@askexenow/exe-os 0.9.410 → 0.9.412

package/dist/{tui-data-ZMSBEPJT.js → tui-data-KJDWP4CB.js}

@@ -1,8 +1,8 @@
 import {
   sessionScopeFilter
-} from "./chunk-WSYIQKZ6.js";
+} from "./chunk-GM4UEZDE.js";
+import "./chunk-PYXXL7N7.js";
 import "./chunk-ZKGWHT56.js";
-import "./chunk-5F3E57TQ.js";
 import "./chunk-WT4RI36X.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-TDF2XKLK.js";
@@ -10,16 +10,16 @@ import "./chunk-EIKATSE4.js";
 import "./chunk-MJCSEIFI.js";
 import "./chunk-QDMZ5DX2.js";
 import "./chunk-HME6ITKV.js";
-import "./chunk-6T5RC3L4.js";
+import "./chunk-QSW5DHMZ.js";
 import "./chunk-VI4ATC6I.js";
 import "./chunk-A27Q27CT.js";
 import "./chunk-6L4VIYLZ.js";
-import "./chunk-WLV27PAO.js";
+import "./chunk-JGBYZTWH.js";
 import "./chunk-T5SM4RXY.js";
-import "./chunk-ASA2UJDH.js";
+import "./chunk-CFFSHBQF.js";
 import "./chunk-IVXELUEQ.js";
 import "./chunk-AM7S2TY6.js";
-import "./chunk-2AXJRXA6.js";
+import "./chunk-2BOLFLAU.js";
 import "./chunk-WJWRQQMS.js";
 import "./chunk-PCV52RYM.js";
 import "./chunk-BTSWFMEH.js";
@@ -28,18 +28,18 @@ import "./chunk-IMYGYIAI.js";
 import "./chunk-NLEW62VC.js";
 import "./chunk-3DAEZILW.js";
 import "./chunk-DRTJCG6B.js";
-import "./chunk-J6RTX7XT.js";
+import "./chunk-TVWYMOZ4.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-YRUZK2QA.js";
 import "./chunk-MP2AFCGL.js";
 import {
   getClient
-} from "./chunk-LBEBSXZA.js";
+} from "./chunk-L5JFVK5T.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
-import "./chunk-E2346GKI.js";
-import "./chunk-IXRYS5X3.js";
+import "./chunk-SINIRUYZ.js";
+import "./chunk-6777GNWI.js";
 import "./chunk-7FE43JRU.js";
 import "./chunk-5YEUPUV4.js";
 import "./chunk-YYB5PMTK.js";
@@ -48,9 +48,9 @@ import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-C7GHNJPW.js";
 import "./chunk-UWGQNJIE.js";
-import "./chunk-KNEEOZWN.js";
+import "./chunk-EOWJXCYC.js";
 import "./chunk-3R7UDPVR.js";
-import "./chunk-XJDSTA2C.js";
+import "./chunk-6D2O5SAH.js";
 import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
 import "./chunk-MMS2HBRT.js";
@@ -184,7 +184,7 @@ async function searchWikiMemoryRows(query) {
 }
 async function loadEntityProfile(entityName) {
   const client = getClient();
-  const { getEntityByName, getRelationships, getEntityTimeline } = await import("./graph-query-CRIH4DXF.js");
+  const { getEntityByName, getRelationships, getEntityTimeline } = await import("./graph-query-7YA3YNKL.js");
   const entity = await getEntityByName(client, entityName);
   if (!entity) return null;
   const [relationships, timelineRaw] = await Promise.all([
@@ -227,7 +227,7 @@ async function loadEntityProfile(entityName) {
 }
 async function searchEntitiesList(query, limit = 20) {
   const client = getClient();
-  const { searchEntities } = await import("./graph-query-CRIH4DXF.js");
+  const { searchEntities } = await import("./graph-query-7YA3YNKL.js");
   const entities = await searchEntities(client, query, limit);
   if (entities.length === 0) return [];
   const placeholders = entities.map(() => "?").join(",");
@@ -253,7 +253,7 @@ async function searchEntitiesList(query, limit = 20) {
 }
 async function loadHotEntities(limit = 15) {
   const client = getClient();
-  const { getHotEntities } = await import("./graph-query-CRIH4DXF.js");
+  const { getHotEntities } = await import("./graph-query-7YA3YNKL.js");
   const since = new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3);
   const hot = await getHotEntities(client, since, limit);
   return hot.map((h) => ({
@@ -266,7 +266,7 @@ async function loadHotEntities(limit = 15) {
 }
 async function loadGraphOverview() {
   const client = getClient();
-  const { getGraphStats } = await import("./graph-query-CRIH4DXF.js");
+  const { getGraphStats } = await import("./graph-query-7YA3YNKL.js");
   const stats = await getGraphStats(client);
   return {
     totalEntities: stats.entities,

