@askexenow/exe-os 0.9.404 → 0.9.406

package/dist/{chunk-KRNF2TTT.js → chunk-7A3N2XWF.js}

@@ -2,10 +2,10 @@ import {
   BUSY_PATTERN,
   sendIntercom,
   updateTaskStatus
-} from "./chunk-56XINHPT.js";
+} from "./chunk-YCYGRLHE.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-MKO45WBR.js";
+} from "./chunk-XT3F5L5L.js";
 import {
   hasPassed
 } from "./chunk-YRUZK2QA.js";
@@ -13,7 +13,7 @@ import {
   baseAgentName,
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 import {
   isAutonomousTmuxSpawnEnabled
 } from "./chunk-MMS2HBRT.js";
@@ -338,7 +338,7 @@ async function surfaceStaleDispatchPendingSignals(scopeList, now, thresholdMs =
     const sessionScope = signalScope ?? (scopeList.length === 1 ? scopeList[0] : null);
     if (allowedScopes.size > 0 && sessionScope && !allowedScopes.has(sessionScope)) continue;
     try {
-      const { writeNotification } = await import("./notifications-WJY5SFDV.js");
+      const { writeNotification } = await import("./notifications-6CSSHZZ5.js");
       await writeNotification({
         agentId: getCoordinatorName(),
         agentRole: "COO",

package/dist/{chunk-ZXMNWYAU.js → chunk-7RMVD2NO.js}

@@ -8,14 +8,14 @@ import {
   resolveExeSession,
   sendIntercom,
   strictSessionScopeFilter
-} from "./chunk-56XINHPT.js";
+} from "./chunk-YCYGRLHE.js";
 import {
   parseMessage,
   serializeMessage
 } from "./chunk-TDF2XKLK.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-MKO45WBR.js";
+} from "./chunk-XT3F5L5L.js";
 import {
   isValidSessionScope
 } from "./chunk-BTSWFMEH.js";
@@ -24,7 +24,7 @@ import {
 } from "./chunk-CVYC6DUW.js";
 import {
   getClient
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 
 // src/lib/messaging.ts
 import crypto from "crypto";

package/dist/{chunk-Y3CXCRCP.js → chunk-A2BKB5UO.js}

@@ -4,7 +4,7 @@ import {
   getGitRootAsync,
   isWorktreeDirty,
   isWorktreeDirtyAsync
-} from "./chunk-SI7JLNKV.js";
+} from "./chunk-CHD3GX2O.js";
 
 // src/lib/worktree-sweep.ts
 import { execFile } from "child_process";

package/dist/{chunk-3ACGTDYH.js → chunk-A4PBEANG.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 import {
   loadConfig
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-S4SSKW2Q.js → chunk-A6KO4CQG.js}

@@ -1,21 +1,21 @@
 import {
   cleanupCardsForMemories,
   cleanupGraphLinksForMemories
-} from "./chunk-XB5G7WB3.js";
+} from "./chunk-RRCKPDTV.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-VGMACSEV.js";
 import {
   buildSystemStateExclusionFilter,
   vectorToBlob
-} from "./chunk-MXEEMTCV.js";
+} from "./chunk-A6VEQ6S4.js";
 import {
   extractKeywords,
   keywordsToString
 } from "./chunk-CHCA3ZM2.js";
 import {
   isCoordinatorName
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 
 // src/lib/consolidation.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-MXEEMTCV.js → chunk-A6VEQ6S4.js}

