@askexenow/exe-os 0.9.84 → 0.9.86

package/dist/bin/cli.js

@@ -1241,6 +1241,7 @@ async function registerMcpServer(packageRoot, homeDir = os6.homedir()) {
 `
       );
     }
+    await registerExeRustMcpConfig(packageRoot, homeDir);
     return false;
   }
   claudeJson.mcpServers[MCP_PRIMARY_KEY] = newEntry;
@@ -1254,8 +1255,39 @@ async function registerMcpServer(packageRoot, homeDir = os6.homedir()) {
 `
     );
   }
+  await registerExeRustMcpConfig(packageRoot, homeDir);
   return true;
 }
+async function registerExeRustMcpConfig(packageRoot, homeDir) {
+  const exeDir = path7.join(homeDir, ".exe");
+  const exeMcpPath = path7.join(exeDir, "mcp.json");
+  await mkdir3(exeDir, { recursive: true });
+  let config = { servers: {} };
+  if (existsSync8(exeMcpPath)) {
+    try {
+      config = JSON.parse(await readFile3(exeMcpPath, "utf-8"));
+      if (!config.servers) config.servers = {};
+    } catch {
+      config = { servers: {} };
+    }
+  }
+  const stdioEntry = {
+    command: "node",
+    args: [path7.join(packageRoot, "dist", "mcp", "server.js")],
+    env: {},
+    shared: true
+  };
+  const existing = config.servers[MCP_PRIMARY_KEY];
+  if (existing && JSON.stringify(existing) === JSON.stringify(stdioEntry)) {
+    return;
+  }
+  if (config.servers[MCP_LEGACY_KEY]) {
+    delete config.servers[MCP_LEGACY_KEY];
+  }
+  config.servers[MCP_PRIMARY_KEY] = stdioEntry;
+  await writeFile3(exeMcpPath, JSON.stringify(config, null, 2) + "\n");
+  process.stderr.write("exe-os: registered MCP server in ~/.exe/mcp.json (Rust runtime)\n");
+}
 async function cleanSettingsJsonMcp(settingsPath) {
   if (!existsSync8(settingsPath)) return;
   try {
@@ -3633,7 +3665,7 @@ __export(exe_daemon_client_exports, {
 });
 import net from "net";
 import os10 from "os";
-import { spawn } from "child_process";
+import { spawn, execSync as execSync4 } from "child_process";
 import { randomUUID } from "crypto";
 import { existsSync as existsSync12, unlinkSync as unlinkSync3, readFileSync as readFileSync9, openSync, closeSync, statSync as statSync2 } from "fs";
 import path12 from "path";
@@ -3663,6 +3695,14 @@ function handleData(chunk) {
     }
   }
 }
+function isZombie(pid) {
+  try {
+    const state = execSync4(`ps -p ${pid} -o state=`, { encoding: "utf8", timeout: 2e3 }).trim();
+    return state.startsWith("Z");
+  } catch {
+    return false;
+  }
+}
 function cleanupStaleFiles() {
   if (existsSync12(PID_PATH)) {
     try {
@@ -3670,7 +3710,11 @@ function cleanupStaleFiles() {
       if (pid > 0) {
         try {
           process.kill(pid, 0);
-          return;
+          if (!isZombie(pid)) {
+            return;
+          }
+          process.stderr.write(`[exed-client] PID ${pid} is a zombie \u2014 cleaning up stale files
+`);
         } catch {
         }
       }
@@ -3698,8 +3742,8 @@ function findPackageRoot() {
 function getAvailableMemoryGB() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync18 } = __require("child_process");
-      const vmstat = execSync18("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync19 } = __require("child_process");
+      const vmstat = execSync19("vm_stat", { encoding: "utf8" });
       const pageSize = 16384;
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -5654,6 +5698,12 @@ async function disposeDatabase() {
     clearInterval(_walCheckpointTimer);
     _walCheckpointTimer = null;
   }
+  if (_client) {
+    try {
+      await _client.execute("PRAGMA wal_checkpoint(PASSIVE)");
+    } catch {
+    }
+  }
   if (_daemonClient) {
     _daemonClient.close();
     _daemonClient = null;
@@ -10404,7 +10454,7 @@ import { createInterface as createInterface2 } from "readline";
 import { existsSync as existsSync19, statSync as statSync6, mkdirSync as mkdirSync12, copyFileSync as copyFileSync3, renameSync as renameSync4, rmSync, writeFileSync as writeFileSync12 } from "fs";
 import path19 from "path";
 import os12 from "os";
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 import { createClient as createClient3 } from "@libsql/client";
 function isInteractiveTerminal2() {
   return Boolean(process.stdin.isTTY && process.stdout.isTTY && !process.env.CI);
@@ -10435,7 +10485,7 @@ function dbSidecarPaths(dbPath) {
 function daemonStatus() {
   const pidPath = path19.join(dataDir(), "exed.pid");
   if (!existsSync19(pidPath)) return { pid: null, alive: false };
-  const pid = execSync4(`cat ${JSON.stringify(pidPath)}`, { encoding: "utf8" }).trim();
+  const pid = execSync5(`cat ${JSON.stringify(pidPath)}`, { encoding: "utf8" }).trim();
   if (!pid) return { pid: null, alive: false };
   try {
     process.kill(Number(pid), 0);
@@ -10449,7 +10499,7 @@ async function stopDaemonIfAlive() {
   if (!daemon.alive || !daemon.pid) return;
   if (Number(daemon.pid) <= 1) {
     try {
