@askexenow/exe-os 0.9.374 → 0.9.376

package/dist/{stack-generate-manifest-MFMDWRUP.js → stack-generate-manifest-7WJZWSPK.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-3UUX5OY4.js";
-import "./chunk-ZGYNKA3O.js";
+} from "./chunk-5QKLWJ4Z.js";
+import "./chunk-TT5BBVLX.js";
 import "./chunk-GHR4ZPJ7.js";
 import "./chunk-C5HUMAA7.js";
 import "./chunk-L25OAFOU.js";
-import "./chunk-L6RXG36J.js";
+import "./chunk-Y2HD2YB7.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-GQOEWNVM.js";
+import "./chunk-4EG4DT4F.js";
 import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-RH4AH3YB.js";
@@ -305,10 +305,11 @@ function evaluateService(spec, facts = {}, options = {}) {
   if (facts.deployed?.ref) {
     const deployedTag = tagOf(facts.deployed.ref);
     const deployedVersion = facts.deployed.versionLabel?.trim();
-    if (!deployedTag || !deployedVersion) {
+    const identifiable = Boolean(deployedTag) || isDigestPinned(facts.deployed.ref);
+    if (!identifiable || !deployedVersion) {
       const missing = [
         !deployedVersion ? "no org.opencontainers.image.version label" : null,
-        !deployedTag ? "matches no release tag (bare digest)" : null
+        !identifiable ? "is neither tag- nor digest-referenced (unattributable)" : null
       ].filter(Boolean).join(" and ");
       return refuse(
         `deployed image ${facts.deployed.ref} has ${missing}; provenance unresolved. Trace the running image and cut a real release before ${spec.key} can be manifest-governed. Re-pinning it to a tag we cannot prove it came from would be a change of unknown scope.`
@@ -357,6 +358,31 @@ function evaluateService(spec, facts = {}, options = {}) {
       `could not resolve ${spec.ghRepo}@${facts.latestTag} to a commit. Provenance is anchored to the COMMIT a tag names, never to the tag string, so an unresolvable tag cannot be pinned.`
     );
   }
+  if (facts.deployed?.ref) {
+    const deployedRef = facts.deployed.ref;
+    const deployedTag = tagOf(deployedRef);
+    if (deployedTag && facts.deployedTagExistsInGit !== true) {
+      return refuse(
+        facts.deployedTagExistsInGit !== false ? `could not verify that ${deployedTag} is an AskExe release tag in ${spec.ghRepo}, so the image production is running cannot be attributed to a release. An unverifiable tag is not a verified tag \u2014 fail closed.` : facts.deployedTagIsNotARelease ? `FLOATING DEPLOYMENT: production runs ${deployedRef}, whose tag "${deployedTag}" is not a release tag at all \u2014 it is a moving reference. Its bytes change under it without the manifest, the stack version, or anyone's review changing, so there is no version this deployment can be said to BE. A version label on the image does not fix that: the label records what the build called itself, not what was released. Deploy a released \`:vX.Y.Z\` tag before ${spec.key} can be manifest-governed.` : facts.deployedTagUpstreamOwned ? `UPSTREAM TAG, NOT OURS: production runs ${deployedRef}, and ${deployedTag} does exist in ${spec.ghRepo} \u2014 but it was created by an UPSTREAM identity, not by AskExe. ${spec.ghRepo} is a hard fork that inherited upstream's tag namespace, so a tag being present there is no evidence that WE released these bytes. Do not "fix" this by trusting the tag; cut a real AskExe release at a version upstream has not used.` : `UNTAGGED RELEASE: production runs ${deployedRef}, but ${deployedTag} does not exist as a git tag in ${spec.ghRepo}. The image wears a release name that was never released \u2014 no reviewed commit corresponds to the bytes that are serving traffic, so this pin cannot be traced back to source. Push the real tag (which builds the image through the tag-triggered release workflow) instead of publishing a version-tagged image beside it.`
+      );
+    }
+    const deployedRevision = facts.deployed.revisionLabel?.trim();
+    if (!deployedRevision) {
+      return refuse(
+        `deployed image ${deployedRef} carries no org.opencontainers.image.revision label, so there is nothing to check against ${spec.ghRepo}'s history. An image that cannot name its own source commit is an unreproducible build.`
+      );
+    }
+    if (facts.deployedRevisionReleaseTag !== void 0 && facts.deployedRevisionReleaseTag === null) {
+      return refuse(
+        `UNRELEASED CODE IN PRODUCTION: ${deployedRef} says it was built from commit ${deployedRevision}, but no release tag in ${spec.ghRepo} contains that commit \u2014 it is not in any released history. Production is running code that was built, pushed and deployed without ever being tagged.`
+      );
+    }
+    if (facts.deployedRevisionReleaseTag === void 0) {
+      return refuse(
+        `could not determine whether any release tag in ${spec.ghRepo} contains commit ${deployedRevision} (the revision ${deployedRef} claims). Unverifiable provenance fails closed.`
+      );
+    }
+  }
   const resolvedDigest = facts.digestByCommit ?? facts.digestByTag;
