@askexenow/exe-os 0.9.381 → 0.9.383

package/deploy/compose/.env.customer.example

@@ -69,7 +69,7 @@ SMTP_PASS=
 # --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---
 # Bug 58840873: pin the auth image so compose never falls back to its stale
 # hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG.
-AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.1@sha256:89670a15bc59255299be695525863e66f949694eec1dd8886038dc3659a4a941
+AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.5@sha256:dc8c1476ef1247079a6e115450bd35681712fa06367461589998ecf943f88089
 # Bug 379e5c13: server_name / CORS from the CONFIGURED apex domain, not by naive
 # last-2-label slicing (which breaks company.co.uk → co.uk).
 AUTH_SERVER_NAME=auth.CHANGEME_DOMAIN
@@ -124,7 +124,7 @@ EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 
 # --- CRM ---
-CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8
+CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 # The CRM's first admin — seeded at boot by WorkspaceBootstrapService, which is
@@ -138,7 +138,7 @@ EXE_CRM_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.28@sha256:61856a4c6b97ce62c62ecdc3a377139287be5860eb807d9fbb737115758d7856
+WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.33@sha256:1f9e04a557c6034e0eac85ecdf76d465eab88394614184387ecf06cd2281e7d8
 # Bug 2a8d3003 — DO NOT change this without migrating the data first.
 # The wiki's users / workspaces / workspace_documents live in `public`. Point it at a
 # different schema and Prisma will NOT error: it finds no tables, assumes a fresh
@@ -176,7 +176,7 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa
+EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=CHANGEME_DEVICE_ID
 EXE_MCP_HOST_BIND=127.0.0.1
@@ -186,7 +186,7 @@ EXE_MCP_HOST_PORT=48739
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- ERP (Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b
+ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v0.3.11@sha256:5888b3e9d4ff309f37052dbdcac1fda66e235dbecb186a9ccf69380576e7b363
 # Administrator password for the ERPNext site (created on first boot).
 # bug 43854b31: this only applies at FIRST boot. To rotate it later you must also
 # run `bench --site $ERP_SITE_NAME set-admin-password <new>` inside exe-erp —

package/deploy/compose/.env.example

@@ -158,7 +158,7 @@ EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 
 # --- CRM ---
-CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8
+CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 EXE_CRM_ADMIN_TOKEN=CHANGEME_EXE_CRM_ADMIN_TOKEN
@@ -209,7 +209,7 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa
+EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6
 
 # Infra image pins — manifest-derived. Compose has no fallback default for
 # these: a missing pin ABORTS the deploy instead of substituting an old image.
@@ -264,7 +264,7 @@ ERROR_REPORTING_ENABLED=true
 MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors
 
 # --- ERP (optional — Exe ERP, Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b
+ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v0.3.11@sha256:5888b3e9d4ff309f37052dbdcac1fda66e235dbecb186a9ccf69380576e7b363
 ERP_ADMIN_PASSWORD=CHANGEME_ERP_ADMIN_PASSWORD
 EXE_ERP_ADMIN_TOKEN=CHANGEME_EXE_ERP_ADMIN_TOKEN
 # Frappe site name — must match the erp.<domain> the customer serves (bug e61ad373).

package/deploy/compose/docker-compose.yml

@@ -764,7 +764,7 @@ services:
       # overridden back to exeOsMcp — see bug c604df37 above before doing that;
       # the spawn args below currently point at the wrong CLI entrypoint.
       EXE_OS_MCP_COMMAND: ${WIKI_EXE_OS_MCP_COMMAND:-npx}
-      EXE_OS_MCP_ARGS: ${WIKI_EXE_OS_MCP_ARGS:--y @askexenow/exe-os@${WIKI_EXE_OS_NPM_VERSION:-0.9.324} mcp}
+      EXE_OS_MCP_ARGS: ${WIKI_EXE_OS_MCP_ARGS:--y @askexenow/exe-os@${WIKI_EXE_OS_NPM_VERSION:-0.9.382} mcp}
       BRANDING_CONFIG_PATH: /app/branding.json
     ports:
       - "127.0.0.1:${WIKI_HOST_PORT:-3001}:3001"

package/deploy/compose/sso-edge/default.conf.template

@@ -153,6 +153,24 @@ server {
     location = /health  { auth_request off; proxy_pass http://$crm_upstream/healthz; }
     location = /healthz { auth_request off; proxy_pass http://$crm_upstream/healthz; }
 
