@askexenow/exe-os 0.9.384 → 0.9.389

package/dist/{chunk-ZBPZDADW.js → chunk-UWVXQEQQ.js}

@@ -6,7 +6,7 @@ import {
   deployStalenessAlertPath,
   evaluateDeployStaleness,
   writeDeployStalenessAlert
-} from "./chunk-C5HUMAA7.js";
+} from "./chunk-B7WVYLAQ.js";
 import {
   REVISION_LABEL,
   VERSION_LABEL,
@@ -15,13 +15,13 @@ import {
 } from "./chunk-L25OAFOU.js";
 import {
   declaredArtifactsFromManifest
-} from "./chunk-LFUBEHFW.js";
+} from "./chunk-RT57D7C4.js";
 import {
   loadLicense
-} from "./chunk-TNS63ATU.js";
+} from "./chunk-FWRPDSO3.js";
 
 // src/lib/stack-update.ts
-import { execFileSync, spawnSync } from "child_process";
+import { execFileSync, spawnSync as spawnSync2 } from "child_process";
 import { createVerify, randomBytes, verify as verifySignature } from "crypto";
 import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
 import http from "http";
@@ -119,6 +119,240 @@ ${remedy}
   return gaps;
 }
 
+// src/lib/stack-lock-derive.ts
+import { spawnSync } from "child_process";
+var GIT_SHA_LABEL = "org.exe.git_sha";
+var GIT_REF_LABEL = "org.exe.git_ref";
+function normalizeProbeResult(observed) {
+  if (observed === null) return null;
+  if (Array.isArray(observed)) return { containers: observed, uninspectable: [] };
+  return { containers: observed.containers ?? [], uninspectable: observed.uninspectable ?? [] };
+}
+function deriveStackLockFromContainers(lock, observed, now = () => /* @__PURE__ */ new Date()) {
+  const base = { ...lock ?? {} };
+  const services = { ...lock?.services ?? {} };
+  const probed = normalizeProbeResult(observed);
+  if (probed === null) {
+    return {
+      lock: base,
+      observations: [],
+      drifted: [],
+      unobserved: Object.keys(services),
+      uninspectable: [],
+      unobservable: true,
+      incomplete: true
+    };
+  }
+  const unreadable = new Set(probed.uninspectable.map((s) => s.trim()).filter(Boolean));
+  const byComposeService = /* @__PURE__ */ new Map();
+  for (const container of probed.containers) {
+    const key = container.composeService.trim();
+    if (!key) continue;
+    const existing = byComposeService.get(key);
+    if (existing) existing.push(container);
+    else byComposeService.set(key, [container]);
+  }
+  const at = now().toISOString();
+  const observations = [];
+  const unobserved = [];
+  const uninspectable = [];
+  const claimedUninspectable = /* @__PURE__ */ new Set();
+  const lockComposeServices = new Set(
+    Object.entries(services).map(
+      ([name, entry]) => (entry.composeService ?? name).trim() || name
+    )
+  );
+  for (const [serviceName, entry] of Object.entries(services)) {
+    const composeService = (entry.composeService ?? serviceName).trim() || serviceName;
+    if (unreadable.has(composeService)) {
+      uninspectable.push(serviceName);
+      claimedUninspectable.add(composeService);
+      continue;
+    }
+    const replicas = byComposeService.get(composeService) ?? [];
+    const container = replicas[0];
+    if (!container) {
+      unobserved.push(serviceName);
+      continue;
+    }
+    const recordedImage = typeof entry.image === "string" ? entry.image : void 0;
+    const recordedGitSha = typeof entry.gitSha === "string" ? entry.gitSha : void 0;
+    const observedGitSha = container.gitSha?.trim() || void 0;
+    const imageDrifted = normalizeImage(recordedImage) !== normalizeImage(container.image) || Boolean(entry.imageId && container.imageId && entry.imageId !== container.imageId);
+    const shaDrifted = observedGitSha !== void 0 && (recordedGitSha ?? "").toLowerCase() !== observedGitSha.toLowerCase();
+    const derived = {
+      ...entry,
+      image: container.image,
+      observedAt: at,
+      imageId: container.imageId
+    };
+    if (observedGitSha) {
+      derived.gitSha = observedGitSha;
+      derived.provenance = "container-label";
+    } else {
+      derived.provenance = "container-image";
+      if (imageDrifted) {
+        delete derived.gitSha;
+        derived.gitShaUnknown = true;
+      }
+    }
+    if (container.gitRef?.trim()) derived.gitRef = container.gitRef.trim();
+    else if (imageDrifted) delete derived.gitRef;
+    const staleContainers = [
+      ...replicas.slice(1),
+      ...probed.containers.filter(
+        (c) => isSidecarOf(composeService, c.composeService.trim()) && !lockComposeServices.has(c.composeService.trim())
+      )
+    ].filter((c) => c !== container && runsSomethingElse(container, c)).map((c) => ({
+      composeService: c.composeService.trim(),
+      image: c.image,
+      ...c.imageId ? { imageId: c.imageId } : {},
+      gitSha: c.gitSha?.trim() || void 0
+    }));
+    if (staleContainers.length > 0) {
+      derived.staleContainers = staleContainers;
