@askexenow/exe-os 0.9.85 → 0.9.86

package/dist/bin/shard-migrate.js

@@ -981,7 +981,7 @@ var init_daemon_auth = __esm({
 // src/lib/exe-daemon-client.ts
 import net from "net";
 import os4 from "os";
-import { spawn } from "child_process";
+import { spawn, execSync as execSync2 } from "child_process";
 import { randomUUID } from "crypto";
 import { existsSync as existsSync5, unlinkSync as unlinkSync2, readFileSync as readFileSync4, openSync, closeSync, statSync } from "fs";
 import path5 from "path";
@@ -1011,6 +1011,14 @@ function handleData(chunk) {
     }
   }
 }
+function isZombie(pid) {
+  try {
+    const state = execSync2(`ps -p ${pid} -o state=`, { encoding: "utf8", timeout: 2e3 }).trim();
+    return state.startsWith("Z");
+  } catch {
+    return false;
+  }
+}
 function cleanupStaleFiles() {
   if (existsSync5(PID_PATH)) {
     try {
@@ -1018,7 +1026,11 @@ function cleanupStaleFiles() {
       if (pid > 0) {
         try {
           process.kill(pid, 0);
-          return;
+          if (!isZombie(pid)) {
+            return;
+          }
+          process.stderr.write(`[exed-client] PID ${pid} is a zombie \u2014 cleaning up stale files
+`);
         } catch {
         }
       }
@@ -1046,8 +1058,8 @@ function findPackageRoot() {
 function getAvailableMemoryGB() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync3 } = __require("child_process");
-      const vmstat = execSync3("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync4 } = __require("child_process");
+      const vmstat = execSync4("vm_stat", { encoding: "utf8" });
       const pageSize = 16384;
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -2833,6 +2845,12 @@ async function disposeDatabase() {
     clearInterval(_walCheckpointTimer);
     _walCheckpointTimer = null;
   }
+  if (_client) {
+    try {
+      await _client.execute("PRAGMA wal_checkpoint(PASSIVE)");
+    } catch {
+    }
+  }
   if (_daemonClient) {
     _daemonClient.close();
     _daemonClient = null;
@@ -3987,7 +4005,7 @@ init_database();
 // src/lib/keychain.ts
 import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync6, statSync as statSync2 } from "fs";
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 import path6 from "path";
 import os5 from "os";
 var SERVICE = "exe-os";
@@ -4008,13 +4026,13 @@ function linuxSecretAvailable() {
   if (process.platform !== "linux") return false;
   if (linuxSecretAvailability !== null) return linuxSecretAvailability;
   try {
-    execSync2("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
+    execSync3("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
   } catch {
     linuxSecretAvailability = false;
     return false;
   }
   try {
-    execSync2("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
+    execSync3("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
     linuxSecretAvailability = true;
   } catch {
     linuxSecretAvailability = false;
@@ -4038,7 +4056,7 @@ function macKeychainGet(service = SERVICE) {
   if (!nativeKeychainAllowed()) return null;
   if (process.platform !== "darwin") return null;
   try {
-    return execSync2(
+    return execSync3(
       `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
@@ -4051,13 +4069,13 @@ function macKeychainSet(value, service = SERVICE) {
   if (process.platform !== "darwin") return false;
   try {
     try {
-      execSync2(
+      execSync3(
         `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
         { timeout: 5e3 }
       );
     } catch {
     }
-    execSync2(
+    execSync3(
       `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
       { timeout: 5e3 }
     );
@@ -4070,7 +4088,7 @@ function macKeychainDelete(service = SERVICE) {
   if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "darwin") return false;
   try {
-    execSync2(
+    execSync3(
       `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
@@ -4082,7 +4100,7 @@ function macKeychainDelete(service = SERVICE) {
 function linuxSecretGet(service = SERVICE) {
   if (!linuxSecretAvailable()) return null;
   try {
-    return execSync2(
+    return execSync3(
       `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
@@ -4093,7 +4111,7 @@ function linuxSecretGet(service = SERVICE) {
 function linuxSecretSet(value, service = SERVICE) {
   if (!linuxSecretAvailable()) return false;
   try {
-    execSync2(
+    execSync3(
       `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
@@ -4106,7 +4124,7 @@ function linuxSecretDelete(service = SERVICE) {
   if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "linux") return false;
   try {
-    execSync2(
+    execSync3(
       `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );

package/dist/bin/stack-update.js

@@ -440,6 +440,9 @@ function installDockerUbuntu(exec) {
 function randomSecret(bytes = 32) {
   return randomBytes(bytes).toString("base64url");
 }
+function randomHexSecret(bytes = 24) {
+  return randomBytes(bytes).toString("hex");
+}
 function hydrateEnv(raw, opts) {
   let next = raw;
   const license = opts.licenseKey || process.env.EXE_LICENSE_KEY || loadLicense() || "";
@@ -449,6 +452,8 @@ function hydrateEnv(raw, opts) {
   for (const [key, value] of env.entries()) {
     if (!/CHANGEME/.test(value)) continue;
     if (key === "EXE_LICENSE_KEY" && license) replacements[key] = license;
+    else if (key === "MONITOR_AGENT_KEY") continue;
+    else if (key === "EXE_GATEWAY_WS_RELAY_AUTH_TOKEN") replacements[key] = randomHexSecret(24);
     else if (key.endsWith("_PASSWORD")) replacements[key] = randomSecret(24);
     else if (key.endsWith("_SECRET") || key.endsWith("_TOKEN") || key.endsWith("_KEY") || key.endsWith("_SALT")) replacements[key] = value.replace(/CHANGEME[A-Z0-9_]*/g, randomSecret(32));
     else if (key === "EXED_MCP_TOKEN") replacements[key] = randomSecret(32);
@@ -708,7 +713,9 @@ function defaultStackPaths() {
     // Packaged manifests keep cold-start installs unblocked even before update-service entitlements are provisioned.
     auditUrl: process.env.EXE_STACK_AUDIT_URL || (/^https?:\/\//.test(manifestRef) ? "https://update.askexe.com/v1/deploy-audits" : void 0),
     imageCredentialsUrl: process.env.EXE_STACK_IMAGE_CREDENTIALS_URL || (/^https?:\/\//.test(manifestRef) ? "https://update.askexe.com/v1/image-credentials" : void 0),
-    manifestAuthToken: process.env.EXE_STACK_UPDATE_TOKEN || process.env.EXE_LICENSE_KEY || loadLicense() || void 0,
+    // License key IS the auth token for update.askexe.com — no separate update token needed.
+    // EXE_STACK_UPDATE_TOKEN kept as legacy fallback during migration.
+    manifestAuthToken: process.env.EXE_LICENSE_KEY || loadLicense() || process.env.EXE_STACK_UPDATE_TOKEN || void 0,
     manifestPublicKey: loadDefaultPublicKey()
   };
 }
@@ -834,7 +841,14 @@ function printChanges(changes, composeFile, envFile) {
   if (changes.length === 0) {
     const running = areCliContainersRunning(composeFile, envFile);
     if (running) {
-      console.log("\u2705 Stack already matches target manifest.");
+      console.log("Stack .env matches target manifest. Checking container health...\n");
+      const unhealthy = printContainerHealth(composeFile, envFile);
+      if (unhealthy > 0) {
+        console.log(`
+\u{1F534} ${unhealthy} service(s) unhealthy or crashlooping. Run \`docker compose logs <service>\` to diagnose.`);
+      } else {
+        console.log("\n\u2705 Stack already matches target manifest. All services healthy.");
+      }
     } else {
       console.log("\u26A0\uFE0F  Stack .env matches target manifest but containers are not running. Will start them.");
     }
@@ -857,6 +871,49 @@ function areCliContainersRunning(composeFile, envFile) {
     return false;
   }
 }
+function getContainerHealth(composeFile, envFile) {
+  try {
+    const result = spawnSync2(
+      "docker",
+      ["compose", "--file", composeFile, "--env-file", envFile, "ps", "--format", "json"],
+      { stdio: ["pipe", "pipe", "pipe"], timeout: 15e3 }
+    );
+    if (result.status !== 0) return [];
+    const raw = result.stdout?.toString().trim() ?? "";
+    if (!raw) return [];
+    return raw.split("\n").filter(Boolean).map((line) => {
+      try {
+        const obj = JSON.parse(line);
+        return {
+          service: obj.Service ?? obj.Name ?? "unknown",
+          state: obj.State ?? "unknown",
+          health: obj.Health ?? "",
+          restartCount: typeof obj.RestartCount === "number" ? obj.RestartCount : 0
+        };
+      } catch {
+        return null;
+      }
+    }).filter((x) => x !== null);
+  } catch {
+    return [];
+  }
+}
+function printContainerHealth(composeFile, envFile) {
+  const containers = getContainerHealth(composeFile, envFile);
+  if (containers.length === 0) return 0;
+  let unhealthy = 0;
+  for (const c of containers) {
+    const isRestarting = c.state === "restarting" || c.restartCount > 2;
+    const isUnhealthy = c.health === "unhealthy" || c.state === "dead" || c.state === "exited";
+    if (isRestarting || isUnhealthy) {
+      unhealthy++;
+      console.log(`  \u274C ${c.service}: ${c.state} (restarts: ${c.restartCount}${c.health ? `, health: ${c.health}` : ""})`);
+    } else {
+      console.log(`  \u2705 ${c.service}: ${c.state}${c.health ? ` (${c.health})` : ""}`);
+    }
+  }
+  return unhealthy;
+}
 function printBreaking(changes) {
   if (changes.length === 0) return;
   console.log("\nBreaking-change notices:");

