@askexenow/exe-os 0.9.410 → 0.9.412

package/dist/{backup-verify-AOTKX5DA.js → chunk-T3AM52YT.js}

@@ -1,24 +1,19 @@
 import {
   getLatestBackup,
   reasonFromBackupName
-} from "./chunk-E2346GKI.js";
+} from "./chunk-SINIRUYZ.js";
 import {
   recordDbOpen
 } from "./chunk-5YEUPUV4.js";
-import "./chunk-YYB5PMTK.js";
-import "./chunk-MMS2HBRT.js";
-import "./chunk-RH4AH3YB.js";
-import "./chunk-HSGBZSCA.js";
-import "./chunk-JKKZGDLP.js";
-import "./chunk-MLKGABMK.js";
 
 // src/lib/backup-verify.ts
 import { createClient } from "@libsql/client";
 import { existsSync, realpathSync } from "fs";
-import { copyFile, mkdtemp, readdir, lstat, rm, writeFile, readFile } from "fs/promises";
-import { createHash } from "crypto";
+import { copyFile, mkdtemp, readdir, lstat, rm, writeFile, readFile, rename } from "fs/promises";
+import { createHash, randomBytes } from "crypto";
 import { tmpdir } from "os";
 import path from "path";
+import { fileURLToPath } from "url";
 var MANIFEST_SCHEMA_VERSION = 1;
 var DEFAULT_DRIFT_ALLOWANCE = 1e5;
 var BACKUP_OPEN_PROBE_SQL = "SELECT name FROM sqlite_master LIMIT 1";
@@ -134,6 +129,213 @@ async function runQuickCheckOnArtifact(client) {
     return { status: "failed", detail: `quick_check could not run: ${errMsg(err)}` };
   }
 }
+async function runArtifactChecks(client) {
+  try {
+    await client.execute(BACKUP_OPEN_PROBE_SQL);
+    const quickCheck = await runQuickCheckOnArtifact(client);
+    if (quickCheck.status !== "ok") {
+      return { kind: "unreadable", detail: `the COPIED artifact FAILED PRAGMA quick_check: ${quickCheck.detail}` };
+    }
+    const schemaTables = await collectSchemaTables(client);
+    const tables = await collectCounts(client, schemaTables.map((t) => t.name));
+    return { kind: "ok", schemaTables, tables };
+  } catch (err) {
+    return { kind: "unreadable", detail: `the COPIED artifact could not be read back: ${errMsg(err)}` };
+  }
+}
+async function runVerifyChecks(client) {
+  try {
+    await client.execute(BACKUP_OPEN_PROBE_SQL);
+  } catch (err) {
+    return { kind: "open-failed", detail: errMsg(err) };
+  }
+  const integrity = await runIntegrityCheck(client);
+  if (integrity.status !== "ok") {
+    return {
+      kind: "integrity",
+      status: integrity.status,
+      quickCheck: integrity.quickCheck,
+      cipherIntegrityCheck: integrity.cipherIntegrityCheck
+    };
+  }
+  try {
+    const schemaTables = await collectSchemaTables(client);
+    const tables = await collectCounts(client, schemaTables.map((t) => t.name));
+    return {
+      kind: "ok",
+      quickCheck: integrity.quickCheck,
+      cipherIntegrityCheck: integrity.cipherIntegrityCheck,
+      schemaTables,
+      tables
+    };
+  } catch (err) {
+    return { kind: "error", detail: errMsg(err) };
+  }
+}
+var BACKUP_VERIFY_WORKER_TIMEOUT_MS = 20 * 60 * 1e3;
+var BACKUP_VERIFY_WORKER_MISSING_TAG = "[backup-verify] WORKER MISSING \u2014 verification running on main thread";
+var BACKUP_VERIFY_WORKER_REPLY_REJECTED_TAG = "[backup-verify] WORKER REPLY REJECTED \u2014 verdict not-checked";
+function reportBackupVerifyWorkerMissing(context, reason) {
+  try {
+    process.stderr.write(
+      `${BACKUP_VERIFY_WORKER_MISSING_TAG} (${context}): ${reason} \u2014 check tsup entry lib/backup-verify-worker
+`
+    );
+  } catch {
+  }
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isStrOrNull(v) {
+  return v === null || typeof v === "string";
+}
+function tableSetProblem(schemaTables, tables) {
+  if (!Array.isArray(schemaTables) || schemaTables.length === 0) return "schemaTables missing or empty";
+  const names = /* @__PURE__ */ new Set();
+  for (const t of schemaTables) {
+    if (!isRecord(t) || typeof t.name !== "string" || !t.name || typeof t.sql !== "string") {
+      return "schemaTables entry malformed";
+    }
+    if (names.has(t.name)) return `schemaTables lists ${t.name} twice`;
+    names.add(t.name);
+  }
+  if (!isRecord(tables)) return "tables missing";
+  const keys = Object.keys(tables);
