@askexenow/exe-os 0.9.382 → 0.9.384

package/dist/{chunk-NY74W3S4.js → chunk-ZBPZDADW.js}

@@ -13,9 +13,12 @@ import {
   checkImageVersionLabels,
   isFirstPartyImage
 } from "./chunk-L25OAFOU.js";
+import {
+  declaredArtifactsFromManifest
+} from "./chunk-LFUBEHFW.js";
 import {
   loadLicense
-} from "./chunk-5DFE2NAF.js";
+} from "./chunk-TNS63ATU.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";
@@ -26,6 +29,97 @@ import https from "https";
 import net from "net";
 import path from "path";
 import { fileURLToPath } from "url";
+import { parseDocument as parseYamlDocument } from "yaml";
+
+// src/lib/service-env-contract.ts
+import { parse as parseYaml } from "yaml";
+var SERVICE_ENV_CONTRACT = [
+  {
+    service: "exe-gateway",
+    keys: ["GOTRUE_JWT_SECRET"],
+    consequence: "gotrue-auth.ts getSymmetricKey() refuses every HS256 GoTrue token, so all SSO-authenticated requests (including /query tenant auth and /pair-login) are rejected with 401 while the service still reports healthy"
+  },
+  {
+    service: "exe-crm",
+    keys: ["GOTRUE_JWT_SECRET"],
+    consequence: "getGoTrueSymmetricVerificationKey cannot verify SSO tokens, so GoTrue logins are rejected"
+  },
+  {
+    service: "exe-wiki",
+    keys: ["GOTRUE_JWT_SECRET"],
+    consequence: "getGoTrueJwtSecret cannot verify SSO tokens, so GoTrue logins are rejected"
+  }
+];
+function parseComposeServiceEnvKeys(composeYaml) {
+  const byService = /* @__PURE__ */ new Map();
+  let doc;
+  try {
+    doc = parseYaml(composeYaml, { merge: true });
+  } catch {
+    return byService;
+  }
+  const services = doc?.services;
+  if (!services || typeof services !== "object") return byService;
+  for (const [name, rawDef] of Object.entries(services)) {
+    const keys = /* @__PURE__ */ new Set();
+    const env = rawDef?.environment;
+    if (Array.isArray(env)) {
+      for (const entry of env) {
+        if (typeof entry !== "string") continue;
+        const eq = entry.indexOf("=");
+        const key = (eq === -1 ? entry : entry.slice(0, eq)).trim();
+        if (key) keys.add(key);
+      }
+    } else if (env && typeof env === "object") {
+      for (const key of Object.keys(env)) keys.add(key);
+    }
+    byService.set(name, keys);
+  }
+  return byService;
+}
+function collectServiceEnvGaps(composeYaml, contract = SERVICE_ENV_CONTRACT) {
+  const byService = parseComposeServiceEnvKeys(composeYaml);
+  const gaps = [];
+  for (const requirement of contract) {
+    const declared = byService.get(requirement.service);
+    if (!declared) continue;
+    const missingKeys = requirement.keys.filter((key) => !declared.has(key));
+    if (missingKeys.length > 0) {
+      gaps.push({ service: requirement.service, missingKeys: [...missingKeys].sort(), consequence: requirement.consequence });
+    }
+  }
+  return gaps.sort((a, b) => a.service.localeCompare(b.service));
+}
+function describeGaps(gaps) {
+  return gaps.map((gap) => `  - ${gap.service}: ${gap.missingKeys.join(", ")}
+      without it, ${gap.consequence}`).join("\n");
+}
+function assertServiceEnvContract(composeYaml, source) {
+  const gaps = collectServiceEnvGaps(composeYaml);
+  if (gaps.length === 0) return;
+  throw new Error(
+    `Stack update aborted before any changes: ${source} does not hand ${gaps.length} service(s) an environment key they cannot work without.
+${describeGaps(gaps)}
+Compose bans env_file: for these services, so a key present in .env but absent from the service's own environment: block never reaches the container. Add the key to that block.`
+  );
+}
+function reportDeployedServiceEnvGaps(deployedComposeYaml, composeFile, willRefreshTemplate, write = (line) => process.stderr.write(line)) {
+  const gaps = collectServiceEnvGaps(deployedComposeYaml);
+  if (gaps.length === 0) return gaps;
+  const remedy = willRefreshTemplate ? "This update refreshes the compose template, which is expected to restore the key(s); re-check after it completes." : `This update does NOT refresh ${composeFile}, so the gap will PERSIST. Update the deployed compose template.`;
+  write(
+    `
+[stack-update] WARNING (bug 7e811acf): the DEPLOYED compose at ${composeFile} does not hand ${gaps.length} running service(s) an environment key they cannot work without:
+${describeGaps(gaps)}
+These services do not crash without it \u2014 they return clean 401s and keep reporting healthy, which is why this can go unnoticed indefinitely.
