@askexenow/exe-os 0.9.374 → 0.9.377

package/dist/{chunk-NUTZJZKW.js → chunk-SKTAZGFI.js}

@@ -4,12 +4,12 @@ import path from "path";
 import os from "os";
 var EXE_DIR = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
 var SESSION_PATH = path.join(EXE_DIR, "gotrue-session.json");
-var DEFAULT_GOTRUE_URL = "https://api.askexe.com/cloud/auth";
 var REFRESH_MARGIN_S = 60;
 var GOTRUE_TIMEOUT_MS = 1e4;
 function resolveGoTrueUrl(session) {
-  return process.env.EXE_GOTRUE_URL ?? process.env.GOTRUE_URL ?? session?.gotrue_url ?? DEFAULT_GOTRUE_URL;
+  return process.env.EXE_GOTRUE_URL ?? process.env.GOTRUE_URL ?? session?.gotrue_url;
 }
+var NO_GOTRUE_URL_ERROR = "No GoTrue URL configured. Re-authenticate with: exe-os login --token <jwt> --gotrue-url <url>";
 function getSession() {
   try {
     const raw = readFileSync(SESSION_PATH, "utf-8");
@@ -50,47 +50,15 @@ function decodeJwt(accessToken) {
     return null;
   }
 }
-async function login(email, password, gotrueUrl) {
-  const url = gotrueUrl ?? resolveGoTrueUrl();
-  try {
-    const resp = await fetch(`${url.replace(/\/+$/, "")}/token?grant_type=password`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ email, password }),
-      signal: AbortSignal.timeout(GOTRUE_TIMEOUT_MS)
-    });
-    if (!resp.ok) {
-      const body = await resp.text().catch(() => "");
-      let errorMsg = `HTTP ${resp.status}`;
-      try {
-        const parsed = JSON.parse(body);
-        errorMsg = parsed.error_description ?? parsed.msg ?? parsed.error ?? errorMsg;
-      } catch {
-      }
-      return { ok: false, error: errorMsg };
-    }
-    const data = await resp.json();
-    if (!data.access_token || !data.refresh_token) {
-      return { ok: false, error: "Response missing access_token or refresh_token" };
-    }
-    const session = {
-      access_token: data.access_token,
-      refresh_token: data.refresh_token,
-      expires_at: Math.floor(Date.now() / 1e3) + (data.expires_in || 3600),
-      email: data.user?.email ?? email,
-      user_id: data.user?.id,
-      gotrue_url: url !== DEFAULT_GOTRUE_URL ? url : void 0
-    };
-    saveSession(session);
-    return { ok: true, session };
-  } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
-  }
-}
 async function refreshSession(session) {
   const current = session ?? getSession();
   if (!current?.refresh_token) return null;
   const url = resolveGoTrueUrl(current);
+  if (!url) {
+    process.stderr.write(`${NO_GOTRUE_URL_ERROR}
+`);
+    return null;
+  }
   try {
     const resp = await fetch(`${url.replace(/\/+$/, "")}/token?grant_type=refresh_token`, {
       method: "POST",
@@ -116,6 +84,7 @@ async function refreshSession(session) {
   }
 }
 function storeToken(accessToken, refreshToken, gotrueUrl) {
+  if (!gotrueUrl) return false;
   const claims = decodeJwt(accessToken);
   if (!claims?.exp) return false;
   const session = {
@@ -124,7 +93,7 @@ function storeToken(accessToken, refreshToken, gotrueUrl) {
     expires_at: claims.exp,
     email: claims.email,
     user_id: claims.sub,
-    gotrue_url: gotrueUrl ?? (resolveGoTrueUrl() !== DEFAULT_GOTRUE_URL ? resolveGoTrueUrl() : void 0)
+    gotrue_url: gotrueUrl
   };
   saveSession(session);
   return true;
@@ -152,7 +121,7 @@ function getSessionInfo() {
     expiresAt: new Date(session.expires_at * 1e3).toISOString(),
     expired,
     plan: appMeta?.plan,
-    gotrueUrl: session.gotrue_url ?? DEFAULT_GOTRUE_URL
+    gotrueUrl: session.gotrue_url
   };
 }
 
