@askexenow/exe-os 0.9.60 → 0.9.62

package/dist/bin/shard-migrate.js

@@ -256,8 +256,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 150,
-          returnTopK: 5
+          fetchTopK: 200,
+          returnTopK: 20
         }
       },
       graphRagEnabled: true,
@@ -2289,7 +2289,7 @@ async function ensureSchema() {
       ON session_kills(agent_id);
   `);
   await client.execute(`
-    CREATE TABLE IF NOT EXISTS global_procedures (
+    CREATE TABLE IF NOT EXISTS company_procedures (
       id TEXT PRIMARY KEY,
       title TEXT NOT NULL,
       content TEXT NOT NULL,
@@ -2300,6 +2300,73 @@ async function ensureSchema() {
       updated_at TEXT NOT NULL
     )
   `);
+  const legacyProcedureObject = await client.execute({
+    sql: "SELECT type FROM sqlite_master WHERE name = 'global_procedures'",
+    args: []
+  });
+  const legacyProcedureType = legacyProcedureObject.rows[0]?.type == null ? null : String(legacyProcedureObject.rows[0].type);
+  if (legacyProcedureType === "table") {
+    await client.execute(`
+      INSERT OR IGNORE INTO company_procedures
+        (id, title, content, priority, domain, active, created_at, updated_at)
+      SELECT id, title, content, priority, domain, active, created_at, updated_at
+      FROM global_procedures
+    `);
+    await client.executeMultiple(`
+      CREATE TRIGGER IF NOT EXISTS global_procedures_mirror_insert
+        AFTER INSERT ON global_procedures
+      BEGIN
+        INSERT OR IGNORE INTO company_procedures
+          (id, title, content, priority, domain, active, created_at, updated_at)
+        VALUES
+          (NEW.id, NEW.title, NEW.content, NEW.priority, NEW.domain, NEW.active, NEW.created_at, NEW.updated_at);
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS global_procedures_mirror_update
+        AFTER UPDATE ON global_procedures
+      BEGIN
+        UPDATE company_procedures
+        SET title = NEW.title,
+            content = NEW.content,
+            priority = NEW.priority,
+            domain = NEW.domain,
+            active = NEW.active,
+            created_at = NEW.created_at,
+            updated_at = NEW.updated_at
+        WHERE id = OLD.id;
+      END;
+    `);
+  } else {
+    await client.execute(`
+      CREATE VIEW IF NOT EXISTS global_procedures AS
+      SELECT id, title, content, priority, domain, active, created_at, updated_at
+      FROM company_procedures
+    `);
+    await client.executeMultiple(`
+      CREATE TRIGGER IF NOT EXISTS global_procedures_insert
+        INSTEAD OF INSERT ON global_procedures
+      BEGIN
+        INSERT INTO company_procedures
+          (id, title, content, priority, domain, active, created_at, updated_at)
+        VALUES
+          (NEW.id, NEW.title, NEW.content, NEW.priority, NEW.domain, NEW.active, NEW.created_at, NEW.updated_at);
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS global_procedures_update
+        INSTEAD OF UPDATE ON global_procedures
+      BEGIN
+        UPDATE company_procedures
+        SET title = NEW.title,
+            content = NEW.content,
+            priority = NEW.priority,
+            domain = NEW.domain,
+            active = NEW.active,
+            created_at = NEW.created_at,
+            updated_at = NEW.updated_at
+        WHERE id = OLD.id;
+      END;
+    `);
+  }
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS conversations (
       id              TEXT PRIMARY KEY,
@@ -2439,6 +2506,51 @@ async function ensureSchema() {
       VALUES (new.rowid, new.content_text, new.sender_name, new.agent_response);
     END;
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS memory_cards (
+      id            TEXT PRIMARY KEY,
+      memory_id     TEXT NOT NULL,
+      agent_id      TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      project_name  TEXT,
+      timestamp     TEXT NOT NULL,
+      card_type     TEXT NOT NULL,
+      subject       TEXT,
+      predicate     TEXT,
+      object        TEXT,
+      content       TEXT NOT NULL,
+      source_ref    TEXT,
+      confidence    REAL DEFAULT 0.6,
+      active        INTEGER DEFAULT 1,
+      created_at    TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_memory_cards_agent
+      ON memory_cards(agent_id, active, timestamp);
+
+    CREATE INDEX IF NOT EXISTS idx_memory_cards_memory
+      ON memory_cards(memory_id);