+      derived.inconsistent = true;
+    } else {
+      delete derived.staleContainers;
+      delete derived.inconsistent;
+    }
+    services[serviceName] = derived;
+    observations.push({
+      service: serviceName,
+      composeService,
+      recordedImage,
+      recordedGitSha,
+      observedImage: container.image,
+      observedGitSha,
+      observedGitRef: container.gitRef?.trim() || void 0,
+      ...staleContainers.length > 0 ? { staleContainers } : {},
+      drifted: imageDrifted || shaDrifted || staleContainers.length > 0
+    });
+  }
+  for (const composeService of unreadable) {
+    if (!claimedUninspectable.has(composeService)) uninspectable.push(composeService);
+  }
+  const inconsistent = observations.filter((o) => o.staleContainers?.length).map((o) => o.service);
+  const incomplete = uninspectable.length > 0 || unobserved.length > 0 || observations.length === 0 || inconsistent.length > 0;
+  base.services = services;
+  base.derivedAt = at;
+  base.derivedFrom = "container-labels";
+  if (incomplete) base.derivationUnverified = [...uninspectable, ...unobserved, ...inconsistent];
+  else delete base.derivationUnverified;
+  return {
+    lock: base,
+    observations,
+    drifted: observations.filter((o) => o.drifted),
+    unobserved,
+    uninspectable,
+    unobservable: false,
+    incomplete
+  };
+}
+function formatStackLockDrift(drifted) {
+  return drifted.map((d) => {
+    const was = `${d.recordedImage ?? "(none)"}${d.recordedGitSha ? ` / ${d.recordedGitSha.slice(0, 12)}` : ""}`;
+    const is = `${d.observedImage}${d.observedGitSha ? ` / ${d.observedGitSha.slice(0, 12)}` : ""}`;
+    const siblings = (d.staleContainers ?? []).map((c) => `
+      also running: ${c.composeService} -> ${c.image}${c.gitSha ? ` / ${c.gitSha.slice(0, 12)}` : ""}`).join("");
+    return `  - ${d.service} (${d.composeService}): lock recorded ${was}; container is running ${is}${siblings}`;
+  }).join("\n");
+}
+function isSidecarOf(composeService, candidate) {
+  if (!composeService || !candidate || candidate === composeService) return false;
+  return candidate.startsWith(`${composeService}-`) || candidate.startsWith(`${composeService}_`);
+}
+function imageRepo(image) {
+  const trimmed = image.trim();
+  const at = trimmed.lastIndexOf("@");
+  const base = at === -1 ? trimmed : trimmed.slice(0, at);
+  const slash = base.lastIndexOf("/");
+  const colon = base.lastIndexOf(":");
+  return colon > slash ? base.slice(0, colon) : base;
+}
+function runsSomethingElse(primary, sidecar) {
+  if ((primary.composeService.trim() === sidecar.composeService.trim() || imageRepo(primary.image) === imageRepo(sidecar.image)) && primary.imageId && sidecar.imageId && primary.imageId !== sidecar.imageId) return true;
+  if ((primary.composeService.trim() === sidecar.composeService.trim() || imageRepo(primary.image) === imageRepo(sidecar.image)) && normalizeImage(primary.image) !== normalizeImage(sidecar.image)) return true;
+  const primarySha = primary.gitSha?.trim().toLowerCase();
+  const sidecarSha = sidecar.gitSha?.trim().toLowerCase();
+  if (primarySha && sidecarSha) return primarySha !== sidecarSha;
+  if (imageRepo(primary.image) !== imageRepo(sidecar.image)) return false;
+  return normalizeImage(primary.image) !== normalizeImage(sidecar.image);
+}
+function normalizeImage(image) {
+  if (!image) return "";
+  const trimmed = image.trim();
+  const at = trimmed.lastIndexOf("@");
+  return at === -1 ? trimmed : trimmed.slice(at + 1);
+}
+var defaultContainerProvenanceProbe = (composeArgs) => {
+  const ps = spawnSync("docker", [...composeArgs, "ps", "--format", "json"], { encoding: "utf8" });
+  if (ps.status !== 0 || typeof ps.stdout !== "string") return null;
+  const records = parseComposePsRecords(ps.stdout);
+  if (records.length === 0) return null;
+  const containers = [];
+  const uninspectable = [];
+  for (const { service, name } of records) {
+    const inspect = spawnSync("docker", ["inspect", name, "--format", '{"Config":{{json .Config}},"Image":{{json .Image}}}'], { encoding: "utf8" });
+    if (inspect.status !== 0 || typeof inspect.stdout !== "string") {
+      uninspectable.push(service);
+      continue;
+    }
+    let inspected;
+    try {
+      inspected = JSON.parse(inspect.stdout.trim());
+    } catch {
+      uninspectable.push(service);
+      continue;
+    }
+    const config = inspected?.Config ?? {};
+    const imageId = typeof inspected?.Image === "string" ? inspected.Image : "";
+    const image = typeof config.Image === "string" ? config.Image : "";
+    if (!image || !imageId) {
+      uninspectable.push(service);
+      continue;
+    }
+    const labels = config.Labels ?? {};