   if (!resolvedDigest || !/^sha256:[0-9a-f]{64}$/i.test(resolvedDigest)) {
     return refuse(
@@ -615,6 +641,55 @@ async function resolveTagCommit(ghRepo, tag) {
   const deref = await run("gh", ["api", `repos/${ghRepo}/git/tags/${sha}`, "--jq", ".object.sha"]);
   return deref.ok && deref.stdout.trim() !== "" ? deref.stdout.trim() : void 0;
 }
+async function fetchReleaseTags(ghRepo) {
+  const { inReleaseNamespace } = await import("./ref-provenance-gate-M4AQO4OT.js");
+  const res = await run("gh", [
+    "api",
+    `repos/${ghRepo}/git/refs/tags`,
+    "--paginate",
+    "--jq",
+    ".[].ref"
+  ]);
+  if (!res.ok) return void 0;
+  return res.stdout.split("\n").map((r) => r.trim().replace(/^refs\/tags\//, "")).filter((t) => t !== "" && inReleaseNamespace(t) && !t.startsWith("stack-v")).sort((a, b) => compareVersionTags(a, b) ?? 0).reverse();
+}
+async function isOurAskExeTag(ghRepo, tag) {
+  const { isOurIdentity } = await import("./ref-provenance-gate-M4AQO4OT.js");
+  return isOurIdentity(await tagCreatorEmail(ghRepo, tag));
+}
+async function deployedTagIsOurRelease(ghRepo, deployedTag, releaseTags) {
+  if (!releaseTags) return void 0;
+  if (!releaseTags.includes(deployedTag)) return false;
+  return isOurAskExeTag(ghRepo, deployedTag);
+}
+var MAX_CONTAINMENT_PROBES = 25;
+var MAX_IDENTITY_SCAN = 120;
+async function releaseTagContaining(ghRepo, commit, tags, knownOurTag) {
+  const from = knownOurTag ? tags.indexOf(knownOurTag) : -1;
+  const candidates = from >= 0 ? tags.slice(from) : tags;
+  const probes = [];
+  let scanned = 0;
+  for (const tag of candidates) {
+    if (probes.length >= MAX_CONTAINMENT_PROBES || scanned >= MAX_IDENTITY_SCAN) break;
+    scanned++;
+    if (await isOurAskExeTag(ghRepo, tag)) probes.push(tag);
+  }
+  if (probes.length === 0) return void 0;
+  let anyAnswered = false;
+  for (const tag of probes) {
+    const contains = await commitIsAncestorOfTag(ghRepo, commit, tag);
+    if (contains === true) return tag;
+    if (contains === false) anyAnswered = true;
+  }
+  if (!anyAnswered) return void 0;
+  if (candidates.length > scanned) {
+    process.stderr.write(
+      `[stack-generate-manifest] probed the ${probes.length} newest ASKEXE release tag(s) of ${ghRepo}; none contains ${commit} (${candidates.length - scanned} older candidate tag(s) not scanned \u2014 non-linear release history?)
+`
+    );
+  }
+  return null;
+}
 async function commitIsAncestorOfTag(ghRepo, commit, tag) {
   const res = await run("gh", [
     "api",
@@ -649,10 +724,21 @@ function loadDeployedState(filePath) {
   }
   return JSON.parse(readFileSync(filePath, "utf8"));
 }
+function unsampledPinnedServices(specs, deployed) {
+  return specs.filter((spec) => spec.origin !== "upstream-pinned" && spec.ghRepo && spec.releaseLane !== "none").filter((spec) => {
+    const entry = deployed[spec.key];
+    if (entry?.ref) return false;
+    if (entry?.absent) return false;
+    return true;
+  }).map((spec) => spec.key);
+}
 async function gatherFacts(spec, previous, deployed) {
   const facts = {
     previousImageRef: previous[spec.key],
-    deployed: deployed[spec.key]
+    // An `{ absent: true }` marker records that the host is NOT running this
+    // service. It is an answer to the coverage question, not an image, so it
+    // must not flow into the deployed-provenance guards as one.
+    deployed: deployed[spec.key]?.ref ? deployed[spec.key] : void 0
   };
   if (spec.origin === "upstream-pinned" || !spec.ghRepo || spec.releaseLane === "none") return facts;
   facts.latestTag = await fetchLatestTag(spec.ghRepo);
@@ -669,11 +755,25 @@ async function gatherFacts(spec, previous, deployed) {
     `${facts.digestByCommit ? commitSource : source}@${resolved}`
   );
   facts.imageCommit = facts.labels["org.exe.git_sha"] ?? facts.labels["org.opencontainers.image.revision"];
-  facts.commitIsAncestorOfTag = await commitIsAncestorOfTag(
-    spec.ghRepo,
-    facts.tagCommit,
-    facts.latestTag
-  );
+  facts.commitIsAncestorOfTag = facts.imageCommit ? await commitIsAncestorOfTag(spec.ghRepo, facts.imageCommit, facts.latestTag) : void 0;
+  if (facts.deployed?.ref) {
+    const releaseTags = await fetchReleaseTags(spec.ghRepo);
+    const deployedTag = tagOf(facts.deployed.ref);
+    const { inReleaseNamespace } = await import("./ref-provenance-gate-M4AQO4OT.js");
+    if (deployedTag && inReleaseNamespace(deployedTag)) {
+      facts.deployedTagExistsInGit = await deployedTagIsOurRelease(
+        spec.ghRepo,
+        deployedTag,
+        releaseTags
+      );
+      facts.deployedTagUpstreamOwned = facts.deployedTagExistsInGit === false && (releaseTags?.includes(deployedTag) ?? false);
+    } else {
+      facts.deployedTagExistsInGit = false;
+      facts.deployedTagIsNotARelease = true;
+    }
+    const revision = facts.deployed.revisionLabel?.trim();
