@askexenow/exe-os 0.9.396 → 0.9.397

package/dist/{chunk-UVEDFARJ.js → chunk-UBFKX2AN.js}

@@ -1,6 +1,10 @@
+import {
+  createCRMWebhookHandler,
+  parseTwentyWebhook
+} from "./chunk-T4LKMZKF.js";
 import {
   WhatsAppAdapter
-} from "./chunk-WAPCTGGB.js";
+} from "./chunk-O2INE7WD.js";
 import {
   SignalAdapter
 } from "./chunk-RJT7H2KR.js";
@@ -16,17 +20,6 @@ import {
 import {
   IMessageAdapter
 } from "./chunk-2SRG3B3D.js";
-import {
-  createCRMWebhookHandler,
-  parseTwentyWebhook
-} from "./chunk-W6W6ED2D.js";
-import {
-  OllamaProvider
-} from "./chunk-FWFFZGSC.js";
-import {
-  AnthropicProvider,
-  OpenAICompatProvider
-} from "./chunk-ECGTESAP.js";
 import {
   BotRegistry,
   BotRuntime,
@@ -49,7 +42,14 @@ import {
   retryWithBackoff,
   routeMessage,
   validateGatewayConfig
-} from "./chunk-EG4ZUF4A.js";
+} from "./chunk-PAYDZ6J3.js";
+import {
+  OllamaProvider
+} from "./chunk-FWFFZGSC.js";
+import {
+  AnthropicProvider,
+  OpenAICompatProvider
+} from "./chunk-ECGTESAP.js";
 import {
   getAccountByName,
   getAccountByPhoneNumberId,

