@askexenow/exe-os 0.9.367 → 0.9.369

package/dist/bin/exe-session-cleanup.js

@@ -3,16 +3,17 @@ import {
   findBestMatch,
   getRecentCommits,
   pushUnpushedCommits
-} from "../chunk-R4AROSYI.js";
+} from "../chunk-RFWOXKVL.js";
+import "../chunk-KZXMP6JG.js";
 import {
   flushBatch,
   initStore,
   writeMemory
-} from "../chunk-BQYQES2Z.js";
-import "../chunk-JLYHJJHU.js";
+} from "../chunk-ELY5WBZX.js";
+import "../chunk-FDA45THL.js";
 import "../chunk-CHCA3ZM2.js";
 import "../chunk-OTVEIJUQ.js";
-import "../chunk-WM7Y5ZV2.js";
+import "../chunk-5U4UJGTW.js";
 import "../chunk-5MOYSU5A.js";
 import "../chunk-4QCFFW2H.js";
 import "../chunk-76CJBM36.js";
@@ -20,26 +21,26 @@ import {
   createReviewForCompletedTask,
   sessionScopeFilter,
   updateTaskStatus
-} from "../chunk-QX33D4CH.js";
+} from "../chunk-Y4AYNLXU.js";
 import "../chunk-BTSWFMEH.js";
-import "../chunk-6MCUXRIP.js";
-import "../chunk-7W6FDHHY.js";
-import "../chunk-IIVFXD6P.js";
+import "../chunk-P3PAD6AA.js";
+import "../chunk-KGPWS4KE.js";
+import "../chunk-KYVIV54Y.js";
 import "../chunk-WT4RI36X.js";
-import "../chunk-CX4MVEM3.js";
 import "../chunk-KI5PFRG6.js";
+import "../chunk-QAEWWYHL.js";
 import "../chunk-EIKATSE4.js";
 import "../chunk-E23LNUWJ.js";
-import "../chunk-QAEWWYHL.js";
-import "../chunk-XKFMNAJ7.js";
+import "../chunk-CSBD7QLZ.js";
 import "../chunk-GBNB4EWD.js";
 import "../chunk-UXLO7VHX.js";
 import "../chunk-DSOQUQTV.js";
-import "../chunk-UI3K73LD.js";
+import "../chunk-BFL3UB77.js";
 import "../chunk-AJIXH5JF.js";
+import "../chunk-PVWM2WMM.js";
 import "../chunk-XTWHNLGD.js";
 import "../chunk-AM7S2TY6.js";
-import "../chunk-N3JLNMPF.js";
+import "../chunk-PGF5I7EV.js";
 import "../chunk-CVYC6DUW.js";
 import "../chunk-ZVTKWWLV.js";
 import "../chunk-CDUB5Q6J.js";
@@ -55,11 +56,11 @@ import "../chunk-GJV3WDWM.js";
 import "../chunk-MP2AFCGL.js";
 import {
   getClient
-} from "../chunk-HSBKV5LB.js";
+} from "../chunk-OBESOWFJ.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-Y7OK5PJE.js";
+import "../chunk-JDPV7W2L.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";
@@ -67,9 +68,9 @@ import "../chunk-JY5GAZYC.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-HPXFKUGU.js";
 import "../chunk-WNBZJSQT.js";
-import "../chunk-F3PIHVVY.js";
+import "../chunk-6UZ3DEQI.js";
 import "../chunk-A7XLR3K7.js";
-import "../chunk-65ZSFW3O.js";
+import "../chunk-MQ5RUHNZ.js";
 import "../chunk-QILQ5FCG.js";
 import "../chunk-ARX6TAGN.js";
 import "../chunk-QMSEL5YS.js";
@@ -440,7 +441,7 @@ try {
 } catch {
 }
 try {
-  const { cleanupWorktree } = await import("../worktree-3TUKIZWY.js");
+  const { cleanupWorktree } = await import("../worktree-3FO6EQ4G.js");
   const cleanup = cleanupWorktree(process.cwd(), agentName);
   if (cleanup.cleaned) {
     process.stderr.write(`[session-cleanup] worktree cleaned: ${cleanup.reason}

