@askexenow/exe-os 0.9.383 → 0.9.384

package/deploy/compose/generate-env.ts

@@ -1,5 +1,6 @@
 import { randomBytes } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 // ---------------------------------------------------------------------------
 // IMAGE PINS — DERIVED FROM THE SIGNED MANIFEST. NEVER HAND-TYPED.
 //
@@ -26,7 +27,52 @@ const REGISTRY = "ghcr.io/askexe";
 // own registry constant rather than reusing REGISTRY (bug 58840873).
 const AUTH_REGISTRY = "update.askexe.com/askexe";
 
-const MANIFEST_PATH = new URL("../stack-manifests/v0.9.json", import.meta.url);
+// Bug cff0de47: the manifest used to be resolved as ONE path relative to this
+// module's own file (`../stack-manifests/v0.9.json`). The documented VPS install
+// copies `deploy/compose/*` into /opt/exe-stack WITHOUT its sibling
+// `deploy/stack-manifests/`, so the relocated generator looked for
+// /opt/stack-manifests/v0.9.json — a directory nobody ever creates — and died at
+// MODULE INITIALIZATION before generating a single line of configuration.
+//
+// Resolution is now an ordered search over EXPLICIT, configurable locations, so
+// relocating this file cannot break it:
+//   1. $EXE_STACK_MANIFEST            — explicit override (setup.sh exports it)
+//   2. <this dir>/stack-manifests/…   — manifest copied ALONGSIDE the compose files
+//   3. <this dir>/../stack-manifests/…— in-repo / in-package layout
+// A failure names every location searched instead of one phantom path.
+const MANIFEST_FILENAME = "v0.9.json";
+const MANIFEST_PATH_ENV_VAR = "EXE_STACK_MANIFEST";
+
+export function manifestSearchPaths(
+  env: NodeJS.ProcessEnv = process.env,
+  moduleUrl: string = import.meta.url,
+): string[] {
+  const paths: string[] = [];
+  const override = (env[MANIFEST_PATH_ENV_VAR] ?? "").trim();
+  if (override) paths.push(override);
+  paths.push(fileURLToPath(new URL(`./stack-manifests/${MANIFEST_FILENAME}`, moduleUrl)));
+  paths.push(fileURLToPath(new URL(`../stack-manifests/${MANIFEST_FILENAME}`, moduleUrl)));
+  return paths;
+}
+
+export function resolveManifestPath(
+  env: NodeJS.ProcessEnv = process.env,
+  moduleUrl: string = import.meta.url,
+  exists: (p: string) => boolean = existsSync,
+): string {
+  const candidates = manifestSearchPaths(env, moduleUrl);
+  for (const candidate of candidates) {
+    if (exists(candidate)) return candidate;
+  }
+  throw new Error(
+    `generate-env: the signed stack manifest (${MANIFEST_FILENAME}) was not found. Searched:\n` +
+      candidates.map((c) => `  - ${c}`).join("\n") +
+      `\nThe manifest is the single source of truth for every image pin, so generation cannot ` +
+      `continue without it. Copy deploy/stack-manifests/ next to these compose files, or set ` +
+      `${MANIFEST_PATH_ENV_VAR}=/path/to/${MANIFEST_FILENAME}. ` +
+      `This is NOT a node/tsx problem.`,
+  );
+}
 
 type ManifestFile = {
   latest: string;
@@ -34,11 +80,12 @@ type ManifestFile = {
 };
 
