@askexenow/exe-os 0.9.393 → 0.9.394

package/deploy/stack-manifests/v0.9.json

@@ -5042,11 +5042,277 @@
         "composeSha256": "220b251375f372107e8d8d54a9c3e4ceab1f57aae80f4babf2933c3887532263",
         "composeOverrideSha256": "af295ca2f75b85788416e4df51cab86d8b773bf4cafe6cf6df9c7c26b9a42d6d"
       }
+    },
+    "0.9.54": {
+      "version": "0.9.54",
+      "releasedAt": "2026-09-23T22:31:53.000Z",
+      "npmVersion": "0.9.393",
+      "notes": "CRM DEMO routing canary from the applied Dashboard 0.9.53 baseline. Update only CRM web and worker to v0.9.67 with signed DEMO workspace routing; preserve Dashboard v0.9.392, Auth v0.6.10, and all other pins. Operator DEMO bootstrap remains a separate scoped step after image acceptance.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.67@sha256:56452b7df4361e157e4d727dd71c8ed3f1cffd4b345bbddecf651609c0de9b48",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "9127619259b7ba2ff8963fbf302827e3cf518ece",
+          "description": "Central authentication and recovery with server-validated shared sessions for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.37@sha256:8fa22e77c0742fbb690f7b4c8431a186692a20ebd335fb141782df4289dc337f",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "713a4370c2b641b8f8b07fd1e7390afa79a9c931"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.10@sha256:0260349962d087cd3c33fed1d362029416e82ae9cc60abca7969beac2cb8639f",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "29fe7015d90b80c94db3a1e3904852b934071711"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.17@sha256:ef61b59d94c04189fe2975045a3816d2fecc8efe3027e0ee8c17d0fa2efdbc3b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "a769ec5e0ae53bc5944715845869715ebbffd63a"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.392@sha256:d151441554c00e216084bd1caf2278e8c41fde188c039e0f167e158a511cbeec",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "e11b25ad567389440da8ed5e566a9c59bce24123"
+        }
+      },
+      "rolloutStage": "canary",
+      "config": {
+        "composeSha256": "220b251375f372107e8d8d54a9c3e4ceab1f57aae80f4babf2933c3887532263",
+        "composeOverrideSha256": "af295ca2f75b85788416e4df51cab86d8b773bf4cafe6cf6df9c7c26b9a42d6d"
+      }
+    },
+    "0.9.55": {
+      "version": "0.9.55",
+      "releasedAt": "2026-09-23T23:14:06.000Z",
+      "npmVersion": "0.9.394",
+      "notes": "CRM DEMO routing canary superseding unapplied stack 0.9.54. The scoped updater now validates, restarts, witnesses, and rolls back CRM web and worker together under the one signed CRM_IMAGE_TAG. From the applied Dashboard 0.9.53 baseline, update only CRM to v0.9.67; preserve Dashboard v0.9.392, Auth v0.6.10, and every other image pin. Operator DEMO bootstrap remains separate after image acceptance.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.67@sha256:56452b7df4361e157e4d727dd71c8ed3f1cffd4b345bbddecf651609c0de9b48",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "9127619259b7ba2ff8963fbf302827e3cf518ece",
+          "description": "Central authentication and recovery with server-validated shared sessions for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.37@sha256:8fa22e77c0742fbb690f7b4c8431a186692a20ebd335fb141782df4289dc337f",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "713a4370c2b641b8f8b07fd1e7390afa79a9c931"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.10@sha256:0260349962d087cd3c33fed1d362029416e82ae9cc60abca7969beac2cb8639f",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "29fe7015d90b80c94db3a1e3904852b934071711"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.17@sha256:ef61b59d94c04189fe2975045a3816d2fecc8efe3027e0ee8c17d0fa2efdbc3b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "a769ec5e0ae53bc5944715845869715ebbffd63a"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.392@sha256:d151441554c00e216084bd1caf2278e8c41fde188c039e0f167e158a511cbeec",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "e11b25ad567389440da8ed5e566a9c59bce24123"
+        }
+      },
+      "rolloutStage": "canary",
+      "config": {
+        "composeSha256": "220b251375f372107e8d8d54a9c3e4ceab1f57aae80f4babf2933c3887532263",
+        "composeOverrideSha256": "af295ca2f75b85788416e4df51cab86d8b773bf4cafe6cf6df9c7c26b9a42d6d"
+      }
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "sr79I2vY2ZVjMGGV/aGJp5i3sT3+nZX0urNqH7jw10Zu1yZNZa62y1973V6b2N5DKNwjE7aZHlQn5aF6nouBDg=="
+    "signature": "BTPhDNOLpsQWb4XWYhc4B76lw+lAa0+t6RP1wC9B5D/9NNvkFcRTPrrf56YxL2bjBgx1IMWaBi4eM5Fbv2WEDA=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-23T22:15:04.008Z",
-  "manifest_sha256": "c3c456977d8ec9e709146a39b984af444449c4bc1716922aa8323e33f06bdfa9",
-  "package_version": "0.9.393"
+  "verified_at": "2026-09-23T23:35:24.863Z",
+  "manifest_sha256": "6448e6d55002816a5c2c682844a5a0d84f5f006dc21386948f690951ae6ad15f",
+  "package_version": "0.9.394"
 }