package/dist/bin/exe-settings.js

@@ -1,13 +1,13 @@
 import {
   assertSecureEndpoint
-} from "../chunk-BTMX2D4X.js";
+} from "../chunk-YGPJ7VSJ.js";
+import "../chunk-EYIX6JU7.js";
 import "../chunk-NEHOQ3P2.js";
-import "../chunk-62U63R3E.js";
 import "../chunk-CW2UCKHS.js";
 import "../chunk-VV5EZZNT.js";
 import "../chunk-JTB5V6BV.js";
 import "../chunk-NUTZJZKW.js";
-import "../chunk-WBKIU6UJ.js";
+import "../chunk-MCXYNYZI.js";
 import "../chunk-VMJ2UH4S.js";
 import "../chunk-QGGH7LOU.js";
 import "../chunk-VHJVD3MZ.js";
@@ -17,11 +17,11 @@ import {
   resolveEmbeddingsEnabled,
   setEmbeddingsEnabled
 } from "../chunk-KWOAM7TA.js";
-import "../chunk-BQYQES2Z.js";
-import "../chunk-JLYHJJHU.js";
+import "../chunk-ELY5WBZX.js";
+import "../chunk-FDA45THL.js";
 import "../chunk-CHCA3ZM2.js";
 import "../chunk-OTVEIJUQ.js";
-import "../chunk-WM7Y5ZV2.js";
+import "../chunk-5U4UJGTW.js";
 import "../chunk-5MOYSU5A.js";
 import "../chunk-4QCFFW2H.js";
 import "../chunk-76CJBM36.js";
@@ -41,11 +41,11 @@ import "../chunk-NLEW62VC.js";
 import "../chunk-MP2AFCGL.js";
 import {
   loadEmployeesSync
-} from "../chunk-HSBKV5LB.js";
+} from "../chunk-OBESOWFJ.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-Y7OK5PJE.js";
+import "../chunk-JDPV7W2L.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";
@@ -55,9 +55,9 @@ import "../chunk-HPXFKUGU.js";
 import {
   DEFAULT_RUNTIME
 } from "../chunk-WNBZJSQT.js";
-import "../chunk-F3PIHVVY.js";
+import "../chunk-6UZ3DEQI.js";
 import "../chunk-A7XLR3K7.js";
-import "../chunk-65ZSFW3O.js";
+import "../chunk-MQ5RUHNZ.js";
 import "../chunk-QILQ5FCG.js";
 import "../chunk-ARX6TAGN.js";
 import {

