@askexenow/exe-os 0.9.377 → 0.9.378

package/deploy/compose/.env.example

@@ -27,7 +27,10 @@ REDIS_PASSWORD=CHANGEME_REDIS_PASSWORD
 # Off-box upload: the daily cron runs `backup.sh --upload-r2`. Without this the
 # encrypted archive only ever lands on the same disk as live data (disk death =
 # total loss). R2 creds are reused from the R2_MEDIA_* vars when set.
-# EXE_BACKUP_KEY=CHANGEME_EXE_BACKUP_KEY   # 256-bit key — encrypts archives at rest
+# EXE_BACKUP_KEY is REQUIRED for off-box upload — backup.sh refuses to push an
+# unencrypted archive to R2/S3. A generated .env gets a random one; set yours with
+#   EXE_BACKUP_KEY=$(openssl rand -base64 32)
+EXE_BACKUP_KEY=CHANGEME_EXE_BACKUP_KEY
 BACKUP_RETENTION_DAYS=7
 # Override the DB container name if your topology differs (default: exe-db).
 # BACKUP_DB_CONTAINER=exe-db

package/deploy/compose/backup.sh

@@ -139,7 +139,8 @@ rm -rf "$ARCHIVE"
 echo "[backup] Archive: $TARFILE ($(du -h "$TARFILE" | cut -f1))"
 
 # 6b. Encrypt before upload — customer data never leaves the VPS unencrypted.
-# Uses EXE_BACKUP_KEY from .env (256-bit, generated at setup).
+# Uses EXE_BACKUP_KEY from .env (256-bit, generated by generate-env.ts and
+# backfilled onto existing hosts by tasks/backup-cron.yml).
 # Without this key, R2 backups are unreadable — even AskExe cannot access them.
 BACKUP_KEY="${EXE_BACKUP_KEY:-}"
 if [[ -z "$BACKUP_KEY" && -f "$SCRIPT_DIR/.env" ]]; then
@@ -156,8 +157,19 @@ if [[ -n "$BACKUP_KEY" ]]; then
   rm -f "$TARFILE"
   TARFILE="$ENCRYPTED_FILE"
   echo "[backup] Encrypted: $TARFILE ($(du -h "$TARFILE" | cut -f1))"
+elif $UPLOAD_R2 || [[ -n "$UPLOAD_S3" ]]; then
+  # Off-box upload without a key would push the WHOLE archive — pg_dumpall of
+  # every database, the stack .env with POSTGRES_PASSWORD and GOTRUE_JWT_SECRET
+  # in it, and the WhatsApp auth state — to third-party object storage in
+  # plaintext. The deploy playbook installs `backup.sh --upload-r2` as a nightly
+  # root cron, so a warn-and-continue here meant every box whose .env never got
+  # the key shipped customer data in the clear every night. Refuse. An operator
+  # who wants an unencrypted archive can still take one — locally, by running
+  # backup.sh with no upload flag.
+  fail "encrypt" "EXE_BACKUP_KEY not set — refusing to upload UNENCRYPTED customer data off-box. Set EXE_BACKUP_KEY in /opt/exe-stack/.env (openssl rand -base64 32), or drop --upload-r2/--upload-s3 to keep the archive on this host."
 else
   echo "[backup] WARNING: EXE_BACKUP_KEY not set — backup NOT encrypted. Set it in .env for E2E encryption." >&2
+  echo "[backup] (an off-box upload would have been refused; local-only archive kept)" >&2
 fi
 
 # 7. Retention — delete old backups (match BOTH .tar.gz and encrypted .tar.gz.enc).

package/deploy/compose/generate-env.ts

@@ -225,6 +225,17 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "",
     `REDIS_PASSWORD=${randomSecret(RANDOM_SECRET_32)}`,
     "",
+    "# --- Backups ---",
+    "# The nightly cron installed by deploy.yml runs `backup.sh --upload-r2`, which",
+    "# pushes the archive to third-party object storage. That archive contains a",
+    "# pg_dumpall of every database, THIS .env (POSTGRES_PASSWORD, GOTRUE_JWT_SECRET),",
+    "# and the WhatsApp auth state — so it is encrypted with AES-256 under the key",
+    "# below before it leaves the host, and backup.sh REFUSES to upload without one.",
+    "# Generated here rather than left commented out: an unset key used to mean a",
+    "# silent plaintext upload every night. Keep a copy — losing it makes every",
+    "# off-box backup unrecoverable, by design (not even AskExe can read them).",
+    `EXE_BACKUP_KEY=${randomSecret(RANDOM_SECRET_32)}`,
+    "",
     "# --- GoTrue (shared auth) ---",
     `GOTRUE_JWT_SECRET=${randomSecret(RANDOM_SECRET_48)}`,
     "GOTRUE_API_PORT=9999",
@@ -530,7 +541,10 @@ export function generateExampleEnv(): string {
     "# Off-box upload: the daily cron runs `backup.sh --upload-r2`. Without this the",
     "# encrypted archive only ever lands on the same disk as live data (disk death =",
     "# total loss). R2 creds are reused from the R2_MEDIA_* vars when set.",
-    "# EXE_BACKUP_KEY=CHANGEME_EXE_BACKUP_KEY   # 256-bit key — encrypts archives at rest",
+    "# EXE_BACKUP_KEY is REQUIRED for off-box upload — backup.sh refuses to push an",
+    "# unencrypted archive to R2/S3. A generated .env gets a random one; set yours with",
+    "#   EXE_BACKUP_KEY=$(openssl rand -base64 32)",
+    "EXE_BACKUP_KEY=CHANGEME_EXE_BACKUP_KEY",
     "BACKUP_RETENTION_DAYS=7",
     "# Override the DB container name if your topology differs (default: exe-db).",
     "# BACKUP_DB_CONTAINER=exe-db",

