@askexenow/exe-os 0.9.37 → 0.9.38

package/dist/bin/cli.js

@@ -814,6 +814,7 @@ var installer_exports = {};
 __export(installer_exports, {
   cleanOldShellFunctions: () => cleanOldShellFunctions,
   copySlashCommands: () => copySlashCommands,
+  detectMcpNameCollisions: () => detectMcpNameCollisions,
   installStatusLine: () => installStatusLine,
   mergeHooks: () => mergeHooks,
   registerMcpServer: () => registerMcpServer,
@@ -899,6 +900,60 @@ name: ${skillName}
   await writeFile3(destPath, content);
   return true;
 }
+function readJsonFile(filePath) {
+  try {
+    return JSON.parse(readFileSync5(filePath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function findAncestorMcpJsons(startDir, homeDir) {
+  const files = [];
+  let dir = path6.resolve(startDir);
+  const root = path6.parse(dir).root;
+  const stop = path6.resolve(homeDir);
+  while (dir !== root) {
+    const candidate = path6.join(dir, ".mcp.json");
+    if (existsSync7(candidate)) files.push(candidate);
+    if (dir === stop) break;
+    dir = path6.dirname(dir);
+  }
+  return files;
+}
+function pathApplies(projectPath, cwd2) {
+  const project = path6.resolve(projectPath);
+  const current = path6.resolve(cwd2);
+  return current === project || current.startsWith(project + path6.sep);
+}
+function detectMcpNameCollisions(homeDir = os5.homedir(), cwd2 = process.cwd()) {
+  const claudeJsonPath = path6.join(homeDir, ".claude.json");
+  if (!existsSync7(claudeJsonPath)) return [];
+  const claudeJson = readJsonFile(claudeJsonPath);
+  if (!claudeJson?.projects) return [];
+  const collisions = [];
+  const mcpJsons = findAncestorMcpJsons(cwd2, homeDir);
+  if (mcpJsons.length === 0) return [];
+  for (const [projectPath, projectConfig] of Object.entries(claudeJson.projects)) {
+    if (!pathApplies(projectPath, cwd2)) continue;
+    const projectServerNames = new Set(Object.keys(projectConfig.mcpServers ?? {}));
+    if (projectServerNames.size === 0) continue;
+    const enabled = new Set(projectConfig.enabledMcpjsonServers ?? []);
+    for (const mcpJsonPath of mcpJsons) {
+      const mcpJson = readJsonFile(mcpJsonPath);
+      const mcpServerNames = Object.keys(mcpJson?.mcpServers ?? {});
+      for (const serverName of mcpServerNames) {
+        if (!projectServerNames.has(serverName)) continue;
+        collisions.push({
+          mcpJsonPath,
+          projectPath,
+          serverName,
+          disabledInMcpJson: !enabled.has(serverName)
+        });
+      }
+    }
+  }
+  return collisions;
+}
 async function registerMcpServer(packageRoot, homeDir = os5.homedir()) {
   const claudeJsonPath = path6.join(homeDir, ".claude.json");
   let claudeJson = {};
@@ -927,12 +982,26 @@ async function registerMcpServer(packageRoot, homeDir = os5.homedir()) {
   if (osMatches) {
     await cleanSettingsJsonMcp(path6.join(homeDir, ".claude", "settings.json"));
     await migratePermissionsToExeOs(path6.join(homeDir, ".claude", "settings.json"));
+    const collisions2 = detectMcpNameCollisions(homeDir, packageRoot).filter((c) => c.serverName === MCP_PRIMARY_KEY || c.serverName === MCP_LEGACY_KEY);
+    for (const c of collisions2) {
+      process.stderr.write(
+        `exe-os: WARNING Claude Code MCP name collision: ${c.serverName} exists in ${c.mcpJsonPath} and ~/.claude.json project ${c.projectPath}. Remove or rename the .mcp.json entry if tools do not surface.
+`
+      );
+    }
     return false;
   }
   claudeJson.mcpServers[MCP_PRIMARY_KEY] = newEntry;
   await writeFile3(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
   await cleanSettingsJsonMcp(path6.join(homeDir, ".claude", "settings.json"));
   await migratePermissionsToExeOs(path6.join(homeDir, ".claude", "settings.json"));
+  const collisions = detectMcpNameCollisions(homeDir, packageRoot).filter((c) => c.serverName === MCP_PRIMARY_KEY || c.serverName === MCP_LEGACY_KEY);
+  for (const c of collisions) {
+    process.stderr.write(
+      `exe-os: WARNING Claude Code MCP name collision: ${c.serverName} exists in ${c.mcpJsonPath} and ~/.claude.json project ${c.projectPath}. Remove or rename the .mcp.json entry if tools do not surface.
+`
+    );
+  }
   return true;
 }
 async function cleanSettingsJsonMcp(settingsPath) {
@@ -1234,8 +1303,6 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
     "purge_document",
     "rerank_documents",
     "set_document_importance",
-    "create_wiki_page",
-    "update_wiki_page",
     "get_wiki_page",
     "list_wiki_pages",
     // System
@@ -1773,8 +1840,8 @@ function deriveMachineKey() {
 }
 function readMachineId() {
   try {
-    const { readFileSync: readFileSync28 } = __require("fs");
-    return readFileSync28("/etc/machine-id", "utf-8").trim();
+    const { readFileSync: readFileSync30 } = __require("fs");
+    return readFileSync30("/etc/machine-id", "utf-8").trim();
   } catch {
     return "";
   }
@@ -7494,7 +7561,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 wiki, documents, and content",
         domain: "tool-use",
         priority: "p1",
-        content: "create_wiki_page: create a wiki page in exe-wiki. list_wiki_pages: browse wiki pages. get_wiki_page: read a wiki page. update_wiki_page: edit a wiki page. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
+        content: "wiki: read/list wiki pages only. Direct wiki write tools are removed; wiki updates flow through raw-data ingestion/projection into the curated wiki store. Legacy aliases: list_wiki_pages/get_wiki_page. crm: read/list/get CRM records from exe-db. raw_data: read capped raw landing-pad events from exe-db with payload opt-in. ingest_document: import a file (PDF, MD, etc.) into memory as chunks. list_documents: browse ingested documents by workspace. purge_document: remove a document and its memory chunks. set_document_importance: adjust chunk importance scores. rerank_documents: re-score document relevance for a query."
