@askexenow/exe-os 0.9.382 → 0.9.384

package/dist/stack-init-5VKL5PL5.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+import "./chunk-MLKGABMK.js";
+
+// src/bin/stack-init.ts
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  statSync
+} from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+var DEFAULT_STACK_DIR = "/opt/exe-stack";
+var NEVER_OVERWRITE = /* @__PURE__ */ new Set([
+  ".env",
+  "gateway.json",
+  "branding.json",
+  "clickhouse-config.xml",
+  "cloudflared/config.yml"
+]);
+var CUSTOMER_OWNED_PATTERNS = [/^cloudflared\/.+\.json$/];
+function isCustomerOwned(rel) {
+  return NEVER_OVERWRITE.has(rel) || CUSTOMER_OWNED_PATTERNS.some((re) => re.test(rel));
+}
+function resolvePackageRoot(moduleUrl = import.meta.url) {
+  const here = path.dirname(fileURLToPath(moduleUrl));
+  const candidates = [path.resolve(here, "..", ".."), path.resolve(here, ".."), process.cwd()];
+  for (const c of candidates) {
+    if (existsSync(path.join(c, "package.json")) && existsSync(path.join(c, "deploy", "compose", "docker-compose.yml"))) {
+      return c;
+    }
+  }
+  throw new Error(
+    "stack-init: could not locate the packaged deploy/ assets. Reinstall the CLI (`npm install -g @askexenow/exe-os`) and retry."
+  );
+}
+function copyTree(srcDir, destDir, relPrefix, force, created, skipped) {
+  mkdirSync(destDir, { recursive: true });
+  for (const entry of readdirSync(srcDir)) {
+    const src = path.join(srcDir, entry);
+    const dest = path.join(destDir, entry);
+    const rel = relPrefix ? `${relPrefix}/${entry}` : entry;
+    if (statSync(src).isDirectory()) {
+      copyTree(src, dest, rel, force, created, skipped);
+      continue;
+    }
+    if (existsSync(dest) && (!force || isCustomerOwned(rel))) {
+      skipped.push(rel);
+      continue;
+    }
+    copyFileSync(src, dest);
+    if (entry.startsWith(".env")) {
+      try {
+        chmodSync(dest, 384);
+      } catch {
+      }
+    }
+    created.push(rel);
+  }
+}
+function runStackInit(options = {}) {
+  const packageRoot = options.packageRoot ?? resolvePackageRoot();
+  const composeSrc = path.join(packageRoot, "deploy", "compose");
+  const manifestSrc = path.join(packageRoot, "deploy", "stack-manifests");
+  if (!existsSync(composeSrc)) {
+    throw new Error(`stack-init: packaged compose files missing at ${composeSrc}. Reinstall the CLI and retry.`);
+  }
+  if (!existsSync(manifestSrc)) {
+    throw new Error(
+      `stack-init: packaged stack manifests missing at ${manifestSrc}. The manifest is the single source of truth for every image pin \u2014 refusing to lay down a stack directory that cannot generate a .env. Reinstall the CLI and retry.`
+    );
+  }
+  const dir = path.resolve(options.dir ?? process.cwd());
+  const created = [];
+  const skipped = [];
+  copyTree(composeSrc, dir, "", options.force === true, created, skipped);
+  const manifestDir = path.join(dir, "stack-manifests");
+  copyTree(manifestSrc, manifestDir, "stack-manifests", options.force === true, created, skipped);
+  return { dir, created, skipped, manifestDir };
+}
+async function runStackInitCli(argv) {
+  if (argv.includes("--help") || argv.includes("-h")) {
+    console.log(
+      `
+Usage: exe-os stack-init [--dir <path>] [--force]
+
+Lay down a fresh exe-os stack directory: docker-compose.yml, setup.sh,
+the .env template, the service configs, and the signed stack manifest.
+
+  --dir <path>   Target directory (default: current directory)
+  --force        Refresh packaged assets that already exist
+                 (customer-owned files \u2014 .env, gateway.json, branding.json,
+                 clickhouse-config.xml, cloudflared/* \u2014 are never touched)
+
+Next: cd <dir> && ./setup.sh --client <name> --domain <domain> \\
+        --admin-email <you@your-domain> --license <key>
+`
+    );
+    return;
+  }
+  let dir;
+  let force = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--dir") dir = argv[++i];
+    else if (arg.startsWith("--dir=")) dir = arg.slice("--dir=".length);
+    else if (arg === "--force") force = true;
+    else {
+      console.error(`exe-os stack-init: unknown option: ${arg}`);
+      process.exit(1);
+    }
+  }
+  const result = runStackInit({ dir, force });
+  console.log(`
+  Stack directory ready: ${result.dir}`);
+  console.log(`  Files written:   ${result.created.length}`);
+  if (result.skipped.length > 0) {
+    console.log(`  Left untouched:  ${result.skipped.length} (already present \u2014 re-run with --force to refresh)`);
+  }
+  console.log(`  Stack manifest:  ${path.join(result.manifestDir, "v0.9.json")}`);
+  console.log(`
+  Next:`);
+  console.log(`    cd ${result.dir}`);
+  console.log(
+    `    ./setup.sh --client <name> --domain <domain> --admin-email <you@your-domain> --license <key>
+`
+  );
+}
+export {
+  DEFAULT_STACK_DIR,
+  resolvePackageRoot,
+  runStackInit,
+  runStackInitCli
+};