+    facts.deployedRevisionReleaseTag = revision && releaseTags ? await releaseTagContaining(spec.ghRepo, revision, releaseTags, facts.latestTag) : void 0;
+  }
   return facts;
 }
 function printUsage() {
@@ -688,8 +788,9 @@ Options:
   --manifest <path>          Manifest to update (default deploy/stack-manifests/v0.9.json)
   --compose <path>           Compose file whose deployed surface must be fully covered
   --stack-version <x.y.z>    Version for the new entry (default: patch-bump of latest)
-  --deployed-state <path>    JSON snapshot of what production runs (enables the
-                             deployed-provenance guard)
+  --deployed-state <path>    JSON snapshot of what production runs. REQUIRED to
+                             write; produce it with
+                               scripts/capture-deployed-state.mjs > deployed.json
   --allow-downgrade <svc>    Explicitly permit ONE named service to move backwards.
                              Repeatable. The only override \u2014 it cannot manufacture
                              provenance for a missing repo, label, or digest.
@@ -702,6 +803,13 @@ FAIL-CLOSED: the run REFUSES (and writes nothing) when a repo has no published
 release, a release has no published image, a digest cannot be resolved, an image
 lacks org.opencontainers.image.version/.revision, a candidate is LOWER than the
 current pin, or compose deploys a service the roster does not govern.
+
+It also refuses when the image PRODUCTION IS RUNNING cannot be traced to source:
+its release tag does not exist as a git tag in that service's repo, or no release
+tag contains the commit the image says it was built from (bug 2c9bf186 \u2014
+ghcr.io/askexe/exe-erp:v0.3.4 was serving traffic while git held only v0.3.1).
+Those checks read the --deployed-state snapshot, which is why writing requires
+one; unverifiable is treated as failing, never as passing.
 `);
 }
 async function runStackGenerateManifestCli(argv) {
@@ -725,6 +833,18 @@ async function runStackGenerateManifestCli(argv) {
   } else {
     console.warn(`[stack-generate-manifest] compose file not found (${opts.composePath}) \u2014 coverage NOT verified.`);
   }
+  if (!opts.dryRun && !opts.deployedStatePath) {
+    console.error(
+      `[stack-generate-manifest] REFUSED: --deployed-state is required to write a manifest.
+  Without a snapshot of what production runs, the deployed-provenance guards cannot run \u2014
+  and those are the guards that catch an image wearing a release tag that exists in no git
+  history (bug 2c9bf186: ghcr.io/askexe/exe-erp:v0.3.4 was live while git had only v0.3.1).
+  Capture one from the host:
+    EXE_STACK_SSH_HOST=<host> node scripts/capture-deployed-state.mjs > deployed.json
+  then re-run with --deployed-state deployed.json. Use --dry-run to resolve without writing.`
+    );
+    return 1;
+  }
   const previous = previousImageRefs(manifest);
   let deployed;
   try {
@@ -734,6 +854,29 @@ async function runStackGenerateManifestCli(argv) {
     return 1;
   }
   const specs = stackServiceSpecs(STACK_SERVICE_SPECS);
+  if (!opts.dryRun && Object.keys(deployed).length === 0) {
+    console.error(
+      `[stack-generate-manifest] REFUSED: the --deployed-state snapshot ${opts.deployedStatePath} describes no services.
+  An empty snapshot passes the flag check and then silently skips every deployed-provenance
+  guard \u2014 production would go unexamined and the manifest would be signed anyway.
+  Re-capture it against the real host:
+    EXE_STACK_SSH_HOST=<host> node scripts/capture-deployed-state.mjs > deployed.json`
+    );
+    return 1;
+  }
+  const unsampled = unsampledPinnedServices(specs, deployed);
+  if (!opts.dryRun && unsampled.length > 0) {
+    console.error(
+      `[stack-generate-manifest] REFUSED: the --deployed-state snapshot says nothing about: ${unsampled.join(", ")}.
+  Their deployed-provenance guards would silently not run, and the manifest would be signed
+  as if production had been checked. A real capture records every service it covers \u2014
+  one the host is not running appears as {"absent": true}, which is an answer. An entry that
+  is missing or empty is not.
+  Re-capture against the host (do not hand-edit the file):
+    EXE_STACK_SSH_HOST=<host> node scripts/capture-deployed-state.mjs > deployed.json`
+    );
+    return 1;
+  }
   const factsByKey = {};
   for (const spec of specs) {
     process.stderr.write(`[stack-generate-manifest] resolving ${spec.key}\u2026
@@ -799,12 +942,17 @@ if (isMainModule(import.meta.url) && process.argv[1]?.includes("stack-generate-m
 }
 export {
   commitIsAncestorOfTag,
+  deployedTagIsOurRelease,
   fetchLatestTag,
+  fetchReleaseTags,
   gatherFacts,
+  isOurAskExeTag,
   loadDeployedState,
   parseGenerateArgs,
   readProvenanceLabels,
+  releaseTagContaining,
   resolveImageDigest,
   resolveTagCommit,
-  runStackGenerateManifestCli
+  runStackGenerateManifestCli,
+  unsampledPinnedServices
 };