package/dist/bin/cli.js

@@ -798,14 +798,14 @@ ${JSON.stringify(stormAlert, null, 2)}`);
   const { runStackUpdateCli } = await import("./stack-update.js");
   await runStackUpdateCli(args.slice(1));
 } else if (args[0] === "release") {
-  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-YEO6BFVR.js");
+  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-YCNRPK6R.js");
   const releaseFlags = parseReleaseArgs(args.slice(1));
   await runStackRelease(releaseFlags);
 } else if (args[0] === "stack-promote") {
-  const { runStackPromoteCli } = await import("../stack-promote-EAPCVGKJ.js");
+  const { runStackPromoteCli } = await import("../stack-promote-4EF7RNIV.js");
   await runStackPromoteCli(args.slice(1));
 } else if (args[0] === "stack-generate-manifest") {
-  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-XZ534AJH.js");
+  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-H6LJQ2HV.js");
   process.exit(await runStackGenerateManifestCli(args.slice(1)));
 } else if (args[0] === "repo-truth") {
   const { runRepoTruthCli } = await import("./exe-repo-truth.js");

package/dist/bin/registry-proxy.js

@@ -2,7 +2,7 @@
 import {
   registryProxyOptionsFromEnv,
   runRegistryProxy
-} from "../chunk-NJ57AHX4.js";
+} from "../chunk-RLUDQYOA.js";
 import {
   isMainModule
 } from "../chunk-6Y4B3QF6.js";

