunk-OBESOWFJ.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-NO3M2AFM.js";
+import "../chunk-JDPV7W2L.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";
 import "../chunk-JY5GAZYC.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-WNBZJSQT.js";
-import "../chunk-ZDUO6QBH.js";
+import "../chunk-6UZ3DEQI.js";
 import "../chunk-A7XLR3K7.js";
-import "../chunk-VS4LPG66.js";
+import "../chunk-MQ5RUHNZ.js";
 import "../chunk-QILQ5FCG.js";
 import "../chunk-ARX6TAGN.js";
 import "../chunk-QMSEL5YS.js";

package/dist/bin/exe-support.js

@@ -4,12 +4,12 @@ import {
   main,
   runHealth,
   runTest
-} from "../chunk-T6S45OLV.js";
+} from "../chunk-4GVJIMMK.js";
 import "../chunk-MMRUBN3I.js";
 import "../chunk-2XZ6X3PJ.js";
-import "../chunk-ZDUO6QBH.js";
+import "../chunk-6UZ3DEQI.js";
 import "../chunk-A7XLR3K7.js";
-import "../chunk-VS4LPG66.js";
+import "../chunk-MQ5RUHNZ.js";
 import "../chunk-QMSEL5YS.js";
 import "../chunk-HSGBZSCA.js";
 import "../chunk-JKKZGDLP.js";

package/dist/bin/exe-team.js

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import {
   shutdownCli
-} from "../chunk-MBBFL2SP.js";
+} from "../chunk-GIO4VU4J.js";
 import {
   fastDbInit
-} from "../chunk-LKYGSJ2E.js";
+} from "../chunk-I76LRCNA.js";
 import {
   getClient,
   loadEmployees
-} from "../chunk-BRLS5OLZ.js";
+} from "../chunk-OBESOWFJ.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-NO3M2AFM.js";
+import "../chunk-JDPV7W2L.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";

package/dist/bin/exe-verify-running-images.js

@@ -7,6 +7,12 @@ import {
   isFirstPartyImage,
   normalizeVersion
 } from "../chunk-L25OAFOU.js";
+import {
+  compareLiveArtifacts,
+  declaredArtifactsFromManifest,
+  deliveryStateOf,
+  parseDigest
+} from "../chunk-W5MCOZTW.js";
 import "../chunk-MLKGABMK.js";
 