 function loadManifestServices(): Record<string, { image?: string }> {
-  const manifest = JSON.parse(readFileSync(MANIFEST_PATH, "utf8")) as ManifestFile;
+  const manifestPath = resolveManifestPath();
+  const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as ManifestFile;
   const services = manifest.stacks?.[manifest.latest]?.services;
   if (!services) {
     throw new Error(
-      `generate-env: stack manifest ${MANIFEST_PATH.pathname} has no services for latest="${manifest.latest}". ` +
+      `generate-env: stack manifest ${manifestPath} has no services for latest="${manifest.latest}". ` +
         `Refusing to generate a .env with no pins — that is exactly the silent-substitution failure ` +
         `the manifest-as-single-source-of-truth change exists to prevent.`,
     );
@@ -192,9 +239,18 @@ export interface GenerateEnvOptions {
    * a fresh deploy and the checked-in .env.example are unchanged.
    */
   disableSignup?: boolean;
+  /**
+   * The CRM's first administrator (bug cff0de47). When supplied it is written
+   * straight into EXE_CRM_ADMIN_EMAIL instead of the CHANGEME_ADMIN_EMAIL placeholder, so the documented first-run path produces
+   * a .env that the deploy gate accepts. It is still never GUESSED — no
+   * admin@<domain> default — because it must be a real mailbox that also exists
+   * in GoTrue.
+   */
+  adminEmail?: string;
 }
 
 export function generateEnv(options: GenerateEnvOptions): string {
+  const adminEmail = (options.adminEmail ?? "").trim();
   const normalizedDomain = normalizeDomain(options.domain);
   const normalizedClientName = normalizeClientName(options.clientName);
   const gatewayWsAuthToken = randomSecret(RANDOM_SECRET_48);
@@ -318,8 +374,8 @@ export function generateEnv(options: GenerateEnvOptions): string {
     // refused (e51ca54c §10.6b). It cannot be generated — it must be a real
     // mailbox that also exists in GoTrue — so it ships as SET_MANUALLY rather
     // than as a random secret or a guessed admin@<domain>.
-    MANUAL_VALUE_COMMENT,
-    "EXE_CRM_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL",
+    ...(adminEmail ? [] : [MANUAL_VALUE_COMMENT]),
+    `EXE_CRM_ADMIN_EMAIL=${adminEmail || "CHANGEME_ADMIN_EMAIL"}`,
     `CRM_HOST_PORT=${CRM_HOST_PORT}`,
     "",
     "# --- Wiki ---",
@@ -935,7 +991,7 @@ export function joinEnvLines(lines: string[]): string {
 function printUsage(): void {
   process.stderr.write(
     "Usage:\n" +
-      "  npx tsx deploy/compose/generate-env.ts <client-name> <domain> [license-key]\n" +
+      "  npx tsx deploy/compose/generate-env.ts <client-name> <domain> [license-key] [admin-email]\n" +
       "  npx tsx deploy/compose/generate-env.ts --example\n",
   );
 }
@@ -957,13 +1013,13 @@ function main(): void {
     return;
   }
 
-  const [clientName, domain, licenseKey] = args;
+  const [clientName, domain, licenseKey, adminEmail] = args;
   if (!clientName || !domain) {
     printUsage();
     process.exit(1);
   }
 
-  process.stdout.write(generateEnv({ clientName, domain, licenseKey }));
+  process.stdout.write(generateEnv({ clientName, domain, licenseKey, adminEmail }));
 }
 
 if (isCliInvocation()) {

package/deploy/compose/setup.sh

@@ -14,17 +14,106 @@ info() { echo -e "${GREEN}[setup]${NC} $1"; }
 warn() { echo -e "${YELLOW}[setup]${NC} $1"; }
 err() { echo -e "${RED}[setup]${NC} $1" >&2; }
 