package/dist/{chunk-7INEFMVU.js → chunk-UNFHKOTF.js}

@@ -175,25 +175,47 @@ function evaluateRestartBreaker(prev, now, bootClass, windowMs = RESTART_BREAKER
   };
 }
 function loadStateEntries(deps) {
+  let raw;
   try {
-    if (!deps.exists(deps.statePath)) return [];
-    const parsed = JSON.parse(deps.read(deps.statePath));
+    if (!deps.exists(deps.statePath)) return { entries: [], readable: true };
+    raw = deps.read(deps.statePath);
+  } catch (err) {
+    process.stderr.write(
+      `[exed] Restart-breaker state file unreadable \u2014 FAILING OPEN for this boot (treating as empty, will not trip) but PRESERVING the file on disk so the crash window is not erased: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return { entries: [], readable: false };
+  }
+  try {
+    const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed.restarts)) throw new Error("restarts is not an array");
-    return parsed.restarts.map((e) => {
+    const entries = parsed.restarts.map((e) => {
       if (typeof e === "number" && Number.isFinite(e)) return { t: e, c: "x" };
       if (e && typeof e.t === "number") {
-        const raw = e.c;
-        const c = raw === "s" ? "s" : raw === "r" ? "r" : "x";
+        const raw2 = e.c;
+        const c = raw2 === "s" ? "s" : raw2 === "r" ? "r" : "x";
         return { t: e.t, c };
       }
       return null;
     }).filter((e) => e !== null);
+    return { entries, readable: true };
   } catch (err) {
-    process.stderr.write(
-      `[exed] Restart-breaker state file unreadable \u2014 FAILING OPEN (treating as empty, will not trip): ${err instanceof Error ? err.message : String(err)}
+    const quarantinePath = `${deps.statePath}.corrupt-${deps.now()}`;
+    try {
+      deps.write(quarantinePath, raw);
+      deps.remove(deps.statePath);
+      process.stderr.write(
+        `[exed] Restart-breaker state file was malformed JSON \u2014 quarantined corrupt bytes to ${quarantinePath} and reset restart tracking to a fresh empty state so crash tracking resumes: ${err instanceof Error ? err.message : String(err)}
 `
-    );
-    return [];
+      );
+      return { entries: [], readable: true };
+    } catch (quarantineErr) {
+      process.stderr.write(
+        `[exed] Restart-breaker state file malformed AND could not be quarantined \u2014 FAILING OPEN for this boot (treating as empty, will not trip), original file left in place: ${quarantineErr instanceof Error ? quarantineErr.message : String(quarantineErr)}
+`
+      );
+      return { entries: [], readable: false };
+    }
   }
 }
 function readLastExit(deps) {
@@ -220,7 +242,8 @@ function readLastExit(deps) {
 function recordDaemonRestart(deps = REAL_DEPS, gap, priorRestartIntent) {
   const lastExit = readLastExit(deps);
   const now = deps.now();
-  const prevEntries = loadStateEntries(deps);
+  const prevState = loadStateEntries(deps);
+  const prevEntries = prevState.entries;
   const priorCrashesInWindow = prevEntries.filter(
     (e) => e.c === "x" && now - e.t < RESTART_BREAKER_WINDOW_MS
   ).length;
@@ -239,9 +262,15 @@ function recordDaemonRestart(deps = REAL_DEPS, gap, priorRestartIntent) {
     RESTART_BREAKER_THRESHOLD,
     recoverable
   );
-  try {
-    deps.write(deps.statePath, JSON.stringify({ restarts: ev.entries }));
-  } catch {
+  if (prevState.readable) {
+    try {
+      deps.write(deps.statePath, JSON.stringify({ restarts: ev.entries }));
+    } catch {
+    }
+  } else {
+    process.stderr.write(
+      "[exed] Restart-breaker state NOT persisted this boot \u2014 the existing file could not be read and overwriting it would erase the crash window the breaker trips on.\n"
+    );
   }
   const decision = {
     trip: ev.trip,
@@ -320,11 +349,11 @@ function selfHealStormAlertPath() {
 }
 function crashBootsInWindow(deps = REAL_DEPS, windowMs = RESTART_BREAKER_WINDOW_MS) {
   const now = deps.now();
-  return loadStateEntries(deps).filter((e) => e.c === "x" && now - e.t < windowMs).length;
+  return loadStateEntries(deps).entries.filter((e) => e.c === "x" && now - e.t < windowMs).length;
 }
 function restartBootsInWindow(deps = REAL_DEPS, windowMs = RESTART_BREAKER_WINDOW_MS) {
   const now = deps.now();
-  return loadStateEntries(deps).filter((e) => now - e.t < windowMs).length;
+  return loadStateEntries(deps).entries.filter((e) => now - e.t < windowMs).length;
 }
 function writeBreakerAlert(decision, lastExit, deps = REAL_DEPS) {
   const windowMin = Math.round(RESTART_BREAKER_WINDOW_MS / 6e4);

package/dist/{chunk-B2P6OX3V.js → chunk-VESYCD2K.js}

@@ -1,14 +1,14 @@
 import {
   resolveAuth,
   resolveEndpoint
-} from "./chunk-4UOEKQF3.js";
+} from "./chunk-XG7OHNPA.js";
 import {
   resolvePartnerIdentities
-} from "./chunk-K3EU7B72.js";
+} from "./chunk-4Y5EKT3D.js";
 import {
   displayFingerprint,
   ed25519PrivateKeyFromSeed
-} from "./chunk-LGNDHTDP.js";
+} from "./chunk-MB3XK7YW.js";
 
 // src/lib/org-member-key.ts
 import { createHash, sign } from "crypto";

package/dist/{chunk-VV7D7KEX.js → chunk-VRPXCQV6.js}

@@ -1,6 +1,6 @@
 import {
   signKeyFingerprint
-} from "./chunk-LGNDHTDP.js";
+} from "./chunk-MB3XK7YW.js";
 import {
   resolveExeDataDir
 } from "./chunk-NPXIS2RY.js";

package/dist/{chunk-X2X3IGZU.js → chunk-W4H2MZAS.js}

@@ -5,7 +5,7 @@ import {
 import {
   composeSeatLimits,
   limitsForPlan
-} from "./chunk-A7XLR3K7.js";
+} from "./chunk-3R7UDPVR.js";
 
