@askexenow/exe-os 0.9.69 → 0.9.71

package/dist/bin/graph-backfill.js

@@ -2222,6 +2222,33 @@ async function ensureSchema() {
     CREATE INDEX IF NOT EXISTS idx_chat_history_session
       ON chat_history(session_id, id);
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS session_events (
+      id            TEXT PRIMARY KEY,
+      agent_id      TEXT NOT NULL,
+      agent_role    TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      session_scope TEXT,
+      project_name  TEXT NOT NULL,
+      event_index   INTEGER NOT NULL,
+      event_type    TEXT NOT NULL,
+      tool_name     TEXT,
+      tool_use_id   TEXT,
+      content       TEXT NOT NULL,
+      payload_json  TEXT,
+      has_error     INTEGER NOT NULL DEFAULT 0,
+      created_at    TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_agent_time
+      ON session_events(agent_id, created_at DESC);
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_session_index
+      ON session_events(session_id, event_index);
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_scope_agent_time
+      ON session_events(session_scope, agent_id, created_at DESC);
+  `);
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS workspaces (
       id              TEXT PRIMARY KEY,
@@ -3353,6 +3380,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",
@@ -4662,13 +4695,75 @@ import crypto2 from "crypto";
 
 // src/lib/code-chunker.ts
 import ts from "typescript";
+var LANGUAGE_BY_EXTENSION = {
+  c: "c",
+  cc: "cpp",
+  cpp: "cpp",
+  cxx: "cpp",
+  h: "c",
+  hh: "cpp",
+  hpp: "cpp",
+  cs: "csharp",
+  css: "css",
+  scss: "scss",
+  f: "fortran",
+  f90: "fortran",
+  f95: "fortran",
+  go: "go",
+  html: "html",
+  htm: "html",
+  java: "java",
+  js: "javascript",
+  jsx: "javascript",
+  json: "json",
+  kt: "kotlin",
+  kts: "kotlin",
+  lua: "lua",
+  md: "markdown",
+  mdx: "mdx",
+  pas: "pascal",
+  php: "php",
+  py: "python",
+  r: "r",
+  rb: "ruby",
+  rs: "rust",
+  scala: "scala",
+  sc: "scala",
+  sol: "solidity",
+  sql: "sql",
+  svelte: "svelte",
+  swift: "swift",
+  toml: "toml",
+  ts: "typescript",
+  tsx: "typescript",
+  vue: "vue",
+  xml: "xml",
+  yaml: "yaml",
+  yml: "yaml",
+  sh: "shell",
+  bash: "shell",
+  zsh: "shell"
+};
+var TEXT_LIKE_LANGUAGES = /* @__PURE__ */ new Set(["json", "markdown", "mdx", "toml", "yaml", "xml", "html", "css", "scss", "sql"]);
+function languageForFile(filePath) {
+  const base = filePath.split(/[\\/]/).pop()?.toLowerCase() ?? "";
+  if (["dockerfile", "makefile", "rakefile", "gemfile"].includes(base)) return base;
+  const ext = base.includes(".") ? base.split(".").pop() : void 0;
+  return ext ? LANGUAGE_BY_EXTENSION[ext] : void 0;
+}
 function chunkSourceFile(source, fileName = "file.ts") {
+  const language = languageForFile(fileName);
+  if (language === "typescript" || language === "javascript") {
+    return chunkTypeScriptLike(source, fileName);
+  }
+  return chunkGenericSource(source, fileName, language);
+}
+function chunkTypeScriptLike(source, fileName) {
   const sourceFile = ts.createSourceFile(
     fileName,
     source,
     ts.ScriptTarget.Latest,
     true,
-    // setParentNodes
     fileName.endsWith(".tsx") || fileName.endsWith(".jsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS
   );
   const chunks = [];
@@ -4690,149 +4785,121 @@ function chunkSourceFile(source, fileName = "file.ts") {
     if (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node)) {
       return node.name?.getText(sourceFile) ?? "(anonymous)";
     }
-    if (ts.isClassDeclaration(node)) {
-      return node.name?.getText(sourceFile) ?? "(anonymous class)";
-    }
-    if (ts.isInterfaceDeclaration(node)) {
-      return node.name.getText(sourceFile);
-    }
-    if (ts.isTypeAliasDeclaration(node)) {
-      return node.name.getText(sourceFile);
-    }
-    if (ts.isEnumDeclaration(node)) {
-      return node.name.getText(sourceFile);
-    }
-    if (ts.isVariableStatement(node)) {
-      const decls = node.declarationList.declarations;
-      return decls.map((d) => d.name.getText(sourceFile)).join(", ");