@@ -1,6 +1,6 @@
 import {
   WORK_STATE_HEARTBEAT_TOOL
-} from "./chunk-KVZB65B5.js";
+} from "./chunk-25UCPYAO.js";
 import {
   extractKeywords,
   keywordsToString
@@ -11,7 +11,7 @@ import {
 import {
   findScopedDuplicate,
   governMemoryRecord
-} from "./chunk-4RFLBGOW.js";
+} from "./chunk-PB3RGTSP.js";
 import {
   orgBus
 } from "./chunk-MP2AFCGL.js";
@@ -22,12 +22,12 @@ import {
   initPostgresOnlyDatabase,
   initTurso,
   isDaemonRoutingActive
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 import {
   buildMemoryInsert,
   persistMemoryBatch,
   readMemoryWriteOutcome
-} from "./chunk-BU4NQU5R.js";
+} from "./chunk-YYBQTE3P.js";
 import {
   memoryWriteScope,
   sameMemoryWriteScope
@@ -43,7 +43,7 @@ import {
 } from "./chunk-C7GHNJPW.js";
 import {
   getMasterKey
-} from "./chunk-ZHHGFNTZ.js";
+} from "./chunk-SYFE7PBI.js";
 import {
   loadConfig
 } from "./chunk-MMS2HBRT.js";
@@ -93,7 +93,7 @@ function recordShardFailure(project, error) {
       `[store] Shard circuit OPEN for "${project}" after ${state.failures} consecutive failures. Will retry in ${SHARD_CB_COOLDOWN_MS / 6e4}min. Last error: ${error}
 `
     );
-    void import("./orchestration-events-CV72DYKD.js").then(({ recordOrchestrationEventBestEffort }) => {
+    void import("./orchestration-events-MYAH33OA.js").then(({ recordOrchestrationEventBestEffort }) => {
       recordOrchestrationEventBestEffort({
         eventType: "shard.circuit_open",
         source: "store.recordShardFailure",
@@ -185,7 +185,7 @@ async function initStore(options) {
   if (!options?.lightweight) {
     try {
       if (process.env.EXE_DISABLE_SHARDING !== "1") {
-        const { initShardManager } = await import("./shard-manager-TKAQSRYN.js");
+        const { initShardManager } = await import("./shard-manager-ITVBXLXP.js");
         initShardManager(hexKey);
       }
     } catch (e) {
@@ -198,7 +198,7 @@ async function initStore(options) {
     );
     _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
     try {
-      const { loadGlobalProcedures } = await import("./global-procedures-NJ7UXIBT.js");
+      const { loadGlobalProcedures } = await import("./global-procedures-M4K6TISF.js");
       await loadGlobalProcedures();
     } catch (e) {
       logStoreWarn("catch", e);
@@ -319,7 +319,7 @@ async function writeMemory(record) {
     founder_id: record.founder_id ?? null
   };
   try {
-    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-WL4GVB6K.js");
+    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-WEX53U5V.js");
     const poisonResult = await checkMemoryPoisoning({
       memoryId: dbRow.id,
       vector: Array.isArray(dbRow.vector) ? dbRow.vector : void 0,
@@ -378,19 +378,19 @@ async function flushPendingBatch() {
   }
   if (eligibleBatch.length > 0) {
     try {
-      const { insertMemoryCardsForBatch } = await import("./memory-cards-DR6VSUXF.js");
+      const { insertMemoryCardsForBatch } = await import("./memory-cards-THYXT7PF.js");
       await insertMemoryCardsForBatch(eligibleBatch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { insertOntologyForBatch } = await import("./agentic-ontology-7G44A5LE.js");
+      const { insertOntologyForBatch } = await import("./agentic-ontology-AC52XJTV.js");
       await insertOntologyForBatch(eligibleBatch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { extractGraphForBatch } = await import("./memory-graph-extractor-T4IT4I65.js");
+      const { extractGraphForBatch } = await import("./memory-graph-extractor-U5LOICH5.js");
       await extractGraphForBatch(eligibleBatch);
     } catch (e) {
       logStoreWarn("catch", e);
@@ -398,7 +398,7 @@ async function flushPendingBatch() {
   }
   _lastFlushShardFailures = [];
   try {
-    const { isShardingEnabled, getReadyShardClient } = await import("./shard-manager-TKAQSRYN.js");
+    const { isShardingEnabled, getReadyShardClient } = await import("./shard-manager-ITVBXLXP.js");
     if (process.env.EXE_DISABLE_SHARDING !== "1" && isShardingEnabled()) {
       const byProject = /* @__PURE__ */ new Map();
       let skippedUnknown = 0;
@@ -577,7 +577,7 @@ async function searchMemories(queryVector, agentId, options) {
   let client;
   let isMainDb = true;
   try {
-    const { isShardingEnabled, shardExists, getReadyShardClient } = await import("./shard-manager-TKAQSRYN.js");
+    const { isShardingEnabled, shardExists, getReadyShardClient } = await import("./shard-manager-ITVBXLXP.js");
     if (!options?.strictSessionScope && isShardingEnabled() && options?.projectName && shardExists(options.projectName)) {
       client = await getReadyShardClient(options.projectName);
       isMainDb = false;
@@ -616,7 +616,7 @@ async function searchMemories(queryVector, agentId, options) {
     args.push(activeEmbeddingModel);
   }
   try {
-    const { founderScopeFilter } = await import("./founder-context-3QW7IIRX.js");
+    const { founderScopeFilter } = await import("./founder-context-JJQQYKBG.js");
     const founderFilter = founderScopeFilter(options?.founderId);
     sql += founderFilter.sql;
     args.push(...founderFilter.args.filter((a) => a !== null));
@@ -700,7 +700,7 @@ async function searchMemories(queryVector, agentId, options) {
     source_type: row.source_type ?? null,
     strength: row.strength ?? 1
   }));
-  const { filterWikiRecallResults } = await import("./wiki-acl-B5CI5FVD.js");
+  const { filterWikiRecallResults } = await import("./wiki-acl-MHNUVAKY.js");
   return filterWikiRecallResults(mapped, agentId);
 }
 async function attachDocumentMetadata(records) {

