@askexenow/exe-os 0.9.61 → 0.9.63

package/dist/bin/shard-migrate.js

@@ -256,8 +256,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 150,
-          returnTopK: 5
+          fetchTopK: 200,
+          returnTopK: 20
         }
       },
       graphRagEnabled: true,
@@ -2506,6 +2506,51 @@ async function ensureSchema() {
       VALUES (new.rowid, new.content_text, new.sender_name, new.agent_response);
     END;
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS memory_cards (
+      id            TEXT PRIMARY KEY,
+      memory_id     TEXT NOT NULL,
+      agent_id      TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      project_name  TEXT,
+      timestamp     TEXT NOT NULL,
+      card_type     TEXT NOT NULL,
+      subject       TEXT,
+      predicate     TEXT,
+      object        TEXT,
+      content       TEXT NOT NULL,
+      source_ref    TEXT,
+      confidence    REAL DEFAULT 0.6,
+      active        INTEGER DEFAULT 1,
+      created_at    TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_memory_cards_agent
+      ON memory_cards(agent_id, active, timestamp);
+
+    CREATE INDEX IF NOT EXISTS idx_memory_cards_memory
+      ON memory_cards(memory_id);
+
+    CREATE VIRTUAL TABLE IF NOT EXISTS memory_cards_fts
+      USING fts5(content, subject, predicate, object, content='memory_cards', content_rowid='rowid');
+
+    CREATE TRIGGER IF NOT EXISTS memory_cards_fts_ai AFTER INSERT ON memory_cards BEGIN
+      INSERT INTO memory_cards_fts(rowid, content, subject, predicate, object)
+      VALUES (new.rowid, new.content, new.subject, new.predicate, new.object);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memory_cards_fts_ad AFTER DELETE ON memory_cards BEGIN
+      INSERT INTO memory_cards_fts(memory_cards_fts, rowid, content, subject, predicate, object)
+      VALUES('delete', old.rowid, old.content, old.subject, old.predicate, old.object);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memory_cards_fts_au AFTER UPDATE ON memory_cards BEGIN
+      INSERT INTO memory_cards_fts(memory_cards_fts, rowid, content, subject, predicate, object)
+      VALUES('delete', old.rowid, old.content, old.subject, old.predicate, old.object);
+      INSERT INTO memory_cards_fts(rowid, content, subject, predicate, object)
+      VALUES (new.rowid, new.content, new.subject, new.predicate, new.object);
+    END;
+  `);
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3`,
@@ -3323,6 +3368,164 @@ ${p.content}`).join("\n\n");
   }
 });
 
+// src/lib/memory-cards.ts
+var memory_cards_exports = {};
+__export(memory_cards_exports, {
+  extractMemoryCards: () => extractMemoryCards,
+  insertMemoryCardsForBatch: () => insertMemoryCardsForBatch,
+  searchMemoryCards: () => searchMemoryCards
+});
+import { createHash as createHash2 } from "crypto";
+function stableId(memoryId, type, content) {
+  return createHash2("sha256").update(`${memoryId}:${type}:${content}`).digest("hex").slice(0, 32);
+}
+function cleanText(text) {
+  return text.replace(/```[\s\S]*?```/g, " ").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+}
+function splitSentences(text) {
+  return cleanText(text).split(/(?<=[.!?])\s+|\n+/).map((s) => s.trim()).filter((s) => s.length >= 24 && s.length <= MAX_SENTENCE_CHARS);
+}
+function inferCardType(sentence, toolName) {
+  const lower = sentence.toLowerCase();
+  if (toolName === "store_decision" || /\b(decided|decision|adr|approved|rejected)\b/.test(lower)) return "decision";
+  if (/\b(prefers|preference|likes|dislikes|wants|doesn't want|does not want)\b/.test(lower)) return "preference";