package/deploy/compose/uptime-check.sh

@@ -35,6 +35,20 @@ check_http() {
   fi
 }
 
+# --- Data-access boundary ---
+# This script NEVER reads customer rows. It runs as a root-owned host health
+# check on the customer's own VPS and is restricted, deliberately, to two kinds
+# of query against the stack Postgres container:
+#   1. liveness  — `SELECT 1`, which touches no relation at all;
+#   2. catalog   — pg_class / pg_namespace metadata about whether the wiki's
+#                  tables EXIST in the schema the container is pointed at.
+# It previously ran `count(*)` over <schema>.users and <schema>.workspace_documents.
+# That is a scan of customer tables by a host cron, outside the data-access
+# boundary the repo requires for customer data, and it was flagged as such in
+# review of #922. Catalog metadata answers the question the check actually asks
+# ("is the wiki pointed at a schema that has its tables?") without reading a
+# single row. Everything that escapes these functions is a fixed status token
+# (ok / fail:<reason> / skip) written to a root-owned JSONL.
 check_postgres() {
   local result
   result=$(docker exec exe-db psql -U "${POSTGRES_USER:-exe}" -d "${POSTGRES_DB:-exedb}" \
@@ -99,8 +113,12 @@ NOW=$(ts)
 # and no error anywhere — silent-empty, which is the whole failure mode. Checking it
 # here bounds how long that can go unnoticed to one cron interval.
 # Reads the LIVE container env, not .env: a compose override can rewrite DATABASE_URL.
+# Data-access note: CATALOG METADATA ONLY — no customer row is read (see the
+# boundary note above check_postgres). This cannot be done through the wiki's
+# own HTTP API — the wiki serves 200 on an empty schema, which IS the failure
+# mode being detected.
 check_wiki_schema() {
-  local url schema counts users docs
+  local url schema rows
   url=$(docker inspect exe-wiki --format '{{range .Config.Env}}{{println .}}{{end}}' 2>/dev/null \
     | sed -n 's/^DATABASE_URL=//p')
   [[ -z "$url" ]] && { echo "skip"; return; }
@@ -108,16 +126,47 @@ check_wiki_schema() {
   [[ -z "$schema" ]] && schema="public"
   # Only ever interpolate a bare identifier into SQL.
   [[ ! "$schema" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] && { echo "fail:bad-schema-name"; return; }
-  counts=$(docker exec exe-db psql -U "${POSTGRES_USER:-exe}" -d "${POSTGRES_DB:-exedb}" -tA -F' ' -c \
-    "SELECT COALESCE((SELECT count(*) FROM ${schema}.users), 0),
-            COALESCE((SELECT count(*) FROM ${schema}.workspace_documents), 0)" 2>/dev/null)
-  [[ -z "$counts" ]] && { echo "skip"; return; }
-  users=$(echo "$counts" | awk '{print $1}')
-  docs=$(echo "$counts" | awk '{print $2}')
-  if [[ "${users:-0}" -gt 0 || "${docs:-0}" -gt 0 ]]; then
+  # `to_regnamespace`/`to_regclass` return NULL instead of erroring on a name
+  # that does not exist, so a wrong schema comes back as a clean "missing"
+  # rather than as an aborted query indistinguishable from "psql is down".
+  # Identifiers are lowercased first: unquoted SQL folds case, but the string
+  # form fed to to_regnamespace does not, so `?schema=Wiki` would otherwise
+  # look missing when it is fine.
+  schema=$(printf '%s' "$schema" | tr '[:upper:]' '[:lower:]')
+  rows=$(docker exec exe-db psql -U "${POSTGRES_USER:-exe}" -d "${POSTGRES_DB:-exedb}" -tA -F' ' -c \
+    "SELECT t.tbl,
+            CASE WHEN c.oid IS NULL THEN 'missing' ELSE 'present' END,
+            COALESCE(c.reltuples::bigint, -1)
+       FROM (VALUES ('users'), ('workspace_documents')) AS t(tbl)
+       LEFT JOIN pg_class c
+              ON c.relname = t.tbl
+             AND c.relkind IN ('r', 'p')
+             AND c.relnamespace = to_regnamespace('${schema}')
+      ORDER BY t.tbl" 2>/dev/null)
+  # Two rows are always returned when the query ran at all; anything else means
+  # the container or psql is unavailable, which check_postgres already reports.
+  [[ "$(printf '%s\n' "$rows" | grep -c .)" -ne 2 ]] && { echo "skip"; return; }
+
+  local missing est max_est=-1
+  missing=$(printf '%s\n' "$rows" | awk '$2 == "missing" { print $1 }' | paste -sd, -)
+  if [[ -n "$missing" ]]; then
+    # The wrong-schema failure mode: the container is pointed somewhere its
+    # tables were never created. This is the signal bug 2a8d3003 is about.
+    echo "fail:missing-tables-$schema($missing)"
+    return
+  fi
+  while read -r _ _ est; do
+    [[ "${est:-0}" -gt "$max_est" ]] && max_est="$est"
+  done < <(printf '%s\n' "$rows")
+  if [[ "$max_est" -gt 0 ]]; then
     echo "ok:$schema"
   else
-    echo "fail:empty-schema-$schema"
+    # reltuples is a PLANNER ESTIMATE, and it is 0 or -1 on a table that has
+    # simply never been ANALYZEd — which is exactly the state of a freshly
+    # restored or freshly migrated wiki that DOES have rows. Reporting "empty"
+    # here would fire the critical DO-NOT-RESTORE alert below on a healthy
+    # host, so an unknown estimate is reported as unknown, never as a failure.
+    echo "unknown:$schema-stats-stale"
   fi
 }
 