-      execSync4("docker inspect exed >/dev/null 2>&1 && docker stop exed >/dev/null", { timeout: 3e4 });
+      execSync5("docker inspect exed >/dev/null 2>&1 && docker stop exed >/dev/null", { timeout: 3e4 });
       return;
     } catch {
       throw new Error("Refusing to signal PID 1. Stop the exed Docker container manually, then retry.");
@@ -12918,7 +12968,7 @@ __export(session_registry_exports, {
   registerSession: () => registerSession
 });
 import { readFileSync as readFileSync18, writeFileSync as writeFileSync17, mkdirSync as mkdirSync17, existsSync as existsSync22 } from "fs";
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync6 } from "child_process";
 import path25 from "path";
 import os14 from "os";
 function registerSession(entry) {
@@ -12958,7 +13008,7 @@ function pruneStaleSessions() {
   if (sessions.length === 0) return 0;
   let liveSessions = [];
   try {
-    liveSessions = execSync5("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
+    liveSessions = execSync6("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
       encoding: "utf8"
     }).trim().split("\n").filter(Boolean);
   } catch {
@@ -12981,7 +13031,7 @@ var init_session_registry = __esm({
 });
 
 // src/lib/session-key.ts
-import { execSync as execSync6 } from "child_process";
+import { execSync as execSync7 } from "child_process";
 function normalizeCommand(command) {
   const trimmed = command.trim().toLowerCase();
   const parts = trimmed.split(/[\\/]/);
@@ -13000,7 +13050,7 @@ function resolveRuntimeProcess() {
   let pid = process.ppid;
   for (let i = 0; i < 10; i++) {
     try {
-      const info = execSync6(`ps -p ${pid} -o ppid=,comm=`, {
+      const info = execSync7(`ps -p ${pid} -o ppid=,comm=`, {
         encoding: "utf8",
         timeout: 2e3
       }).trim();
@@ -13174,14 +13224,14 @@ var init_transport = __esm({
 });
 
 // src/lib/cc-agent-support.ts
-import { execSync as execSync7 } from "child_process";
+import { execSync as execSync8 } from "child_process";
 function _resetCcAgentSupportCache() {
   _cachedSupport = null;
 }
 function claudeSupportsAgentFlag() {
   if (_cachedSupport !== null) return _cachedSupport;
   try {
-    const helpOutput = execSync7("claude --help 2>&1", {
+    const helpOutput = execSync8("claude --help 2>&1", {
       encoding: "utf-8",
       timeout: 5e3
     });
@@ -13558,7 +13608,7 @@ var init_session_kill_telemetry = __esm({
 });
 
 // src/lib/project-name.ts
-import { execSync as execSync8 } from "child_process";
+import { execSync as execSync9 } from "child_process";
 import path29 from "path";
 function getProjectName(cwd2) {
   const dir = cwd2 ?? process.cwd();
@@ -13566,7 +13616,7 @@ function getProjectName(cwd2) {
   try {
     let repoRoot;
     try {
-      const gitCommonDir = execSync8("git rev-parse --path-format=absolute --git-common-dir", {
+      const gitCommonDir = execSync9("git rev-parse --path-format=absolute --git-common-dir", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -13574,7 +13624,7 @@ function getProjectName(cwd2) {
       }).trim();
       repoRoot = path29.dirname(gitCommonDir);
     } catch {
-      repoRoot = execSync8("git rev-parse --show-toplevel", {
+      repoRoot = execSync9("git rev-parse --show-toplevel", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -13681,7 +13731,7 @@ __export(tasks_crud_exports, {
 import crypto9 from "crypto";
 import path30 from "path";
 import os17 from "os";
-import { execSync as execSync9 } from "child_process";
+import { execSync as execSync10 } from "child_process";
 import { mkdir as mkdir5, writeFile as writeFile5, appendFile } from "fs/promises";
 import { existsSync as existsSync26, readFileSync as readFileSync22 } from "fs";
 async function writeCheckpoint(input) {
@@ -14026,14 +14076,14 @@ function isTmuxSessionAlive(identifier) {
   if (!identifier || identifier === "unknown") return true;
   try {
     if (identifier.startsWith("%")) {
-      const output2 = execSync9("tmux list-panes -a -F '#{pane_id}'", {
+      const output2 = execSync10("tmux list-panes -a -F '#{pane_id}'", {
         timeout: 2e3,
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"]
       });
       return output2.split("\n").some((l) => l.trim() === identifier);
     } else {
-      execSync9(`tmux has-session -t ${JSON.stringify(identifier)}`, {
+      execSync10(`tmux has-session -t ${JSON.stringify(identifier)}`, {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -14042,7 +14092,7 @@ function isTmuxSessionAlive(identifier) {
   } catch {
     if (identifier.startsWith("%")) return true;
     try {
-      execSync9("tmux list-sessions", {
+      execSync10("tmux list-sessions", {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -14057,12 +14107,12 @@ function checkStaleCompletion(taskContext, taskCreatedAt) {