+  if (/\b(changed|updated|replaced|now|no longer|instead|supersedes)\b/.test(lower)) return "belief_update";
+  if (toolName && ["Read", "Write", "Edit", "Bash"].includes(toolName)) return "code";
+  if (/\b(meeting|deadline|shipped|launched|completed|failed|blocked|assigned|created)\b/.test(lower)) return "event";
+  return "fact";
+}
+function extractSubject(sentence, agentId) {
+  const explicit = sentence.match(/\b([A-Z][a-zA-Z0-9_-]{2,}(?:\s+[A-Z][a-zA-Z0-9_-]{2,})?)\b/);
+  return explicit?.[1] ?? agentId;
+}
+function predicateFor(type) {
+  switch (type) {
+    case "preference":
+      return "prefers";
+    case "belief_update":
+      return "updated";
+    case "decision":
+      return "decided";
+    case "event":
+      return "happened";
+    case "code":
+      return "implemented";
+    default:
+      return "states";
+  }
+}
+function extractMemoryCards(row) {
+  const sentences = splitSentences(row.raw_text);
+  const cards = [];
+  for (const sentence of sentences) {
+    const type = inferCardType(sentence, row.tool_name);
+    const subject = extractSubject(sentence, row.agent_id);
+    const content = sentence.length > MAX_SENTENCE_CHARS ? `${sentence.slice(0, MAX_SENTENCE_CHARS - 1)}\u2026` : sentence;
+    cards.push({
+      id: stableId(row.id, type, content),
+      memory_id: row.id,
+      agent_id: row.agent_id,
+      session_id: row.session_id,
+      project_name: row.project_name ?? null,
+      timestamp: row.timestamp,
+      card_type: type,
+      subject,
+      predicate: predicateFor(type),
+      object: content,
+      content,
+      source_ref: row.id,
+      confidence: type === "fact" ? 0.55 : 0.65
+    });
+    if (cards.length >= MAX_CARDS_PER_MEMORY) break;
+  }
+  return cards;
+}
+async function insertMemoryCardsForBatch(rows) {
+  const cards = rows.flatMap(extractMemoryCards);
+  if (cards.length === 0) return 0;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const client = getClient();
+  const stmts = cards.map((card) => ({
+    sql: `INSERT OR IGNORE INTO memory_cards
+          (id, memory_id, agent_id, session_id, project_name, timestamp, card_type,
+           subject, predicate, object, content, source_ref, confidence, active, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)`,
+    args: [
+      card.id,
+      card.memory_id,
+      card.agent_id,
+      card.session_id,
+      card.project_name,
+      card.timestamp,
+      card.card_type,
+      card.subject,
+      card.predicate,
+      card.object,
+      card.content,
+      card.source_ref,
+      card.confidence,
+      now
+    ]
+  }));
+  await client.batch(stmts, "write");
+  return cards.length;
+}
+function buildMatchExpr(queryText) {
+  const terms = queryText.toLowerCase().split(/\s+/).filter((t) => t.length >= 3).map((t) => t.replace(/[^a-z0-9_]/g, "")).filter((t) => t.length >= 3).slice(0, 12);
+  if (terms.length === 0) return null;
+  return terms.map((t) => `${t}*`).join(terms.length >= 3 ? " AND " : " OR ");
+}
+async function searchMemoryCards(queryText, agentId, options) {
+  const limit = options?.limit ?? 10;
+  const matchExpr = buildMatchExpr(queryText);
+  if (!matchExpr) return [];
+  let sql = `SELECT c.id, c.memory_id, c.agent_id, c.session_id, c.project_name,
+                    c.timestamp, c.card_type, c.content, c.source_ref, c.confidence
+             FROM memory_cards c
+             JOIN memory_cards_fts fts ON c.rowid = fts.rowid
+             WHERE memory_cards_fts MATCH ?
+               AND c.agent_id = ?
