@askexenow/exe-os 0.9.370 → 0.9.372

package/dist/{tool-telemetry-WHTCFN2L.js → tool-telemetry-ZX7VSAXK.js}

@@ -5,7 +5,7 @@ import {
   startToolTelemetryFlush,
   stopToolTelemetryFlush,
   wrapServerWithTelemetry
-} from "./chunk-442EX2PZ.js";
+} from "./chunk-3Y5THOU6.js";
 import "./chunk-MLKGABMK.js";
 export {
   getToolUsageStats,

package/dist/tui/App.js

@@ -1,35 +1,36 @@
 #!/usr/bin/env node
 import {
   getSessionPrompt
-} from "../chunk-QK26AJD7.js";
-import "../chunk-REOG2KQS.js";
+} from "../chunk-6XEYELCA.js";
+import "../chunk-HIVZ53YB.js";
 import "../chunk-THIJIOE2.js";
 import {
   sessionScopeFilter
-} from "../chunk-LMZD3A6K.js";
+} from "../chunk-XHYHX6F7.js";
 import "../chunk-BTSWFMEH.js";
-import "../chunk-DNKCJ6KV.js";
-import "../chunk-6FMS6DGO.js";
+import "../chunk-WAEKYKTK.js";
+import "../chunk-44C7QNZS.js";
+import "../chunk-JTWTBX2M.js";
 import "../chunk-KI5PFRG6.js";
-import "../chunk-D3QU2KNF.js";
 import "../chunk-WT4RI36X.js";
+import "../chunk-E23LNUWJ.js";
 import "../chunk-QAEWWYHL.js";
 import "../chunk-EIKATSE4.js";
-import "../chunk-E23LNUWJ.js";
-import "../chunk-RYDR7TRT.js";
+import "../chunk-MDGYXUOV.js";
 import "../chunk-GBNB4EWD.js";
 import "../chunk-UXLO7VHX.js";
 import "../chunk-DSOQUQTV.js";
-import "../chunk-TTAPKUQV.js";
+import "../chunk-E2WEFZOR.js";
 import "../chunk-AJIXH5JF.js";
-import "../chunk-J7OPJPYG.js";
+import "../chunk-L6ZNURWN.js";
 import "../chunk-XTWHNLGD.js";
 import "../chunk-AM7S2TY6.js";
-import "../chunk-637HNKYP.js";
+import "../chunk-HIIXCAEE.js";
 import "../chunk-CVYC6DUW.js";
-import "../chunk-ZVTKWWLV.js";
+import "../chunk-QZL6E4UB.js";
 import "../chunk-CDUB5Q6J.js";
-import "../chunk-BNHAZ65R.js";
+import "../chunk-UQUUNGTP.js";
+import "../chunk-IVU3WN7S.js";
 import "../chunk-RIECV7SR.js";
 import "../chunk-LNOS24GV.js";
 import "../chunk-NLEW62VC.js";
@@ -42,21 +43,21 @@ import {
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   isCoordinatorName
-} from "../chunk-5XRKPKHJ.js";
+} from "../chunk-5DCCKHDY.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-SWVRUCVM.js";
+import "../chunk-UTDMTQNH.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";
 import "../chunk-JY5GAZYC.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-WNBZJSQT.js";
-import "../chunk-I3FXDCUE.js";
+import "../chunk-DKBPCOU4.js";
 import "../chunk-A7XLR3K7.js";
-import "../chunk-2A76BLAD.js";
-import "../chunk-QILQ5FCG.js";
+import "../chunk-GB3AHV5F.js";
+import "../chunk-A7JYF4RG.js";
 import "../chunk-ARX6TAGN.js";
 import {
   THEME_MODES,
@@ -7431,7 +7432,7 @@ function useOrchestrator(enabled = true) {
     let cancelled = false;
     async function init() {
       try {
-        const { MultiAgentOrchestrator } = await import("../orchestrator-DV5G5DKQ.js");