 // src/bin/exe-verify-running-images.ts
@@ -93,6 +99,82 @@ function inspectContainer(name) {
     labels: { [VERSION_LABEL]: clean(version), [REVISION_LABEL]: clean(revision) }
   };
 }
+function resolveRunningRef(containerName, configuredImage) {
+  const imageId = run("docker", ["inspect", containerName, "--format", "{{ .Image }}"]);
+  if (imageId.status !== 0) return configuredImage;
+  const id = imageId.stdout.trim();
+  if (!id) return configuredImage;
+  const digests = run("docker", ["inspect", id, "--format", "{{ json .RepoDigests }}"]);
+  if (digests.status !== 0) return configuredImage;
+  let list = [];
+  try {
+    const parsed = JSON.parse(digests.stdout.trim() || "[]");
+    if (Array.isArray(parsed)) list = parsed.filter((x) => typeof x === "string");
+  } catch {
+    return configuredImage;
+  }
+  if (list.length === 0) return configuredImage;
+  const configuredRepo = (configuredImage.split("@")[0] ?? "").replace(/:[^/:]+$/, "");
+  return list.find((d) => d.startsWith(`${configuredRepo}@`)) ?? list[0] ?? configuredImage;
+}
+function groupRunningArtifacts(entries) {
+  const byRef = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const existing = byRef.get(e.ref);
+    if (existing) {
+      existing.containers.push(e.container);
+      continue;
+    }
+    byRef.set(e.ref, { containers: [e.container], ref: e.ref, digest: parseDigest(e.ref) });
+  }
+  return [...byRef.values()];
+}
+function loadManifest(explicitPath) {
+  const candidates = explicitPath ? [explicitPath] : DEFAULT_MANIFESTS;
+  for (const candidate of candidates) {
+    if (!existsSync(candidate)) continue;
+    try {
+      return { manifest: JSON.parse(readFileSync(candidate, "utf8")), path: candidate };
+    } catch {
+    }
+  }
+  return void 0;
+}
+function loadDeclared(explicitPath) {
+  const loaded = loadManifest(explicitPath);
+  if (!loaded) return { declared: [], source: "no manifest found" };
+  try {
+    return { declared: declaredArtifactsFromManifest(loaded.manifest), source: loaded.path };
+  } catch {
+    return { declared: [], source: `${loaded.path} (unreadable stacks)` };
+  }
+}
+var VERDICT_ICON = {
+  agrees: "\u{1F7E2}",
+  disagrees: "\u{1F534}",
+  undeclared: "\u{1F7E0}",
+  "unknown-provenance": "\u{1F7E0}",
+  "not-running": "\u{1F7E0}"
+};
+function printLiveState(report) {
+  console.log(
+    `
+What is live \u2014 ${report.inventory.runningArtifacts} running artifact(s) vs ${report.inventory.declaredArtifacts} declared (${report.inventory.source})
+`
+  );
+  for (const e of report.entries) {
+    const icon = VERDICT_ICON[e.verdict] ?? "?";
+    console.log(`  ${icon} ${e.service.padEnd(22)} ${e.verdict}`);
+    if (e.running) console.log(`       running  ${e.running.digest ?? e.running.ref}  [${e.running.containers.join(", ")}]`);
+    if (e.declared) console.log(`       declared ${e.declared.digest ?? e.declared.ref}`);
+    if (e.verdict !== "agrees") console.log(`       ${e.detail}`);
+  }
+  console.log(
+    `
+  agrees: ${report.counts.agrees}  disagrees: ${report.counts.disagrees}  undeclared: ${report.counts.undeclared}  unknown-provenance: ${report.counts["unknown-provenance"]}  not-running: ${report.counts["not-running"]}
+`
+  );
+}
 function loadKnownVersions(explicitPath) {
   const candidates = explicitPath ? [explicitPath] : DEFAULT_MANIFESTS;
   for (const candidate of candidates) {
@@ -118,8 +200,33 @@ function main(argv) {
   const containers = names.map(inspectContainer).filter((c) => c !== void 0);
   const knownVersions = loadKnownVersions(manifestPath);
   const findings = findRunningImageIssues(containers, knownVersions);
+  const { declared, source } = loadDeclared(manifestPath);
+  const running = groupRunningArtifacts(
+    containers.map((c) => ({ container: c.name, ref: resolveRunningRef(c.name, c.image) }))
+  );
+  const liveState = compareLiveArtifacts(running, declared, {
+    source,
+    // A declared service with nothing running it is real information on a full
+    // stack host, and pure noise on a subset install. Reported only when the
+    // manifest was actually readable, and always as a finding the reader can
+    // dismiss — see limitation 4 in delivery-truth.ts.
+    reportNotRunning: declared.length > 0
+  });
   if (json) {
-    console.log(JSON.stringify({ ok: findings.length === 0, checked: containers.length, findings }, null, 2));
+    console.log(
+      JSON.stringify(
+        {
+          ok: findings.length === 0 && liveState.findings.length === 0,
+          checked: containers.length,
+          findings,
+          liveState,
+          // The contract the bug/task close gates should consume (#690/#694).
+          delivery: deliveryStateOf(liveState)
+        },
+        null,
+        2
+      )
+    );
   } else {
     console.log(`Running-image version assertion \u2014 inspected ${containers.length} container(s)`);
     if (knownVersions.size === 0) {
@@ -131,15 +238,27 @@ function main(argv) {
     for (const f of findings) {
       console.error(`  \u{1F534} [${f.kind}] ${f.message}`);
     }
+    if (declared.length === 0) {
+      console.log("  \u26A0\uFE0F  no declared artifacts readable \u2014 live-vs-declared comparison SKIPPED (this is not a pass)");
+    } else {
+      printLiveState(liveState);
+    }
   }
-  if (findings.length === 0) return 0;
+  const enforceable = liveState.findings.filter((f) => f.verdict !== "not-running");
+  const total = findings.length + enforceable.length;
+  if (total === 0) return 0;
   if (!enforce) {
     console.error(
-      `::warning::${findings.length} running-image finding(s) \u2014 WARN-first, not failing. Pass --enforce (or EXE_VERIFY_RUNNING_IMAGES_ENFORCE=1) to fail closed.`
+      `::warning::${findings.length} running-image finding(s) and ${liveState.findings.length} live-vs-declared finding(s) \u2014 WARN-first, not failing. Pass --enforce (or EXE_VERIFY_RUNNING_IMAGES_ENFORCE=1) to fail closed.`
     );
     return 0;
   }
-  console.error(`::error::${findings.length} running container(s) do not resolve to a known release.`);
+  for (const f of enforceable) {
+    console.error(`::error::[${f.verdict}] ${f.service}: ${f.detail}`);
+  }
+  console.error(
+    `::error::${total} finding(s): ${findings.length} container(s) do not resolve to a known release; ${enforceable.length} artifact(s) are not the artifact the signed manifest pins.`
+  );
   return 1;
 }
 process.exit(main(process.argv));