+    # G5 served-freshness (bug 529f45cf). See the doctrine note in
+    # sso-redirect.conf: an ungated path is granted EXPLICITLY, by exact match,
+    # never by a wildcard. Without this the watchdog's GET /__version was caught
+    # by the gate and 302'd to the auth login page, so the probe read auth's
+    # HTML and could not distinguish "wrong version" from "gated" from "down" —
+    # the served-freshness axis was unreadable for every SSO-gated surface.
+    #
+    # WHY UNAUTHENTICATED, DELIBERATELY: the response is a git sha/ref/repo and
+    # a build time, all of which the signed stack manifest already publishes
+    # unauthenticated at update.askexe.com/v1/stack-manifest.json. It leaks
+    # nothing the fleet does not already state publicly. The alternative —
+    # teaching the watchdog to hold an SSO session per surface — would put a
+    # live credential in a nightly job, widen its blast radius across five
+    # hosts, and make credential expiry look identical to real drift. A monitor
+    # whose failure mode is indistinguishable from the thing it monitors is the
+    # blind-monitor class this whole sweep is closing.
+    location = /__version { auth_request off; proxy_pass http://$crm_upstream/__version; }
+
     # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2). Without this,
     # /auth/logout triggers 401 -> redirect to auth with logout URL as redirect param
     # -> infinite loop. Let the app handle logout (clear its own cookies), then it
@@ -207,6 +225,9 @@ server {
     location = /health  { auth_request off; proxy_pass http://$wiki_upstream/api/ping; }
     location = /healthz { auth_request off; proxy_pass http://$wiki_upstream/api/ping; }
 
+    # G5 served-freshness — see the CRM vhost's note (bug 529f45cf).
+    location = /__version { auth_request off; proxy_pass http://$wiki_upstream/__version; }
+
     # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2).
     location = /auth/logout { auth_request off; proxy_pass http://$wiki_upstream/auth/logout; }
 
@@ -246,6 +267,27 @@ server {
     set $gotrue_upstream gotrue:9999;                  # used by sso-redirect.conf's /_sso_gate
     include /etc/nginx/snippets/sso-redirect.conf;
 
+    # G5 served-freshness — see the CRM vhost's note (bug 529f45cf).
+    #
+    # HONEST ABOUT WHAT THIS DOES AND DOES NOT FIX: exe-erp does not implement
+    # /__version yet (that is a change in AskExe/exe-erp, not here). Today this
+    # location turns a MISLEADING answer into an honest one — the probe stops
+    # reading auth.askexe.com's login HTML and starts reading ERP's own 404, so
+    # served-freshness reports ERP as unverifiable-because-unimplemented rather
+    # than silently comparing a login page against a git sha. It becomes a real
+    # verification the moment exe-erp ships the route; nothing here changes then.
+    #
+    # Host is preserved and the standard forwarded headers are set, matching the
+    # main location block below — a bare proxy_pass would send
+    # Host: exe-erp-nginx, which frappe's origin check rejects.
+    location = /__version {
+        auth_request off;
+        proxy_pass http://$erp_upstream/__version;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+
     # ERP is the one upstream that runs a realtime socket.io service with
     # origin authentication: frappe's realtime middleware compares the Host
     # header against the Origin header and rejects mismatches ("Invalid
@@ -294,6 +336,9 @@ server {
     location = /health  { auth_request off; proxy_pass http://$dashboard_upstream/health; }
     location = /healthz { auth_request off; proxy_pass http://$dashboard_upstream/health; }
 