+        const { MultiAgentOrchestrator } = await import("../orchestrator-JVPVOYWA.js");
         const { getCoordinatorName, isCoordinatorRole, loadEmployees } = await import("../lib/employees.js");
         const { isExeSession } = await import("../lib/tmux-routing.js");
         const { listTmuxSessions, inTmux } = await import("../lib/tmux-status.js");
@@ -7472,7 +7473,7 @@ function useOrchestrator(enabled = true) {
         setTotalInProgress(health.totalInProgress);
         try {
           const { getClient } = await import("../lib/database.js");
-          const { sessionScopeFilter: sessionScopeFilter2 } = await import("../task-scope-H2XPGS6Y.js");
+          const { sessionScopeFilter: sessionScopeFilter2 } = await import("../task-scope-KXF7Y6KA.js");
           const client = getClient();
           const uoScope = sessionScopeFilter2();
           const result = await client.execute({
@@ -7504,7 +7505,7 @@ function useOrchestrator(enabled = true) {
   const spawnSession = useCallback5(
     async (agentId) => {
       try {
-        const { createTaskCore } = await import("../tasks-crud-4F6ECDNC.js");
+        const { createTaskCore } = await import("../tasks-crud-5EM55WRZ.js");
         const { ensureEmployee } = await import("../lib/tmux-routing.js");
         const { getCoordinatorName } = await import("../lib/employees.js");
         await createTaskCore({
@@ -8128,7 +8129,7 @@ function TasksView({ onBack }) {
     const { withTrace } = await import("../telemetry-43X3GT3R.js");
     return withTrace("tui.tasks.loadTasks", async () => {
       try {
-        const { loadTaskList } = await import("../tui-data-36IHMXIQ.js");
+        const { loadTaskList } = await import("../tui-data-CC5POSUV.js");
         const tasks = await loadTaskList();
         setAllTasks(
           tasks.map((task) => ({
@@ -8961,7 +8962,7 @@ function TeamView({ onBack, onViewSessions }) {
         let projectsByEmployee = /* @__PURE__ */ new Map();
         let currentTaskByEmployee = /* @__PURE__ */ new Map();
         try {
-          const { loadTeamBadgeCounts, loadTeamDetailMetrics } = await import("../tui-data-36IHMXIQ.js");
+          const { loadTeamBadgeCounts, loadTeamDetailMetrics } = await import("../tui-data-CC5POSUV.js");
           setBadgeInFlight(true);
           const badgeCountsPromise = loadTeamBadgeCounts();
           const detailsPromise = loadTeamDetailMetrics(roster.map((emp) => emp.name));
@@ -9327,7 +9328,7 @@ function WikiView({ onBack }) {
     }
     setSearchLoading(true);
     try {
-      const { searchWikiMemoryRows } = await import("../tui-data-36IHMXIQ.js");
+      const { searchWikiMemoryRows } = await import("../tui-data-CC5POSUV.js");
       setSearchResults(await searchWikiMemoryRows(query));
     } catch {
       setSearchResults([]);