       },
       {
         title: "MCP tools \u2014 system, operations, and admin",
@@ -7512,7 +7579,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 advanced (triggers, skills, orchestration)",
         domain: "tool-use",
         priority: "p1",
-        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage Layer 0 procedures (actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
+        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage customer-owned company procedures (Layer 0; actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
       }
     ];
     PLATFORM_PROCEDURE_TITLES = new Set(
@@ -8994,9 +9061,9 @@ Unclassified: ${unclassified}
 }
 async function exportBatches(options) {
   const fs8 = await import("fs");
-  const path48 = await import("path");
+  const path49 = await import("path");
   const client = getClient();
-  const outDir = path48.join(process.cwd(), "exe/output/classifications/input");
+  const outDir = path49.join(process.cwd(), "exe/output/classifications/input");
   fs8.mkdirSync(outDir, { recursive: true });
   const countResult = await client.execute({
     sql: "SELECT COUNT(*) as cnt FROM memories WHERE intent IS NULL AND outcome IS NULL AND domain IS NULL",
@@ -9020,7 +9087,7 @@ async function exportBatches(options) {
       const text = String(row.text || "").replace(/\n/g, " ");
       return JSON.stringify({ id: row.id, text });
     });
-    const batchFile = path48.join(outDir, `batch-${String(batchNum).padStart(4, "0")}.jsonl`);
+    const batchFile = path49.join(outDir, `batch-${String(batchNum).padStart(4, "0")}.jsonl`);
     fs8.writeFileSync(batchFile, lines.join("\n") + "\n");
     exported += batch.rows.length;
     offset += options.batchSize;
@@ -9036,7 +9103,7 @@ async function exportBatches(options) {
 }
 async function importClassifications(importDir) {
   const fs8 = await import("fs");
-  const path48 = await import("path");
+  const path49 = await import("path");
   const client = getClient();
   const files = fs8.readdirSync(importDir).filter((f) => f.endsWith(".jsonl")).sort();
   process.stderr.write(`[backfill-metadata] Found ${files.length} JSONL files to import from ${importDir}
@@ -9044,7 +9111,7 @@ async function importClassifications(importDir) {
   let imported = 0;
   let invalid = 0;
   for (const file of files) {
-    const lines = fs8.readFileSync(path48.join(importDir, file), "utf-8").split("\n").filter(Boolean);
+    const lines = fs8.readFileSync(path49.join(importDir, file), "utf-8").split("\n").filter(Boolean);
     for (const line of lines) {
       try {
         const rec = JSON.parse(line);
@@ -11677,10 +11744,10 @@ async function disposeEmbedder() {
 async function embedDirect(text) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync34 } = await import("fs");
-  const path48 = await import("path");
-  const modelPath = path48.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync34(modelPath)) {
+  const { existsSync: existsSync35 } = await import("fs");
+  const path49 = await import("path");
+  const modelPath = path49.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync35(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -14583,6 +14650,8 @@ async function main2() {
     process.exit(1);
   }
   const [oldName, newName] = args2;
+  const { initStore: initStore2 } = await Promise.resolve().then(() => (init_store(), store_exports));
+  await initStore2({ lightweight: true });
   const result = await renameEmployee(oldName, newName);
   if (!result.success) {
     console.error(`Error: ${result.error}`);
@@ -16465,6 +16534,309 @@ var init_update = __esm({
   }
 });
 
+// src/lib/stack-update.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync25, renameSync as renameSync6, writeFileSync as writeFileSync20 } from "fs";
+import http from "http";
+import https from "https";
+import path37 from "path";
+function parseStackManifest(raw) {
+  const parsed = JSON.parse(raw);
+  if (parsed.schemaVersion !== 1) throw new Error("Unsupported stack manifest schemaVersion");
+  if (!parsed.latest || !parsed.stacks || typeof parsed.stacks !== "object") {
+    throw new Error("Invalid stack manifest: latest and stacks are required");
+  }
+  for (const [version, release] of Object.entries(parsed.stacks)) {
+    if (!release.version) release.version = version;
+    if (!release.services || typeof release.services !== "object") {
+      throw new Error(`Invalid stack manifest: release ${version} has no services`);
+    }
+    for (const [serviceName, service] of Object.entries(release.services)) {
+      if (!service.image || !service.env) {
+        throw new Error(`Invalid stack manifest: ${version}.${serviceName} requires image and env`);
+      }
+    }
+  }
+  return parsed;
+}
+async function loadStackManifest(ref, fetchText = defaultFetchText) {
+  if (/^https?:\/\//.test(ref)) return parseStackManifest(await fetchText(ref));
+  return parseStackManifest(readFileSync25(ref, "utf8"));
+}
+function parseEnv(raw) {
+  const env = /* @__PURE__ */ new Map();
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const idx = line.indexOf("=");
+    if (idx <= 0) continue;
+    env.set(line.slice(0, idx).trim(), line.slice(idx + 1));
+  }
+  return env;
+}
+function patchEnv(raw, updates) {
+  const seen = /* @__PURE__ */ new Set();
+  const lines = raw.replace(/\n$/, "").split(/\r?\n/);
+  const patched = lines.map((line) => {
+    const idx = line.indexOf("=");
+    if (idx <= 0 || line.trim().startsWith("#")) return line;
+    const key = line.slice(0, idx).trim();
+    if (!(key in updates)) return line;
+    seen.add(key);
+    return `${key}=${updates[key]}`;
+  });
+  for (const [key, value] of Object.entries(updates)) {
+    if (!seen.has(key)) patched.push(`${key}=${value}`);
+  }
+  return patched.join("\n").replace(/\n*$/, "\n");
+}
+function createStackUpdatePlan(manifest, envRaw, targetVersion) {
+  const version = targetVersion ?? manifest.latest;
+  const release = manifest.stacks[version];
+  if (!release) throw new Error(`Stack version ${version} not found in manifest`);
+  const env = parseEnv(envRaw);
+  const changes = [];
+  for (const [serviceName, service] of Object.entries(release.services)) {
+    const before = env.get(service.env);
+    if (before !== service.image) {
+      changes.push({ key: service.env, before, after: service.image, service: serviceName });
+    }
+  }
+  return {
+    manifest,
+    release,
+    targetVersion: version,
+    changes,
+    breakingChanges: release.breakingChanges ?? []
+  };
+}
+function assertBreakingChangesAllowed(plan, allowedIds) {
+  const required = plan.breakingChanges.filter((c) => c.requiresConfirmation !== false);
+  const missing = required.filter((c) => !allowedIds.includes(c.id));
+  if (missing.length > 0) {
+    const details = missing.map((c) => `- ${c.id}: ${c.title}
+  ${c.description}
+  Action: ${c.requiredAction ?? "Review release notes."}`).join("\n");
+    throw new Error(
+      `Stack ${plan.targetVersion} has breaking changes that require confirmation:
+${details}
+Re-run with --allow-breaking ${missing.map((c) => c.id).join(",")}`
+    );
+  }
+}
+async function runStackUpdate(options) {
+  const exec2 = options.exec ?? defaultExec;
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const manifest = await loadStackManifest(options.manifestRef, options.fetchText);
+  const envRaw = readFileSync25(options.envFile, "utf8");
+  const plan = createStackUpdatePlan(manifest, envRaw, options.targetVersion);
+  assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
+  const lockFile = options.lockFile ?? path37.join(path37.dirname(options.envFile), ".exe-stack-lock.json");
+  if (options.dryRun || plan.changes.length === 0) {
+    return { status: "planned", targetVersion: plan.targetVersion, changes: plan.changes, lockFile };
+  }
+  const backupDir = path37.join(path37.dirname(options.envFile), ".exe-stack-backups");
+  mkdirSync19(backupDir, { recursive: true });
+  const stamp = now().toISOString().replace(/[:.]/g, "-");
+  const backupEnvFile = path37.join(backupDir, `env-${stamp}.bak`);
+  writeFileSync20(backupEnvFile, envRaw, { mode: 384 });
+  const updates = Object.fromEntries(plan.changes.map((c) => [c.key, c.after]));
+  const patched = patchEnv(envRaw, updates);
+  const tmp = `${options.envFile}.tmp-${process.pid}`;
+  writeFileSync20(tmp, patched, { mode: 384 });
+  renameSync6(tmp, options.envFile);