+  if (keys.length !== names.size || keys.some((k) => !names.has(k))) return "tables keys do not match schemaTables";
+  for (const k of keys) {
+    const n = tables[k];
+    if (typeof n !== "number" || !Number.isInteger(n) || n < 0) return `tables.${k} is not a non-negative integer`;
+  }
+  return null;
+}
+function artifactOutcomeProblem(o) {
+  if (!isRecord(o)) return "outcome missing";
+  if (o.kind === "unreadable") return typeof o.detail === "string" ? null : "unreadable outcome without detail";
+  if (o.kind === "ok") return tableSetProblem(o.schemaTables, o.tables);
+  return `outcome.kind=${String(o.kind)} is not ok|unreadable`;
+}
+function verifyOutcomeProblem(o) {
+  if (!isRecord(o)) return "outcome missing";
+  switch (o.kind) {
+    case "open-failed":
+    case "error":
+      return typeof o.detail === "string" ? null : `${o.kind} outcome without detail`;
+    case "integrity":
+      if (o.status !== "failed" && o.status !== "unreadable") return "integrity outcome with bad status";
+      return isStrOrNull(o.quickCheck) && isStrOrNull(o.cipherIntegrityCheck) ? null : "integrity outcome fields malformed";
+    case "ok":
+      if (typeof o.quickCheck !== "string" || o.quickCheck.toLowerCase() !== "ok") return "ok outcome without quick_check=ok";
+      if (o.cipherIntegrityCheck !== null && (typeof o.cipherIntegrityCheck !== "string" || o.cipherIntegrityCheck.toLowerCase() !== "ok")) {
+        return "ok outcome with a non-ok cipher_integrity_check";
+      }
+      return tableSetProblem(o.schemaTables, o.tables);
+    default:
+      return `outcome.kind=${String(o.kind)} is not a verify outcome`;
+  }
+}
+function validateBackupVerifyWorkerReply(req, msg) {
+  if (!isRecord(msg)) return { ok: false, reason: "reply is not an object" };
+  if (typeof msg.op !== "string") return { ok: false, reason: "reply has no op" };
+  if (typeof msg.pid !== "number" || !Number.isInteger(msg.pid)) return { ok: false, reason: "reply has no pid" };
+  if (msg.op === "error") {
+    return typeof msg.error === "string" ? { ok: true, response: msg } : { ok: false, reason: "error reply without an error string" };
+  }
+  if (msg.op !== req.op) return { ok: false, reason: `worker answered op=${msg.op} for op=${req.op}` };
+  let problem;
+  if (msg.op === "source") problem = typeof msg.verdict === "string" ? null : "source reply without a verdict string";
+  else if (msg.op === "artifact") problem = artifactOutcomeProblem(msg.outcome);
+  else if (msg.op === "verify") problem = verifyOutcomeProblem(msg.outcome);
+  else problem = `unknown op ${msg.op}`;
+  return problem ? { ok: false, reason: problem } : { ok: true, response: msg };
+}
+function backupVerifyOffloadEnabled(env = process.env) {
+  const raw = env.EXE_BACKUP_VERIFY_OFFLOAD;
+  if (raw === "1") return true;
+  if (raw === "0") return false;
+  return env.EXE_IS_DAEMON === "1";
+}
+function resolveBackupVerifyWorker(selfUrl, exists = existsSync) {
+  let selfDir;
+  try {
+    selfDir = path.dirname(fileURLToPath(selfUrl));
+  } catch {
+    return null;
+  }
+  for (const candidate of [
+    path.join(selfDir, "backup-verify-worker.js"),
+    path.join(selfDir, "lib", "backup-verify-worker.js")
+  ]) {
+    if (exists(candidate)) return { path: candidate, execArgv: [] };
+  }
+  const tsEntry = path.join(selfDir, "backup-verify-worker.ts");
+  if (exists(tsEntry)) return { path: tsEntry, execArgv: ["--import", "tsx"] };
+  return null;
+}
+async function runInBackupVerifyWorker(req, opts = {}) {
+  const worker = resolveBackupVerifyWorker(opts.selfUrl ?? import.meta.url);
+  if (!worker) return { ok: false, unavailable: true, reason: "backup-verify-worker entry not found" };
+  let child;
+  try {
+    const { fork } = await import("child_process");
+    child = fork(worker.path, [], {
+      execArgv: worker.execArgv,
+      stdio: ["ignore", "ignore", "inherit", "ipc"],
+      // EXE_IS_DAEMON cleared: the child must never act as the daemon.
+      env: { ...process.env, EXE_IS_DAEMON: "" }
+    });
+  } catch (err) {
+    return { ok: false, unavailable: true, reason: `fork failed: ${errMsg(err)}` };