 // src/shared/seat-benefit.ts
 var ORG_BILLABLE_PLANS = ["team", "agency", "enterprise"];
@@ -45,6 +45,13 @@ function seatBenefit(personalPlan, orgPlan) {
       before: renderCount(before.devices),
       after: renderCount(after.devices),
       changed: before.devices !== after.devices
+    },
+    {
+      axis: "employees",
+      label: "AI employees",
+      before: renderCount(before.employees),
+      after: renderCount(after.employees),
+      changed: before.employees !== after.employees
     }
   ];
   return { gained: axes.some((a) => a.changed), orgPlan, axes };
@@ -127,8 +134,8 @@ function adminInviteDisclosureText(input) {
   const granting = input.orgPlan === null ? [
     "WHAT YOU ARE GRANTING",
     "  Nothing beyond membership itself. With no plan attached, the seat does",
-    "  not raise their cloud backup, memories or device allowances - they keep",
-    "  whatever their own plan gives them.",
+    "  not raise their cloud backup, memories, device or AI employee",
+    "  allowances - they keep whatever their own plan gives them.",
     "  Membership is still real: the mailbox, the roster and any shared",
     "  knowledge you grant all work."
   ] : [
@@ -137,8 +144,13 @@ function adminInviteDisclosureText(input) {
     "",
     ...axisTable(benefit.axes).map((line) => ` ${line}`),
     "",
-    "  Their AI employee allowance is NOT raised - a seat funds one Partner,",
-    "  not a team."
+    // Founder decision 2026-09-24 (supersedes 2026-08-09): a seat confers
+    // the org's full plan on every axis, including AI employees — see
+    // `SEAT_EXCLUDED_AXES` in src/shared/plan-limits.ts. This used to say
+    // "NOT raised"; that was true under the superseded rule and is false
+    // now, so it must not come back.
+    "  Their AI employee allowance is raised too, on the same terms as",
+    "  everything else above."
   ];
   return [
     `Issuing a seat invite for "${input.seatRef}" in ${input.orgId}.`,

package/dist/{chunk-FNVZAK4C.js → chunk-WO6KY2SP.js}

@@ -1,9 +1,9 @@
 import {
   createTokenBudgetMiddleware
-} from "./chunk-GPB6X2OI.js";
+} from "./chunk-YBUSK4GH.js";
 import {
   MultiAgentOrchestrator
-} from "./chunk-GHCF7J4Q.js";
+} from "./chunk-BLZ2LEZF.js";
 import {
   createQuietRenderer,
   createTerminalRenderer,
@@ -212,7 +212,7 @@ function createExeOSHooks(config) {
         );
       }
       try {
-        const { listBehaviors } = await import("./behaviors-5FRO36HG.js");
+        const { listBehaviors } = await import("./behaviors-T2N3VJS3.js");
         const behaviors = await listBehaviors(config.agentId, config.projectName, 12);
         if (behaviors.length > 0) {
           process.stderr.write(
@@ -333,7 +333,7 @@ function createExeOSHooks(config) {
     async onSubagentStop(_reason) {
       try {
         const { getClient } = await import("./lib/database.js");
-        const { sessionScopeFilter } = await import("./task-scope-YHXKRO2Y.js");
+        const { sessionScopeFilter } = await import("./task-scope-NF7JKUD7.js");
         const client = getClient();
         const ehScope = sessionScopeFilter();
         const tasks = await client.execute({
@@ -373,7 +373,7 @@ function createExeOSHooks(config) {
         setAt: (/* @__PURE__ */ new Date()).toISOString()
       });
       try {
-        const { writeNotification } = await import("./notifications-LHDV4WKP.js");
+        const { writeNotification } = await import("./notifications-7EBPEORY.js");
         await writeNotification({
           agentId: config.agentId,
           agentRole: "employee",
@@ -444,7 +444,7 @@ function createExeOSHooks(config) {
         try {
           const { writeMemory, flushBatch } = await import("./lib/store.js");
           const { getClient } = await import("./lib/database.js");
-          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-YHXKRO2Y.js");
+          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-NF7JKUD7.js");
           const client = getClient();
           const cpScope = cpScopeFilter();
           const tasks = await client.execute({