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-02T16:27:58.480Z",
-  "manifest_sha256": "ece576114533d5eefd5825e465bb966df86e4e85d74e520fe6c9796f7f3d763f",
-  "package_version": "0.9.377"
+  "verified_at": "2026-09-02T17:30:10.063Z",
+  "manifest_sha256": "2ac28000eca0fef6a9f2dd65b7297c98868732c8a9cbcd1ff178fc30e2119ccb",
+  "package_version": "0.9.378"
 }

package/dist/bin/cli.js

@@ -709,14 +709,14 @@ ${JSON.stringify(stormAlert, null, 2)}`);
   const { runStackUpdateCli } = await import("./stack-update.js");
   await runStackUpdateCli(args.slice(1));
 } else if (args[0] === "release") {
-  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-MY6U2QIO.js");
+  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-JFB3NJLO.js");
   const releaseFlags = parseReleaseArgs(args.slice(1));
   await runStackRelease(releaseFlags);
 } else if (args[0] === "stack-promote") {
-  const { runStackPromoteCli } = await import("../stack-promote-OP2URGFF.js");
+  const { runStackPromoteCli } = await import("../stack-promote-Y4JXWM6R.js");
   await runStackPromoteCli(args.slice(1));
 } else if (args[0] === "stack-generate-manifest") {
-  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-7WJZWSPK.js");
+  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-BR3GZESE.js");
   process.exit(await runStackGenerateManifestCli(args.slice(1)));
 } else if (args[0] === "repo-truth") {
   const { runRepoTruthCli } = await import("./exe-repo-truth.js");

package/dist/bin/registry-proxy.js

@@ -2,7 +2,7 @@
 import {
   registryProxyOptionsFromEnv,
   runRegistryProxy
-} from "../chunk-FCMQVEVL.js";
+} from "../chunk-A3P3CLE6.js";
 import {
   isMainModule
 } from "../chunk-6Y4B3QF6.js";

package/dist/bin/stack-update.js

@@ -27,8 +27,8 @@ import {
   serviceSelectionPath,
   verifyManifestImagesAvailable,
   warnUnmanagedManifestServices
-} from "../chunk-TT5BBVLX.js";
-import "../chunk-GHR4ZPJ7.js";
+} from "../chunk-5IUXUD3X.js";
+import "../chunk-EC5H53YD.js";
 import {
   runVerifyStack
 } from "../chunk-PTY2N23C.js";
@@ -43,7 +43,7 @@ import {
 import {
   logResult,
   runHealthGate
-} from "../chunk-JRMHGO5B.js";
+} from "../chunk-U3GM5MYE.js";
 import "../chunk-L25OAFOU.js";
 import "../chunk-W5MCOZTW.js";
 import "../chunk-FTZET5YX.js";

package/dist/bin/vps-health-gate.js

@@ -8,7 +8,7 @@ import {
   logResult,
   main,
   runHealthGate
-} from "../chunk-JRMHGO5B.js";
+} from "../chunk-U3GM5MYE.js";
 import "../chunk-MLKGABMK.js";
 export {
   checkCRM,