@@ -162,7 +131,6 @@ export {
   clearSession,
   isExpired,
   decodeJwt,
-  login,
   refreshSession,
   storeToken,
   getAuthHeader,

package/dist/{chunk-TQAZTRQ3.js → chunk-SVXUT2DN.js}

@@ -1,16 +1,16 @@
 import {
   isExeSession
-} from "./chunk-AKLQSC6W.js";
+} from "./chunk-KI7O64XV.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-W75GTHR3.js";
+} from "./chunk-3SRZNJKD.js";
 import {
   getClient,
   isCoordinatorName
-} from "./chunk-TAMDAOCU.js";
+} from "./chunk-66CGXQUA.js";
 import {
   isDaemonAlive
-} from "./chunk-V3W3SATA.js";
+} from "./chunk-CL4J4757.js";
 
 // src/lib/session-kill-telemetry.ts
 import crypto from "crypto";

package/dist/{chunk-DJ7YXOTU.js → chunk-T7EF5CQO.js}

@@ -1,13 +1,13 @@
 import {
   resolveClaudeBinaryPath
-} from "./chunk-75H4R62K.js";
+} from "./chunk-CBPNZFSU.js";
 import {
   initStore
-} from "./chunk-MXPNVSXI.js";
+} from "./chunk-CIEVY5TD.js";
 import {
   getClient,
   isInitialized
-} from "./chunk-TAMDAOCU.js";
+} from "./chunk-66CGXQUA.js";
 
 // src/lib/schedules.ts
 import crypto from "crypto";

package/dist/{chunk-QAEWWYHL.js → chunk-TDF2XKLK.js}

@@ -25,6 +25,8 @@ function buildTaskResult(opts) {
       decisions: opts.decisions ?? [],
       open_questions: opts.open_questions ?? [],
       pr_number: opts.pr_number,
+      pr_url: opts.pr_url,
+      pr_no_reason: opts.pr_no_reason,
       commits: opts.commits ?? [],
       tests: opts.tests ?? "none",
       build: opts.build ?? "skip"
@@ -68,7 +70,9 @@ function formatTypedMessage(msg) {
       if (p.commits.length > 0)
         lines.push(`Commits: ${p.commits.join(", ")}`);
       lines.push(`Tests: ${p.tests} | Build: ${p.build}`);
-      if (p.pr_number) lines.push(`PR: #${p.pr_number}`);
+      if (p.pr_url) lines.push(`PR: ${p.pr_url}`);
+      else if (p.pr_number) lines.push(`PR: #${p.pr_number}`);
+      else if (p.pr_no_reason) lines.push(`PR: none (${p.pr_no_reason})`);
       if (p.open_questions.length > 0)
         lines.push(`Open questions: ${p.open_questions.join("; ")}`);
       break;