package/dist/{chunk-SLRKZRLC.js → chunk-WOG5XT2P.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 
 // src/lib/boot-generation.ts
 var SYNC_META_KEY = "daemon_boot_generation";

package/dist/{chunk-4UOEKQF3.js → chunk-XG7OHNPA.js}

@@ -1,27 +1,27 @@
 import {
   asOrgBillablePlan
-} from "./chunk-X2X3IGZU.js";
+} from "./chunk-W4H2MZAS.js";
 import {
   resolvePartnerIdentities
-} from "./chunk-K3EU7B72.js";
+} from "./chunk-4Y5EKT3D.js";
 import {
   OrgKeyPinConflictError,
   orgKeyPinConfirmation,
   pinOrgKey,
   readOrgKeyPin
-} from "./chunk-VV7D7KEX.js";
+} from "./chunk-VRPXCQV6.js";
 import {
   displayFingerprint,
   ed25519PrivateKeyFromSeed,
   signKeyFingerprint
-} from "./chunk-LGNDHTDP.js";
+} from "./chunk-MB3XK7YW.js";
 import {
   establishOrgMode,
   upsertOrgMembership
-} from "./chunk-INLY2LLN.js";
+} from "./chunk-SDYIUXW7.js";
 import {
   isValidX25519Recipient
-} from "./chunk-I4DBM5ME.js";
+} from "./chunk-F6OV7JP2.js";
 
 // src/lib/org-join.ts
 import { createHash, sign } from "crypto";

package/dist/{chunk-5YAXBLZR.js → chunk-XHSCV3BM.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-KY5XPFMA.js";
+} from "./chunk-OJ7SLC5P.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-DDYKAJMS.js → chunk-XJRF26L5.js}

@@ -1,6 +1,6 @@
 import {
   isExeSession
-} from "./chunk-V4RIHICU.js";
+} from "./chunk-Y2DTTZCV.js";
 import {
   loadConfigSync
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-3CAKKEEY.js → chunk-XWOEPR2Q.js}

@@ -1,10 +1,10 @@
 import {
   getCurrentSessionScope,
   strictSessionScopeFilter
-} from "./chunk-V4RIHICU.js";
+} from "./chunk-Y2DTTZCV.js";
 import {
   getProjectName
-} from "./chunk-GHIMWZN4.js";
+} from "./chunk-ROQ6R3FV.js";
 
 // src/lib/session-events.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-7C4YKCUK.js → chunk-XYB7GHGV.js}

@@ -1,7 +1,7 @@
 import {
   getIdentity,
   loadEmployeesSync
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 
 // src/lib/drift-probes.ts
 var DRIFT_THRESHOLD = 80;