package/dist/bin/stack-update.js

@@ -18,6 +18,7 @@ import {
   defaultStackPaths,
   detectDanglingVolumes,
   detectMissingRequiredEnvVars,
+  expandComposeServicesWithSidecars,
   listAvailableVersions,
   listHostComposeServices,
   loadServiceSelection,
@@ -46,7 +47,7 @@ import {
   verifyManifestImagesAvailable,
   warnUnmanagedManifestServices,
   withStackUpdateOperationLock
-} from "../chunk-WMGS5U2J.js";
+} from "../chunk-DYFTZWG2.js";
 import "../chunk-EC5H53YD.js";
 import {
   runVerifyStack
@@ -62,7 +63,7 @@ import {
 import {
   logResult,
   runHealthGate
-} from "../chunk-POBFVHIS.js";
+} from "../chunk-5OWHYOIF.js";
 import "../chunk-L25OAFOU.js";
 import "../chunk-RT57D7C4.js";
 import "../chunk-FTZET5YX.js";
@@ -2141,8 +2142,9 @@ function captureRetainedHealthForCli(composeFile, envFile, selectedService, requ
     stdio: ["pipe", "pipe", "pipe"],
     timeout: 2e4
   });
-  const critical = retainedCriticalServices(config.status === 0 ? config.stdout : null, selectedService, requiredCore);
-  const completedDependencies = retainedCompletedDependencies(config.stdout, critical, selectedService, requiredCore);
+  const companions = expandComposeServicesWithSidecars([selectedService]).slice(1);
+  const critical = retainedCriticalServices(config.status === 0 ? config.stdout : null, selectedService, requiredCore, companions);
+  const completedDependencies = retainedCompletedDependencies(config.stdout, critical, selectedService, requiredCore, companions);
   const ps = spawnSync3("docker", [...args, "ps", "--all", "--format", "json"], {
     encoding: "utf8",
     stdio: ["pipe", "pipe", "pipe"],
@@ -2451,20 +2453,20 @@ async function main(args = process.argv.slice(2)) {
     }, plan, liveComposeRaw, envRaw, process.env, retainedComposeFiles.override);
     console.log(`[stack-update] Signed live compose retained: base SHA256 ${manifest.stacks[plan.targetVersion]?.config?.composeSha256}` + (retainedComposeFiles.override === null ? " (no override)" : `, override SHA256 ${manifest.stacks[plan.targetVersion]?.config?.composeOverrideSha256}`));
     const selectedService = Object.values(plan.release.services)[0];
-    assertRetainedComposeRunningService(
-      composeArgsForStack(opts.composeFile, opts.envFile),
-      selectedService.composeService ?? opts.serviceName
-    );
-    assertRetainedComposeRenderedImage(
-      composeArgsForStack(opts.composeFile, opts.envFile),
-      selectedService.composeService ?? opts.serviceName,
-      selectedService.env,
-      plan.changes[0].after,
-      void 0,
-      { ...process.env, [selectedService.env]: plan.changes[0].after }
-    );
+    const composeTargets = expandComposeServicesWithSidecars([selectedService.composeService ?? opts.serviceName]);
+    for (const target of composeTargets) {
+      assertRetainedComposeRunningService(composeArgsForStack(opts.composeFile, opts.envFile), target);
+      assertRetainedComposeRenderedImage(
+        composeArgsForStack(opts.composeFile, opts.envFile),
+        target,
+        selectedService.env,
+        plan.changes[0].after,
+        void 0,
+        { ...process.env, [selectedService.env]: plan.changes[0].after }
+      );
+    }
     console.log(
-      `[stack-update] If applied: back up stack config and attempt the configured database/off-host backups; write only ${selectedService.env} in the stack .env; update the stack lock and deploy audit; pull and recreate only ${selectedService.composeService ?? opts.serviceName}. Compose, bind-mounted assets, gateway overlays, host hardening, and service selection remain unchanged.`
+      `[stack-update] If applied: back up stack config and attempt the configured database/off-host backups; write only ${selectedService.env} in the stack .env; update the stack lock and deploy audit; pull and recreate only ${composeTargets.join(", ")}. Compose, bind-mounted assets, gateway overlays, host hardening, and service selection remain unchanged.`
     );
   }
   const targetRelease = manifest.stacks[plan.targetVersion];

package/dist/bin/vps-health-gate.js

@@ -8,7 +8,7 @@ import {
   logResult,
   main,
   runHealthGate
-} from "../chunk-POBFVHIS.js";
+} from "../chunk-5OWHYOIF.js";
 import "../chunk-MLKGABMK.js";
 export {
   checkCRM,