   if (!DELEGATION_KEYWORDS.test(taskContext)) return null;
   try {
     const since = new Date(taskCreatedAt).toISOString();
-    const branch = execSync9(
+    const branch = execSync10(
       "git rev-parse --abbrev-ref HEAD 2>/dev/null",
       { encoding: "utf8", timeout: 3e3 }
     ).trim();
     const branchArg = branch && branch !== "HEAD" ? branch : "";
-    const commitCount = execSync9(
+    const commitCount = execSync10(
       `git log --oneline --since="${since}" ${branchArg} 2>/dev/null | wc -l`,
       { encoding: "utf8", timeout: 5e3 }
     ).trim();
@@ -15661,7 +15711,7 @@ __export(tmux_routing_exports, {
   spawnEmployee: () => spawnEmployee,
   verifyPaneAtCapacity: () => verifyPaneAtCapacity
 });
-import { execFileSync as execFileSync3, execSync as execSync10 } from "child_process";
+import { execFileSync as execFileSync3, execSync as execSync11 } from "child_process";
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync20, mkdirSync as mkdirSync20, existsSync as existsSync28, appendFileSync as appendFileSync2, readdirSync as readdirSync7 } from "fs";
 import path34 from "path";
 import os18 from "os";
@@ -16382,7 +16432,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   let booted = false;
   for (let i = 0; i < 30; i++) {
     try {
-      execSync10("sleep 0.5");
+      execSync11("sleep 0.5");
     } catch {
     }
     try {
@@ -16755,7 +16805,7 @@ __export(active_agent_exports, {
   writeActiveAgent: () => writeActiveAgent
 });
 import { readFileSync as readFileSync24, writeFileSync as writeFileSync21, mkdirSync as mkdirSync21, unlinkSync as unlinkSync12, readdirSync as readdirSync8 } from "fs";
-import { execSync as execSync11 } from "child_process";
+import { execSync as execSync12 } from "child_process";
 import path35 from "path";
 function isNameWithOptionalInstance(candidate, baseName) {
   if (candidate === baseName) return true;
@@ -16849,7 +16899,7 @@ function getActiveAgent() {
   } catch {
   }
   try {
-    const sessionName = execSync11(
+    const sessionName = execSync12(
       "tmux display-message -p '#{session_name}' 2>/dev/null",
       { encoding: "utf8", timeout: 2e3 }
     ).trim();
@@ -17574,7 +17624,7 @@ __export(exe_rename_exports, {
   renameEmployee: () => renameEmployee
 });
 import { readFileSync as readFileSync25, writeFileSync as writeFileSync22, renameSync as renameSync6, unlinkSync as unlinkSync13, existsSync as existsSync29 } from "fs";
-import { execSync as execSync12 } from "child_process";
+import { execSync as execSync13 } from "child_process";
 import path36 from "path";
 import { homedir as homedir4 } from "os";
 async function renameEmployee(oldName, newName, opts = {}) {
@@ -17715,7 +17765,7 @@ function rewriteRenamedEmployeeContent(content, oldName, newName) {
 }
 function findExeBin2() {
   try {
-    return execSync12(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
+    return execSync13(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
   } catch {
     return null;
   }
@@ -18421,7 +18471,7 @@ import {
   readdirSync as readdirSync9,
   unlinkSync as unlinkSync15
 } from "fs";
-import { execSync as execSync13 } from "child_process";
+import { execSync as execSync14 } from "child_process";
 import path38 from "path";
 import { homedir as homedir5 } from "os";
 function generateSessionWrappers(packageRoot, homeDir) {
@@ -18518,12 +18568,12 @@ function writeWrapper(wrapperPath, content) {
 }
 function resolveGlobalBinDir() {
   try {
-    const exeOsPath = execSync13("command -v exe-os", { encoding: "utf8", timeout: 3e3 }).trim().split("\n")[0];
+    const exeOsPath = execSync14("command -v exe-os", { encoding: "utf8", timeout: 3e3 }).trim().split("\n")[0];
     if (exeOsPath) return path38.dirname(exeOsPath);
   } catch {
   }
   try {
-    const prefix = execSync13("npm prefix -g", { encoding: "utf8", timeout: 3e3 }).trim();
+    const prefix = execSync14("npm prefix -g", { encoding: "utf8", timeout: 3e3 }).trim();
     if (prefix) return path38.join(prefix, "bin");
   } catch {
   }
@@ -18630,8 +18680,8 @@ function ask3(rl, prompt) {
 function getAvailableMemoryGB2() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync18 } = __require("child_process");
-      const vmstat = execSync18("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync19 } = __require("child_process");
+      const vmstat = execSync19("vm_stat", { encoding: "utf8" });
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const pageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : 16384;
       const free = vmstat.match(/Pages free:\s+(\d+)/);
@@ -19492,7 +19542,7 @@ var init_update_backup = __esm({
 });
 
 // src/lib/update-check.ts
-import { execSync as execSync14 } from "child_process";
+import { execSync as execSync15 } from "child_process";