package/dist/{chunk-V4RIHICU.js → chunk-Y2DTTZCV.js}

@@ -1,6 +1,6 @@
 import {
   ensureAgentSymlink
-} from "./chunk-BJ3ZQAIL.js";
+} from "./chunk-IV63ZWK6.js";
 import {
   ensureWorktree,
   ensureWorktreeAsync,
@@ -8,10 +8,15 @@ import {
   getMainRepoRoot,
   isInsideGitRepo,
   isWorktreeDirty
-} from "./chunk-UW5KXM4D.js";
+} from "./chunk-TTHUPNBU.js";
 import {
   resolveRowVisibility
-} from "./chunk-WFKZZSEB.js";
+} from "./chunk-3QYMH77Q.js";
+import {
+  LEASE_MINUTES,
+  isLeaseExpired,
+  leaseExpiryIso
+} from "./chunk-E23LNUWJ.js";
 import {
   buildTaskResult,
   serializeMessage
@@ -26,15 +31,10 @@ import {
 import {
   hasIntercomAckAfter
 } from "./chunk-MJCSEIFI.js";
-import {
-  LEASE_MINUTES,
-  isLeaseExpired,
-  leaseExpiryIso
-} from "./chunk-E23LNUWJ.js";
 import {
   listSessions,
   registerSession
-} from "./chunk-FJPCVXQX.js";
+} from "./chunk-DFIH6ZZF.js";
 import {
   getTransport
 } from "./chunk-VI4ATC6I.js";
@@ -43,7 +43,7 @@ import {
 } from "./chunk-6L4VIYLZ.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-OGJCUMSM.js";
+} from "./chunk-2YESHX5N.js";
 import {
   appendDispatchJournalEvent,
   releaseDispatchClaim,
@@ -52,7 +52,7 @@ import {
 } from "./chunk-T5SM4RXY.js";
 import {
   incrementSkillSuccess
-} from "./chunk-JKUCAMV4.js";
+} from "./chunk-AFDVI6KB.js";
 import {
   assertRuntimeModelCompatible,
   getAgentRuntime,
@@ -62,7 +62,7 @@ import {
 import {
   PlanLimitError,
   assertEmployeeLimitSync
-} from "./chunk-KM7M4LKN.js";
+} from "./chunk-QRWGGJAA.js";
 import {
   getSessionKey
 } from "./chunk-CVYC6DUW.js";
@@ -78,7 +78,7 @@ import {
 } from "./chunk-BTSWFMEH.js";
 import {
   getProjectName
-} from "./chunk-GHIMWZN4.js";
+} from "./chunk-ROQ6R3FV.js";
 import {
   expandDualPrefixTools
 } from "./chunk-HYZV25LY.js";
@@ -103,13 +103,13 @@ import {
   loadEmployeesSync,
   offloadReadIfMain,
   offloadReadQuery
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 import {
   RUNTIME_TABLE
 } from "./chunk-3VW5ZP2F.js";
 import {
   loadDeviceId
-} from "./chunk-6VMVQ3G7.js";
+} from "./chunk-GTW56AUB.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -1610,7 +1610,7 @@ async function createTaskCore(input, deps = {}) {
         if (isCoordinatorSession) {
           earlySessionScope = resolved;
         } else {
-          const { getSessionProject } = await import("./session-scope-LDRY5PBO.js");
+          const { getSessionProject } = await import("./session-scope-KVIRKTX7.js");
           const sessionProject = getSessionProject(resolved);
           if (sessionProject && sessionProject !== input.projectName) {
             scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
@@ -1880,7 +1880,7 @@ ${scopeMismatchWarning}` : scopeMismatchWarning;
       });
       await writeTaskMarkdownAtomic(mdPath, mdContent);
       try {
-        const { injectBehaviors } = await import("./behavior-injection-CHSQWES4.js");
+        const { injectBehaviors } = await import("./behavior-injection-S2NBCHRK.js");
         await injectBehaviors({
           taskFile: mdPath,
           title: input.title,
@@ -1975,7 +1975,7 @@ async function buildTaskRowsStatement(opts) {
   }
   if (opts.founderId !== null) {
     try {
-      const { founderScopeFilter } = await import("./founder-context-6Q6OU7Q7.js");
+      const { founderScopeFilter } = await import("./founder-context-3X5JFEQQ.js");
       const founderFilter = founderScopeFilter(opts.founderId);
       const cleaned = founderFilter.sql.replace(/^\s*AND\s+/, "");
       conditions.push(cleaned);
@@ -5442,7 +5442,7 @@ async function verifyPaneAtCapacity(sessionName) {
       reason: `capture-pane failed: ${err instanceof Error ? err.message : String(err)}`
