@askexenow/exe-os 0.9.367 → 0.9.368

package/dist/{chunk-ALKYXAMB.js → chunk-UVM5ZXO2.js}

@@ -1,13 +1,13 @@
 import {
   buildSystemStateMemoryTypeExclusion
-} from "./chunk-BQYQES2Z.js";
+} from "./chunk-ELY5WBZX.js";
 import {
   sessionScopeFilter
-} from "./chunk-QX33D4CH.js";
+} from "./chunk-Y4AYNLXU.js";
 import {
   getClient,
   getIdentity
-} from "./chunk-HSBKV5LB.js";
+} from "./chunk-OBESOWFJ.js";
 import {
   getEmotionalBaseline
 } from "./chunk-NJFJWQNN.js";
@@ -646,7 +646,7 @@ var DreamingEngine = class {
     }
     let overdueProspective = [];
     try {
-      const { getOverdueProspective, completeProspective } = await import("./prospective-memory-G5VK5GCD.js");
+      const { getOverdueProspective, completeProspective } = await import("./prospective-memory-HI3WUY4U.js");
       const overdue = await getOverdueProspective(agentId);
       overdueProspective = overdue.map((o) => ({
         id: o.id,

package/dist/{chunk-R3H3WW7H.js → chunk-V7E37GE3.js}

@@ -1,11 +1,11 @@
 import {
   ingest
-} from "./chunk-XSXZVKJ7.js";
+} from "./chunk-VD3CVNGB.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-Y4JVM3SI.js";
+} from "./chunk-CXHRNESJ.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";

package/dist/{chunk-XSXZVKJ7.js → chunk-VD3CVNGB.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-HSBKV5LB.js";
+} from "./chunk-OBESOWFJ.js";
 
 // src/lib/pipeline-router.ts
 import crypto from "crypto";
@@ -140,8 +140,8 @@ Agent response: ${agentResponse}` : ""
 }
 async function sinkEntityExtraction(msg, agentResponse, agentName) {
   try {
-    const { extractFromConversation } = await import("./conversation-entity-extractor-ZR5GFKAI.js");
-    const { storeExtraction } = await import("./graph-rag-L5NV5YWD.js");
+    const { extractFromConversation } = await import("./conversation-entity-extractor-LFIDTD2O.js");
+    const { storeExtraction } = await import("./graph-rag-RLRQMY54.js");
     if ((msg.text?.length ?? 0) < 20) return false;
     if (msg.isHistorical) return false;
     const extraction = await extractFromConversation(msg, agentResponse, agentName);

package/dist/{chunk-CKKLSY7B.js → chunk-VIW62NN5.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-L25OAFOU.js";
 import {
   loadLicense
-} from "./chunk-F3PIHVVY.js";
+} from "./chunk-6UZ3DEQI.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync as spawnSync2 } from "child_process";

package/dist/{chunk-VY3QUSWS.js → chunk-VTOO5UB3.js}

@@ -1,23 +1,23 @@
 import {
   MultiAgentOrchestrator
-} from "./chunk-P5XER5QY.js";
+} from "./chunk-QT6CNCXO.js";
 import {
   createTokenBudgetMiddleware
-} from "./chunk-267QB6VB.js";
+} from "./chunk-2UGU3V63.js";
 import {
   createQuietRenderer,
   createTerminalRenderer,
   renderAgentEvents
 } from "./chunk-YZFZDJWZ.js";
-import {
-  checkDangerousPatterns,
-  hasCriticalPattern
-} from "./chunk-CMCYL2JC.js";
 import {
   checkPathSafety,
   checkReadPathSafety,
   containsPathTraversal
 } from "./chunk-NGVOA6ZQ.js";
+import {
+  checkDangerousPatterns,
+  hasCriticalPattern
+} from "./chunk-CMCYL2JC.js";
 import {
   ContextManager,
   agentLoop,
@@ -209,7 +209,7 @@ function createExeOSHooks(config) {
         );
       }
       try {
-        const { listBehaviors } = await import("./behaviors-O6HKTSOF.js");
+        const { listBehaviors } = await import("./behaviors-UCMAREU3.js");
         const behaviors = await listBehaviors(config.agentId, config.projectName, 12);
         if (behaviors.length > 0) {
           process.stderr.write(
@@ -330,7 +330,7 @@ function createExeOSHooks(config) {
     async onSubagentStop(_reason) {
       try {
         const { getClient } = await import("./lib/database.js");
-        const { sessionScopeFilter } = await import("./task-scope-74JBTKJN.js");
+        const { sessionScopeFilter } = await import("./task-scope-PQ67YRWP.js");
         const client = getClient();
         const ehScope = sessionScopeFilter();
         const tasks = await client.execute({
@@ -422,7 +422,7 @@ function createExeOSHooks(config) {
         try {
           const { writeMemory, flushBatch } = await import("./lib/store.js");
           const { getClient } = await import("./lib/database.js");
-          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-74JBTKJN.js");
+          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-PQ67YRWP.js");
           const client = getClient();
           const cpScope = cpScopeFilter();
           const tasks = await client.execute({