+${remedy}
+
+`
+  );
+  return gaps;
+}
+
+// src/lib/stack-update.ts
 var SLOW_SERVICE_HEALTH_DEFAULTS = {
   // Frappe `bench migrate` on every boot can take well over the 180s default.
   "exe-erp": 900
@@ -184,61 +278,127 @@ function isCloudflaredTunnelMisconfigured(composeFile, envFile) {
   return true;
 }
 var INGRESS_DEFAULT_PORTS = { http: 80, https: 443 };
-function stripYamlScalar(raw) {
-  let v = raw.trim();
-  v = v.replace(/\s+#.*$/, "").trim();
-  if (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'")) {
-    v = v.slice(1, -1);
-  }
-  return v.trim();
+function findUnauditableIngressSyntax(configYml) {
+  return walkCloudflaredIngress(configYml).unmodelled;
 }
 function parseCloudflaredIngressTargets(configYml) {
-  const lines = configYml.split(/\r?\n/);
+  return walkCloudflaredIngress(configYml).targets;
+}
+function ruleLabel(hostname, service) {
+  return `${hostname ? `hostname: ${hostname}` : "(no hostname)"} -> service: ${service.slice(0, 60)}`;
+}
+function walkCloudflaredIngress(configYml) {
   const targets = [];
-  let inIngress = false;
-  let ingressIndent = -1;
-  let currentHostname;
-  const flushService = (serviceRaw) => {
-    const service = stripYamlScalar(serviceRaw);
-    const m = /^([a-z][a-z0-9+.\-]*):\/\/(?:\[([^\]]+)\]|([^/:\s]+))(?::(\d+))?/i.exec(service);
-    if (!m) return;
+  const rules = [];
+  const unmodelled = [];
+  const emitTarget = (service, hostname) => {
+    const m = /^([a-z][a-z0-9+.\-]*):\/\/(?:\[([^\]]+)\]|([^/:\s]+))(?::(\d+))?/i.exec(service.trim());
+    if (!m) {
+      rules.push({ hostname, service });
+      return;
+    }
     const scheme = (m[1] ?? "").toLowerCase();
     const host = m[2] ?? m[3] ?? "";
     const port = m[4] ? Number(m[4]) : INGRESS_DEFAULT_PORTS[scheme];
-    if (!host) return;
+    if (!host) {
+      rules.push({ hostname, service });
+      return;
+    }
+    rules.push({ hostname, service, host });
     if (port === void 0 || !Number.isFinite(port) || port <= 0 || port > 65535) return;
-    targets.push({ hostname: currentHostname, service, host, port });
+    targets.push({ hostname, service, host, port });
   };
-  for (const raw of lines) {
-    if (raw.trim() === "" || raw.trim().startsWith("#")) continue;
-    const indent = raw.length - raw.replace(/^\s*/, "").length;
-    if (!inIngress) {
-      if (/^ingress\s*:\s*$/.test(raw.trim())) {
-        inIngress = true;
-        ingressIndent = indent;
+  let root;
+  try {
+    const doc = parseYamlDocument(configYml, { merge: true, uniqueKeys: true });
+    if (doc.errors.length > 0) {
+      unmodelled.push(`config.yml does not parse as YAML: ${doc.errors[0]?.message ?? "unknown error"}`);
+      return { targets, rules, unmodelled };
+    }
+    root = doc.toJS({ maxAliasCount: 100 });
+  } catch (err) {
+    unmodelled.push(`config.yml could not be read as YAML: ${err instanceof Error ? err.message : String(err)}`);
+    return { targets, rules, unmodelled };
+  }
+  if (root === null || root === void 0) return { targets, rules, unmodelled };
+  if (typeof root !== "object" || Array.isArray(root)) {
+    unmodelled.push("top level of config.yml is not a mapping, so its `ingress:` cannot be located");
+    return { targets, rules, unmodelled };
+  }
+  const ingress = root.ingress;
+  if (ingress === void 0 || ingress === null) return { targets, rules, unmodelled };
+  if (!Array.isArray(ingress)) {
+    unmodelled.push("`ingress:` is not a sequence of rules");
+    return { targets, rules, unmodelled };
+  }
+  for (const rule of ingress) {