package/dist/bin/exe-start-codex.js

@@ -1,18 +1,19 @@
 #!/usr/bin/env node
 import {
   exportBehaviorsForAgent
-} from "../chunk-XVRQZCTS.js";
-import "../chunk-WBKIU6UJ.js";
+} from "../chunk-C5FOA5GO.js";
+import "../chunk-XOTDAKJL.js";
+import "../chunk-MCXYNYZI.js";
 import "../chunk-VMJ2UH4S.js";
 import "../chunk-QGGH7LOU.js";
 import {
   disposeStore,
   initStore
-} from "../chunk-BQYQES2Z.js";
-import "../chunk-JLYHJJHU.js";
+} from "../chunk-ELY5WBZX.js";
+import "../chunk-FDA45THL.js";
 import "../chunk-CHCA3ZM2.js";
 import "../chunk-OTVEIJUQ.js";
-import "../chunk-WM7Y5ZV2.js";
+import "../chunk-5U4UJGTW.js";
 import "../chunk-5MOYSU5A.js";
 import "../chunk-4QCFFW2H.js";
 import "../chunk-76CJBM36.js";
@@ -20,6 +21,7 @@ import {
   clearTerminalLauncherFailure,
   writeTerminalLauncherFailure
 } from "../chunk-AJIXH5JF.js";
+import "../chunk-PVWM2WMM.js";
 import {
   CODEX_CHATGPT_UNSUPPORTED_MODELS,
   assertCodexModelForAuth,
@@ -35,11 +37,11 @@ import "../chunk-MP2AFCGL.js";
 import {
   baseAgentName,
   loadEmployeesSync
-} from "../chunk-HSBKV5LB.js";
+} from "../chunk-OBESOWFJ.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-Y7OK5PJE.js";
+import "../chunk-JDPV7W2L.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";
@@ -235,8 +237,37 @@ function writePromptFile(agent, identity, behaviorsPath, globalProcedures) {
   writeFileSync(outPath, prompt, "utf-8");
   return outPath;
 }
-var CODEX_PINNED_SANDBOX_ARGS = ["--sandbox", "workspace-write"];
-var CODEX_PINNED_APPROVAL_ARGS = ["--approval-policy", "never"];
+var CODEX_PINNED_SANDBOX_MODE = "workspace-write";
+var CODEX_PINNED_APPROVAL_POLICY = "never";
+var CODEX_APPROVAL_FLAG_PREFERENCE = ["--ask-for-approval", "--approval-policy"];
+var CODEX_SANDBOX_FLAG_PREFERENCE = ["--sandbox"];
+function parseCodexSupportedFlags(helpText) {
+  const flags = /* @__PURE__ */ new Set();
+  for (const match of helpText.matchAll(/(?<![\w-])--[a-z0-9][a-z0-9-]*/g)) {
+    flags.add(match[0]);
+  }
+  return flags;
+}
+function buildCodexConstraintArgs(supported, preference, configKey, value) {
+  const flag = preference.find((f) => supported.has(f));
+  return flag ? [flag, value] : ["-c", `${configKey}=${JSON.stringify(value)}`];
+}
+var cachedCodexExecFlags = null;
+function detectCodexExecFlags(binary) {
+  if (cachedCodexExecFlags) return cachedCodexExecFlags;
+  let help = "";
+  try {
+    const probe = spawnSync(binary, ["exec", "--help"], {
+      encoding: "utf-8",
+      timeout: 1e4
+    });
+    help = `${probe.stdout ?? ""}
+${probe.stderr ?? ""}`;
+  } catch {
+  }
+  cachedCodexExecFlags = parseCodexSupportedFlags(help);
+  return cachedCodexExecFlags;
+}
 function sanitizeCodexPassthroughArgs(passthrough) {
   const sanitized = [];
   for (let i = 0; i < passthrough.length; i++) {
@@ -244,26 +275,44 @@ function sanitizeCodexPassthroughArgs(passthrough) {
     if (arg === "--dangerously-bypass-approvals-and-sandbox" || arg === "--full-auto") {
       continue;
     }
-    if (arg === "--sandbox" || arg === "-s" || arg === "--approval-policy") {
+    if (arg === "--sandbox" || arg === "-s" || arg === "--approval-policy" || arg === "--ask-for-approval" || arg === "-a") {
       i++;
       continue;
     }
-    if (arg.startsWith("--sandbox=") || arg.startsWith("-s=") || arg.startsWith("--approval-policy=")) {
+    if (arg.startsWith("--sandbox=") || arg.startsWith("-s=") || arg.startsWith("--approval-policy=") || arg.startsWith("--ask-for-approval=") || arg.startsWith("-a=")) {
       continue;
     }
+    if (arg === "-c" || arg === "--config") {
+      const next = passthrough[i + 1];
+      if (next && /^(sandbox_mode|approval_policy)\s*=/.test(next)) {
+        i++;
+        continue;
+      }
+    }
     sanitized.push(arg);
   }
   return sanitized;
 }
 function buildCodexLaunchArgs(input) {
+  const supported = input.supportedExecFlags ?? detectCodexExecFlags(CODEX.binary);
   const args = [
     "exec",
     "-m",
     input.effectiveModel,
     "-c",
     `model=${JSON.stringify(input.effectiveModel)}`,
-    ...CODEX_PINNED_SANDBOX_ARGS,
-    ...CODEX_PINNED_APPROVAL_ARGS,
+    ...buildCodexConstraintArgs(
+      supported,
+      CODEX_SANDBOX_FLAG_PREFERENCE,
+      "sandbox_mode",
+      CODEX_PINNED_SANDBOX_MODE
+    ),
+    ...buildCodexConstraintArgs(
+      supported,
+      CODEX_APPROVAL_FLAG_PREFERENCE,
+      "approval_policy",
+      CODEX_PINNED_APPROVAL_POLICY
+    ),
     "--color",
     "never",
     ...sanitizeCodexPassthroughArgs(input.passthrough)
@@ -525,7 +574,7 @@ async function main() {
     await initStore();
     behaviorsPath = await exportBehaviorsForAgent(baseAgent, "");
     try {
-      const { loadGlobalProcedures, getGlobalProceduresBlock } = await import("../global-procedures-XDNA3TNA.js");
+      const { loadGlobalProcedures, getGlobalProceduresBlock } = await import("../global-procedures-RXIKBVLZ.js");
       await loadGlobalProcedures();
       const block = getGlobalProceduresBlock();
       if (block) globalProcedures = block;
@@ -575,8 +624,8 @@ async function main() {
   let codexProfileName = null;
   if (exeSessionName) {
     try {
-      const { readOrCreateDaemonToken } = await import("../mcp-http-config-ROF5EPEF.js");
-      const { mcpHttpUrl } = await import("../mcp-http-config-ROF5EPEF.js");
+      const { readOrCreateDaemonToken } = await import("../mcp-http-config-XUNRIGQH.js");
+      const { mcpHttpUrl } = await import("../mcp-http-config-XUNRIGQH.js");
       const token = readOrCreateDaemonToken();
       const profileContent = buildCodexMcpProfileContent({
         agentId: codexIdentity.memoryAgent,
@@ -606,12 +655,12 @@ async function main() {
     }
   }
   try {
-    const { writeActiveAgent } = await import("../active-agent-R6Q7UEUD.js");
+    const { writeActiveAgent } = await import("../active-agent-RDTJGZHP.js");
     writeActiveAgent(memoryAgent, empRole);
   } catch {
   }
   try {
-    const { verifyCodexHooks, runCodexInstaller } = await import("../installer-EPQAOI6M.js");
+    const { verifyCodexHooks, runCodexInstaller } = await import("../installer-TOPA7673.js");
     if (!verifyCodexHooks()) {
       process.stderr.write("[exe-start-codex] hooks missing \u2014 registering now\n");
       await runCodexInstaller();
@@ -629,7 +678,7 @@ async function main() {
 `);
   if (WORKTREE_ROLES.has(empRole)) {
     try {
-      const { ensureWorktree, parseInstanceLabel } = await import("../worktree-3TUKIZWY.js");
+      const { ensureWorktree, parseInstanceLabel } = await import("../worktree-3FO6EQ4G.js");
       const { base, instance } = parseInstanceLabel(worktreeName);
       worktreePath = ensureWorktree(process.cwd(), base, instance);
       if (worktreePath) {
@@ -707,12 +756,17 @@ if (!process.env.VITEST) {
 export {
   CODEX_AUTONOMOUS_BOOT_PROMPT,
   CODEX_BOOT_INSTRUCTIONS,
+  CODEX_PINNED_APPROVAL_POLICY,
+  CODEX_PINNED_SANDBOX_MODE,
   buildCodexBootPrompt,
+  buildCodexConstraintArgs,
   buildCodexLaunchArgs,
   buildCodexMcpProfileContent,
+  detectCodexExecFlags,
   detectCodexModelNotSupported,
   launchCodex,
   loadIdentity,
+  parseCodexSupportedFlags,
   readCodexUserConfig,
   resolveCodexMcpIdentity,
   resolveEffectiveCodexModel,