package/dist/{chunk-3HDUO5XG.js → chunk-AEQGEUWL.js}

@@ -3,14 +3,14 @@ import {
 } from "./chunk-IZWMWJZT.js";
 import {
   isGhostBehaviorRow
-} from "./chunk-L3L4KCBJ.js";
+} from "./chunk-B6O2B4JY.js";
 import {
   IdentityConflictError,
   getClient,
   getIdentity,
   listIdentities,
   updateIdentity
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 import {
   atomicWriteJsonSync
 } from "./chunk-HSGBZSCA.js";

package/dist/{chunk-L3L4KCBJ.js → chunk-B6O2B4JY.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-ZD5TZZXU.js";
 import {
   vectorToSqlLiteral
-} from "./chunk-MXEEMTCV.js";
+} from "./chunk-A6VEQ6S4.js";
 import {
   blobToVector
 } from "./chunk-OTVEIJUQ.js";
 import {
   getClient,
   sanitizeBehaviorContent
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 
 // src/lib/behaviors.ts
 import crypto from "crypto";

package/dist/{chunk-FVEAYEMK.js → chunk-BAITBKRT.js}

@@ -14,10 +14,10 @@ import {
 import {
   buildClaudeHttpMcpEntry,
   buildClaudeStdioProxyMcpEntry
-} from "./chunk-ID3KTUXS.js";
+} from "./chunk-KLGMX5R3.js";
 import {
   ensureAllAgentSymlinks
-} from "./chunk-W76IFXGP.js";
+} from "./chunk-OV7JDJBL.js";
 import {
   MCP_LEGACY_KEY,
   MCP_PRIMARY_KEY
@@ -977,7 +977,7 @@ async function runInstaller(homeDir) {
     );
   }
   try {
-    const { generateAgentDefs, summarizeAgentDefResults } = await import("./agent-defs-generator-23FGUXVO.js");
+    const { generateAgentDefs, summarizeAgentDefResults } = await import("./agent-defs-generator-RB7LTDQS.js");
     const defResults = generateAgentDefs({ homeDir: resolvedHome });
     process.stderr.write(`Agent definitions: ${summarizeAgentDefResults(defResults)}
 `);

package/dist/{chunk-WH2TTW4G.js → chunk-BJJLXP6P.js}

@@ -4,10 +4,10 @@ import {
   extractIdentifiers,
   isGarbageEntity,
   normalizeEntityName
-} from "./chunk-XB5G7WB3.js";
+} from "./chunk-RRCKPDTV.js";
 import {
   getClient
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 
 // src/lib/memory-graph-extractor.ts
 function relationshipId(sourceId, targetId, relType) {
@@ -432,7 +432,7 @@ async function upsertMemoryGraph(result, memoryId, opts) {
     });
   }
   try {
-    const { createCoOccurrenceEdges } = await import("./co-occurrence-XQZZCRWV.js");
+    const { createCoOccurrenceEdges } = await import("./co-occurrence-4BP7PVIF.js");
     await createCoOccurrenceEdges(result.entities, memoryId, { linkOnly });
   } catch {
   }