package/dist/{chunk-ZGYNKA3O.js → chunk-TT5BBVLX.js}

@@ -15,7 +15,7 @@ import {
 } from "./chunk-L25OAFOU.js";
 import {
   loadLicense
-} from "./chunk-L6RXG36J.js";
+} from "./chunk-Y2HD2YB7.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";
@@ -1770,6 +1770,10 @@ ${details}
 Fix registry authentication or publish the missing image(s), then re-run stack-update.`
   );
 }
+var defaultContainerCountSnapshot = () => {
+  const snapshot = spawnSync("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
+  return snapshot.stdout?.split("\n").filter(Boolean).length ?? 0;
+};
 var defaultImageLabelReader = (image, label) => {
   try {
     return readImageLabel(image, label);
@@ -2501,6 +2505,16 @@ var CRITICAL_VOLUMES = [
   "clickhouse_data",
   "erp_sites"
 ];
+var defaultVolumeExists = (volumeName) => spawnSync(
+  "docker",
+  ["volume", "inspect", volumeName],
+  {
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 5e3,
+    killSignal: "SIGKILL"
+    // SIGTERM'd docker CLIs on a hung daemon linger as orphans
+  }
+).status === 0;
 function assertBindMountsExist(stackDir) {
   const missing = [];
   for (const mount of CRITICAL_BIND_MOUNTS) {
@@ -2515,16 +2529,10 @@ function assertBindMountsExist(stackDir) {
     console.warn("[stack-update] These files contain customer config that will be lost if not present.");
   }
 }
-function assertVolumesIntact() {
+function assertVolumesIntact(volumeExists = defaultVolumeExists) {
   const missing = [];
   for (const vol of CRITICAL_VOLUMES) {
-    const result = spawnSync("docker", ["volume", "inspect", `exe-os_${vol}`], {
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 5e3,
-      killSignal: "SIGKILL"
-      // SIGTERM'd docker CLIs on a hung daemon linger as orphans
-    });
-    if (result.status !== 0) {
+    if (!volumeExists(`exe-os_${vol}`)) {
       missing.push(vol);
     }
   }
@@ -2533,20 +2541,10 @@ function assertVolumesIntact() {
     console.warn("[stack-update] Data may have been lost. Check if 'docker compose down -v' was used.");
   }
 }
-function warnLegacyDaemonVolume() {
-  const legacy = spawnSync("docker", ["volume", "inspect", "exe-os_exed_data"], {
-    stdio: ["pipe", "pipe", "pipe"],
-    timeout: 5e3,
-    killSignal: "SIGKILL"
-    // SIGTERM'd docker CLIs on a hung daemon linger as orphans
-  });
-  const current = spawnSync("docker", ["volume", "inspect", "exe-os_exe_os_data"], {
-    stdio: ["pipe", "pipe", "pipe"],
-    timeout: 5e3,
-    killSignal: "SIGKILL"
-    // SIGTERM'd docker CLIs on a hung daemon linger as orphans
-  });
-  if (legacy.status === 0 && current.status === 0) {
+function warnLegacyDaemonVolume(volumeExists = defaultVolumeExists) {
+  const legacy = volumeExists("exe-os_exed_data");
+  const current = volumeExists("exe-os_exe_os_data");
+  if (legacy && current) {
     console.warn("[stack-update] \u26A0 Legacy volume exe-os_exed_data exists alongside exe-os_exe_os_data.");
     console.warn("[stack-update] Keeping both volumes intact; after verifying exe_os_data has current daemon state, remove exed_data manually if desired.");
   }
@@ -2607,7 +2605,7 @@ async function runStackUpdate(options) {
     if (!options.dryRun) assertHostReadyForApply(report);
   }
   assertBindMountsExist(path.dirname(options.envFile));
-  warnLegacyDaemonVolume();
+  warnLegacyDaemonVolume(options.volumeExists);
   if (!options.dryRun) {
     try {
       const endPhase = startPhase("preflight");
@@ -3125,8 +3123,8 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       ...RESTART_ORDER.filter((service) => scopedComposeServices.includes(service)),
       ...scopedComposeServices.filter((service) => !RESTART_ORDER.includes(service))
     ];
-    const preSnapshot = spawnSync("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
-    const preContainerCount = preSnapshot.stdout?.split("\n").filter(Boolean).length ?? 0;
+    const containerCountSnapshot = options.containerCountSnapshot ?? defaultContainerCountSnapshot;
+    const preContainerCount = containerCountSnapshot();
     console.log(`[stack-update] Pre-update snapshot: ${preContainerCount} containers`);
     const bundledIsolation = Object.keys(plan.release.services).length > 1;
     const failedManifestServices = /* @__PURE__ */ new Set();
@@ -3152,7 +3150,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       if (!serviceDefined) continue;
       progress.logServiceStep(restartIndex, service, "Restarting");
       if (service === "exe-wiki") {
-        const guard = spawnSync(
+        const guard = options.runWikiSchemaGuard ? { status: options.runWikiSchemaGuard() } : spawnSync(
           "docker",
           [...composeArgs, "run", "--rm", "--no-deps", "exe-wiki-schema-guard"],
           { encoding: "utf8", stdio: ["pipe", "inherit", "inherit"], timeout: 12e4 }
@@ -3222,8 +3220,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
     if (!restartedAnyService) {
       exec("docker", [...composeArgs, "up", "-d", "--remove-orphans"]);
     }
-    const postSnapshot = spawnSync("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
-    const postContainerCount = postSnapshot.stdout?.split("\n").filter(Boolean).length ?? 0;
+    const postContainerCount = containerCountSnapshot();
     console.log(`[stack-update] Post-update snapshot: ${postContainerCount} containers (was ${preContainerCount})`);
     if (postContainerCount < preContainerCount) {
       console.warn(`[stack-update] \u26A0 Container count dropped from ${preContainerCount} to ${postContainerCount}`);
@@ -3352,7 +3349,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       }
       console.warn("[stack-update] Health gate check skipped (module not available)");
     }
-    assertVolumesIntact();
+    assertVolumesIntact(options.volumeExists);
     try {
       if (!options.verifyStack) {
         throw new Error("verifyStack hook not provided");
@@ -3362,7 +3359,8 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       for (const r of verifyReport.results) {
         if (r.status === "fail") {
           console.warn(`[verify-stack] FAIL: ${r.check}: ${r.message}`);
-          if (/security|auth|signup|password|ssl|tls|bind|exposed/i.test(r.check)) {
+          const isTruncatedRun = r.check === "Total timeout";
+          if (isTruncatedRun || /security|auth|signup|password|ssl|tls|bind|exposed/i.test(r.check)) {
             securityFailures.push(`${r.check}: ${r.message}`);
           }
         }