+               AND COALESCE(c.active, 1) = 1`;
+  const args = [matchExpr, agentId];
+  if (options?.projectName) {
+    sql += ` AND c.project_name = ?`;
+    args.push(options.projectName);
+  }
+  if (options?.since) {
+    sql += ` AND c.timestamp >= ?`;
+    args.push(options.since);
+  }
+  sql += ` ORDER BY rank LIMIT ?`;
+  args.push(limit);
+  const result = await getClient().execute({ sql, args });
+  return result.rows.map((row) => ({
+    id: `card:${String(row.id)}`,
+    agent_id: String(row.agent_id),
+    agent_role: "memory_card",
+    session_id: String(row.session_id),
+    timestamp: String(row.timestamp),
+    tool_name: `memory_card:${String(row.card_type)}`,
+    project_name: row.project_name == null ? "" : String(row.project_name),
+    has_error: false,
+    raw_text: `[${String(row.card_type)}] ${String(row.content)}
+Source memory: ${String(row.source_ref ?? row.memory_id)}`,
+    vector: [],
+    importance: 6,
+    status: "active",
+    confidence: Number(row.confidence ?? 0.6),
+    last_accessed: String(row.timestamp)
+  }));
+}
+var MAX_CARDS_PER_MEMORY, MAX_SENTENCE_CHARS;
+var init_memory_cards = __esm({
+  "src/lib/memory-cards.ts"() {
+    "use strict";
+    init_database();
+    MAX_CARDS_PER_MEMORY = 6;
+    MAX_SENTENCE_CHARS = 360;
+  }
+});
+
 // src/lib/store.ts
 init_memory();
 init_database();
@@ -3877,6 +4080,11 @@ async function flushBatch() {
     const globalClient = getClient();
     const globalStmts = batch.map(buildStmt);
     await globalClient.batch(globalStmts, "write");
+    try {
+      const { insertMemoryCardsForBatch: insertMemoryCardsForBatch2 } = await Promise.resolve().then(() => (init_memory_cards(), memory_cards_exports));
+      await insertMemoryCardsForBatch2(batch);
+    } catch {
+    }
     schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
     _pendingRecords.splice(0, batch.length);
     try {

package/dist/bin/stack-update.js

@@ -20,12 +20,64 @@ function isMainModule(importMetaUrl) {
 
 // src/lib/stack-update.ts
 import { execFileSync } from "child_process";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { createVerify, verify as verifySignature } from "crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from "fs";
 import http from "http";
 import https from "https";
 import path from "path";
-function parseStackManifest(raw) {
-  const parsed = JSON.parse(raw);
+function isSignedEnvelope(value) {
+  return !!value && typeof value === "object" && "manifest" in value && "signature" in value;
+}
+function canonicalizeStackManifest(manifest) {
+  const clone = JSON.parse(JSON.stringify(manifest));
+  delete clone.signature;
+  return stableJson(clone);
+}
+function verifyStackManifestSignature(manifest, publicKeyPem) {
+  const signature = manifest.signature;
+  if (!signature) throw new Error("Stack manifest signature required but missing");
+  const payload = Buffer.from(canonicalizeStackManifest(manifest));
+  const sig = Buffer.from(signature.signature, "base64");
+  let ok = false;
+  if (signature.alg === "ed25519") {
+    ok = verifySignature(null, payload, publicKeyPem, sig);
+  } else if (signature.alg === "rsa-sha256") {
+    const verifier = createVerify("RSA-SHA256");
+    verifier.update(payload);
+    verifier.end();
+    ok = verifier.verify(publicKeyPem, sig);
+  } else {
+    throw new Error(`Unsupported stack manifest signature alg: ${signature.alg}`);
+  }
+  if (!ok) throw new Error("Stack manifest signature verification failed");
+}
+function stableJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${stableJson(obj[key])}`).join(",")}}`;
+}
+function findLatestBackupEnvFile(envFile) {
+  const backupDir = path.join(path.dirname(envFile), ".exe-stack-backups");
+  if (!existsSync(backupDir)) return null;
+  const backups = readdirSync(backupDir).filter((name) => name.startsWith("env-") && name.endsWith(".bak")).sort();
+  const latest = backups.at(-1);
+  return latest ? path.join(backupDir, latest) : null;
+}
+async function rollbackStackUpdate(options) {