+    if (rule === null || typeof rule !== "object" || Array.isArray(rule)) {
+      unmodelled.push(`ingress rule is not a mapping: ${JSON.stringify(rule).slice(0, 120)}`);
+      continue;
+    }
+    const entry = rule;
+    const rawHostname = entry.hostname;
+    const rawService = entry.service;
+    let hostname;
+    if (rawHostname !== void 0 && rawHostname !== null) {
+      if (typeof rawHostname !== "string") {
+        unmodelled.push(`ingress rule \`hostname:\` is not a string: ${JSON.stringify(rawHostname).slice(0, 120)}`);
+        continue;
+      }
+      const trimmedHostname = rawHostname.trim();
+      hostname = trimmedHostname === "" ? void 0 : trimmedHostname;
+    }
+    if (rawService === void 0 || rawService === null) {
+      if (hostname !== void 0) {
+        unmodelled.push(`ingress rule for ${hostname} has no \`service:\``);
       }
       continue;
     }
-    if (indent <= ingressIndent && !raw.trim().startsWith("-")) {
-      inIngress = false;
+    if (typeof rawService !== "string") {
+      unmodelled.push(`ingress rule \`service:\` is not a string: ${JSON.stringify(rawService).slice(0, 120)}`);
       continue;
     }
-    const t = raw.trim();
-    if (t.startsWith("-")) {
-      currentHostname = void 0;
-      const item = t.replace(/^-\s*/, "");
-      const hm = /^hostname\s*:\s*(.+)$/i.exec(item);
-      const sm = /^service\s*:\s*(.+)$/i.exec(item);
-      if (hm) currentHostname = stripYamlScalar(hm[1] ?? "");
-      else if (sm) flushService(sm[1] ?? "");
-    } else {
-      const hm = /^hostname\s*:\s*(.+)$/i.exec(t);
-      const sm = /^service\s*:\s*(.+)$/i.exec(t);
-      if (hm) currentHostname = stripYamlScalar(hm[1] ?? "");
-      else if (sm) flushService(sm[1] ?? "");
+    const svc = rawService.trim();
+    const builtIn = /^(?:http_status:\d+|hello_world)$/i.test(svc);
+    const networkUrl = /^[a-z][a-z0-9+.\-]*:\/\//i.test(svc);
+    if (entry.path !== void 0 && entry.path !== null && !builtIn) {
+      unmodelled.push(
+        `rule ${ruleLabel(hostname, svc)}: has a \`path:\` (${JSON.stringify(entry.path).slice(0, 40)}) AND serves an application, so it covers only part of that hostname and some later rule covers the rest \u2014 which is how a path-scoped edge route hid an unrestricted direct route below it. A \`path:\` is fine on a DENY rule (\`service: http_status:404\`); on a serving rule, drop the path.`
+      );
+      continue;
     }
+    if (hostname !== void 0 && hostname.includes("*")) {
+      unmodelled.push(
+        `rule ${ruleLabel(hostname, svc)}: the hostname is a WILDCARD, so it serves product hostnames it does not name \u2014 including the SSO-gated ones \u2014 and which rule wins depends on ordering this gate does not resolve. Write one rule per concrete hostname.`
+      );
+      continue;
+    }
+    if (hostname === void 0) {
+      if (!builtIn) {
+        unmodelled.push(
+          `rule ${ruleLabel(hostname, svc)}: a CATCH-ALL (no hostname) that serves an application. It serves every product hostname no earlier rule claims, including the SSO-gated ones, so it can route a product around the edge without naming it. Give it a hostname, or make the catch-all a terminator (\`service: http_status:404\`).`
+        );
+        continue;
+      }
+      rules.push({ hostname, service: svc });
+      continue;
+    }
+    if (!builtIn && !networkUrl) {
+      unmodelled.push(
+        `rule ${ruleLabel(hostname, svc)}: the service is not a \`scheme://host\` URL, so this gate cannot resolve what it points at. A unix socket or bastion still serves the application, so it must not be read as serving nothing. Route it through \`http://<container>:<port>\`.`