-    }
-    if (ts.isExportAssignment(node)) {
-      return "default export";
-    }
+    if (ts.isClassDeclaration(node)) return node.name?.getText(sourceFile) ?? "(anonymous class)";
+    if (ts.isInterfaceDeclaration(node)) return node.name.getText(sourceFile);
+    if (ts.isTypeAliasDeclaration(node)) return node.name.getText(sourceFile);
+    if (ts.isEnumDeclaration(node)) return node.name.getText(sourceFile);
+    if (ts.isVariableStatement(node)) return node.declarationList.declarations.map((d) => d.name.getText(sourceFile)).join(", ");
+    if (ts.isExportAssignment(node)) return "default export";
     return "(unknown)";
   }
   function visitTopLevel(node) {
     if (ts.isImportDeclaration(node)) {
-      importLines.push({
-        start: getLineNumber(node.getStart(sourceFile)),
-        end: getLineNumber(node.getEnd())
-      });
+      importLines.push({ start: getLineNumber(node.getStart(sourceFile)), end: getLineNumber(node.getEnd()) });
       return;
     }
     if (ts.isFunctionDeclaration(node)) {
-      chunks.push({
-        kind: "function",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
+      chunks.push({ kind: "function", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
       return;
     }
     if (ts.isClassDeclaration(node)) {
-      chunks.push({
-        kind: "class",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
+      chunks.push({ kind: "class", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
       return;
     }
-    if (ts.isInterfaceDeclaration(node)) {
-      chunks.push({
-        kind: "type",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
-      return;
-    }
-    if (ts.isTypeAliasDeclaration(node)) {
-      chunks.push({
-        kind: "type",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
-      return;
-    }
-    if (ts.isEnumDeclaration(node)) {
-      chunks.push({
-        kind: "type",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
+    if (ts.isInterfaceDeclaration(node) || ts.isTypeAliasDeclaration(node) || ts.isEnumDeclaration(node)) {
+      chunks.push({ kind: "type", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
       return;
     }
     if (ts.isVariableStatement(node)) {
-      const decls = node.declarationList.declarations;
-      const isFnLike = decls.some(
-        (d) => d.initializer && (ts.isArrowFunction(d.initializer) || ts.isFunctionExpression(d.initializer))
-      );
-      chunks.push({
-        kind: isFnLike ? "function" : "variable",
-        name: getName(node),
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
+      const isFnLike = node.declarationList.declarations.some((d) => d.initializer && (ts.isArrowFunction(d.initializer) || ts.isFunctionExpression(d.initializer)));
+      chunks.push({ kind: isFnLike ? "function" : "variable", name: getName(node), text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
       return;
     }
     if (ts.isExportAssignment(node)) {
-      chunks.push({
-        kind: "export",
-        name: "default export",
-        text: getNodeText(node),
-        startLine: getLineNumber(node.getStart(sourceFile)),
-        endLine: getLineNumber(node.getEnd()),
-        comment: getLeadingComment(node)
-      });
+      chunks.push({ kind: "export", name: "default export", text: getNodeText(node), startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()), comment: getLeadingComment(node) });
       return;
     }
     if (ts.isExpressionStatement(node)) {
       const text = getNodeText(node);
-      if (text.length > 10) {
-        chunks.push({
-          kind: "other",
-          name: text.slice(0, 40).replace(/\n/g, " "),
-          text,
-          startLine: getLineNumber(node.getStart(sourceFile)),
-          endLine: getLineNumber(node.getEnd())
-        });
-      }
-      return;
+      if (text.length > 10) chunks.push({ kind: "other", name: text.slice(0, 40).replace(/\n/g, " "), text, startLine: getLineNumber(node.getStart(sourceFile)), endLine: getLineNumber(node.getEnd()) });
     }
   }