 import { readFileSync as readFileSync28 } from "fs";
 import path41 from "path";
 function getLocalVersion(packageRoot) {
@@ -19502,7 +19552,7 @@ function getLocalVersion(packageRoot) {
 }
 function getRemoteVersion() {
   try {
-    const output2 = execSync14("npm view @askexenow/exe-os version", {
+    const output2 = execSync15("npm view @askexenow/exe-os version", {
       encoding: "utf-8",
       timeout: 15e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -19541,7 +19591,7 @@ __export(update_exports, {
   getRemoteVersion: () => getRemoteVersion,
   runUpdate: () => runUpdate
 });
-import { execSync as execSync15 } from "child_process";
+import { execSync as execSync16 } from "child_process";
 import { createInterface as createInterface5 } from "readline";
 async function runRestore() {
   console.log("\n\u{1F504} Restoring from update backup...");
@@ -19552,7 +19602,7 @@ async function runRestore() {
     console.log(`
 \u{1F4E5} Reinstalling @askexenow/exe-os@${manifest.version}...`);
     try {
-      execSync15(`npm install -g @askexenow/exe-os@${manifest.version}`, {
+      execSync16(`npm install -g @askexenow/exe-os@${manifest.version}`, {
         stdio: ["pipe", "pipe", "inherit"],
         timeout: 3e5
       });
@@ -19577,7 +19627,7 @@ async function runRestore() {
 }
 async function runUpdate(cliArgs) {
   const args2 = cliArgs ?? process.argv.slice(2);
-  const autoMode = args2.includes("--auto") || args2.includes("-y");
+  const autoMode = args2.includes("--auto") || args2.includes("--yes") || args2.includes("-y");
   const checkOnly = args2.includes("--check");
   const restoreMode = args2.includes("--restore");
   if (restoreMode) {
@@ -19629,7 +19679,7 @@ async function runUpdate(cliArgs) {
   }
   console.log("\u{1F9F9} Clearing npm cache...");
   try {
-    execSync15("npm cache clean --force", { stdio: "pipe" });
+    execSync16("npm cache clean --force", { stdio: "pipe" });
     console.log("   Done");
   } catch {
     console.log("   Skipped (non-critical)");
@@ -19637,7 +19687,7 @@ async function runUpdate(cliArgs) {
   console.log("\u{1F4E5} Installing @askexenow/exe-os@latest...");
   console.log("   This may take a minute...\n");
   try {
-    execSync15("npm install -g @askexenow/exe-os@latest", {
+    execSync16("npm install -g @askexenow/exe-os@latest", {
       stdio: ["pipe", "pipe", "inherit"],
       timeout: 3e5
     });
@@ -19655,7 +19705,7 @@ async function runUpdate(cliArgs) {
     newVersion = getLocalVersion(packageRoot);
   } catch {
     try {
-      const out = execSync15("npm list -g @askexenow/exe-os --depth=0 2>/dev/null", { encoding: "utf8" });
+      const out = execSync16("npm list -g @askexenow/exe-os --depth=0 2>/dev/null", { encoding: "utf8" });
       const match = out.match(/@askexenow\/exe-os@(\S+)/);
       newVersion = match?.[1] ?? "unknown";
     } catch {
@@ -19684,7 +19734,7 @@ async function runUpdate(cliArgs) {
   }
   console.log("\u{1F527} Re-registering MCP, hooks, wrappers, and daemon...");
   try {
-    execSync15("exe-os-install --global", {
+    execSync16("exe-os-install --global", {
       stdio: ["pipe", "inherit", "inherit"],
       timeout: 3e5
     });
@@ -19719,7 +19769,7 @@ async function runUpdate(cliArgs) {
   }
   try {
     console.log("\u{1FA7A} Checking AskExe support intake...");
-    execSync15("exe-os support health", {
+    execSync16("exe-os support health", {
       stdio: ["pipe", "inherit", "inherit"],
       timeout: 3e4
     });
@@ -20042,6 +20092,9 @@ function installDockerUbuntu(exec2) {
 function randomSecret(bytes = 32) {
   return randomBytes2(bytes).toString("base64url");
 }
+function randomHexSecret(bytes = 24) {
+  return randomBytes2(bytes).toString("hex");
+}
 function hydrateEnv(raw, opts) {
   let next = raw;
   const license = opts.licenseKey || process.env.EXE_LICENSE_KEY || loadLicense() || "";
@@ -20051,6 +20104,8 @@ function hydrateEnv(raw, opts) {
   for (const [key, value] of env.entries()) {
     if (!/CHANGEME/.test(value)) continue;
     if (key === "EXE_LICENSE_KEY" && license) replacements[key] = license;
+    else if (key === "MONITOR_AGENT_KEY") continue;
+    else if (key === "EXE_GATEWAY_WS_RELAY_AUTH_TOKEN") replacements[key] = randomHexSecret(24);
     else if (key.endsWith("_PASSWORD")) replacements[key] = randomSecret(24);
     else if (key.endsWith("_SECRET") || key.endsWith("_TOKEN") || key.endsWith("_KEY") || key.endsWith("_SALT")) replacements[key] = value.replace(/CHANGEME[A-Z0-9_]*/g, randomSecret(32));
     else if (key === "EXED_MCP_TOKEN") replacements[key] = randomSecret(32);
@@ -20113,12 +20168,25 @@ function assertHostReadyForApply(report) {
   if (blockers.length > 0) throw new Error(`Stack host is not ready:
 - ${blockers.join("\n- ")}`);
 }
+function areStackContainersRunning(composeFile, envFile) {