package/dist/{stack-promote-EKSCYY63.js → stack-promote-OP2URGFF.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-3UUX5OY4.js";
-import "./chunk-ZGYNKA3O.js";
+} from "./chunk-5QKLWJ4Z.js";
+import "./chunk-TT5BBVLX.js";
 import "./chunk-GHR4ZPJ7.js";
 import "./chunk-C5HUMAA7.js";
 import "./chunk-L25OAFOU.js";
-import "./chunk-L6RXG36J.js";
+import "./chunk-Y2HD2YB7.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-GQOEWNVM.js";
+import "./chunk-4EG4DT4F.js";
 import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-RH4AH3YB.js";

package/dist/{stack-release-2GZAAFO4.js → stack-release-MY6U2QIO.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-3UUX5OY4.js";
-import "./chunk-ZGYNKA3O.js";
+} from "./chunk-5QKLWJ4Z.js";
+import "./chunk-TT5BBVLX.js";
 import "./chunk-GHR4ZPJ7.js";
 import {
   assertPreflightGate,
@@ -10,9 +10,9 @@ import {
 } from "./chunk-LLZNPOGB.js";
 import "./chunk-C5HUMAA7.js";
 import "./chunk-L25OAFOU.js";
-import "./chunk-L6RXG36J.js";
+import "./chunk-Y2HD2YB7.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-GQOEWNVM.js";
+import "./chunk-4EG4DT4F.js";
 import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-RH4AH3YB.js";
@@ -328,7 +328,9 @@ function parseReleaseArgs(argv) {
   return flags;
 }
 async function git(repoPath, ...args) {
-  const { stdout } = await execFile("git", ["-C", repoPath, ...args]);
+  const { stdout } = await execFile("git", ["-C", repoPath, ...args], {
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
   return stdout.trim();
 }
 async function assertCleanWorkingTree(opts) {
@@ -471,7 +473,9 @@ function isCloneTargetSafe(targetPath, parentDir) {
   return resolvedTarget === resolvedParent || resolvedTarget.startsWith(resolvedParent + path2.sep);
 }
 var defaultCloneRunner = async (url, targetPath) => {
-  await execFile("git", ["clone", url, targetPath]);
+  await execFile("git", ["clone", url, targetPath], {
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
 };
 async function ensureRepoCloned(repo, parentDir = PARENT_DIR, runClone = defaultCloneRunner) {
   if (hasPackageJson(repo)) return false;
@@ -538,6 +542,19 @@ function rebaseImageTag(image, newVersion) {
   }
   return `${image}:v${newVersion}`;
 }
+function imageRepoPath(image) {
+  const withoutDigest = image.split("@")[0] ?? image;
+  const lastColon = withoutDigest.lastIndexOf(":");
+  const lastSlash = withoutDigest.lastIndexOf("/");
+  return lastColon > lastSlash ? withoutDigest.slice(0, lastColon) : withoutDigest;
+}
+function mayRebaseComponent(component, componentImage, ownImage) {
+  if (component && typeof component === "object" && component.versionLockstep === true) {
+    return true;
+  }
+  if (typeof ownImage !== "string" || ownImage.length === 0) return false;
+  return imageRepoPath(componentImage) === imageRepoPath(ownImage);
+}
 async function bumpVersions(changes, mode, dryRun) {
   for (const change of changes) {
     const newVersion = bumpVersion(change.currentVersion, mode);
@@ -558,15 +575,18 @@ async function bumpVersions(changes, mode, dryRun) {
       if (typeof srf.image === "string") {
         srf.image = rebaseImageTag(srf.image, newVersion);
       }
+      const ownImage = typeof srf.image === "string" ? srf.image : void 0;
       if (srf.components && typeof srf.components === "object") {
         const components = srf.components;
         for (const key of Object.keys(components)) {
           const val = components[key];
           if (typeof val === "string") {
-            components[key] = rebaseImageTag(val, newVersion);
+            if (mayRebaseComponent(val, val, ownImage)) {
+              components[key] = rebaseImageTag(val, newVersion);
+            }
           } else if (val && typeof val === "object" && "image" in val) {
             const obj = val;
-            if (typeof obj.image === "string") {
+            if (typeof obj.image === "string" && mayRebaseComponent(obj, obj.image, ownImage)) {
               obj.image = rebaseImageTag(obj.image, newVersion);
             }
           }
@@ -1466,8 +1486,11 @@ export {
   findPullRequestForHeadSha,
   findWorkflowRunForHeadSha,
   forceBuildRejection,
+  imageRepoPath,
   isCloneTargetSafe,
+  mayRebaseComponent,
   parseReleaseArgs,
   printOpenPrGate,
+  rebaseImageTag,
   runStackRelease
 };