+    # G5 served-freshness — see the CRM vhost's note (bug 529f45cf).
+    location = /__version { auth_request off; proxy_pass http://$dashboard_upstream/__version; }
+
     # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2).
     location = /auth/logout { auth_request off; proxy_pass http://$dashboard_upstream/auth/logout; }
 

package/deploy/compose/sso-edge/sso-redirect.conf

@@ -146,8 +146,17 @@
 # make it fire). That is not a typo fix — it would newly open a real bypass for
 # every path whose URI ends in an asset extension, including user-uploaded CRM
 # attachments and wiki images. If a future app genuinely needs an ungated path,
-# give it an explicit `location = /path { auth_request off; }` (as the /health
-# and /auth/logout routes already do), never an extension-shaped wildcard.
+# give it an explicit `location = /path { auth_request off; }` (as the /health,
+# /auth/logout and /__version routes already do), never an extension-shaped
+# wildcard.
+#
+# /__version is the third such grant (bug 529f45cf). It is exact-match, it is
+# read-only, and its body is a git sha/ref/repo already published without
+# authentication in the signed stack manifest — so it widens no disclosure. It
+# exists because the G5 served-freshness watchdog could not read ANY gated
+# surface: every probe was 302'd to the login page, and the watchdog compared a
+# git sha against auth's HTML. That is the shape this gate must never take —
+# a control that cannot see reporting its blindness as ordinary traffic.
 # ─────────────────────────────────────────────────────────────────────────────
 
 # Run the gate for every request on this vhost. The gate is a zero-cost local

package/deploy/stack-manifests/v0.9.30-apps.json

@@ -76,6 +76,6 @@
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "ib9CL9sD/5c2q6M1UQDA1BUf9WT6iI18gUyCmY3+TitjVhIeAf5bTTyfs/FiWAAn8penUVWp21p65KJgSW1PCA=="
+    "signature": "hZxmmxAMTi7l2yI0XDe3vnm35xl7z6A+BVcLFZopjULs9Q+v9CsqvoaLoDv6APiBfsagwr1wPmN0A7Uw0GrJBw=="
   }
 }