+      );
+      continue;
+    }
+    const authority = svc.slice(svc.indexOf("://") + 3).split("/")[0] ?? "";
+    if (!builtIn && !/^(?:\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9._-]+)(?::\d+)?$/.test(authority)) {
+      unmodelled.push(
+        `rule ${ruleLabel(hostname, svc)}: the service authority ${JSON.stringify(authority.slice(0, 60))} is not a plain \`host\` or \`host:port\`. Userinfo (\`user:pass@host\`), escapes and other URL syntax are read differently by this gate than by cloudflared \u2014 \`http://edge:tok@app:80\` names the EDGE here and routes to the APP there \u2014 so it cannot be audited. Write \`scheme://<container>:<port>\` with no credentials.`
+      );
+      continue;
+    }
+    emitTarget(rawService, hostname);
   }
-  return targets;
+  return { targets, rules, unmodelled };
 }
 async function findUnreachableIngressTargets(targets, probe) {
   const results = await Promise.all(
@@ -246,6 +406,56 @@ async function findUnreachableIngressTargets(targets, probe) {
   );
   return results.filter((r) => !r.reachable).map((r) => r.t);
 }
+var SSO_GATED_HOSTNAME_LABELS = ["crm", "wiki", "erp", "dashboard"];
+var SSO_EDGE_SERVICE_HOST = "exe-sso-edge";
+function findSsoUngatedIngressHostnames(configYml) {
+  const { rules } = walkCloudflaredIngress(configYml);
+  const offenders = [];
+  for (const rule of rules) {
+    if (!rule.hostname) continue;
+    const label = rule.hostname.split(".")[0]?.toLowerCase() ?? "";
+    if (!SSO_GATED_HOSTNAME_LABELS.includes(label)) continue;
+    if (rule.host === void 0) continue;
+    if (rule.host.toLowerCase() === SSO_EDGE_SERVICE_HOST) continue;
+    offenders.push({ hostname: rule.hostname, label, service: rule.service, host: rule.host });
+  }
+  return offenders;
+}
+function verifySsoGatedIngressRouting(configYml) {
+  if (!configYml || configYml.trim() === "") return;
+  const unmodelled = findUnauditableIngressSyntax(configYml);
+  if (unmodelled.length > 0) {
+    throw new Error(
+      `[stack-update] cloudflared ingress: this config cannot be audited for SSO-edge routing.
+
+${unmodelled.map((u) => `  - ${u}`).join("\n")}
+
+THE SHAPE THIS GATE CAN AUDIT \u2014 one rule per concrete hostname, no \`path:\` on a rule that
+serves an application, and a \`scheme://host\` service:
+
+  ingress:
+    - hostname: erp.example.com
+      service: http://exe-sso-edge:80
+    - hostname: monitor.example.com   # a \`path:\` is fine on a DENY rule
+      path: /_/*
+      service: http_status:404
+    - service: http_status:404        # terminator, serves nothing
+
+WHY IT REFUSES RATHER THAN GUESSES (bug 3fce7502): wildcards, path-scoped app routes,
+app-serving catch-alls and socket services all decide which rule serves a product by rules
+this gate does not resolve. Reporting "no offenders" for routing nobody could read is how a
+product ends up served around the SSO edge with its cross-app logout silently dead.`
+    );
+  }
+  const offenders = findSsoUngatedIngressHostnames(configYml);
+  if (offenders.length === 0) return;
+  const lines = offenders.map((o) => `  - ${o.hostname} -> ${o.service} (should be http://${SSO_EDGE_SERVICE_HOST}:80)`).join("\n");
+  throw new Error(
+    `[stack-update] cloudflared ingress: SSO-gated hostname(s) bypass the SSO edge:
+${lines}
+These hostnames must route through exe-sso-edge, which selects the app by Host header. Routing straight at the app container skips the unauthenticated 302 to auth.<domain> AND the cross-app-logout check, so a user who signs out at the apex stays signed in to that app (bug 3fce7502). Point the rule at http://exe-sso-edge:80 and re-deploy.`