package/dist/build-manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "generated_at": "2026-09-23T22:15:03.947Z",
+  "generated_at": "2026-09-23T23:35:24.804Z",
   "files": [
     {
       "path": "active-agent-KMGOYJTP.js",
@@ -179,7 +179,7 @@
     },
     {
       "path": "bin/cli.js",
-      "sha256": "a26f29a3a9652a702b0bdafd1bbceb13389b3fffc4d49477eae926e855a59ee6",
+      "sha256": "407694f935b3d6c4613ca6c24229ac39e53d9022bf4bc62303bc4436920089f5",
       "bytes": 69792
     },
     {
@@ -524,7 +524,7 @@
     },
     {
       "path": "bin/registry-proxy.js",
-      "sha256": "e4b41eb986a2f7baf4371bb8a1bd5ec046ef6741c5df16a1f7aaeda5cb946675",
+      "sha256": "224728a8c04ed51bd21488f26c521f39776d6d5c67d40e6b05acfa30aaa47eb8",
       "bytes": 1885
     },
     {
@@ -549,8 +549,8 @@
     },
     {
       "path": "bin/stack-update.js",
-      "sha256": "45e9139c3b040aff8c4e863ada54ca75c58c4c14b7c8571f67a599372a0978bb",
-      "bytes": 131290
+      "sha256": "39605342987fd37972f577aa1619e9fdc7aef0e339bc5188f820251392c45242",
+      "bytes": 131487
     },
     {
       "path": "bin/update.js",
@@ -569,7 +569,7 @@
     },
     {
       "path": "bin/vps-health-gate.js",
-      "sha256": "1b4e8961edf1b549fc3900950e8ddd6bf1bff6dc02fed969028f31b4c730a3d3",
+      "sha256": "386e8e34d613c6ed0511ff3380532e9bc24176de7c6a955770134c6a29853940",
       "bytes": 333
     },
     {
@@ -782,6 +782,11 @@
       "sha256": "c2e2367cffa3e57666f0307f2374f6ca8cbf2f07ba45b7361d680e8271be90ec",
       "bytes": 3297
     },
+    {
+      "path": "chunk-5OWHYOIF.js",
+      "sha256": "7321323a90b487e2f95b3f6c6dd72a177e546aa7aace189d3f725f879fa560c5",
+      "bytes": 7587
+    },
     {
       "path": "chunk-5V7BD7Z4.js",
       "sha256": "ca37d6e8b8481a988ed41264e604ce992de1d8d63fff23e07b3d2367cba5af21",
@@ -1092,6 +1097,11 @@
       "sha256": "cf3ce4cf6c9cdba17a8a5e3d9f0c78ae42f1cb72f1a06608cc8da1fb27f06a76",
       "bytes": 3292
     },
+    {
+      "path": "chunk-DYFTZWG2.js",
+      "sha256": "72d0060a08f4996dfe65b4fe9718b00fc053f2bfd2747d176f7a4539954ec4fc",
+      "bytes": 261313
+    },
     {
       "path": "chunk-E23LNUWJ.js",
       "sha256": "6d692be7ac73bf481e7013c4b948b70acd8282234f645d562457754afaa7a02e",
@@ -1527,11 +1537,6 @@
       "sha256": "cfdcf9141d53bd73b7b8cc3a4097773d1f854a9dffb7a81324f2782c7d70fe6c",
       "bytes": 14891
     },
-    {
-      "path": "chunk-NJ57AHX4.js",
-      "sha256": "37cd6a8a4df230eca98e5fc2792fa39027c3ca8cbfbb5438f87680a1c996a755",
-      "bytes": 40844
-    },
     {
       "path": "chunk-NKPPPX6I.js",
       "sha256": "4a5f8acc2c7b70708de8b68c7c3b7b3f5981395f2bd1a4db3b3b7151769910db",
@@ -1658,9 +1663,9 @@
       "bytes": 3317
     },
     {
-      "path": "chunk-POBFVHIS.js",
-      "sha256": "398f78513e36934eebeaceb2644137c3a95acb515783aa0bdf6dd970bb33cbb9",
-      "bytes": 7587
+      "path": "chunk-PS77SULS.js",
+      "sha256": "6c337e635c575f47a50c8587d2bfa2fcdd0ebfdf43a967f38170ce684ff63dbb",
+      "bytes": 3766
     },
     {
       "path": "chunk-PYS43F2X.js",
@@ -1757,6 +1762,11 @@