+  const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
+  try {
+    exec2("docker", [...composeArgs, "pull"]);
+    exec2("docker", [...composeArgs, "up", "-d"]);
+    await verifyReleaseHealth(plan.release, options.healthRetries ?? 12, options.healthDelayMs ?? 5e3);
+    writeFileSync20(lockFile, JSON.stringify({ stackVersion: plan.targetVersion, updatedAt: now().toISOString(), services: plan.release.services }, null, 2) + "\n");
+    return { status: "updated", targetVersion: plan.targetVersion, changes: plan.changes, backupEnvFile, lockFile };
+  } catch (err) {
+    writeFileSync20(options.envFile, envRaw, { mode: 384 });
+    try {
+      exec2("docker", [...composeArgs, "up", "-d"]);
+    } catch {
+    }
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`Stack update failed and rollback was attempted: ${reason}`);
+  }
+}
+async function verifyReleaseHealth(release, retries, delayMs) {
+  for (const [serviceName, service] of Object.entries(release.services)) {
+    if (!service.healthUrl) continue;
+    await waitForHttpOk(service.healthUrl, retries, delayMs, serviceName);
+  }
+}
+async function waitForHttpOk(url, retries, delayMs, label) {
+  let last = "";
+  for (let i = 0; i < retries; i++) {
+    try {
+      const status = await httpStatus(url);
+      if (status >= 200 && status < 300) return;
+      last = `HTTP ${status}`;
+    } catch (err) {
+      last = err instanceof Error ? err.message : String(err);
+    }
+    if (i < retries - 1) await new Promise((resolve) => setTimeout(resolve, delayMs));
+  }
+  throw new Error(`Health check failed for ${label} (${url}): ${last}`);
+}
+function httpStatus(urlString) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(urlString);
+    const mod = url.protocol === "https:" ? https : http;
+    const req = mod.request(url, { method: "GET", timeout: 5e3 }, (res) => {
+      res.resume();
+      resolve(res.statusCode ?? 0);
+    });
+    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("error", reject);
+    req.end();
+  });
+}
+function defaultExec(cmd, args2, opts) {
+  execFileSync3(cmd, args2, { stdio: "inherit", cwd: opts?.cwd });
+}
+async function defaultFetchText(ref) {
+  const res = await fetch(ref);
+  if (!res.ok) throw new Error(`Failed to fetch ${ref}: HTTP ${res.status}`);
+  return res.text();
+}
+function defaultStackPaths() {
+  const cwdCompose = path37.resolve("docker-compose.yml");
+  const cwdEnv = path37.resolve(".env");
+  return {
+    composeFile: process.env.EXE_STACK_COMPOSE_FILE || (existsSync30(cwdCompose) ? cwdCompose : "/opt/exe-stack/docker-compose.yml"),
+    envFile: process.env.EXE_STACK_ENV_FILE || (existsSync30(cwdEnv) ? cwdEnv : "/opt/exe-stack/.env"),
+    manifestRef: process.env.EXE_STACK_MANIFEST || "https://updates.askexe.com/stack-manifest.json"
+  };
+}
+var init_stack_update = __esm({
+  "src/lib/stack-update.ts"() {
+    "use strict";
+  }
+});
+
+// src/bin/stack-update.ts
+var stack_update_exports = {};
+__export(stack_update_exports, {
+  runStackUpdateCli: () => main3
+});
+import { readFileSync as readFileSync26 } from "fs";
+function parseArgs4(args2) {
+  const defaults = defaultStackPaths();
+  const opts = {
+    manifestRef: defaults.manifestRef,
+    composeFile: defaults.composeFile,
+    envFile: defaults.envFile,
+    dryRun: false,
+    check: false,
+    yes: false,
+    allowedBreakingChangeIds: []
+  };
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    const next = () => args2[++i] ?? "";
+    if (arg === "--manifest") opts.manifestRef = next();
+    else if (arg.startsWith("--manifest=")) opts.manifestRef = arg.split("=").slice(1).join("=");
+    else if (arg === "--target") opts.targetVersion = next();
+    else if (arg.startsWith("--target=")) opts.targetVersion = arg.split("=")[1];
+    else if (arg === "--compose-file") opts.composeFile = next();
+    else if (arg.startsWith("--compose-file=")) opts.composeFile = arg.split("=").slice(1).join("=");
+    else if (arg === "--env-file") opts.envFile = next();
+    else if (arg.startsWith("--env-file=")) opts.envFile = arg.split("=").slice(1).join("=");
+    else if (arg === "--lock-file") opts.lockFile = next();
+    else if (arg === "--dry-run") opts.dryRun = true;
+    else if (arg === "--check") opts.check = true;
+    else if (arg === "--yes" || arg === "-y") opts.yes = true;
+    else if (arg === "--allow-breaking") opts.allowedBreakingChangeIds.push(...next().split(",").map((s) => s.trim()).filter(Boolean));
+    else if (arg.startsWith("--allow-breaking=")) opts.allowedBreakingChangeIds.push(...arg.split("=")[1].split(",").map((s) => s.trim()).filter(Boolean));
+    else if (arg === "--help" || arg === "-h") {
+      printHelp();
+      process.exit(0);
+    } else {
+      throw new Error(`Unknown option: ${arg}`);
+    }
+  }
+  return opts;
+}
+function printHelp() {
+  console.log(`exe-os stack-update \u2014 update a self-hosted Exe OS stack from a pinned manifest
+
+Usage:
+  exe-os stack-update [--manifest <path-or-url>] [--target <version>] [--yes]
+
+Options:
+  --manifest <ref>           Stack manifest JSON path or URL (default: updates.askexe.com)
+  --target <version>         Stack version to install (default: manifest.latest)
+  --compose-file <path>      docker-compose.yml path (default: ./docker-compose.yml or /opt/exe-stack/docker-compose.yml)
+  --env-file <path>          .env path (default: ./.env or /opt/exe-stack/.env)
+  --lock-file <path>         Lock file path (default: beside .env)
+  --check                    Print available changes only
+  --dry-run                  Plan only; do not run Docker
+  --allow-breaking <ids>     Confirm breaking changes, comma-separated
+  -y, --yes                  Non-interactive confirmation
+`);
+}
+function printChanges(changes) {
+  if (changes.length === 0) {
+    console.log("\u2705 Stack already matches target manifest.");
+    return;
+  }
+  console.log("Planned image tag changes:");
+  for (const c of changes) {
+    console.log(`  - ${c.service}: ${c.key}`);
+    console.log(`      ${c.before ?? "<unset>"} \u2192 ${c.after}`);
+  }
+}
+function printBreaking(changes) {
+  if (changes.length === 0) return;
+  console.log("\nBreaking-change notices:");
+  for (const c of changes) {
+    console.log(`  - ${c.id}: ${c.title}`);
+    console.log(`    ${c.description}`);
+    if (c.requiredAction) console.log(`    Action: ${c.requiredAction}`);
+    if (c.expectedDowntimeMinutes) console.log(`    Expected downtime: ${c.expectedDowntimeMinutes} minutes`);
+  }
+}
+async function main3() {
+  const opts = parseArgs4(process.argv.slice(2));
+  const manifest = await loadStackManifest(opts.manifestRef);
+  const envRaw = readFileSync26(opts.envFile, "utf8");
+  const plan = createStackUpdatePlan(manifest, envRaw, opts.targetVersion);
+  console.log(`Exe OS stack target: ${plan.targetVersion}`);
+  console.log(`Manifest: ${opts.manifestRef}`);
+  console.log(`Compose:  ${opts.composeFile}`);
+  console.log(`Env:      ${opts.envFile}
+`);
+  printChanges(plan.changes);
+  printBreaking(plan.breakingChanges);
+  if (opts.check || opts.dryRun) return;
+  if (!opts.yes) {
+    console.error("\nRefusing to update without --yes. Re-run with --yes after reviewing the plan.");
+    process.exit(2);
+  }
+  const result = await runStackUpdate(opts);
+  console.log(`
+\u2705 Stack ${result.status}: ${result.targetVersion}`);
+  if (result.backupEnvFile) console.log(`Backup env: ${result.backupEnvFile}`);
+  console.log(`Lock file: ${result.lockFile}`);
+}
+var init_stack_update2 = __esm({
+  "src/bin/stack-update.ts"() {
+    "use strict";
+    init_is_main();
+    init_stack_update();
+    if (isMainModule(import.meta.url)) {
+      main3().catch((err) => {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      });
+    }
+  }
+});
+
 // node_modules/es-toolkit/dist/function/debounce.mjs
 function debounce(func, debounceMs, { signal, edges } = {}) {
   let pendingThis = void 0;
@@ -18266,7 +18638,7 @@ var init_src = __esm({
 
 // node_modules/terminal-size/index.js
 import process2 from "process";
-import { execFileSync as execFileSync3 } from "child_process";
+import { execFileSync as execFileSync4 } from "child_process";
 import fs from "fs";
 import tty from "tty";
 function terminalSize() {
@@ -18298,7 +18670,7 @@ var init_terminal_size = __esm({
     "use strict";
     defaultColumns = 80;
     defaultRows = 24;
-    exec = (command, arguments_, { shell, env } = {}) => execFileSync3(command, arguments_, {