+# Read one KEY from .env, empty if absent. Used to decide whether a RE-RUN
+# already has the configuration this run did not pass on the command line.
+get_env_var() {
+  [[ -f .env ]] || { echo ""; return 0; }
+  local raw
+  raw=$(grep -E "^$1=" .env 2>/dev/null | head -n1 | cut -d= -f2- || true)
+  # set_env_var writes dotenv DOUBLE-QUOTED values, so undo that quoting here —
+  # otherwise a re-run compares `"true"` against `true` and takes the wrong
+  # branch. Values written by generate-env.ts are unquoted and pass through.
+  if [[ ${#raw} -ge 2 && "$raw" == '"'*'"' ]]; then
+    local bs='\' dq='"' dollar='$'
+    raw="${raw:1:${#raw}-2}"
+    raw="${raw//$dollar$dollar/$dollar}"
+    raw="${raw//"$bs$dq"/$dq}"
+    raw="${raw//"$bs$bs"/$bs}"
+  fi
+  printf '%s\n' "$raw"
+}
+
+# Set (or append) one KEY=VALUE in .env WITHOUT echoing the value. sed cannot be
+# used safely here: secrets contain /, & and = which are sed metacharacters.
+#
+# COMPOSE INTERPOLATES .env VALUES, so a `$` written raw is not a `$`. An SMTP
+# password of `abc$TOKEN` is read by Compose as the variable TOKEN and becomes
+# `abc` — the credential is silently changed, email verification and password
+# reset stop working, and nothing in the stack reports a wrong password as
+# anything but a failed login. Measured:
+#
+#   .env: SMTP_PASS=abc$TOKEN   -> docker compose config -> P: abc
+#   .env: SMTP_PASS=abc$$TOKEN  -> docker compose config -> P: abc$$TOKEN
+#
+# (`docker compose config` re-escapes a literal `$` as `$$` on output, which is
+# how the second line reads back as the intended `abc$TOKEN`.)
+#
+# ESCAPING `$` IS NOT ENOUGH: an UNQUOTED value also loses everything from the
+# first `#`, and its surrounding whitespace. Measured the same way:
+#
+#   .env: SMTP_PASS=abc #def    -> docker compose config -> P: abc
+#   .env: SMTP_PASS="abc #def"  -> docker compose config -> P: abc #def
+#
+# So values are written dotenv DOUBLE-QUOTED, with `\`, `"` and `$` escaped.
+# These are literal secrets and hostnames, never expressions — nothing here is
+# meant to interpolate. get_env_var() undoes exactly this quoting.
+set_env_var() {
+  local key="$1" value="$2"
+  # The replacement side of ${var//x/y} IS expanded, so a literal `$$` written
+  # there becomes the shell's PID — `abc$TOKEN` came out as `abc87319TOKEN`.
+  # Going through a variable whose value is a single `$` keeps both characters
+  # literal, because an expansion's RESULT is not expanded again.
+  local dollar='$' bs='\' dq='"'
+  # The PATTERN side is quoted: an unquoted `$bs` is a lone backslash, which the
+  # pattern matcher reads as an escape character and matches nothing, so `a\b`
+  # went out unescaped and Compose read `\b` as a BACKSPACE byte.
+  value="${value//"$bs"/$bs$bs}"   # backslash first: it escapes the rest
+  value="${value//$dq/$bs$dq}"
+  value="${value//$dollar/$dollar$dollar}"
+  value="$dq$value$dq"
+  SEV_KEY="$key" SEV_VALUE="$value" awk '
+    $0 ~ "^" ENVIRON["SEV_KEY"] "=" { print ENVIRON["SEV_KEY"] "=" ENVIRON["SEV_VALUE"]; found=1; next }
+    { print }
+    END { if (!found) print ENVIRON["SEV_KEY"] "=" ENVIRON["SEV_VALUE"] }
+  ' .env > .env.setenv.tmp && mv .env.setenv.tmp .env
+  chmod 600 .env 2>/dev/null || true
+}
+
 # Parse args
-CLIENT="" DOMAIN="" LICENSE=""
+CLIENT="" DOMAIN="" LICENSE="" ADMIN_EMAIL="" TUNNEL_TOKEN=""
+SMTP_HOST="" SMTP_PORT="" SMTP_USER="" SMTP_PASS="" NO_EMAIL="no"
 while [[ $# -gt 0 ]]; do
   case $1 in
     --client) CLIENT="$2"; shift 2;;
     --domain) DOMAIN="$2"; shift 2;;
     --license) LICENSE="$2"; shift 2;;
+    --admin-email) ADMIN_EMAIL="$2"; shift 2;;
+    --tunnel-token) TUNNEL_TOKEN="$2"; shift 2;;
+    --smtp-host) SMTP_HOST="$2"; shift 2;;
+    --smtp-port) SMTP_PORT="$2"; shift 2;;
+    --smtp-user) SMTP_USER="$2"; shift 2;;
+    --smtp-pass) SMTP_PASS="$2"; shift 2;;
+    --no-email) NO_EMAIL="yes"; shift 1;;
     *) err "Unknown arg: $1"; exit 1;;
   esac
 done
-[[ -z "$CLIENT" || -z "$DOMAIN" ]] && { err "Usage: ./setup.sh --client <name> --domain <domain>"; exit 1; }