package/dist/{stack-promote-3UKJBJSP.js → stack-promote-34CE2HHF.js}

@@ -1,20 +1,21 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-FHSV4BSW.js";
-import "./chunk-NY74W3S4.js";
+} from "./chunk-MOANZQXF.js";
+import "./chunk-ZBPZDADW.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-C5HUMAA7.js";
 import "./chunk-L25OAFOU.js";
-import "./chunk-5DFE2NAF.js";
+import "./chunk-LFUBEHFW.js";
+import "./chunk-TNS63ATU.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-O34F5EP5.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-DZN7SDY2.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 

package/dist/{stack-release-5CVXMJM5.js → stack-release-5PGWV5D4.js}

@@ -1,21 +1,22 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-FHSV4BSW.js";
-import "./chunk-NY74W3S4.js";
+} from "./chunk-MOANZQXF.js";
+import "./chunk-ZBPZDADW.js";
 import "./chunk-EC5H53YD.js";
 import {
   assertPreflightGate,
   runPreflightOnManifest
-} from "./chunk-LLZNPOGB.js";
+} from "./chunk-PLII76NJ.js";
 import "./chunk-C5HUMAA7.js";
 import "./chunk-L25OAFOU.js";
-import "./chunk-5DFE2NAF.js";
+import "./chunk-LFUBEHFW.js";
+import "./chunk-TNS63ATU.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-O34F5EP5.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-DZN7SDY2.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 
@@ -229,6 +230,38 @@ var STACK_RECONCILE_APP_IMAGE_REPOS = Object.freeze([
   {
     imageName: "update.askexe.com/askexe/exe-auth",
     ghRepo: "AskExe/exe-auth"
+  },
+  // exe-dashboard: same gap — it was absent from both maps in this file, so
+  // G6's reconcile classified an unstamped dashboard image as "no expected
+  // source repo mapped here" (third-party, informational), exactly the false
+  // pass the "unstamped-third-party" distinction exists to avoid for images
+  // this repo family DOES build.
+  //
+  // 🔴 THE REPO HERE IS THE REPO THE IMAGE IS BUILT IN, NOT THE ONE THAT WILL
+  // EVENTUALLY OWN IT. G6 compares this value against the image's org.exe.repo
+  // label, which the shared release lane stamps with the repository the build
+  // actually ran in. exe-dashboard is still built from `dashboard-page/` INSIDE
+  // AskExe/exe-os (.github/workflows/release-dashboard-image.yml passes
+  // `context: dashboard-page`); AskExe/exe-dashboard exists but its history
+  // extraction is unfinished and nothing is built there yet. The real published
+  // ghcr.io/askexe/exe-dashboard:v0.9.382 carries org.exe.repo=AskExe/exe-os
+  // (recorded verbatim in release-service.yml's G2 arming note), so naming the
+  // destination repo here turns every correctly-stamped dashboard release into
+  // a "wrong-repo image (bug 218b10e4 class)" failure — and simultaneously
+  // makes that signal useless for the one service it would be reporting on.
+  //
+  // release-contract-services.mjs's `ghRepo: "AskExe/exe-dashboard"` is a
+  // different field with a different meaning: it names the repo that OWNS the
+  // service in the migration table. Copying it into this provenance map is how
+  // the wrong value got here.
+  //
+  // When the extraction completes, the lane's `context` flips to `.` and moves
+  // to AskExe/exe-dashboard; flip this with it. A test in
+  // tests/scripts/image-provenance.test.ts reads that `context` and fails if
+  // the two disagree, so this cannot drift silently a second time.
+  {
+    imageName: "update.askexe.com/askexe/exe-dashboard",
+    ghRepo: "AskExe/exe-os"
   }
 ]);
 