+  try {
+    const result = spawnSync("docker", ["compose", "--file", composeFile, "--env-file", envFile, "ps", "-q"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 15e3
+    });
+    return result.status === 0 && (result.stdout?.toString().trim().length ?? 0) > 0;
+  } catch {
+    return false;
+  }
+}
 async function runStackUpdate(options) {
   const exec2 = options.exec ?? defaultExec;
   const now2 = options.now ?? (() => /* @__PURE__ */ new Date());
   if (options.rollback) return rollbackStackUpdate(options);
-  const report = bootstrapStackHost({ ...options, installDocker: options.installDocker ?? !!options.yes });
-  if (!options.dryRun) assertHostReadyForApply(report);
+  if (options.bootstrap !== false) {
+    const report = bootstrapStackHost({ ...options, installDocker: options.installDocker ?? !!options.yes });
+    if (!options.dryRun) assertHostReadyForApply(report);
+  }
   const manifest = await loadStackManifest(options.manifestRef, options.fetchText, options.manifestPublicKey, options.manifestAuthToken);
   const envRaw = readFileSync29(options.envFile, "utf8");
   const plan = createStackUpdatePlan(manifest, envRaw, options.targetVersion);
@@ -20134,7 +20202,8 @@ async function runStackUpdate(options) {
   });
   const lockFile = options.lockFile ?? path42.join(path42.dirname(options.envFile), ".exe-stack-lock.json");
   const previousVersion = readCurrentStackVersion(lockFile);
-  if (options.dryRun || plan.changes.length === 0) {
+  const containersRunning = plan.changes.length === 0 ? areStackContainersRunning(options.composeFile, options.envFile) : true;
+  if (options.dryRun || plan.changes.length === 0 && containersRunning) {
     return { status: "planned", targetVersion: plan.targetVersion, changes: plan.changes, lockFile };
   }
   await postDeployAudit(options, "started", plan.targetVersion, previousVersion);
@@ -20296,7 +20365,9 @@ function defaultStackPaths() {
     // Packaged manifests keep cold-start installs unblocked even before update-service entitlements are provisioned.
     auditUrl: process.env.EXE_STACK_AUDIT_URL || (/^https?:\/\//.test(manifestRef) ? "https://update.askexe.com/v1/deploy-audits" : void 0),
     imageCredentialsUrl: process.env.EXE_STACK_IMAGE_CREDENTIALS_URL || (/^https?:\/\//.test(manifestRef) ? "https://update.askexe.com/v1/image-credentials" : void 0),
-    manifestAuthToken: process.env.EXE_STACK_UPDATE_TOKEN || process.env.EXE_LICENSE_KEY || loadLicense() || void 0,
+    // License key IS the auth token for update.askexe.com — no separate update token needed.
+    // EXE_STACK_UPDATE_TOKEN kept as legacy fallback during migration.
+    manifestAuthToken: process.env.EXE_LICENSE_KEY || loadLicense() || process.env.EXE_STACK_UPDATE_TOKEN || void 0,
     manifestPublicKey: loadDefaultPublicKey()
   };
 }
@@ -20322,6 +20393,7 @@ __export(stack_update_exports, {
   runStackUpdateCli: () => main7
 });
 import { readFileSync as readFileSync30 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
 function parseArgs4(args2) {
   const defaults = defaultStackPaths();
   const opts = {
@@ -20431,9 +20503,21 @@ Options:
   -y, --yes                  Non-interactive confirmation
 `);
 }
-function printChanges(changes) {
+function printChanges(changes, composeFile, envFile) {
   if (changes.length === 0) {
-    console.log("\u2705 Stack already matches target manifest.");
+    const running = areCliContainersRunning(composeFile, envFile);
+    if (running) {
+      console.log("Stack .env matches target manifest. Checking container health...\n");
+      const unhealthy = printContainerHealth(composeFile, envFile);
+      if (unhealthy > 0) {
+        console.log(`
+\u{1F534} ${unhealthy} service(s) unhealthy or crashlooping. Run \`docker compose logs <service>\` to diagnose.`);
+      } else {
+        console.log("\n\u2705 Stack already matches target manifest. All services healthy.");
+      }
+    } else {
+      console.log("\u26A0\uFE0F  Stack .env matches target manifest but containers are not running. Will start them.");
+    }
     return;
   }
   console.log("Planned image tag changes:");
@@ -20442,6 +20526,60 @@ function printChanges(changes) {
     console.log(`      ${c.before ?? "<unset>"} \u2192 ${c.after}`);
   }
 }
+function areCliContainersRunning(composeFile, envFile) {
+  try {
+    const result = spawnSync2("docker", ["compose", "--file", composeFile, "--env-file", envFile, "ps", "-q"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 15e3
+    });
+    return result.status === 0 && (result.stdout?.toString().trim().length ?? 0) > 0;
+  } catch {
+    return false;
+  }
+}
+function getContainerHealth(composeFile, envFile) {
+  try {
+    const result = spawnSync2(
+      "docker",
+      ["compose", "--file", composeFile, "--env-file", envFile, "ps", "--format", "json"],