package/dist/{update-support-QY7WALUZ.js → update-support-UYDYMHVR.js}

@@ -2,17 +2,17 @@ import {
   persistSupportArtifact,
   supportIdSchema,
   supportVersionSchema
-} from "./chunk-R3N5BCMM.js";
+} from "./chunk-O3BLL6MY.js";
 import {
   queueSupportStatusUpdateSync
 } from "./chunk-L4ISXVC5.js";
 import "./chunk-MMRUBN3I.js";
 import "./chunk-Q3GMM6I7.js";
-import "./chunk-X2EBM5BQ.js";
-import "./chunk-UQKGV6SX.js";
+import "./chunk-LSHUX7P4.js";
+import "./chunk-MOBZTIJQ.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-LK6OG47X.js";
+import "./chunk-FYSKQPTE.js";
 import "./chunk-5MOYSU5A.js";
 import {
   describeUpstreamFailure,
@@ -25,7 +25,7 @@ import {
 import "./chunk-76CJBM36.js";
 import {
   getActiveAgent
-} from "./chunk-IHBYJG7N.js";
+} from "./chunk-GL5ZG72X.js";
 import "./chunk-7YX73K2R.js";
 import "./chunk-5WA4DG2A.js";
 import "./chunk-WJWRQQMS.js";
@@ -40,11 +40,11 @@ import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-YRUZK2QA.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-LBEBSXZA.js";
+import "./chunk-L5JFVK5T.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
-import "./chunk-E2346GKI.js";
-import "./chunk-IXRYS5X3.js";
+import "./chunk-SINIRUYZ.js";
+import "./chunk-6777GNWI.js";
 import "./chunk-7FE43JRU.js";
 import "./chunk-5YEUPUV4.js";
 import "./chunk-YYB5PMTK.js";
@@ -52,13 +52,13 @@ import "./chunk-WAAGVFFN.js";
 import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-C7GHNJPW.js";
-import "./chunk-IQCC6WFI.js";
+import "./chunk-4J77TCTX.js";
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-KNEEOZWN.js";
+} from "./chunk-EOWJXCYC.js";
 import "./chunk-3R7UDPVR.js";
-import "./chunk-XJDSTA2C.js";
+import "./chunk-6D2O5SAH.js";
 import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
 import {

package/dist/{whatsapp-NCZ43BB3.js → whatsapp-5EMPZHF5.js}

@@ -2,8 +2,8 @@ import {
   WhatsAppAdapter,
   calculateBackoff,
   hardenBaileysAuthState
-} from "./chunk-K6XWIJN7.js";
-import "./chunk-IQCC6WFI.js";
+} from "./chunk-3N24FV22.js";
+import "./chunk-4J77TCTX.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";

package/dist/{wiki-acl-3L7BRJUV.js → wiki-acl-M7BTQJBZ.js}

@@ -6,7 +6,7 @@ import {
   listUserWikiAccess,
   listWorkspaceUsers,
   revokeWikiAccess
-} from "./chunk-FDQXQBBC.js";
+} from "./chunk-6NRZLVK3.js";
 import "./chunk-MLKGABMK.js";
 export {
   checkWikiAccess,

package/dist/{work-claims-XQXT2VWJ.js → work-claims-5CFMZTML.js}

@@ -15,15 +15,15 @@ import {
   normalizeWorkRef,
   releaseClaim,
   resolveHolderSession
-} from "./chunk-FYKEL2L6.js";
+} from "./chunk-BLTXAUP6.js";
 import "./chunk-C6U7XWOC.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-BTSWFMEH.js";
-import "./chunk-LBEBSXZA.js";
+import "./chunk-L5JFVK5T.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
-import "./chunk-E2346GKI.js";
-import "./chunk-IXRYS5X3.js";
+import "./chunk-SINIRUYZ.js";
+import "./chunk-6777GNWI.js";
 import "./chunk-7FE43JRU.js";
 import "./chunk-5YEUPUV4.js";
 import "./chunk-YYB5PMTK.js";

package/dist/{work-state-heartbeat-GAIQ7M73.js → work-state-heartbeat-7IA2DZ2E.js}