+[[ -z "$CLIENT" || -z "$DOMAIN" ]] && { err "Usage: ./setup.sh --client <name> --domain <domain> --admin-email <you@your-domain> [--tunnel-token <token>] [--smtp-host <host> --smtp-user <user> --smtp-pass <pass> | --no-email] [--license <key>]"; exit 1; }
+# bug cff0de47: the CRM seeds its FIRST workspace owner from EXE_CRM_ADMIN_EMAIL.
+# Without it the CRM boots healthy with no workspace and no user, and the first
+# sign-in is refused with no way in. Ask for it here rather than deploying a
+# stack nobody can log into (preflight refuses it either way).
+if [[ -z "$ADMIN_EMAIL" ]]; then
+  if [[ -t 0 ]]; then
+    read -r -p "  Admin email (owns the CRM/wiki; must be a real mailbox): " ADMIN_EMAIL
+  fi
+fi
+if [[ -z "$ADMIN_EMAIL" ]]; then
+  err "--admin-email is required. It becomes EXE_CRM_ADMIN_EMAIL: the mailbox that"
+  err "owns this stack. The CRM seeds its first workspace for exactly this address;"
+  err "without it the CRM comes up healthy but empty and NOBODY can sign in."
+  err "  ./setup.sh --client $CLIENT --domain $DOMAIN --admin-email you@$DOMAIN${LICENSE:+ --license $LICENSE}"
+  exit 1
+fi
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 cd "$SCRIPT_DIR"
@@ -59,13 +148,44 @@ else
   # so any failure of the generator silently deployed ancient images that bypass
   # the manifest's digest-pinning entirely. There is NO safe inline fallback for
   # image tags — fail loudly instead and let the operator install node/npx.
+  # Bug cff0de47: generate-env.ts reads the SIGNED STACK MANIFEST at module
+  # initialization. The documented install copies deploy/compose/* into
+  # /opt/exe-stack without its sibling deploy/stack-manifests/, so the generator
+  # died on a manifest path that exists only inside the npm package — and the
+  # error below blamed node/tsx, sending the operator to debug the wrong thing.
+  # Locate the manifest explicitly and hand the generator its path.
+  if [[ -z "${EXE_STACK_MANIFEST:-}" ]]; then
+    for candidate in \
+      "$SCRIPT_DIR/stack-manifests/v0.9.json" \
+      "$SCRIPT_DIR/../stack-manifests/v0.9.json" \
+      "$(npm root -g 2>/dev/null)/@askexenow/exe-os/deploy/stack-manifests/v0.9.json"; do
+      if [[ -f "$candidate" ]]; then EXE_STACK_MANIFEST="$candidate"; break; fi
+    done
+  fi
+  if [[ -z "${EXE_STACK_MANIFEST:-}" || ! -f "${EXE_STACK_MANIFEST}" ]]; then
+    err "Stack manifest v0.9.json not found. Searched:"
+    err "  - \$EXE_STACK_MANIFEST (${EXE_STACK_MANIFEST:-unset})"
+    err "  - $SCRIPT_DIR/stack-manifests/v0.9.json"
+    err "  - $SCRIPT_DIR/../stack-manifests/v0.9.json"
+    err "  - \$(npm root -g)/@askexenow/exe-os/deploy/stack-manifests/v0.9.json"
+    err ""
+    err "The manifest is the single source of truth for every image pin, so .env"
+    err "cannot be generated without it. This is NOT a node/tsx problem."
+    err "Fix: run 'exe-os stack-init --dir $SCRIPT_DIR' (it copies the compose files"
+    err "AND the manifest), or set EXE_STACK_MANIFEST=/path/to/v0.9.json."
+    exit 1
+  fi
+  info "Using stack manifest: $EXE_STACK_MANIFEST"
+  export EXE_STACK_MANIFEST
   if command -v node >/dev/null 2>&1 && command -v npx >/dev/null 2>&1; then
     # Run via npx tsx (the project is pure ESM — require() is forbidden).
-    if ! npx --yes tsx "$SCRIPT_DIR/generate-env.ts" "$CLIENT" "$DOMAIN" "${LICENSE:-}" > .env 2>/tmp/exe-generate-env.err; then
+    if ! npx --yes tsx "$SCRIPT_DIR/generate-env.ts" "$CLIENT" "$DOMAIN" "${LICENSE:-}" "$ADMIN_EMAIL" > .env 2>/tmp/exe-generate-env.err; then
       rm -f .env
       err "generate-env.ts failed — refusing to write a .env with stale fallback image tags."
       err "Generator error:"; cat /tmp/exe-generate-env.err >&2 || true
-      err "Fix node/tsx and re-run setup.sh (the inline fallback was removed: bug 716c0f6e)."
+      err "If the error above is about a missing manifest, see EXE_STACK_MANIFEST"
+      err "(currently: $EXE_STACK_MANIFEST). Otherwise fix node/tsx and re-run"
+      err "setup.sh (the inline fallback was removed: bug 716c0f6e)."
       exit 1
     fi
   else
@@ -80,6 +200,79 @@ else
   info ".env generated with auto-generated secrets (chmod 600)"
 fi
 
