@askexenow/exe-os 0.9.412 → 0.9.414

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-10-14T20:24:45.008Z",
-  "manifest_sha256": "d122346741db80b81598e2e493f830003ab58345842a20cff55bef76867a8375",
-  "package_version": "0.9.412"
+  "verified_at": "2026-10-15T00:18:47.533Z",
+  "manifest_sha256": "56005af9f0940d23ec8e5b5e40a99c5de60759447f48e43485710e4a136445c8",
+  "package_version": "0.9.414"
 }

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.9.412",
-  "commit": "c2827caa6d",
-  "buildTime": "2026-10-14T20:24:44.459Z"
+  "version": "0.9.414",
+  "commit": "62ab039bf",
+  "buildTime": "2026-10-15T00:18:47.230Z"
 }

package/dist/build-manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "generated_at": "2026-10-14T20:24:44.903Z",
+  "generated_at": "2026-10-15T00:18:47.462Z",
   "files": [
     {
       "path": "active-agent-3YCLS7GB.js",
@@ -624,8 +624,8 @@
     },
     {
       "path": "build-info.json",
-      "sha256": "020a97e2fcb7cbf2bd9dc5ca75e8a598377e057ddfb4629c20d79bca406dfbbf",
-      "bytes": 96
+      "sha256": "60ff3de91faa968284507e2138810ab967d1ce01a6a1c60e10f35dfe9568f777",
+      "bytes": 95
     },
     {
       "path": "capability-cards-YQWBEG7A.js",
@@ -2604,7 +2604,7 @@
     },
     {
       "path": "hooks/manifest.json",
-      "sha256": "cb346441423b072873c35a530d1b78f8a4c2a9894838113efb272b070eca2493",
+      "sha256": "26d5925221ee3a1716e61f43a8b2bdb7422b7da58bd728f003d69fee9d21c9ba",
       "bytes": 1841
     },
     {

package/dist/hooks/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-10-14T20:24:44.425Z",
+  "generatedAt": "2026-10-15T00:18:46.717Z",
   "hashes": {
     "bug-report-worker.js": "0d9712cf7c03fd8eb3c9dc83e7b17b4df8f396787a9eb49e5108172f2ea741a4",
     "codex-stop-task-finalizer.js": "6f9fecf94aa63e22c5ed78f29faa6b9f6e6b6dc2c4685fddd6725983dfba818a",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.412",
+  "version": "0.9.414",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -91,8 +91,12 @@
     "ip-address": "^10.3.1",
     "nanoid": "^5.1.16",
     "picomatch": "^4.0.4",
-    "sharp": "^0.35.4",
-    "undici": "^6.27.0",
+    "sharp": "^0.35.5",
+    "undici": "^6.28.1",
+    "@grpc/grpc-js": "^1.14.5",
+    "simple-git": "^4.0.2",
+    "proxy-addr": "^2.0.8",
+    "brace-expansion": "^5.0.11",
     "esbuild": ">=0.28.1",
     "hono": ">=4.12.25",
     "@opentelemetry/core": ">=2.8.0",
@@ -201,7 +205,7 @@
     "@aws-sdk/client-s3": "^3.1052.0",
     "@aws-sdk/s3-request-presigner": "^3.1052.0",
     "@libsql/client": "^0.14.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/sdk-node": "^0.219.0",
     "@opentelemetry/sdk-trace-base": "^2.8.0",
@@ -242,6 +246,7 @@
   },
   "optionalDependencies": {
     "keytar": "^7.9.0",
+    "sharp": "^0.35.5",
     "@whiskeysockets/baileys": "^7.0.0-rc12"
   }
 }