+  const exec = options.exec ?? defaultExec;
+  const backupEnvFile = options.lockFile && existsSync(options.lockFile) ? JSON.parse(readFileSync(options.lockFile, "utf8")).backupEnvFile : void 0;
+  const rollbackEnv = backupEnvFile && existsSync(backupEnvFile) ? backupEnvFile : findLatestBackupEnvFile(options.envFile);
+  if (!rollbackEnv) throw new Error(`No stack backup env found beside ${options.envFile}`);
+  writeFileSync(options.envFile, readFileSync(rollbackEnv), { mode: 384 });
+  const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
+  exec("docker", [...composeArgs, "up", "-d"]);
+  return { status: "rolled_back", targetVersion: "previous", changes: [], backupEnvFile: rollbackEnv, lockFile: options.lockFile ?? path.join(path.dirname(options.envFile), ".exe-stack-lock.json") };
+}
+function parseStackManifest(raw, publicKey) {
+  const parsedRaw = JSON.parse(raw);
+  const parsed = isSignedEnvelope(parsedRaw) ? { ...parsedRaw.manifest, signature: parsedRaw.signature } : parsedRaw;
+  if (publicKey) verifyStackManifestSignature(parsed, publicKey);
   if (parsed.schemaVersion !== 1) throw new Error("Unsupported stack manifest schemaVersion");
   if (!parsed.latest || !parsed.stacks || typeof parsed.stacks !== "object") {
     throw new Error("Invalid stack manifest: latest and stacks are required");
@@ -43,9 +95,13 @@ function parseStackManifest(raw) {
   }
   return parsed;
 }
-async function loadStackManifest(ref, fetchText = defaultFetchText) {
-  if (/^https?:\/\//.test(ref)) return parseStackManifest(await fetchText(ref));
-  return parseStackManifest(readFileSync(ref, "utf8"));
+async function loadStackManifest(ref, fetchText = defaultFetchText, publicKey, authToken) {
+  if (/^https?:\/\//.test(ref)) return parseStackManifest(await fetchTextWithAuth(ref, fetchText, authToken), publicKey);
+  return parseStackManifest(readFileSync(ref, "utf8"), publicKey);
+}
+async function fetchTextWithAuth(ref, fetchText, authToken) {
+  if (!authToken || fetchText !== defaultFetchText) return fetchText(ref);
+  return defaultFetchText(ref, authToken);
 }
 function parseEnv(raw) {
   const env = /* @__PURE__ */ new Map();
@@ -111,14 +167,17 @@ Re-run with --allow-breaking ${missing.map((c) => c.id).join(",")}`
 async function runStackUpdate(options) {
   const exec = options.exec ?? defaultExec;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const manifest = await loadStackManifest(options.manifestRef, options.fetchText);
+  if (options.rollback) return rollbackStackUpdate(options);
+  const manifest = await loadStackManifest(options.manifestRef, options.fetchText, options.manifestPublicKey, options.manifestAuthToken);
   const envRaw = readFileSync(options.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, options.targetVersion);
   assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
   const lockFile = options.lockFile ?? path.join(path.dirname(options.envFile), ".exe-stack-lock.json");
+  const previousVersion = readCurrentStackVersion(lockFile);
   if (options.dryRun || plan.changes.length === 0) {
     return { status: "planned", targetVersion: plan.targetVersion, changes: plan.changes, lockFile };
   }
+  await postDeployAudit(options, "started", plan.targetVersion, previousVersion);
   const backupDir = path.join(path.dirname(options.envFile), ".exe-stack-backups");
   mkdirSync(backupDir, { recursive: true });
   const stamp = now().toISOString().replace(/[:.]/g, "-");
@@ -134,7 +193,8 @@ async function runStackUpdate(options) {
     exec("docker", [...composeArgs, "pull"]);
     exec("docker", [...composeArgs, "up", "-d"]);
     await verifyReleaseHealth(plan.release, options.healthRetries ?? 12, options.healthDelayMs ?? 5e3);
-    writeFileSync(lockFile, JSON.stringify({ stackVersion: plan.targetVersion, updatedAt: now().toISOString(), services: plan.release.services }, null, 2) + "\n");
+    writeFileSync(lockFile, JSON.stringify({ stackVersion: plan.targetVersion, updatedAt: now().toISOString(), backupEnvFile, services: plan.release.services }, null, 2) + "\n");