package/deploy/stack-manifests/v0.9.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "latest": "0.9.36",
+  "latest": "0.9.38",
   "stacks": {
     "0.9.0": {
       "version": "0.9.0",
@@ -2806,11 +2806,263 @@
         }
       },
       "rolloutStage": "ga"
+    },
+    "0.9.37": {
+      "version": "0.9.37",
+      "releasedAt": "2026-09-08T06:48:53.529Z",
+      "npmVersion": "0.9.382",
+      "notes": "exe-os v0.9.382, exe-crm v0.9.59 and exe-erp v0.3.11 reach customers. exe-os was pinned at v0.9.324 — 58 versions of merged work that no install could see. exe-crm v0.9.59 carries the shared EXE design tokens plus the @faker-js/faker CVE-2026-73231 fix (the vulnerable image was built but its release tag was correctly withheld, so it never shipped). exe-erp v0.3.11 is the first ERP image driving Frappe's own Espresso design system with EXE brand tokens instead of an override stylesheet, and the first built natively on x86_64 with QEMU removed from the release path. wiki v0.9.33 and auth v0.6.5 pins are unchanged — already current.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.33@sha256:1f9e04a557c6034e0eac85ecdf76d465eab88394614184387ecf06cd2281e7d8",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "exe-wiki v0.9.33 — typography unified onto the shared @askexenow/exe-theme tokens. plus-jakarta-sans removed repo-wide, and a latent bug fixed: font-headline was defined in Tailwind but no rule ever applied it, so h1-h6 had silently inherited the body font and wiki headings had never once rendered in Epilogue. Also dark first paint before stylesheets load, so switching between CRM, wiki and ERP no longer flashes white.",
+          "gitSha": "3f35bd9c52543987e2ebaec9e5876cc6c6fd8f3a"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.5@sha256:dc8c1476ef1247079a6e115450bd35681712fa06367461589998ecf943f88089",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/api/health",
+          "category": "auth",
+          "description": "exe-auth v0.6.5 — an already-authenticated user switching between ERP, wiki and CRM no longer sees the login page flash. The session is now validated SERVER-SIDE before any login markup is sent, so an authenticated request gets a bare 302 (bug 910ff2a5). A forged exe_access_token sentinel still receives the login page, so this is not an auth bypass. Also strips the leading dot from AUTH_COOKIE_DOMAIN (bug ee4b831d).",
+          "gitSha": "e119d1fa1fd08f2faf951f9998fe33393cf8b258"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.11@sha256:5888b3e9d4ff309f37052dbdcac1fda66e235dbecb186a9ccf69380576e7b363",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning",
+          "gitSha": "d185286873dcfa11e4b3f9672c4e23efea240cc5"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.382@sha256:43c4eb52d89d977021d29df73bcfa6f9d769ab4debf90e81240b59a4c165bab0",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing"
+        }
+      },
+      "rolloutStage": "ga"
+    },
+    "0.9.38": {
+      "version": "0.9.38",
+      "releasedAt": "2026-09-08T14:38:52.000Z",
+      "npmVersion": "0.9.382",
+      "notes": "Corrects the auth healthUrl only; every image pin is identical to 0.9.37. 0.9.37 probed auth at /api/health, which exe-auth returns 404 for BY DESIGN: nginx.conf adds an exact `location = /api/health` that 404s so GoTrue's version is not exposed to the public internet (fingerprinting), and its comment states health of the container is the compose healthcheck on `/`. The manifest was never updated to match, so deploying auth aborted with 'Health check failed for auth (http://127.0.0.1:3300/api/health): HTTP 404' and rolled the whole stack back. Verified live on the running service: / -> 200, /__version -> 200, /api/health -> 404. Points at `/`, matching the container's own healthcheck (wget --spider http://127.0.0.1:80/).",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.33@sha256:1f9e04a557c6034e0eac85ecdf76d465eab88394614184387ecf06cd2281e7d8",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "exe-wiki v0.9.33 — typography unified onto the shared @askexenow/exe-theme tokens. plus-jakarta-sans removed repo-wide, and a latent bug fixed: font-headline was defined in Tailwind but no rule ever applied it, so h1-h6 had silently inherited the body font and wiki headings had never once rendered in Epilogue. Also dark first paint before stylesheets load, so switching between CRM, wiki and ERP no longer flashes white.",
+          "gitSha": "3f35bd9c52543987e2ebaec9e5876cc6c6fd8f3a"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.5@sha256:dc8c1476ef1247079a6e115450bd35681712fa06367461589998ecf943f88089",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "exe-auth v0.6.5 — an already-authenticated user switching between ERP, wiki and CRM no longer sees the login page flash. The session is now validated SERVER-SIDE before any login markup is sent, so an authenticated request gets a bare 302 (bug 910ff2a5). A forged exe_access_token sentinel still receives the login page, so this is not an auth bypass. Also strips the leading dot from AUTH_COOKIE_DOMAIN (bug ee4b831d).",
+          "gitSha": "e119d1fa1fd08f2faf951f9998fe33393cf8b258"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.11@sha256:5888b3e9d4ff309f37052dbdcac1fda66e235dbecb186a9ccf69380576e7b363",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning",
+          "gitSha": "d185286873dcfa11e4b3f9672c4e23efea240cc5"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.382@sha256:43c4eb52d89d977021d29df73bcfa6f9d769ab4debf90e81240b59a4c165bab0",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing"
+        }
+      },
+      "rolloutStage": "ga"
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "UAQm9FB5Ai8KaBSGe6LEkBfXZ3XtBFT/5/8DozCK1v7f8llD33AhrAF11HEttf33z3w/weWhxZEXG3yGIWw/Dg=="
+    "signature": "slzGaEhMxBaItfNzC80+bNJs4C3skBapi8TbSsVRRf7iWa/WFowmc9vvnnluoLKdWdsi8gqxdFUSFaxkul5sAg=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-08T02:19:11.078Z",
-  "manifest_sha256": "b55b6c21dd560116c3ce9ca67bbfc648b6a910b0bed064e64b9f36e13576ea74",
-  "package_version": "0.9.381"
+  "verified_at": "2026-09-09T09:12:16.097Z",
+  "manifest_sha256": "c3ae50f3aee170892131cbd9cd4bf821b1a20be63261b2ff9081b3a763993c6b",
+  "package_version": "0.9.383"
 }