package/release-notes.json

@@ -1,96 +1,70 @@
 {
-  "current": "0.9.412",
+  "current": "0.9.414",
   "notes": {
-    "0.9.412": {
-      "version": "0.9.412",
-      "date": "2026-10-14",
-      "features": [
-        "deliver private HTML reports in customer release 0.9.77",
-        "org plane enforces suspension/ban + operator revoke-all-sessions (closed-loop revocation, part 2) (#3965)"
-      ],
+    "0.9.414": {
+      "version": "0.9.414",
+      "date": "2026-10-15",
+      "features": [],
       "fixes": [
-        "skip monitor recovery before inspecting unused images",
-        "bind ERP session proof and recover legacy monitor ownership",
-        "verify stateful ERP SSO handoff and native identity",
-        "bind monitor probe to observed agent artifact",
-        "allow valid multi-platform registry inspections to finish",
-        "declare the telemetry image setting for legacy template upgrades",
-        "preserve global version on no-op scoped updates",
-        "make previews read-only and migrate inactive legacy workers",
-        "complete verified standalone dashboard cutover",
-        "derive customer template pins from the new release"
+        "publish the scanned core image without rebuilding"
       ],
       "security": [],
       "other": [
-        "typecheck updater regressions and stabilize dated fixtures",
-        "keep CLI planning mock aligned with exported template reader",
-        "release(stack): make tested customer bundle 0.9.77 the default"
+        "keep pre-push and cleanup guards on immutable publication"
       ],
       "migration_notes": []
     },
-    "0.9.371": {
-      "version": "0.9.371",
-      "date": "2026-08-14",
+    "0.9.413": {
+      "version": "0.9.413",
+      "date": "2026-10-15",
       "features": [],
       "fixes": [
-        "upgrading no longer leaves the daemon running outside its supervisor. The installer already asked launchd/systemd to start the daemon, but only waited 10 seconds to confirm — a cold start (DB init and warmup) takes longer, so it timed out and spawned its own daemon, which won the singleton lock and left the supervised one deferring. The result was silent: restart-on-death was gone and every plist/unit setting was inert, including the ProcessType tuning that fixes MCP drops. On Linux the installer never consulted systemd at all. The daemon now hands itself back to its supervisor on startup, so machines that already drifted repair themselves on the next start (#726)"
+        "Update the MCP SDK, gRPC, proxy address parser, optional image processing, brace expansion and Git helper dependencies to patched releases.",
+        "Patch npm 11 runtime embedded HTTP and brace-expansion packages while preserving its supported install/update behavior. The core image must pass the existing HIGH/CRITICAL vulnerability scan before publication.",
+        "Retain the legacy-upgrade fixes from CLI 0.9.412 and the accepted application pins in stack 0.9.78. A later signed stack adopts this core image only after its digest and release provenance are verified."
       ],
       "security": [],
       "other": [],
       "migration_notes": []
     },
-    "0.9.370": {
-      "version": "0.9.370",
-      "date": "2026-08-14",
-      "features": [
-        "irreversible data operations now refuse to run without a verified restorable backup — the check is mechanical, not a reminder in a runbook (#724)"
-      ],
+    "0.9.412": {
+      "version": "0.9.412",
+      "date": "2026-10-14",
+      "features": [],
       "fixes": [
-        "support notes and comments are stored whole or refused outright, never silently truncated mid-word — validation and storage caps are now derived from one constant so they cannot drift apart again (#720)",
-        "completing a reminder now completes the one you named, rather than one that merely quotes it (#719)",
-        "--force-build refuses when it cannot honour the bypass, instead of reporting a bypass it never performed (#722)",
-        "the afk ticker resolves a real timeout binary instead of exiting 127 on systems without GNU coreutils (#721)"
+        "Stack update previews leave existing configuration, service selection and monitor pairing untouched, including rejected signatures and deployment checks.",
+        "Existing embeddings-off installations migrate the shipped v0.9.311 worker fallback to the current empty image slot after confirming the worker is neither enabled nor present. Digest and signed-manifest gates remain mandatory; already migrated installations are unchanged.",
+        "legacy stack upgrades derive the required telemetry image setting from the signed manifest; multi-platform registry checks allow up to two minutes per attempt and validate Docker 29 descriptor platforms",
+        "The accepted monitoring-agent image uses its verified native health probe, allowing legacy upgrades to complete without disabling monitoring checks.",
+        "ERP admission verification completes the state-protected Auth browser handoff and validates the resulting native session identity; foreign redirects, insecure callbacks and redirect loops remain fatal.",
+        "Rollback to the legacy monitoring hub restores its verified data-volume owner before restart, preserving its users and monitored systems."
       ],
       "security": [],
       "other": [],
       "migration_notes": []
     },
-    "0.9.369": {
-      "version": "0.9.369",
+    "0.9.371": {
+      "version": "0.9.371",
       "date": "2026-08-14",