@@ -370,6 +403,53 @@ async function ghRun(args) {
   const { stdout } = await execFile("gh", args);
   return stdout.trim();
 }
+function isStrictSemverTag(tag) {
+  return /^v\d+\.\d+\.\d+$/.test(tag);
+}
+function compareSemver(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+function higherSemver(a, b) {
+  return compareSemver(a, b) >= 0 ? a : b;
+}
+function parseRemoteTagNames(lsRemoteOutput) {
+  return lsRemoteOutput.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => line.split("	")[1] ?? "").filter((ref) => ref.startsWith("refs/tags/")).map((ref) => ref.slice("refs/tags/".length).replace(/\^\{\}$/, ""));
+}
+function highestReleasedVersion(tagNames) {
+  let best = null;
+  for (const tag of tagNames) {
+    if (!isStrictSemverTag(tag)) continue;
+    const version = tag.slice(1);
+    best = best === null ? version : higherSemver(best, version);
+  }
+  return best;
+}
+async function getRemoteReleaseTags(repoPath, gitRunner = git) {
+  try {
+    const out = await gitRunner(repoPath, "ls-remote", "--tags", "origin");
+    return parseRemoteTagNames(out);
+  } catch {
+    return [];
+  }
+}
+async function resolveVersionBasis(repoPath, packageVersion, gitRunner = git) {
+  const highestTag = highestReleasedVersion(await getRemoteReleaseTags(repoPath, gitRunner));
+  return highestTag ? higherSemver(packageVersion, highestTag) : packageVersion;
+}
+async function assertVersionNotAlreadyReleased(repoPath, tag, gitRunner = git) {
+  const out = await gitRunner(repoPath, "ls-remote", "--tags", "origin", `refs/tags/${tag}`);
+  if (out.trim().length > 0) {
+    throw new Error(
+      `refusing to cut ${tag}: this tag already exists on origin. package.json (and/or the computed bump basis) has drifted behind real release history \u2014 resync before releasing. (bug 343af002)`
+    );
+  }
+}
 async function assertReleaseFreshness(opts) {
   const runGit = opts.gitRunner ?? git;
   const logFn = opts.log ?? log;
@@ -513,6 +593,14 @@ async function detectChanges(repos) {
         continue;
       }
     }
+    const basisVersion = await resolveVersionBasis(repo.localPath, currentVersion);
+    if (basisVersion !== currentVersion) {
+      log(
+        "warn",
+        `${repo.serviceKey}: package.json (${currentVersion}) is behind the highest release tag on origin \u2014 using ${basisVersion} as the bump basis`
+      );
+      currentVersion = basisVersion;
+    }
     const lastTag = await getLastTag(repo.localPath);
     if (!lastTag) {
       log("warn", `No tags found in ${repo.serviceKey} \u2014 skipping`);
@@ -560,6 +648,7 @@ async function bumpVersions(changes, mode, dryRun) {
     const newVersion = bumpVersion(change.currentVersion, mode);
     change.newVersion = newVersion;
     change.tag = `v${newVersion}`;
+    await assertVersionNotAlreadyReleased(change.repo.localPath, change.tag);
     if (dryRun) {
       log("dry", `${change.repo.serviceKey}: ${change.currentVersion} -> ${newVersion}`);
       continue;
@@ -602,6 +691,7 @@ async function bumpVersions(changes, mode, dryRun) {
     log("ok", `${change.repo.serviceKey}: bumped ${change.currentVersion} -> ${newVersion} (local commit, push deferred)`);
   }
 }
+var RELEASE_PR_POLL_JQ = "[.state, .mergeable, .mergeStateStatus] | @tsv";
 async function landViaPR(repoPath, ghRepo, defaultBranch, branch, title) {