package/dist/{stack-update-J6JXSTAZ.js → stack-update-QSHSLUTZ.js}

@@ -105,13 +105,13 @@ import {
   verifyStackManifestSignature,
   waitForHttpOk,
   warnUnmanagedManifestServices
-} from "./chunk-ZGYNKA3O.js";
+} from "./chunk-TT5BBVLX.js";
 import "./chunk-GHR4ZPJ7.js";
 import "./chunk-C5HUMAA7.js";
 import "./chunk-L25OAFOU.js";
-import "./chunk-L6RXG36J.js";
+import "./chunk-Y2HD2YB7.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-GQOEWNVM.js";
+import "./chunk-4EG4DT4F.js";
 import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-RH4AH3YB.js";

package/dist/{steward-gate-BFCCMCSW.js → steward-gate-KMLS5ECC.js}

@@ -1,15 +1,15 @@
 import {
   StewardGate
-} from "./chunk-SEQIPGLU.js";
-import "./chunk-TAMDAOCU.js";
+} from "./chunk-IZLML47J.js";
+import "./chunk-66CGXQUA.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-DSJI76XL.js";
+import "./chunk-AHNVFBVB.js";
 import "./chunk-YYB5PMTK.js";
-import "./chunk-NJFJWQNN.js";
-import "./chunk-V3W3SATA.js";
-import "./chunk-JY5GAZYC.js";
+import "./chunk-L5CGXEZC.js";
+import "./chunk-CL4J4757.js";
+import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";

package/dist/{subagent-brief-injection-ED36PLYY.js → subagent-brief-injection-HCKZQZBF.js}