package/dist/{tui-data-36IHMXIQ.js → tui-data-CC5POSUV.js}

@@ -1,29 +1,30 @@
 import {
   sessionScopeFilter
-} from "./chunk-LMZD3A6K.js";
+} from "./chunk-XHYHX6F7.js";
 import "./chunk-BTSWFMEH.js";
-import "./chunk-DNKCJ6KV.js";
-import "./chunk-6FMS6DGO.js";
+import "./chunk-WAEKYKTK.js";
+import "./chunk-44C7QNZS.js";
+import "./chunk-JTWTBX2M.js";
 import "./chunk-KI5PFRG6.js";
-import "./chunk-D3QU2KNF.js";
 import "./chunk-WT4RI36X.js";
+import "./chunk-E23LNUWJ.js";
 import "./chunk-QAEWWYHL.js";
 import "./chunk-EIKATSE4.js";
-import "./chunk-E23LNUWJ.js";
-import "./chunk-RYDR7TRT.js";
+import "./chunk-MDGYXUOV.js";
 import "./chunk-GBNB4EWD.js";
 import "./chunk-UXLO7VHX.js";
 import "./chunk-DSOQUQTV.js";
-import "./chunk-TTAPKUQV.js";
+import "./chunk-E2WEFZOR.js";
 import "./chunk-AJIXH5JF.js";
-import "./chunk-J7OPJPYG.js";
+import "./chunk-L6ZNURWN.js";
 import "./chunk-XTWHNLGD.js";
 import "./chunk-AM7S2TY6.js";
-import "./chunk-637HNKYP.js";
+import "./chunk-HIIXCAEE.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-ZVTKWWLV.js";
+import "./chunk-QZL6E4UB.js";
 import "./chunk-CDUB5Q6J.js";
-import "./chunk-BNHAZ65R.js";
+import "./chunk-UQUUNGTP.js";
+import "./chunk-IVU3WN7S.js";
 import "./chunk-RIECV7SR.js";
 import "./chunk-LNOS24GV.js";
 import "./chunk-NLEW62VC.js";
@@ -33,21 +34,21 @@ import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
 import {
   getClient
-} from "./chunk-5XRKPKHJ.js";
+} from "./chunk-5DCCKHDY.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-SWVRUCVM.js";
+import "./chunk-UTDMTQNH.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-WNBZJSQT.js";
-import "./chunk-I3FXDCUE.js";
+import "./chunk-DKBPCOU4.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-2A76BLAD.js";
-import "./chunk-QILQ5FCG.js";
+import "./chunk-GB3AHV5F.js";
+import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
 import "./chunk-QMSEL5YS.js";
 import "./chunk-HSGBZSCA.js";

package/dist/{update-support-JQSTFOWO.js → update-support-KH6NSQON.js}

@@ -1,23 +1,23 @@
 import {
   persistSupportArtifact
-} from "./chunk-5GHQD5NZ.js";
-import {
-  queueSupportStatusUpdateSync
-} from "./chunk-GSJLB6JI.js";
+} from "./chunk-OKGIOWOB.js";
 import {
   supportIdSchema,
   supportVersionSchema
 } from "./chunk-5H47VHB7.js";
+import {
+  queueSupportStatusUpdateSync
+} from "./chunk-GSJLB6JI.js";
 import "./chunk-MMRUBN3I.js";
-import "./chunk-RLDMUSRM.js";
-import "./chunk-HIIEIDD2.js";
-import "./chunk-ME3A4LKV.js";
+import "./chunk-IDZPQG2D.js";
+import "./chunk-OYQNNKNS.js";
+import "./chunk-7UTJA6HF.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-Z4AN75KW.js";
+import "./chunk-3F2UB4IQ.js";
 import {
   getActiveAgent
-} from "./chunk-MO2A7GUU.js";
+} from "./chunk-KYFFVTGO.js";
 import "./chunk-2ADYTOHQ.js";
 import "./chunk-5MOYSU5A.js";
 import {
@@ -29,17 +29,18 @@ import {
 } from "./chunk-4QCFFW2H.js";
 import "./chunk-76CJBM36.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-BNHAZ65R.js";
+import "./chunk-UQUUNGTP.js";
+import "./chunk-IVU3WN7S.js";
 import "./chunk-RIECV7SR.js";
 import "./chunk-LNOS24GV.js";
 import "./chunk-NLEW62VC.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-5XRKPKHJ.js";
+import "./chunk-5DCCKHDY.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-SWVRUCVM.js";
+import "./chunk-UTDMTQNH.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
@@ -49,10 +50,10 @@ import "./chunk-HPXFKUGU.js";
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-I3FXDCUE.js";
+} from "./chunk-DKBPCOU4.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-2A76BLAD.js";
-import "./chunk-QILQ5FCG.js";
+import "./chunk-GB3AHV5F.js";
+import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
 import {
   EXE_AI_DIR,

package/dist/{work-claims-CH77EFZ4.js → work-claims-MNK7PEPW.js}

@@ -15,15 +15,15 @@ import {
   normalizeWorkRef,
   releaseClaim,
   resolveHolderSession
-} from "./chunk-DOQ5F3GZ.js";
+} from "./chunk-RUWWES2K.js";
 import "./chunk-PHUHIVD5.js";
 import "./chunk-BTSWFMEH.js";
 import "./chunk-E23LNUWJ.js";
-import "./chunk-5XRKPKHJ.js";
+import "./chunk-5DCCKHDY.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-SWVRUCVM.js";
+import "./chunk-UTDMTQNH.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";

package/dist/{work-state-heartbeat-YC3O6M2G.js → work-state-heartbeat-YEWT5NMZ.js}