+    containers.push({
+      composeService: service,
+      image,
+      imageId,
+      gitSha: typeof labels[GIT_SHA_LABEL] === "string" ? labels[GIT_SHA_LABEL] : void 0,
+      gitRef: typeof labels[GIT_REF_LABEL] === "string" ? labels[GIT_REF_LABEL] : void 0
+    });
+  }
+  return { containers, uninspectable };
+};
+function parseComposePsRecords(stdout) {
+  const trimmed = stdout.trim().replace(/^/, "");
+  if (!trimmed) return [];
+  const records = [];
+  if (trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (Array.isArray(parsed)) records.push(...parsed);
+    } catch {
+    }
+  }
+  if (records.length === 0) {
+    for (const line of trimmed.split("\n")) {
+      const l = line.trim();
+      if (!l) continue;
+      try {
+        records.push(JSON.parse(l));
+      } catch {
+      }
+    }
+  }
+  const out = [];
+  for (const obj of records) {
+    const service = String(obj.Service ?? "").trim();
+    const name = String(obj.Name ?? "").trim();
+    if (service && name) out.push({ service, name });
+  }
+  return out;
+}
+
 // src/lib/stack-update.ts
 var SLOW_SERVICE_HEALTH_DEFAULTS = {
   // Frappe `bench migrate` on every boot can take well over the 180s default.
@@ -862,6 +1096,7 @@ async function rollbackStackUpdate(options) {
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
   }
+  reconcileDeployRecordNonFatal("a rollback", lockFilePath, composeArgs, () => /* @__PURE__ */ new Date());
   console.log("[stack-update] Rollback complete.");
   return { status: "rolled_back", targetVersion: "previous", changes: [], backupEnvFile: rollbackEnv, lockFile: lockFilePath, serviceStatus: lockData?.serviceStatus };
 }
@@ -908,7 +1143,7 @@ function isExecFormMigration(migrationCommand) {
 }
 function isComposeServiceRunning(composeArgs, composeServiceName) {
   try {
-    const result = spawnSync("docker", [...composeArgs, "ps", "--quiet", composeServiceName], {
+    const result = spawnSync2("docker", [...composeArgs, "ps", "--quiet", composeServiceName], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 1e4
@@ -978,6 +1213,72 @@ function writeStackUpdateLock(lockFile, data) {
   writeFileSync(lockFile, JSON.stringify(data, null, 2) + "\n", { mode: 420 });
   chmodSync(lockFile, 420);
 }
+function reconcileStackLockFromContainers(lockFile, composeArgs, options = {}) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const probe = options.probe ?? defaultContainerProvenanceProbe;
+  const lock = readStackUpdateLock(lockFile);
+  if (!lock) {
+    return { drifted: [], unobserved: [], uninspectable: [], observed: 0, incomplete: true, unobservable: true, written: false };
+  }
+  let observed;
+  try {
+    observed = probe(composeArgs);
+  } catch {
+    observed = null;
+  }
+  const derivation = deriveStackLockFromContainers(lock, observed, now);
+  if (derivation.unobservable) {
+    console.warn(
+      `[stack-update] \u26A0 Could not observe the running containers, so ${path.basename(lockFile)} was NOT derived. It still reports whatever was last written to it \u2014 treat it as unverified.`
+    );
+    return {
+      drifted: [],
+      unobserved: derivation.unobserved,
+      uninspectable: [],
+      observed: 0,
+      incomplete: true,
+      unobservable: true,
+      written: false
+    };
+  }
+  if (derivation.drifted.length > 0) {
+    console.warn(
+      `[stack-update] \u26A0 Deploy record drift (bug 32920edc): ${derivation.drifted.length} service(s) were delivered by a route that never updated ${path.basename(lockFile)}:
+${formatStackLockDrift(derivation.drifted)}`
+    );
+  }
+  if (derivation.incomplete) {
+    const inconsistent = derivation.observations.filter((o) => o.staleContainers?.length).map((o) => o.service);
+    console.warn(
+      `[stack-update] \u26A0 ${path.basename(lockFile)} derivation is INCOMPLETE (${derivation.observations.length} service(s) observed` + (derivation.uninspectable.length > 0 ? `; could not read: ${derivation.uninspectable.join(", ")}` : "") + (derivation.unobserved.length > 0 ? `; no running container: ${derivation.unobserved.join(", ")}` : "") + (inconsistent.length > 0 ? `; inconsistent containers: ${inconsistent.join(", ")}` : "") + `). Those entries are UNVERIFIED; observed conflicts remain in the record.`
+    );
+  }
+  const result = {
+    drifted: derivation.drifted,
+    unobserved: derivation.unobserved,
+    uninspectable: derivation.uninspectable,
+    observed: derivation.observations.length,
+    incomplete: derivation.incomplete,
+    unobservable: false,
+    written: false
+  };
+  if (options.dryRun) return result;
+  writeStackUpdateLock(lockFile, derivation.lock);
+  return { ...result, written: true };
+}
+function reconcileDeployRecordNonFatal(stage, lockFile, composeArgs, now) {