package/dist/bin/exe-start-opencode.js

@@ -1,21 +1,23 @@
 #!/usr/bin/env node
 import {
   exportBehaviorsForAgent
-} from "../chunk-XVRQZCTS.js";
-import "../chunk-WBKIU6UJ.js";
+} from "../chunk-C5FOA5GO.js";
+import "../chunk-XOTDAKJL.js";
+import "../chunk-MCXYNYZI.js";
 import "../chunk-VMJ2UH4S.js";
 import "../chunk-QGGH7LOU.js";
 import {
   disposeStore,
   initStore
-} from "../chunk-BQYQES2Z.js";
-import "../chunk-JLYHJJHU.js";
+} from "../chunk-ELY5WBZX.js";
+import "../chunk-FDA45THL.js";
 import "../chunk-CHCA3ZM2.js";
 import "../chunk-OTVEIJUQ.js";
-import "../chunk-WM7Y5ZV2.js";
+import "../chunk-5U4UJGTW.js";
 import "../chunk-5MOYSU5A.js";
 import "../chunk-4QCFFW2H.js";
 import "../chunk-76CJBM36.js";
+import "../chunk-PVWM2WMM.js";
 import "../chunk-BNHAZ65R.js";
 import "../chunk-RIECV7SR.js";
 import "../chunk-LNOS24GV.js";
@@ -24,11 +26,11 @@ import "../chunk-MP2AFCGL.js";
 import {
   baseAgentName,
   loadEmployeesSync
-} from "../chunk-HSBKV5LB.js";
+} from "../chunk-OBESOWFJ.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-Y7OK5PJE.js";
+import "../chunk-JDPV7W2L.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";
@@ -196,12 +198,12 @@ async function main() {
   })();
   process.env.AGENT_ROLE = empRole;
   try {
-    const { writeActiveAgent } = await import("../active-agent-R6Q7UEUD.js");
+    const { writeActiveAgent } = await import("../active-agent-RDTJGZHP.js");
     writeActiveAgent(memoryAgent, empRole);
   } catch {
   }
   try {
-    const { verifyOpenCodeHooks, runOpenCodeInstaller } = await import("../installer-UDRMFY75.js");
+    const { verifyOpenCodeHooks, runOpenCodeInstaller } = await import("../installer-EXR25DDG.js");
     if (!verifyOpenCodeHooks()) {
       process.stderr.write("[exe-start-opencode] hooks missing \u2014 registering now\n");
       await runOpenCodeInstaller();