package/dist/{chunk-5H47VHB7.js → chunk-UWX6MMCX.js}

@@ -3,7 +3,7 @@ import {
   isWellFormedCommit,
   isWellFormedSupportId,
   isWellFormedVersion
-} from "./chunk-4QCFFW2H.js";
+} from "./chunk-5QCIWWFA.js";
 
 // src/lib/support-schemas.ts
 import { z } from "zod";

package/dist/{chunk-XL5MFGMR.js → chunk-V4YNN7PA.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-4YNA3CM6.js";
 import {
   sessionScopeFilter
-} from "./chunk-AKLQSC6W.js";
+} from "./chunk-KI7O64XV.js";
 
 // src/shared/task-completion-gate.ts
 var COMPLETION_CLAIM_STATUSES = ["done", "needs_review", "closed"];
@@ -130,7 +130,14 @@ function getRecentCommits(limit = DEFAULT_COMMIT_LIMIT) {
   }
 }
 function pushUnpushedCommits() {
-  const run = (args) => execSync(`git ${args}`, { encoding: "utf8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
+  const run = (args) => execSync(`git ${args}`, {
+    encoding: "utf8",
+    timeout: 15e3,
+    stdio: ["pipe", "pipe", "pipe"],
+    // GIT_TERMINAL_PROMPT=0: fail fast instead of hanging on an interactive
+    // credential prompt — this runs from agent sessions with no TTY.
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  }).trim();
   let branch;
   try {
     branch = run("rev-parse --abbrev-ref HEAD");
@@ -289,7 +296,7 @@ async function sweepTasks(projectName, options = {}) {
     }
     if (!dryRun) {
       try {
-        const { updateTaskStatus } = await import("./tasks-crud-ZRQNJXQ2.js");
+        const { updateTaskStatus } = await import("./tasks-crud-45WOIMIM.js");
         await updateTaskStatus({
           taskId: task.id,
           status: "needs_review",

package/dist/{chunk-SL6KQYDU.js → chunk-V5DDXXMP.js}

@@ -7,23 +7,23 @@ import {
   resolveExeSession,
   sendIntercom,
   strictSessionScopeFilter
-} from "./chunk-AKLQSC6W.js";
-import {
-  isValidSessionScope
-} from "./chunk-BTSWFMEH.js";
+} from "./chunk-KI7O64XV.js";
 import {
   parseMessage,
   serializeMessage
-} from "./chunk-QAEWWYHL.js";
+} from "./chunk-TDF2XKLK.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-W75GTHR3.js";
+} from "./chunk-3SRZNJKD.js";
 import {
   getSessionKey
 } from "./chunk-CVYC6DUW.js";
+import {
+  isValidSessionScope
+} from "./chunk-BTSWFMEH.js";
 import {
   getClient
-} from "./chunk-TAMDAOCU.js";
+} from "./chunk-66CGXQUA.js";
 
 // src/lib/messaging.ts
 import crypto from "crypto";

package/dist/{chunk-DZKPOSFD.js → chunk-VH6SPPNA.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-TAMDAOCU.js";
+} from "./chunk-66CGXQUA.js";
 