+  );
+}
 function resolveTransitiveDeps(selected, depsMap) {
   const resolved = new Set(selected);
   const queue = [...selected];
@@ -2139,15 +2349,39 @@ function randomSecret(bytes = 32) {
 function randomHexSecret(bytes = 24) {
   return randomBytes(bytes).toString("hex");
 }
+var EXTERNAL_INPUT_ENV_KEYS = /* @__PURE__ */ new Set([
+  "API_ROUTER_KEY",
+  "MONITOR_AGENT_KEY",
+  "MONITOR_AGENT_TOKEN",
+  "CLOUDFLARE_TUNNEL_TOKEN",
+  "R2_MEDIA_ACCESS_KEY",
+  "R2_MEDIA_SECRET_KEY",
+  "SSH_PUBLIC_KEY",
+  "SSH_PRIVATE_KEY"
+]);
+function isExternalInputKey(key) {
+  return EXTERNAL_INPUT_ENV_KEYS.has(key) || key.endsWith("_API_KEY");
+}
+function deriveDeviceId(domain, rand = () => randomBytes(4).toString("hex")) {
+  const label = domain.trim().toLowerCase().replace(/^https?:\/\//, "").split("/")[0]?.split(".")[0] ?? "";
+  const slug = label.replace(/[^a-z0-9-]/g, "");
+  return slug ? `vps-${slug}` : `vps-${rand()}`;
+}
 function hydrateEnv(raw, opts) {
   let next = raw;
   const license = opts.licenseKey || process.env.EXE_LICENSE_KEY || loadLicense() || "";
   const domain = opts.domain || process.env.EXE_STACK_DOMAIN || process.env.CUSTOMER_DOMAIN || "";
+  const adminEmail = (opts.adminEmail || process.env.EXE_STACK_ADMIN_EMAIL || "").trim();
   const replacements = {};
   const env = parseEnv(raw);
+  const wikiProvider = (env.get("WIKI_LLM_PROVIDER") ?? "").trim().toLowerCase();
+  const wikiUsesAnthropic = wikiProvider === "anthropic" || wikiProvider === "";
   for (const [key, value] of env.entries()) {
     if (!/CHANGEME/.test(value)) continue;
     if (key === "EXE_LICENSE_KEY" && license) replacements[key] = license;
+    else if ((key === "EXE_CRM_ADMIN_EMAIL" || key === "MONITOR_HUB_ADMIN_EMAIL") && adminEmail) replacements[key] = adminEmail;
+    else if (key === "EXED_DEVICE_ID") replacements[key] = deriveDeviceId(domain);
+    else if (key === "WIKI_ANTHROPIC_API_KEY" && !wikiUsesAnthropic) replacements[key] = "";
     else if (key === "MONITOR_AGENT_TOKEN" || key === "MONITOR_AGENT_KEY") continue;
     else if (key === "CLOUDFLARE_TUNNEL_TOKEN") continue;
     else if (key === "EXE_GATEWAY_WS_RELAY_AUTH_TOKEN") replacements[key] = randomHexSecret(24);
@@ -2155,7 +2389,8 @@ function hydrateEnv(raw, opts) {
     else if (key.endsWith("_TOKEN")) replacements[key] = randomHexSecret(32);
     else if (key.endsWith("_SECRET") || key.endsWith("_SALT")) replacements[key] = randomSecret(32);
     else if (key === "EXE_MONITOR_KEY") replacements[key] = randomSecret(32);
-    else if (key.endsWith("_KEY") && key !== "EXE_LICENSE_KEY") continue;
+    else if (isExternalInputKey(key)) continue;
+    else if (key.endsWith("_KEY") && key !== "EXE_LICENSE_KEY") replacements[key] = randomSecret(32);
   }
   if (domain) next = next.replaceAll("CHANGEME_DOMAIN", domain);
   next = patchEnv(next, replacements);
@@ -2574,6 +2809,13 @@ function applyPostgresInitSql(composeArgs, envFile, composeFile, exec) {
   ]);
   console.log("[stack-update] \u2713 Postgres init SQL applied");
 }
+var LIVE_ARTIFACT_MATCHES_MANIFEST_CHECK = "Live artifact matches signed manifest";
+function isFatalLiveArtifactFailure(result) {
+  if (result.check !== LIVE_ARTIFACT_MATCHES_MANIFEST_CHECK) return false;
+  if (result.status !== "fail") return false;
+  if (!result.verdicts) return true;
+  return (result.verdicts.disagrees ?? 0) > 0;
+}
 async function runStackUpdate(options) {
   const exec = options.exec ?? defaultExec;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