package/dist/build-manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "generated_at": "2026-09-02T16:27:58.225Z",
+  "generated_at": "2026-09-02T17:30:09.805Z",
   "files": [
     {
       "path": "active-agent-BOBBUJ74.js",
@@ -179,7 +179,7 @@
     },
     {
       "path": "bin/cli.js",
-      "sha256": "6eeb0981cbf05a14ade008e2a90ceff9eaeccd8e8ed12ae6e21bfff0d105764d",
+      "sha256": "ff0ebe61eb90170c55e5e3b19df328a051f73a6a4bd40233e168b3e9e9a22ac1",
       "bytes": 65011
     },
     {
@@ -524,7 +524,7 @@
     },
     {
       "path": "bin/registry-proxy.js",
-      "sha256": "210ef9c6dd138c23e7e0a9c7e51c666e428d0a8a22dfe401e875d06985027cea",
+      "sha256": "2d38e5b49eb5749a62453f23c9d84fb3b0fb7f2bce3922a7eafefe295a020648",
       "bytes": 1885
     },
     {
@@ -544,7 +544,7 @@
     },
     {
       "path": "bin/stack-update.js",
-      "sha256": "30c3ff8677417684e8c8208b372717fe94fed940f7c9e6dd9ef1fac26635350b",
+      "sha256": "e0ff5ef9a72ab3afb5e26e9b52cbe4bdb14649d40a9b892a484de419b55ab1b0",
       "bytes": 57247
     },
     {
@@ -564,7 +564,7 @@
     },
     {
       "path": "bin/vps-health-gate.js",
-      "sha256": "ea15238d388d7b94f937282d05a5a5b82cff60562ef04818983dd5e49c0989be",
+      "sha256": "c5489e1f08d2f20572bd17a3ef584abc4472cb387514f992c044f9d5c47037af",
       "bytes": 333
     },
     {
@@ -647,6 +647,11 @@
       "sha256": "0aae97bac703b5f5102ff180a9b279efb0f0e6b208cb4292f83d353ff47924e7",
       "bytes": 3642
     },
+    {
+      "path": "chunk-3M3N7D7O.js",
+      "sha256": "da17bad4260b6af38836556ef7b2698b9ec8c66ec3633c70558c8bd8c8d17f53",
+      "bytes": 3250
+    },
     {
       "path": "chunk-3OEVDGIY.js",
       "sha256": "ed3690ce4d418043eb922810ed6b67ed626119ff677ef351def6e0bf1e6016d7",
@@ -747,6 +752,11 @@
       "sha256": "19a9706b415bb25b177a37e1192d9df7d2cfc60cf3c0d997fc5d87c5001e59b1",
       "bytes": 6076
     },
+    {
+      "path": "chunk-5IUXUD3X.js",
+      "sha256": "9d553f894e977b53724f71de8a6d9f0a8aec2f48a0700bbb19d245bd60cd660a",
+      "bytes": 186260
+    },
     {
       "path": "chunk-5MOYSU5A.js",
       "sha256": "c2e2367cffa3e57666f0307f2374f6ca8cbf2f07ba45b7361d680e8271be90ec",
@@ -762,11 +772,6 @@
       "sha256": "80bfcc6daf45ce066dc277b635bdeba44e42387f0c3b4cfee22287bac913612a",
       "bytes": 20507
     },
-    {
-      "path": "chunk-5QKLWJ4Z.js",
-      "sha256": "5ee3b527880c81a19faf07ab497b6c58260a795b5fb753313015ff6029e049cf",
-      "bytes": 3250
-    },
     {
       "path": "chunk-5UBWBXLF.js",
       "sha256": "a36075b55ed774c96edb71e5ed68e0aad3c2cc91c82807d374ab3762081ab601",
@@ -867,6 +872,11 @@
       "sha256": "9ffc6029453a6cecb1164230dbe11515f25d93db4e7d7568a2a9b363ff6689f2",
       "bytes": 12110
     },
+    {
+      "path": "chunk-A3P3CLE6.js",
+      "sha256": "24bc185c48cdc2736374cf83a594eeecd488987e19f539bbfc2fde38985b2146",
+      "bytes": 30665
+    },
     {
       "path": "chunk-A7JYF4RG.js",
       "sha256": "3517b5704e13c31d180df1840da5a4ddf3b55cbad396daa963e783bb9c8f6846",
@@ -1047,6 +1057,11 @@
       "sha256": "0391139d25845faff65e341cf4edf95bb48a2976fbc2a99f35dd47f661cfdb1f",
       "bytes": 21845
     },
+    {
+      "path": "chunk-EC5H53YD.js",
+      "sha256": "31542497d924523e81c2fe63027b0a008d756ce0682592f0de592649a5188302",
+      "bytes": 3928
+    },
     {
       "path": "chunk-ECGTESAP.js",
       "sha256": "80fa0c3b882a1c739530913a08ab4c46e89c76c665ef45084be4baa8fe187283",
@@ -1087,11 +1102,6 @@
       "sha256": "50cfb3eeca20703519c19f97c16bca1578e6d41bf068adca7d62ea37e0cab4be",
       "bytes": 3242
     },
-    {
-      "path": "chunk-FCMQVEVL.js",
-      "sha256": "8b74587c379962e637612221d6677b16ea88405bc7c22f0a0a8c63229b4fcf7e",
-      "bytes": 30665
-    },
     {
       "path": "chunk-FNEZ4BWT.js",
       "sha256": "03b95f888cd6e804bdfe00e94a9ed83aac34a59e3bf28cd1c3995b5e273a3532",