+
+    CREATE VIRTUAL TABLE IF NOT EXISTS memory_cards_fts
+      USING fts5(content, subject, predicate, object, content='memory_cards', content_rowid='rowid');
+
+    CREATE TRIGGER IF NOT EXISTS memory_cards_fts_ai AFTER INSERT ON memory_cards BEGIN
+      INSERT INTO memory_cards_fts(rowid, content, subject, predicate, object)
+      VALUES (new.rowid, new.content, new.subject, new.predicate, new.object);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memory_cards_fts_ad AFTER DELETE ON memory_cards BEGIN
+      INSERT INTO memory_cards_fts(memory_cards_fts, rowid, content, subject, predicate, object)
+      VALUES('delete', old.rowid, old.content, old.subject, old.predicate, old.object);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memory_cards_fts_au AFTER UPDATE ON memory_cards BEGIN
+      INSERT INTO memory_cards_fts(memory_cards_fts, rowid, content, subject, predicate, object)
+      VALUES('delete', old.rowid, old.content, old.subject, old.predicate, old.object);
+      INSERT INTO memory_cards_fts(rowid, content, subject, predicate, object)
+      VALUES (new.rowid, new.content, new.subject, new.predicate, new.object);
+    END;
+  `);
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3`,
@@ -3176,7 +3288,7 @@ var init_platform_procedures = __esm({
         title: "MCP tools \u2014 advanced (triggers, skills, orchestration)",
         domain: "tool-use",
         priority: "p1",
-        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. global_procedure: manage customer-owned company procedures (Layer 0; actions: store, list, deactivate). Legacy aliases: store_global_procedure, list_global_procedures, deactivate_global_procedure."
+        content: "create_trigger: set up a scheduled recurring agent job (cron). list_triggers: view active triggers. load_skill: load a slash-command skill dynamically. apply_starter_pack: import a pre-built behavior + identity pack for a role. export_orchestration: export full org state (tasks, behaviors, identities) as portable JSON. import_orchestration: import org state into a new instance. deploy_client: deploy a customer client instance. query_company_brain: unified RAG query across all company knowledge. create_reminder: set a text reminder (shown in boot brief). list_reminders: view pending reminders. complete_reminder: mark a reminder done. company_procedure: manage customer-owned company procedures (Layer 0; actions: store, list, deactivate). Legacy aliases: global_procedure, store_global_procedure, list_global_procedures, deactivate_global_procedure."
       }
     ];
     PLATFORM_PROCEDURE_TITLES = new Set(
@@ -3197,7 +3309,7 @@ import { randomUUID as randomUUID2 } from "crypto";
 async function loadGlobalProcedures() {
   const client = getClient();
   const result = await client.execute({
-    sql: "SELECT * FROM global_procedures WHERE active = 1 ORDER BY priority ASC, created_at ASC",
+    sql: "SELECT * FROM company_procedures WHERE active = 1 ORDER BY priority ASC, created_at ASC",
     args: []
   });
   const allRows = result.rows;
@@ -3226,7 +3338,7 @@ async function storeGlobalProcedure(input) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const client = getClient();
   await client.execute({
-    sql: `INSERT INTO global_procedures (id, title, content, priority, domain, active, created_at, updated_at)
+    sql: `INSERT INTO company_procedures (id, title, content, priority, domain, active, created_at, updated_at)
           VALUES (?, ?, ?, ?, ?, 1, ?, ?)`,
     args: [id, input.title, input.content, input.priority ?? "p0", input.domain ?? null, now, now]
   });
@@ -3237,7 +3349,7 @@ async function deactivateGlobalProcedure(id) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const client = getClient();
   const result = await client.execute({
-    sql: "UPDATE global_procedures SET active = 0, updated_at = ? WHERE id = ?",
+    sql: "UPDATE company_procedures SET active = 0, updated_at = ? WHERE id = ?",
     args: [now, id]
   });
   await loadGlobalProcedures();
@@ -3256,6 +3368,164 @@ ${p.content}`).join("\n\n");
   }
 });
 
+// src/lib/memory-cards.ts
+var memory_cards_exports = {};
+__export(memory_cards_exports, {
+  extractMemoryCards: () => extractMemoryCards,
+  insertMemoryCardsForBatch: () => insertMemoryCardsForBatch,
+  searchMemoryCards: () => searchMemoryCards