+    exec = (command, arguments_, { shell, env } = {}) => execFileSync4(command, arguments_, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 500,
@@ -20823,8 +21195,8 @@ var init_ErrorOverview = __esm({
     "use strict";
     init_Box();
     init_Text();
-    cleanupPath = (path48) => {
-      return path48?.replace(`file://${cwd()}/`, "");
+    cleanupPath = (path49) => {
+      return path49?.replace(`file://${cwd()}/`, "");
     };
     stackUtils = new StackUtils({
       cwd: cwd(),
@@ -23232,11 +23604,11 @@ function Footer() {
       } catch {
       }
       try {
-        const { existsSync: existsSync34 } = await import("fs");
+        const { existsSync: existsSync35 } = await import("fs");
         const { join } = await import("path");
         const home = process.env.HOME ?? "";
         const pidPath = join(home, ".exe-os", "exed.pid");
-        setDaemon(existsSync34(pidPath) ? "running" : "stopped");
+        setDaemon(existsSync35(pidPath) ? "running" : "stopped");
       } catch {
         setDaemon("unknown");
       }
@@ -25287,10 +25659,10 @@ var init_hooks = __esm({
 });
 
 // src/runtime/safety-checks.ts
-import path37 from "path";
+import path38 from "path";
 import os18 from "os";
 function checkPathSafety(filePath) {
-  const resolved = path37.resolve(filePath);
+  const resolved = path38.resolve(filePath);
   for (const { pattern, reason } of BYPASS_IMMUNE_PATTERNS) {
     const matches = typeof pattern === "function" ? pattern(resolved) : pattern.test(resolved);
     if (matches) {
@@ -25300,7 +25672,7 @@ function checkPathSafety(filePath) {
   return { safe: true, bypassImmune: true };
 }
 function checkReadPathSafety(filePath) {
-  const resolved = path37.resolve(filePath);
+  const resolved = path38.resolve(filePath);
   const credPatterns = BYPASS_IMMUNE_PATTERNS.filter(
     (p) => typeof p.pattern !== "function" && (p.reason.includes("secrets") || p.reason.includes("Private key") || p.reason.includes("Credential"))
   );
@@ -25326,11 +25698,11 @@ var init_safety_checks = __esm({
         reason: "Git config can set hooks and command execution"
       },
       {
-        pattern: (p) => p.startsWith(path37.join(HOME, ".claude")),
+        pattern: (p) => p.startsWith(path38.join(HOME, ".claude")),
         reason: "Claude configuration files are protected"
       },
       {
-        pattern: (p) => p.startsWith(path37.join(HOME, ".exe-os")),
+        pattern: (p) => p.startsWith(path38.join(HOME, ".exe-os")),
         reason: "exe-os configuration files are protected"
       },
       {
@@ -25347,7 +25719,7 @@ var init_safety_checks = __esm({
       },
       {
         pattern: (p) => {
-          const name = path37.basename(p);
+          const name = path38.basename(p);
           return [".bashrc", ".zshrc", ".profile", ".bash_profile", ".zprofile", ".zshenv"].includes(name);
         },
         reason: "Shell configuration files can execute arbitrary code on login"
@@ -25374,7 +25746,7 @@ __export(file_read_exports, {
   FileReadTool: () => FileReadTool
 });
 import fs3 from "fs/promises";
-import path38 from "path";
+import path39 from "path";
 import { z } from "zod";
 function isBinary(buf) {
   for (let i = 0; i < buf.length; i++) {
@@ -25410,7 +25782,7 @@ var init_file_read = __esm({
         return { behavior: "allow" };
       },
       async call(input, context) {
-        const filePath = path38.isAbsolute(input.file_path) ? input.file_path : path38.resolve(context.cwd, input.file_path);
+        const filePath = path39.isAbsolute(input.file_path) ? input.file_path : path39.resolve(context.cwd, input.file_path);
         let stat2;
         try {
           stat2 = await fs3.stat(filePath);
@@ -25450,7 +25822,7 @@ __export(glob_exports, {
   GlobTool: () => GlobTool
 });
 import fs4 from "fs/promises";
-import path39 from "path";
+import path40 from "path";
 import { z as z2 } from "zod";
 async function walkDir(dir, maxDepth = 10) {
   const results = [];
@@ -25466,7 +25838,7 @@ async function walkDir(dir, maxDepth = 10) {
       if (entry.isDirectory() && (entry.name === "node_modules" || entry.name === ".git")) {
         continue;
       }
-      const fullPath = path39.join(current, entry.name);
+      const fullPath = path40.join(current, entry.name);
       if (entry.isDirectory()) {
         await walk(fullPath, depth + 1);
       } else {
@@ -25500,11 +25872,11 @@ var init_glob = __esm({
       inputSchema: inputSchema2,
       isReadOnly: true,
       async call(input, context) {
-        const baseDir = input.path ? path39.isAbsolute(input.path) ? input.path : path39.resolve(context.cwd, input.path) : context.cwd;
+        const baseDir = input.path ? path40.isAbsolute(input.path) ? input.path : path40.resolve(context.cwd, input.path) : context.cwd;
         try {
           const entries = await walkDir(baseDir);
           const matched = entries.filter(
-            (e) => simpleGlobMatch(path39.relative(baseDir, e.path), input.pattern)
+            (e) => simpleGlobMatch(path40.relative(baseDir, e.path), input.pattern)
           );
           matched.sort((a, b) => b.mtime - a.mtime);
           if (matched.length === 0) {
@@ -25530,7 +25902,7 @@ __export(grep_exports, {
 });
 import { spawn as spawn2 } from "child_process";
 import fs5 from "fs/promises";
-import path40 from "path";
+import path41 from "path";
 import { z as z3 } from "zod";
 function runRipgrep(input, searchPath, context) {
   return new Promise((resolve, reject) => {
@@ -25584,7 +25956,7 @@ async function nodeGrep(input, searchPath) {
     }
     for (const entry of entries) {
       if (entry.name === "node_modules" || entry.name === ".git") continue;
-      const fullPath = path40.join(dir, entry.name);
+      const fullPath = path41.join(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(fullPath);
       } else {
@@ -25630,7 +26002,7 @@ var init_grep = __esm({
       inputSchema: inputSchema3,
       isReadOnly: true,
       async call(input, context) {
-        const searchPath = input.path ? path40.isAbsolute(input.path) ? input.path : path40.resolve(context.cwd, input.path) : context.cwd;
+        const searchPath = input.path ? path41.isAbsolute(input.path) ? input.path : path41.resolve(context.cwd, input.path) : context.cwd;
         try {
           const result = await runRipgrep(input, searchPath, context);
           return result;
@@ -25655,7 +26027,7 @@ __export(file_write_exports, {
   FileWriteTool: () => FileWriteTool
 });
 import fs6 from "fs/promises";
-import path41 from "path";
+import path42 from "path";
 import { z as z4 } from "zod";
 var inputSchema4, FileWriteTool;
 var init_file_write = __esm({
@@ -25683,8 +26055,8 @@ var init_file_write = __esm({
         return { behavior: "allow" };
       },
       async call(input, context) {
-        const filePath = path41.isAbsolute(input.file_path) ? input.file_path : path41.resolve(context.cwd, input.file_path);
-        const dir = path41.dirname(filePath);
+        const filePath = path42.isAbsolute(input.file_path) ? input.file_path : path42.resolve(context.cwd, input.file_path);
+        const dir = path42.dirname(filePath);
         await fs6.mkdir(dir, { recursive: true });
         await fs6.writeFile(filePath, input.content, "utf-8");
         return {
@@ -25702,7 +26074,7 @@ __export(file_edit_exports, {
   FileEditTool: () => FileEditTool
 });
 import fs7 from "fs/promises";
-import path42 from "path";
+import path43 from "path";
 import { z as z5 } from "zod";
 function countOccurrences(haystack, needle) {
   let count = 0;
@@ -25743,7 +26115,7 @@ var init_file_edit = __esm({
         return { behavior: "allow" };
       },
       async call(input, context) {
-        const filePath = path42.isAbsolute(input.file_path) ? input.file_path : path42.resolve(context.cwd, input.file_path);
+        const filePath = path43.isAbsolute(input.file_path) ? input.file_path : path43.resolve(context.cwd, input.file_path);
         let content;
         try {
           content = await fs7.readFile(filePath, "utf-8");
@@ -25985,7 +26357,7 @@ var init_bash = __esm({
 // src/tui/views/CommandCenter.tsx
 import { useState as useState6, useEffect as useEffect8, useMemo as useMemo4, useCallback as useCallback4, useRef as useRef4 } from "react";
 import TextInput from "ink-text-input";
-import path43 from "path";
+import path44 from "path";
 import { homedir as homedir6 } from "os";