@@ -1142,11 +1152,6 @@
       "sha256": "6d3b5ff73e66f76bcdcad9cc898bd85904e6ffc3c27bb340055eae1a4d28fe81",
       "bytes": 1155
     },
-    {
-      "path": "chunk-GHR4ZPJ7.js",
-      "sha256": "6f9dc5236c64d9ff74cd8247cc7667d9dcd01c4a5062f2b84a6289b5c589685a",
-      "bytes": 2490
-    },
     {
       "path": "chunk-GJV3WDWM.js",
       "sha256": "59017c5a02fd07899282dfaaad148e33de6fa003a9b6bdae78b60fdd9d3acc9f",
@@ -1307,11 +1312,6 @@
       "sha256": "533a919e763433ed5e882f31ee225e3a75ae8a643d2936a17767722a6f52fe7d",
       "bytes": 3708
     },
-    {
-      "path": "chunk-JRMHGO5B.js",
-      "sha256": "2322ed24b906fe73faa32d00dfb0dc171094e6611e446b95289c804105426258",
-      "bytes": 7587
-    },
     {
       "path": "chunk-JSTTPYL3.js",
       "sha256": "acc037274d4e9a5a5705b3f24c44a891dd55f37e428173d29f2d9f582809a24e",
@@ -1772,16 +1772,16 @@
       "sha256": "c044678bdb81f58be175ce56eec162b1f678b19509eafa8893e3beac7def6f72",
       "bytes": 2633
     },
-    {
-      "path": "chunk-TT5BBVLX.js",
-      "sha256": "5d609d7dc2f4979fb6e8c6326eee56ff9d9c8cf60b92bc252df0c1356b2955e2",
-      "bytes": 186260
-    },
     {
       "path": "chunk-TWMWHDOY.js",
       "sha256": "d1a4b120060e1bda1c09919ff863fbb281c71f017d89b31f47e8df07587814c0",
       "bytes": 2488
     },
+    {
+      "path": "chunk-U3GM5MYE.js",
+      "sha256": "7760a15dba0485ca567c96c9c1e0c3bf59c9bbdc9223869336a7481fd3a25019",
+      "bytes": 7587
+    },
     {
       "path": "chunk-UBMZ3YQU.js",
       "sha256": "340c9342ed76ef63e08ecb48573e8b76ad912f640876b0d50152839f747b6078",
@@ -2464,7 +2464,7 @@
     },
     {
       "path": "hooks/manifest.json",
-      "sha256": "aafff5a963888bc061f2b3ce1bdbedc27cc8097b090b0876624bdeb67e0bc28d",
+      "sha256": "935211c99bdd95f9dd65e1a3126e66b8366d3e3e2e4c021dd0e299d98f397e1f",
       "bytes": 1841
     },
     {
@@ -2754,7 +2754,7 @@
     },
     {
       "path": "lib/registry-proxy.js",
-      "sha256": "69a2584b0bf78c3dbdba042a0394f4bef3bb7331669e665e62152990d315a1e1",
+      "sha256": "bde5270fe62007134099d85e5c7ae1e8500c6c844204bcf8662ed946fe3b56d9",
       "bytes": 527
     },
     {
@@ -3188,9 +3188,9 @@
       "bytes": 433
     },
     {
-      "path": "resolve-image-labels-ZI6UBW5W.js",
-      "sha256": "6bd9adeeb3053a1dde6946549776b6799d29f64f188ef57941381eaa6cc0dc0d",
-      "bytes": 275
+      "path": "resolve-image-labels-N27XXTUG.js",
+      "sha256": "d3f89a38f106f08cb7f736894a6629e6ce1bf2ae8bcb03f0bf9b9fcf2269bcc5",
+      "bytes": 333
     },
     {
       "path": "restore-proof-HR4TXI3X.js",
@@ -3293,23 +3293,23 @@
       "bytes": 111
     },
     {
-      "path": "stack-generate-manifest-7WJZWSPK.js",
-      "sha256": "7ba8f753a1f780fe8916e440584656098002ecf7d689056708be04ba98a4de65",
+      "path": "stack-generate-manifest-BR3GZESE.js",
+      "sha256": "65b10366eb91c3f157ef01682b81f22c8ea0ec80c0436aef31661b8a86b29047",
       "bytes": 42703
     },
     {
-      "path": "stack-promote-OP2URGFF.js",
-      "sha256": "37ac150a4f2b428aa3fb50dd8028e69b16814e61ab6980ae2e3ec407e0310d1a",
+      "path": "stack-promote-Y4JXWM6R.js",
+      "sha256": "4e4f5cae4da628657e7045b26a68895885f232fb2e0a43890592227766caa06e",
       "bytes": 7395
     },
     {
-      "path": "stack-release-MY6U2QIO.js",
-      "sha256": "aba7c9b54baea1cb4dede11736e36679639610dfb114070e251a03ca597d1c73",
+      "path": "stack-release-JFB3NJLO.js",
+      "sha256": "fcc7c556b206f0da831d25a5f15184c656097dd532528488d5ce92e6dc79e1ec",
       "bytes": 57491
     },
     {
-      "path": "stack-update-QSHSLUTZ.js",
-      "sha256": "dd8465cdd58a08ff6eb6579b3f4acdfb5e22acb4835a842db9583a806e9bdcff",
+      "path": "stack-update-SWRZLQVQ.js",
+      "sha256": "09bb94cf4e2a6cc99d7c7d112d0de93573cefbe3e1e2faba42af820f0f910f08",
       "bytes": 6185
     },
     {