+  try {
+    const result = reconcileStackLockFromContainers(lockFile, composeArgs, { now });
+    if (result.unobservable || result.incomplete) {
+      console.warn(
+        `[stack-update] \u26A0 Deploy record after ${stage} is NOT fully verified (${result.observed} service(s) read from containers). Treat ${path.basename(lockFile)} as partial evidence.`
+      );
+    }
+  } catch (deriveErr) {
+    const reason = deriveErr instanceof Error ? deriveErr.message : String(deriveErr);
+    console.warn(`[stack-update] \u26A0 Deploy-record derivation failed after ${stage} (non-fatal): ${reason}`);
+  }
+}
 function composeOverrideFileFor(composeFile) {
   return path.join(path.dirname(composeFile), "docker-compose.override.yml");
 }
@@ -1568,7 +1869,7 @@ function collectImageAvailabilityIssues(plan) {
     let inspectOutput = "";
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
       try {
-        const result = spawnSync("docker", ["manifest", "inspect", manifestInspectRef(image), "--verbose"], {
+        const result = spawnSync2("docker", ["manifest", "inspect", manifestInspectRef(image), "--verbose"], {
           stdio: ["ignore", "pipe", "pipe"],
           timeout: 3e4
         });
@@ -1583,7 +1884,7 @@ function collectImageAvailabilityIssues(plan) {
           console.log(
             `[stack-update] Image ${image} not yet available on proxy (attempt ${attempt}/${maxAttempts}), retrying in ${delayMs / 1e3}s\u2026 (bug d11c9809)`
           );
-          spawnSync("sleep", [String(delayMs / 1e3)], { stdio: "ignore" });
+          spawnSync2("sleep", [String(delayMs / 1e3)], { stdio: "ignore" });
         }
       } catch {
         inspected = true;
@@ -1888,41 +2189,21 @@ async function resolveStackImageCredentials(options, release) {
   }
   return null;
 }
-async function verifyManifestImagesAvailable(plan, options) {
-  const exec = options.exec ?? defaultExec;
-  const images = manifestImagesForPull(plan.release);
-  const maxAttempts = Math.max(1, Math.floor(options.verifyImageMaxAttempts ?? 3));
-  const baseDelayMs = Math.max(0, Math.floor(options.verifyImageRetryBaseDelayMs ?? 1e3));
+async function withStackImageCredentials(plan, options, verify) {
   let registryForLogout;
-  const creds = await resolveStackImageCredentials(options, plan.release);
-  if (creds) {
-    (options.dockerLogin ?? defaultDockerLogin)(creds);
-    registryForLogout = creds.registry;
-  }
   try {
-    const results = [];
-    for (const image of images) {
-      let lastError = "";
-      let ok = false;
-      for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-        try {
-          exec("docker", ["manifest", "inspect", manifestInspectRef(image)]);
-          ok = true;
-          break;
-        } catch (err) {
-          lastError = err instanceof Error ? err.message : String(err);
-          if (attempt < maxAttempts) {
-            const delayMs = baseDelayMs * Math.pow(2, attempt - 1);
-            console.warn(
-              `[stack-update] manifest inspect failed for ${image} (attempt ${attempt}/${maxAttempts}): ${lastError}. Retrying in ${delayMs}ms.`
-            );
-            if (delayMs > 0) await new Promise((resolve) => setTimeout(resolve, delayMs));
-          }
-        }
-      }
-      results.push(ok ? { image, ok: true } : { image, ok: false, error: `manifest inspect failed after ${maxAttempts} attempt(s): ${lastError}` });
+    const creds = await resolveStackImageCredentials(options, plan.release);
+    if (creds) {
+      (options.dockerLogin ?? defaultDockerLogin)(creds);
+      registryForLogout = creds.registry;
     }
-    return results;
+  } catch (err) {
+    throw new Error(
+      `Pre-deploy registry authentication check failed before any production service was changed. Aborting stack update for service(s) ${allServiceList(plan.release)}: ${errorMessage(err)}`
+    );
+  }
+  try {
+    return await verify();
   } finally {
     if (registryForLogout) {
       try {
@@ -1932,6 +2213,38 @@ async function verifyManifestImagesAvailable(plan, options) {
     }
   }
 }
+async function inspectManifestImagesAvailable(plan, options) {
+  const exec = options.exec ?? defaultExec;
+  const images = manifestImagesForPull(plan.release);
+  const maxAttempts = Math.max(1, Math.floor(options.verifyImageMaxAttempts ?? 3));
+  const baseDelayMs = Math.max(0, Math.floor(options.verifyImageRetryBaseDelayMs ?? 1e3));
+  const results = [];
+  for (const image of images) {
+    let lastError = "";
+    let ok = false;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      try {
+        exec("docker", ["manifest", "inspect", manifestInspectRef(image)]);
+        ok = true;
+        break;