@@ -1,76 +1,77 @@
 import {
   buildEmployeeBootBrief
-} from "./chunk-6VHOQ3IM.js";
+} from "./chunk-HHAKXIKX.js";
 import "./chunk-HSFBNCNC.js";
-import "./chunk-32YV32VA.js";
-import "./chunk-WMEYJT4R.js";
-import "./chunk-XZ65ST2I.js";
+import "./chunk-LTUA5EYI.js";
+import "./chunk-6FG34V6D.js";
+import "./chunk-QV5CQLQH.js";
 import "./chunk-QGGH7LOU.js";
-import "./chunk-TFKCERAK.js";
+import "./chunk-HHT527PV.js";
 import "./chunk-VMHZSZQJ.js";
-import "./chunk-MXPNVSXI.js";
-import "./chunk-VZAFWPAY.js";
+import "./chunk-CIEVY5TD.js";
+import "./chunk-IK4344V5.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-DN4YVV4Z.js";
+import "./chunk-RSABKW6B.js";
 import {
   resolveAgentAttribution
-} from "./chunk-55BEFF4V.js";
+} from "./chunk-5DF4Y6EC.js";
 import {
   tryMarkSubagentBriefInjected
 } from "./chunk-K4ESASPL.js";
 import "./chunk-5MOYSU5A.js";
-import "./chunk-4QCFFW2H.js";
+import "./chunk-5QCIWWFA.js";
 import "./chunk-76CJBM36.js";
-import "./chunk-AKLQSC6W.js";
-import "./chunk-BTSWFMEH.js";
-import "./chunk-6RKKVPYF.js";
-import "./chunk-4EN3IZ3Q.js";
-import "./chunk-KI5PFRG6.js";
-import "./chunk-3KDCORDO.js";
+import "./chunk-KI7O64XV.js";
+import "./chunk-4YUGB637.js";
+import "./chunk-64ODONK2.js";
+import "./chunk-C2UN464N.js";
+import "./chunk-ZKGWHT56.js";
 import "./chunk-WT4RI36X.js";
-import "./chunk-E23LNUWJ.js";
-import "./chunk-QAEWWYHL.js";
+import "./chunk-TDF2XKLK.js";
 import "./chunk-EIKATSE4.js";
 import "./chunk-MJCSEIFI.js";
-import "./chunk-XH7YL7JM.js";
-import "./chunk-ORM7ZFKC.js";
+import "./chunk-E23LNUWJ.js";
+import "./chunk-ZMX22HSS.js";
 import "./chunk-VI4ATC6I.js";
 import "./chunk-A27Q27CT.js";
-import "./chunk-W75GTHR3.js";
+import "./chunk-BZ546I4Q.js";
+import "./chunk-3SRZNJKD.js";
 import "./chunk-AJIXH5JF.js";
-import "./chunk-7GE2EQ23.js";
+import "./chunk-YGVAKKGJ.js";
 import "./chunk-GZOG2MAX.js";
 import "./chunk-AM7S2TY6.js";
-import "./chunk-6YVUR3OU.js";
+import "./chunk-QR3BUMOS.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-GOMQ7PVQ.js";
+import "./chunk-WJC6AAJN.js";
 import "./chunk-4IK2K3B3.js";
-import "./chunk-NUK7EEN5.js";
+import "./chunk-ZKJ5S23O.js";
+import "./chunk-GPUOUUHA.js";
+import "./chunk-BTSWFMEH.js";
 import "./chunk-ZG62LIK3.js";
-import "./chunk-EKYYMIVT.js";
+import "./chunk-IMYGYIAI.js";
 import "./chunk-NLEW62VC.js";
-import "./chunk-SLLLOOEI.js";
+import "./chunk-GPJIBLP4.js";
 import "./chunk-V3WLC5TJ.js";
-import "./chunk-JTVIANUB.js";
+import "./chunk-AEUGIJDO.js";
 import "./chunk-HYZV25LY.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-TAMDAOCU.js";
+import "./chunk-66CGXQUA.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-DSJI76XL.js";
+import "./chunk-AHNVFBVB.js";
 import "./chunk-YYB5PMTK.js";
-import "./chunk-NJFJWQNN.js";
-import "./chunk-V3W3SATA.js";
-import "./chunk-JY5GAZYC.js";
+import "./chunk-L5CGXEZC.js";
+import "./chunk-CL4J4757.js";
+import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-WNBZJSQT.js";
 import "./chunk-HPXFKUGU.js";
-import "./chunk-L6RXG36J.js";
+import "./chunk-Y2HD2YB7.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-GQOEWNVM.js";
+import "./chunk-4EG4DT4F.js";
 import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
 import "./chunk-ZIG7VPJV.js";
@@ -89,7 +90,7 @@ async function buildSubagentBootstrapContext(payload, options = {}) {
       return "";
     }
     try {
-      const { fastDbInit } = await import("./fast-db-init-L2RGKJWH.js");
+      const { fastDbInit } = await import("./fast-db-init-GWUZ746B.js");
       await fastDbInit({ caller: "hook" });
     } catch {
     }