       "sha256": "627baf16bbe786e186075ad51849ac4460738fb2e185216bddefca23d2ae55b2",
       "bytes": 11048
     },
+    {
+      "path": "chunk-RLUDQYOA.js",
+      "sha256": "5e1fb642dcb8ed9d6fdb95fae00346afafff51fddd4b60d2b11c1c878d7b1c3b",
+      "bytes": 40844
+    },
     {
       "path": "chunk-RT57D7C4.js",
       "sha256": "054f2262b18d6c727b18c7bc34491d1d30f20d4d8fb42eb21704ac9c190e5477",
@@ -1907,11 +1917,6 @@
       "sha256": "697ecdef6991c061baab1e9759bc14aecd28631954b2edfdb721c98c72d41c82",
       "bytes": 1813
     },
-    {
-      "path": "chunk-V57YDQQA.js",
-      "sha256": "6284d4a8d979d18fdb3b863f59f91c7cd616c169349bb77766a94693477706e9",
-      "bytes": 3766
-    },
     {
       "path": "chunk-VGMACSEV.js",
       "sha256": "4a51d1fb50f1389160ec2d06ebeb702976a647212f7731ab58f562de3f53f215",
@@ -1967,11 +1972,6 @@
       "sha256": "288099f4b532013a4c9ba4c6129273a6f5036fc99f574e4b4d2b0fddc3792b67",
       "bytes": 1549
     },
-    {
-      "path": "chunk-WMGS5U2J.js",
-      "sha256": "688da29e942b4732af8dc9d226f26a1c57c37e30581a97e30be5af4bfc4ad4ae",
-      "bytes": 260597
-    },
     {
       "path": "chunk-WPTIHQ6M.js",
       "sha256": "a999baf6db449dcd8c856393a0721a50aceb27e74a49f71bbc6b553081d98fc2",
@@ -2574,7 +2574,7 @@
     },
     {
       "path": "hooks/manifest.json",
-      "sha256": "af052428c7e0f413b988ae47ed6a7120020847a8d665eb125ff24e0f5571b633",
+      "sha256": "4140c8729b945f17c2a19a259a8aa0a1e3f753237a95e005be4362d4fb90cc4f",
       "bytes": 1841
     },
     {
@@ -2879,7 +2879,7 @@
     },
     {
       "path": "lib/registry-proxy.js",
-      "sha256": "086622c69175e1c94ca91d2ac0dab2042db655eb14252e8acabc3e02fc2dd40b",
+      "sha256": "94c2d851ff177536c9e0def91d5d55c740005ae6c96b9ee4b9543852a470d25f",
       "bytes": 749
     },
     {
@@ -3463,8 +3463,8 @@
       "bytes": 111
     },
     {
-      "path": "stack-generate-manifest-XZ534AJH.js",
-      "sha256": "5a3b5b3ab0b6160c45abf107a099e188db1cd3239f983c774bb32a4304d02fa9",
+      "path": "stack-generate-manifest-H6LJQ2HV.js",
+      "sha256": "d790293379cf08251382c3076496f39824ddb800e345e24ef00fff1d21e36335",
       "bytes": 56960
     },
     {
@@ -3473,18 +3473,18 @@
       "bytes": 4761
     },
     {
-      "path": "stack-promote-EAPCVGKJ.js",
-      "sha256": "5dbfd92d46224fa325522dcb29a0c37a04503bcbc240338e6dd81999915e41df",
+      "path": "stack-promote-4EF7RNIV.js",
+      "sha256": "d9db50f30a0a97cbe56b4e566be8e9c1327d9ecb5c96a6a46967bf57ea76f8a9",
       "bytes": 7425
     },
     {
-      "path": "stack-release-YEO6BFVR.js",
-      "sha256": "59e8eb373abf14f60ab5c7b758b8ab9cebe044490622af22c1af3746f0bd2102",
+      "path": "stack-release-YCNRPK6R.js",
+      "sha256": "bd26b47386fa7849325c313b30e2eb0ee8f0ba77ea8dcaf95256fb0241a824bd",
       "bytes": 117550
     },
     {
-      "path": "stack-update-NEDES5S4.js",
-      "sha256": "f70a348356634acc818edf94d0deaf756ca7ad3198d6f339b39b8358a6962afe",
+      "path": "stack-update-2F464W3N.js",
+      "sha256": "8be2553c248e2067f8f4a0a0f342513af5080b88b79ce9b22ce07cf7a73bf5ce",
       "bytes": 7863
     },
     {