+      { stdio: ["pipe", "pipe", "pipe"], timeout: 15e3 }
+    );
+    if (result.status !== 0) return [];
+    const raw = result.stdout?.toString().trim() ?? "";
+    if (!raw) return [];
+    return raw.split("\n").filter(Boolean).map((line) => {
+      try {
+        const obj = JSON.parse(line);
+        return {
+          service: obj.Service ?? obj.Name ?? "unknown",
+          state: obj.State ?? "unknown",
+          health: obj.Health ?? "",
+          restartCount: typeof obj.RestartCount === "number" ? obj.RestartCount : 0
+        };
+      } catch {
+        return null;
+      }
+    }).filter((x) => x !== null);
+  } catch {
+    return [];
+  }
+}
+function printContainerHealth(composeFile, envFile) {
+  const containers = getContainerHealth(composeFile, envFile);
+  if (containers.length === 0) return 0;
+  let unhealthy = 0;
+  for (const c of containers) {
+    const isRestarting = c.state === "restarting" || c.restartCount > 2;
+    const isUnhealthy = c.health === "unhealthy" || c.state === "dead" || c.state === "exited";
+    if (isRestarting || isUnhealthy) {
+      unhealthy++;
+      console.log(`  \u274C ${c.service}: ${c.state} (restarts: ${c.restartCount}${c.health ? `, health: ${c.health}` : ""})`);
+    } else {
+      console.log(`  \u2705 ${c.service}: ${c.state}${c.health ? ` (${c.health})` : ""}`);
+    }
+  }
+  return unhealthy;
+}
 function printBreaking(changes) {
   if (changes.length === 0) return;
   console.log("\nBreaking-change notices:");
@@ -20496,7 +20634,7 @@ async function main7(args2 = process.argv.slice(2)) {
   console.log(`Compose:  ${opts.composeFile}`);
   console.log(`Env:      ${opts.envFile}
 `);
-  printChanges(plan.changes);
+  printChanges(plan.changes, opts.composeFile, opts.envFile);
   printBreaking(plan.breakingChanges);
   if (opts.check || opts.dryRun) return;
   if (!opts.yes) {
@@ -27190,13 +27328,13 @@ __export(tmux_status_exports, {
   parseActivity: () => parseActivity,
   parseContextPercentage: () => parseContextPercentage
 });
-import { execSync as execSync16 } from "child_process";
+import { execSync as execSync17 } from "child_process";
 function inTmux() {
   if (process.env.TMUX || process.env.TMUX_PANE) return true;
   const term = process.env.TERM ?? "";
   if (term.startsWith("tmux") || term.startsWith("screen")) return true;
   try {
-    execSync16("tmux display-message -p '#{session_name}' 2>/dev/null", {
+    execSync17("tmux display-message -p '#{session_name}' 2>/dev/null", {
       encoding: "utf8",
       timeout: 2e3
     });
@@ -27206,12 +27344,12 @@ function inTmux() {
   try {
     let pid = process.ppid;
     for (let depth = 0; depth < 8 && pid > 1; depth++) {
-      const comm = execSync16(`ps -p ${pid} -o comm= 2>/dev/null`, {
+      const comm = execSync17(`ps -p ${pid} -o comm= 2>/dev/null`, {
         encoding: "utf8",
         timeout: 1e3
       }).trim();
       if (/tmux/.test(comm)) return true;
-      const ppid = execSync16(`ps -p ${pid} -o ppid= 2>/dev/null`, {
+      const ppid = execSync17(`ps -p ${pid} -o ppid= 2>/dev/null`, {
         encoding: "utf8",
         timeout: 1e3
       }).trim();
@@ -27224,7 +27362,7 @@ function inTmux() {
 }
 function listTmuxSessions() {
   try {
-    const out = execSync16("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
+    const out = execSync17("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
       encoding: "utf8",
       timeout: 3e3
     });
@@ -27235,7 +27373,7 @@ function listTmuxSessions() {
 }
 function capturePaneLines(windowName, lines = 10) {
   try {
-    const out = execSync16(
+    const out = execSync17(
       `tmux capture-pane -t ${JSON.stringify(windowName)} -p 2>/dev/null | tail -${lines}`,
       { encoding: "utf8", timeout: 3e3 }
     );
@@ -27246,7 +27384,7 @@ function capturePaneLines(windowName, lines = 10) {
 }
 function getPaneCwd(windowName) {
   try {
-    const out = execSync16(
+    const out = execSync17(
       `tmux display-message -t ${JSON.stringify(windowName)} -p '#{pane_current_path}' 2>/dev/null`,
       { encoding: "utf8", timeout: 3e3 }
     );
@@ -27257,7 +27395,7 @@ function getPaneCwd(windowName) {
 }
 function projectFromPath(dir) {
   try {
-    const root = execSync16("git -C " + JSON.stringify(dir) + " rev-parse --show-toplevel 2>/dev/null", {
+    const root = execSync17("git -C " + JSON.stringify(dir) + " rev-parse --show-toplevel 2>/dev/null", {
       encoding: "utf8",
       timeout: 3e3
     }).trim();
@@ -27326,7 +27464,7 @@ function getEmployeeStatuses(employeeNames) {
     }
     let paneAlive = true;
     try {
-      const paneStatus = execSync16(
+      const paneStatus = execSync17(
         `tmux list-panes -t ${JSON.stringify(sessionName)} -F '#{pane_dead}' 2>/dev/null`,