package/dist/{chunk-5QKLWJ4Z.js → chunk-3M3N7D7O.js}

@@ -1,6 +1,6 @@
 import {
   canonicalizeStackManifest
-} from "./chunk-TT5BBVLX.js";
+} from "./chunk-5IUXUD3X.js";
 
 // src/lib/stack-manifest-write.ts
 import { readFileSync, writeFileSync } from "fs";

package/dist/{chunk-TT5BBVLX.js → chunk-5IUXUD3X.js}

@@ -1,6 +1,6 @@
 import {
   readImageLabel
-} from "./chunk-GHR4ZPJ7.js";
+} from "./chunk-EC5H53YD.js";
 import {
   clearDeployStalenessAlert,
   deployStalenessAlertPath,

package/dist/{chunk-FCMQVEVL.js → chunk-A3P3CLE6.js}

@@ -136,7 +136,7 @@ async function assertManifestSignature(manifest, publicKeyPem) {
       "manifest carries no `signature`. Fleets that enforce EXE_STACK_PUBLIC_KEY reject unsigned manifests, so publishing one would ship a release no host can install. Re-sign with the custodied key: node scripts/sign-stack-manifest.mjs deploy/stack-manifests/v0.9.json"
     );
   }
-  const { verifyStackManifestSignature } = await import("./stack-update-QSHSLUTZ.js");
+  const { verifyStackManifestSignature } = await import("./stack-update-SWRZLQVQ.js");
   try {
     verifyStackManifestSignature(manifest, publicKeyPem);
   } catch (err) {

package/dist/{chunk-GHR4ZPJ7.js → chunk-EC5H53YD.js}

@@ -1,6 +1,16 @@
 // scripts/lib/resolve-image-labels.mjs
 import { spawnSync } from "child_process";
 var defaultRunner = (cmd, args) => spawnSync(cmd, args, { encoding: "utf8", timeout: 6e4 });
+var ImageLabelResolutionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ImageLabelResolutionError";
+  }
+};
+var INDEX_MEDIA_TYPES = /* @__PURE__ */ new Set([
+  "application/vnd.oci.image.index.v1+json",
+  "application/vnd.docker.distribution.manifest.list.v2+json"
+]);
 function repositoryOf(ref) {
   if (typeof ref !== "string") return ref;
   const at = ref.indexOf("@");
@@ -24,13 +34,39 @@ function amd64ChildDigest(rawJson) {
   const digest = pick?.digest;
   return typeof digest === "string" && digest.length > 0 ? digest : void 0;
 }
-function resolvePlatformRef(imageRef, { runner } = {}) {
+function resolvePlatformRef(imageRef, { runner, failClosed = false } = {}) {
   const run = runner ?? defaultRunner;
   const res = run("docker", ["buildx", "imagetools", "inspect", imageRef, "--raw"]);
-  if (!res || res.status !== 0) return imageRef;
+  if (!res || res.status !== 0) {
+    if (failClosed) {
+      throw new ImageLabelResolutionError(
+        `registry manifest fetch failed for ${imageRef} (docker buildx imagetools inspect --raw exited ${res ? res.status : "spawn-failed"}) \u2014 cannot resolve to a platform manifest; refusing to read labels at index level (bug 8415a222)`
+      );
+    }
+    return imageRef;
+  }
   const raw = (res.stdout ?? "").toString();
-  const childDigest = amd64ChildDigest(raw);
-  if (!childDigest) return imageRef;
+  let doc;
+  try {
+    doc = JSON.parse(raw);
+  } catch {
+    if (failClosed) {
+      throw new ImageLabelResolutionError(
+        `registry returned an unparseable manifest for ${imageRef} \u2014 cannot determine index-vs-manifest; refusing to guess (bug 8415a222)`
+      );
+    }
+    return imageRef;
+  }
+  const childDigest = amd64ChildDigest(doc);
+  if (!childDigest) {
+    const isIndex = Boolean(doc && Array.isArray(doc.manifests)) || typeof doc?.mediaType === "string" && INDEX_MEDIA_TYPES.has(doc.mediaType);
+    if (isIndex && failClosed) {
+      throw new ImageLabelResolutionError(
+        `${imageRef} is a multi-arch index with no linux/amd64 child manifest \u2014 no platform manifest exists whose config carries the labels (bug 8415a222)`
+      );
+    }
+    return imageRef;
+  }
   return `${repositoryOf(imageRef)}@${childDigest}`;
 }
 function readLabelOff(platformRef, label, { runner } = {}) {
@@ -51,8 +87,8 @@ function readLabelOff(platformRef, label, { runner } = {}) {
   }
   return void 0;
 }
-function resolveImageLabels(imageRef, labels, { runner } = {}) {
-  const platformRef = resolvePlatformRef(imageRef, { runner });
+function resolveImageLabels(imageRef, labels, { runner, failClosed = false } = {}) {
+  const platformRef = resolvePlatformRef(imageRef, { runner, failClosed });
   const out = {};
   for (const label of labels) out[label] = readLabelOff(platformRef, label, { runner });
   return out;
@@ -62,6 +98,7 @@ function readImageLabel(imageRef, label, opts = {}) {
 }
 