+      } catch (err) {
+        lastError = err instanceof Error ? err.message : String(err);
+        if (attempt < maxAttempts) {
+          const delayMs = baseDelayMs * Math.pow(2, attempt - 1);
+          console.warn(
+            `[stack-update] manifest inspect failed for ${image} (attempt ${attempt}/${maxAttempts}): ${lastError}. Retrying in ${delayMs}ms.`
+          );
+          if (delayMs > 0) await new Promise((resolve) => setTimeout(resolve, delayMs));
+        }
+      }
+    }
+    results.push(ok ? { image, ok: true } : { image, ok: false, error: `manifest inspect failed after ${maxAttempts} attempt(s): ${lastError}` });
+  }
+  return results;
+}
+async function verifyManifestImagesAvailable(plan, options) {
+  return withStackImageCredentials(plan, options, () => inspectManifestImagesAvailable(plan, options));
+}
 function servicesForPullImage(release, image) {
   return Object.entries(release.services).filter(([, service]) => imagePullRef(service.image) === image).map(([serviceName, service]) => {
     const composeService = service.composeService ?? serviceName;
@@ -1962,7 +2275,7 @@ function readStagedComposeTemplate(options, currentComposeRaw) {
 async function assertPreDeployImagesPullable(plan, options) {
   let results;
   try {
-    results = await verifyManifestImagesAvailable(plan, options);
+    results = await inspectManifestImagesAvailable(plan, options);
   } catch (err) {
     throw new Error(
       `Pre-deploy registry authentication check failed before any production service was changed. Aborting stack update for service(s) ${allServiceList(plan.release)}: ${errorMessage(err)}`
@@ -1980,8 +2293,21 @@ ${details}
 Fix registry authentication or publish the missing image(s), then re-run stack-update.`
   );
 }
+async function verifyPreDeployImages(plan, options) {
+  await withStackImageCredentials(plan, options, async () => {
+    console.log("[stack-update] Pre-deploy image auth/pullability check started");
+    await assertPreDeployImagesPullable(plan, options);
+    console.log("[stack-update] \u2713 Pre-deploy image auth/pullability check passed");
+    console.log("[stack-update] Deploy-time image-provenance check (G4) started");
+    assertImageProvenance(plan, options);
+    console.log("[stack-update] \u2713 Deploy-time image-provenance check (G4) passed");
+    console.log("[stack-update] Deploy-time image version-label check (G4b) started");
+    assertImageVersionLabels(plan, options);
+    console.log("[stack-update] \u2713 Deploy-time image version-label check (G4b) passed");
+  });
+}
 var defaultContainerCountSnapshot = () => {
-  const snapshot = spawnSync("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
+  const snapshot = spawnSync2("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
   return snapshot.stdout?.split("\n").filter(Boolean).length ?? 0;
 };
 var defaultImageLabelReader = (image, label) => {
@@ -2097,7 +2423,7 @@ A first-party image whose version label does not match its tag cannot be traced
 }
 var PROBE_TIMEOUT_MS = 1e4;
 function commandSucceeds(cmd, args = []) {
-  const res = spawnSync(cmd, args, {
+  const res = spawnSync2(cmd, args, {
     stdio: "ignore",
     timeout: PROBE_TIMEOUT_MS,
     killSignal: "SIGKILL"
@@ -2105,7 +2431,7 @@ function commandSucceeds(cmd, args = []) {
   return res.status === 0;
 }
 function shellSucceeds(command) {
-  const res = spawnSync("sh", ["-lc", command], {
+  const res = spawnSync2("sh", ["-lc", command], {
     stdio: "ignore",
     timeout: PROBE_TIMEOUT_MS,
     killSignal: "SIGKILL"
@@ -2536,7 +2862,7 @@ function hardenHost(exec) {
   return result;
 }
 function hardenUfw(exec, result) {
-  const whichUfw = spawnSync("which", ["ufw"], { stdio: ["pipe", "pipe", "pipe"], timeout: 5e3 });
+  const whichUfw = spawnSync2("which", ["ufw"], { stdio: ["pipe", "pipe", "pipe"], timeout: 5e3 });
   const ufwInstalled = whichUfw.status === 0;
   if (!ufwInstalled) {
     if (!existsSync("/etc/os-release")) {
@@ -2561,7 +2887,7 @@ function hardenUfw(exec, result) {
       return;
     }
   }
-  const statusResult = spawnSync("ufw", ["status", "verbose"], {
+  const statusResult = spawnSync2("ufw", ["status", "verbose"], {
     encoding: "utf8",
     stdio: ["pipe", "pipe", "pipe"],
     timeout: 1e4
@@ -2713,7 +3039,7 @@ function hardenSsh(exec, result) {
 }
 function areStackContainersRunning(composeFile, envFile) {
   try {
-    const result = spawnSync("docker", [...composeArgsForStack(composeFile, envFile), "ps", "-q"], {
+    const result = spawnSync2("docker", [...composeArgsForStack(composeFile, envFile), "ps", "-q"], {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 15e3
     });
@@ -2740,7 +3066,7 @@ var CRITICAL_VOLUMES = [