+# Step 2a: Cloudflare tunnel token.
+#
+# bug cff0de47: the gated deploy at the end of this script REFUSES to run
+# without a tunnel token (the cloudflared service has no compose profile gate,
+# so a stack without a token has no public ingress). The customer guide used to
+# hand the token over in a LATER step than the one that runs this script, so the
+# documented order could never complete on a fresh machine. Take it here.
+if [[ -n "$TUNNEL_TOKEN" ]]; then
+  set_env_var CLOUDFLARE_TUNNEL_TOKEN "$TUNNEL_TOKEN"
+  info "Cloudflare tunnel token written to .env"
+else
+  warn "No --tunnel-token given. The deploy step below REQUIRES CLOUDFLARE_TUNNEL_TOKEN"
+  warn "in .env (Zero Trust > Networks > Tunnels > your tunnel > install token)."
+  warn "Set it and re-run this script, or re-run with --tunnel-token <token>."
+fi
+
+# Step 2a-ii: Email delivery.
+#
+# bug cff0de47: a freshly generated .env ships SMTP_HOST empty and
+# GOTRUE_MAILER_AUTOCONFIRM=false, and the deploy preflight REFUSES that
+# combination — password-reset and email-verification would silently never
+# send. Every fresh install hit it, and the customer guide never mentioned
+# email at all. Ask for it here rather than deploying a stack whose recovery
+# flow is dead, or record the operator's explicit decision to run without email.
+if [[ "$NO_EMAIL" == "yes" ]]; then
+  set_env_var GOTRUE_MAILER_AUTOCONFIRM "true"
+  warn "Email flows DISABLED (--no-email): GOTRUE_MAILER_AUTOCONFIRM=true."
+  warn "Sign-ups are auto-confirmed and there is NO password-reset email."
+  warn "Signup stays disabled (invite-only), so this does not open registration."
+elif [[ -n "$SMTP_HOST" ]]; then
+  set_env_var SMTP_HOST "$SMTP_HOST"
+  if [[ -n "$SMTP_PORT" ]]; then set_env_var SMTP_PORT "$SMTP_PORT"; fi
+  if [[ -n "$SMTP_USER" ]]; then set_env_var SMTP_USER "$SMTP_USER"; fi
+  if [[ -n "$SMTP_PASS" ]]; then set_env_var SMTP_PASS "$SMTP_PASS"; fi
+  # GOTRUE_MAILER_AUTOCONFIRM IS DERIVED FROM THE MAILER DECISION, not left at
+  # whatever a previous run wrote. Switching a `--no-email` install to SMTP used
+  # to leave AUTOCONFIRM=true behind: setup announced that verification would
+  # send while GoTrue kept auto-confirming every account without ever proving
+  # the mailbox belonged to the person signing up — and preflight's smtp_recovery
+  # check short-circuits on AUTOCONFIRM=true, so nothing downstream said
+  # otherwise. Each branch here writes the flag its own decision implies.
+  # (codex on PR #1152)
+  set_env_var GOTRUE_MAILER_AUTOCONFIRM "false"
+  info "SMTP configured ($SMTP_HOST) — email verification and password reset will send."
+elif [[ -n "$(get_env_var SMTP_HOST)" ]]; then
+  # A RE-RUN IS NOT A FRESH INSTALL. This script is documented as re-runnable —
+  # the customer guide's own tunnel-token retry re-invokes it — and demanding
+  # the email flags again on every invocation made that retry fail on a stack
+  # that was already configured correctly. Judge the EFFECTIVE configuration in
+  # .env, not the flags of this particular run. (codex on PR #1152)
+  info "SMTP already configured in .env ($(get_env_var SMTP_HOST)) — keeping it."
+  if [[ "$(get_env_var GOTRUE_MAILER_AUTOCONFIRM)" == "true" ]]; then
+    # No decision was made THIS run, so this is reported, not silently flipped:
+    # SMTP + AUTOCONFIRM=true can be deliberate on an invite-only stack.
+    warn "...but GOTRUE_MAILER_AUTOCONFIRM=true, so accounts are auto-confirmed"
+    warn "WITHOUT verifying the mailbox. Re-run with --smtp-host to enforce"
+    warn "verification, or set GOTRUE_MAILER_AUTOCONFIRM=false in .env."
+  fi
+elif [[ "$(get_env_var GOTRUE_MAILER_AUTOCONFIRM)" == "true" ]]; then
+  warn "Email flows already DISABLED in .env (GOTRUE_MAILER_AUTOCONFIRM=true) — keeping that choice."
+  warn "Sign-ups are auto-confirmed and there is NO password-reset email."
+else
+  err "No email delivery configured. A stack with SMTP_HOST empty and"
+  err "GOTRUE_MAILER_AUTOCONFIRM=false cannot send password-reset or"
+  err "email-verification messages, and the deploy gate refuses it."
+  err ""
+  err "Either supply SMTP credentials:"
+  err "  --smtp-host smtp.example.com --smtp-port 587 --smtp-user <user> --smtp-pass <pass>"
+  err "or run without email flows (sign-ups auto-confirmed, no password reset):"
+  err "  --no-email"
+  exit 1
+fi
+
 # Step 2b: Host-access consent for the monitor agent.
 #
 # exe-monitor-agent reports fleet health to the monitoring hub, but to do so it
@@ -235,7 +428,7 @@ fi
 
