@askexenow/exe-os 0.9.395 → 0.9.396

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-24T01:39:28.227Z",
-  "manifest_sha256": "a9b3e331e099100599251d9feaf50f7a7da33cecd178d59d986aaf3e3f810366",
-  "package_version": "0.9.395"
+  "verified_at": "2026-09-24T03:22:35.670Z",
+  "manifest_sha256": "882003bc67319c95ef5176b5ca31cc4cb8893171183ad87044b555d99cbbfb1e",
+  "package_version": "0.9.396"
 }

package/dist/build-manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "generated_at": "2026-09-24T01:39:28.168Z",
+  "generated_at": "2026-09-24T03:22:35.607Z",
   "files": [
     {
       "path": "active-agent-6CIFLMKA.js",
@@ -2579,7 +2579,7 @@
     },
     {
       "path": "hooks/manifest.json",
-      "sha256": "7b9f02b404d80a92d4e364a85036f9b9956657a8b3b5ac4f5cfcd803cb9638e6",
+      "sha256": "2556ee4239ef1a967f656939361999f14e549a92d5ab7437409c5d0e70d26591",
       "bytes": 1841
     },
     {

package/dist/hooks/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-09-24T01:39:27.730Z",
+  "generatedAt": "2026-09-24T03:22:35.345Z",
   "hashes": {
     "bug-report-worker.js": "d51de3d9014eac245af3d4313331a7dd7d6fff0178a9e45ef52814e69ac52069",
     "codex-stop-task-finalizer.js": "fc508147202167503a48c8c11906dd89f04c16d86e7b061afa46e5b7ea71d4a8",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.395",
+  "version": "0.9.396",
   "description": "AI employee operating system \u2014 persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -83,8 +83,15 @@
   "overrides": {
     "protobufjs": ">=8.6.0",
     "form-data": ">=4.0.6",
-    "nodemailer": "^8.0.9",
-    "tar": ">=7.5.16",
+    "nodemailer": "^10.0.10",
+    "tar": ">=7.5.21",
+    "axios": "^1.18.0",
+    "fast-uri": "^3.1.6",
+    "ip-address": "^10.3.1",
+    "nanoid": "^5.1.16",
+    "picomatch": "^4.0.4",
+    "sharp": "^0.35.4",
+    "undici": "^6.27.0",
     "esbuild": ">=0.28.1",
     "hono": ">=4.12.25",
     "@opentelemetry/core": ">=2.8.0",
@@ -93,7 +100,7 @@
     "@opentelemetry/sdk-metrics": ">=2.8.0",
     "@opentelemetry/sdk-logs": ">=0.219.0",
     "@opentelemetry/propagator-b3": ">=2.8.0",
-    "@opentelemetry/propagator-jaeger": ">=2.8.0",
+    "@opentelemetry/propagator-jaeger": ">=2.9.0",
     "@opentelemetry/exporter-zipkin": ">=2.8.0",
     "@opentelemetry/otlp-exporter-base": ">=0.219.0",
     "@opentelemetry/otlp-transformer": ">=0.219.0",
@@ -203,7 +210,7 @@
     "ink-text-input": "^6.0.0",
     "jose": "^6.2.2",
     "node-llama-cpp": "^3.18.1",
-    "nodemailer": "^8.0.9",
+    "nodemailer": "^10.0.10",
     "openai": "^6.33.0",
     "pg": "^8.20.0",
     "react": "^19.2.4",