package/dist/bin/exe-status.js

@@ -1,29 +1,29 @@
 #!/usr/bin/env node
 import {
   status
-} from "../chunk-NPND34FS.js";
-import "../chunk-JZBZI36P.js";
-import "../chunk-BTFDA3UJ.js";
-import "../chunk-QX33D4CH.js";
+} from "../chunk-GP3J3AOT.js";
+import "../chunk-GIO4VU4J.js";
+import "../chunk-I76LRCNA.js";
+import "../chunk-Y4AYNLXU.js";
 import "../chunk-BTSWFMEH.js";
-import "../chunk-6MCUXRIP.js";
-import "../chunk-7W6FDHHY.js";
-import "../chunk-IIVFXD6P.js";
+import "../chunk-P3PAD6AA.js";
+import "../chunk-KGPWS4KE.js";
+import "../chunk-KYVIV54Y.js";
 import "../chunk-WT4RI36X.js";
-import "../chunk-CX4MVEM3.js";
 import "../chunk-KI5PFRG6.js";
+import "../chunk-QAEWWYHL.js";
 import "../chunk-EIKATSE4.js";
 import "../chunk-E23LNUWJ.js";
-import "../chunk-QAEWWYHL.js";
-import "../chunk-XKFMNAJ7.js";
+import "../chunk-CSBD7QLZ.js";
 import "../chunk-GBNB4EWD.js";
 import "../chunk-UXLO7VHX.js";
 import "../chunk-DSOQUQTV.js";
-import "../chunk-UI3K73LD.js";
+import "../chunk-BFL3UB77.js";
 import "../chunk-AJIXH5JF.js";
+import "../chunk-PVWM2WMM.js";
 import "../chunk-XTWHNLGD.js";
 import "../chunk-AM7S2TY6.js";
-import "../chunk-N3JLNMPF.js";
+import "../chunk-PGF5I7EV.js";
 import "../chunk-CVYC6DUW.js";
 import "../chunk-ZVTKWWLV.js";
 import "../chunk-CDUB5Q6J.js";
@@ -35,20 +35,20 @@ import "../chunk-W2IRQJ6R.js";
 import "../chunk-HYZV25LY.js";
 import "../chunk-GJV3WDWM.js";
 import "../chunk-MP2AFCGL.js";
-import "../chunk-HSBKV5LB.js";
+import "../chunk-OBESOWFJ.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-Y7OK5PJE.js";
+import "../chunk-JDPV7W2L.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";
 import "../chunk-JY5GAZYC.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-WNBZJSQT.js";
-import "../chunk-F3PIHVVY.js";
+import "../chunk-6UZ3DEQI.js";
 import "../chunk-A7XLR3K7.js";
-import "../chunk-65ZSFW3O.js";
+import "../chunk-MQ5RUHNZ.js";
 import "../chunk-QILQ5FCG.js";
 import "../chunk-ARX6TAGN.js";
 import "../chunk-QMSEL5YS.js";