 import { Fragment as Fragment2, jsx as jsx7, jsxs as jsxs5 } from "react/jsx-runtime";
 function CommandCenterView({
@@ -26020,15 +26392,15 @@ function CommandCenterView({
         const { createPermissionsFromPreset: createPermissionsFromPreset2, EMPLOYEE_PERMISSIONS: EMPLOYEE_PERMISSIONS2 } = await Promise.resolve().then(() => (init_permissions(), permissions_exports));
         const { getPresetByRole: getPresetByRole2 } = await Promise.resolve().then(() => (init_permission_presets(), permission_presets_exports));
         const { createDefaultHooks: createDefaultHooks2 } = await Promise.resolve().then(() => (init_hooks(), hooks_exports));
-        const { readFileSync: readFileSync28, existsSync: existsSync34 } = await import("fs");
+        const { readFileSync: readFileSync30, existsSync: existsSync35 } = await import("fs");
         const { join } = await import("path");
         const { homedir: homedir8 } = await import("os");
         const configPath = join(homedir8(), ".exe-os", "config.json");
         let failoverChain = ["anthropic", "opencode", "gemini", "openai"];
         let providerConfigs = {};
-        if (existsSync34(configPath)) {
+        if (existsSync35(configPath)) {
           try {
-            const raw = JSON.parse(readFileSync28(configPath, "utf8"));
+            const raw = JSON.parse(readFileSync30(configPath, "utf8"));
             if (Array.isArray(raw.failoverChain)) failoverChain = raw.failoverChain;
             if (raw.providers && typeof raw.providers === "object") {
               providerConfigs = raw.providers;
@@ -26089,7 +26461,7 @@ function CommandCenterView({
           const markerDir = join(homedir8(), ".exe-os", "session-cache");
           const agentFiles = (await import("fs")).readdirSync(markerDir).filter((f) => f.startsWith("active-agent-"));
           for (const f of agentFiles) {
-            const data = JSON.parse(readFileSync28(join(markerDir, f), "utf8"));
+            const data = JSON.parse(readFileSync30(join(markerDir, f), "utf8"));
             if (data.agentRole) {
               agentRole = data.agentRole;
               break;
@@ -26234,7 +26606,7 @@ function CommandCenterView({
       const demoEntries = DEMO_PROJECTS.map((p) => ({
         projectName: p.projectName,
         exeSession: p.exeSession,
-        projectDir: path43.join(homedir6(), p.projectName),
+        projectDir: path44.join(homedir6(), p.projectName),
         employeeCount: p.employees.length,
         activeCount: p.employees.filter((e) => e.status === "active").length,
         memoryCount: p.employees.length * 4e3,
@@ -26272,7 +26644,7 @@ function CommandCenterView({
         const { listSessions: listSessions2 } = await Promise.resolve().then(() => (init_session_registry(), session_registry_exports));
         const { listTmuxSessions: listTmuxSessions2, inTmux: inTmux2 } = await Promise.resolve().then(() => (init_tmux_status(), tmux_status_exports));
         const { loadEmployees: loadEmployees2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
-        const { existsSync: existsSync34 } = await import("fs");
+        const { existsSync: existsSync35 } = await import("fs");
         const { join } = await import("path");
         const client = getClient2();
         if (!client) {
@@ -26343,7 +26715,7 @@ function CommandCenterView({
           }
           const memoryCount = memoryCounts.get(name) ?? 0;
           const openTaskCount = openTaskCounts.get(name) ?? 0;
-          const hasGit = projectDir ? existsSync34(join(projectDir, ".git")) : false;
+          const hasGit = projectDir ? existsSync35(join(projectDir, ".git")) : false;
           const type = hasGit ? "code" : memoryCount > 0 ? "code" : "automation";
           projectList.push({
             projectName: name,
@@ -26368,7 +26740,7 @@ function CommandCenterView({
         setHealth((h) => ({ ...h, memories: Number(totalResult.rows[0]?.cnt ?? 0) }));
         try {
           const pidPath = join(process.env.HOME ?? "", ".exe-os", "exed.pid");
-          setHealth((h) => ({ ...h, daemon: existsSync34(pidPath) ? "running" : "stopped" }));
+          setHealth((h) => ({ ...h, daemon: existsSync35(pidPath) ? "running" : "stopped" }));
         } catch {
         }
         const activityResult = await client.execute(
@@ -27238,7 +27610,7 @@ var init_useOrchestrator = __esm({
 
 // src/tui/views/Sessions.tsx
 import React19, { useState as useState9, useEffect as useEffect11, useCallback as useCallback6 } from "react";
-import path44 from "path";
+import path45 from "path";
 import { homedir as homedir7 } from "os";
 import { jsx as jsx9, jsxs as jsxs7 } from "react/jsx-runtime";
 function isCoordinatorEntry(entry) {
@@ -27276,7 +27648,7 @@ function SessionsView({
     if (demo) {
       setProjects(DEMO_PROJECTS.map((p) => ({
         ...p,
-        projectDir: path44.join(homedir7(), p.projectName),
+        projectDir: path45.join(homedir7(), p.projectName),
         employees: p.employees.map((e) => ({ ...e, attached: e.status === "active" }))
       })));
       return;
@@ -28491,12 +28863,12 @@ async function loadGatewayConfig() {
     state.running = false;
   }
   try {
-    const { existsSync: existsSync34, readFileSync: readFileSync28 } = await import("fs");
+    const { existsSync: existsSync35, readFileSync: readFileSync30 } = await import("fs");
     const { join } = await import("path");
     const home = process.env.HOME ?? "";
     const configPath = join(home, ".exe-os", "gateway.json");
-    if (existsSync34(configPath)) {
-      const raw = JSON.parse(readFileSync28(configPath, "utf8"));
+    if (existsSync35(configPath)) {
+      const raw = JSON.parse(readFileSync30(configPath, "utf8"));
       state.port = raw.port ?? 3100;
       state.gatewayUrl = raw.gatewayUrl ?? "";
       if (raw.adapters) {
@@ -29094,12 +29466,12 @@ function TeamView({ onBack, onViewSessions }) {
         setMembers(teamData);
         setDbError(null);
         try {
-          const { existsSync: existsSync34, readFileSync: readFileSync28 } = await import("fs");
+          const { existsSync: existsSync35, readFileSync: readFileSync30 } = await import("fs");
           const { join } = await import("path");
           const home = process.env.HOME ?? "";
           const gatewayConfig = join(home, ".exe-os", "gateway.json");
-          if (existsSync34(gatewayConfig)) {
-            const raw = JSON.parse(readFileSync28(gatewayConfig, "utf8"));
+          if (existsSync35(gatewayConfig)) {
+            const raw = JSON.parse(readFileSync30(gatewayConfig, "utf8"));
             if (raw.agents && raw.agents.length > 0) {
               setExternals(raw.agents.map((a) => ({
                 name: a.name,
@@ -29279,8 +29651,8 @@ __export(wiki_client_exports, {
   listDocuments: () => listDocuments,
   listWorkspaces: () => listWorkspaces
 });
-async function wikiFetch(config, path48, method = "GET", body) {
-  const url = `${config.baseUrl}/api/v1${path48}`;
+async function wikiFetch(config, path49, method = "GET", body) {
+  const url = `${config.baseUrl}/api/v1${path49}`;
   const headers = {
     Authorization: `Bearer ${config.apiKey}`,
     "Content-Type": "application/json"
@@ -29313,7 +29685,7 @@ async function wikiFetch(config, path48, method = "GET", body) {
       }
     }
     if (!response.ok) {
-      throw new Error(`Wiki API ${method} ${path48}: ${response.status} ${response.statusText}`);
+      throw new Error(`Wiki API ${method} ${path49}: ${response.status} ${response.statusText}`);
     }
     return response.json();
   } finally {
@@ -29907,12 +30279,12 @@ function SettingsView({ onBack }) {
     }
     setProviders(providerList);
     try {
-      const { existsSync: existsSync34 } = await import("fs");
+      const { existsSync: existsSync35 } = await import("fs");
       const { join } = await import("path");
       const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
       const cfg = await loadConfig2();
       const home = process.env.HOME ?? "";
-      const hasKey = existsSync34(join(home, ".exe-os", "master.key"));
+      const hasKey = existsSync35(join(home, ".exe-os", "master.key"));
       if (cfg.cloud) {
         setCloud({
           configured: true,
@@ -29925,22 +30297,22 @@ function SettingsView({ onBack }) {
       const pidPath = join(home, ".exe-os", "exed.pid");
       let daemon = "unknown";
       try {
-        daemon = existsSync34(pidPath) ? "running" : "stopped";