package/release-notes.json

@@ -1,74 +1,19 @@
 {
-  "current": "0.9.395",
+  "current": "0.9.396",
   "notes": {
-    "0.9.395": {
-      "version": "0.9.395",
+    "0.9.396": {
+      "version": "0.9.396",
       "date": "2026-09-24",
-      "features": [
-        "ARC-1 verifier gate and isolated signer boundary (Phase 3, Track D) (#1187)",
-        "local CI triage — classify failing checks at zero token cost (#1441)",
-        "declare the runner fleet instead of remembering it (#1179)",
-        "ARC-1 release ledger, part 1 of 4 — core, leases and transitions (#1229)",
-        "bug census source of truth — per-status/per-product counts, surfaced at boot (#1270)",
-        "--scope flag reaches DEAD coordinator lanes' zombie queues (follow-up to bug 81c63b67) (#1405)",
-        "sign recoverable B3 invite proofs with native keys"
-      ],
+      "features": [],
       "fixes": [
-        "memory-batch binding phase 1 — readers only, emission off by default (bug f7656734) (#1505)",
-        "rollback with no prior key removes the new key (cb3798c1) (#1500)",
-        "keep Trivy database outside image build context",
-        "separate image tags from signed stack publication",
-        "resume interrupted digest-pinned blobs safely",
-        "binary-rename divergence, merge-commit attribution, stale-constant guard (cicd-pipeline-integrity) (#1506)",
-        "un-skip register-tools-empty-machine test with real 96df1a7f contract (5c65809b) (#1503)",
-        "render abandoned count and track cancelled-then-timed-out bodies (#1502)",
-        "partial-pull cluster — 409 recovery, apply-failure conflation, legacy cursor, state erasure, memory-batch binding (#1501)",
-        "list_bugs status filter silently ignored unknown values (e645822c) (#1494)",
-        "honor omitted default no-restart policy",
-        "honor completed one-shot dependencies in retained health",
-        "require critical container identity and preserve missing restart data",
-        "scope retained health to selected service and critical dependencies",
-        "compare override drift to signed snapshot",
-        "attest retained Compose override for scoped releases",
-        "no_raw excludes captured searches (bug 37353c88 residual a) (#1509)",
-        "cited-bug-id integrity guard (bug 2b74a91c); no pin change for bug 1f0fba70 (#1365)",
-        "an unreadable licence key or grandfather marker is not an absent one (bug d11c5049, G8) (#1321)",
-        "warm global-procedures cache on exe-call/exe-agent paths + durable guard (#1472)",
-        "purely additive target-keyed enforcement for every mutating tool (bug 4d7961b3) (#1279)",
-        "enforce shared-master exclusion at join, not only at publish (#1199 follow-up) (#1507)",
-        "supersession hygiene propagates importance in chain order (bug 692bd251) (#1508)",
-        "mix process.pid into the test-mode lock port (reopens 3c72aa45) (#1496)",
-        "linear f-string scan in policy evaluation (PR #1471 follow-up) (#1483)"
+        "isolate git subprocess tests in required PR and main gates",
+        "refresh vulnerable packages and image runtime for v0.9.396"
       ],
       "security": [],
       "other": [
-        "prepare exe-os v0.9.395 image metadata",
-        "cover GHCR blob redirects during resume",
-        "Add fixed-source npm-only publisher for exe-os 0.9.394",
-        "Prepare signed CRM companion canary stack 0.9.55",
-        "Allow signed retained CRM web and worker image group",
-        "Prepare signed CRM DEMO canary stack 0.9.54",
-        "Add fixed-source npm-only publisher for exe-os 0.9.393",
-        "Prepare signed Dashboard canary stack 0.9.53 with scoped updater 0.9.393",
-        "assert required core failure in retained scope",
-        "release(npm): publish 0.9.392 from exact green main source",
-        "release(stack): sign Dashboard topology canary 0.9.52",
-        "release(stack): pin Dashboard v0.9.392 in canary 0.9.51 (#1511)",
-        "release: use declared control runner lane",
-        "release: run fixed-source npm gate on control lane",
-        "release: add fixed-source npm canary publisher",
-        "release(stack): pin CRM v0.9.66 in DEMO canary",
-        "remove three mac CI flakes (bugs 4fd3f86e, 3c72aa45, e8a0c254) (#1482)",
-        "Retain signed live compose for targeted image updates (#1478)",
-        "use valid X25519 keys in B3 fixtures",
-        "use HTTP/1.1 for full-history provenance checkout (#1480)",
-        "release(stack): add CRM DEMO canary 0.9.50 (#1475)",
-        "bound lock-owner waits on failure",
-        "sign targeted SSO edge asset v0.9.49"
+        "require isolated git tests in both workflow gates"
       ],
-      "migration_notes": [
-        "recall, query: deployment` let the skip group consume the real"
-      ]
+      "migration_notes": []
     },
     "0.9.371": {
       "version": "0.9.371",

package/stack.release.json

@@ -4,8 +4,8 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.395",
-  "image": "ghcr.io/askexe/exe-os:v0.9.395",
+  "version": "0.9.396",
+  "image": "ghcr.io/askexe/exe-os:v0.9.396",
   "imageEnv": "EXE_OS_IMAGE_TAG",
   "imageDigestTodo": "The top-level image names the forthcoming exe-os build and receives its digest after publication. Independently released components, including dashboard, retain verified digest pins; stack publication validates every service pin.",
   "components": {
@@ -110,5 +110,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.395"
+  "sourceVersion": "0.9.396"
 }