@@ -9,7 +9,7 @@ import {
   runWorkStateTick,
   shouldWriteWorkState,
   upsertWorkState
-} from "./chunk-ME3A4LKV.js";
+} from "./chunk-7UTJA6HF.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{worker-gate-BJTF4TUP.js → worker-gate-BOQSIU2Z.js}

@@ -6,7 +6,7 @@ import {
   releaseBackfillLock,
   tryAcquireBackfillLock,
   tryAcquireWorkerSlot
-} from "./chunk-LKB7OV6U.js";
+} from "./chunk-QR624DER.js";
 import "./chunk-QMSEL5YS.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";

package/dist/{workflow-engine-ZWRIDV6J.js → workflow-engine-MUUD7ZEX.js}

@@ -10,8 +10,8 @@ import {
   persistWorkflows,
   runWorkflow,
   startWorkflow
-} from "./chunk-RHDDSIFC.js";
-import "./chunk-EQJ462VM.js";
+} from "./chunk-KXYFBBZR.js";
+import "./chunk-ADNBOKYZ.js";
 import "./chunk-MLKGABMK.js";
 export {
   advanceWorkflow,

package/dist/{worktree-YNPSWYQY.js → worktree-GOGT2LZP.js}

@@ -16,13 +16,13 @@ import {
   resolveGitWithRetrySync,
   worktreeBranch,
   worktreePath
-} from "./chunk-6FMS6DGO.js";
-import "./chunk-TTAPKUQV.js";
-import "./chunk-5XRKPKHJ.js";
+} from "./chunk-JTWTBX2M.js";
+import "./chunk-E2WEFZOR.js";
+import "./chunk-5DCCKHDY.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-SWVRUCVM.js";
+import "./chunk-UTDMTQNH.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";

package/dist/{worktree-sweep-GRMHU4DA.js → worktree-sweep-46VWPVQT.js}

@@ -4,14 +4,14 @@ import {
   discoverRepoPathsAsync,
   isWorktreePathOccupiedByCwd,
   sweepWorktrees
-} from "./chunk-OPI5HGW6.js";
-import "./chunk-6FMS6DGO.js";
-import "./chunk-TTAPKUQV.js";
-import "./chunk-5XRKPKHJ.js";
+} from "./chunk-AMKSDKMK.js";
+import "./chunk-JTWTBX2M.js";
+import "./chunk-E2WEFZOR.js";
+import "./chunk-5DCCKHDY.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-SWVRUCVM.js";
+import "./chunk-UTDMTQNH.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.370",
+  "version": "0.9.372",
   "description": "AI employee operating system \u2014 persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -48,6 +48,7 @@
     "exe-stack-update": "./dist/bin/stack-update.js",
     "exe-verify-running-images": "./dist/bin/exe-verify-running-images.js",
     "exe-preflight": "./dist/bin/exe-preflight.js",
+    "exe-repo-truth": "./dist/bin/exe-repo-truth.js",
     "exe-cloud": "./dist/bin/exe-cloud.js",
     "exe-grant": "./dist/bin/exe-grant.js",
     "exe-os-bulk-sync-postgres": "./dist/bin/bulk-sync-postgres.js",