package/dist/chunk-W5MCOZTW.js

@@ -0,0 +1,304 @@
+// src/lib/delivery-truth.ts
+var DIGEST_RE = /@(sha256:[0-9a-f]{64})\b/i;
+function parseDigest(ref) {
+  const m = DIGEST_RE.exec(ref ?? "");
+  return m?.[1] ? m[1].toLowerCase() : null;
+}
+function repositoryKey(ref) {
+  const withoutDigest = (ref ?? "").split("@")[0] ?? "";
+  const withoutTag = withoutDigest.replace(/:[^/:]+$/, "");
+  const segments = withoutTag.split("/").filter(Boolean);
+  return segments[segments.length - 1] ?? withoutTag;
+}
+function compareLiveArtifacts(running, declared, options) {
+  const declaredByDigest = /* @__PURE__ */ new Map();
+  const declaredByRepo = /* @__PURE__ */ new Map();
+  for (const d of declared) {
+    if (d.digest) declaredByDigest.set(d.digest.toLowerCase(), d);
+    declaredByRepo.set(repositoryKey(d.ref), d);
+  }
+  const entries = [];
+  const matchedDeclared = /* @__PURE__ */ new Set();
+  for (const r of running) {
+    const digest = r.digest ?? parseDigest(r.ref);
+    const repo = repositoryKey(r.ref);
+    const runningSide = { ref: r.ref, digest, containers: r.containers };
+    if (digest && declaredByDigest.has(digest)) {
+      const d = declaredByDigest.get(digest);
+      matchedDeclared.add(d.service);
+      entries.push({
+        service: d.service,
+        verdict: "agrees",
+        channel: d.channel,
+        running: runningSide,
+        declared: { ref: d.ref, digest: d.digest },
+        detail: `running digest is the digest the signed manifest pins`
+      });
+      continue;
+    }
+    const byRepo = declaredByRepo.get(repo);
+    if (byRepo) {
+      matchedDeclared.add(byRepo.service);
+      if (!digest) {
+        entries.push({
+          service: byRepo.service,
+          verdict: "unknown-provenance",
+          channel: byRepo.channel,
+          running: runningSide,
+          declared: { ref: byRepo.ref, digest: byRepo.digest },
+          detail: `running ref "${r.ref}" carries no resolvable digest, so what is running cannot be traced to any published artifact \u2014 it cannot be shown to match or to differ from the manifest pin`
+        });
+        continue;
+      }
+      entries.push({
+        service: byRepo.service,
+        verdict: "disagrees",
+        channel: byRepo.channel,
+        running: runningSide,
+        declared: { ref: byRepo.ref, digest: byRepo.digest },
+        detail: `running ${digest} but the signed manifest pins ${byRepo.digest ?? "(no digest)"} \u2014 production is not the artifact we signed`
+      });
+      continue;
+    }
+    if (!digest) {
+      entries.push({
+        service: repo,
+        verdict: "unknown-provenance",
+        channel: "signed-manifest",
+        running: runningSide,
+        detail: `running ref "${r.ref}" carries no resolvable digest and matches no declared repository \u2014 provenance unknown`
+      });
+      continue;
+    }
+    entries.push({
+      service: repo,
+      verdict: "undeclared",
+      channel: "signed-manifest",
+      running: runningSide,
+      detail: `running ${digest} under repository "${repo}", which the signed manifest does not declare at all \u2014 this artifact is outside the release contract`
+    });
+  }
+  if (options?.reportNotRunning) {
+    for (const d of declared) {
+      if (matchedDeclared.has(d.service)) continue;
+      entries.push({
+        service: d.service,
+        verdict: "not-running",
+        channel: d.channel,
+        declared: { ref: d.ref, digest: d.digest },
+        detail: `declared and pinned, but no running artifact in the inspected inventory carries this digest or repository`
+      });
+    }
+  }
+  const counts = {
+    agrees: 0,
+    disagrees: 0,
+    undeclared: 0,
+    "unknown-provenance": 0,
+    "not-running": 0
+  };
+  for (const e of entries) counts[e.verdict]++;