 export {
+  ImageLabelResolutionError,
   repositoryOf,
   amd64ChildDigest,
   resolvePlatformRef,

package/dist/{chunk-JRMHGO5B.js → chunk-U3GM5MYE.js}

@@ -212,7 +212,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-QSHSLUTZ.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-SWRZLQVQ.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/hooks/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-09-02T16:27:58.137Z",
+  "generatedAt": "2026-09-02T17:30:09.713Z",
   "hashes": {
     "bug-report-worker.js": "8191d9e9ad67127e44969bb4671d21f3ac603dcc8dd978960f1e50b215eac475",
     "codex-stop-task-finalizer.js": "1c7ebddd870afd357eeab64172a88163ea02957eff527a5e13c5dd24e2f1a678",

package/dist/lib/registry-proxy.js

@@ -7,7 +7,7 @@ import {
   registryProxyOptionsFromEnv,
   resolveRegistryProxyBuildIdentity,
   runRegistryProxy
-} from "../chunk-FCMQVEVL.js";
+} from "../chunk-A3P3CLE6.js";
 import "../chunk-MLKGABMK.js";
 export {
   STACK_RELEASE_PUBLISH_PATH,

package/dist/{resolve-image-labels-ZI6UBW5W.js → resolve-image-labels-N27XXTUG.js}

@@ -1,12 +1,14 @@
 import {
+  ImageLabelResolutionError,
   amd64ChildDigest,
   readImageLabel,
   repositoryOf,
   resolveImageLabels,
   resolvePlatformRef
-} from "./chunk-GHR4ZPJ7.js";
+} from "./chunk-EC5H53YD.js";
 import "./chunk-MLKGABMK.js";
 export {
+  ImageLabelResolutionError,
   amd64ChildDigest,
   readImageLabel,
   repositoryOf,

package/dist/{stack-generate-manifest-7WJZWSPK.js → stack-generate-manifest-BR3GZESE.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-5QKLWJ4Z.js";
-import "./chunk-TT5BBVLX.js";
-import "./chunk-GHR4ZPJ7.js";
+} from "./chunk-3M3N7D7O.js";
+import "./chunk-5IUXUD3X.js";
+import "./chunk-EC5H53YD.js";
 import "./chunk-C5HUMAA7.js";
 import "./chunk-L25OAFOU.js";
 import "./chunk-Y2HD2YB7.js";
@@ -710,7 +710,7 @@ async function resolveImageDigest(ref) {
   return match?.[1];
 }
 async function readProvenanceLabels(ref) {
-  const { resolveImageLabels } = await import("./resolve-image-labels-ZI6UBW5W.js");
+  const { resolveImageLabels } = await import("./resolve-image-labels-N27XXTUG.js");
   return resolveImageLabels(ref, [
     "org.opencontainers.image.version",
     "org.opencontainers.image.revision",

package/dist/{stack-promote-OP2URGFF.js → stack-promote-Y4JXWM6R.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-5QKLWJ4Z.js";
-import "./chunk-TT5BBVLX.js";
-import "./chunk-GHR4ZPJ7.js";
+} from "./chunk-3M3N7D7O.js";
+import "./chunk-5IUXUD3X.js";
+import "./chunk-EC5H53YD.js";
 import "./chunk-C5HUMAA7.js";
 import "./chunk-L25OAFOU.js";
 import "./chunk-Y2HD2YB7.js";

package/dist/{stack-release-MY6U2QIO.js → stack-release-JFB3NJLO.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-5QKLWJ4Z.js";
-import "./chunk-TT5BBVLX.js";
-import "./chunk-GHR4ZPJ7.js";
+} from "./chunk-3M3N7D7O.js";
+import "./chunk-5IUXUD3X.js";
+import "./chunk-EC5H53YD.js";
 import {
   assertPreflightGate,
   runPreflightOnManifest

package/dist/{stack-update-QSHSLUTZ.js → stack-update-SWRZLQVQ.js}

@@ -105,8 +105,8 @@ import {
   verifyStackManifestSignature,
   waitForHttpOk,
   warnUnmanagedManifestServices
-} from "./chunk-TT5BBVLX.js";
-import "./chunk-GHR4ZPJ7.js";
+} from "./chunk-5IUXUD3X.js";
+import "./chunk-EC5H53YD.js";
 import "./chunk-C5HUMAA7.js";
 import "./chunk-L25OAFOU.js";
 import "./chunk-Y2HD2YB7.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.377",
+  "version": "0.9.378",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/release-notes.json