package/release-notes.json

@@ -1,15 +1,42 @@
 {
-  "current": "0.9.370",
+  "current": "0.9.372",
   "notes": {
-    "0.9.370": {
-      "version": "0.9.370",
+    "0.9.372": {
+      "version": "0.9.372",
       "date": "2026-08-14",
       "features": [],
       "fixes": [],
       "security": [],
       "other": [
-        "v0.9.370 (#725)"
+        "v0.9.372 — re-cut the exe-os stack image from main (#745)"
+      ],
+      "migration_notes": []
+    },
+    "0.9.371": {
+      "version": "0.9.371",
+      "date": "2026-08-14",
+      "features": [],
+      "fixes": [
+        "upgrading no longer leaves the daemon running outside its supervisor. The installer already asked launchd/systemd to start the daemon, but only waited 10 seconds to confirm — a cold start (DB init and warmup) takes longer, so it timed out and spawned its own daemon, which won the singleton lock and left the supervised one deferring. The result was silent: restart-on-death was gone and every plist/unit setting was inert, including the ProcessType tuning that fixes MCP drops. On Linux the installer never consulted systemd at all. The daemon now hands itself back to its supervisor on startup, so machines that already drifted repair themselves on the next start (#726)"
+      ],
+      "security": [],
+      "other": [],
+      "migration_notes": []
+    },
+    "0.9.370": {
+      "version": "0.9.370",
+      "date": "2026-08-14",
+      "features": [
+        "irreversible data operations now refuse to run without a verified restorable backup — the check is mechanical, not a reminder in a runbook (#724)"
+      ],
+      "fixes": [
+        "support notes and comments are stored whole or refused outright, never silently truncated mid-word — validation and storage caps are now derived from one constant so they cannot drift apart again (#720)",
+        "completing a reminder now completes the one you named, rather than one that merely quotes it (#719)",
+        "--force-build refuses when it cannot honour the bypass, instead of reporting a bypass it never performed (#722)",
+        "the afk ticker resolves a real timeout binary instead of exiting 127 on systems without GNU coreutils (#721)"
       ],
+      "security": [],
+      "other": [],
       "migration_notes": []
     },
     "0.9.369": {
@@ -52,62 +79,6 @@
       "security": [],
       "other": [],
       "migration_notes": []
-    },
-    "0.9.367": {
-      "version": "0.9.367",
-      "date": "2026-08-13",
-      "features": [
-        "account termination is now irreversible by the terminated user — tombstone record, lock-before-write ordering, and legal-hold support, closing a path where a suspended account could restore itself (#688)",
-        "SSO cookie contract is verified at deploy time and monitored live, so a login that silently stops working is caught by the system instead of by a user (#696)",
-        "GoTrue's admin API is no longer served on the public internet from the auth page (#689)",
-        "atomic work claims enforced at every dispatch path — two agents can no longer pick up the same task (#656)",
-        "exe-os MCP tools are registered correctly in the agent runtime, plus stall detection so a wedged agent loop is surfaced instead of hanging silently (#693)",
-        "stack updates can roll back an unset pin, and a stale deploy now raises an alert rather than sitting unnoticed (#692)",
-        "automated task completion passes through a verification gate — work cannot be marked done without an artifact backing the claim (#694, #690)",
-        "wiki documents support seal/unseal, with matching cloud-docs endpoints (#687)",
-        "auth page: confirmation state, gated token tab, refreshed UX, and opt-in cross-app SSO cookies (#684)",
-        "email preflight now fails on incomplete SMTP credentials and warns on a bad sender or port, instead of appearing configured (#685)"
-      ],
-      "fixes": [
-        "restored 52 test files — including 33 gateway security suites — that had been running in no CI job since April (#662)",
-        "CI fails loudly when a required check cannot evaluate on a PR, instead of reporting a vacuous green (#673)",
-        "the x64 native lane builds again before running DB worker tests, which had been testing a missing artifact (#698)",
-        "release path is deadlock-proofed: the publish gate reads required-context status off the release lane, plus a drift monitor that catches npm falling behind main (#675)"
-      ],
-      "security": [],
-      "other": [],
-      "migration_notes": []
-    },
-    "0.9.366": {
-      "version": "0.9.366",
-      "date": "2026-08-13",
-      "features": [
-        "atomic work claims — two sessions can no longer take the same job, enforced at every dispatch path",
-        "Codex session consolidation + hook trust: Codex hooks were never actually running, so fresh installs captured nothing",
-        "auth page: confirmation state, gated token tab, and opt-in cross-app SSO",
-        "wiki docs: seal/unseal capability with cloud-docs worker endpoints"
-      ],
-      "fixes": [
-        "SECURITY: GoTrue's admin API is no longer published on the public internet",
-        "SECURITY: account termination was reversible by the terminated user — now tombstoned and lock-fenced",
-        "SSO cookie contract is gated at deploy and monitored live",
-        "task + tracker close gates now require a verification artifact, so automated completion cannot close work that was never verified",
-        "runtime: exe-os MCP tools are registered and the agent loop detects stalls",
-        "stack-update: unset-pin rollback and a stale-deploy alert",
-        "preflight: SMTP recovery fails on incomplete credentials instead of silently continuing",
-        "hook tests: empty stdout is now a clear diagnostic rather than an opaque JSON parse error, and hook fixtures are isolated from the live daemon"
-      ],
-      "infrastructure": [
-        "restored 52 test files that ran in NO CI job at all — including 33 gateway security suites covering permission-guard, api-router enforcement, read-only SQL and rate limiting, dark since 2026-04-20 and green in 17 seconds",
-        "a guard that fails loudly when a required check cannot evaluate on a pull request, so a required context can never again be satisfied by never running",
-        "native-addon smoke gate: node-llama-cpp's addon had zero coverage, meaning production was the first place it ever executed",
-        "the CI sweeper's four correctness fixes finally reached main — an absent required check no longer reads as green",
-        "stopped paying for lint and typecheck twice per PR; sweeps every 5 minutes",
-        "SHA-pinned the last mutable action ref"
-      ],
-      "security": [],
-      "other": [],
-      "migration_notes": []
     }
   }
 }