+  return {
+    entries,
+    findings: entries.filter((e) => e.verdict !== "agrees"),
+    counts,
+    inventory: {
+      runningArtifacts: running.length,
+      declaredArtifacts: declared.length,
+      source: options?.source ?? "unspecified"
+    }
+  };
+}
+function declaredArtifactsFromManifest(manifest, options) {
+  const m = manifest;
+  if (!m || typeof m !== "object" || !m.stacks) {
+    throw new Error("manifest has no `stacks` object");
+  }
+  const version = options?.stackVersion ?? m.latest;
+  if (!version) throw new Error("manifest has no `latest` and no stack version was given");
+  const stack = m.stacks[version];
+  if (!stack?.services) throw new Error(`manifest stack "${version}" is missing or has no services`);
+  const out = [];
+  for (const [service, svc] of Object.entries(stack.services)) {
+    const ref = typeof svc?.image === "string" ? svc.image : "";
+    if (!ref) continue;
+    out.push({ service, ref, digest: parseDigest(ref), channel: "signed-manifest" });
+  }
+  return out;
+}
+function evaluateDeliveryChannels(input) {
+  const { detected, registry, npmFiles } = input;
+  const normalizedFiles = npmFiles.map((f) => f.replace(/^\.\//, "").replace(/\/+$/, ""));
+  const covered = (p) => {
+    const path = p.replace(/^\.\//, "").replace(/\/+$/, "");
+    return normalizedFiles.some((f) => f === path || path.startsWith(`${f}/`));
+  };
+  const out = [];
+  for (const d of detected) {
+    const channel = registry[d.path] ?? null;
+    if (!channel) {
+      out.push({
+        path: d.path,
+        channel: null,
+        verdict: "unclassified",
+        detail: `${d.path} is deployable (${d.evidence}) but declares no delivery channel. Nothing can say whether a change here reaches a customer.`
+      });
+      continue;
+    }
+    if (channel === "no-release-path") {
+      out.push({
+        path: d.path,
+        channel,
+        verdict: "no-release-path",
+        detail: `${d.path} has NO delivery path. Merging here delivers nothing to anyone.`
+      });
+      continue;
+    }
+    if (channel === "not-shipped") {
+      out.push({
+        path: d.path,
+        channel,
+        verdict: "not-shipped",
+        detail: `${d.path} ships nowhere itself. A change here reaches a customer only once it is vendored into a consuming artifact AND that artifact is rebuilt.`
+      });
+      continue;
+    }
+    if (channel === "npm" && !covered(d.path)) {
+      out.push({
+        path: d.path,
+        channel,
+        verdict: "undelivered",
+        detail: `${d.path} declares the npm channel but is not covered by package.json \`files\`, so it is in the git tag and ABSENT from the published tarball. Tag ancestry is not proof of delivery.`
+      });
+      continue;
+    }
+    out.push({
+      path: d.path,
+      channel,
+      verdict: "delivered",
+      detail: `${d.path} ships via ${channel}`
+    });
+  }
+  return out;
+}
+var GATE_COOKIE_RE = /\bexe_[a-z0-9_]*token[a-z0-9_]*\b/gi;
+function extractGateCookieNames(html) {
+  const found = /* @__PURE__ */ new Set();
+  for (const m of (html ?? "").matchAll(GATE_COOKIE_RE)) found.add(m[0].toLowerCase());
+  return [...found].sort();
+}
+function evaluateAnonymousGate(input) {
+  const { service, url, html, setterNames } = input;
+  const gateCookies = extractGateCookieNames(html);
+  if (gateCookies.length === 0) {
+    return {
+      service,
+      url,
+      status: "no-client-gate",
+      gateCookies,
+      detail: `no SSO-shaped cookie name in the served document \u2014 this product does not gate client-side (it may bridge server-side, which is correct)`
+    };
+  }
+  const setters = new Set(setterNames.map((s) => s.toLowerCase()));
+  if (setters.size === 0) {
+    return {
+      service,
+      url,
+      status: "inconclusive",