         { encoding: "utf8", timeout: 3e3 }
       ).trim();
@@ -27516,8 +27654,8 @@ function Footer() {
           setSessions(allSessions.length);
           if (!currentSession) {
             try {
-              const { execSync: execSync18 } = await import("child_process");
-              const name = execSync18("tmux display-message -p '#{session_name}' 2>/dev/null", {
+              const { execSync: execSync19 } = await import("child_process");
+              const name = execSync19("tmux display-message -p '#{session_name}' 2>/dev/null", {
                 encoding: "utf8",
                 timeout: 2e3
               }).trim();
@@ -30871,8 +31009,8 @@ function TmuxPane({ sessionName, employeeName, employeeRole, projectName, onDeta
     }
     const capture = () => {
       try {
-        const { execSync: execSync18 } = __require("child_process");
-        const output2 = execSync18(
+        const { execSync: execSync19 } = __require("child_process");
+        const output2 = execSync19(
           `tmux capture-pane -t ${JSON.stringify(sessionName)} -p -e 2>/dev/null | tail -${CAPTURE_LINES}`,
           { encoding: "utf8", timeout: 3e3 }
         );
@@ -30896,8 +31034,8 @@ function TmuxPane({ sessionName, employeeName, employeeRole, projectName, onDeta
     if (key.return) {
       if (!demo && inputBuffer.trim()) {
         try {
-          const { execSync: execSync18 } = __require("child_process");
-          execSync18(
+          const { execSync: execSync19 } = __require("child_process");
+          execSync19(
             `tmux send-keys -t ${JSON.stringify(sessionName)} ${JSON.stringify(inputBuffer)} Enter`,
             { timeout: 2e3 }
           );
@@ -30905,8 +31043,8 @@ function TmuxPane({ sessionName, employeeName, employeeRole, projectName, onDeta
         }
       } else if (!demo) {
         try {
-          const { execSync: execSync18 } = __require("child_process");
-          execSync18(`tmux send-keys -t ${JSON.stringify(sessionName)} Enter`, { timeout: 2e3 });
+          const { execSync: execSync19 } = __require("child_process");
+          execSync19(`tmux send-keys -t ${JSON.stringify(sessionName)} Enter`, { timeout: 2e3 });
         } catch {
         }
       }
@@ -31593,12 +31731,12 @@ function SessionsView({
           return;
         }
       } else {
-        const { execSync: execSync18 } = await import("child_process");
+        const { execSync: execSync19 } = await import("child_process");
         const dir = projectDir || process.cwd();
-        execSync18(`tmux new-session -d -s ${JSON.stringify(entry.sessionName)} -c ${JSON.stringify(dir)}`, { timeout: 5e3 });
-        execSync18(`tmux send-keys -t ${JSON.stringify(entry.sessionName)} "claude --dangerously-skip-permissions" Enter`, { timeout: 3e3 });
+        execSync19(`tmux new-session -d -s ${JSON.stringify(entry.sessionName)} -c ${JSON.stringify(dir)}`, { timeout: 5e3 });
+        execSync19(`tmux send-keys -t ${JSON.stringify(entry.sessionName)} "claude --dangerously-skip-permissions" Enter`, { timeout: 3e3 });
         await new Promise((r) => setTimeout(r, 3e3));
-        execSync18(`tmux send-keys -t ${JSON.stringify(entry.sessionName)} "/exe" Enter`, { timeout: 3e3 });
+        execSync19(`tmux send-keys -t ${JSON.stringify(entry.sessionName)} "/exe" Enter`, { timeout: 3e3 });
       }
       const updated = { ...entry, status: "active", activity: "Starting...", attached: false };
       setViewingEmployee(updated);
@@ -31701,7 +31839,7 @@ function SessionsView({
         const { listTmuxSessions: listTmuxSessions2, inTmux: inTmux2, capturePaneLines: capturePaneLines2, parseActivity: parseActivity2 } = await Promise.resolve().then(() => (init_tmux_status(), tmux_status_exports));
         const { getCoordinatorName: getCoordinatorName2, isCoordinatorRole: isCoordinatorRole2, loadEmployees: loadEmployees2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
         const { isExeSession: isExeSession2 } = await Promise.resolve().then(() => (init_tmux_routing(), tmux_routing_exports));
-        const { execSync: execSync18 } = await import("child_process");
+        const { execSync: execSync19 } = await import("child_process");
         if (!inTmux2()) {
           setTmuxAvailable(false);
           setProjects([]);
@@ -31710,7 +31848,7 @@ function SessionsView({
         setTmuxAvailable(true);
         const attachedMap = /* @__PURE__ */ new Map();
         try {
-          const out = execSync18("tmux list-sessions -F '#{session_name}:#{session_attached}' 2>/dev/null", {
+          const out = execSync19("tmux list-sessions -F '#{session_name}:#{session_attached}' 2>/dev/null", {
             encoding: "utf8",
             timeout: 3e3
           });
@@ -32746,8 +32884,8 @@ function upsertConversation(conversations, platform, senderId, message) {