package/dist/{chunk-POBFVHIS.js → chunk-5OWHYOIF.js}

@@ -212,7 +212,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-NEDES5S4.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-2F464W3N.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/{chunk-WMGS5U2J.js → chunk-DYFTZWG2.js}

@@ -176,7 +176,7 @@ function parseRenderedServices(renderedCompose) {
   }
   return services;
 }
-function retainedCriticalServices(renderedCompose, selectedService, requiredCore) {
+function retainedCriticalServices(renderedCompose, selectedService, requiredCore, selectedCompanions = []) {
   const services = parseRenderedServices(renderedCompose);
   const critical = /* @__PURE__ */ new Set();
   const visit = (service) => {
@@ -202,10 +202,11 @@ function retainedCriticalServices(renderedCompose, selectedService, requiredCore
     }
   };
   visit(selectedService);
+  for (const service of selectedCompanions) visit(service);
   for (const service of requiredCore) visit(service);
   return critical;
 }
-function retainedCompletedDependencies(renderedCompose, critical, selectedService, requiredCore) {
+function retainedCompletedDependencies(renderedCompose, critical, selectedService, requiredCore, selectedCompanions = []) {
   const services = parseRenderedServices(renderedCompose);
   const inbound = /* @__PURE__ */ new Map();
   for (const parent of critical) {
@@ -223,7 +224,7 @@ function retainedCompletedDependencies(renderedCompose, critical, selectedServic
       inbound.set(name, [...inbound.get(name) ?? [], condition]);
     }
   }
-  const roots = /* @__PURE__ */ new Set([selectedService, ...requiredCore]);
+  const roots = /* @__PURE__ */ new Set([selectedService, ...selectedCompanions, ...requiredCore]);
   return new Set(
     [...inbound].filter(
       ([name, conditions]) => !roots.has(name) && // Compose's omitted restart policy is "no". An explicit policy
@@ -2476,8 +2477,9 @@ function assertRetainedComposePlan(input, plan, liveComposeRaw, envRaw, processE
   if (service.migrations || plan.release.migrations) {
     throw new Error("--retain-compose cannot run service or release migrations");
   }
-  if (expandComposeServicesWithSidecars([service.composeService ?? name]).length !== 1) {
-    throw new Error("--retain-compose requires a service with no companion sidecars");
+  const composeServices = expandComposeServicesWithSidecars([service.composeService ?? name]);
+  if (composeServices.length > 1 && !(name === "crm" && composeServices.length === 2 && composeServices[0] === "exe-crm" && composeServices[1] === "exe-crm-worker")) {
+    throw new Error("--retain-compose requires a service with no unsupported companion sidecars");
   }
   if (!service.env || plan.changes.length !== 1 || plan.changes[0].service !== name || plan.changes[0].key !== service.env) {
     throw new Error("--retain-compose requires exactly one selected image-pin change");
@@ -2498,16 +2500,17 @@ function assertRetainedComposePlan(input, plan, liveComposeRaw, envRaw, processE
   } else if (config.composeOverrideSha256) {
     throw new Error("--retain-compose refused: signed compose override is absent from the live stack");
   }
-  const imageExpression = liveOverrideRaw === null ? parseComposeServiceImages(liveComposeRaw).get(service.composeService ?? name) : parseComposeServiceImages(liveOverrideRaw).get(service.composeService ?? name) ?? parseComposeServiceImages(liveComposeRaw).get(service.composeService ?? name);
-  if (!imageExpression || !envRefsInImageExpression(imageExpression).includes(service.env)) {
-    throw new Error("--retain-compose refused: selected service compose image does not use its signed image pin");
-  }
-  const plannedImage = resolveComposeImageExpression(
-    imageExpression,
-    parseEnv(patchEnv(envRaw, { [service.env]: plan.changes[0].after }))
-  );
-  if (plannedImage !== plan.changes[0].after) {
-    throw new Error("--retain-compose refused: rendered selected service image differs from signed image pin");
+  const baseImages = parseComposeServiceImages(liveComposeRaw);
+  const overrideImages = liveOverrideRaw === null ? /* @__PURE__ */ new Map() : parseComposeServiceImages(liveOverrideRaw);
+  const plannedEnv = parseEnv(patchEnv(envRaw, { [service.env]: plan.changes[0].after }));
+  for (const composeService of composeServices) {
+    const imageExpression = overrideImages.get(composeService) ?? baseImages.get(composeService);
+    if (!imageExpression || !envRefsInImageExpression(imageExpression).includes(service.env)) {
+      throw new Error(`--retain-compose refused: selected service ${composeService} compose image does not use its signed image pin`);
+    }
+    if (resolveComposeImageExpression(imageExpression, plannedEnv) !== plan.changes[0].after) {
+      throw new Error(`--retain-compose refused: rendered selected service ${composeService} image differs from signed image pin`);
+    }
   }
   const env = parseEnv(envRaw);
   const monitorKey = env.get("EXE_MONITOR_KEY") ?? "";
@@ -3947,18 +3950,20 @@ ${lines.join("\n")}`
     if (options.retainCompose) {
       const [name, service] = Object.entries(plan.release.services)[0];