package/dist/bin/exe-support.js

@@ -4,12 +4,12 @@ import {
   main,
   runHealth,
   runTest
-} from "../chunk-JJRZE2LD.js";
+} from "../chunk-4GVJIMMK.js";
 import "../chunk-MMRUBN3I.js";
 import "../chunk-2XZ6X3PJ.js";
-import "../chunk-F3PIHVVY.js";
+import "../chunk-6UZ3DEQI.js";
 import "../chunk-A7XLR3K7.js";
-import "../chunk-65ZSFW3O.js";
+import "../chunk-MQ5RUHNZ.js";
 import "../chunk-QMSEL5YS.js";
 import "../chunk-HSGBZSCA.js";
 import "../chunk-JKKZGDLP.js";

package/dist/bin/exe-team.js

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import {
   shutdownCli
-} from "../chunk-JZBZI36P.js";
+} from "../chunk-GIO4VU4J.js";
 import {
   fastDbInit
-} from "../chunk-BTFDA3UJ.js";
+} from "../chunk-I76LRCNA.js";
 import {
   getClient,
   loadEmployees
-} from "../chunk-HSBKV5LB.js";
+} from "../chunk-OBESOWFJ.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-Y7OK5PJE.js";
+import "../chunk-JDPV7W2L.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";

package/dist/bin/exe-verify-running-images.js

@@ -7,6 +7,12 @@ import {
   isFirstPartyImage,
   normalizeVersion
 } from "../chunk-L25OAFOU.js";
+import {
+  compareLiveArtifacts,
+  declaredArtifactsFromManifest,
+  deliveryStateOf,
+  parseDigest
+} from "../chunk-W5MCOZTW.js";
 import "../chunk-MLKGABMK.js";
 