+  }
+  return await new Promise((resolve) => {
+    let settled = false;
+    const finish = (run) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      resolve(run);
+    };
+    const timeoutMs = opts.timeoutMs ?? BACKUP_VERIFY_WORKER_TIMEOUT_MS;
+    const timer = setTimeout(
+      () => finish({ ok: false, unavailable: false, reason: `timed out after ${timeoutMs}ms` }),
+      timeoutMs
+    );
+    child.once("error", (err) => {
+      finish({ ok: false, unavailable: child.pid === void 0, reason: `worker error: ${errMsg(err)}` });
+    });
+    child.once("close", (code, signal) => {
+      finish({ ok: false, unavailable: false, reason: `worker exited without a result (code=${code}, signal=${signal})` });
+    });
+    child.on("message", (msg) => {
+      if (settled) return;
+      const checked = validateBackupVerifyWorkerReply(req, msg);
+      if (!checked.ok) {
+        try {
+          process.stderr.write(`${BACKUP_VERIFY_WORKER_REPLY_REJECTED_TAG} (op=${req.op}): ${checked.reason}
+`);
+        } catch {
+        }
+        finish({ ok: false, unavailable: false, reason: `worker sent a malformed reply: ${checked.reason}` });
+        return;
+      }
+      const res = checked.response;
+      if (res.op === "error") {
+        finish({ ok: false, unavailable: false, reason: `worker error: ${res.error}` });
+        return;
+      }
+      finish({ ok: true, response: res });
+    });
+    try {
+      child.send({ ...req, parentPid: process.pid });
+    } catch (err) {
+      finish({ ok: false, unavailable: false, reason: `could not send the request: ${errMsg(err)}` });
+    }
+  });
+}
 var SCRATCH_DIR_PREFIX = "exe-bkmanifest-";
 var SCRATCH_DIR_ORPHAN_AGE_MS = 6 * 60 * 60 * 1e3;
 async function sweepOrphanScratchDirs(base = tmpdir(), opts = {}) {
@@ -190,9 +392,23 @@ async function sweepOrphanScratchDirs(base = tmpdir(), opts = {}) {
   }
   return { removed, errors };
 }
+async function writeManifestAtomic(manifestPath, contents) {
+  const tmpPath = `${manifestPath}.${process.pid}-${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    await writeFile(tmpPath, contents, "utf-8");
+    await rename(tmpPath, manifestPath);
+  } catch (err) {
+    try {
+      await rm(tmpPath, { force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
 async function readBackBackupArtifact(backupPath, dbName, opts = {}) {
   let scratch = null;
   let ownedClient = null;
+  let proof = null;
   try {
     let client = opts.client;
     if (!client) {
@@ -226,36 +442,36 @@ async function readBackBackupArtifact(backupPath, dbName, opts = {}) {
         }
       }
       const keyHex = opts.keyHex === void 0 ? await resolveBackupKeyHex() : opts.keyHex;
-      ownedClient = createClient(
-        keyHex ? { url: `file:${scratchDb}`, encryptionKey: keyHex } : { url: `file:${scratchDb}` }
-      );
-      recordDbOpen({ dbPath: scratchDb, source: "backup-verify-scratch", writeCapable: true, checkpointTimer: false });
-      client = ownedClient;
-    }
-    let schemaHash;
-    let tables;
-    try {
-      await client.execute(BACKUP_OPEN_PROBE_SQL);
-      const quickCheck = await runQuickCheckOnArtifact(client);
-      if (quickCheck.status !== "ok") {
-        return {
-          artifact: "unreadable",
-          manifestWritten: false,
-          manifest: null,
-          detail: `the COPIED artifact FAILED PRAGMA quick_check: ${quickCheck.detail}`
-        };
+      const offload = opts.offload ?? backupVerifyOffloadEnabled();
+      if (offload) {
+        const run = await runInBackupVerifyWorker({ op: "artifact", dbPath: scratchDb, keyHex: keyHex ?? null });
+        if (run.ok && run.response.op === "artifact") {
+          proof = run.response.outcome;
+        } else if (!run.ok && run.unavailable) {
+          reportBackupVerifyWorkerMissing("artifact read-back", run.reason);
+        } else {
+          return {
+            artifact: "not-checked",
+            manifestWritten: false,
+            manifest: null,