+    await postDeployAudit(options, "success", plan.targetVersion, previousVersion, void 0, { changes: plan.changes.length });
     return { status: "updated", targetVersion: plan.targetVersion, changes: plan.changes, backupEnvFile, lockFile };
   } catch (err) {
     writeFileSync(options.envFile, envRaw, { mode: 384 });
@@ -143,9 +203,37 @@ async function runStackUpdate(options) {
     } catch {
     }
     const reason = err instanceof Error ? err.message : String(err);
+    await postDeployAudit(options, "failed", plan.targetVersion, previousVersion, reason, { rollbackAttempted: true });
     throw new Error(`Stack update failed and rollback was attempted: ${reason}`);
   }
 }
+function readCurrentStackVersion(lockFile) {
+  if (!existsSync(lockFile)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync(lockFile, "utf8"));
+    return parsed.stackVersion;
+  } catch {
+    return void 0;
+  }
+}
+async function postDeployAudit(options, status, stackVersion, previousVersion, error, metadata) {
+  if (!options.auditUrl) return;
+  const postJson = options.postJson ?? defaultPostJson;
+  try {
+    await postJson(options.auditUrl, {
+      stackVersion,
+      previousVersion,
+      status,
+      error,
+      metadata,
+      deviceId: options.deviceId,
+      licenseKey: options.licenseKey
+    }, options.manifestAuthToken);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.warn(`[stack-update] deploy audit failed: ${reason}`);
+  }
+}
 async function verifyReleaseHealth(release, retries, delayMs) {
   for (const [serviceName, service] of Object.entries(release.services)) {
     if (!service.healthUrl) continue;
@@ -182,20 +270,43 @@ function httpStatus(urlString) {
 function defaultExec(cmd, args, opts) {
   execFileSync(cmd, args, { stdio: "inherit", cwd: opts?.cwd });
 }
-async function defaultFetchText(ref) {
-  const res = await fetch(ref);
+async function defaultFetchText(ref, authToken) {
+  const res = await fetch(ref, {
+    headers: authToken ? { authorization: `Bearer ${authToken}` } : void 0
+  });
   if (!res.ok) throw new Error(`Failed to fetch ${ref}: HTTP ${res.status}`);
   return res.text();
 }
+async function defaultPostJson(url, body, authToken) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...authToken ? { authorization: `Bearer ${authToken}` } : {}
+    },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`Failed to POST ${url}: HTTP ${res.status}`);
+}
 function defaultStackPaths() {
   const cwdCompose = path.resolve("docker-compose.yml");
   const cwdEnv = path.resolve(".env");
   return {
     composeFile: process.env.EXE_STACK_COMPOSE_FILE || (existsSync(cwdCompose) ? cwdCompose : "/opt/exe-stack/docker-compose.yml"),
     envFile: process.env.EXE_STACK_ENV_FILE || (existsSync(cwdEnv) ? cwdEnv : "/opt/exe-stack/.env"),
-    manifestRef: process.env.EXE_STACK_MANIFEST || "https://updates.askexe.com/stack-manifest.json"
+    manifestRef: process.env.EXE_STACK_MANIFEST || "https://update.askexe.com/stack-manifest.json",
+    auditUrl: process.env.EXE_STACK_AUDIT_URL || "https://update.askexe.com/v1/deploy-audits",
+    manifestAuthToken: process.env.EXE_STACK_UPDATE_TOKEN,
+    manifestPublicKey: loadDefaultPublicKey()
   };
 }
+function loadDefaultPublicKey() {
+  if (process.env.EXE_STACK_PUBLIC_KEY) return process.env.EXE_STACK_PUBLIC_KEY;
+  if (process.env.EXE_STACK_PUBLIC_KEY_FILE && existsSync(process.env.EXE_STACK_PUBLIC_KEY_FILE)) {
+    return readFileSync(process.env.EXE_STACK_PUBLIC_KEY_FILE, "utf8");
+  }
+  return void 0;
+}
 
 // src/bin/stack-update.ts
 function parseArgs(args) {
@@ -204,8 +315,14 @@ function parseArgs(args) {
     manifestRef: defaults.manifestRef,
     composeFile: defaults.composeFile,
     envFile: defaults.envFile,
+    auditUrl: defaults.auditUrl,
+    manifestAuthToken: defaults.manifestAuthToken,
+    manifestPublicKey: defaults.manifestPublicKey,
+    deviceId: process.env.EXE_DEVICE_ID,
+    licenseKey: process.env.EXE_LICENSE_KEY,
     dryRun: false,
     check: false,