package/dist/{chunk-ZM22ANTG.js → chunk-C4IHTLDE.js}

@@ -3,20 +3,22 @@ import { existsSync, readFileSync } from "fs";
 import { homedir } from "os";
 import path from "path";
 function readBuildIdentity(pkgRoot) {
-  let version;
+  let pkgVersion;
   try {
     const pkgPath = path.join(pkgRoot, "package.json");
     const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-    version = typeof pkg.version === "string" && pkg.version ? pkg.version : "unknown";
+    pkgVersion = typeof pkg.version === "string" && pkg.version ? pkg.version : "unknown";
   } catch {
     return null;
   }
+  let version = pkgVersion;
   let commit = "unknown";
   let buildTime = "unknown";
   try {
     const infoPath = path.join(pkgRoot, "dist", "build-info.json");
     if (existsSync(infoPath)) {
       const info = JSON.parse(readFileSync(infoPath, "utf-8"));
+      if (typeof info.version === "string" && info.version) version = info.version;
       if (typeof info.commit === "string" && info.commit) commit = info.commit;
       if (typeof info.buildTime === "string" && info.buildTime) buildTime = info.buildTime;
     }
@@ -120,6 +122,72 @@ function formatRuntimeUnverifiedBriefLine(result, surfaceLabel = result.surface)
   }
   return line;
 }
+var EXE_HOOK_TARGET = /[\\/]dist[\\/]hooks[\\/]/;
+function collectDistinctHookRoots(probes) {
+  const roots = /* @__PURE__ */ new Set();
+  for (const probe of probes) {
+    if (probe.runtime !== "claude" || !probe.target) continue;
+    if (!EXE_HOOK_TARGET.test(probe.target)) continue;
+    roots.add(pkgRootFromHookTarget(probe.target));
+  }
+  return [...roots];
+}
+function compareAllHookRoots(roots, installed) {
+  if (roots.length === 0) {
+    return [compareRuntimeIdentity("hooks", null, installed)];
+  }
+  return roots.map((root) => compareRuntimeIdentity("hooks", readBuildIdentity(root), installed));
+}
+function runningIdentityKey(result) {
+  if (!result.running) return null;
+  return `${result.running.root}|${result.running.version}|${result.running.commit}`;
+}
+function groupByRunningIdentity(items) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = runningIdentityKey(item.result);
+    if (key === null) continue;
+    const group = groups.get(key);
+    if (group) group.push(item);
+    else groups.set(key, [item]);
+  }
+  return [...groups.values()];
+}
+function mergedLabel(group) {
+  if (group.length === 1) return group[0].label;
+  if (group.length === 2 && group.some((g) => g.label === "hooks") && group.some((g) => g.label === "daemon")) {
+    return "both";
+  }
+  return group.map((g) => g.label).join("+");
+}
+var MAX_DRIFT_ROOTS_SHOWN = 2;
+function formatRuntimeDriftBootLines(hookResults, daemonResult) {
+  const warnings = [];
+  const multiHooks = hookResults.length > 1;
+  const labeled = [
+    ...hookResults.map((result, i) => ({ label: multiHooks ? `hooks#${i + 1}` : "hooks", result })),
+    { label: "daemon", result: daemonResult }
+  ];
+  const driftItems = labeled.filter((item) => item.result.status === "drift");
+  const distinctDriftingRoots = new Set(driftItems.map((item) => item.result.running.root)).size;
+  if (distinctDriftingRoots > MAX_DRIFT_ROOTS_SHOWN) {
+    const installedVersion = driftItems[0]?.result.installed?.version ?? "unknown";
+    let line = `\u{1F534} RUNTIME DRIFT: ${distinctDriftingRoots} build roots differ from installed ${installedVersion}`;
+    if (briefDisplayWidth(line) > BRIEF_LINE_MAX_WIDTH) line = clampMiddle(line, BRIEF_LINE_MAX_WIDTH);
+    warnings.push(line);
+  } else {
+    for (const group of groupByRunningIdentity(driftItems)) {
+      const lines = formatRuntimeDriftBriefLines(group[0].result, mergedLabel(group));
+      if (lines) warnings.push(...lines);
+    }
+  }
+  const unverifiedItems = labeled.filter((item) => item.result.status === "unknown" && item.result.unverified);
+  for (const group of groupByRunningIdentity(unverifiedItems)) {
+    const line = formatRuntimeUnverifiedBriefLine(group[0].result, mergedLabel(group));
+    if (line) warnings.push(line);
+  }
+  return warnings;
+}
 
 export {
   readBuildIdentity,
@@ -128,5 +196,8 @@ export {
   formatRuntimeDriftWarning,
   BRIEF_LINE_MAX_WIDTH,
   formatRuntimeDriftBriefLines,
-  formatRuntimeUnverifiedBriefLine
+  formatRuntimeUnverifiedBriefLine,
+  collectDistinctHookRoots,
+  compareAllHookRoots,
+  formatRuntimeDriftBootLines
 };