+});
+import { createHash as createHash2 } from "crypto";
+function stableId(memoryId, type, content) {
+  return createHash2("sha256").update(`${memoryId}:${type}:${content}`).digest("hex").slice(0, 32);
+}
+function cleanText(text) {
+  return text.replace(/```[\s\S]*?```/g, " ").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+}
+function splitSentences(text) {
+  return cleanText(text).split(/(?<=[.!?])\s+|\n+/).map((s) => s.trim()).filter((s) => s.length >= 24 && s.length <= MAX_SENTENCE_CHARS);
+}
+function inferCardType(sentence, toolName) {
+  const lower = sentence.toLowerCase();
+  if (toolName === "store_decision" || /\b(decided|decision|adr|approved|rejected)\b/.test(lower)) return "decision";
+  if (/\b(prefers|preference|likes|dislikes|wants|doesn't want|does not want)\b/.test(lower)) return "preference";
+  if (/\b(changed|updated|replaced|now|no longer|instead|supersedes)\b/.test(lower)) return "belief_update";
+  if (toolName && ["Read", "Write", "Edit", "Bash"].includes(toolName)) return "code";
+  if (/\b(meeting|deadline|shipped|launched|completed|failed|blocked|assigned|created)\b/.test(lower)) return "event";
+  return "fact";
+}
+function extractSubject(sentence, agentId) {
+  const explicit = sentence.match(/\b([A-Z][a-zA-Z0-9_-]{2,}(?:\s+[A-Z][a-zA-Z0-9_-]{2,})?)\b/);
+  return explicit?.[1] ?? agentId;
+}
+function predicateFor(type) {
+  switch (type) {
+    case "preference":
+      return "prefers";
+    case "belief_update":
+      return "updated";
+    case "decision":
+      return "decided";
+    case "event":
+      return "happened";
+    case "code":
+      return "implemented";
+    default:
+      return "states";
+  }
+}
+function extractMemoryCards(row) {
+  const sentences = splitSentences(row.raw_text);
+  const cards = [];
+  for (const sentence of sentences) {
+    const type = inferCardType(sentence, row.tool_name);
+    const subject = extractSubject(sentence, row.agent_id);
+    const content = sentence.length > MAX_SENTENCE_CHARS ? `${sentence.slice(0, MAX_SENTENCE_CHARS - 1)}\u2026` : sentence;
+    cards.push({
+      id: stableId(row.id, type, content),
+      memory_id: row.id,
+      agent_id: row.agent_id,
+      session_id: row.session_id,
+      project_name: row.project_name ?? null,
+      timestamp: row.timestamp,
+      card_type: type,
+      subject,
+      predicate: predicateFor(type),
+      object: content,
+      content,
+      source_ref: row.id,
+      confidence: type === "fact" ? 0.55 : 0.65
+    });
+    if (cards.length >= MAX_CARDS_PER_MEMORY) break;
+  }
+  return cards;
+}
+async function insertMemoryCardsForBatch(rows) {
+  const cards = rows.flatMap(extractMemoryCards);
+  if (cards.length === 0) return 0;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const client = getClient();
+  const stmts = cards.map((card) => ({
+    sql: `INSERT OR IGNORE INTO memory_cards
+          (id, memory_id, agent_id, session_id, project_name, timestamp, card_type,
+           subject, predicate, object, content, source_ref, confidence, active, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)`,
+    args: [
+      card.id,
+      card.memory_id,
+      card.agent_id,
+      card.session_id,
+      card.project_name,
+      card.timestamp,
+      card.card_type,
+      card.subject,
+      card.predicate,
+      card.object,
+      card.content,
+      card.source_ref,
+      card.confidence,
+      now
+    ]
+  }));
+  await client.batch(stmts, "write");
+  return cards.length;
+}
+function buildMatchExpr(queryText) {
+  const terms = queryText.toLowerCase().split(/\s+/).filter((t) => t.length >= 3).map((t) => t.replace(/[^a-z0-9_]/g, "")).filter((t) => t.length >= 3).slice(0, 12);
+  if (terms.length === 0) return null;
+  return terms.map((t) => `${t}*`).join(terms.length >= 3 ? " AND " : " OR ");
+}
+async function searchMemoryCards(queryText, agentId, options) {
+  const limit = options?.limit ?? 10;
+  const matchExpr = buildMatchExpr(queryText);
+  if (!matchExpr) return [];
+  let sql = `SELECT c.id, c.memory_id, c.agent_id, c.session_id, c.project_name,
+                    c.timestamp, c.card_type, c.content, c.source_ref, c.confidence
+             FROM memory_cards c
+             JOIN memory_cards_fts fts ON c.rowid = fts.rowid
+             WHERE memory_cards_fts MATCH ?