 if [[ -n "$EXE_CLI" ]]; then
   info "Step 4+5: Deploying via '$EXE_CLI stack-update' (preflight + proxy auth + health-gated rollout + rollback)..."
-  if ! "$EXE_CLI" stack-update --yes; then
+  if ! "$EXE_CLI" stack-update --yes --domain "$DOMAIN" --admin-email "$ADMIN_EMAIL"; then
     err "stack-update failed — the gated deploy refused or rolled back. Review the"
     err "output above. Do NOT bypass with raw 'docker compose up' — fix the cause"
     err "(preflight RED, image pull, or health failure) and re-run setup.sh."
@@ -249,7 +442,7 @@ else
   err ""
   err "Install the CLI and re-run setup.sh:"
   err "  npm install -g exe-os"
-  err "  ./setup.sh --client $CLIENT --domain $DOMAIN${LICENSE:+ --license $LICENSE}"
+  err "  ./setup.sh --client $CLIENT --domain $DOMAIN --admin-email $ADMIN_EMAIL${LICENSE:+ --license $LICENSE}"
   exit 1
 fi
 
@@ -259,7 +452,12 @@ docker ps --format 'table {{.Names}}\t{{.Status}}'
 echo ""
 info "Stack deployed! Next steps:"
 echo "  1. Configure Cloudflare tunnel (if not done)"
-echo "  2. Open https://crm.${DOMAIN} to create admin account"
+# bug cff0de47: this used to say "to create admin account". GoTrue signup is OFF
+# by default (invite-only), so there is no account to create in the CRM UI — the
+# admin is SEEDED from EXE_CRM_ADMIN_EMAIL and must also be created in GoTrue.
+echo "  2. Create the GoTrue user for ${ADMIN_EMAIL} (signup is DISABLED by default —"
+echo "     see CUSTOMER-GUIDE.md 'Create Your Admin Account'), then sign in at"
+echo "     https://crm.${DOMAIN}"
 echo "  3. Open https://wiki.${DOMAIN} to set up wiki"
 echo "  4. Configure WhatsApp: edit gateway.json, restart gateway, pair at https://gateway.${DOMAIN}/pair/<name>"
 echo "  5. Verify: curl https://crm.${DOMAIN}/healthz && curl https://wiki.${DOMAIN}/api/ping"