+            detail: `artifact read-back worker did not complete: ${run.ok ? `unexpected reply op=${run.response.op}` : run.reason}`
+          };
+        }
       }
-      const schemaTables = await collectSchemaTables(client);
-      schemaHash = computeSchemaHash(schemaTables);
-      tables = await collectCounts(client, schemaTables.map((t) => t.name));
-    } catch (err) {
-      return {
-        artifact: "unreadable",
-        manifestWritten: false,
-        manifest: null,
-        detail: `the COPIED artifact could not be read back: ${errMsg(err)}`
-      };
+      if (!proof) {
+        ownedClient = createClient(
+          keyHex ? { url: `file:${scratchDb}`, encryptionKey: keyHex } : { url: `file:${scratchDb}` }
+        );
+        recordDbOpen({ dbPath: scratchDb, source: "backup-verify-scratch", writeCapable: true, checkpointTimer: false });
+        client = ownedClient;
+      }
+    }
+    if (!proof) proof = await runArtifactChecks(client);
+    if (proof.kind !== "ok") {
+      return { artifact: "unreadable", manifestWritten: false, manifest: null, detail: proof.detail };
     }
+    const schemaHash = computeSchemaHash(proof.schemaTables);
+    const tables = proof.tables;
     const manifest = {
       schemaVersion: MANIFEST_SCHEMA_VERSION,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -267,7 +483,7 @@ async function readBackBackupArtifact(backupPath, dbName, opts = {}) {
     const rows = Object.values(tables).reduce((n, c) => n + c, 0);
     const readDetail = `artifact read back: ${Object.keys(tables).length} table(s), ${rows} row(s)`;
     try {
-      await writeFile(manifestPathFor(backupPath), JSON.stringify(manifest, null, 2), "utf-8");
+      await writeManifestAtomic(manifestPathFor(backupPath), JSON.stringify(manifest, null, 2));
     } catch (err) {
       return {
         artifact: "readable",
@@ -542,14 +758,50 @@ async function verifyBackup(backupPath, opts = {}) {
         }
       }
     }
-    let client;
-    try {
-      client = createClient(
-        keyHex ? { url: `file:${scratchDb}`, encryptionKey: keyHex } : { url: `file:${scratchDb}` }
-      );
-      recordDbOpen({ dbPath: scratchDb, source: "backup-verify-copy", writeCapable: true, checkpointTimer: false });
-      await client.execute(BACKUP_OPEN_PROBE_SQL);
-    } catch (err) {
+    let outcome = null;
+    if (opts.offload ?? backupVerifyOffloadEnabled()) {
+      const run = await runInBackupVerifyWorker({ op: "verify", dbPath: scratchDb, keyHex: keyHex ?? null });
+      if (run.ok && run.response.op === "verify") {
+        outcome = run.response.outcome;
+      } else if (!run.ok && run.unavailable) {
+        reportBackupVerifyWorkerMissing("verifyBackup", run.reason);
+      } else {
+        res = {
+          ok: false,
+          backup: name,
+          source: "none",
+          integrity: "unreadable",
+          tables: [],
+          reason: "not-checked",
+          detail: `verification worker did not complete; nothing was learned about the backup: ${run.ok ? `unexpected reply op=${run.response.op}` : run.reason}`
+        };
+        if (record) await recordVerdict(res);
+        return res;
+      }
+    }
+    if (!outcome) {
+      let client = null;
+      try {
+        client = createClient(
+          keyHex ? { url: `file:${scratchDb}`, encryptionKey: keyHex } : { url: `file:${scratchDb}` }
+        );
+        recordDbOpen({ dbPath: scratchDb, source: "backup-verify-copy", writeCapable: true, checkpointTimer: false });
+      } catch (err) {
+        outcome = { kind: "open-failed", detail: errMsg(err) };
+      }
+      if (client) {
+        try {
+          outcome = await runVerifyChecks(client);
+        } finally {
+          try {
+            client.close?.();
+          } catch {
+          }
+        }
+      }
+    }
+    if (!outcome) throw new Error("verification produced no outcome");
+    if (outcome.kind === "open-failed") {
       res = {
         ok: false,
         backup: name,
@@ -557,48 +809,40 @@ async function verifyBackup(backupPath, opts = {}) {
         integrity: "unreadable",
         tables: [],