@@ -9,7 +9,7 @@ import {
   runWorkStateTick,
   shouldWriteWorkState,
   upsertWorkState
-} from "./chunk-UQKGV6SX.js";
+} from "./chunk-MOBZTIJQ.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{workflow-engine-FCOOI5M6.js → workflow-engine-S5JOE2YR.js}

@@ -11,8 +11,8 @@ import {
   persistWorkflows,
   runWorkflow,
   startWorkflow
-} from "./chunk-CKRZBQ2K.js";
-import "./chunk-XDWIJBTY.js";
+} from "./chunk-GHYHNHDL.js";
+import "./chunk-CFO47VW4.js";
 import "./chunk-MLKGABMK.js";
 export {
   MAX_WORKFLOW_STEPS,

package/dist/{worktree-GS4ODQ4C.js → worktree-7V4ZMF3D.js}

@@ -19,13 +19,13 @@ import {
   resolveGitWithRetrySync,
   worktreeBranch,
   worktreePath
-} from "./chunk-E3ZO4EL3.js";
-import "./chunk-WLV27PAO.js";
-import "./chunk-LBEBSXZA.js";
+} from "./chunk-5ZMNFSHV.js";
+import "./chunk-JGBYZTWH.js";
+import "./chunk-L5JFVK5T.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
-import "./chunk-E2346GKI.js";
-import "./chunk-IXRYS5X3.js";
+import "./chunk-SINIRUYZ.js";
+import "./chunk-6777GNWI.js";
 import "./chunk-7FE43JRU.js";
 import "./chunk-5YEUPUV4.js";
 import "./chunk-YYB5PMTK.js";

package/dist/{worktree-sweep-6LMC7H5Y.js → worktree-sweep-34MXJ7S6.js}

@@ -6,14 +6,14 @@ import {
   getBranchLandedState,
   isWorktreePathOccupiedByCwd,
   sweepWorktrees
-} from "./chunk-XJQGS4IM.js";
-import "./chunk-E3ZO4EL3.js";
-import "./chunk-WLV27PAO.js";
-import "./chunk-LBEBSXZA.js";
+} from "./chunk-VS7V5HNO.js";
+import "./chunk-5ZMNFSHV.js";
+import "./chunk-JGBYZTWH.js";
+import "./chunk-L5JFVK5T.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
-import "./chunk-E2346GKI.js";
-import "./chunk-IXRYS5X3.js";
+import "./chunk-SINIRUYZ.js";
+import "./chunk-6777GNWI.js";
 import "./chunk-7FE43JRU.js";
 import "./chunk-5YEUPUV4.js";
 import "./chunk-YYB5PMTK.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.410",
+  "version": "0.9.412",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -218,6 +218,7 @@
     "openai": "^6.33.0",
     "pg": "^8.20.0",
     "react": "^19.2.4",
+    "smol-toml": "1.8.0",
     "typescript": "^5.9.3",
     "ws": "^8.21.0",
     "yaml": "2.8.3",