package/dist/{chunk-ZG3ZXYKX.js → chunk-C6O7VUD5.js}

@@ -1,15 +1,15 @@
 import {
   getActiveAgent
-} from "./chunk-LCC7SS6F.js";
+} from "./chunk-X4XUAFT3.js";
 import {
   listTasks
-} from "./chunk-56XINHPT.js";
+} from "./chunk-YCYGRLHE.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 
 // src/mcp/tools/list-tasks.ts
 import { z } from "zod";

package/dist/{chunk-SI7JLNKV.js → chunk-CHD3GX2O.js}

@@ -1,6 +1,6 @@
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-MKO45WBR.js";
+} from "./chunk-XT3F5L5L.js";
 
 // src/lib/worktree.ts
 import { execFile, execFileSync, execSync } from "child_process";

package/dist/{chunk-QEGSRMGV.js → chunk-D32PLDKS.js}

@@ -1,6 +1,6 @@
 import {
   signKeyFingerprint
-} from "./chunk-B42HMZSQ.js";
+} from "./chunk-FIEIIIPY.js";
 import {
   resolveExeDataDir
 } from "./chunk-NPXIS2RY.js";

package/dist/{chunk-UXSLCTCQ.js → chunk-D3NEPZOO.js}

@@ -212,7 +212,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-V64H2645.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-EDZ3ZLWW.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/{chunk-TCGYYUDX.js → chunk-D5U45AMN.js}

@@ -1,14 +1,14 @@
 import {
   deactivateBehavior,
   listBehaviors
-} from "./chunk-L3L4KCBJ.js";
+} from "./chunk-B6O2B4JY.js";
 import {
   IdentityConflictError,
   IdentityLockError,
   getIdentity,
   mutateIdentity,
   withIdentityLock
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 
 // src/lib/behavior-promotion.ts
 var PROMOTED_SECTION_HEADING = "## Promoted lessons (permanent \u2014 promoted from behaviours)";

package/dist/{chunk-3RQHJYRK.js → chunk-DLA4S5CY.js}

@@ -3,13 +3,13 @@ import {
   getClient,
   isInitialized,
   loadEmployees
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 import {
   checkLicense,
   isFeatureAllowed,
   readPersonalFreeGrandfatherState,
   resolveClientLimits
-} from "./chunk-OAYFVKNM.js";
+} from "./chunk-XPRLWIKS.js";
 import {
   PLAN_LIMITS
 } from "./chunk-3R7UDPVR.js";

package/dist/{chunk-LRRPSQ25.js → chunk-DPILHOZN.js}

@@ -19,7 +19,7 @@ import {
 } from "./chunk-RT57D7C4.js";
 import {
   loadLicense
-} from "./chunk-OAYFVKNM.js";
+} from "./chunk-XPRLWIKS.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync as spawnSync2 } from "child_process";
@@ -32,6 +32,12 @@ import path from "path";
 import { fileURLToPath } from "url";
 import { parseDocument as parseYamlDocument } from "yaml";
 