@@ -2768,6 +3010,10 @@ ${lines.join("\n")}`
       allowUnmanifestedServices: options.allowUnmanifestedServices
     });
   }
+  if (!options.dryRun) {
+    assertServiceEnvContract(stagedCompose.raw, `the compose template at ${stagedCompose.templatePath}`);
+  }
+  reportDeployedServiceEnvGaps(composeRaw, options.composeFile, stagedCompose.shouldRefresh);
   const previousVersion = readCurrentStackVersion(lockFile);
   if (options.verifyImages) {
     const endPhase = startPhase("verify images");
@@ -3246,6 +3492,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         defaultIngressReachabilityProbe,
         makeDefaultComposeServiceProbe(composeArgs)
       );
+      verifySsoGatedIngressRouting(cfIngressConfigYml);
     }
     const stackEnv = existsSync(options.envFile) ? parseEnv(readFileSync(options.envFile, "utf8")) : void 0;
     const partialRun = failedManifestServices.size > 0;
@@ -3354,7 +3601,21 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       if (!options.verifyStack) {
         throw new Error("verifyStack hook not provided");
       }
-      const verifyReport = await options.verifyStack({ composeFile: options.composeFile, envFile: options.envFile });
+      let expectedArtifacts;
+      try {
+        expectedArtifacts = declaredArtifactsFromManifest(
+          { latest: plan.targetVersion, stacks: { [plan.targetVersion]: plan.release } },
+          { stackVersion: plan.targetVersion }
+        );
+      } catch {
+        expectedArtifacts = void 0;
+      }
+      const verifyReport = await options.verifyStack({
+        composeFile: options.composeFile,
+        envFile: options.envFile,
+        stackVersion: plan.targetVersion,
+        expectedArtifacts
+      });
       const securityFailures = [];
       for (const r of verifyReport.results) {
         if (r.status === "fail") {
@@ -3362,6 +3623,8 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
           const isTruncatedRun = r.check === "Total timeout";
           if (isTruncatedRun || /security|auth|signup|password|ssl|tls|bind|exposed/i.test(r.check)) {
             securityFailures.push(`${r.check}: ${r.message}`);
+          } else if (isFatalLiveArtifactFailure(r)) {
+            securityFailures.push(`${r.check}: ${r.message}`);
           }
         }
       }
@@ -4121,8 +4384,11 @@ export {
   parseComposeServiceNames,
   isUsableTunnelToken,
   isCloudflaredTunnelMisconfigured,
+  findUnauditableIngressSyntax,
   parseCloudflaredIngressTargets,
   findUnreachableIngressTargets,
+  findSsoUngatedIngressHostnames,
+  verifySsoGatedIngressRouting,
   resolveTransitiveDeps,
   filterServicesBySelection,
   buildDefaultServiceSelection,
@@ -4184,10 +4450,14 @@ export {
   assertImageVersionLabels,
   applyGatewayOverlays,
   backupStackConfig,
+  deriveDeviceId,
+  hydrateEnv,
   pairMonitorAgent,
   bootstrapStackHost,
   assertHostReadyForApply,
   hardenHost,
+  LIVE_ARTIFACT_MATCHES_MANIFEST_CHECK,
+  isFatalLiveArtifactFailure,
   runStackUpdate,
   readCurrentStackVersion,
   listAvailableVersions,

package/dist/{chunk-ZLPS3GR7.js → chunk-ZJQ56DZZ.js}

@@ -30,6 +30,16 @@ function updateLoadWindow(samples, nowMs, load1m, wallElapsedMs, keepMs) {
     blockStartMs
   };
 }
+var NOT_SCHEDULED_CPU_FLOOR = 0.02;
+var HOST_SUSPENDED_TICK_CEILING = 0.5;
+function isHostSuspendedWindow(lagMs, severeThresholdMs, selfCpuBusyFraction, hostTickFraction, cpuFloor = NOT_SCHEDULED_CPU_FLOOR, tickCeiling = HOST_SUSPENDED_TICK_CEILING) {
+  if (!Number.isFinite(lagMs) || lagMs <= severeThresholdMs) return false;