   "clickhouse_data",
   "erp_sites"
 ];
-var defaultVolumeExists = (volumeName) => spawnSync(
+var defaultVolumeExists = (volumeName) => spawnSync2(
   "docker",
   ["volume", "inspect", volumeName],
   {
@@ -3034,15 +3360,7 @@ ${lines.join("\n")}`
     return { status: "planned", targetVersion: plan.targetVersion, changes: plan.changes, lockFile };
   }
   if (!options.skipImageAvailabilityCheck) {
-    console.log("[stack-update] Pre-deploy image auth/pullability check started");
-    await assertPreDeployImagesPullable(plan, options);
-    console.log("[stack-update] \u2713 Pre-deploy image auth/pullability check passed");
-    console.log("[stack-update] Deploy-time image-provenance check (G4) started");
-    assertImageProvenance(plan, options);
-    console.log("[stack-update] \u2713 Deploy-time image-provenance check (G4) passed");
-    console.log("[stack-update] Deploy-time image version-label check (G4b) started");
-    assertImageVersionLabels(plan, options);
-    console.log("[stack-update] \u2713 Deploy-time image version-label check (G4b) passed");
+    await verifyPreDeployImages(plan, options);
   }
   await postDeployAudit(options, "started", plan.targetVersion, previousVersion);
   try {
@@ -3388,7 +3706,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       if (bundledIsolation && (failedComposeServices.has(service) || failedManifestServices.has(resolveOwningManifestService(service, plan.release.services)))) {
         continue;
       }
-      const serviceDefined = options.composeServiceExists ? options.composeServiceExists(service) : spawnSync("docker", [...composeArgs, "ps", "--quiet", service], {
+      const serviceDefined = options.composeServiceExists ? options.composeServiceExists(service) : spawnSync2("docker", [...composeArgs, "ps", "--quiet", service], {
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"],
         timeout: 1e4
@@ -3396,7 +3714,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       if (!serviceDefined) continue;
       progress.logServiceStep(restartIndex, service, "Restarting");
       if (service === "exe-wiki") {
-        const guard = options.runWikiSchemaGuard ? { status: options.runWikiSchemaGuard() } : spawnSync(
+        const guard = options.runWikiSchemaGuard ? { status: options.runWikiSchemaGuard() } : spawnSync2(
           "docker",
           [...composeArgs, "run", "--rm", "--no-deps", "exe-wiki-schema-guard"],
           { encoding: "utf8", stdio: ["pipe", "inherit", "inherit"], timeout: 12e4 }
@@ -3412,7 +3730,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       updateServiceStatus(lockFile, manifestServiceName, "restarted", now);
       const maxWait = resolveServiceHealthTimeout(service, plan.release, options.healthTimeoutSecs);
       const probeHealth = options.inspectContainerHealth ?? ((svc) => {
-        const inspectResult = spawnSync(
+        const inspectResult = spawnSync2(
           "docker",
           ["inspect", "--format", "{{.State.Health.Status}}", svc],
           { encoding: "utf8", timeout: 5e3 }
@@ -3567,6 +3885,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         preUpdateImageDefaults: partialLock.preUpdateImageDefaults ?? configBackup.preUpdateImageDefaults,
         services: { ...fullTargetPlan.release.services, ...partialLock.services ?? {}, ...plan.release.services }
       });
+      reconcileDeployRecordNonFatal("a partial update", lockFile, composeArgs, now);
       const partialStaleness = evaluateDeployStaleness(readStackUpdateLock(lockFile), now);
       if (partialStaleness) writeDeployStalenessAlert(partialStaleness);
       await postDeployAudit(
@@ -3672,6 +3991,7 @@ Fix these before the stack is safe to operate.`);
       preUpdateImageDefaults: finalLock.preUpdateImageDefaults ?? configBackup.preUpdateImageDefaults,
       services: { ...fullTargetPlan.release.services, ...finalLock.services ?? {}, ...plan.release.services }
     });
+    reconcileDeployRecordNonFatal("a successful update", lockFile, composeArgs, now);
     clearDeployStalenessAlert();
     await postDeployAudit(options, "success", plan.targetVersion, previousVersion, void 0, { changes: plan.changes.length });
     return { status: "updated", targetVersion: plan.targetVersion, changes: plan.changes, backupEnvFile, lockFile, serviceStatus: readStackUpdateLock(lockFile)?.serviceStatus };
@@ -3838,7 +4158,7 @@ async function verifyReleaseHealth(release, retries, delayMs, env, skipServices)
 var defaultComposePsCapture = (composeArgs) => {
   let result;
   try {
-    result = spawnSync("docker", [...composeArgs, "ps", "--all", "--format", "json"], {
+    result = spawnSync2("docker", [...composeArgs, "ps", "--all", "--format", "json"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 2e4