 async function loadGatewayConfig() {
   const state = { running: false, port: 3100, adapters: [], agents: [], gatewayUrl: "" };
   try {
-    const { execSync: execSync18 } = await import("child_process");
-    const ps = execSync18("pgrep -f exe-gateway 2>/dev/null", { encoding: "utf8", timeout: 3e3 });
+    const { execSync: execSync19 } = await import("child_process");
+    const ps = execSync19("pgrep -f exe-gateway 2>/dev/null", { encoding: "utf8", timeout: 3e3 });
     state.running = ps.trim().length > 0;
   } catch {
     state.running = false;
@@ -33224,10 +33362,10 @@ var init_Gateway = __esm({
 });
 
 // src/tui/utils/agent-status.ts
-import { execSync as execSync17 } from "child_process";
+import { execSync as execSync18 } from "child_process";
 function getAgentStatus(agentId) {
   try {
-    const sessions = execSync17("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
+    const sessions = execSync18("tmux list-sessions -F '#{session_name}' 2>/dev/null", {
       encoding: "utf8",
       timeout: 2e3
     }).trim().split("\n");
@@ -33238,7 +33376,7 @@ function getAgentStatus(agentId) {
       return /^\d?-/.test(suffix) || /^\d+$/.test(suffix);
     });
     if (!agentSession) return { label: "offline", color: "gray" };
-    const pane = execSync17(`tmux capture-pane -t "${agentSession}" -p 2>/dev/null | tail -3`, {
+    const pane = execSync18(`tmux capture-pane -t "${agentSession}" -p 2>/dev/null | tail -3`, {
       encoding: "utf8",
       timeout: 2e3
     });
@@ -34161,8 +34299,8 @@ function SettingsView({ onBack }) {
       };
     });
     try {
-      const { execSync: execSync18 } = await import("child_process");
-      execSync18("curl -s --max-time 1 http://localhost:11434/api/tags", { timeout: 2e3 });
+      const { execSync: execSync19 } = await import("child_process");
+      execSync19("curl -s --max-time 1 http://localhost:11434/api/tags", { timeout: 2e3 });
       providerList.push({ name: "Ollama", configured: true, detail: "localhost:11434" });
     } catch {
       providerList.push({ name: "Ollama", configured: false, detail: "not running" });
@@ -35061,7 +35199,7 @@ __export(code_context_index_exports, {
 import crypto14 from "crypto";
 import path51 from "path";
 import { existsSync as existsSync36, mkdirSync as mkdirSync25, readFileSync as readFileSync32, readdirSync as readdirSync11, statSync as statSync7, writeFileSync as writeFileSync26 } from "fs";
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 function normalizeProjectRoot(projectRoot) {
   return path51.resolve(projectRoot || process.cwd());
 }
@@ -35079,7 +35217,7 @@ function getCodeContextIndexPath(projectRoot) {
   return path51.join(indexDir(), `${rootHash}.json`);
 }
 function currentBranch(projectRoot) {
-  const result = spawnSync2("git", ["branch", "--show-current"], { cwd: projectRoot, encoding: "utf8", timeout: 2e3 });
+  const result = spawnSync3("git", ["branch", "--show-current"], { cwd: projectRoot, encoding: "utf8", timeout: 2e3 });
   const branch = result.status === 0 ? result.stdout.trim() : "";
   return branch || "detached-or-unknown";
 }
@@ -35098,12 +35236,12 @@ function listRecursive(projectRoot, dir = projectRoot, out = []) {
   return out;
 }
 function listCodeFiles(projectRoot, maxFiles) {
-  const git = spawnSync2("git", ["ls-files"], { cwd: projectRoot, encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024 * 16 });
+  const git = spawnSync3("git", ["ls-files"], { cwd: projectRoot, encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024 * 16 });
   let files = [];
   if (git.status === 0 && git.stdout.trim()) {
     files = git.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
   } else {
-    const rg = spawnSync2("rg", ["--files"], { cwd: projectRoot, encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024 * 16 });
+    const rg = spawnSync3("rg", ["--files"], { cwd: projectRoot, encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024 * 16 });
     files = rg.status === 0 && rg.stdout.trim() ? rg.stdout.split("\n").map((s) => s.trim()).filter(Boolean) : listRecursive(projectRoot);
   }
   return files.map((file) => file.replaceAll(path51.sep, "/")).filter((file) => isChunkable(file) && !shouldIgnore(file)).slice(0, maxFiles).sort();
@@ -36961,10 +37099,10 @@ async function runClaudeUninstall(flags = []) {
     }
   }
   try {
-    const { execSync: execSync18 } = await import("child_process");
+    const { execSync: execSync19 } = await import("child_process");
     const findExeBin3 = () => {
       try {
-        return execSync18(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
+        return execSync19(process.platform === "win32" ? "where exe-os" : "which exe-os", { encoding: "utf8" }).trim();
       } catch {
         return null;
       }