   sourceFile.statements.forEach(visitTopLevel);
   if (importLines.length > 0) {
     const startLine = importLines[0].start;
     const endLine = importLines[importLines.length - 1].end;
-    const importText = lines.slice(startLine - 1, endLine).join("\n");
-    chunks.unshift({
-      kind: "import",
-      name: `${importLines.length} imports`,
-      text: importText,
-      startLine,
+    chunks.unshift({ kind: "import", name: `${importLines.length} imports`, text: lines.slice(startLine - 1, endLine).join("\n"), startLine, endLine });
+  }
+  chunks.sort((a, b) => a.startLine - b.startLine);
+  return chunks.length > 0 ? chunks : chunkByWindows(source, 80);
+}
+function chunkGenericSource(source, _fileName, language) {
+  const lines = source.split("\n");
+  if (source.trim().length === 0) return [];
+  if (language && TEXT_LIKE_LANGUAGES.has(language)) return chunkTextLike(lines, language);
+  const chunks = [];
+  const patterns = [
+    { kind: "function", regex: /^\s*(?:async\s+)?def\s+([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "class", regex: /^\s*class\s+([A-Za-z_][\w]*)\b/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*(?:pub\s+)?fn\s+([A-Za-z_][\w]*)\s*[<(]/, name: (m) => m[1] },
+    { kind: "class", regex: /^\s*(?:pub\s+)?(?:struct|enum|trait)\s+([A-Za-z_][\w]*)\b/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*func\s+(?:\([^)]*\)\s*)?([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*(?:public|private|protected|static|final|suspend|fun|override|open|internal|export|async|func|function|subroutine)\s+.*?([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "function", regex: /^\s*function\s+([A-Za-z_][\w]*)\s*\(/, name: (m) => m[1] },
+    { kind: "type", regex: /^\s*(?:interface|type|enum|record|data\s+class|case\s+class|contract|library)\s+([A-Za-z_][\w]*)\b/, name: (m) => m[1] },
+    { kind: "section", regex: /^\s{0,3}#{1,6}\s+(.+)$/, name: (m) => m[1].trim() }
+  ];
+  const starts = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    for (const pattern of patterns) {
+      const match = line.match(pattern.regex);
+      if (match) {
+        starts.push({ line: i + 1, kind: pattern.kind, name: pattern.name(match) });
+        break;
+      }
+    }
+  }
+  if (starts.length === 0) return chunkByWindows(source, 80);
+  for (let i = 0; i < starts.length; i++) {
+    const start = starts[i];
+    const next = starts[i + 1]?.line ?? lines.length + 1;
+    const endLine = Math.max(start.line, next - 1);
+    chunks.push({
+      kind: start.kind,
+      name: start.name,
+      text: lines.slice(start.line - 1, endLine).join("\n"),
+      startLine: start.line,
       endLine
     });
   }
-  chunks.sort((a, b) => a.startLine - b.startLine);
+  return chunks;
+}
+function chunkTextLike(lines, language) {
+  if (language === "markdown" || language === "mdx") {
+    const starts = lines.map((line, i) => ({ line, i })).filter(({ line }) => /^\s{0,3}#{1,6}\s+/.test(line));
+    if (starts.length > 0) {
+      return starts.map((start, idx) => {
+        const end = starts[idx + 1]?.i ?? lines.length;
+        const title = start.line.replace(/^\s{0,3}#{1,6}\s+/, "").trim();
+        return { kind: "section", name: title, text: lines.slice(start.i, end).join("\n"), startLine: start.i + 1, endLine: end };
+      });
+    }
+  }
+  return chunkByWindows(lines.join("\n"), 80);
+}
+function chunkByWindows(source, windowLines) {
+  const lines = source.split("\n");
+  const chunks = [];
+  for (let i = 0; i < lines.length; i += windowLines) {
+    const end = Math.min(lines.length, i + windowLines);
+    const text = lines.slice(i, end).join("\n");
+    if (text.trim()) chunks.push({ kind: "other", name: `lines ${i + 1}-${end}`, text, startLine: i + 1, endLine: end });
+  }
   return chunks;
 }
 function isChunkable(filePath) {
-  const ext = filePath.split(".").pop()?.toLowerCase();
-  return ext === "ts" || ext === "tsx" || ext === "js" || ext === "jsx";
+  return Boolean(languageForFile(filePath));
 }
 
 // src/lib/graph-rag.ts

package/dist/bin/graph-export.js

@@ -2437,6 +2437,33 @@ async function ensureSchema() {
     CREATE INDEX IF NOT EXISTS idx_chat_history_session
       ON chat_history(session_id, id);
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS session_events (
+      id            TEXT PRIMARY KEY,
+      agent_id      TEXT NOT NULL,
+      agent_role    TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      session_scope TEXT,
+      project_name  TEXT NOT NULL,
+      event_index   INTEGER NOT NULL,
+      event_type    TEXT NOT NULL,
+      tool_name     TEXT,
+      tool_use_id   TEXT,
+      content       TEXT NOT NULL,
+      payload_json  TEXT,
+      has_error     INTEGER NOT NULL DEFAULT 0,
+      created_at    TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_agent_time
+      ON session_events(agent_id, created_at DESC);
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_session_index
+      ON session_events(session_id, event_index);
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_scope_agent_time
+      ON session_events(session_scope, agent_id, created_at DESC);
+  `);
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS workspaces (
       id              TEXT PRIMARY KEY,
@@ -4125,6 +4152,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",

package/dist/bin/intercom-check.js

@@ -2546,6 +2546,33 @@ async function ensureSchema() {
     CREATE INDEX IF NOT EXISTS idx_chat_history_session
       ON chat_history(session_id, id);
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS session_events (
+      id            TEXT PRIMARY KEY,
+      agent_id      TEXT NOT NULL,
+      agent_role    TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      session_scope TEXT,
+      project_name  TEXT NOT NULL,
+      event_index   INTEGER NOT NULL,
+      event_type    TEXT NOT NULL,
+      tool_name     TEXT,
+      tool_use_id   TEXT,
+      content       TEXT NOT NULL,
+      payload_json  TEXT,
+      has_error     INTEGER NOT NULL DEFAULT 0,
+      created_at    TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_agent_time
+      ON session_events(agent_id, created_at DESC);
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_session_index
+      ON session_events(session_id, event_index);
+
+    CREATE INDEX IF NOT EXISTS idx_session_events_scope_agent_time
+      ON session_events(session_scope, agent_id, created_at DESC);
+  `);
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS workspaces (
       id              TEXT PRIMARY KEY,
@@ -4234,6 +4261,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Code context first for repository orientation",
+        domain: "workflow",
+        priority: "p1",
+        content: "Before broad repo exploration, symbol tracing, blast-radius review, or codebase Q&A, agents should use the consolidated code_context MCP tool instead of manual grep/read loops. Use action=index or stats to refresh/check the index; action=search with query, limit, offset, languages, paths, refresh_index for fresh multi-language code/doc search; action=trace for symbol imports/dependents; action=blast_radius for impact analysis before edits. CLI parity exists via exe-os code-context init|index|status|stats|search|doctor. Keep code_context separate from durable employee memory: promote only validated decisions, procedures, or lessons into store_memory/commit_memory."
+      },
       {
         title: "Commit discipline \u2014 never leave verified work floating",
         domain: "workflow",

package/dist/bin/registry-proxy.js

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+
+// src/lib/is-main.ts
+import { realpathSync } from "fs";
+import { fileURLToPath } from "url";
+function isMainModule(importMetaUrl) {
+  if (process.argv[1] == null) return false;
+  if (process.argv[1].includes("mcp/server")) return false;
+  try {
+    const scriptPath = realpathSync(process.argv[1]);
+    const modulePath = realpathSync(fileURLToPath(importMetaUrl));
+    return scriptPath === modulePath;
+  } catch {
+    return importMetaUrl === `file://${process.argv[1]}` || importMetaUrl === new URL(process.argv[1], "file://").href;
+  }
+}
+
+// src/lib/registry-proxy.ts
+import { createServer } from "http";
+import { Readable } from "stream";
+function parsePullTokens(raw) {
+  return (raw ?? "").split(/[\n,]/).map((s) => s.trim()).filter(Boolean);
+}
+function registryProxyOptionsFromEnv(env = process.env) {
+  const upstreamToken = env.EXE_REGISTRY_PROXY_UPSTREAM_TOKEN || env.GHCR_TOKEN || "";
+  const pullTokens = parsePullTokens(env.EXE_REGISTRY_PROXY_PULL_TOKENS);
+  return {
+    port: Number(env.EXE_REGISTRY_PROXY_PORT || 3201),
+    host: env.EXE_REGISTRY_PROXY_HOST || "0.0.0.0",
+    upstream: env.EXE_REGISTRY_PROXY_UPSTREAM || "https://ghcr.io",
+    upstreamUsername: env.EXE_REGISTRY_PROXY_UPSTREAM_USERNAME || env.GHCR_USERNAME || "askexe",
+    upstreamToken,
+    pullTokens,
+    allowedNamespace: env.EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE || "askexe"
+  };
+}
+function assertRegistryProxyConfig(options) {
+  if (!options.upstreamToken) throw new Error("EXE_REGISTRY_PROXY_UPSTREAM_TOKEN or GHCR_TOKEN is required");
+  if (options.pullTokens.length === 0) throw new Error("EXE_REGISTRY_PROXY_PULL_TOKENS is required");
+  if (!options.allowedNamespace || !/^[a-z0-9._-]+$/i.test(options.allowedNamespace)) {
+    throw new Error("EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE must be a registry-safe namespace");
+  }
+}
+function timingSafeIncludes(values, candidate) {
+  return values.some((value) => value === candidate);
+}
+function parseBasicAuth(header) {
+  if (!header?.startsWith("Basic ")) return null;
+  try {
+    const decoded = Buffer.from(header.slice("Basic ".length), "base64").toString("utf8");
+    const idx = decoded.indexOf(":");
+    if (idx < 0) return null;
+    return { username: decoded.slice(0, idx), password: decoded.slice(idx + 1) };
+  } catch {
+    return null;
+  }
+}
+function unauthorized(res) {
+  res.writeHead(401, {
+    "www-authenticate": 'Basic realm="AskExe Registry Proxy"',
+    "content-type": "application/json"
+  });
+  res.end(JSON.stringify({ error: "registry proxy authentication required" }));
+}
+function isAllowedPath(pathname, namespace) {
+  if (pathname === "/health") return true;
+  if (pathname === "/v2/" || pathname === "/v2") return true;
+  const prefix = `/v2/${namespace}/`;
+  if (!pathname.startsWith(prefix)) return false;
+  if (pathname.includes("..") || /%2f/i.test(pathname)) return false;
+  return true;
+}
+function parseBearerChallenge(header) {
+  if (!header?.toLowerCase().startsWith("bearer ")) return null;
+  const raw = header.slice("Bearer ".length);
+  const params = new URLSearchParams();
+  for (const part of raw.match(/(?:[^,"]+|"[^"]*")+/g) ?? []) {
+    const idx = part.indexOf("=");
+    if (idx < 0) continue;
+    const key = part.slice(0, idx).trim();
+    const value = part.slice(idx + 1).trim().replace(/^"|"$/g, "");
+    params.set(key, value);
+  }
+  const realm = params.get("realm");
+  if (!realm) return null;
+  params.delete("realm");
+  return { realm, params };
+}
+async function fetchUpstreamWithRegistryAuth(url, init, upstreamBasicAuth) {
+  const firstHeaders = new Headers(init.headers);
+  firstHeaders.set("authorization", `Basic ${upstreamBasicAuth}`);
+  const first = await fetch(url, { ...init, headers: firstHeaders });
+  if (first.status !== 401) return first;
+  const challenge = parseBearerChallenge(first.headers.get("www-authenticate"));
+  if (!challenge) return first;
+  const tokenUrl = new URL(challenge.realm);
+  for (const [key, value] of challenge.params.entries()) tokenUrl.searchParams.set(key, value);
+  const tokenRes = await fetch(tokenUrl, { headers: { authorization: `Basic ${upstreamBasicAuth}` } });
+  if (!tokenRes.ok) return first;
+  const tokenJson = await tokenRes.json();
+  const token = tokenJson.token ?? tokenJson.access_token;
+  if (!token) return first;
+  const retryHeaders = new Headers(init.headers);
+  retryHeaders.set("authorization", `Bearer ${token}`);
+  return fetch(url, { ...init, headers: retryHeaders });
+}
+function copyResponseHeaders(from, to) {
+  for (const [key, value] of from.entries()) {
+    const lower = key.toLowerCase();
+    if (["connection", "keep-alive", "transfer-encoding", "content-encoding"].includes(lower)) continue;
+    to.setHeader(key, value);
+  }
+}
+function createRegistryProxyServer(options) {
+  assertRegistryProxyConfig(options);
+  const upstream = new URL(options.upstream ?? "https://ghcr.io");
+  const namespace = options.allowedNamespace ?? "askexe";
+  const upstreamAuth = Buffer.from(`${options.upstreamUsername ?? "askexe"}:${options.upstreamToken}`).toString("base64");
+  return createServer(async (req, res) => {
+    const requestUrl = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+    if (requestUrl.pathname === "/health") {
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ ok: true, service: "exe-registry-proxy", upstream: upstream.origin, namespace }));
+      return;
+    }
+    if (!isAllowedPath(requestUrl.pathname, namespace)) {
+      res.writeHead(404, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: "registry path not allowed" }));
+      return;
+    }
+    const auth = parseBasicAuth(req.headers.authorization);
+    if (!auth || !timingSafeIncludes(options.pullTokens, auth.password)) {
+      unauthorized(res);
+      return;
+    }
+    const upstreamUrl = new URL(requestUrl.pathname + requestUrl.search, upstream.origin);
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(req.headers)) {
+      if (!value) continue;
+      const lower = key.toLowerCase();
+      if (["host", "connection", "authorization", "content-length"].includes(lower)) continue;
+      headers.set(key, Array.isArray(value) ? value.join(",") : value);
+    }
+    headers.set("authorization", `Basic ${upstreamAuth}`);
+    try {
+      const upstreamRes = await fetchUpstreamWithRegistryAuth(upstreamUrl, {
+        method: req.method,
+        headers,
+        body: req.method === "GET" || req.method === "HEAD" ? void 0 : req,
+        // Required by undici when streaming request bodies.
+        duplex: "half"
+      }, upstreamAuth);
+      res.statusCode = upstreamRes.status;
+      res.statusMessage = upstreamRes.statusText;
+      copyResponseHeaders(upstreamRes.headers, res);
+      if (!upstreamRes.body || req.method === "HEAD") {
+        res.end();
+        return;
+      }
+      Readable.fromWeb(upstreamRes.body).pipe(res);
+    } catch (err) {
+      res.writeHead(502, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: "upstream registry proxy failed", detail: err instanceof Error ? err.message : String(err) }));
+    }
+  });
+}
+async function runRegistryProxy(options = registryProxyOptionsFromEnv()) {
+  const server = createRegistryProxyServer(options);
+  await new Promise((resolve) => server.listen(options.port, options.host, resolve));
+  console.log(`exe-registry-proxy listening on ${options.host ?? "0.0.0.0"}:${options.port}`);
+  console.log(`proxying /v2/${options.allowedNamespace ?? "askexe"}/* -> ${options.upstream ?? "https://ghcr.io"}`);
+}
+
+// src/bin/registry-proxy.ts
+function printHelp() {
+  console.log(`exe-os registry-proxy \u2014 authenticated pull-through proxy for AskExe customer images
+
+Environment:
+  EXE_REGISTRY_PROXY_PORT=3201
+  EXE_REGISTRY_PROXY_HOST=0.0.0.0
+  EXE_REGISTRY_PROXY_UPSTREAM=https://ghcr.io
+  EXE_REGISTRY_PROXY_UPSTREAM_USERNAME=<github-user>
+  EXE_REGISTRY_PROXY_UPSTREAM_TOKEN=<askexe-ghcr-read-token>
+  EXE_REGISTRY_PROXY_PULL_TOKENS=<customer-token-1,customer-token-2>
+  EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE=askexe
+
+Docker image shape for clients:
+  registry.askexe.com/askexe/exed:v0.9.3
+  registry.askexe.com/askexe/exe-crm:v0.9.3
+`);
+}
+async function main(args = process.argv.slice(2)) {
+  if (args.includes("--help") || args.includes("-h")) {
+    printHelp();
+    return;
+  }
+  await runRegistryProxy(registryProxyOptionsFromEnv());
+}
+if (isMainModule(import.meta.url)) {
+  main().catch((err) => {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  });
+}
+export {
+  main
+};