package/release-notes.json

@@ -1,34 +1,30 @@
 {
-  "current": "0.9.410",
+  "current": "0.9.412",
   "notes": {
-    "0.9.410": {
-      "version": "0.9.410",
-      "date": "2026-10-03",
-      "features": [],
+    "0.9.412": {
+      "version": "0.9.412",
+      "date": "2026-10-14",
+      "features": [
+        "deliver private HTML reports in customer release 0.9.77",
+        "org plane enforces suspension/ban + operator revoke-all-sessions (closed-loop revocation, part 2) (#3965)"
+      ],
       "fixes": [
-        "admission gate disk floor + commit machine disk-guard (#3934)",
-        "serving probe distinguishes STALLED from down + bounded stall capture (bug 5c7c2e7b) (#3942)",
-        "sweep orphaned exe-bkmanifest-* scratch dirs before read-back (#3928)",
-        "ci-disk-reclaim event-history completeness — late-arriving events and dockerd restarts (bug b8b9bdf1) (#3941)",
-        "mock-export analyzer precision — per-test barrel consumption, erased unused imports, nested export * propagation; MS009-MS012 blocking (bug 1c1f9ecd) (#3940)",
-        "server-side per-bug GitHub-migration lease on triage_bug (bug 33f670b1) (#3938)",
-        "host-reaper item G — explicitly-set EMPTY allowlist env fails validation (bug b1dd4db8) (#3939)",
-        "host-reaper — reap stale sims/emulators/runaway processes (bug 7dbfa40e) (#1611)",
-        "make demoteOffTopicResults agree with the FTS5 unicode61 tokenizer (bug ad96abe7) (#3935)",
-        "judge run identity and required platforms against TRUSTED policy, not descriptor fields (bug 0f8fd509) (#3937)",
-        "one tri-state lifecycle for the anchor probe — unknown is never a sticky decision (bug dc278943) (#3936)",
-        "redact secret-bearing CLI args at memory ingest + block flagged records from relevant-memories injection (bug 52ada9a3) (#3932)",
-        "alarm on timeout and non-supersession cancellations of main full suite (bug 97aa969e) (#3929)",
-        "identity updates regenerate agent defs (bug d8798016) + PreToolUse routes MCP tools (bug 24488803) (#3931)",
-        "honest backup-failure wording + \"unknown\" memory cursor (bugs 66a049da, ffedcad4) (#3930)",
-        "delete the unreachable tmux dispatch machinery behind the retired sink (bug 125dd445) (#3933)",
-        "retire tmux dispatch at the shared spawn sink, not just two tool boundaries (bug 0750e2b4) (#1710)",
-        "sign isolated DEMO image74 and central routing75 canaries"
+        "skip monitor recovery before inspecting unused images",
+        "bind ERP session proof and recover legacy monitor ownership",
+        "verify stateful ERP SSO handoff and native identity",
+        "bind monitor probe to observed agent artifact",
+        "allow valid multi-platform registry inspections to finish",
+        "declare the telemetry image setting for legacy template upgrades",
+        "preserve global version on no-op scoped updates",
+        "make previews read-only and migrate inactive legacy workers",
+        "complete verified standalone dashboard cutover",
+        "derive customer template pins from the new release"
       ],
       "security": [],
       "other": [
-        "release: v0.9.410 (#3944)",
-        "Pin verified Wiki navigation and ERP multi-site runtime fixes"
+        "typecheck updater regressions and stabilize dated fixtures",
+        "keep CLI planning mock aligned with exported template reader",
+        "release(stack): make tested customer bundle 0.9.77 the default"
       ],
       "migration_notes": []
     },

package/stack.release.json

@@ -4,8 +4,8 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.410",
-  "image": "ghcr.io/askexe/exe-os:v0.9.410",
+  "version": "0.9.412",
+  "image": "ghcr.io/askexe/exe-os:v0.9.412",
   "imageEnv": "EXE_OS_IMAGE_TAG",
   "imageDigestTodo": "The top-level image names the forthcoming exe-os build and receives its digest after publication. Independently released components, including dashboard, retain verified digest pins; stack publication validates every service pin.",
   "components": {
@@ -16,11 +16,11 @@
       "note": "Bug 81ca8903: was `ghcr.io/askexe/exe-erp:v0.9.312` \u2014 a tag that has never existed. ERP is versioned on its own 0.x line; v0.9.312 is an EXE-OS version number that bumpVersions() stamped onto this component because rebaseImageTag() rebased every tag-only component image to the exe-os release version regardless of which repo built it. That rebase is now scoped (same commit) so it can no longer forge tags for independently-versioned components. Repinned to the real, current ERP release v0.3.4, digest resolved live from ghcr.io/askexe/exe-erp on 2026-09-01. Digest-pinning is also what makes this entry self-defending: rebaseImageTag() returns any `@sha256:`-bearing ref untouched. Prior intent for the record (bug 790794e8) was v0.2.0-final8, the first ERP image shipping the realtime/socketio entrypoint (exe-erp PR #15); final3/final7 crash-looped exe-erp-websocket on a missing socketio.js. v0.3.4 supersedes it."
     },
     "dashboard": {
-      "image": "ghcr.io/askexe/exe-dashboard:v0.9.382@sha256:43c4eb52d89d977021d29df73bcfa6f9d769ab4debf90e81240b59a4c165bab0",
+      "image": "ghcr.io/askexe/exe-dashboard:v0.9.400@sha256:d6963463d623f2e07b8b1b6cdaa5662b8a7219aa237cd315cfbabcad84f06ee1",
       "env": "DASHBOARD_IMAGE_TAG",
       "composeService": "exe-dashboard",
       "versionLockstep": false,
-      "note": "Dashboard is independently versioned after the standalone repository handoff. Preserve the verified image already pinned by the customer stack until the first AskExe/exe-dashboard release passes provenance checks. Update this digest and current-image source mappings together at cutover; exe-os version bumps must not rewrite this tag."
+      "note": "Independently published by AskExe/exe-dashboard from 0e389f1acf35b34c648a846abdc4bcca4d2cd816. Matches the verified v0.9.400 customer manifest pin; source mappings move atomically with this digest."
     },
     "exe-db": {
       "image": "pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
@@ -110,5 +110,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.410"
+  "sourceVersion": "0.9.412"
 }