+               AND c.agent_id = ?
+               AND COALESCE(c.active, 1) = 1`;
+  const args = [matchExpr, agentId];
+  if (options?.projectName) {
+    sql += ` AND c.project_name = ?`;
+    args.push(options.projectName);
+  }
+  if (options?.since) {
+    sql += ` AND c.timestamp >= ?`;
+    args.push(options.since);
+  }
+  sql += ` ORDER BY rank LIMIT ?`;
+  args.push(limit);
+  const result = await getClient().execute({ sql, args });
+  return result.rows.map((row) => ({
+    id: `card:${String(row.id)}`,
+    agent_id: String(row.agent_id),
+    agent_role: "memory_card",
+    session_id: String(row.session_id),
+    timestamp: String(row.timestamp),
+    tool_name: `memory_card:${String(row.card_type)}`,
+    project_name: row.project_name == null ? "" : String(row.project_name),
+    has_error: false,
+    raw_text: `[${String(row.card_type)}] ${String(row.content)}
+Source memory: ${String(row.source_ref ?? row.memory_id)}`,
+    vector: [],
+    importance: 6,
+    status: "active",
+    confidence: Number(row.confidence ?? 0.6),
+    last_accessed: String(row.timestamp)
+  }));
+}
+var MAX_CARDS_PER_MEMORY, MAX_SENTENCE_CHARS;
+var init_memory_cards = __esm({
+  "src/lib/memory-cards.ts"() {
+    "use strict";
+    init_database();
+    MAX_CARDS_PER_MEMORY = 6;
+    MAX_SENTENCE_CHARS = 360;
+  }
+});
+
 // src/lib/store.ts
 init_memory();
 init_database();
@@ -3810,6 +4080,11 @@ async function flushBatch() {
     const globalClient = getClient();
     const globalStmts = batch.map(buildStmt);
     await globalClient.batch(globalStmts, "write");
+    try {
+      const { insertMemoryCardsForBatch: insertMemoryCardsForBatch2 } = await Promise.resolve().then(() => (init_memory_cards(), memory_cards_exports));
+      await insertMemoryCardsForBatch2(batch);
+    } catch {
+    }
     schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
     _pendingRecords.splice(0, batch.length);
     try {

package/dist/bin/stack-update.js

@@ -20,12 +20,64 @@ function isMainModule(importMetaUrl) {
 
 // src/lib/stack-update.ts
 import { execFileSync } from "child_process";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { createVerify, verify as verifySignature } from "crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from "fs";
 import http from "http";
 import https from "https";
 import path from "path";
-function parseStackManifest(raw) {
-  const parsed = JSON.parse(raw);
+function isSignedEnvelope(value) {
+  return !!value && typeof value === "object" && "manifest" in value && "signature" in value;
+}
+function canonicalizeStackManifest(manifest) {
+  const clone = JSON.parse(JSON.stringify(manifest));
+  delete clone.signature;
+  return stableJson(clone);
+}
+function verifyStackManifestSignature(manifest, publicKeyPem) {
+  const signature = manifest.signature;
+  if (!signature) throw new Error("Stack manifest signature required but missing");
+  const payload = Buffer.from(canonicalizeStackManifest(manifest));
+  const sig = Buffer.from(signature.signature, "base64");
+  let ok = false;
+  if (signature.alg === "ed25519") {
+    ok = verifySignature(null, payload, publicKeyPem, sig);
+  } else if (signature.alg === "rsa-sha256") {
+    const verifier = createVerify("RSA-SHA256");
+    verifier.update(payload);
+    verifier.end();
+    ok = verifier.verify(publicKeyPem, sig);
+  } else {
+    throw new Error(`Unsupported stack manifest signature alg: ${signature.alg}`);
+  }
+  if (!ok) throw new Error("Stack manifest signature verification failed");
+}
+function stableJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${stableJson(obj[key])}`).join(",")}}`;
+}