     };
   }
-  const { isAtCapacity } = await import("./capacity-monitor-TIKUMNDU.js");
+  const { isAtCapacity } = await import("./capacity-monitor-RKLRCGOG.js");
   if (!isAtCapacity(pane)) {
     return {
       atCapacity: false,
@@ -5749,7 +5749,7 @@ async function countScopedPendingReviews(targetSession, reviewer) {
 }
 async function countScopedOpenTasks(targetSession, agentId) {
   try {
-    const { fastDbInit } = await import("./fast-db-init-6MQDCHEB.js");
+    const { fastDbInit } = await import("./fast-db-init-YRCNKGFD.js");
     const client = await fastDbInit();
     const scope = extractRootExe(targetSession);
     if (!scope) return 0;
@@ -5806,7 +5806,7 @@ function buildScopedInProgressTaskQuery(targetSession) {
 async function findScopedInProgressTaskId(targetSession) {
   const q = buildScopedInProgressTaskQuery(targetSession);
   if (!q) return null;
-  const { fastDbInit } = await import("./fast-db-init-6MQDCHEB.js");
+  const { fastDbInit } = await import("./fast-db-init-YRCNKGFD.js");
   const client = await fastDbInit();
   const result = await client.execute(q);
   const id = result.rows[0]?.id;
@@ -5927,7 +5927,7 @@ function sendIntercom(targetSession, opts) {
   const ledgerEnv = (process.env.EXE_NOTIFICATION_LEDGER ?? "").trim().toLowerCase();
   if (ledgerEnv === "shadow") {
     const ledgerScope = opts && "callerSessionScope" in opts ? opts.callerSessionScope : void 0;
-    void import("./notification-ledger-2GIT6AZ7.js").then((m) => m.recordShadowNudge(targetSession, reason, ledgerScope, { force: opts?.force })).catch(() => {
+    void import("./notification-ledger-BYBU427R.js").then((m) => m.recordShadowNudge(targetSession, reason, ledgerScope, { force: opts?.force })).catch(() => {
     });
   }
   if (!opts?.force && isDebounced(targetSession)) {
@@ -6081,7 +6081,7 @@ function scheduleDeferredSpawnNudge(input) {
             return;
           }
           queueIntercom(input.sessionName, `spawn nudge failed after ${attempt} attempts: ${msg}`, "signal");
-          void import("./notifications-LHDV4WKP.js").then(({ writeNotification: writeNotification2 }) => writeNotification2({
+          void import("./notifications-7EBPEORY.js").then(({ writeNotification: writeNotification2 }) => writeNotification2({
             agentId: getCoordinatorName(),
             agentRole: "COO",
             event: "error_spike",
@@ -6176,7 +6176,7 @@ async function sendIntercomAsync(targetSession, opts) {
   let ledgerClaim = null;
   if (authoritativeLedger) {
     try {
-      const { claimAuthoritativeNudge } = await import("./notification-ledger-2GIT6AZ7.js");
+      const { claimAuthoritativeNudge } = await import("./notification-ledger-BYBU427R.js");
       const claim2 = await claimAuthoritativeNudge(
         targetSession,
         reason,
@@ -6199,7 +6199,7 @@ async function sendIntercomAsync(targetSession, opts) {
   const markLedgerDelivered = async () => {
     if (!ledgerClaim) return;
     try {
-      const { markNudgeDelivered } = await import("./notification-ledger-2GIT6AZ7.js");
+      const { markNudgeDelivered } = await import("./notification-ledger-BYBU427R.js");
       await markNudgeDelivered(ledgerClaim.id, ledgerClaim.sessionScope);
     } catch {
     }
@@ -6207,7 +6207,7 @@ async function sendIntercomAsync(targetSession, opts) {
   const markLedgerFailed = async (error) => {
     if (!ledgerClaim) return;
     try {
-      const { markNudgeDeliveryFailed } = await import("./notification-ledger-2GIT6AZ7.js");
+      const { markNudgeDeliveryFailed } = await import("./notification-ledger-BYBU427R.js");
       await markNudgeDeliveryFailed(ledgerClaim.id, error, ledgerClaim.sessionScope);
     } catch {
     }