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-09T09:12:16.097Z",
-  "manifest_sha256": "c3ae50f3aee170892131cbd9cd4bf821b1a20be63261b2ff9081b3a763993c6b",
-  "package_version": "0.9.383"
+  "verified_at": "2026-09-10T04:33:27.784Z",
+  "manifest_sha256": "bc5eed1f8fc614320e0c43011f62df3b11fb4e6c07324618a1eaa44feaa4d45c",
+  "package_version": "0.9.384"
 }

package/dist/{active-agent-LFY5P5EX.js → active-agent-F5V4E4UL.js}

@@ -8,18 +8,18 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-4KNZKUDK.js";
+} from "./chunk-F4BBMIPG.js";
 import "./chunk-MUCNYSJP.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-ZVPVLYBG.js";
+import "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FPAPXMJA.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-MMS2HBRT.js";

package/dist/{active-agent-BV4OE3GI.js → active-agent-YTBB4ZQM.js}

@@ -7,18 +7,18 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-4KNZKUDK.js";
+} from "./chunk-F4BBMIPG.js";
 import "./chunk-MUCNYSJP.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-ZVPVLYBG.js";
+import "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FPAPXMJA.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-MMS2HBRT.js";

package/dist/{agent-defs-generator-IC2DVSI4.js → agent-defs-generator-7TFISIJQ.js}

@@ -5,14 +5,14 @@ import "./chunk-AM7S2TY6.js";
 import {
   loadEmployeesSync,
   validateEmployeeName
-} from "./chunk-ZVPVLYBG.js";
+} from "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FPAPXMJA.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-WNBZJSQT.js";

package/dist/{agent-loop-GSUZJZBJ.js → agent-loop-EZ7LDAGD.js}

@@ -1,6 +1,6 @@
 import {
   agentLoop
-} from "./chunk-DZ3VKZ3C.js";
+} from "./chunk-TKS5GMYA.js";
 import "./chunk-JRLNE3T2.js";
 import "./chunk-2O2UKMUE.js";
 import "./chunk-HF25XPZE.js";

package/dist/{agentic-ontology-V3PFEFVZ.js → agentic-ontology-XVTUVV7W.js}

@@ -10,7 +10,7 @@ import {
   insertOntologyForMemory,
   ontologyPayload,
   stableId
-} from "./chunk-7C33VMAN.js";
+} from "./chunk-JRIH6I7D.js";
 import "./chunk-MLKGABMK.js";
 export {
   ONTOLOGY_YIELD_EVERY,