   const pushedSha = await git(repoPath, "rev-parse", "HEAD");
   await git(repoPath, "push", "--force-with-lease", "origin", `HEAD:refs/heads/${branch}`);
@@ -652,22 +742,30 @@ async function landViaPR(repoPath, ghRepo, defaultBranch, branch, title) {
   if (releasePr.state !== "MERGED") {
     await ghRun(["pr", "merge", String(releasePr.number), "--repo", ghRepo, "--auto", "--squash"]);
   }
+  let lastMergeable = "";
   for (; ; ) {
-    const state = (await ghRun([
+    const observed = (await ghRun([
       "pr",
       "view",
       String(releasePr.number),
       "--repo",
       ghRepo,
       "--json",
-      "state",
+      "state,mergeable,mergeStateStatus",
       "-q",
-      ".state"
+      RELEASE_PR_POLL_JQ
     ])).trim();
+    const [state, mergeable = "", mergeStateStatus = ""] = observed.split("	");
+    if (mergeable) lastMergeable = `mergeable=${mergeable} mergeStateStatus=${mergeStateStatus}`;
     if (state === "MERGED") break;
+    if (mergeable === "CONFLICTING") {
+      throw new Error(
+        `Release PR ${ghRepo}#${releasePr.number} (${branch} @ ${pushedSha.slice(0, 12)}) CONFLICTS with ${defaultBranch}. GitHub cannot compute a merge commit for it, so NO CI will run and auto-merge can never fire \u2014 waiting would not help. Rebase the release branch and re-run. Aborting release; ${defaultBranch} left untouched.`
+      );
+    }
     if (Date.now() > deadline) {
       throw new Error(
-        `Release PR ${ghRepo}#${releasePr.number} (${branch} @ ${pushedSha.slice(0, 12)}) did not merge within 30m \u2014 required CI likely red. Aborting release; ${defaultBranch} left untouched.`
+        `Release PR ${ghRepo}#${releasePr.number} (${branch} @ ${pushedSha.slice(0, 12)}) did not merge within 30m (${lastMergeable || "mergeability never readable"}). Aborting release; ${defaultBranch} left untouched.`
       );
     }
     await sleep(3e4);
@@ -1236,7 +1334,11 @@ async function commitAndTagExeOs(newStackVersion, _exeOsChange, dryRun) {
     await git(EXE_OS_ROOT, "push", "origin", stackTag);
     log("ok", `Tagged exe-os ${stackTag}`);
   } catch (err) {
-    log("warn", `Failed to tag exe-os ${stackTag}: ${err instanceof Error ? err.message : String(err)}`);
+    const message = err instanceof Error ? err.message : String(err);
+    log("fail", `Failed to tag/push exe-os ${stackTag}: ${message}`);
+    throw new Error(
+      `Aborting: failed to tag/push exe-os ${stackTag}: ${message}. The manifest was committed but the stack-v tag that publishes it was not \u2014 customers will keep reading the previous manifest. Fix the cause and re-run; publishing is idempotent.`
+    );
   }
 }
 function printSummary(changes, ciStatuses, newStackVersion, dryRun) {
@@ -1479,18 +1581,27 @@ async function runStackRelease(flags) {
   }
 }
 export {
+  RELEASE_PR_POLL_JQ,
   assertCleanWorkingTree,
   assertReleaseFreshness,
+  assertVersionNotAlreadyReleased,
+  compareSemver,
   deriveCloneUrl,
   ensureRepoCloned,
   findPullRequestForHeadSha,
   findWorkflowRunForHeadSha,
   forceBuildRejection,
+  getRemoteReleaseTags,
+  higherSemver,
+  highestReleasedVersion,
   imageRepoPath,
   isCloneTargetSafe,
+  isStrictSemverTag,
   mayRebaseComponent,
   parseReleaseArgs,
+  parseRemoteTagNames,
   printOpenPrGate,
   rebaseImageTag,
+  resolveVersionBasis,
   runStackRelease
 };