package/stack.release.json

@@ -4,10 +4,10 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.312",
-  "image": "ghcr.io/askexe/exe-os:v0.9.312",
+  "version": "0.9.372",
+  "image": "ghcr.io/askexe/exe-os:v0.9.372",
   "imageEnv": "EXE_OS_IMAGE_TAG",
-  "imageDigestTodo": "TODO(bug 32d6e02f): the top-level `image` and components.erp.image are tag-only on the private ghcr.io/askexe CI registry. Their @sha256 digests cannot be resolved from this tree (the v0.9.312 build artifacts are not present here and the registry is auth-gated). The release/publish pipeline MUST resolve and append the @sha256 digest for ghcr.io/askexe/exe-os:v0.9.312 and ghcr.io/askexe/exe-erp before this descriptor is signed/shipped. FAIL-CLOSED: do not promote a tag-only app image to a customer release. All public infra images in this descriptor are already digest-pinned. The customer-facing manifest (deploy/stack-manifests/v0.9.json) 'latest' entry is fully digest-pinned; this CI descriptor mirrors it once the ghcr digests are resolved.",
+  "imageDigestTodo": "TODO(bug 32d6e02f): the top-level `image` and components.erp.image are tag-only on the private ghcr.io/askexe CI registry. Their @sha256 digests cannot be resolved from this tree (the v0.9.372 build artifacts are not present here and the registry is auth-gated). The release/publish pipeline MUST resolve and append the @sha256 digest for ghcr.io/askexe/exe-os:v0.9.372 and ghcr.io/askexe/exe-erp before this descriptor is signed/shipped. FAIL-CLOSED: do not promote a tag-only app image to a customer release. All public infra images in this descriptor are already digest-pinned. The customer-facing manifest (deploy/stack-manifests/v0.9.json) 'latest' entry is fully digest-pinned; this CI descriptor mirrors it once the ghcr digests are resolved.",
   "components": {
     "erp": {
       "image": "ghcr.io/askexe/exe-erp:v0.9.312",
@@ -103,5 +103,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.312"
+  "sourceVersion": "0.9.372"
 }

package/dist/{chunk-KOYGRP2L.js → chunk-5N4SG5NB.js}

@@ -1,6 +1,3 @@
-import {
-  asOrgBillablePlan
-} from "./chunk-X2X3IGZU.js";
 import {
   resolvePartnerIdentities
 } from "./chunk-PVEM537A.js";
@@ -10,6 +7,9 @@ import {
   pinOrgKey,
   readOrgKeyPin
 } from "./chunk-H37FSTF2.js";
+import {
+  asOrgBillablePlan
+} from "./chunk-X2X3IGZU.js";
 import {
   displayFingerprint,
   ed25519PrivateKeyFromSeed,