+function findLatestBackupEnvFile(envFile) {
+  const backupDir = path.join(path.dirname(envFile), ".exe-stack-backups");
+  if (!existsSync(backupDir)) return null;
+  const backups = readdirSync(backupDir).filter((name) => name.startsWith("env-") && name.endsWith(".bak")).sort();
+  const latest = backups.at(-1);
+  return latest ? path.join(backupDir, latest) : null;
+}
+async function rollbackStackUpdate(options) {
+  const exec = options.exec ?? defaultExec;
+  const backupEnvFile = options.lockFile && existsSync(options.lockFile) ? JSON.parse(readFileSync(options.lockFile, "utf8")).backupEnvFile : void 0;
+  const rollbackEnv = backupEnvFile && existsSync(backupEnvFile) ? backupEnvFile : findLatestBackupEnvFile(options.envFile);
+  if (!rollbackEnv) throw new Error(`No stack backup env found beside ${options.envFile}`);
+  writeFileSync(options.envFile, readFileSync(rollbackEnv), { mode: 384 });
+  const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
+  exec("docker", [...composeArgs, "up", "-d"]);
+  return { status: "rolled_back", targetVersion: "previous", changes: [], backupEnvFile: rollbackEnv, lockFile: options.lockFile ?? path.join(path.dirname(options.envFile), ".exe-stack-lock.json") };
+}
+function parseStackManifest(raw, publicKey) {
+  const parsedRaw = JSON.parse(raw);
+  const parsed = isSignedEnvelope(parsedRaw) ? { ...parsedRaw.manifest, signature: parsedRaw.signature } : parsedRaw;
+  if (publicKey) verifyStackManifestSignature(parsed, publicKey);
   if (parsed.schemaVersion !== 1) throw new Error("Unsupported stack manifest schemaVersion");
   if (!parsed.latest || !parsed.stacks || typeof parsed.stacks !== "object") {
     throw new Error("Invalid stack manifest: latest and stacks are required");
@@ -43,9 +95,9 @@ function parseStackManifest(raw) {
   }
   return parsed;
 }
-async function loadStackManifest(ref, fetchText = defaultFetchText) {
-  if (/^https?:\/\//.test(ref)) return parseStackManifest(await fetchText(ref));
-  return parseStackManifest(readFileSync(ref, "utf8"));
+async function loadStackManifest(ref, fetchText = defaultFetchText, publicKey) {
+  if (/^https?:\/\//.test(ref)) return parseStackManifest(await fetchText(ref), publicKey);
+  return parseStackManifest(readFileSync(ref, "utf8"), publicKey);
 }
 function parseEnv(raw) {
   const env = /* @__PURE__ */ new Map();
@@ -111,7 +163,8 @@ Re-run with --allow-breaking ${missing.map((c) => c.id).join(",")}`
 async function runStackUpdate(options) {
   const exec = options.exec ?? defaultExec;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const manifest = await loadStackManifest(options.manifestRef, options.fetchText);
+  if (options.rollback) return rollbackStackUpdate(options);
+  const manifest = await loadStackManifest(options.manifestRef, options.fetchText, options.manifestPublicKey);
   const envRaw = readFileSync(options.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, options.targetVersion);
   assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
@@ -134,7 +187,7 @@ async function runStackUpdate(options) {
     exec("docker", [...composeArgs, "pull"]);
     exec("docker", [...composeArgs, "up", "-d"]);
     await verifyReleaseHealth(plan.release, options.healthRetries ?? 12, options.healthDelayMs ?? 5e3);
-    writeFileSync(lockFile, JSON.stringify({ stackVersion: plan.targetVersion, updatedAt: now().toISOString(), services: plan.release.services }, null, 2) + "\n");
+    writeFileSync(lockFile, JSON.stringify({ stackVersion: plan.targetVersion, updatedAt: now().toISOString(), backupEnvFile, services: plan.release.services }, null, 2) + "\n");