package/dist/{stack-update-Z53KG2P5.js → stack-update-ZQQ5YYPJ.js}

@@ -1,5 +1,6 @@
 import {
   BUILTIN_STACK_MANIFEST_KEY_ID,
+  LIVE_ARTIFACT_MATCHES_MANIFEST_CHECK,
   MONITOR_HEALTH_BIN_ENV,
   MONITOR_IMAGE_TAG_ENV,
   ProgressReporter,
@@ -31,6 +32,7 @@ import {
   createStackUpdatePlan,
   defaultIngressReachabilityProbe,
   defaultStackPaths,
+  deriveDeviceId,
   detectDanglingVolumes,
   detectMissingRequiredEnvVars,
   expandComposeExpression,
@@ -38,14 +40,18 @@ import {
   expandEnvRefs,
   filterServicesBySelection,
   findLatestBackupEnvFile,
+  findSsoUngatedIngressHostnames,
+  findUnauditableIngressSyntax,
   findUnreachableIngressTargets,
   hardenHost,
   httpStatus,
+  hydrateEnv,
   imagePullRef,
   isCloudflaredLoopbackHost,
   isCloudflaredTunnelMisconfigured,
   isComposeNetworkHost,
   isExecFormMigration,
+  isFatalLiveArtifactFailure,
   isStrictDigestEnabled,
   isThirdPartyImage,
   isUnpinnedImageBreakGlassEnabled,
@@ -102,23 +108,26 @@ import {
   verifyIngressTargetsReachable,
   verifyManifestImagesAvailable,
   verifyReleaseHealth,
+  verifySsoGatedIngressRouting,
   verifyStackManifestSignature,
   waitForHttpOk,
   warnUnmanagedManifestServices
-} from "./chunk-NY74W3S4.js";
+} from "./chunk-ZBPZDADW.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-C5HUMAA7.js";
 import "./chunk-L25OAFOU.js";
-import "./chunk-5DFE2NAF.js";
+import "./chunk-LFUBEHFW.js";
+import "./chunk-TNS63ATU.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-O34F5EP5.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-DZN7SDY2.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {
   BUILTIN_STACK_MANIFEST_KEY_ID,
+  LIVE_ARTIFACT_MATCHES_MANIFEST_CHECK,
   MONITOR_HEALTH_BIN_ENV,
   MONITOR_IMAGE_TAG_ENV,
   ProgressReporter,
@@ -150,6 +159,7 @@ export {
   createStackUpdatePlan,
   defaultIngressReachabilityProbe,
   defaultStackPaths,
+  deriveDeviceId,
   detectDanglingVolumes,
   detectMissingRequiredEnvVars,
   expandComposeExpression,
@@ -157,14 +167,18 @@ export {
   expandEnvRefs,
   filterServicesBySelection,
   findLatestBackupEnvFile,
+  findSsoUngatedIngressHostnames,
+  findUnauditableIngressSyntax,
   findUnreachableIngressTargets,
   hardenHost,
   httpStatus,
+  hydrateEnv,
   imagePullRef,
   isCloudflaredLoopbackHost,
   isCloudflaredTunnelMisconfigured,
   isComposeNetworkHost,
   isExecFormMigration,
+  isFatalLiveArtifactFailure,
   isStrictDigestEnabled,
   isThirdPartyImage,
   isUnpinnedImageBreakGlassEnabled,
@@ -221,6 +235,7 @@ export {
   verifyIngressTargetsReachable,
   verifyManifestImagesAvailable,
   verifyReleaseHealth,
+  verifySsoGatedIngressRouting,
   verifyStackManifestSignature,
   waitForHttpOk,
   warnUnmanagedManifestServices

package/dist/{steward-gate-OKUYYIX6.js → steward-gate-AQJ6KT2C.js}

@@ -1,19 +1,19 @@
 import {
   StewardGate
-} from "./chunk-N4J5WHO2.js";
-import "./chunk-AY2U4NZ5.js";
+} from "./chunk-ZT4LFTUJ.js";
+import "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FU5O2REK.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{subagent-brief-injection-T2CVQLAS.js → subagent-brief-injection-3GU7YAWY.js}