package/dist/bin/exe-watchdog.js

@@ -47,6 +47,9 @@ function daemonSockPath() {
 function restartMarkerPath() {
   return join(exeDir(), "last-daemon-restart");
 }
+function suppressionCountersPath() {
+  return join(exeDir(), "watchdog-suppressions.json");
+}
 function watchdogLogDir() {
   return join(exeDir(), "logs");
 }
@@ -340,6 +343,38 @@ async function awaitSuccessor(killedPid) {
     await sleep(SUCCESSOR_POLL_MS);
   }
 }
+function emptySuppressionCounters() {
+  return { total: {}, lastAt: {}, lastDetail: {} };
+}
+function readSuppressionCounters(file = suppressionCountersPath()) {
+  try {
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    if (!parsed || typeof parsed !== "object") return emptySuppressionCounters();
+    const raw = parsed;
+    const obj = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
+    const total = {};
+    for (const [k, v] of Object.entries(obj(raw.total))) {
+      if (typeof v === "number" && Number.isFinite(v)) total[k] = v;
+    }
+    return { total, lastAt: { ...obj(raw.lastAt) }, lastDetail: { ...obj(raw.lastDetail) } };
+  } catch {
+    return emptySuppressionCounters();
+  }
+}
+function recordSuppression(reason, detail, file = suppressionCountersPath(), nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  const counters = readSuppressionCounters(file);
+  const next = (counters.total[reason] ?? 0) + 1;
+  counters.total[reason] = next;
+  counters.lastAt[reason] = nowIso;
+  counters.lastDetail[reason] = detail;
+  try {
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, JSON.stringify(counters, null, 2));
+  } catch (err) {
+    log(`[watchdog] WARNING: could not persist suppression counter: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return next;
+}
 function cleanupStaleFiles() {
   try {
     if (existsSync(daemonPidPath())) unlinkSync(daemonPidPath());
@@ -546,19 +581,22 @@ async function tick() {
   if (age === null) {
     log("[watchdog] Daemon PID file missing \u2014 cannot determine daemon age (daemon likely dead); proceeding to self-heal checks");
   } else if (bootGraceActive({ ageSec: age, perCore, readySignaledThisBoot: readySignaledByPid(pid) })) {
-    log(`[watchdog] Daemon is only ${Math.round(age)}s old (min ${effectiveMinDaemonAgeS(perCore)}s at load ${perCore.toFixed(2)}/core, not yet ready) \u2014 suppressing kill, resetting counter`);
+    const bootGraceTotal = recordSuppression("boot_grace", `age=${Math.round(age)}s load=${perCore.toFixed(2)}/core`);
+    log(`[watchdog] Daemon is only ${Math.round(age)}s old (min ${effectiveMinDaemonAgeS(perCore)}s at load ${perCore.toFixed(2)}/core, not yet ready) \u2014 suppressing kill, resetting counter [boot-grace-suppressed total: ${bootGraceTotal}]`);
     failureState = emptyFailureState();
     return;
   }
   const starvation = detectStarvation();
   if (starvation.starved) {
-    log(`[watchdog] Daemon unresponsive but host is CPU-starved (${starvation.reason}) \u2014 suppressing self-heal (restart won't fix starvation), resetting counter`);
+    const starvationTotal = recordSuppression("starvation", starvation.reason ?? "starved");
+    log(`[watchdog] Daemon unresponsive but host is CPU-starved (${starvation.reason}) \u2014 suppressing self-heal (restart won't fix starvation), resetting counter [starvation-suppressed total: ${starvationTotal}]`);
     failureState = emptyFailureState();
     return;
   }
   const hbAge = heartbeatAgeMs(now);
   if (isHeartbeatFresh(hbAge)) {
-    log(`[watchdog] Daemon unresponsive to HTTP ping but event-loop heartbeat is fresh (${((hbAge ?? 0) / 1e3).toFixed(1)}s old < ${HEARTBEAT_FRESH_MS / 1e3}s) \u2014 event loop is still turning; daemon is alive-but-slow. Suppressing kill, resetting counter`);
+    const hbTotal = recordSuppression("heartbeat_fresh", `hbAge=${((hbAge ?? 0) / 1e3).toFixed(1)}s`);
+    log(`[watchdog] Daemon unresponsive to HTTP ping but event-loop heartbeat is fresh (${((hbAge ?? 0) / 1e3).toFixed(1)}s old < ${HEARTBEAT_FRESH_MS / 1e3}s) \u2014 event loop is still turning; daemon is alive-but-slow. Suppressing kill, resetting counter [heartbeat-fresh-suppressed total: ${hbTotal}]`);
     failureState = emptyFailureState();
     return;
   }
@@ -627,12 +665,15 @@ export {
   effectiveMinDaemonAgeS,
   effectiveSigtermGraceMs,
   emptyFailureState,
+  emptySuppressionCounters,
   hasSustainedFailures,
   heartbeatAgeMs,
   isHeartbeatFresh,
   launchdKickstartTargets,
   loadPerCore,
+  readSuppressionCounters,
   recordPingFailure,
+  recordSuppression,
   resolveSelfPath,
   restartDaemonViaSupervisor,
   watchdogDaemonPidPathForTests