+        daemon = existsSync35(pidPath) ? "running" : "stopped";
       } catch {
       }
       let version = "unknown";
       try {
-        const { readFileSync: readFileSync28 } = await import("fs");
+        const { readFileSync: readFileSync30 } = await import("fs");
         const { createRequire: createRequire3 } = await import("module");
         const require2 = createRequire3(import.meta.url);
         const pkgPath = require2.resolve("@askexenow/exe-os/package.json");
-        const pkg = JSON.parse(readFileSync28(pkgPath, "utf8"));
+        const pkg = JSON.parse(readFileSync30(pkgPath, "utf8"));
         version = pkg.version;
       } catch {
         try {
-          const { readFileSync: readFileSync28 } = await import("fs");
+          const { readFileSync: readFileSync30 } = await import("fs");
           const { join: joinPath } = await import("path");
-          const pkg = JSON.parse(readFileSync28(joinPath(process.cwd(), "package.json"), "utf8"));
+          const pkg = JSON.parse(readFileSync30(joinPath(process.cwd(), "package.json"), "utf8"));
           version = pkg.version;
         } catch {
         }
@@ -30741,15 +31113,15 @@ __export(installer_exports2, {
   verifyOpenCodeHooks: () => verifyOpenCodeHooks
 });
 import { readFile as readFile7, writeFile as writeFile8, mkdir as mkdir8 } from "fs/promises";
-import { existsSync as existsSync31, readFileSync as readFileSync26 } from "fs";
-import path45 from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync28 } from "fs";
+import path46 from "path";
 import os19 from "os";
 async function registerOpenCodeMcp(packageRoot, homeDir = os19.homedir()) {
-  const configDir = path45.join(homeDir, ".config", "opencode");
-  const configPath = path45.join(configDir, "opencode.json");
+  const configDir = path46.join(homeDir, ".config", "opencode");
+  const configPath = path46.join(configDir, "opencode.json");
   await mkdir8(configDir, { recursive: true });
   let config = {};
-  if (existsSync31(configPath)) {
+  if (existsSync32(configPath)) {
     try {
       config = JSON.parse(await readFile7(configPath, "utf-8"));
     } catch {
@@ -30761,7 +31133,7 @@ async function registerOpenCodeMcp(packageRoot, homeDir = os19.homedir()) {
   }
   const newEntry = {
     type: "local",
-    command: ["node", path45.join(packageRoot, "dist", "mcp", "server.js")],
+    command: ["node", path46.join(packageRoot, "dist", "mcp", "server.js")],
     enabled: true
   };
   const current = config.mcp["exe-os"];
@@ -30776,14 +31148,14 @@ async function registerOpenCodeMcp(packageRoot, homeDir = os19.homedir()) {
   return true;
 }
 async function installOpenCodePlugin(packageRoot, homeDir = os19.homedir()) {
-  const pluginDir = path45.join(homeDir, ".config", "opencode", "plugins");
-  const pluginPath = path45.join(pluginDir, "exe-os.mjs");
+  const pluginDir = path46.join(homeDir, ".config", "opencode", "plugins");
+  const pluginPath = path46.join(pluginDir, "exe-os.mjs");
   await mkdir8(pluginDir, { recursive: true });
   const pluginContent = PLUGIN_TEMPLATE.replace(
     /__PACKAGE_ROOT__/g,
     packageRoot.replace(/\\/g, "\\\\")
   );
-  if (existsSync31(pluginPath)) {
+  if (existsSync32(pluginPath)) {
     const existing = await readFile7(pluginPath, "utf-8");
     if (existing === pluginContent) {
       return false;
@@ -30793,16 +31165,16 @@ async function installOpenCodePlugin(packageRoot, homeDir = os19.homedir()) {
   return true;
 }
 function verifyOpenCodeHooks(homeDir = os19.homedir()) {
-  const configPath = path45.join(homeDir, ".config", "opencode", "opencode.json");
-  const pluginPath = path45.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
-  if (!existsSync31(configPath)) return false;
+  const configPath = path46.join(homeDir, ".config", "opencode", "opencode.json");
+  const pluginPath = path46.join(homeDir, ".config", "opencode", "plugins", "exe-os.mjs");
+  if (!existsSync32(configPath)) return false;
   try {
-    const config = JSON.parse(readFileSync26(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync28(configPath, "utf-8"));
     if (!config.mcp?.["exe-os"]?.enabled) return false;
   } catch {
     return false;
   }
-  if (!existsSync31(pluginPath)) return false;
+  if (!existsSync32(pluginPath)) return false;
   return true;
 }
 async function runOpenCodeInstaller(homeDir) {
@@ -30837,19 +31209,19 @@ __export(installer_exports3, {
   verifyCodexHooks: () => verifyCodexHooks
 });
 import { readFile as readFile8, writeFile as writeFile9, mkdir as mkdir9 } from "fs/promises";
-import { existsSync as existsSync32 } from "fs";
-import path46 from "path";
+import { existsSync as existsSync33 } from "fs";
+import path47 from "path";
 import os20 from "os";
 async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
-  const codexDir = path46.join(homeDir, ".codex");
-  const hooksPath = path46.join(codexDir, "hooks.json");
-  const logsDir = path46.join(homeDir, ".exe-os", "logs");
-  const hookLogPath = path46.join(logsDir, "hooks.log");
+  const codexDir = path47.join(homeDir, ".codex");
+  const hooksPath = path47.join(codexDir, "hooks.json");
+  const logsDir = path47.join(homeDir, ".exe-os", "logs");
+  const hookLogPath = path47.join(logsDir, "hooks.log");
   const logSuffix = ` 2>> "${hookLogPath}"`;
   await mkdir9(codexDir, { recursive: true });
   await mkdir9(logsDir, { recursive: true });
   let hooksJson = {};
-  if (existsSync32(hooksPath)) {
+  if (existsSync33(hooksPath)) {
     try {
       hooksJson = JSON.parse(await readFile8(hooksPath, "utf-8"));
     } catch {
@@ -30866,7 +31238,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path46.join(packageRoot, "dist", "hooks", "session-start.js")}"${logSuffix}`,
+            command: `node "${path47.join(packageRoot, "dist", "hooks", "session-start.js")}"${logSuffix}`,
             timeout: 30
           }
         ]
@@ -30882,7 +31254,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
             // Combined hook: runs ingest + error-recall in one Node process.
             // Eliminates a cold-start cycle per tool call (~3-6s savings on Codex).
             type: "command",
-            command: `node "${path46.join(packageRoot, "dist", "hooks", "post-tool-combined.js")}"${logSuffix}`
+            command: `node "${path47.join(packageRoot, "dist", "hooks", "post-tool-combined.js")}"${logSuffix}`
           }
         ]
       },
@@ -30896,7 +31268,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
             // Single hook: prompt-submit handles memory retrieval + entity boost.
             // exe-heartbeat-hook is CC-specific (intercom) — omitted on Codex.
             type: "command",
-            command: `node "${path46.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
+            command: `node "${path47.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
           }
         ]
       },
@@ -30908,7 +31280,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path46.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
+            command: `node "${path47.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
           }
         ]
       },
@@ -30921,7 +31293,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path46.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
+            command: `node "${path47.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
           }
         ]
       },
@@ -30953,8 +31325,8 @@ async function mergeCodexHooks(packageRoot, homeDir = os20.homedir()) {
   return { added, skipped };
 }
 function verifyCodexHooks(homeDir = os20.homedir()) {
-  const hooksPath = path46.join(homeDir, ".codex", "hooks.json");
-  if (!existsSync32(hooksPath)) return false;
+  const hooksPath = path47.join(homeDir, ".codex", "hooks.json");
+  if (!existsSync33(hooksPath)) return false;
   try {
     const hooksJson = JSON.parse(
       __require("fs").readFileSync(hooksPath, "utf-8")
@@ -30977,11 +31349,11 @@ function verifyCodexHooks(homeDir = os20.homedir()) {
 async function installCodexStatusLine(homeDir = os20.homedir()) {
   const prefs = loadPreferences(homeDir);
   if (prefs.codexStatusLine === false) return "opted-out";
-  const codexDir = path46.join(homeDir, ".codex");
-  const configPath = path46.join(codexDir, "config.toml");
+  const codexDir = path47.join(homeDir, ".codex");
+  const configPath = path47.join(codexDir, "config.toml");
   await mkdir9(codexDir, { recursive: true });
   let content = "";