+  if (typeof selfCpuBusyFraction !== "number" || !Number.isFinite(selfCpuBusyFraction)) return false;
+  if (typeof hostTickFraction !== "number" || !Number.isFinite(hostTickFraction)) return false;
+  const selfLimit = Number.isFinite(cpuFloor) && cpuFloor >= 0 ? cpuFloor : NOT_SCHEDULED_CPU_FLOOR;
+  const hostLimit = Number.isFinite(tickCeiling) && tickCeiling >= 0 ? tickCeiling : HOST_SUSPENDED_TICK_CEILING;
+  return selfCpuBusyFraction <= selfLimit && hostTickFraction < hostLimit;
+}
 function decideDaemonSelfHeal(s) {
   const alive = s.processAlive ?? true;
   if (!alive) {
@@ -76,6 +86,16 @@ function decideDaemonSelfHeal(s) {
       selfInflictedSuppressedMsAfter: sumInWindow
     };
   }
+  if (isHostSuspendedWindow(
+    s.lagMs,
+    s.severeThresholdMs,
+    s.selfCpuBusyFraction,
+    s.hostTickFraction,
+    s.notScheduledCpuFloor,
+    s.hostSuspendedTickCeiling
+  )) {
+    return { restart: false, reason: "host_suspended_backoff", consecutiveSevereAfter: 0, ...carry };
+  }
   if (s.lagMs > s.singleBlockMs) {
     return { restart: true, reason: "single_block", consecutiveSevereAfter: 0, ...cleared };
   }
@@ -134,13 +154,34 @@ function computeBootRetryAfterSeconds(nowMs, readyEtaMs, opts = {}) {
   const maxS = opts.maxS ?? 60;
   return Math.min(maxS, Math.max(minS, Math.ceil((readyEtaMs - nowMs) / 1e3)));
 }
+function totalHostCpuMs(cpus) {
+  if (!Array.isArray(cpus) || cpus.length === 0) return void 0;
+  let total = 0;
+  for (const c of cpus) {
+    const t = c?.times;
+    if (!t) return void 0;
+    total += t.user + t.nice + t.sys + t.idle + t.irq;
+  }
+  return Number.isFinite(total) ? total : void 0;
+}
+function hostTickFractionFor(previousTotalMs, currentTotalMs, coreCount, wallElapsedMs) {
+  if (typeof previousTotalMs !== "number" || !Number.isFinite(previousTotalMs)) return void 0;
+  if (typeof currentTotalMs !== "number" || !Number.isFinite(currentTotalMs)) return void 0;
+  if (typeof coreCount !== "number" || !Number.isFinite(coreCount) || coreCount <= 0) return void 0;
+  if (!Number.isFinite(wallElapsedMs)) return void 0;
+  if (wallElapsedMs <= 0) return 1;
+  return Math.max(0, currentTotalMs - previousTotalMs) / (coreCount * wallElapsedMs);
+}
 
 export {
   isHostCpuStarved,
   updateLoadWindow,
+  isHostSuspendedWindow,
   decideDaemonSelfHeal,
   decideStarvationDrainGuard,
   decideOrchestrationTickSkip,
   decideBootBackoff,
-  computeBootRetryAfterSeconds
+  computeBootRetryAfterSeconds,
+  totalHostCpuMs,
+  hostTickFractionFor
 };

package/dist/{chunk-VMZZTFXT.js → chunk-ZOTTYCP5.js}

@@ -9,17 +9,17 @@ import {
 import {
   buildClaudeHttpMcpEntry,
   buildClaudeStdioProxyMcpEntry
-} from "./chunk-L5YDAFUH.js";
+} from "./chunk-CYCIX7AW.js";
 import {
   ensureAllAgentSymlinks
-} from "./chunk-JUKDL5MF.js";
+} from "./chunk-6BJCDWSM.js";
 import {
   MCP_LEGACY_KEY,
   MCP_PRIMARY_KEY
 } from "./chunk-HYZV25LY.js";
 import {
   loadConfigSync
-} from "./chunk-ZIG7VPJV.js";
+} from "./chunk-MMS2HBRT.js";
 
 // src/adapters/claude/installer.ts
 import { readFile, writeFile, mkdir, readdir, rm } from "fs/promises";
@@ -942,7 +942,7 @@ async function runInstaller(homeDir) {
     );
   }
   try {
-    const { generateAgentDefs, summarizeAgentDefResults } = await import("./agent-defs-generator-EIUA3SH5.js");
+    const { generateAgentDefs, summarizeAgentDefResults } = await import("./agent-defs-generator-7TFISIJQ.js");
     const defResults = generateAgentDefs({ homeDir: resolvedHome });
     process.stderr.write(`Agent definitions: ${summarizeAgentDefResults(defResults)}
 `);