-      "features": [
-        "a leaked API key can now actually be killed: owner-facing rotate/revoke plus an admin revoke, with the revoked key rejected on the very next request (#717)"
-      ],
+      "features": [],
       "fixes": [
-        "reissuing an API key used to retire nothing — the paths that mailed you a new key wrote only the key column and left the OLD key's hash in place, so both keys kept working indefinitely and 'rotation' revoked nothing. Both credential columns now move together (#717)",
-        "revocation also cuts off the 30-day license token, which previously kept working on the support plane without re-checking the key (#717)"
+        "upgrading no longer leaves the daemon running outside its supervisor. The installer already asked launchd/systemd to start the daemon, but only waited 10 seconds to confirm — a cold start (DB init and warmup) takes longer, so it timed out and spawned its own daemon, which won the singleton lock and left the supervised one deferring. The result was silent: restart-on-death was gone and every plist/unit setting was inert, including the ProcessType tuning that fixes MCP drops. On Linux the installer never consulted systemd at all. The daemon now hands itself back to its supervisor on startup, so machines that already drifted repair themselves on the next start (#726)"
       ],
       "security": [],
       "other": [],
       "migration_notes": []
     },
-    "0.9.368": {
-      "version": "0.9.368",
+    "0.9.370": {
+      "version": "0.9.370",
       "date": "2026-08-14",
       "features": [
-        "approve/deny on a privileged action now actually decides whether it runs — previously the prompt was cosmetic: no server handler existed, the safety classifier had no caller, and the wait flag was ignored (exe-build #165)",
-        "dashboard gains a Drive tab — an admin lens over Exe Drive (#709)",
-        "delivery truth: the system now tracks the gap between merged and actually delivered, with liveness checked on a clock rather than assumed (#707)",
-        "the watchdog now counts the self-heals it declines to make, so a restart it chose NOT to perform is visible instead of silent (#708)"
+        "irreversible data operations now refuse to run without a verified restorable backup — the check is mechanical, not a reminder in a runbook (#724)"
       ],
       "fixes": [
-        "cloud sync no longer starves every stage after the memory push: a deferred slice used to return early with no signal, so the daemon idled a full interval and the fifteen later stages — including DB backup — never ran, while every run reported success (#715)",
-        "closing a bug now genuinely requires a verification artifact — the gate existed and was correct, but was never reachable from the client everyone uses, so nothing was ever refused (#710)",
-        "behavior-injection truncation is loud instead of silent: agents were storing corrections that were dropped at spawn with no warning, so lessons appeared saved and were never applied (#701)",
-        "the installer refuses to run from a linked git worktree, detected structurally, so a temp checkout can no longer re-point global hooks at a directory that will not outlive it (#706)",
-        "create_task no longer reports success for a dispatch nobody received (#705)",
-        "Codex sessions launch again — we stopped pinning a flag OpenAI's CLI removed, and now feature-detect its flag surface instead (#704)",
-        "PreToolUse worktree isolation was inert inside .claude/worktrees (#712)",
-        "stopped shipping the crashlooping exe-monitor v0.9.5 build (#711)",
-        "admin bug updates: evidence-only updates no longer 400, corrections reach upstream, and oversize text is refused rather than silently truncated (#713, #714)",
-        "the dashboard image can serve askexe.com — the one domain it never could (#703)",
-        "release gate asserts required contexts off the x64 lane, so a release can no longer deadlock waiting on a runner it is occupying (#700)",
-        "device-token chat persists instead of losing every message: device identities carried no org, so writes were refused; the connection now resolves a real tenant or is refused outright (exe-build #164, #166)"
+        "support notes and comments are stored whole or refused outright, never silently truncated mid-word — validation and storage caps are now derived from one constant so they cannot drift apart again (#720)",
+        "completing a reminder now completes the one you named, rather than one that merely quotes it (#719)",
+        "--force-build refuses when it cannot honour the bypass, instead of reporting a bypass it never performed (#722)",
+        "the afk ticker resolves a real timeout binary instead of exiting 127 on systems without GNU coreutils (#721)"
       ],
       "security": [],
       "other": [],

package/stack.release.json

@@ -4,8 +4,8 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.412",
-  "image": "ghcr.io/askexe/exe-os:v0.9.412",
+  "version": "0.9.414",
+  "image": "ghcr.io/askexe/exe-os:v0.9.414",
   "imageEnv": "EXE_OS_IMAGE_TAG",
   "imageDigestTodo": "The top-level image names the forthcoming exe-os build and receives its digest after publication. Independently released components, including dashboard, retain verified digest pins; stack publication validates every service pin.",
   "components": {
@@ -110,5 +110,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.412"
+  "sourceVersion": "0.9.414"
 }