@@ -3907,29 +4227,38 @@ function snapshotComposeServiceStates(composeArgs, wantedServices, capture) {
   if (records.length === 0) return null;
   const byService = /* @__PURE__ */ new Map();
   for (const svc of wantedServices) {
-    byService.set(svc, { service: svc, state: "", health: "", restartCount: 0, missing: true });
+    byService.set(svc, { service: svc, state: "", health: "", restartCount: 0, exitCode: null, missing: true });
   }
   for (const obj of records) {
     const service = String(obj.Service ?? obj.Name ?? "");
     if (!service || !byService.has(service)) continue;
     const restartRaw = obj.RestartCount;
+    const exitRaw = obj.ExitCode;
     byService.set(service, {
       service,
       state: String(obj.State ?? "").toLowerCase(),
       health: String(obj.Health ?? "").toLowerCase(),
       restartCount: typeof restartRaw === "number" ? restartRaw : Number(restartRaw) || 0,
+      // Absent / unparsable stays null. Compose omits ExitCode on some versions
+      // and reports it as a string on others; only a real number is an answer.
+      exitCode: typeof exitRaw === "number" ? exitRaw : typeof exitRaw === "string" && exitRaw.trim() !== "" && Number.isFinite(Number(exitRaw)) ? Number(exitRaw) : null,
       missing: false
     });
   }
   return byService;
 }
-async function verifyComposeServicesRunning(composeArgs, wantedServices, timeoutSecs = 180, capture) {
+async function verifyComposeServicesRunning(composeArgs, wantedServices, timeoutSecs = 180, capture, oneShotServices, requireObservableState = false) {
   if (wantedServices.length === 0) return;
   const psCapture = capture ?? defaultComposePsCapture;
   const deadline = Date.now() + timeoutSecs * 1e3;
   for (; ; ) {
     const states = snapshotComposeServiceStates(composeArgs, wantedServices, psCapture);
     if (states === null) {
+      if (requireObservableState) {
+        throw new Error(
+          "Post-deploy health verification failed closed (Phase 3): container runtime state unavailable (docker compose ps returned nothing usable)"
+        );
+      }
       console.warn("[stack-update] Phase 3 skipped: container runtime state unavailable (docker compose ps returned nothing)");
       return;
     }
@@ -3941,6 +4270,21 @@ async function verifyComposeServicesRunning(composeArgs, wantedServices, timeout
         hardFailures.push(`${svc}: container missing (never created)`);
         continue;
       }
+      if (oneShotServices?.has(svc)) {
+        if (s.state === "exited") {
+          if (s.exitCode === 0) continue;
+          hardFailures.push(
+            s.exitCode === null ? `${svc}: one-shot container exited but compose reported no exit status, so completion could not be confirmed` : `${svc}: one-shot container failed (exit code ${s.exitCode})`
+          );
+          continue;
+        }
+        if (s.state === "dead") {
+          hardFailures.push(`${svc}: container dead`);
+          continue;
+        }
+        pending.push(`${svc}: one-shot still running (no exit status yet)`);
+        continue;
+      }
       if (s.state === "exited" || s.state === "dead") {
         hardFailures.push(`${svc}: container ${s.state} (restarts: ${s.restartCount})`);
         continue;
@@ -3981,7 +4325,7 @@ var INGRESS_PROBE_TIMEOUT_MS = 4e3;
 var defaultDockerCapture = (args) => {
   let result;
   try {
-    result = spawnSync("docker", args, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 2e4 });
+    result = spawnSync2("docker", args, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 2e4 });
   } catch (err) {
     return { unavailable: true, status: null, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
   }
@@ -4135,16 +4479,57 @@ async function defaultFetchText(ref, authToken) {
   if (!res.ok) throw new Error(`Failed to fetch ${ref}: HTTP ${res.status}`);
   return res.text();
 }
+function assertCredentialSafeAuditUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Refusing to post a deploy audit to an unparseable URL: ${url}`);
+  }
+  if (parsed.protocol === "https:") return;
+  const host = parsed.hostname.toLowerCase();
+  if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]") return;
+  throw new Error(
+    `Refusing to post a deploy audit over ${parsed.protocol}// to ${parsed.host}: the request carries the license key in its body and a bearer token in its headers, which plain HTTP exposes to anything on the network path. Use an https:// endpoint (the default is https://api.askexe.com), or point it at localhost.`
+  );
+}
+var MAX_AUDIT_REDIRECTS = 5;
 async function defaultPostJson(url, body, authToken) {
