@askexenow/exe-os 0.9.413 → 0.9.414

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-10-14T21:38:04.810Z",
-  "manifest_sha256": "cd6d628cf9170384881bb8562ed208be57248bed3456cf6797a60bb87ac7861c",
-  "package_version": "0.9.413"
+  "verified_at": "2026-10-15T00:18:47.533Z",
+  "manifest_sha256": "56005af9f0940d23ec8e5b5e40a99c5de60759447f48e43485710e4a136445c8",
+  "package_version": "0.9.414"
 }

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.9.413",
-  "commit": "cf66dffc1f",
-  "buildTime": "2026-10-14T21:38:04.474Z"
+  "version": "0.9.414",
+  "commit": "62ab039bf",
+  "buildTime": "2026-10-15T00:18:47.230Z"
 }

package/dist/build-manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "generated_at": "2026-10-14T21:38:04.732Z",
+  "generated_at": "2026-10-15T00:18:47.462Z",
   "files": [
     {
       "path": "active-agent-3YCLS7GB.js",
@@ -624,8 +624,8 @@
     },
     {
       "path": "build-info.json",
-      "sha256": "ae2c18364e569176d61a4ca37007c3b167bcd86cbb5dcf15b40a35ccc933486f",
-      "bytes": 96
+      "sha256": "60ff3de91faa968284507e2138810ab967d1ce01a6a1c60e10f35dfe9568f777",
+      "bytes": 95
     },
     {
       "path": "capability-cards-YQWBEG7A.js",
@@ -2604,7 +2604,7 @@
     },
     {
       "path": "hooks/manifest.json",
-      "sha256": "6e4d658cb0eb906d2ea17974d9448cb11a0e1b3ed45fd4fcd92c9480ba1469f2",
+      "sha256": "26d5925221ee3a1716e61f43a8b2bdb7422b7da58bd728f003d69fee9d21c9ba",
       "bytes": 1841
     },
     {

package/dist/hooks/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-10-14T21:38:04.450Z",
+  "generatedAt": "2026-10-15T00:18:46.717Z",
   "hashes": {
     "bug-report-worker.js": "0d9712cf7c03fd8eb3c9dc83e7b17b4df8f396787a9eb49e5108172f2ea741a4",
     "codex-stop-task-finalizer.js": "6f9fecf94aa63e22c5ed78f29faa6b9f6e6b6dc2c4685fddd6725983dfba818a",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.413",
+  "version": "0.9.414",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/release-notes.json

@@ -1,16 +1,29 @@
 {
-  "current": "0.9.413",
+  "current": "0.9.414",
   "notes": {
+    "0.9.414": {
+      "version": "0.9.414",
+      "date": "2026-10-15",
+      "features": [],
+      "fixes": [
+        "publish the scanned core image without rebuilding"
+      ],
+      "security": [],
+      "other": [
+        "keep pre-push and cleanup guards on immutable publication"
+      ],
+      "migration_notes": []
+    },
     "0.9.413": {
       "version": "0.9.413",
-      "date": "2026-10-14",
+      "date": "2026-10-15",
       "features": [],
       "fixes": [
-        "use public HTTPS registry URLs in package-lock"
-      ],
-      "security": [
-        "update package-lock and Docker runtime security packages"
+        "Update the MCP SDK, gRPC, proxy address parser, optional image processing, brace expansion and Git helper dependencies to patched releases.",
+        "Patch npm 11 runtime embedded HTTP and brace-expansion packages while preserving its supported install/update behavior. The core image must pass the existing HIGH/CRITICAL vulnerability scan before publication.",
+        "Retain the legacy-upgrade fixes from CLI 0.9.412 and the accepted application pins in stack 0.9.78. A later signed stack adopts this core image only after its digest and release provenance are verified."
       ],
+      "security": [],
       "other": [],
       "migration_notes": []
     },
@@ -56,20 +69,6 @@
       "security": [],
       "other": [],
       "migration_notes": []
-    },
-    "0.9.369": {
-      "version": "0.9.369",
-      "date": "2026-08-14",
-      "features": [
-        "a leaked API key can now actually be killed: owner-facing rotate/revoke plus an admin revoke, with the revoked key rejected on the very next request (#717)"
-      ],
-      "fixes": [
-        "reissuing an API key used to retire nothing — the paths that mailed you a new key wrote only the key column and left the OLD key's hash in place, so both keys kept working indefinitely and 'rotation' revoked nothing. Both credential columns now move together (#717)",
-        "revocation also cuts off the 30-day license token, which previously kept working on the support plane without re-checking the key (#717)"
-      ],
-      "security": [],
-      "other": [],
-      "migration_notes": []
     }
   }
 }

package/stack.release.json

@@ -4,8 +4,8 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.413",
-  "image": "ghcr.io/askexe/exe-os:v0.9.413",
+  "version": "0.9.414",
+  "image": "ghcr.io/askexe/exe-os:v0.9.414",
   "imageEnv": "EXE_OS_IMAGE_TAG",
   "imageDigestTodo": "The top-level image names the forthcoming exe-os build and receives its digest after publication. Independently released components, including dashboard, retain verified digest pins; stack publication validates every service pin.",
   "components": {
@@ -110,5 +110,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.413"
+  "sourceVersion": "0.9.414"
 }