-  if (existsSync32(configPath)) {
+  if (existsSync33(configPath)) {
     content = await readFile8(configPath, "utf-8");
     if (/\[tui\][\s\S]*?status_line\s*=/.test(content)) {
       return "already-configured";
@@ -31039,12 +31411,12 @@ ${desired}
   return { content: next, changed };
 }
 async function registerCodexMcpServer(packageRoot, homeDir = os20.homedir()) {
-  const codexDir = path46.join(homeDir, ".codex");
-  const configPath = path46.join(codexDir, "config.toml");
-  const serverJsPath = path46.join(packageRoot, "dist", "mcp", "server.js");
+  const codexDir = path47.join(homeDir, ".codex");
+  const configPath = path47.join(codexDir, "config.toml");
+  const serverJsPath = path47.join(packageRoot, "dist", "mcp", "server.js");
   await mkdir9(codexDir, { recursive: true });
   let content = "";
-  if (existsSync32(configPath)) {
+  if (existsSync33(configPath)) {
     content = await readFile8(configPath, "utf-8");
   }
   const sectionHeader = "[mcp_servers.exe-os]";
@@ -31069,10 +31441,10 @@ async function registerCodexMcpServer(packageRoot, homeDir = os20.homedir()) {
   return "registered";
 }
 async function ensureCodexHooksFeature(homeDir = os20.homedir()) {
-  const configPath = path46.join(homeDir, ".codex", "config.toml");
-  await mkdir9(path46.join(homeDir, ".codex"), { recursive: true });
+  const configPath = path47.join(homeDir, ".codex", "config.toml");
+  await mkdir9(path47.join(homeDir, ".codex"), { recursive: true });
   let content = "";
-  if (existsSync32(configPath)) {
+  if (existsSync33(configPath)) {
     content = await readFile8(configPath, "utf-8");
   }
   if (/\[features\][\s\S]*?codex_hooks\s*=\s*true/.test(content)) {
@@ -31140,14 +31512,14 @@ var init_installer3 = __esm({
 });
 
 // src/bin/cli.ts
-import { existsSync as existsSync33, readFileSync as readFileSync27, writeFileSync as writeFileSync20, readdirSync as readdirSync10, rmSync } from "fs";
-import path47 from "path";
+import { existsSync as existsSync34, readFileSync as readFileSync29, writeFileSync as writeFileSync21, readdirSync as readdirSync10, rmSync } from "fs";
+import path48 from "path";
 import os21 from "os";
 var args = process.argv.slice(2);
 if (args.includes("--version") || args.includes("-v")) {
   try {
-    const pkgPath = path47.join(path47.dirname(new URL(import.meta.url).pathname), "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync27(pkgPath, "utf8"));
+    const pkgPath = path48.join(path48.dirname(new URL(import.meta.url).pathname), "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync29(pkgPath, "utf8"));
     console.log(pkg.version);
   } catch {
     console.log("unknown");
@@ -31306,16 +31678,19 @@ ID: ${result.id}`);
 } else if (args[0] === "update") {
   const { runUpdate: runUpdate2 } = await Promise.resolve().then(() => (init_update(), update_exports));
   await runUpdate2(args.slice(1));
+} else if (args[0] === "stack-update") {
+  const { runStackUpdateCli } = await Promise.resolve().then(() => (init_stack_update2(), stack_update_exports));
+  await runStackUpdateCli();
 } else if (args.includes("--tui") || args.includes("--demo") || args[0] === "tui") {
   checkForUpdateOnBoot().catch(() => {
   });
   await init_App2().then(() => App_exports);
 } else {
-  const claudeDir = path47.join(os21.homedir(), ".claude");
-  const settingsPath = path47.join(claudeDir, "settings.json");
-  const hasClaudeCode = existsSync33(settingsPath) && (() => {
+  const claudeDir = path48.join(os21.homedir(), ".claude");
+  const settingsPath = path48.join(claudeDir, "settings.json");
+  const hasClaudeCode = existsSync34(settingsPath) && (() => {
     try {
-      const raw = readFileSync27(settingsPath, "utf8");
+      const raw = readFileSync29(settingsPath, "utf8");
       return raw.includes("exe-os") || raw.includes("exe-mem");
     } catch {
       return false;
@@ -31325,9 +31700,9 @@ ID: ${result.id}`);
     const { DEFAULT_COORDINATOR_TEMPLATE_NAME: DEFAULT_COORDINATOR_TEMPLATE_NAME2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
     let cooName = DEFAULT_COORDINATOR_TEMPLATE_NAME2;
     try {
-      const rosterPath = path47.join(os21.homedir(), ".exe-os", "exe-employees.json");
-      if (existsSync33(rosterPath)) {
-        const roster = JSON.parse(readFileSync27(rosterPath, "utf8"));
+      const rosterPath = path48.join(os21.homedir(), ".exe-os", "exe-employees.json");
+      if (existsSync34(rosterPath)) {
+        const roster = JSON.parse(readFileSync29(rosterPath, "utf8"));
         const coo = roster.find((e) => e.role === "COO");
         if (coo) cooName = coo.name;
       }
@@ -31391,14 +31766,15 @@ async function runCodexInstall() {
   }
 }
 async function runClaudeCheck() {
-  const claudeDir = path47.join(os21.homedir(), ".claude");
-  const settingsPath = path47.join(claudeDir, "settings.json");
-  const claudeJsonPath = path47.join(os21.homedir(), ".claude.json");
+  const { detectMcpNameCollisions: detectMcpNameCollisions2 } = await Promise.resolve().then(() => (init_installer(), installer_exports));
+  const claudeDir = path48.join(os21.homedir(), ".claude");
+  const settingsPath = path48.join(claudeDir, "settings.json");
+  const claudeJsonPath = path48.join(os21.homedir(), ".claude.json");
   let ok = true;
-  if (existsSync33(settingsPath)) {
+  if (existsSync34(settingsPath)) {
     let settings;
     try {
-      settings = JSON.parse(readFileSync27(settingsPath, "utf8"));
+      settings = JSON.parse(readFileSync29(settingsPath, "utf8"));
     } catch {
       console.log("\x1B[31m\u2717\x1B[0m settings.json is malformed (invalid JSON)");
       ok = false;
@@ -31424,10 +31800,10 @@ async function runClaudeCheck() {
     console.log("\x1B[31m\u2717\x1B[0m settings.json not found");
     ok = false;
   }
-  if (existsSync33(claudeJsonPath)) {
+  if (existsSync34(claudeJsonPath)) {
     let claudeJson;
     try {
-      claudeJson = JSON.parse(readFileSync27(claudeJsonPath, "utf8"));
+      claudeJson = JSON.parse(readFileSync29(claudeJsonPath, "utf8"));
     } catch {
       console.log("\x1B[31m\u2717\x1B[0m claude.json is malformed (invalid JSON)");
       ok = false;
@@ -31446,8 +31822,22 @@ async function runClaudeCheck() {
     console.log("\x1B[31m\u2717\x1B[0m claude.json not found");
     ok = false;
   }
-  const skillsDir = path47.join(claudeDir, "skills");
-  if (existsSync33(skillsDir)) {
+  const collisions = detectMcpNameCollisions2(os21.homedir(), process.cwd());
+  const disabledCollisions = collisions.filter((c) => c.disabledInMcpJson);
+  if (disabledCollisions.length > 0) {
+    console.log("\x1B[31m\u2717\x1B[0m MCP name collision: disabled .mcp.json entries shadow project MCP servers");
+    for (const c of disabledCollisions) {
+      console.log(`  - ${c.serverName}: ${c.mcpJsonPath} shadows ~/.claude.json project ${c.projectPath}`);
+    }
+    console.log("  Fix: remove/rename the duplicate .mcp.json server entry, or use one MCP config source of truth.");
+    ok = false;
+  } else if (collisions.length > 0) {
+    console.log("\x1B[33m!\x1B[0m MCP server names duplicated between .mcp.json and project config");
+  } else {
+    console.log("\x1B[32m\u2713\x1B[0m No .mcp.json/project MCP name collisions detected");
+  }
+  const skillsDir = path48.join(claudeDir, "skills");
+  if (existsSync34(skillsDir)) {
     console.log("\x1B[32m\u2713\x1B[0m Slash skills directory exists");
   } else {
     console.log("\x1B[31m\u2717\x1B[0m Slash skills directory missing");
@@ -31464,16 +31854,16 @@ async function runClaudeUninstall(flags = []) {
   const dryRun = flags.includes("--dry-run");
   const purge = flags.includes("--purge");
   const homeDir = os21.homedir();
-  const claudeDir = path47.join(homeDir, ".claude");
-  const settingsPath = path47.join(claudeDir, "settings.json");
-  const claudeJsonPath = path47.join(homeDir, ".claude.json");
-  const exeOsDir = path47.join(homeDir, ".exe-os");
+  const claudeDir = path48.join(homeDir, ".claude");
+  const settingsPath = path48.join(claudeDir, "settings.json");
+  const claudeJsonPath = path48.join(homeDir, ".claude.json");
+  const exeOsDir = path48.join(homeDir, ".exe-os");
   let removed = 0;
   const log = (msg) => console.log(dryRun ? `[dry-run] ${msg}` : msg);
   let settings = {};
-  if (existsSync33(settingsPath)) {
+  if (existsSync34(settingsPath)) {
     try {
-      settings = JSON.parse(readFileSync27(settingsPath, "utf8"));