-  const res = await fetch(url, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      ...authToken ? { authorization: `Bearer ${authToken}` } : {}
-    },
-    body: JSON.stringify(body)
-  });
-  if (!res.ok) throw new Error(`Failed to POST ${url}: HTTP ${res.status}`);
+  const payload = JSON.stringify(body);
+  let target = url;
+  let originOrigin;
+  for (let hop = 0; ; hop++) {
+    assertCredentialSafeAuditUrl(target);
+    const targetOrigin = new URL(target).origin;
+    if (originOrigin === void 0) {
+      originOrigin = targetOrigin;
+    } else if (targetOrigin !== originOrigin) {
+      throw new Error(
+        `Refusing to follow a deploy-audit redirect from ${originOrigin} to ${targetOrigin}: this request carries the license key in its body and a bearer token in its Authorization header, and this loop re-attaches both to every hop itself, so the Fetch spec's cross-origin credential stripping never applies. A redirect to a different origin \u2014 even one that is independently https \u2014 is refused rather than forwarded with credentials attached.`
+      );
+    }
+    const res = await fetch(target, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...authToken ? { authorization: `Bearer ${authToken}` } : {}
+      },
+      body: payload,
+      redirect: "manual"
+    });
+    if (res.status < 300 || res.status > 399) {
+      if (!res.ok) throw new Error(`Failed to POST ${target}: HTTP ${res.status}`);
+      return;
+    }
+    if (hop >= MAX_AUDIT_REDIRECTS) {
+      throw new Error(`Failed to POST ${url}: more than ${MAX_AUDIT_REDIRECTS} redirects (last: ${target})`);
+    }
+    const location = res.headers.get("location");
+    if (!location) {
+      throw new Error(`Failed to POST ${target}: HTTP ${res.status} redirect with no Location header`);
+    }
+    target = new URL(location, target).toString();
+  }
 }
 function defaultStackPaths() {
   const cwdCompose = path.resolve("docker-compose.yml");
@@ -4201,7 +4586,7 @@ function parseComposeVolumeNames(composeRaw) {
   return names;
 }
 function volumeHasComposeProjectLabel(volumeName, projectName) {
-  const res = spawnSync(
+  const res = spawnSync2(
     "docker",
     ["volume", "inspect", volumeName, "--format", '{{ index .Labels "com.docker.compose.project" }}'],
     { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 1e4 }
@@ -4230,7 +4615,7 @@ function detectDanglingVolumes(scope) {
       byName.set(name, { name, driver: driver ?? "local", size: "" });
     }
   };
-  const labeled = spawnSync(
+  const labeled = spawnSync2(
     "docker",
     [
       "volume",
@@ -4245,7 +4630,7 @@ function detectDanglingVolumes(scope) {
     { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3e4 }
   );
   if (labeled.status === 0 && labeled.stdout?.trim()) ingest(labeled.stdout, false);
-  const all = spawnSync(
+  const all = spawnSync2(
     "docker",
     ["volume", "ls", "--filter", "dangling=true", "--format", "{{.Name}}	{{.Driver}}"],
     { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3e4 }
@@ -4260,14 +4645,14 @@ function detectDanglingVolumes(scope) {
 }
 function getVolumeSize(volumeName) {
   try {
-    const inspectResult = spawnSync(
+    const inspectResult = spawnSync2(
       "docker",
       ["volume", "inspect", volumeName, "--format", "{{.Mountpoint}}"],
       { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 1e4 }
     );
     const mountpoint = inspectResult.stdout?.trim();
     if (!mountpoint || inspectResult.status !== 0) return "unknown";
-    const duResult = spawnSync(
+    const duResult = spawnSync2(
       "du",
       ["-sh", mountpoint],
       { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 1e4 }
@@ -4296,7 +4681,7 @@ function removeDanglingVolumes(volumes, scope) {
       );
       continue;
     }
-    const checkResult = spawnSync(
+    const checkResult = spawnSync2(
       "docker",
       ["volume", "ls", "--filter", "dangling=true", "--filter", `name=^${vol.name}$`, "--format", "{{.Name}}"],
       { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 1e4 }
@@ -4403,6 +4788,7 @@ export {
   isExecFormMigration,
   expandComposeServicesWithSidecars,
   resolveOwningManifestService,
+  reconcileStackLockFromContainers,
   composeArgsForStack,
   parseStackManifest,
   loadStackManifest,
@@ -4444,6 +4830,7 @@ export {
   assertRolloutStageAllowed,
   assertBreakingChangesAllowed,
   verifyManifestImagesAvailable,
+  verifyPreDeployImages,
   collectImageProvenanceIssues,
   assertImageProvenance,
   collectImageVersionLabelIssues,
@@ -4473,6 +4860,8 @@ export {
   verifyIngressTargetsReachable,
   waitForHttpOk,
   httpStatus,
+  assertCredentialSafeAuditUrl,
+  defaultPostJson,
   defaultStackPaths,
   resolveComposeProjectName,
   parseComposeVolumeNames,