package/dist/bin/update.js

@@ -804,7 +804,7 @@ async function runRestore() {
 }
 async function runUpdate(cliArgs) {
   const args = cliArgs ?? process.argv.slice(2);
-  const autoMode = args.includes("--auto") || args.includes("-y");
+  const autoMode = args.includes("--auto") || args.includes("--yes") || args.includes("-y");
   const checkOnly = args.includes("--check");
   const restoreMode = args.includes("--restore");
   if (restoreMode) {

package/dist/gateway/index.js

@@ -1702,7 +1702,7 @@ var init_daemon_auth = __esm({
 // src/lib/exe-daemon-client.ts
 import net from "net";
 import os4 from "os";
-import { spawn } from "child_process";
+import { spawn, execSync as execSync2 } from "child_process";
 import { randomUUID } from "crypto";
 import { existsSync as existsSync6, unlinkSync as unlinkSync2, readFileSync as readFileSync5, openSync, closeSync, statSync } from "fs";
 import path6 from "path";
@@ -1732,6 +1732,14 @@ function handleData(chunk) {
     }
   }
 }
+function isZombie(pid) {
+  try {
+    const state = execSync2(`ps -p ${pid} -o state=`, { encoding: "utf8", timeout: 2e3 }).trim();
+    return state.startsWith("Z");
+  } catch {
+    return false;
+  }
+}
 function cleanupStaleFiles() {
   if (existsSync6(PID_PATH)) {
     try {
@@ -1739,7 +1747,11 @@ function cleanupStaleFiles() {
       if (pid > 0) {
         try {
           process.kill(pid, 0);
-          return;
+          if (!isZombie(pid)) {
+            return;
+          }
+          process.stderr.write(`[exed-client] PID ${pid} is a zombie \u2014 cleaning up stale files
+`);
         } catch {
         }
       }
@@ -1767,8 +1779,8 @@ function findPackageRoot() {
 function getAvailableMemoryGB() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync8 } = __require("child_process");
-      const vmstat = execSync8("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync9 } = __require("child_process");
+      const vmstat = execSync9("vm_stat", { encoding: "utf8" });
       const pageSize = 16384;
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -3703,6 +3715,12 @@ async function disposeDatabase() {
     clearInterval(_walCheckpointTimer);
     _walCheckpointTimer = null;
   }
+  if (_client) {
+    try {
+      await _client.execute("PRAGMA wal_checkpoint(PASSIVE)");
+    } catch {
+    }
+  }
   if (_daemonClient) {
     _daemonClient.close();
     _daemonClient = null;
@@ -3807,7 +3825,7 @@ var init_embedder = __esm({
 // src/lib/keychain.ts
 import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync7, statSync as statSync2 } from "fs";
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 import path7 from "path";
 import os5 from "os";
 function getKeyDir() {
@@ -3824,13 +3842,13 @@ function linuxSecretAvailable() {
   if (process.platform !== "linux") return false;
   if (linuxSecretAvailability !== null) return linuxSecretAvailability;
   try {
-    execSync2("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
+    execSync3("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
   } catch {
     linuxSecretAvailability = false;
     return false;
   }
   try {