package/dist/{chunk-GPB6X2OI.js → chunk-YBUSK4GH.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 
 // src/lib/token-budget.ts
 var WARN_THRESHOLD = 0.8;

package/dist/{chunk-5M4UNU6O.js → chunk-YLY66VLU.js}

@@ -1,13 +1,13 @@
 import {
   isExeSession
-} from "./chunk-V4RIHICU.js";
+} from "./chunk-Y2DTTZCV.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-OGJCUMSM.js";
+} from "./chunk-2YESHX5N.js";
 import {
   getClient,
   isCoordinatorName
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 import {
   isDaemonAlive
 } from "./chunk-QH5ZQ5SJ.js";

package/dist/{chunk-ZSFFCRVI.js → chunk-YPSS2SHD.js}

@@ -140,7 +140,7 @@ async function assertManifestSignature(manifest, publicKeyPem) {
       "manifest carries no `signature`. Fleets that enforce EXE_STACK_PUBLIC_KEY reject unsigned manifests, so publishing one would ship a release no host can install. Re-sign with the custodied key: node scripts/sign-stack-manifest.mjs deploy/stack-manifests/v0.9.json"
     );
   }
-  const { verifyStackManifestSignature } = await import("./stack-update-H3YXPL7Z.js");
+  const { verifyStackManifestSignature } = await import("./stack-update-JHPGK6AM.js");
   try {
     verifyStackManifestSignature(manifest, publicKeyPem);
   } catch (err) {
@@ -1008,7 +1008,7 @@ async function runRegistryProxy(options = registryProxyOptionsFromEnv()) {
   await new Promise((resolve) => server.listen(options.port, options.host, resolve));
   console.log(`exe-registry-proxy listening on ${options.host ?? "0.0.0.0"}:${options.port}`);
   console.log(`proxying /v2/${options.allowedNamespace ?? "askexe"}/* -> ${options.upstream ?? "https://ghcr.io"}`);
-  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-YCV3GMHN.js");
+  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-4GBRQ3NQ.js");
   const syncConfig = licenseSyncConfigFromEnv();
   if (syncConfig) {
     startLicenseSyncScheduler(syncConfig);

package/dist/{chunk-SSGIMXA6.js → chunk-YYPHTYOV.js}

@@ -1,16 +1,16 @@
 import {
   extractMemoryGraph
-} from "./chunk-UALXBUDX.js";
+} from "./chunk-2DDXCN4A.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-V4JWFJZR.js";
+} from "./chunk-P4C3BX2L.js";
 import {
   extractKeywords
 } from "./chunk-CHCA3ZM2.js";
 import {
   getActiveAgent
-} from "./chunk-RPOIKNJZ.js";
+} from "./chunk-C44UWID5.js";
 
 // src/mcp/tools/import-conversations.ts
 import { z } from "zod";

package/dist/{chunk-OWPOJ6OG.js → chunk-ZBUUFS5G.js}

@@ -4,7 +4,7 @@ import {
 import {
   flushBatch,
   writeMemory
-} from "./chunk-V4JWFJZR.js";
+} from "./chunk-P4C3BX2L.js";
 import {
   SUPPORT_PRODUCTS,
   isWellFormedCommit,

package/dist/{chunk-6OQ2TRZK.js → chunk-ZFDQJVKH.js}

@@ -19,7 +19,7 @@ import {
 } from "./chunk-RT57D7C4.js";
 import {
   loadLicense
-} from "./chunk-6VMVQ3G7.js";
+} from "./chunk-GTW56AUB.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync as spawnSync2 } from "child_process";
@@ -4749,7 +4749,13 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         composeFile: options.composeFile,
         envFile: options.envFile,
         stackVersion: plan.targetVersion,
-        expectedArtifacts
+        expectedArtifacts,
+        // A signed retain-compose update deliberately changes only its selected
+        // container(s). The full-project artifact check would classify a
+        // pre-existing companion on an older digest as this service's failed
+        // delivery. Retained health and image witnesses still cover the selected
+        // service and its required dependencies before and after the update.
+        artifactComposeServices: options.retainCompose ? Object.entries(plan.release.services).flatMap(([name, service]) => expandComposeServicesWithSidecars([service.composeService ?? name])) : void 0
       });
       const securityFailures = [];
       for (const r of verifyReport.results) {