+// src/lib/askexe-image-prefixes.ts
+var ASKEXE_IMAGE_PREFIXES = ["ghcr.io/askexe/", "update.askexe.com/askexe/"];
+function isAskExeHostedImageRef(trimmedImage) {
+  return ASKEXE_IMAGE_PREFIXES.some((p) => trimmedImage.startsWith(p));
+}
+
 // src/lib/erp-asset-smoke.ts
 var REQUIRED_DESK_BUNDLES = {
   "desk.bundle.js": "javascript",
@@ -914,6 +920,15 @@ function findSsoUngatedIngressHostnames(configYml) {
   }
   return offenders;
 }
+function readCfIngressConfigYml(composeFile) {
+  const cfIngressConfigPath = path.join(path.dirname(composeFile), "cloudflared", "config.yml");
+  try {
+    return readFileSync(cfIngressConfigPath, "utf8");
+  } catch (err) {
+    if (err instanceof Error && err.code === "ENOENT") return null;
+    throw err;
+  }
+}
 function verifySsoGatedIngressRouting(configYml) {
   if (!configYml || configYml.trim() === "") return;
   const unmodelled = findUnauditableIngressSyntax(configYml);
@@ -2011,7 +2026,7 @@ function imageTag(image) {
 }
 function isThirdPartyImage(image) {
   const trimmed = image.trim().replace(/^['"]|['"]$/g, "");
-  return trimmed !== "" && !trimmed.startsWith("ghcr.io/askexe/") && !trimmed.startsWith("update.askexe.com/askexe/");
+  return trimmed !== "" && !isAskExeHostedImageRef(trimmed);
 }
 function stripImageDigest(image) {
   return image.replace(/@sha256:[a-f0-9]{64}$/i, "");
@@ -4260,6 +4275,15 @@ ${lines.join("\n")}`
         `[stack-update] (dry run) ${SSO_EDGE_SERVICE} config delivery could not be verified: ${ssoOutcome.problem ?? "unknown"}. Planning continues; a real update would REFUSE at this point.`
       );
     }
+    try {
+      verifySsoGatedIngressRouting(readCfIngressConfigYml(options.composeFile));
+    } catch (routingErr) {
+      if (!options.dryRun) throw routingErr;
+      const reason = routingErr instanceof Error ? routingErr.message : String(routingErr);
+      console.warn(
+        `[stack-update] (dry run) SSO-gated ingress routing could not be verified: ${reason}. Planning continues; a real update would REFUSE at this point.`
+      );
+    }
     return { status: "planned", targetVersion: plan.targetVersion, changes: plan.changes, lockFile };
   }
   if (!options.skipImageAvailabilityCheck) {
@@ -4846,8 +4870,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       }
     }
     {
-      const cfIngressConfigPath = path.join(path.dirname(options.composeFile), "cloudflared", "config.yml");
-      const cfIngressConfigYml = existsSync(cfIngressConfigPath) ? readFileSync(cfIngressConfigPath, "utf8") : null;
+      const cfIngressConfigYml = readCfIngressConfigYml(options.composeFile);
       await verifyIngressTargetsReachable(
         cfIngressConfigYml,
         defaultIngressReachabilityProbe,

package/dist/{chunk-SHGAH24B.js → chunk-DZLT22F7.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-YWH7XWOX.js";
+} from "./chunk-FTAMGND3.js";
 
 // src/lib/skill-usage.ts
 async function recordBehaviorsConsulted(behaviorIds) {

package/dist/{chunk-MMQH7AM7.js → chunk-EN3H4DWX.js}

@@ -4,7 +4,7 @@ import {
 import {
   flushBatch,
   writeMemory
-} from "./chunk-MXEEMTCV.js";
+} from "./chunk-A6VEQ6S4.js";
 import {
   SUPPORT_PRODUCTS,
   isWellFormedCommit,

package/dist/{chunk-QILKDHJ7.js → chunk-ESSGNQHO.js}

@@ -1,10 +1,10 @@
 import {
   exportRawPublicKey,
   privateKeyFromScalar
-} from "./chunk-DLJSC6YA.js";
+} from "./chunk-KUHIE54S.js";
 import {
   getMasterKey
-} from "./chunk-ZHHGFNTZ.js";
+} from "./chunk-SYFE7PBI.js";
 
 // src/lib/partner-seal-identity.ts
 import crypto from "crypto";

package/dist/{chunk-AAAJKHJM.js → chunk-EUH53QWR.js}

@@ -3,25 +3,25 @@ import {
 } from "./chunk-W4H2MZAS.js";
 import {
   resolvePartnerIdentities
-} from "./chunk-HC7GQZLN.js";
+} from "./chunk-JIIG7QSB.js";
 import {
   OrgKeyPinConflictError,
   orgKeyPinConfirmation,
   pinOrgKey,
   readOrgKeyPin
-} from "./chunk-QEGSRMGV.js";
+} from "./chunk-D32PLDKS.js";
 import {
   displayFingerprint,
   ed25519PrivateKeyFromSeed,
   signKeyFingerprint
-} from "./chunk-B42HMZSQ.js";
+} from "./chunk-FIEIIIPY.js";
 import {
   establishOrgMode,
   upsertOrgMembership
-} from "./chunk-4XFVEIPV.js";
+} from "./chunk-KWKITPBK.js";
 import {
   isValidX25519Recipient
-} from "./chunk-DLJSC6YA.js";
+} from "./chunk-KUHIE54S.js";
 
 // src/lib/org-join.ts
 import { createHash, sign } from "crypto";