     return { status: "updated", targetVersion: plan.targetVersion, changes: plan.changes, backupEnvFile, lockFile };
   } catch (err) {
     writeFileSync(options.envFile, envRaw, { mode: 384 });
@@ -193,7 +246,7 @@ function defaultStackPaths() {
   return {
     composeFile: process.env.EXE_STACK_COMPOSE_FILE || (existsSync(cwdCompose) ? cwdCompose : "/opt/exe-stack/docker-compose.yml"),
     envFile: process.env.EXE_STACK_ENV_FILE || (existsSync(cwdEnv) ? cwdEnv : "/opt/exe-stack/.env"),
-    manifestRef: process.env.EXE_STACK_MANIFEST || "https://updates.askexe.com/stack-manifest.json"
+    manifestRef: process.env.EXE_STACK_MANIFEST || "https://update.askexe.com/stack-manifest.json"
   };
 }
 
@@ -206,6 +259,7 @@ function parseArgs(args) {
     envFile: defaults.envFile,
     dryRun: false,
     check: false,
+    rollback: false,
     yes: false,
     allowedBreakingChangeIds: []
   };
@@ -221,6 +275,9 @@ function parseArgs(args) {
     else if (arg === "--env-file") opts.envFile = next();
     else if (arg.startsWith("--env-file=")) opts.envFile = arg.split("=").slice(1).join("=");
     else if (arg === "--lock-file") opts.lockFile = next();
+    else if (arg === "--public-key") opts.manifestPublicKey = readFileSync2(next(), "utf8");
+    else if (arg.startsWith("--public-key=")) opts.manifestPublicKey = readFileSync2(arg.split("=").slice(1).join("="), "utf8");
+    else if (arg === "--rollback") opts.rollback = true;
     else if (arg === "--dry-run") opts.dryRun = true;
     else if (arg === "--check") opts.check = true;
     else if (arg === "--yes" || arg === "-y") opts.yes = true;
@@ -242,13 +299,15 @@ Usage:
   exe-os stack-update [--manifest <path-or-url>] [--target <version>] [--yes]
 
 Options:
-  --manifest <ref>           Stack manifest JSON path or URL (default: updates.askexe.com)
+  --manifest <ref>           Stack manifest JSON path or URL (default: update.askexe.com)
   --target <version>         Stack version to install (default: manifest.latest)
   --compose-file <path>      docker-compose.yml path (default: ./docker-compose.yml or /opt/exe-stack/docker-compose.yml)
   --env-file <path>          .env path (default: ./.env or /opt/exe-stack/.env)
   --lock-file <path>         Lock file path (default: beside .env)
   --check                    Print available changes only
   --dry-run                  Plan only; do not run Docker
+  --public-key <path>        PEM public key for signed manifest verification
+  --rollback                 Restore latest backed-up .env and restart stack
   --allow-breaking <ids>     Confirm breaking changes, comma-separated
   -y, --yes                  Non-interactive confirmation
 `);
@@ -276,7 +335,16 @@ function printBreaking(changes) {
 }
 async function main() {
   const opts = parseArgs(process.argv.slice(2));
-  const manifest = await loadStackManifest(opts.manifestRef);
+  if (opts.rollback) {
+    if (!opts.yes) {
+      console.error("Refusing to rollback without --yes.");
+      process.exit(2);
+    }
+    const result2 = await runStackUpdate(opts);
+    console.log(`\u2705 Stack rollback attempted using backup: ${result2.backupEnvFile ?? "latest backup"}`);
+    return;
+  }
+  const manifest = await loadStackManifest(opts.manifestRef, void 0, opts.manifestPublicKey);
   const envRaw = readFileSync2(opts.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, opts.targetVersion);
   console.log(`Exe OS stack target: ${plan.targetVersion}`);

package/dist/bin/update.js

@@ -80,8 +80,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 150,
-          returnTopK: 5
+          fetchTopK: 200,
+          returnTopK: 20
         }
       },
       graphRagEnabled: true,