+      settings = JSON.parse(readFileSync29(settingsPath, "utf8"));
     } catch {
       console.error("Your ~/.claude/settings.json appears malformed.");
       if (purge) {
@@ -31511,15 +31901,15 @@ async function runClaudeUninstall(flags = []) {
         permCount = before - settings.permissions.allow.length;
       }
       if (!dryRun) {
-        writeFileSync20(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+        writeFileSync21(settingsPath, JSON.stringify(settings, null, 2) + "\n");
       }
       log("\u2713 Removed exe-os hooks from settings.json");
       if (permCount > 0) log(`\u2713 Removed ${permCount} MCP permission entries`);
       removed++;
     }
   }
-  if (existsSync33(claudeJsonPath)) {
-    const raw = readFileSync27(claudeJsonPath, "utf8");
+  if (existsSync34(claudeJsonPath)) {
+    const raw = readFileSync29(claudeJsonPath, "utf8");
     if (raw.length > 1e6) {
       console.error("claude.json exceeds 1 MB \u2014 skipping parse.");
     } else {
@@ -31540,7 +31930,7 @@ async function runClaudeUninstall(flags = []) {
         }
         if (removedMcp) {
           if (!dryRun) {
-            writeFileSync20(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
+            writeFileSync21(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
           }
           log("\u2713 Removed exe-os MCP server from claude.json");
           removed++;
@@ -31548,14 +31938,14 @@ async function runClaudeUninstall(flags = []) {
       }
     }
   }
-  const skillsDir = path47.join(claudeDir, "skills");
-  if (existsSync33(skillsDir)) {
+  const skillsDir = path48.join(claudeDir, "skills");
+  if (existsSync34(skillsDir)) {
     let skillCount = 0;
     try {
       const entries = readdirSync10(skillsDir);
       for (const entry of entries) {
         if (entry.startsWith("exe")) {
-          const fullPath = path47.join(skillsDir, entry);
+          const fullPath = path48.join(skillsDir, entry);
           if (!dryRun) rmSync(fullPath, { recursive: true, force: true });
           skillCount++;
         }
@@ -31567,30 +31957,30 @@ async function runClaudeUninstall(flags = []) {
       removed++;
     }
   }
-  const claudeMdPath = path47.join(claudeDir, "CLAUDE.md");
-  if (existsSync33(claudeMdPath)) {
-    const content = readFileSync27(claudeMdPath, "utf8");
+  const claudeMdPath = path48.join(claudeDir, "CLAUDE.md");
+  if (existsSync34(claudeMdPath)) {
+    const content = readFileSync29(claudeMdPath, "utf8");
     const startMarker = "<!-- exe-os:orchestration-start -->";
     const endMarker = "<!-- exe-os:orchestration-end -->";
     const startIdx = content.indexOf(startMarker);
     const endIdx = content.indexOf(endMarker);
     if (startIdx !== -1 && endIdx !== -1) {
       const cleaned = (content.slice(0, startIdx) + content.slice(endIdx + endMarker.length)).replace(/\n{3,}/g, "\n\n").trim() + "\n";
-      if (!dryRun) writeFileSync20(claudeMdPath, cleaned);
+      if (!dryRun) writeFileSync21(claudeMdPath, cleaned);
       log("\u2713 Removed orchestration block from CLAUDE.md");
       removed++;
     }
   }
-  const agentsDir = path47.join(claudeDir, "agents");
-  if (existsSync33(agentsDir)) {
+  const agentsDir = path48.join(claudeDir, "agents");
+  if (existsSync34(agentsDir)) {
     let agentCount = 0;
     try {
       const entries = readdirSync10(agentsDir).filter((f) => f.endsWith(".md"));
       let knownNames = /* @__PURE__ */ new Set();
-      const rosterPath = path47.join(exeOsDir, "exe-employees.json");
-      if (existsSync33(rosterPath)) {
+      const rosterPath = path48.join(exeOsDir, "exe-employees.json");
+      if (existsSync34(rosterPath)) {
         try {
-          const roster = JSON.parse(readFileSync27(rosterPath, "utf8"));
+          const roster = JSON.parse(readFileSync29(rosterPath, "utf8"));
           knownNames = new Set(roster.map((e) => e.name));
         } catch {
         }
@@ -31598,7 +31988,7 @@ async function runClaudeUninstall(flags = []) {
       for (const entry of entries) {
         const name = entry.replace(/\.md$/, "");
         if (knownNames.has(name)) {
-          if (!dryRun) rmSync(path47.join(agentsDir, entry), { force: true });
+          if (!dryRun) rmSync(path48.join(agentsDir, entry), { force: true });
           agentCount++;
         }
       }
@@ -31609,16 +31999,16 @@ async function runClaudeUninstall(flags = []) {
       removed++;
     }
   }
-  const projectsDir = path47.join(claudeDir, "projects");
-  if (existsSync33(projectsDir)) {
+  const projectsDir = path48.join(claudeDir, "projects");
+  if (existsSync34(projectsDir)) {
     let projectCount = 0;
     try {
       const projects = readdirSync10(projectsDir);
       for (const proj of projects) {
-        const projSettings = path47.join(projectsDir, proj, "settings.json");
-        if (!existsSync33(projSettings)) continue;
+        const projSettings = path48.join(projectsDir, proj, "settings.json");
+        if (!existsSync34(projSettings)) continue;
         try {
-          const pSettings = JSON.parse(readFileSync27(projSettings, "utf8"));
+          const pSettings = JSON.parse(readFileSync29(projSettings, "utf8"));
           let changed = false;
           if (Array.isArray(pSettings.permissions?.allow)) {
             const before = pSettings.permissions.allow.length;
@@ -31628,7 +32018,7 @@ async function runClaudeUninstall(flags = []) {
             if (pSettings.permissions.allow.length < before) changed = true;
           }
           if (changed && !dryRun) {
-            writeFileSync20(projSettings, JSON.stringify(pSettings, null, 2) + "\n");
+            writeFileSync21(projSettings, JSON.stringify(pSettings, null, 2) + "\n");
           }
           if (changed) projectCount++;
         } catch {
@@ -31652,18 +32042,18 @@ async function runClaudeUninstall(flags = []) {
     };
     const exeBinPath = findExeBin3();
     if (!exeBinPath) throw new Error("exe-os not found in PATH");
-    const binDir = path47.dirname(exeBinPath);
+    const binDir = path48.dirname(exeBinPath);
     let symlinkCount = 0;
-    const rosterPath = path47.join(exeOsDir, "exe-employees.json");
-    if (existsSync33(rosterPath)) {
-      const roster = JSON.parse(readFileSync27(rosterPath, "utf8"));
+    const rosterPath = path48.join(exeOsDir, "exe-employees.json");
+    if (existsSync34(rosterPath)) {
+      const roster = JSON.parse(readFileSync29(rosterPath, "utf8"));
       const { DEFAULT_COORDINATOR_TEMPLATE_NAME: DEFAULT_COORDINATOR_TEMPLATE_NAME2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
       const coordinatorName = roster.find((e) => e.role?.toLowerCase() === "coo")?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME2;
       for (const emp of roster) {
         if (emp.name === coordinatorName) continue;
         for (const suffix of ["", "-opencode"]) {
-          const linkPath = path47.join(binDir, `${emp.name}${suffix}`);
-          if (existsSync33(linkPath)) {
+          const linkPath = path48.join(binDir, `${emp.name}${suffix}`);
+          if (existsSync34(linkPath)) {
             if (!dryRun) rmSync(linkPath, { force: true });
             symlinkCount++;
           }
@@ -31676,7 +32066,7 @@ async function runClaudeUninstall(flags = []) {
     }
   } catch {
   }
-  if (purge && existsSync33(exeOsDir)) {
+  if (purge && existsSync34(exeOsDir)) {
     if (!dryRun) {
       process.stdout.write("\x1B[33m\u26A0 This will delete all memories, identities, and agent data.\x1B[0m\n");
       process.stdout.write("  Removing ~/.exe-os...\n");
@@ -31701,7 +32091,7 @@ async function checkForUpdateOnBoot() {
     const config = await loadConfig2();
     if (!config.autoUpdate.checkOnBoot) return;
     const { checkForUpdate: checkForUpdate2 } = await Promise.resolve().then(() => (init_update(), update_exports));
-    const packageRoot = path47.resolve(
+    const packageRoot = path48.resolve(
       new URL("../..", import.meta.url).pathname
     );
     const result = checkForUpdate2(packageRoot);
@@ -31761,7 +32151,7 @@ async function runActivate(key) {
       const idTemplate = getIdentityTemplate(identityKey);
       if (idTemplate) {
         const idPath = identityPath2(name);
-        const dir = path47.dirname(idPath);
+        const dir = path48.dirname(idPath);
         if (!fs8.existsSync(dir)) fs8.mkdirSync(dir, { recursive: true });
         fs8.writeFileSync(idPath, idTemplate.replace(/^agent_id: \w+/m, `agent_id: ${name}`), "utf-8");
       }