-    execSync2("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
+    execSync3("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
     linuxSecretAvailability = true;
   } catch {
     linuxSecretAvailability = false;
@@ -3854,7 +3872,7 @@ function macKeychainGet(service = SERVICE) {
   if (!nativeKeychainAllowed()) return null;
   if (process.platform !== "darwin") return null;
   try {
-    return execSync2(
+    return execSync3(
       `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
@@ -3867,13 +3885,13 @@ function macKeychainSet(value, service = SERVICE) {
   if (process.platform !== "darwin") return false;
   try {
     try {
-      execSync2(
+      execSync3(
         `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
         { timeout: 5e3 }
       );
     } catch {
     }
-    execSync2(
+    execSync3(
       `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
       { timeout: 5e3 }
     );
@@ -3886,7 +3904,7 @@ function macKeychainDelete(service = SERVICE) {
   if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "darwin") return false;
   try {
-    execSync2(
+    execSync3(
       `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
@@ -3898,7 +3916,7 @@ function macKeychainDelete(service = SERVICE) {
 function linuxSecretGet(service = SERVICE) {
   if (!linuxSecretAvailable()) return null;
   try {
-    return execSync2(
+    return execSync3(
       `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
@@ -3909,7 +3927,7 @@ function linuxSecretGet(service = SERVICE) {
 function linuxSecretSet(value, service = SERVICE) {
   if (!linuxSecretAvailable()) return false;
   try {
-    execSync2(
+    execSync3(
       `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
@@ -3922,7 +3940,7 @@ function linuxSecretDelete(service = SERVICE) {
   if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "linux") return false;
   try {
-    execSync2(
+    execSync3(
       `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
@@ -7274,7 +7292,7 @@ var init_session_registry = __esm({
 });
 
 // src/lib/session-key.ts
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 function normalizeCommand(command) {
   const trimmed = command.trim().toLowerCase();
   const parts = trimmed.split(/[\\/]/);
@@ -7293,7 +7311,7 @@ function resolveRuntimeProcess() {
   let pid = process.ppid;
   for (let i = 0; i < 10; i++) {
     try {
-      const info = execSync3(`ps -p ${pid} -o ppid=,comm=`, {
+      const info = execSync4(`ps -p ${pid} -o ppid=,comm=`, {
         encoding: "utf8",
         timeout: 2e3
       }).trim();
@@ -7459,14 +7477,14 @@ var init_transport = __esm({
 });
 
 // src/lib/cc-agent-support.ts
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 function _resetCcAgentSupportCache() {
   _cachedSupport = null;
 }
 function claudeSupportsAgentFlag() {
   if (_cachedSupport !== null) return _cachedSupport;
   try {
-    const helpOutput = execSync4("claude --help 2>&1", {
+    const helpOutput = execSync5("claude --help 2>&1", {
       encoding: "utf-8",
       timeout: 5e3
     });
@@ -7950,7 +7968,7 @@ var init_session_kill_telemetry = __esm({
 });
 