+      gateCookies,
+      detail: `the auth origin exposed no cookie name, so there is nothing to compare against. The probe cannot answer the question \u2014 fix the probe or the auth surface. This is NOT a pass.`
+    };
+  }
+  const unsatisfiable = gateCookies.filter((c) => !setters.has(c));
+  if (unsatisfiable.length === gateCookies.length) {
+    return {
+      service,
+      url,
+      status: "unsatisfiable",
+      gateCookies,
+      detail: `gates on ${unsatisfiable.join(", ")}, which NO origin in the live auth flow sets (auth hands out: ${[...setters].sort().join(", ")}). Every visitor bounces between this product and auth forever. The served page answers HTTP 200 with zero redirects because the loop is client-side, so a status-code check sees a healthy service.`
+    };
+  }
+  return {
+    service,
+    url,
+    status: "satisfiable",
+    gateCookies,
+    detail: `gates on ${gateCookies.join(", ")}; the live auth flow sets a matching name`
+  };
+}
+var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+var DEPARTMENT_RE = /^(the\s+)?(team|eng|engineering|ops|devops|sre|infra|platform|everyone|tbd|unknown|n\/?a)$/i;
+function applyLivenessAcks(input) {
+  const { findingKeys, acks, now } = input;
+  const present = new Set(findingKeys);
+  const evaluations = [];
+  const suppressed = /* @__PURE__ */ new Set();
+  for (const ack of acks) {
+    const missing = [];
+    if (!ack?.key) missing.push("key");
+    const owner = (ack?.owner ?? "").trim();
+    if (owner.length < 2) missing.push("owner");
+    else if (DEPARTMENT_RE.test(owner)) missing.push("owner (a person, not a team)");
+    if (!ack?.bug) missing.push("bug");
+    if (!ack?.expires || !ISO_DATE_RE.test(ack.expires)) missing.push("expires (YYYY-MM-DD)");
+    if (missing.length > 0) {
+      evaluations.push({
+        ack,
+        state: "invalid",
+        detail: `ack for "${ack?.key ?? "(no key)"}" is missing ${missing.join(", ")} \u2014 it suppresses nothing. An ack needs a person who defends it and a tracked fix, or it is just a mute.`
+      });
+      continue;
+    }
+    const expiry = /* @__PURE__ */ new Date(`${ack.expires}T23:59:59Z`);
+    if (Number.isNaN(expiry.getTime()) || expiry.getTime() < now.getTime()) {
+      evaluations.push({
+        ack,
+        state: "expired",
+        detail: `ack for "${ack.key}" expired on ${ack.expires} (owner: ${ack.owner}, bug: ${ack.bug}). The finding is failing again, and the lapsed ack is itself a failure. Fix it or re-ack with a new date and a reason.`
+      });
+      continue;
+    }
+    if (!present.has(ack.key)) {
+      evaluations.push({
+        ack,
+        state: "stale",
+        detail: `ack for "${ack.key}" (owner: ${ack.owner}) suppresses a finding that is no longer present. Delete it \u2014 a suppression list that only grows becomes a permanent allow-list.`
+      });
+      continue;
+    }
+    suppressed.add(ack.key);
+  }
+  return {
+    failing: findingKeys.filter((k) => !suppressed.has(k)),
+    acknowledged: [...suppressed],
+    ackProblems: evaluations
+  };
+}
+function findingKey(f) {
+  return `${f.service}:${f.verdict}`;
+}
+function deliveryStateOf(report) {
+  return report.entries.map((e) => ({
+    service: e.service,
+    channel: e.channel,
+    delivered: e.verdict === "agrees" ? true : e.verdict === "unknown-provenance" ? null : false,
+    liveIdentity: e.running?.digest ?? e.running?.ref ?? null,
+    declaredIdentity: e.declared?.digest ?? e.declared?.ref ?? null,
+    verdict: e.verdict,
+    detail: e.detail
+  }));
+}
+
+export {
+  parseDigest,
+  repositoryKey,
+  compareLiveArtifacts,
+  declaredArtifactsFromManifest,
+  evaluateDeliveryChannels,
+  extractGateCookieNames,
+  evaluateAnonymousGate,
+  applyLivenessAcks,
+  findingKey,
+  deliveryStateOf
+};