         reason: "unreadable",
-        detail: `cannot read backup with configured key${targetManifest?.keyEpoch ? " (manifest key epoch matched; artifact is unreadable/corrupt)" : ""}: ${errMsg(err)}`
+        detail: `cannot read backup with configured key${targetManifest?.keyEpoch ? " (manifest key epoch matched; artifact is unreadable/corrupt)" : ""}: ${outcome.detail}`
       };
       if (record) await recordVerdict(res);
       return res;
     }
-    try {
-      const integrity = await runIntegrityCheck(client);
-      if (integrity.status !== "ok") {
-        res = {
-          ok: false,
-          backup: name,
-          source: "none",
-          integrity: integrity.status,
-          quickCheck: integrity.quickCheck,
-          cipherIntegrityCheck: integrity.cipherIntegrityCheck,
-          tables: [],
-          reason: integrity.status === "unreadable" ? "unreadable" : "integrity",
-          detail: `integrity check ${integrity.status}${integrity.quickCheck ? ` (quick_check=${integrity.quickCheck})` : ""}`
-        };
-        if (record) await recordVerdict(res);
-        return res;
-      }
-      const schemaTables = await collectSchemaTables(client);
-      const schemaHash = computeSchemaHash(schemaTables);
-      const gotCounts = await collectCounts(client, schemaTables.map((t) => t.name));
-      const wantSource = opts.source ?? "auto";
-      const manifest = wantSource === "live" ? null : targetManifest;
-      if (manifest) {
-        res = compareToManifest(name, manifest, schemaHash, gotCounts);
-      } else {
-        res = await compareToLive(name, gotCounts, opts);
-      }
-      res.quickCheck = integrity.quickCheck;
-      res.cipherIntegrityCheck = integrity.cipherIntegrityCheck;
-      if (record) await recordVerdict(res, target);
+    if (outcome.kind === "integrity") {
+      res = {
+        ok: false,
+        backup: name,
+        source: "none",
+        integrity: outcome.status,
+        quickCheck: outcome.quickCheck,
+        cipherIntegrityCheck: outcome.cipherIntegrityCheck,
+        tables: [],
+        reason: outcome.status === "unreadable" ? "unreadable" : "integrity",
+        detail: `integrity check ${outcome.status}${outcome.quickCheck ? ` (quick_check=${outcome.quickCheck})` : ""}`
+      };
+      if (record) await recordVerdict(res);
       return res;
-    } finally {
-      try {
-        client.close?.();
-      } catch {
-      }
     }
+    if (outcome.kind === "error") throw new Error(outcome.detail);
+    const schemaHash = computeSchemaHash(outcome.schemaTables);
+    const gotCounts = outcome.tables;
+    const wantSource = opts.source ?? "auto";
+    const manifest = wantSource === "live" ? null : targetManifest;
+    if (manifest) {
+      res = compareToManifest(name, manifest, schemaHash, gotCounts);
+    } else {
+      res = await compareToLive(name, gotCounts, opts);
+    }
+    res.quickCheck = outcome.quickCheck;
+    res.cipherIntegrityCheck = outcome.cipherIntegrityCheck;
+    if (record) await recordVerdict(res, target);
+    return res;
   } catch (err) {
     res = {
       ok: false,
@@ -629,19 +873,31 @@ async function maybeVerifyDailyBackup(backupPath) {
     return null;
   }
 }
+
 export {
-  computeKeyEpoch,
+  manifestWriteEnabled,
   dailyVerifyEnabled,
   describeDailyVerifyPosture,
-  isCrashLoopBackup,
   liveHardEnabled,
+  isCrashLoopBackup,
+  computeKeyEpoch,
   manifestPathFor,
-  manifestWriteEnabled,
-  maybeVerifyDailyBackup,
-  readBackBackupArtifact,
-  readManifest,
   runQuickCheckOnArtifact,
+  runArtifactChecks,
+  runVerifyChecks,
+  BACKUP_VERIFY_WORKER_TIMEOUT_MS,
+  BACKUP_VERIFY_WORKER_MISSING_TAG,
+  BACKUP_VERIFY_WORKER_REPLY_REJECTED_TAG,
+  reportBackupVerifyWorkerMissing,
+  validateBackupVerifyWorkerReply,
+  backupVerifyOffloadEnabled,
+  resolveBackupVerifyWorker,
+  runInBackupVerifyWorker,
   sweepOrphanScratchDirs,
+  writeManifestAtomic,
+  readBackBackupArtifact,
+  writeBackupManifest,
+  readManifest,
   verifyBackup,
-  writeBackupManifest
+  maybeVerifyDailyBackup
 };