 // src/lib/project-name.ts
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync6 } from "child_process";
 import path16 from "path";
 function getProjectName(cwd) {
   const dir = cwd ?? process.cwd();
@@ -7958,7 +7976,7 @@ function getProjectName(cwd) {
   try {
     let repoRoot;
     try {
-      const gitCommonDir = execSync5("git rev-parse --path-format=absolute --git-common-dir", {
+      const gitCommonDir = execSync6("git rev-parse --path-format=absolute --git-common-dir", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -7966,7 +7984,7 @@ function getProjectName(cwd) {
       }).trim();
       repoRoot = path16.dirname(gitCommonDir);
     } catch {
-      repoRoot = execSync5("git rev-parse --show-toplevel", {
+      repoRoot = execSync6("git rev-parse --show-toplevel", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -8057,7 +8075,7 @@ var init_session_scope = __esm({
 import crypto6 from "crypto";
 import path17 from "path";
 import os12 from "os";
-import { execSync as execSync6 } from "child_process";
+import { execSync as execSync7 } from "child_process";
 import { mkdir as mkdir4, writeFile as writeFile4, appendFile } from "fs/promises";
 import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
 async function writeCheckpoint(input) {
@@ -8402,14 +8420,14 @@ function isTmuxSessionAlive(identifier) {
   if (!identifier || identifier === "unknown") return true;
   try {
     if (identifier.startsWith("%")) {
-      const output = execSync6("tmux list-panes -a -F '#{pane_id}'", {
+      const output = execSync7("tmux list-panes -a -F '#{pane_id}'", {
         timeout: 2e3,
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"]
       });
       return output.split("\n").some((l) => l.trim() === identifier);
     } else {
-      execSync6(`tmux has-session -t ${JSON.stringify(identifier)}`, {
+      execSync7(`tmux has-session -t ${JSON.stringify(identifier)}`, {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -8418,7 +8436,7 @@ function isTmuxSessionAlive(identifier) {
   } catch {
     if (identifier.startsWith("%")) return true;
     try {
-      execSync6("tmux list-sessions", {
+      execSync7("tmux list-sessions", {
         timeout: 2e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -8433,12 +8451,12 @@ function checkStaleCompletion(taskContext, taskCreatedAt) {
   if (!DELEGATION_KEYWORDS.test(taskContext)) return null;
   try {
     const since = new Date(taskCreatedAt).toISOString();
-    const branch = execSync6(
+    const branch = execSync7(
       "git rev-parse --abbrev-ref HEAD 2>/dev/null",
       { encoding: "utf8", timeout: 3e3 }
     ).trim();
     const branchArg = branch && branch !== "HEAD" ? branch : "";
-    const commitCount = execSync6(
+    const commitCount = execSync7(
       `git log --oneline --since="${since}" ${branchArg} 2>/dev/null | wc -l`,
       { encoding: "utf8", timeout: 5e3 }
     ).trim();
@@ -9969,7 +9987,7 @@ __export(tmux_routing_exports, {
   spawnEmployee: () => spawnEmployee,
   verifyPaneAtCapacity: () => verifyPaneAtCapacity
 });
-import { execFileSync as execFileSync2, execSync as execSync7 } from "child_process";
+import { execFileSync as execFileSync2, execSync as execSync8 } from "child_process";
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync8, mkdirSync as mkdirSync9, existsSync as existsSync17, appendFileSync, readdirSync as readdirSync4 } from "fs";
 import path21 from "path";
 import os13 from "os";
@@ -10690,7 +10708,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   let booted = false;
   for (let i = 0; i < 30; i++) {
     try {
-      execSync7("sleep 0.5");
+      execSync8("sleep 0.5");
     } catch {
     }
     try {