package/dist/{artifact-backup-EXBY3YQS.js → artifact-backup-TF6YWQT2.js}

@@ -7,10 +7,10 @@ import {
 import {
   artifactObjectId,
   encryptSyncBlob
-} from "./chunk-PJ2ZJUM2.js";
+} from "./chunk-ZPP63JSQ.js";
 import "./chunk-TWMWHDOY.js";
-import "./chunk-AYOCLUGP.js";
-import "./chunk-CZKDWW76.js";
+import "./chunk-4AR5XKCH.js";
+import "./chunk-5U2IJBFV.js";
 import {
   EXE_AI_DIR,
   loadConfigSync

package/dist/{backfill-metadata-NTCC7EMS.js → backfill-metadata-J6MXIDCW.js}

@@ -2,30 +2,30 @@
 import {
   disposeStore,
   initStore
-} from "./chunk-53YKDX7M.js";
-import "./chunk-XTREZV4R.js";
+} from "./chunk-UOPCVFVR.js";
+import "./chunk-AWWDKF22.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-BEIYEBTU.js";
+import "./chunk-VHHX4UCP.js";
 import "./chunk-5MOYSU5A.js";
-import "./chunk-RJXOPNXY.js";
+import "./chunk-ELEGH4DX.js";
 import "./chunk-76CJBM36.js";
 import "./chunk-MP2AFCGL.js";
 import {
   getClient,
   getEmployeeNamesByRole,
   loadEmployeesSync
-} from "./chunk-ZVPVLYBG.js";
+} from "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FPAPXMJA.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-CZKDWW76.js";
+import "./chunk-5U2IJBFV.js";
 import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
 import {

package/dist/{backup-verify-D3RU5JXC.js → backup-verify-6DVBQMDP.js}

@@ -4,7 +4,7 @@ import {
 import {
   getLatestBackup,
   reasonFromBackupName
-} from "./chunk-FPAPXMJA.js";
+} from "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";

package/dist/{behavior-injection-GWRLUR34.js → behavior-injection-XDA7ZCYN.js}

@@ -19,20 +19,20 @@ import {
   selectInjectedBehaviors,
   selectRelevantBehaviors,
   selectRelevantBehaviorsWithReasons
-} from "./chunk-642NFHVO.js";
-import "./chunk-Q5O2ER4U.js";
-import "./chunk-L2PBBNKH.js";
+} from "./chunk-4AAMFWJT.js";
+import "./chunk-S26CV7BE.js";
+import "./chunk-EIOGV75A.js";
 import "./chunk-QGGH7LOU.js";
-import "./chunk-53YKDX7M.js";
-import "./chunk-XTREZV4R.js";
+import "./chunk-UOPCVFVR.js";
+import "./chunk-AWWDKF22.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-BEIYEBTU.js";
+import "./chunk-VHHX4UCP.js";
 import "./chunk-5MOYSU5A.js";
-import "./chunk-RJXOPNXY.js";
+import "./chunk-ELEGH4DX.js";
 import "./chunk-76CJBM36.js";
-import "./chunk-S3G7LJDK.js";
-import "./chunk-4JF42BVF.js";
+import "./chunk-VJEJ7JNB.js";
+import "./chunk-MFAOAIUE.js";
 import "./chunk-PCV52RYM.js";
 import "./chunk-BTSWFMEH.js";
 import "./chunk-CIPDQRFO.js";
@@ -41,17 +41,18 @@ import "./chunk-IMYGYIAI.js";
 import "./chunk-3DAEZILW.js";
 import "./chunk-DRTJCG6B.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-ZVPVLYBG.js";
+import "./chunk-YRUZK2QA.js";
+import "./chunk-GL47M7NY.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-FPAPXMJA.js";
+import "./chunk-72V3S44T.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
-import "./chunk-CL4J4757.js";
+import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-CZKDWW76.js";
+import "./chunk-5U2IJBFV.js";
 import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
 import "./chunk-MMS2HBRT.js";