       const composeArgs2 = composeArgsForStack(options.composeFile, options.envFile);
-      assertRetainedComposeRunningService(
-        composeArgs2,
-        service.composeService ?? name,
-        options.composePsCapture ?? defaultComposePsCapture
-      );
-      assertRetainedComposeRenderedImage(
-        composeArgs2,
-        service.composeService ?? name,
-        service.env,
-        plan.changes[0].after,
-        options.composeConfigCapture ?? defaultComposeConfigCapture
-      );
+      for (const target of expandComposeServicesWithSidecars([service.composeService ?? name])) {
+        assertRetainedComposeRunningService(
+          composeArgs2,
+          target,
+          options.composePsCapture ?? defaultComposePsCapture
+        );
+        assertRetainedComposeRenderedImage(
+          composeArgs2,
+          target,
+          service.env,
+          plan.changes[0].after,
+          options.composeConfigCapture ?? defaultComposeConfigCapture
+        );
+      }
     }
     const hostState = listHostComposeServices(
       composeArgsForStack(options.composeFile, options.envFile),
@@ -4113,11 +4118,12 @@ ${lines.join("\n")}`
   if (options.retainCompose) {
     const [selectedName, selectedEntry] = Object.entries(plan.release.services)[0];
     const selected = selectedEntry.composeService ?? selectedName;
+    const selectedCompanions = expandComposeServicesWithSidecars([selected]).slice(1);
     const requiredCore = Object.entries(targetRelease.services).filter(([, service]) => service.required === true && service.category === "core").map(([name, service]) => service.composeService ?? name);
     const args = composeArgsForStack(options.composeFile, options.envFile);
     const rendered = (options.composeConfigCapture ?? defaultComposeConfigCapture)(args, process.env);
-    const critical = retainedCriticalServices(rendered, selected, requiredCore);
-    const completedDependencies = retainedCompletedDependencies(rendered, critical, selected, requiredCore);
+    const critical = retainedCriticalServices(rendered, selected, requiredCore, selectedCompanions);
+    const completedDependencies = retainedCompletedDependencies(rendered, critical, selected, requiredCore, selectedCompanions);
     const rawHealth = (options.composePsCapture ?? defaultComposePsCapture)(args);
     retainedHealthBaseline = { critical, completedDependencies, containers: parseRetainedContainerHealth(rawHealth) };
     const failures = assessRetainedHealthBefore(retainedHealthBaseline);
@@ -4470,7 +4476,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
     for (const service of restartOrder) {
       restartIndex++;
       const endRestart = startPhase(`restart ${service}`);
-      const manifestServiceName = Object.entries(plan.release.services).find(([name, svc]) => (svc.composeService ?? name) === service)?.[0] ?? service;
+      const manifestServiceName = resolveOwningManifestService(service, plan.release.services);
       if (bundledIsolation && (failedComposeServices.has(service) || failedManifestServices.has(resolveOwningManifestService(service, plan.release.services)))) {
         continue;
       }
@@ -4484,12 +4490,13 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         continue;
       }
       if (options.retainCompose) {
+        const owner = plan.release.services[manifestServiceName];
         assertRetainedComposeFilesUnchanged(options.composeFile, composeRaw, retainedOverrideHash);
         assertRetainedComposeRunningService(composeArgs, service, options.composePsCapture ?? defaultComposePsCapture);
         assertRetainedComposeRenderedImage(
           composeArgs,
           service,
-          plan.release.services[manifestServiceName].env,
+          owner.env,
           plan.changes[0].after,
           options.composeConfigCapture ?? defaultComposeConfigCapture
         );
@@ -4856,9 +4863,12 @@ Fix these before the stack is safe to operate.`);
         const composeService = service.composeService ?? name;
         try {
           syncImagePinsWithProcessEnv(envRaw, [service.env]);
-          exec("docker", [...composeArgs, "up", "-d", "--no-deps", composeService]);
-          console.error(`[stack-update] Scoped fallback restored ${composeService} after rollback error: ${rbReason}`);
-          rollbackDetail += `; scoped fallback restored ${composeService}`;
+          const restored = expandComposeServicesWithSidecars([composeService]);
+          for (const target of restored) {
+            exec("docker", [...composeArgs, "up", "-d", "--no-deps", target]);
+          }
+          console.error(`[stack-update] Scoped fallback restored ${restored.join(", ")} after rollback error: ${rbReason}`);
+          rollbackDetail += `; scoped fallback restored ${restored.join(", ")}`;
         } catch (scopedError) {
           console.error(`[stack-update] Scoped fallback failed for ${composeService}: ${errorMessage(scopedError)}`);
           rollbackDetail += `; scoped fallback failed for ${composeService}: ${errorMessage(scopedError)}`;