@@ -1,83 +1,84 @@
 import {
   buildEmployeeBootBrief
-} from "./chunk-ENN6DY4T.js";
+} from "./chunk-RVO5O5SR.js";
 import "./chunk-HSFBNCNC.js";
-import "./chunk-VZT66WWP.js";
-import "./chunk-2YIB75UQ.js";
-import "./chunk-QV5CQLQH.js";
+import "./chunk-4AAMFWJT.js";
+import "./chunk-S26CV7BE.js";
+import "./chunk-EIOGV75A.js";
 import "./chunk-QGGH7LOU.js";
-import "./chunk-TXTXC3QG.js";
-import "./chunk-C7H2D7LX.js";
+import "./chunk-3RGTLZNO.js";
+import "./chunk-M4XY4JRK.js";
 import "./chunk-VMHZSZQJ.js";
-import "./chunk-CO5ZVE3D.js";
-import "./chunk-ZEGEFBZV.js";
+import "./chunk-UOPCVFVR.js";
+import "./chunk-AWWDKF22.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-M2B35MUK.js";
+import "./chunk-VHHX4UCP.js";
 import {
   resolveAgentAttribution
-} from "./chunk-F6H7GP2O.js";
+} from "./chunk-F4BBMIPG.js";
 import {
   tryMarkSubagentBriefInjected
-} from "./chunk-K4ESASPL.js";
+} from "./chunk-MUCNYSJP.js";
 import "./chunk-5MOYSU5A.js";
-import "./chunk-5QCIWWFA.js";
+import "./chunk-ELEGH4DX.js";
 import "./chunk-76CJBM36.js";
-import "./chunk-ZVBVPX4W.js";
-import "./chunk-JUKDL5MF.js";
-import "./chunk-SFFXAPYK.js";
-import "./chunk-UJWZYK46.js";
+import "./chunk-7UHZBVP3.js";
+import "./chunk-6BJCDWSM.js";
+import "./chunk-JDDM6C57.js";
 import "./chunk-ZKGWHT56.js";
+import "./chunk-QNZ4562V.js";
 import "./chunk-WT4RI36X.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-TDF2XKLK.js";
 import "./chunk-EIKATSE4.js";
 import "./chunk-MJCSEIFI.js";
-import "./chunk-NPGV4MZ3.js";
+import "./chunk-ALRHGEAJ.js";
+import "./chunk-PUBA5B4M.js";
 import "./chunk-VI4ATC6I.js";
 import "./chunk-A27Q27CT.js";
-import "./chunk-BZ546I4Q.js";
-import "./chunk-VUOAPKPI.js";
-import "./chunk-XU57KFD6.js";
-import "./chunk-AZBJXATK.js";
-import "./chunk-GZOG2MAX.js";
+import "./chunk-LSNBTGW4.js";
+import "./chunk-T5SM4RXY.js";
+import "./chunk-VJEJ7JNB.js";
+import "./chunk-L5EPGGDP.js";
 import "./chunk-AM7S2TY6.js";
-import "./chunk-4CF5KUWH.js";
+import "./chunk-BPVFZ6Q4.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-WJC6AAJN.js";
-import "./chunk-4IK2K3B3.js";
-import "./chunk-ZKJ5S23O.js";
-import "./chunk-GPUOUUHA.js";
+import "./chunk-ANVHWV2X.js";
+import "./chunk-HME6ITKV.js";
+import "./chunk-MFAOAIUE.js";
+import "./chunk-PCV52RYM.js";
 import "./chunk-BTSWFMEH.js";
-import "./chunk-ZG62LIK3.js";
-import "./chunk-IMYGYIAI.js";
+import "./chunk-CIPDQRFO.js";
 import "./chunk-NLEW62VC.js";
-import "./chunk-GPJIBLP4.js";
-import "./chunk-V3WLC5TJ.js";
-import "./chunk-22LNFCDF.js";
+import "./chunk-IMYGYIAI.js";
+import "./chunk-3DAEZILW.js";
+import "./chunk-DRTJCG6B.js";
+import "./chunk-UX2EO653.js";
 import "./chunk-HYZV25LY.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-AY2U4NZ5.js";
+import "./chunk-YRUZK2QA.js";
+import "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FU5O2REK.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-WNBZJSQT.js";
-import "./chunk-AVMLC2MR.js";
-import "./chunk-5DFE2NAF.js";
+import "./chunk-5U2IJBFV.js";
+import "./chunk-TNS63ATU.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-O34F5EP5.js";
+import "./chunk-DZN7SDY2.js";
 import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
-import "./chunk-ZIG7VPJV.js";
-import "./chunk-HSGBZSCA.js";
+import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 
@@ -91,7 +92,7 @@ async function buildSubagentBootstrapContext(payload, options = {}) {
       return "";
     }
     try {
-      const { fastDbInit } = await import("./fast-db-init-MGY6VCLG.js");
+      const { fastDbInit } = await import("./fast-db-init-W3NGKAEU.js");
       await fastDbInit({ caller: "hook" });
     } catch {
     }
@@ -99,7 +100,14 @@ async function buildSubagentBootstrapContext(payload, options = {}) {
     return await buildBrief({
       agentId: attribution.agentId,
       cwd: payload.cwd || process.cwd(),
-      mode: "subagent"
+      mode: "subagent",
+      // Bug 24053c0c: `agent_id` is the harness's unique id for THIS subagent
+      // spawn, and it is the only thing that separates the several subagents
+      // that share one roster identity. It was already being captured by the
+      // spawn ledger above and then dropped one call short of the scratch path
+      // that needed it — so concurrent `tom`s all resolved one directory while
+      // being told it was private.
+      agentInstanceId: payload.agent_id
     });
   } catch {
     return "";