@@ -1,21 +1,17 @@
 {
-  "current": "0.9.377",
+  "current": "0.9.378",
   "notes": {
-    "0.9.377": {
-      "version": "0.9.377",
+    "0.9.378": {
+      "version": "0.9.378",
       "date": "2026-09-02",
       "features": [],
       "fixes": [
-        "fetch full history+tags in publish checkouts for the ref-provenance guard (#1029)",
-        "exempt /auth/logout from the SSO gate in crm/wiki/dashboard vhosts (bug 96f8b2b2) (#1027)",
-        "sso-edge erp vhost preserves Host + websocket upgrade headers (#1024)",
-        "refuse to push a tag stamped with a non-AskExe identity (#1021)"
+        "wire backup + uptime crons into deploy.yml, with the data boundary closed (re-land, bug 6c1893f0) (#1028)",
+        "G2 label resolution dereferences the OCI index fail-closed, never reads labels at index level (bug 8415a222) (#1023)"
       ],
       "security": [],
       "other": [
-        "bump to v0.9.377 (#1031)",
-        "cross-arch builds use the docker driver (Rosetta), not bundled qemu (#1030)",
-        "migrate release/x64 lanes off build-my onto the local ci-linux VM (#1026)"
+        "bump to v0.9.378 (#1032)"
       ],
       "migration_notes": []
     },

package/stack.release.json

@@ -4,8 +4,8 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.377",
-  "image": "ghcr.io/askexe/exe-os:v0.9.377",
+  "version": "0.9.378",
+  "image": "ghcr.io/askexe/exe-os:v0.9.378",
   "imageEnv": "EXE_OS_IMAGE_TAG",
   "imageDigestTodo": "TODO(bug 32d6e02f), NARROWED by bug 81ca8903. The top-level `image` is tag-only BY CONSTRUCTION and that is correct: it names the tag the release run is about to build, whose digest does not exist until the push (see the 'Cross-check built digest against the manifest pin' step in .github/workflows/release-stack-image.yml). Demanding a digest here is unsatisfiable, which is why this TODO kept surviving. The one genuinely resolvable case it also covered — components.erp, built in a DIFFERENT repo and therefore already sitting in the registry — is now resolved and digest-pinned below. What remains open is ONLY components.dashboard, and not for the reason this TODO claimed: ghcr.io/askexe/exe-dashboard:v0.9.372 DOES NOT EXIST. .github/workflows/release-dashboard-image.yml has produced exactly one run in its lifetime (id 32405074431, 2026-08-20, tag v0.9.374) and that run FAILED, so the dashboard release lane has never emitted a single v* tag — the only refs in ghcr.io/askexe/exe-dashboard are the floating :main and :sha-<sha> dev refs from dashboard-image.yml. The dashboard pin is therefore a PHANTOM, not an unresolved digest, and it is deliberately left tag-only here rather than silently repointed at a :main digest, because choosing which dashboard bytes constitute a release is a release decision, not a lint fix. FAIL-CLOSED still holds and is enforced where it bites: scripts/publish-stack-release.mjs verifyServicePin() refuses to publish any tag-only app image into the customer manifest.",
   "components": {
@@ -16,7 +16,7 @@
       "note": "Bug 81ca8903: was `ghcr.io/askexe/exe-erp:v0.9.312` — a tag that has never existed. ERP is versioned on its own 0.x line; v0.9.312 is an EXE-OS version number that bumpVersions() stamped onto this component because rebaseImageTag() rebased every tag-only component image to the exe-os release version regardless of which repo built it. That rebase is now scoped (same commit) so it can no longer forge tags for independently-versioned components. Repinned to the real, current ERP release v0.3.4, digest resolved live from ghcr.io/askexe/exe-erp on 2026-09-01. Digest-pinning is also what makes this entry self-defending: rebaseImageTag() returns any `@sha256:`-bearing ref untouched. Prior intent for the record (bug 790794e8) was v0.2.0-final8, the first ERP image shipping the realtime/socketio entrypoint (exe-erp PR #15); final3/final7 crash-looped exe-erp-websocket on a missing socketio.js. v0.3.4 supersedes it."
     },
     "dashboard": {
-      "image": "ghcr.io/askexe/exe-dashboard:v0.9.377",
+      "image": "ghcr.io/askexe/exe-dashboard:v0.9.378",
       "env": "DASHBOARD_IMAGE_TAG",
       "composeService": "exe-dashboard",
       "versionLockstep": true,
@@ -110,5 +110,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.377"
+  "sourceVersion": "0.9.378"
 }