package/dist/{chunk-LCXWQVOD.js → chunk-TCBWHLKH.js}

@@ -4,21 +4,21 @@ import {
   assertUsableEpoch,
   deriveOrgKeyIdentities,
   describeEpochRemedy
-} from "./chunk-APKEGWFB.js";
+} from "./chunk-A5I2GYVQ.js";
 import {
   InviteError,
   resolveAuth,
   resolveEndpoint
-} from "./chunk-XC2KAJK4.js";
+} from "./chunk-HA6BIZ6L.js";
 import {
   asOrgBillablePlan
 } from "./chunk-W4H2MZAS.js";
 import {
   orgKeyFingerprintDisplay
-} from "./chunk-XBCIRNNU.js";
+} from "./chunk-6PXFF6IV.js";
 import {
   ed25519PrivateKeyFromSeed
-} from "./chunk-OUUNFTS4.js";
+} from "./chunk-MZNLQC6W.js";
 
 // src/lib/org-key-admin.ts
 import { sign } from "crypto";

package/dist/{chunk-YWZGDFAL.js → chunk-TS4LSNRI.js}

@@ -1,9 +1,9 @@
 import {
   getGlobalProceduresBlock
-} from "./chunk-WZPD4QSE.js";
+} from "./chunk-HDQAVAV6.js";
 import {
   writePlatformReferenceFile
-} from "./chunk-NVM3SKJ4.js";
+} from "./chunk-4CN3EE6U.js";
 
 // src/lib/employee-templates.ts
 var BASE_OPERATING_PROCEDURES = `

package/dist/{chunk-J6RTX7XT.js → chunk-TVWYMOZ4.js}

@@ -6,7 +6,7 @@ import {
   baseAgentName,
   getEmployee,
   loadEmployeesSync
-} from "./chunk-LBEBSXZA.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/lib/project-name.ts
 import { execSync } from "child_process";

package/dist/{chunk-3WNDI5KT.js → chunk-VAHQOIQY.js}

@@ -4,7 +4,7 @@ import {
 import {
   isValidX25519Recipient,
   pubKeyHash
-} from "./chunk-2K7IKLBL.js";
+} from "./chunk-7SHU5MOD.js";
 