package/dist/{active-agent-GZ6O7KKS.js → active-agent-BV4OE3GI.js}

@@ -7,23 +7,23 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-TKTEFYPH.js";
-import "./chunk-K4ESASPL.js";
+} from "./chunk-4KNZKUDK.js";
+import "./chunk-MUCNYSJP.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-MAOKR5AL.js";
+import "./chunk-ZVPVLYBG.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-GODDBYPL.js";
+import "./chunk-FPAPXMJA.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{active-agent-GE6HDADY.js → active-agent-LFY5P5EX.js}

@@ -8,23 +8,23 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-TKTEFYPH.js";
-import "./chunk-K4ESASPL.js";
+} from "./chunk-4KNZKUDK.js";
+import "./chunk-MUCNYSJP.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-MAOKR5AL.js";
+import "./chunk-ZVPVLYBG.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-GODDBYPL.js";
+import "./chunk-FPAPXMJA.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{agent-defs-generator-3VHBN56U.js → agent-defs-generator-IC2DVSI4.js}

@@ -1,24 +1,24 @@
 import {
   loadAgentConfig
-} from "./chunk-GZOG2MAX.js";
+} from "./chunk-L5EPGGDP.js";
 import "./chunk-AM7S2TY6.js";
 import {
   loadEmployeesSync,
   validateEmployeeName
-} from "./chunk-MAOKR5AL.js";
+} from "./chunk-ZVPVLYBG.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-GODDBYPL.js";
+import "./chunk-FPAPXMJA.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-WNBZJSQT.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 

package/dist/{agent-loop-7ZRH56EX.js → agent-loop-GSUZJZBJ.js}

@@ -1,6 +1,6 @@
 import {
   agentLoop
-} from "./chunk-KBR5LIWD.js";
+} from "./chunk-DZ3VKZ3C.js";
 import "./chunk-JRLNE3T2.js";
 import "./chunk-2O2UKMUE.js";
 import "./chunk-HF25XPZE.js";

package/dist/{agentic-ontology-6X5Z5QPD.js → agentic-ontology-V3PFEFVZ.js}

@@ -10,7 +10,7 @@ import {
   insertOntologyForMemory,
   ontologyPayload,
   stableId
-} from "./chunk-4G5MWV7O.js";
+} from "./chunk-7C33VMAN.js";
 import "./chunk-MLKGABMK.js";
 export {
   ONTOLOGY_YIELD_EVERY,

package/dist/{artifact-backup-NYXAYASJ.js → artifact-backup-EXBY3YQS.js}

@@ -7,16 +7,16 @@ import {
 import {
   artifactObjectId,
   encryptSyncBlob
-} from "./chunk-MP4ST7RO.js";
+} from "./chunk-PJ2ZJUM2.js";
 import "./chunk-TWMWHDOY.js";
-import "./chunk-4GZTBLJG.js";
-import "./chunk-AVMLC2MR.js";
+import "./chunk-AYOCLUGP.js";
+import "./chunk-CZKDWW76.js";
 import {
   EXE_AI_DIR,
   loadConfigSync
-} from "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+} from "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 

package/dist/{backfill-gate-KWJQ35YX.js → backfill-gate-FWYLCGNJ.js}

@@ -5,10 +5,10 @@ import {
   backfillKillSwitchEnabled,
   computeBackfillDisabled,
   countActionableNullVectors
-} from "./chunk-IHXW4VUI.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+} from "./chunk-5IADGFGR.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {