@askexenow/exe-os 0.9.83 → 0.9.85

package/deploy/compose/.env.customer.example

@@ -30,7 +30,7 @@ WIKI_SIG_SALT=CHANGEME_WIKI_SIG_SALT
 WIKI_HOST_PORT=3001
 
 # --- exed ---
-EXED_IMAGE_TAG=registry.askexe.com/askexe/exed:v0.9.6
+EXED_IMAGE_TAG=registry.askexe.com/askexe/exed:v0.9.7
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=hygo-vps
 # VPS-only: enables cloud/local SQLite -> exe-db Postgres projection.

package/deploy/compose/.env.example

@@ -30,7 +30,7 @@ WIKI_SIG_SALT=CHANGEME_WIKI_SIG_SALT
 WIKI_HOST_PORT=3001
 
 # --- exed ---
-EXED_IMAGE_TAG=registry.askexe.com/askexe/exed:v0.9.6
+EXED_IMAGE_TAG=registry.askexe.com/askexe/exed:v0.9.7
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=hygo-vps
 # VPS-only: enables cloud/local SQLite -> exe-db Postgres projection.

package/deploy/compose/docker-compose.yml

@@ -236,7 +236,7 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
   exed:
-    image: ${EXED_IMAGE_TAG:-registry.askexe.com/askexe/exed:v0.9.6}
+    image: ${EXED_IMAGE_TAG:-registry.askexe.com/askexe/exed:v0.9.7}
     container_name: exed
     restart: unless-stopped
     env_file:

package/deploy/stack-manifests/v0.9.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "latest": "0.9.6",
+  "latest": "0.9.7",
   "stacks": {
     "0.9.0": {
       "version": "0.9.0",
@@ -429,6 +429,74 @@
       },
       "date": "2026-05-12",
       "sourceRef": "stack-v0.9.6"
+    },
+    "0.9.7": {
+      "version": "0.9.7",
+      "releasedAt": "2026-05-12T00:00:00Z",
+      "notes": "Stack update auth unblock: default manifest now uses the packaged signed/customer manifest when available, so cold-start installs do not require update.askexe.com entitlement provisioning. Remote update service remains opt-in via EXE_STACK_MANIFEST.",
+      "breakingChanges": [
+        {
+          "id": "whatsapp_relink_required",
+          "title": "WhatsApp QR re-link required for Baileys v7",
+          "description": "exe-gateway uses Baileys v7. Existing WhatsApp 6.x linked-device auth state must be backed up and re-linked once with a new QR code.",
+          "requiredAction": "Open https://<gateway-domain>/pair/default?token=<admin-token> and scan from WhatsApp → Linked Devices after the update.",
+          "expectedDowntimeMinutes": "2-5",
+          "requiresConfirmation": true
+        }
+      ],
+      "services": {
+        "crm": {
+          "env": "CRM_IMAGE_TAG",
+          "image": "registry.askexe.com/askexe/exe-crm:v0.9.3",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "deploymentScope": "customer"
+        },
+        "wiki": {
+          "env": "WIKI_IMAGE_TAG",
+          "image": "registry.askexe.com/askexe/exe-wiki:v0.9.3",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "deploymentScope": "customer"
+        },
+        "exed": {
+          "env": "EXED_IMAGE_TAG",
+          "image": "registry.askexe.com/askexe/exed:v0.9.7",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "deploymentScope": "customer"
+        },
+        "gateway": {
+          "env": "GATEWAY_IMAGE_TAG",
+          "image": "registry.askexe.com/askexe/exe-gateway:v0.9.3",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "deploymentScope": "customer"
+        },
+        "monitorAgent": {
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "image": "registry.askexe.com/askexe/exe-monitor-agent:v0.9.3",
+          "deploymentScope": "customer"
+        }
+      },
+      "releaseDescriptors": {
+        "exed": "AskExe/exe-os@stack-v0.9.4:stack.release.json",
+        "crm": "AskExe/exe-crm@0.9.3:stack.release.json",
+        "wiki": "AskExe/exe-wiki@0.9.3:stack.release.json",
+        "gateway": "AskExe/exe-gateway@0.9.3:stack.release.json",
+        "db": "AskExe/exe-db@0.9.3:stack.release.json",
+        "monitorAgent": "AskExe/exe-monitor@0.9.3:stack.release.json"
+      },
+      "componentVersions": {
+        "exe-os": {
+          "repo": "AskExe/exe-os",
+          "npmPackage": "@askexenow/exe-os",
+          "npmVersion": "0.9.84",
+          "image": "registry.askexe.com/askexe/exed:v0.9.4",
+          "imageVersion": "0.9.7",
+          "note": "Customer stack image tag is 0.9.4; bundled npm package is @askexenow/exe-os@0.9.81. Hygo pulls through registry.askexe.com, which proxies the AskExe-owned GHCR artifact server-side.",
+          "sourceRef": "stack-v0.9.4",
+          "commit": "main@stack-v0.9.7"
+        }
+      },
+      "date": "2026-05-12",
+      "sourceRef": "stack-v0.9.7"
     }
   }
 }

package/dist/bin/cli.js

@@ -1241,6 +1241,7 @@ async function registerMcpServer(packageRoot, homeDir = os6.homedir()) {
 `
       );
     }
+    await registerExeRustMcpConfig(packageRoot, homeDir);
     return false;
   }
   claudeJson.mcpServers[MCP_PRIMARY_KEY] = newEntry;
@@ -1254,8 +1255,39 @@ async function registerMcpServer(packageRoot, homeDir = os6.homedir()) {
 `
     );
   }
+  await registerExeRustMcpConfig(packageRoot, homeDir);
   return true;
 }
+async function registerExeRustMcpConfig(packageRoot, homeDir) {
+  const exeDir = path7.join(homeDir, ".exe");
+  const exeMcpPath = path7.join(exeDir, "mcp.json");
+  await mkdir3(exeDir, { recursive: true });
+  let config = { servers: {} };
+  if (existsSync8(exeMcpPath)) {
+    try {
+      config = JSON.parse(await readFile3(exeMcpPath, "utf-8"));
+      if (!config.servers) config.servers = {};
+    } catch {
+      config = { servers: {} };
+    }
+  }
+  const stdioEntry = {
+    command: "node",
+    args: [path7.join(packageRoot, "dist", "mcp", "server.js")],
+    env: {},
+    shared: true
+  };
+  const existing = config.servers[MCP_PRIMARY_KEY];
+  if (existing && JSON.stringify(existing) === JSON.stringify(stdioEntry)) {
+    return;
+  }
+  if (config.servers[MCP_LEGACY_KEY]) {
+    delete config.servers[MCP_LEGACY_KEY];
+  }
+  config.servers[MCP_PRIMARY_KEY] = stdioEntry;
+  await writeFile3(exeMcpPath, JSON.stringify(config, null, 2) + "\n");
+  process.stderr.write("exe-os: registered MCP server in ~/.exe/mcp.json (Rust runtime)\n");
+}
 async function cleanSettingsJsonMcp(settingsPath) {
   if (!existsSync8(settingsPath)) return;
   try {
@@ -20113,12 +20145,25 @@ function assertHostReadyForApply(report) {
   if (blockers.length > 0) throw new Error(`Stack host is not ready:
 - ${blockers.join("\n- ")}`);
 }
+function areStackContainersRunning(composeFile, envFile) {
+  try {
+    const result = spawnSync("docker", ["compose", "--file", composeFile, "--env-file", envFile, "ps", "-q"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 15e3
+    });
+    return result.status === 0 && (result.stdout?.toString().trim().length ?? 0) > 0;
+  } catch {
+    return false;
+  }
+}
 async function runStackUpdate(options) {
   const exec2 = options.exec ?? defaultExec;
   const now2 = options.now ?? (() => /* @__PURE__ */ new Date());
   if (options.rollback) return rollbackStackUpdate(options);
-  const report = bootstrapStackHost({ ...options, installDocker: options.installDocker ?? !!options.yes });
-  if (!options.dryRun) assertHostReadyForApply(report);
+  if (options.bootstrap !== false) {
+    const report = bootstrapStackHost({ ...options, installDocker: options.installDocker ?? !!options.yes });
+    if (!options.dryRun) assertHostReadyForApply(report);
+  }
   const manifest = await loadStackManifest(options.manifestRef, options.fetchText, options.manifestPublicKey, options.manifestAuthToken);
   const envRaw = readFileSync29(options.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, options.targetVersion);
@@ -20134,7 +20179,8 @@ async function runStackUpdate(options) {
   });
   const lockFile = options.lockFile ?? path42.join(path42.dirname(options.envFile), ".exe-stack-lock.json");
   const previousVersion = readCurrentStackVersion(lockFile);
-  if (options.dryRun || plan.changes.length === 0) {
+  const containersRunning = plan.changes.length === 0 ? areStackContainersRunning(options.composeFile, options.envFile) : true;
+  if (options.dryRun || plan.changes.length === 0 && containersRunning) {
     return { status: "planned", targetVersion: plan.targetVersion, changes: plan.changes, lockFile };
   }
   await postDeployAudit(options, "started", plan.targetVersion, previousVersion);
@@ -20286,12 +20332,16 @@ async function defaultPostJson(url, body, authToken) {
 function defaultStackPaths() {
   const cwdCompose = path42.resolve("docker-compose.yml");
   const cwdEnv = path42.resolve(".env");
+  const packagedManifest = path42.join(resolvePackageRoot2(), "deploy", "stack-manifests", "v0.9.json");
+  const manifestRef = process.env.EXE_STACK_MANIFEST || (existsSync34(packagedManifest) ? packagedManifest : "https://update.askexe.com/stack-manifest.json");
   return {
     composeFile: process.env.EXE_STACK_COMPOSE_FILE || (existsSync34(cwdCompose) ? cwdCompose : "/opt/exe-stack/docker-compose.yml"),
     envFile: process.env.EXE_STACK_ENV_FILE || (existsSync34(cwdEnv) ? cwdEnv : "/opt/exe-stack/.env"),
-    manifestRef: process.env.EXE_STACK_MANIFEST || "https://update.askexe.com/stack-manifest.json",
-    auditUrl: process.env.EXE_STACK_AUDIT_URL || "https://update.askexe.com/v1/deploy-audits",
-    imageCredentialsUrl: process.env.EXE_STACK_IMAGE_CREDENTIALS_URL || "https://update.askexe.com/v1/image-credentials",
+    manifestRef,
+    // Only call update.askexe.com if explicitly configured or if a remote manifest was requested.
+    // Packaged manifests keep cold-start installs unblocked even before update-service entitlements are provisioned.
+    auditUrl: process.env.EXE_STACK_AUDIT_URL || (/^https?:\/\//.test(manifestRef) ? "https://update.askexe.com/v1/deploy-audits" : void 0),
+    imageCredentialsUrl: process.env.EXE_STACK_IMAGE_CREDENTIALS_URL || (/^https?:\/\//.test(manifestRef) ? "https://update.askexe.com/v1/image-credentials" : void 0),
     manifestAuthToken: process.env.EXE_STACK_UPDATE_TOKEN || process.env.EXE_LICENSE_KEY || loadLicense() || void 0,
     manifestPublicKey: loadDefaultPublicKey()
   };
@@ -20318,6 +20368,7 @@ __export(stack_update_exports, {
   runStackUpdateCli: () => main7
 });
 import { readFileSync as readFileSync30 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
 function parseArgs4(args2) {
   const defaults = defaultStackPaths();
   const opts = {
@@ -20427,9 +20478,14 @@ Options:
   -y, --yes                  Non-interactive confirmation
 `);
 }
-function printChanges(changes) {
+function printChanges(changes, composeFile, envFile) {
   if (changes.length === 0) {
-    console.log("\u2705 Stack already matches target manifest.");
+    const running = areCliContainersRunning(composeFile, envFile);
+    if (running) {
+      console.log("\u2705 Stack already matches target manifest.");
+    } else {
+      console.log("\u26A0\uFE0F  Stack .env matches target manifest but containers are not running. Will start them.");
+    }
     return;
   }
   console.log("Planned image tag changes:");
@@ -20438,6 +20494,17 @@ function printChanges(changes) {
     console.log(`      ${c.before ?? "<unset>"} \u2192 ${c.after}`);
   }
 }
+function areCliContainersRunning(composeFile, envFile) {
+  try {
+    const result = spawnSync2("docker", ["compose", "--file", composeFile, "--env-file", envFile, "ps", "-q"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 15e3
+    });
+    return result.status === 0 && (result.stdout?.toString().trim().length ?? 0) > 0;
+  } catch {
+    return false;
+  }
+}
 function printBreaking(changes) {
   if (changes.length === 0) return;
   console.log("\nBreaking-change notices:");
@@ -20492,7 +20559,7 @@ async function main7(args2 = process.argv.slice(2)) {
   console.log(`Compose:  ${opts.composeFile}`);
   console.log(`Env:      ${opts.envFile}
 `);
-  printChanges(plan.changes);
+  printChanges(plan.changes, opts.composeFile, opts.envFile);
   printBreaking(plan.breakingChanges);
   if (opts.check || opts.dryRun) return;
   if (!opts.yes) {
@@ -35057,7 +35124,7 @@ __export(code_context_index_exports, {
 import crypto14 from "crypto";
 import path51 from "path";
 import { existsSync as existsSync36, mkdirSync as mkdirSync25, readFileSync as readFileSync32, readdirSync as readdirSync11, statSync as statSync7, writeFileSync as writeFileSync26 } from "fs";
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 function normalizeProjectRoot(projectRoot) {
   return path51.resolve(projectRoot || process.cwd());
 }
@@ -35075,7 +35142,7 @@ function getCodeContextIndexPath(projectRoot) {
   return path51.join(indexDir(), `${rootHash}.json`);
 }
 function currentBranch(projectRoot) {
-  const result = spawnSync2("git", ["branch", "--show-current"], { cwd: projectRoot, encoding: "utf8", timeout: 2e3 });
+  const result = spawnSync3("git", ["branch", "--show-current"], { cwd: projectRoot, encoding: "utf8", timeout: 2e3 });
   const branch = result.status === 0 ? result.stdout.trim() : "";
   return branch || "detached-or-unknown";
 }
@@ -35094,12 +35161,12 @@ function listRecursive(projectRoot, dir = projectRoot, out = []) {
   return out;
 }
 function listCodeFiles(projectRoot, maxFiles) {
-  const git = spawnSync2("git", ["ls-files"], { cwd: projectRoot, encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024 * 16 });
+  const git = spawnSync3("git", ["ls-files"], { cwd: projectRoot, encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024 * 16 });
   let files = [];
   if (git.status === 0 && git.stdout.trim()) {
     files = git.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
   } else {
-    const rg = spawnSync2("rg", ["--files"], { cwd: projectRoot, encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024 * 16 });
+    const rg = spawnSync3("rg", ["--files"], { cwd: projectRoot, encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024 * 16 });
     files = rg.status === 0 && rg.stdout.trim() ? rg.stdout.split("\n").map((s) => s.trim()).filter(Boolean) : listRecursive(projectRoot);
   }
   return files.map((file) => file.replaceAll(path51.sep, "/")).filter((file) => isChunkable(file) && !shouldIgnore(file)).slice(0, maxFiles).sort();

package/dist/bin/exe-launch-agent.js

@@ -3332,8 +3332,8 @@ function deriveMachineKey() {
 }
 function readMachineId() {
   try {
-    const { readFileSync: readFileSync7 } = __require("fs");
-    return readFileSync7("/etc/machine-id", "utf-8").trim();
+    const { readFileSync: readFileSync8 } = __require("fs");
+    return readFileSync8("/etc/machine-id", "utf-8").trim();
   } catch {
     return "";
   }
@@ -5473,6 +5473,68 @@ var init_store = __esm({
   }
 });
 
+// src/lib/runtime-table.ts
+var RUNTIME_TABLE, DEFAULT_RUNTIME;
+var init_runtime_table = __esm({
+  "src/lib/runtime-table.ts"() {
+    "use strict";
+    RUNTIME_TABLE = {
+      codex: {
+        binary: "codex",
+        launchMode: "interactive",
+        autoApproveFlag: "--dangerously-bypass-approvals-and-sandbox",
+        inlineFlag: "--no-alt-screen",
+        apiKeyEnv: "OPENAI_API_KEY",
+        defaultModel: "gpt-5.5"
+      },
+      opencode: {
+        binary: "opencode",
+        launchMode: "exec",
+        autoApproveFlag: "--dangerously-skip-permissions",
+        inlineFlag: "",
+        apiKeyEnv: "ANTHROPIC_API_KEY",
+        defaultModel: "anthropic/claude-sonnet-4-6"
+      }
+    };
+    DEFAULT_RUNTIME = "claude";
+  }
+});
+
+// src/lib/agent-config.ts
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync9 } from "fs";
+import path9 from "path";
+function loadAgentConfig() {
+  if (!existsSync9(AGENT_CONFIG_PATH)) return {};
+  try {
+    return JSON.parse(readFileSync5(AGENT_CONFIG_PATH, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function getAgentRuntime(agentId) {
+  const config = loadAgentConfig();
+  const entry = config[agentId];
+  if (entry) return entry;
+  const orgDefault = config["default"];
+  if (orgDefault) return orgDefault;
+  return { runtime: DEFAULT_RUNTIME, model: DEFAULT_MODELS[DEFAULT_RUNTIME] };
+}
+var AGENT_CONFIG_PATH, DEFAULT_MODELS;
+var init_agent_config = __esm({
+  "src/lib/agent-config.ts"() {
+    "use strict";
+    init_config();
+    init_runtime_table();
+    init_secure_files();
+    AGENT_CONFIG_PATH = path9.join(EXE_AI_DIR, "agent-config.json");
+    DEFAULT_MODELS = {
+      claude: "claude-opus-4.6",
+      codex: RUNTIME_TABLE.codex?.defaultModel ?? "gpt-5.4",
+      opencode: RUNTIME_TABLE.opencode?.defaultModel ?? "anthropic/claude-sonnet-4-6"
+    };
+  }
+});
+
 // src/lib/session-key.ts
 import { execSync as execSync4 } from "child_process";
 function normalizeCommand(command) {
@@ -5564,9 +5626,9 @@ __export(active_agent_exports, {
   resolveActiveAgentFromTmuxSession: () => resolveActiveAgentFromTmuxSession,
   writeActiveAgent: () => writeActiveAgent
 });
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, unlinkSync as unlinkSync4, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, unlinkSync as unlinkSync4, readdirSync as readdirSync3 } from "fs";
 import { execSync as execSync5 } from "child_process";
-import path9 from "path";
+import path10 from "path";
 function isNameWithOptionalInstance(candidate, baseName) {
   if (candidate === baseName) return true;
   if (!candidate.startsWith(baseName)) return false;
@@ -5610,12 +5672,12 @@ function resolveActiveAgentFromTmuxSession(sessionName) {
   return null;
 }
 function getMarkerPath() {
-  return path9.join(CACHE_DIR, `active-agent-${getSessionKey()}.json`);
+  return path10.join(CACHE_DIR, `active-agent-${getSessionKey()}.json`);
 }
 function writeActiveAgent(agentId, agentRole) {
   try {
     mkdirSync4(CACHE_DIR, { recursive: true });
-    writeFileSync4(
+    writeFileSync5(
       getMarkerPath(),
       JSON.stringify({ agentId, agentRole, startedAt: (/* @__PURE__ */ new Date()).toISOString() })
     );
@@ -5633,7 +5695,7 @@ function getActiveAgent() {
   if (httpCtx) return httpCtx;
   try {
     const markerPath = getMarkerPath();
-    const raw = readFileSync5(markerPath, "utf8");
+    const raw = readFileSync6(markerPath, "utf8");
     const data = JSON.parse(raw);
     if (data.agentId) {
       if (data.startedAt) {
@@ -5681,14 +5743,14 @@ function getAllActiveAgents() {
       const key = file.slice("active-agent-".length, -".json".length);
       if (key === "undefined") continue;
       try {
-        const raw = readFileSync5(path9.join(CACHE_DIR, file), "utf8");
+        const raw = readFileSync6(path10.join(CACHE_DIR, file), "utf8");
         const data = JSON.parse(raw);
         if (!data.agentId) continue;
         if (data.startedAt) {
           const age = Date.now() - new Date(data.startedAt).getTime();
           if (age > STALE_MS) {
             try {
-              unlinkSync4(path9.join(CACHE_DIR, file));
+              unlinkSync4(path10.join(CACHE_DIR, file));
             } catch {
             }
             continue;
@@ -5711,11 +5773,11 @@ function getAllActiveAgents() {
 function cleanupSessionMarkers() {
   const key = getSessionKey();
   try {
-    unlinkSync4(path9.join(CACHE_DIR, `active-agent-${key}.json`));
+    unlinkSync4(path10.join(CACHE_DIR, `active-agent-${key}.json`));
   } catch {
   }
   try {
-    unlinkSync4(path9.join(CACHE_DIR, "active-agent-undefined.json"));
+    unlinkSync4(path10.join(CACHE_DIR, "active-agent-undefined.json"));
   } catch {
   }
 }
@@ -5727,7 +5789,7 @@ var init_active_agent = __esm({
     init_session_key();
     init_agent_context();
     init_employees();
-    CACHE_DIR = path9.join(EXE_AI_DIR, "session-cache");
+    CACHE_DIR = path10.join(EXE_AI_DIR, "session-cache");
     STALE_MS = 24 * 60 * 60 * 1e3;
   }
 });
@@ -5735,8 +5797,8 @@ var init_active_agent = __esm({
 // src/bin/exe-launch-agent.ts
 init_store();
 import os7 from "os";
-import path10 from "path";
-import { existsSync as existsSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync4 } from "fs";
+import path11 from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync4 } from "fs";
 import { spawnSync } from "child_process";
 
 // src/bin/fast-db-init.ts
@@ -6108,6 +6170,7 @@ var PROVIDER_TABLE = {
 var DEFAULT_PROVIDER = "default";
 
 // src/bin/exe-launch-agent.ts
+init_agent_config();
 function getKnownAgents() {
   try {
     return loadEmployeesSync().map((e) => e.name);
@@ -6125,7 +6188,7 @@ function parseBasename(basename) {
   return { agent, provider };
 }
 function resolveAgent(argv) {
-  const invokedAs = path10.basename(argv[1] ?? "");
+  const invokedAs = path11.basename(argv[1] ?? "");
   if (invokedAs && invokedAs !== "exe-launch-agent" && !invokedAs.endsWith(".js")) {
     const { agent: agent2, provider } = parseBasename(invokedAs.toLowerCase());
     return { agent: agent2, provider, passthrough: argv.slice(2) };
@@ -6154,13 +6217,13 @@ async function isKnownAgent(agent) {
   }
 }
 function identityPathFor(agent) {
-  const dir = path10.join(os7.homedir(), ".exe-os", "identity");
-  const exactPath = path10.join(dir, `${agent}.md`);
-  if (existsSync9(exactPath)) return exactPath;
+  const dir = path11.join(os7.homedir(), ".exe-os", "identity");
+  const exactPath = path11.join(dir, `${agent}.md`);
+  if (existsSync10(exactPath)) return exactPath;
   try {
     const files = readdirSync4(dir);
     const match = files.find((f) => f.toLowerCase() === `${agent.toLowerCase()}.md`);
-    if (match) return path10.join(dir, match);
+    if (match) return path11.join(dir, match);
   } catch {
   }
   return exactPath;
@@ -6182,13 +6245,13 @@ function leanMcpEnabled() {
 function collectAllMcpServers() {
   const servers = {};
   const sources = [
-    path10.join(os7.homedir(), ".claude.json"),
-    path10.join(os7.homedir(), ".claude", "settings.json")
+    path11.join(os7.homedir(), ".claude.json"),
+    path11.join(os7.homedir(), ".claude", "settings.json")
   ];
   for (const src of sources) {
     try {
-      if (!existsSync9(src)) continue;
-      const data = JSON.parse(readFileSync6(src, "utf-8"));
+      if (!existsSync10(src)) continue;
+      const data = JSON.parse(readFileSync7(src, "utf-8"));
       const block = data.mcpServers;
       if (!block) continue;
       for (const [name, cfg] of Object.entries(block)) {
@@ -6214,18 +6277,18 @@ function generateLeanMcpConfig(agent, role) {
     }
     if (Object.keys(leanServers).length >= Object.keys(allServers).length) return null;
     if (!leanServers["exe-mem"]) {
-      const packageRoot = path10.resolve(path10.dirname(new URL(import.meta.url).pathname), "..", "..");
+      const packageRoot = path11.resolve(path11.dirname(new URL(import.meta.url).pathname), "..", "..");
       leanServers["exe-mem"] = {
         type: "stdio",
         command: "node",
-        args: [path10.join(packageRoot, "dist", "mcp", "server.js")],
+        args: [path11.join(packageRoot, "dist", "mcp", "server.js")],
         env: {}
       };
     }
-    const configDir = path10.join(os7.homedir(), ".exe-os", "mcp-configs");
+    const configDir = path11.join(os7.homedir(), ".exe-os", "mcp-configs");
     mkdirSync5(configDir, { recursive: true });
-    const configPath = path10.join(configDir, `${agent}-lean.json`);
-    writeFileSync5(configPath, JSON.stringify({ mcpServers: leanServers }, null, 2), "utf-8");
+    const configPath = path11.join(configDir, `${agent}-lean.json`);
+    writeFileSync6(configPath, JSON.stringify({ mcpServers: leanServers }, null, 2), "utf-8");
     const saved = Object.keys(allServers).length - Object.keys(leanServers).length;
     if (saved > 0) {
       process.stderr.write(
@@ -6244,8 +6307,8 @@ function generateLeanMcpConfig(agent, role) {
 }
 function leanMcpConfigFor(agent) {
   if (!leanMcpEnabled()) return null;
-  const p = path10.join(os7.homedir(), ".exe-os", "mcp-configs", `${agent}-lean.json`);
-  return existsSync9(p) ? p : null;
+  const p = path11.join(os7.homedir(), ".exe-os", "mcp-configs", `${agent}-lean.json`);
+  return existsSync10(p) ? p : null;
 }
 var _ccHelpOutput = null;
 function getCcHelpOutput() {
@@ -6268,39 +6331,39 @@ function _resetCcHelpCache() {
 function buildLaunchPlan(agent, behaviorsPath, passthrough, _hasAgentFlag, _provider) {
   const args = ["--dangerously-skip-permissions"];
   const idPath = identityPathFor(agent);
-  const ccAgentPath = path10.join(os7.homedir(), ".claude", "agents", `${agent}.md`);
+  const ccAgentPath = path11.join(os7.homedir(), ".claude", "agents", `${agent}.md`);
   let effectiveCcPath = null;
-  if (existsSync9(ccAgentPath)) {
+  if (existsSync10(ccAgentPath)) {
     effectiveCcPath = ccAgentPath;
   } else {
     try {
-      const ccAgentDir = path10.join(os7.homedir(), ".claude", "agents");
+      const ccAgentDir = path11.join(os7.homedir(), ".claude", "agents");
       const ccFiles = readdirSync4(ccAgentDir);
       const ccMatch = ccFiles.find((f) => f.toLowerCase() === `${agent.toLowerCase()}.md`);
-      if (ccMatch) effectiveCcPath = path10.join(ccAgentDir, ccMatch);
+      if (ccMatch) effectiveCcPath = path11.join(ccAgentDir, ccMatch);
     } catch {
     }
   }
-  const effectiveIdPath = existsSync9(idPath) ? idPath : effectiveCcPath;
+  const effectiveIdPath = existsSync10(idPath) ? idPath : effectiveCcPath;
   let identityContent = null;
-  if (effectiveIdPath && existsSync9(effectiveIdPath)) {
+  if (effectiveIdPath && existsSync10(effectiveIdPath)) {
     try {
-      const content = readFileSync6(effectiveIdPath, "utf-8");
+      const content = readFileSync7(effectiveIdPath, "utf-8");
       if (content.trim().length > 0) identityContent = content;
     } catch {
     }
   }
   if (!identityContent) {
     try {
-      const rosterPath = path10.join(os7.homedir(), ".exe-os", "exe-employees.json");
-      if (existsSync9(rosterPath)) {
-        const roster = JSON.parse(readFileSync6(rosterPath, "utf8"));
+      const rosterPath = path11.join(os7.homedir(), ".exe-os", "exe-employees.json");
+      if (existsSync10(rosterPath)) {
+        const roster = JSON.parse(readFileSync7(rosterPath, "utf8"));
         const emp = roster.find((e) => e.name.toLowerCase() === agent.toLowerCase());
         if (emp?.systemPrompt && emp.systemPrompt.trim().length > 20) {
           identityContent = emp.systemPrompt;
           try {
-            const dir = path10.dirname(idPath);
-            if (!existsSync9(dir)) mkdirSync5(dir, { recursive: true });
+            const dir = path11.dirname(idPath);
+            if (!existsSync10(dir)) mkdirSync5(dir, { recursive: true });
             const hasFrontmatter = identityContent.trimStart().startsWith("---");
             const fileContent = hasFrontmatter ? identityContent : `---
 role: ${(emp.role ?? "employee").toLowerCase()}
@@ -6312,7 +6375,7 @@ updated_at: ${(/* @__PURE__ */ new Date()).toISOString()}
 ---
 
 ${identityContent}`;
-            writeFileSync5(idPath, fileContent, "utf-8");
+            writeFileSync6(idPath, fileContent, "utf-8");
             identityContent = fileContent;
             process.stderr.write(`[exe-launch-agent] self-healed missing identity file: ${idPath}
 `);
@@ -6340,15 +6403,15 @@ ${identityContent}`;
       args.push("--system-prompt", getSessionPrompt(identityContent));
     } else {
       try {
-        const tmpPath = path10.join(os7.homedir(), ".exe-os", "session-cache", `${agent}-identity.md`);
-        mkdirSync5(path10.dirname(tmpPath), { recursive: true });
-        writeFileSync5(tmpPath, identityContent, "utf-8");
+        const tmpPath = path11.join(os7.homedir(), ".exe-os", "session-cache", `${agent}-identity.md`);
+        mkdirSync5(path11.dirname(tmpPath), { recursive: true });
+        writeFileSync6(tmpPath, identityContent, "utf-8");
         args.push("--append-system-prompt-file", tmpPath);
       } catch {
       }
     }
   }
-  if (behaviorsPath && existsSync9(behaviorsPath)) {
+  if (behaviorsPath && existsSync10(behaviorsPath)) {
     args.push("--append-system-prompt-file", behaviorsPath);
   }
   const leanMcp = leanMcpConfigFor(agent);
@@ -6440,28 +6503,28 @@ async function main() {
   _resetCcAgentSupportCache();
   const hasAgentFlag = claudeSupportsAgentFlag();
   if (hasAgentFlag) {
-    const ccAgentDir = path10.join(os7.homedir(), ".claude", "agents");
-    const ccAgentFile = path10.join(ccAgentDir, `${agent}.md`);
-    if (!existsSync9(ccAgentFile)) {
+    const ccAgentDir = path11.join(os7.homedir(), ".claude", "agents");
+    const ccAgentFile = path11.join(ccAgentDir, `${agent}.md`);
+    if (!existsSync10(ccAgentFile)) {
       const exeIdentity = identityPathFor(agent);
       let sourceFile = null;
-      if (existsSync9(exeIdentity)) {
+      if (existsSync10(exeIdentity)) {
         sourceFile = exeIdentity;
       } else {
         try {
-          const identityDir = path10.dirname(exeIdentity);
+          const identityDir = path11.dirname(exeIdentity);
           const files = readdirSync4(identityDir);
           const match = files.find((f) => f.toLowerCase() === `${agent.toLowerCase()}.md`);
-          if (match) sourceFile = path10.join(identityDir, match);
+          if (match) sourceFile = path11.join(identityDir, match);
         } catch {
         }
       }
       if (sourceFile) {
         try {
           mkdirSync5(ccAgentDir, { recursive: true });
-          let content = readFileSync6(sourceFile, "utf-8");
+          let content = readFileSync7(sourceFile, "utf-8");
           content = content.replace(/\$\{agent_id\}/g, baseAgentName(agent));
-          writeFileSync5(ccAgentFile, content, "utf-8");
+          writeFileSync6(ccAgentFile, content, "utf-8");
           process.stderr.write(
             `[exe-launch-agent] auto-provisioned ${ccAgentFile} from ${sourceFile}
 `
@@ -6474,8 +6537,8 @@ async function main() {
   const memoryAgent = baseAgentName(agent);
   const empRole = (() => {
     try {
-      const emps = readFileSync6(
-        path10.join(os7.homedir(), ".exe-os", "exe-employees.json"),
+      const emps = readFileSync7(
+        path11.join(os7.homedir(), ".exe-os", "exe-employees.json"),
         "utf-8"
       );
       const found = JSON.parse(emps).find(
@@ -6504,6 +6567,16 @@ async function main() {
   if (!process.env.CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING) {
     process.env.CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING = "1";
   }
+  if (provider === DEFAULT_PROVIDER) {
+    const rtConfig = getAgentRuntime(memoryAgent);
+    if (rtConfig.runtime === "claude" && rtConfig.model) {
+      let ccModel = rtConfig.model.replace(/(\d+)\.(\d+)/g, "$1-$2");
+      if (/claude-(opus|sonnet)-4-[6-9]/.test(ccModel) && !ccModel.includes("[1m]")) {
+        ccModel += "[1m]";
+      }
+      process.env.ANTHROPIC_MODEL = ccModel;
+    }
+  }
   const child = spawnSync(plan.command, plan.args, { stdio: "inherit" });
   if (child.error) {
     const err = child.error;

package/dist/bin/exe-new-employee.js

@@ -1662,6 +1662,7 @@ async function registerMcpServer(packageRoot, homeDir = os8.homedir()) {
 `
       );
     }
+    await registerExeRustMcpConfig(packageRoot, homeDir);
     return false;
   }
   claudeJson.mcpServers[MCP_PRIMARY_KEY] = newEntry;
@@ -1675,8 +1676,39 @@ async function registerMcpServer(packageRoot, homeDir = os8.homedir()) {
 `
     );
   }
+  await registerExeRustMcpConfig(packageRoot, homeDir);
   return true;
 }
+async function registerExeRustMcpConfig(packageRoot, homeDir) {
+  const exeDir = path12.join(homeDir, ".exe");
+  const exeMcpPath = path12.join(exeDir, "mcp.json");
+  await mkdir3(exeDir, { recursive: true });
+  let config = { servers: {} };
+  if (existsSync12(exeMcpPath)) {
+    try {
+      config = JSON.parse(await readFile3(exeMcpPath, "utf-8"));
+      if (!config.servers) config.servers = {};
+    } catch {
+      config = { servers: {} };
+    }
+  }
+  const stdioEntry = {
+    command: "node",
+    args: [path12.join(packageRoot, "dist", "mcp", "server.js")],
+    env: {},
+    shared: true
+  };
+  const existing = config.servers[MCP_PRIMARY_KEY];
+  if (existing && JSON.stringify(existing) === JSON.stringify(stdioEntry)) {
+    return;
+  }
+  if (config.servers[MCP_LEGACY_KEY]) {
+    delete config.servers[MCP_LEGACY_KEY];
+  }
+  config.servers[MCP_PRIMARY_KEY] = stdioEntry;
+  await writeFile3(exeMcpPath, JSON.stringify(config, null, 2) + "\n");
+  process.stderr.write("exe-os: registered MCP server in ~/.exe/mcp.json (Rust runtime)\n");
+}
 async function cleanSettingsJsonMcp(settingsPath) {
   if (!existsSync12(settingsPath)) return;
   try {

package/dist/bin/install.js

@@ -991,6 +991,7 @@ async function registerMcpServer(packageRoot, homeDir = os6.homedir()) {
 `
       );
     }
+    await registerExeRustMcpConfig(packageRoot, homeDir);
     return false;
   }
   claudeJson.mcpServers[MCP_PRIMARY_KEY] = newEntry;
@@ -1004,8 +1005,39 @@ async function registerMcpServer(packageRoot, homeDir = os6.homedir()) {
 `
     );
   }
+  await registerExeRustMcpConfig(packageRoot, homeDir);
   return true;
 }
+async function registerExeRustMcpConfig(packageRoot, homeDir) {
+  const exeDir = path7.join(homeDir, ".exe");
+  const exeMcpPath = path7.join(exeDir, "mcp.json");
+  await mkdir3(exeDir, { recursive: true });
+  let config = { servers: {} };
+  if (existsSync8(exeMcpPath)) {
+    try {
+      config = JSON.parse(await readFile3(exeMcpPath, "utf-8"));
+      if (!config.servers) config.servers = {};
+    } catch {
+      config = { servers: {} };
+    }
+  }
+  const stdioEntry = {
+    command: "node",
+    args: [path7.join(packageRoot, "dist", "mcp", "server.js")],
+    env: {},
+    shared: true
+  };
+  const existing = config.servers[MCP_PRIMARY_KEY];
+  if (existing && JSON.stringify(existing) === JSON.stringify(stdioEntry)) {
+    return;
+  }
+  if (config.servers[MCP_LEGACY_KEY]) {
+    delete config.servers[MCP_LEGACY_KEY];
+  }
+  config.servers[MCP_PRIMARY_KEY] = stdioEntry;
+  await writeFile3(exeMcpPath, JSON.stringify(config, null, 2) + "\n");
+  process.stderr.write("exe-os: registered MCP server in ~/.exe/mcp.json (Rust runtime)\n");
+}
 async function cleanSettingsJsonMcp(settingsPath) {
   if (!existsSync8(settingsPath)) return;
   try {

package/dist/bin/stack-update.js

@@ -2,6 +2,7 @@
 
 // src/bin/stack-update.ts
 import { readFileSync as readFileSync4 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
 
 // src/lib/is-main.ts
 import { realpathSync } from "fs";
@@ -510,12 +511,25 @@ function assertHostReadyForApply(report) {
   if (blockers.length > 0) throw new Error(`Stack host is not ready:
 - ${blockers.join("\n- ")}`);
 }
+function areStackContainersRunning(composeFile, envFile) {
+  try {
+    const result = spawnSync("docker", ["compose", "--file", composeFile, "--env-file", envFile, "ps", "-q"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 15e3
+    });
+    return result.status === 0 && (result.stdout?.toString().trim().length ?? 0) > 0;
+  } catch {
+    return false;
+  }
+}
 async function runStackUpdate(options) {
   const exec = options.exec ?? defaultExec;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   if (options.rollback) return rollbackStackUpdate(options);
-  const report = bootstrapStackHost({ ...options, installDocker: options.installDocker ?? !!options.yes });
-  if (!options.dryRun) assertHostReadyForApply(report);
+  if (options.bootstrap !== false) {
+    const report = bootstrapStackHost({ ...options, installDocker: options.installDocker ?? !!options.yes });
+    if (!options.dryRun) assertHostReadyForApply(report);
+  }
   const manifest = await loadStackManifest(options.manifestRef, options.fetchText, options.manifestPublicKey, options.manifestAuthToken);
   const envRaw = readFileSync3(options.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, options.targetVersion);
@@ -531,7 +545,8 @@ async function runStackUpdate(options) {
   });
   const lockFile = options.lockFile ?? path3.join(path3.dirname(options.envFile), ".exe-stack-lock.json");
   const previousVersion = readCurrentStackVersion(lockFile);
-  if (options.dryRun || plan.changes.length === 0) {
+  const containersRunning = plan.changes.length === 0 ? areStackContainersRunning(options.composeFile, options.envFile) : true;
+  if (options.dryRun || plan.changes.length === 0 && containersRunning) {
     return { status: "planned", targetVersion: plan.targetVersion, changes: plan.changes, lockFile };
   }
   await postDeployAudit(options, "started", plan.targetVersion, previousVersion);
@@ -683,12 +698,16 @@ async function defaultPostJson(url, body, authToken) {
 function defaultStackPaths() {
   const cwdCompose = path3.resolve("docker-compose.yml");
   const cwdEnv = path3.resolve(".env");
+  const packagedManifest = path3.join(resolvePackageRoot(), "deploy", "stack-manifests", "v0.9.json");
+  const manifestRef = process.env.EXE_STACK_MANIFEST || (existsSync4(packagedManifest) ? packagedManifest : "https://update.askexe.com/stack-manifest.json");
   return {
     composeFile: process.env.EXE_STACK_COMPOSE_FILE || (existsSync4(cwdCompose) ? cwdCompose : "/opt/exe-stack/docker-compose.yml"),
     envFile: process.env.EXE_STACK_ENV_FILE || (existsSync4(cwdEnv) ? cwdEnv : "/opt/exe-stack/.env"),
-    manifestRef: process.env.EXE_STACK_MANIFEST || "https://update.askexe.com/stack-manifest.json",
-    auditUrl: process.env.EXE_STACK_AUDIT_URL || "https://update.askexe.com/v1/deploy-audits",
-    imageCredentialsUrl: process.env.EXE_STACK_IMAGE_CREDENTIALS_URL || "https://update.askexe.com/v1/image-credentials",
+    manifestRef,
+    // Only call update.askexe.com if explicitly configured or if a remote manifest was requested.
+    // Packaged manifests keep cold-start installs unblocked even before update-service entitlements are provisioned.
+    auditUrl: process.env.EXE_STACK_AUDIT_URL || (/^https?:\/\//.test(manifestRef) ? "https://update.askexe.com/v1/deploy-audits" : void 0),
+    imageCredentialsUrl: process.env.EXE_STACK_IMAGE_CREDENTIALS_URL || (/^https?:\/\//.test(manifestRef) ? "https://update.askexe.com/v1/image-credentials" : void 0),
     manifestAuthToken: process.env.EXE_STACK_UPDATE_TOKEN || process.env.EXE_LICENSE_KEY || loadLicense() || void 0,
     manifestPublicKey: loadDefaultPublicKey()
   };
@@ -811,9 +830,14 @@ Options:
   -y, --yes                  Non-interactive confirmation
 `);
 }
-function printChanges(changes) {
+function printChanges(changes, composeFile, envFile) {
   if (changes.length === 0) {
-    console.log("\u2705 Stack already matches target manifest.");
+    const running = areCliContainersRunning(composeFile, envFile);
+    if (running) {
+      console.log("\u2705 Stack already matches target manifest.");
+    } else {
+      console.log("\u26A0\uFE0F  Stack .env matches target manifest but containers are not running. Will start them.");
+    }
     return;
   }
   console.log("Planned image tag changes:");
@@ -822,6 +846,17 @@ function printChanges(changes) {
     console.log(`      ${c.before ?? "<unset>"} \u2192 ${c.after}`);
   }
 }
+function areCliContainersRunning(composeFile, envFile) {
+  try {
+    const result = spawnSync2("docker", ["compose", "--file", composeFile, "--env-file", envFile, "ps", "-q"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 15e3
+    });
+    return result.status === 0 && (result.stdout?.toString().trim().length ?? 0) > 0;
+  } catch {
+    return false;
+  }
+}
 function printBreaking(changes) {
   if (changes.length === 0) return;
   console.log("\nBreaking-change notices:");
@@ -876,7 +911,7 @@ async function main(args = process.argv.slice(2)) {
   console.log(`Compose:  ${opts.composeFile}`);
   console.log(`Env:      ${opts.envFile}
 `);
-  printChanges(plan.changes);
+  printChanges(plan.changes, opts.composeFile, opts.envFile);
   printBreaking(plan.breakingChanges);
   if (opts.check || opts.dryRun) return;
   if (!opts.yes) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.83",
+  "version": "0.9.85",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/stack.release.json

@@ -4,8 +4,8 @@
   "repo": "AskExe/exe-os",
   "service": "exed",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.6",
-  "image": "ghcr.io/askexe/exed:v0.9.6",
+  "version": "0.9.7",
+  "image": "ghcr.io/askexe/exed:v0.9.7",
   "imageEnv": "EXED_IMAGE_TAG",
   "stackParticipation": {
     "required": true,
@@ -42,9 +42,9 @@
     "breakingChanges": [],
     "dataSovereignty": "Customer-local memory/tasks/behaviors stay in SQLCipher/local storage. Updates must not overwrite roster, identity, behavior, or local memory files.",
     "releaseLine": "v0.9 private/customer pilot; v1.0 is public-beta stable.",
-    "highGhostStack": "0.9.6",
+    "highGhostStack": "0.9.7",
     "deploymentScope": "customer"
   },
   "deploymentScope": "customer",
-  "highGhostStack": "0.9.6"
+  "highGhostStack": "0.9.7"
 }