+    rollback: false,
     yes: false,
     allowedBreakingChangeIds: []
   };
@@ -221,6 +338,18 @@ function parseArgs(args) {
     else if (arg === "--env-file") opts.envFile = next();
     else if (arg.startsWith("--env-file=")) opts.envFile = arg.split("=").slice(1).join("=");
     else if (arg === "--lock-file") opts.lockFile = next();
+    else if (arg === "--public-key") opts.manifestPublicKey = readFileSync2(next(), "utf8");
+    else if (arg.startsWith("--public-key=")) opts.manifestPublicKey = readFileSync2(arg.split("=").slice(1).join("="), "utf8");
+    else if (arg === "--auth-token") opts.manifestAuthToken = next();
+    else if (arg.startsWith("--auth-token=")) opts.manifestAuthToken = arg.split("=").slice(1).join("=");
+    else if (arg === "--auth-token-env") opts.manifestAuthToken = process.env[next()] ?? "";
+    else if (arg === "--audit-url") opts.auditUrl = next();
+    else if (arg.startsWith("--audit-url=")) opts.auditUrl = arg.split("=").slice(1).join("=");
+    else if (arg === "--device-id") opts.deviceId = next();
+    else if (arg.startsWith("--device-id=")) opts.deviceId = arg.split("=").slice(1).join("=");
+    else if (arg === "--license-key") opts.licenseKey = next();
+    else if (arg.startsWith("--license-key=")) opts.licenseKey = arg.split("=").slice(1).join("=");
+    else if (arg === "--rollback") opts.rollback = true;
     else if (arg === "--dry-run") opts.dryRun = true;
     else if (arg === "--check") opts.check = true;
     else if (arg === "--yes" || arg === "-y") opts.yes = true;
@@ -242,13 +371,20 @@ Usage:
   exe-os stack-update [--manifest <path-or-url>] [--target <version>] [--yes]
 
 Options:
-  --manifest <ref>           Stack manifest JSON path or URL (default: updates.askexe.com)
+  --manifest <ref>           Stack manifest JSON path or URL (default: update.askexe.com)
   --target <version>         Stack version to install (default: manifest.latest)
   --compose-file <path>      docker-compose.yml path (default: ./docker-compose.yml or /opt/exe-stack/docker-compose.yml)
   --env-file <path>          .env path (default: ./.env or /opt/exe-stack/.env)
   --lock-file <path>         Lock file path (default: beside .env)
   --check                    Print available changes only
   --dry-run                  Plan only; do not run Docker
+  --public-key <path>        PEM public key for signed manifest verification
+  --auth-token <token>       Bearer token for private update manifest/audit API
+  --auth-token-env <name>    Read bearer token from an environment variable
+  --audit-url <url>          Deploy-audit endpoint (default: EXE_STACK_AUDIT_URL/update.askexe.com)
+  --device-id <id>           Device ID to include in deploy audit
+  --license-key <key>        License key to include in deploy audit
+  --rollback                 Restore latest backed-up .env and restart stack
   --allow-breaking <ids>     Confirm breaking changes, comma-separated
   -y, --yes                  Non-interactive confirmation
 `);
@@ -276,7 +412,16 @@ function printBreaking(changes) {
 }
 async function main() {
   const opts = parseArgs(process.argv.slice(2));
-  const manifest = await loadStackManifest(opts.manifestRef);
+  if (opts.rollback) {
+    if (!opts.yes) {
+      console.error("Refusing to rollback without --yes.");
+      process.exit(2);
+    }
+    const result2 = await runStackUpdate(opts);
+    console.log(`\u2705 Stack rollback attempted using backup: ${result2.backupEnvFile ?? "latest backup"}`);
+    return;
+  }
+  const manifest = await loadStackManifest(opts.manifestRef, void 0, opts.manifestPublicKey, opts.manifestAuthToken);
   const envRaw = readFileSync2(opts.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, opts.targetVersion);
   console.log(`Exe OS stack target: ${plan.targetVersion}`);

package/dist/bin/update.js

@@ -80,8 +80,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 150,
-          returnTopK: 5
+          fetchTopK: 200,
+          returnTopK: 20
         }
       },
       graphRagEnabled: true,