 // src/lib/token-budget.ts
 var WARN_THRESHOLD = 0.8;

package/dist/{chunk-LDNYSMPZ.js → chunk-VJUUI2VT.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-WSQASFLP.js";
+} from "./chunk-VCTK5HRA.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-CBCGDEJA.js → chunk-VN5WOOAQ.js}

@@ -1,18 +1,20 @@
 import {
   employeeSessionName,
   ensureEmployee,
+  getDispatchedBy,
+  liveSessionHoldingTask,
   markAsReadByTaskFile,
   notifyParentExe,
   queryTaskRows,
   resolveExeSession,
   sendIntercom
-} from "./chunk-AKLQSC6W.js";
+} from "./chunk-KI7O64XV.js";
 import {
   getTransport
 } from "./chunk-VI4ATC6I.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-W75GTHR3.js";
+} from "./chunk-3SRZNJKD.js";
 import {
   releaseDispatchClaim,
   tryAcquireDispatchClaim
@@ -27,7 +29,7 @@ import {
   isCoordinatorName,
   isMultiInstance,
   shouldAutoInstance
-} from "./chunk-TAMDAOCU.js";
+} from "./chunk-66CGXQUA.js";
 
 // src/lib/tasks-notify.ts
 var VERIFY_DELAY_MS = 1e4;
@@ -89,7 +91,7 @@ async function dispatchTaskToEmployee(input) {
   let crossProject = false;
   if (input.projectName) {
     try {
-      const { assertSessionScope } = await import("./session-scope-KRWE54C4.js");
+      const { assertSessionScope } = await import("./session-scope-DKOHPQPJ.js");
       const check = assertSessionScope("dispatch_task", input.projectName);
       if (check.reason === "cross_session_denied") {
         crossProject = true;
@@ -107,6 +109,27 @@ async function dispatchTaskToEmployee(input) {
     } catch {
     }
   }
+  if (input.taskId) {
+    const holder = await liveSessionHoldingTask(input.taskId, input.sessionScope ?? null);
+    if (holder) {
+      process.stderr.write(
+        `[dispatch-audit] SPAWN SUPPRESSED -> ${input.assignedTo} | task="${input.title}" [${input.priority}] | task ${input.taskId} already in_progress on live session ${holder}; not spawning a duplicate
+`
+      );
+      recordOrchestrationEventBestEffort({
+        eventType: "dispatch.deduped",
+        source: "tasks-notify.dispatchTaskToEmployee",
+        severity: "info",
+        taskId: input.taskId,
+        agentId: input.assignedTo,
+        tmuxSession: holder,
+        runtime: dispatchRuntime,
+        result: "skipped",
+        payload: { reason: "task_held_by_live_session", holder }
+      });
+      return { dispatched: "skipped", session: holder, deduped: true, crossProject };
+    }
+  }
   let claimedDispatch = false;
   if (input.taskId) {
     claimedDispatch = tryAcquireDispatchClaim(input.taskId, input.assignedTo);
@@ -298,13 +321,25 @@ async function dispatchTaskToEmployee(input) {
     return { dispatched: "session_missing" };
   }
 }
-function notifyTaskDone() {
+function resolveCompletionNudgeRecipient(reviewer, dispatcher) {
+  const r = reviewer == null ? "" : String(reviewer).trim();
+  if (r) return { agent: r, via: "reviewer" };
+  const d = dispatcher == null ? "" : String(dispatcher).trim();
+  if (d) return { agent: d, via: "dispatcher" };
+  return { agent: null, via: "none" };
+}
+function notifyTaskDone(reviewer) {
   try {
     const key = getSessionKey();
     if (key && !process.env.VITEST) {
+      const dispatcher = getDispatchedBy(key);
+      const routing = resolveCompletionNudgeRecipient(reviewer, dispatcher);
+      if (routing.via !== "dispatcher") {
+        return;
+      }
       notifyParentExe(key);
       process.stderr.write(
-        `[dispatch-audit] notifyTaskDone \u2192 parent coordinator (session=${key})
+        `[dispatch-audit] notifyTaskDone \u2192 dispatcher (session=${key})
 `
       );
     }
@@ -321,6 +356,7 @@ async function markTaskNotificationsRead(taskFile) {
 export {
   verifyDispatch,
   dispatchTaskToEmployee,
+  resolveCompletionNudgeRecipient,
   notifyTaskDone,
   markTaskNotificationsRead
 };