package/dist/chunk-WZPD4QSE.js

@@ -1,113 +0,0 @@
-import {
-  PLATFORM_PROCEDURES,
-  PLATFORM_PROCEDURE_TITLES
-} from "./chunk-NVM3SKJ4.js";
-import {
-  fastDbInit
-} from "./chunk-7ZP2PAW3.js";
-import {
-  getClient
-} from "./chunk-LBEBSXZA.js";
-
-// src/lib/global-procedures.ts
-import { randomUUID } from "crypto";
-var _customerCache = "";
-var _cacheLoaded = false;
-var _loadPromise = null;
-var _platformCache = PLATFORM_PROCEDURES.map((p) => `### ${p.title}
-${p.content}`).join("\n\n");
-async function loadGlobalProcedures() {
-  const client = getClient();
-  const result = await client.execute({
-    sql: "SELECT * FROM company_procedures WHERE active = 1 ORDER BY priority ASC, created_at ASC",
-    args: []
-  });
-  const allRows = result.rows;
-  const customerOnly = allRows.filter((p) => {
-    if (PLATFORM_PROCEDURE_TITLES.has(p.title)) return false;
-    const title = (p.title ?? "").trim();
-    const content = (p.content ?? "").trim();
-    if (!title || title === "(untitled)") return false;
-    if (!content) return false;
-    return true;
-  });
-  const values = customerOnly.filter((p) => p.kind === "value");
-  const procedures = customerOnly.filter((p) => p.kind !== "value");
-  const parts = [];
-  if (values.length > 0) {
-    parts.push("### Company Values\n" + values.map((v) => `- **${v.title}:** ${v.content}`).join("\n"));
-  }
-  if (procedures.length > 0) {
-    parts.push(procedures.map((p) => `### ${p.title}
-${p.content}`).join("\n\n"));
-  }
-  _customerCache = parts.join("\n\n");
-  _cacheLoaded = true;
-  return customerOnly;
-}
-var COMPANY_PROCEDURES_NOT_LOADED_LINE = "\u26A0 Company procedures NOT loaded; run config company_procedure list";
-async function ensureGlobalProceduresLoaded() {
-  if (_cacheLoaded) return;
-  if (!_loadPromise) {
-    _loadPromise = (async () => {
-      await fastDbInit({ daemonOnly: true });
-      return loadGlobalProcedures();
-    })().catch((err) => {
-      process.stderr.write(
-        `[global-procedures] company procedures load failed: ${String(err)}
-`
-      );
-      return [];
-    });
-  }
-  try {
-    await _loadPromise;
-  } finally {
-    if (!_cacheLoaded) _loadPromise = null;
-  }
-}
-function getGlobalProceduresBlock() {
-  const sections = [];
-  if (_platformCache) sections.push(_platformCache);
-  if (_cacheLoaded && _customerCache) sections.push(_customerCache);
-  if (!_cacheLoaded) sections.push(COMPANY_PROCEDURES_NOT_LOADED_LINE);
-  if (sections.length === 0) return "";
-  return `## Organization-Wide Procedures (MANDATORY \u2014 supersedes all other rules)
-
-${sections.join("\n\n")}
-`;
-}
-async function storeGlobalProcedure(input) {
-  if (!input.title?.trim() || !input.content?.trim()) {
-    throw new Error("storeGlobalProcedure requires a non-empty title and content");
-  }
-  const id = randomUUID();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const client = getClient();
-  await client.execute({
-    sql: `INSERT INTO company_procedures (id, title, content, priority, domain, kind, active, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, 1, ?, ?)`,
-    args: [id, input.title, input.content, input.priority ?? "p0", input.domain ?? null, input.kind ?? "procedure", now, now]
-  });
-  await loadGlobalProcedures();
-  return id;
-}
-async function deactivateGlobalProcedure(id) {
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const client = getClient();
-  const result = await client.execute({
-    sql: "UPDATE company_procedures SET active = 0, updated_at = ? WHERE id = ?",
-    args: [now, id]
-  });
-  await loadGlobalProcedures();
-  return result.rowsAffected > 0;
-}
-
-export {
-  loadGlobalProcedures,
-  COMPANY_PROCEDURES_NOT_LOADED_LINE,
-  ensureGlobalProceduresLoaded,
-  getGlobalProceduresBlock,
-  storeGlobalProcedure,
-  deactivateGlobalProcedure
-};