 // src/lib/monitor-grants.ts
 import crypto from "crypto";

package/dist/{chunk-QH2V67NX.js → chunk-VBYSAQJD.js}

@@ -212,7 +212,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-7ET7S3ED.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-EBATTQPP.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/{chunk-MQD3JJCO.js → chunk-VQQPYI4X.js}

@@ -132,7 +132,7 @@ async function verifyOrBlock(hookPath) {
     process.stderr.write(`[SECURITY] Hook tamper detected: ${filename} \u2014 ${result.reason}
 `);
     try {
-      const { pushNotifyAsync } = await import("./push-notifications-W3UNHDC5.js");
+      const { pushNotifyAsync } = await import("./push-notifications-QW4BWRC7.js");
       pushNotifyAsync({
         event: "security_alert",
         title: "Hook tamper detected",

package/dist/{chunk-XJQGS4IM.js → chunk-VS7V5HNO.js}

@@ -4,7 +4,7 @@ import {
   getGitRootAsync,
   isWorktreeDirty,
   isWorktreeDirtyAsync
-} from "./chunk-E3ZO4EL3.js";
+} from "./chunk-5ZMNFSHV.js";
 
 // src/lib/worktree-sweep.ts
 import { execFile } from "child_process";

package/dist/{chunk-CPC75PXE.js → chunk-W3ABSZ6G.js}

@@ -140,7 +140,7 @@ async function assertManifestSignature(manifest, publicKeyPem) {
       "manifest carries no `signature`. Fleets that enforce EXE_STACK_PUBLIC_KEY reject unsigned manifests, so publishing one would ship a release no host can install. Re-sign with the custodied key: node scripts/sign-stack-manifest.mjs deploy/stack-manifests/v0.9.json"
     );
   }
-  const { verifyStackManifestSignature } = await import("./stack-update-7ET7S3ED.js");
+  const { verifyStackManifestSignature } = await import("./stack-update-EBATTQPP.js");
   try {
     verifyStackManifestSignature(manifest, publicKeyPem);
   } catch (err) {
@@ -1008,7 +1008,7 @@ async function runRegistryProxy(options = registryProxyOptionsFromEnv()) {
   await new Promise((resolve) => server.listen(options.port, options.host, resolve));
   console.log(`exe-registry-proxy listening on ${options.host ?? "0.0.0.0"}:${options.port}`);
   console.log(`proxying /v2/${options.allowedNamespace ?? "askexe"}/* -> ${options.upstream ?? "https://ghcr.io"}`);
-  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-YTDCUN3S.js");
+  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-FDEDT4AC.js");
   const syncConfig = licenseSyncConfigFromEnv();
   if (syncConfig) {
     startLicenseSyncScheduler(syncConfig);

package/dist/{chunk-SUGAHHVR.js → chunk-W7VKGB42.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-LBEBSXZA.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-UG3YOQAC.js → chunk-X2ZHCNNB.js}

@@ -1,17 +1,17 @@
 import {
   isExeSession,
   strictSessionScopeFilter
-} from "./chunk-WSYIQKZ6.js";
+} from "./chunk-GM4UEZDE.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-WLV27PAO.js";
+} from "./chunk-JGBYZTWH.js";
 import {
   getProjectName
-} from "./chunk-J6RTX7XT.js";
+} from "./chunk-TVWYMOZ4.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   getCoordinatorName
-} from "./chunk-LBEBSXZA.js";
+} from "./chunk-L5JFVK5T.js";
 import {
   loadConfigSync
 } from "./chunk-MMS2HBRT.js";
@@ -260,7 +260,7 @@ function createRealDeps(getClient) {
       });
     },
     createReviewForOrphan: async (task) => {
-      const { createReviewForCompletedTask } = await import("./tasks-review-HXHYA76X.js");
+      const { createReviewForCompletedTask } = await import("./tasks-review-3G7CAW2O.js");
       const cwd = process.cwd();
       await createReviewForCompletedTask(
         task,