package/dist/{chunk-V57YDQQA.js → chunk-PS77SULS.js}

@@ -1,6 +1,6 @@
 import {
   canonicalizeStackManifest
-} from "./chunk-WMGS5U2J.js";
+} from "./chunk-DYFTZWG2.js";
 
 // src/lib/stack-manifest-write.ts
 import { readFileSync, statSync, writeFileSync } from "fs";

package/dist/{chunk-NJ57AHX4.js → chunk-RLUDQYOA.js}

@@ -138,7 +138,7 @@ async function assertManifestSignature(manifest, publicKeyPem) {
       "manifest carries no `signature`. Fleets that enforce EXE_STACK_PUBLIC_KEY reject unsigned manifests, so publishing one would ship a release no host can install. Re-sign with the custodied key: node scripts/sign-stack-manifest.mjs deploy/stack-manifests/v0.9.json"
     );
   }
-  const { verifyStackManifestSignature } = await import("./stack-update-NEDES5S4.js");
+  const { verifyStackManifestSignature } = await import("./stack-update-2F464W3N.js");
   try {
     verifyStackManifestSignature(manifest, publicKeyPem);
   } catch (err) {

package/dist/hooks/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-09-23T22:15:03.718Z",
+  "generatedAt": "2026-09-23T23:35:24.596Z",
   "hashes": {
     "bug-report-worker.js": "7c5f5951fe30192e374d9047c3a7f2975a879a5951457aafea5db95d5d6be6af",
     "codex-stop-task-finalizer.js": "f963449525e068ebf3f04a2950adf21464de71774b60165a84d69621a5eca30a",

package/dist/lib/registry-proxy.js

@@ -11,7 +11,7 @@ import {
   resolveRegistryProxyBuildIdentity,
   resolveStackManifestChannel,
   runRegistryProxy
-} from "../chunk-NJ57AHX4.js";
+} from "../chunk-RLUDQYOA.js";
 import "../chunk-MLKGABMK.js";
 export {
   SERVED_VERSION_PATH,

package/dist/{stack-generate-manifest-XZ534AJH.js → stack-generate-manifest-H6LJQ2HV.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-V57YDQQA.js";
-import "./chunk-WMGS5U2J.js";
+} from "./chunk-PS77SULS.js";
+import "./chunk-DYFTZWG2.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-YYRI2AGK.js";
 import "./chunk-L25OAFOU.js";

package/dist/{stack-promote-EAPCVGKJ.js → stack-promote-4EF7RNIV.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-V57YDQQA.js";
-import "./chunk-WMGS5U2J.js";
+} from "./chunk-PS77SULS.js";
+import "./chunk-DYFTZWG2.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-YYRI2AGK.js";
 import "./chunk-L25OAFOU.js";

package/dist/{stack-release-YEO6BFVR.js → stack-release-YCNRPK6R.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-V57YDQQA.js";
-import "./chunk-WMGS5U2J.js";
+} from "./chunk-PS77SULS.js";
+import "./chunk-DYFTZWG2.js";
 import "./chunk-EC5H53YD.js";
 import {
   assertPreflightGate,
@@ -2028,7 +2028,7 @@ async function warmProxyCache(imageRef) {
 async function resolveImageGitShaLabel(ref, dryRun) {
   if (!ref || dryRun) return void 0;
   try {
-    const { readProvenanceLabels } = await import("./stack-generate-manifest-XZ534AJH.js");
+    const { readProvenanceLabels } = await import("./stack-generate-manifest-H6LJQ2HV.js");
     const labels = await readProvenanceLabels(ref);
     return labels["org.exe.git_sha"] ?? labels["org.opencontainers.image.revision"];
   } catch (err) {

package/dist/{stack-update-NEDES5S4.js → stack-update-2F464W3N.js}

@@ -132,7 +132,7 @@ import {
   waitForHttpOk,
   warnUnmanagedManifestServices,
   withStackUpdateOperationLock
-} from "./chunk-WMGS5U2J.js";
+} from "./chunk-DYFTZWG2.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-YYRI2AGK.js";
 import "./chunk-L25OAFOU.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.393",
+  "version": "0.9.394",
   "description": "AI employee operating system \u2014 persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/release-notes.json

@@ -1,8 +1,8 @@
 {
-  "current": "0.9.393",
+  "current": "0.9.394",
   "notes": {
-    "0.9.393": {
-      "version": "0.9.393",
+    "0.9.394": {
+      "version": "0.9.394",
       "date": "2026-09-23",
       "features": [
         "local CI triage — classify failing checks at zero token cost (#1441)",
@@ -41,6 +41,10 @@
       ],
       "security": [],
       "other": [
+        "Prepare signed CRM companion canary stack 0.9.55",
+        "Allow signed retained CRM web and worker image group",
+        "Prepare signed CRM DEMO canary stack 0.9.54",
+        "Add fixed-source npm-only publisher for exe-os 0.9.393",
         "Prepare signed Dashboard canary stack 0.9.53 with scoped updater 0.9.393",
         "assert required core failure in retained scope",
         "release(npm): publish 0.9.392 from exact green main source",