 // src/bin/exe-verify-running-images.ts
@@ -93,6 +99,82 @@ function inspectContainer(name) {
     labels: { [VERSION_LABEL]: clean(version), [REVISION_LABEL]: clean(revision) }
   };
 }
+function resolveRunningRef(containerName, configuredImage) {
+  const imageId = run("docker", ["inspect", containerName, "--format", "{{ .Image }}"]);
+  if (imageId.status !== 0) return configuredImage;
+  const id = imageId.stdout.trim();
+  if (!id) return configuredImage;
+  const digests = run("docker", ["inspect", id, "--format", "{{ json .RepoDigests }}"]);
+  if (digests.status !== 0) return configuredImage;
+  let list = [];
+  try {
+    const parsed = JSON.parse(digests.stdout.trim() || "[]");
+    if (Array.isArray(parsed)) list = parsed.filter((x) => typeof x === "string");
+  } catch {
+    return configuredImage;
+  }
+  if (list.length === 0) return configuredImage;
+  const configuredRepo = (configuredImage.split("@")[0] ?? "").replace(/:[^/:]+$/, "");
+  return list.find((d) => d.startsWith(`${configuredRepo}@`)) ?? list[0] ?? configuredImage;
+}
+function groupRunningArtifacts(entries) {
+  const byRef = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const existing = byRef.get(e.ref);
+    if (existing) {
+      existing.containers.push(e.container);
+      continue;
+    }
+    byRef.set(e.ref, { containers: [e.container], ref: e.ref, digest: parseDigest(e.ref) });
+  }
+  return [...byRef.values()];
+}
+function loadManifest(explicitPath) {
+  const candidates = explicitPath ? [explicitPath] : DEFAULT_MANIFESTS;
+  for (const candidate of candidates) {
+    if (!existsSync(candidate)) continue;
+    try {
+      return { manifest: JSON.parse(readFileSync(candidate, "utf8")), path: candidate };
+    } catch {
+    }
+  }
+  return void 0;
+}
+function loadDeclared(explicitPath) {
+  const loaded = loadManifest(explicitPath);
+  if (!loaded) return { declared: [], source: "no manifest found" };
+  try {
+    return { declared: declaredArtifactsFromManifest(loaded.manifest), source: loaded.path };
+  } catch {
+    return { declared: [], source: `${loaded.path} (unreadable stacks)` };
+  }
+}
+var VERDICT_ICON = {
+  agrees: "\u{1F7E2}",
+  disagrees: "\u{1F534}",
+  undeclared: "\u{1F7E0}",
+  "unknown-provenance": "\u{1F7E0}",
+  "not-running": "\u{1F7E0}"
+};
+function printLiveState(report) {
+  console.log(
+    `
+What is live \u2014 ${report.inventory.runningArtifacts} running artifact(s) vs ${report.inventory.declaredArtifacts} declared (${report.inventory.source})
+`
+  );
+  for (const e of report.entries) {
+    const icon = VERDICT_ICON[e.verdict] ?? "?";
+    console.log(`  ${icon} ${e.service.padEnd(22)} ${e.verdict}`);
+    if (e.running) console.log(`       running  ${e.running.digest ?? e.running.ref}  [${e.running.containers.join(", ")}]`);
+    if (e.declared) console.log(`       declared ${e.declared.digest ?? e.declared.ref}`);
+    if (e.verdict !== "agrees") console.log(`       ${e.detail}`);
+  }
+  console.log(
+    `
+  agrees: ${report.counts.agrees}  disagrees: ${report.counts.disagrees}  undeclared: ${report.counts.undeclared}  unknown-provenance: ${report.counts["unknown-provenance"]}  not-running: ${report.counts["not-running"]}
+`
+  );
+}
 function loadKnownVersions(explicitPath) {
   const candidates = explicitPath ? [explicitPath] : DEFAULT_MANIFESTS;
   for (const candidate of candidates) {
@@ -118,8 +200,33 @@ function main(argv) {
   const containers = names.map(inspectContainer).filter((c) => c !== void 0);
   const knownVersions = loadKnownVersions(manifestPath);
   const findings = findRunningImageIssues(containers, knownVersions);
+  const { declared, source } = loadDeclared(manifestPath);
+  const running = groupRunningArtifacts(
+    containers.map((c) => ({ container: c.name, ref: resolveRunningRef(c.name, c.image) }))
+  );
+  const liveState = compareLiveArtifacts(running, declared, {
+    source,
+    // A declared service with nothing running it is real information on a full
+    // stack host, and pure noise on a subset install. Reported only when the
+    // manifest was actually readable, and always as a finding the reader can
+    // dismiss — see limitation 4 in delivery-truth.ts.
+    reportNotRunning: declared.length > 0
+  });
   if (json) {
-    console.log(JSON.stringify({ ok: findings.length === 0, checked: containers.length, findings }, null, 2));
+    console.log(
+      JSON.stringify(
+        {
+          ok: findings.length === 0 && liveState.findings.length === 0,
+          checked: containers.length,
+          findings,
+          liveState,
+          // The contract the bug/task close gates should consume (#690/#694).
+          delivery: deliveryStateOf(liveState)
+        },
+        null,
+        2
+      )
+    );
   } else {
     console.log(`Running-image version assertion \u2014 inspected ${containers.length} container(s)`);
     if (knownVersions.size === 0) {
@@ -131,15 +238,27 @@ function main(argv) {
     for (const f of findings) {
       console.error(`  \u{1F534} [${f.kind}] ${f.message}`);
     }
+    if (declared.length === 0) {
+      console.log("  \u26A0\uFE0F  no declared artifacts readable \u2014 live-vs-declared comparison SKIPPED (this is not a pass)");
+    } else {
+      printLiveState(liveState);
+    }
   }
-  if (findings.length === 0) return 0;
+  const enforceable = liveState.findings.filter((f) => f.verdict !== "not-running");
+  const total = findings.length + enforceable.length;
+  if (total === 0) return 0;
   if (!enforce) {
     console.error(
-      `::warning::${findings.length} running-image finding(s) \u2014 WARN-first, not failing. Pass --enforce (or EXE_VERIFY_RUNNING_IMAGES_ENFORCE=1) to fail closed.`
+      `::warning::${findings.length} running-image finding(s) and ${liveState.findings.length} live-vs-declared finding(s) \u2014 WARN-first, not failing. Pass --enforce (or EXE_VERIFY_RUNNING_IMAGES_ENFORCE=1) to fail closed.`
     );
     return 0;
   }
-  console.error(`::error::${findings.length} running container(s) do not resolve to a known release.`);
+  for (const f of enforceable) {
+    console.error(`::error::[${f.verdict}] ${f.service}: ${f.detail}`);
+  }
+  console.error(
+    `::error::${total} finding(s): ${findings.length} container(s) do not resolve to a known release; ${enforceable.length} artifact(s) are not the artifact the signed manifest pins.`
+  );
   return 1;
 }
 process.exit(main(process.argv));