package/dist/{support-inbox-YW47SYJF.js → support-inbox-UBXU5RKV.js}

@@ -10,27 +10,27 @@ import {
   registerTriageBugReport,
   registerTriageFeatureRequest,
   registerTriageReview
-} from "./chunk-ZL4AGWAH.js";
-import "./chunk-5H47VHB7.js";
+} from "./chunk-BNWWVYRN.js";
+import "./chunk-UWX6MMCX.js";
 import "./chunk-4YNA3CM6.js";
-import "./chunk-55BEFF4V.js";
+import "./chunk-5DF4Y6EC.js";
 import "./chunk-K4ESASPL.js";
-import "./chunk-4QCFFW2H.js";
+import "./chunk-5QCIWWFA.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-TAMDAOCU.js";
+import "./chunk-66CGXQUA.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-DSJI76XL.js";
+import "./chunk-AHNVFBVB.js";
 import "./chunk-YYB5PMTK.js";
-import "./chunk-NJFJWQNN.js";
-import "./chunk-V3W3SATA.js";
-import "./chunk-JY5GAZYC.js";
+import "./chunk-L5CGXEZC.js";
+import "./chunk-CL4J4757.js";
+import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-L6RXG36J.js";
+import "./chunk-Y2HD2YB7.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-GQOEWNVM.js";
+import "./chunk-4EG4DT4F.js";
 import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-RH4AH3YB.js";

package/dist/{support-outbox-HFJWG52M.js → support-outbox-G2NG2U5K.js}

@@ -3,9 +3,9 @@ import {
   getOutboxStatus,
   queueSupportStatusUpdateSync,
   reconcileUpstreamStatus
-} from "./chunk-GSJLB6JI.js";
+} from "./chunk-7THUQU44.js";
 import "./chunk-MMRUBN3I.js";
-import "./chunk-4QCFFW2H.js";
+import "./chunk-5QCIWWFA.js";
 import "./chunk-MLKGABMK.js";
 export {
   flushSupportOutbox as flushBugReportOutbox,

package/dist/{sweep-budget-KMPJ7O5Z.js → sweep-budget-YGLCNXZZ.js}

@@ -2,20 +2,26 @@ import {
   DEFAULT_SWEEP_BUDGET_MS,
   DEFAULT_SWEEP_RESCHEDULE_DELAY_MS,
   createTimerPauseAccounting,
+  currentPauseStartMs,
+  isTimerPausedNow,
   recordTimerPauseMs,
   runBudgetedSweep,
   runWithTimerPauseAccounting,
   sweepPauseTotalMs,
-  sweepTickBudgetMs
-} from "./chunk-KI5PFRG6.js";
+  sweepTickBudgetMs,
+  timerPauseIntervalsSince
+} from "./chunk-ZKGWHT56.js";
 import "./chunk-MLKGABMK.js";
 export {
   DEFAULT_SWEEP_BUDGET_MS,
   DEFAULT_SWEEP_RESCHEDULE_DELAY_MS,
   createTimerPauseAccounting,
+  currentPauseStartMs,
+  isTimerPausedNow,
   recordTimerPauseMs,
   runBudgetedSweep,
   runWithTimerPauseAccounting,
   sweepPauseTotalMs,
-  sweepTickBudgetMs
+  sweepTickBudgetMs,
+  timerPauseIntervalsSince
 };