@askexenow/exe-os 0.9.322 → 0.9.324

package/deploy/compose/.env.customer.example

@@ -186,7 +186,7 @@ MONITOR_AGENT_LISTEN=:45876
 #   erp.<domain>     → http://exe-sso-edge:80   (NOT exe-erp / exe-erp-nginx)
 #   gateway.<domain> → http://exe-gateway:3100  (routed directly — no SSO gate)
 #   monitor.<domain> → http://exe-monitor-hub:8090
-#   auth.<domain>    → http://gotrue:9999
+#   auth.<domain>    → http://exe-auth:80    (auth gateway — NOT raw gotrue:9999; bug 802661a5)
 #   api.<domain>     → http://exe-os:8765
 # SET_MANUALLY
 CLOUDFLARE_TUNNEL_TOKEN=CHANGEME_CLOUDFLARE_TUNNEL_TOKEN

package/deploy/compose/.env.example

@@ -10,6 +10,12 @@ DOMAIN=CHANGEME_DOMAIN
 POSTGRES_USER=exe
 POSTGRES_PASSWORD=CHANGEME_POSTGRES_PASSWORD
 POSTGRES_DB=exedb
+# bug ad645206: NEVER connect to exe-db via its container IP (10.42.0.x) —
+# container IPs are reassigned on every stack update and silently break any
+# script that hardcodes them. In-network services use the service hostname
+# exe-db:5432; host-side scripts (crons, collectors, OCR workers) use the
+# stable loopback port below (published as 127.0.0.1:<port> by compose).
+EXE_DB_HOST_PORT=55432
 
 CLICKHOUSE_DB=default
 CLICKHOUSE_USER=exe
@@ -139,6 +145,17 @@ GATEWAY_WS_HOST_PORT=3101
 GATEWAY_GOTRUE_URL=http://gotrue:9999
 # CRM bridge: exe-gateway reaches exe-crm through Docker service DNS.
 CRM_GRAPHQL_URL=http://exe-crm:3000/graphql
+# bug 0b66164c: CRM bridge token. Compose passes CRM_API_TOKEN into the
+# gateway container, defaulting to the EXE_CRM_ADMIN_TOKEN generated in the
+# CRM block above — set this only to override with a dedicated token. If the
+# gateway logs 'CRM bridge Disabled', check this chain and recreate the
+# gateway container.
+# CRM_API_TOKEN=
+# bug a99c1462: one-time Baileys v7 WhatsApp auth migration. Set =1 for a
+# single gateway restart after an update that invalidates WhatsApp auth
+# (fresh-QR reconnect loop): old auth is archived and a clean QR pairing
+# starts. Re-pair at https://gateway.<domain>/pair/<account>, then unset.
+# EXE_GATEWAY_CONFIRM_BAILEYS_V7_REPAIR=1
 # Error forwarding to exe-monitor-hub (strongly recommended for production)
 ERROR_REPORTING_ENABLED=true
 MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors
@@ -230,7 +247,7 @@ MONITOR_SHARE_ALL_SYSTEMS=false
 #   erp.<domain>     → http://exe-sso-edge:80   (NOT exe-erp / exe-erp-nginx)
 #   gateway.<domain> → http://exe-gateway:3100  (routed directly — no SSO gate)
 #   monitor.<domain> → http://exe-monitor-hub:8090
-#   auth.<domain>    → http://gotrue:9999
+#   auth.<domain>    → http://exe-auth:80    (auth gateway — NOT raw gotrue:9999; bug 802661a5)
 #   api.<domain>     → http://exe-os:8765
 # SET_MANUALLY
 CLOUDFLARE_TUNNEL_TOKEN=CHANGEME_CLOUDFLARE_TUNNEL_TOKEN

package/deploy/compose/PROTECTED_FILES.md

@@ -14,7 +14,10 @@ and log a migration notice, not replace the existing one.
 
 ## Data volumes (Docker managed, persist across updates)
 - `postgres_data` — all database data (CRM, wiki, graph, raw, gateway)
-- `gateway_data` — Baileys WhatsApp auth state (creds.json, sessions)
+- `gateway_data` — gateway runtime data and local cache
+- `gateway_whatsapp_auth` — Baileys WhatsApp auth state (creds.json, sessions);
+  mounted at both `/data/auth_info` and `/data/.auth` so gateway image updates
+  cannot strand pairings by switching auth directories
 - `wiki_data` — uploaded documents, workspace storage
 - `crm_data` — CRM local file storage
 - `monitor_hub_data` — PocketBase data, alert history

package/deploy/compose/add-routes.sh

@@ -26,6 +26,8 @@
 #   Host overlay dir  : ${OVERLAY_DIR:-/opt/exe-stack/overlay}
 #   In-container view : /data/overlay  (read-only bind-mount, always present)
 #   Applied into      : ${OVERLAY_TARGET:-/app/overlay} inside the container
+#   Legacy fallback   : matching files under /app/dist (when the image has no
+#                       EXE_GATEWAY_OVERLAY_DIR loader yet)
 #
 # Overlays are loaded by the gateway from EXE_GATEWAY_OVERLAY_DIR (defaults to
 # /data/overlay — the bind-mount — so on a modern gateway no copy is even needed;
@@ -84,6 +86,26 @@ for f in "${overlay_files[@]}"; do
   else
     log "  ERROR failed to apply ${base}"
   fi
+
+  # Compatibility fallback for gateway builds that still do NOT read
+  # EXE_GATEWAY_OVERLAY_DIR or /app/overlay (bug 20ae1f85). HYGO's overlays are
+  # flat files (po-intake.js, whatsapp.js) that patch same-named files in the
+  # built gateway dist. If exactly one match exists, patch that runtime file too
+  # so the overlay survives a container recreate even before the gateway image
+  # grows a native overlay loader. Multiple matches are unsafe — warn instead of
+  # guessing.
+  matches=$(docker exec "$CONTAINER" sh -c 'find /app/dist -type f -name "$1" 2>/dev/null' sh "$base" 2>/dev/null || true)
+  match_count=$(printf '%s\n' "$matches" | sed '/^$/d' | wc -l | tr -d ' ')
+  if [[ "$match_count" == "1" ]]; then
+    target=$(printf '%s\n' "$matches" | sed '/^$/d' | head -n1)
+    if docker cp "$f" "${CONTAINER}:${target}" >/dev/null 2>&1; then
+      log "  patched legacy runtime file ${target}"
+    else
+      log "  WARN failed to patch legacy runtime file ${target}"
+    fi
+  elif [[ "$match_count" != "0" ]]; then
+    log "  WARN ${base} matched ${match_count} files under /app/dist; not patching legacy runtime path"
+  fi
 done
 
 if [[ "$applied" -eq 0 ]]; then

package/deploy/compose/cloudflared/config.yml.example

@@ -9,7 +9,7 @@
 #        erp.<domain>     → http://exe-sso-edge:80   (unified SSO redirect)
 #        gateway.<domain> → http://exe-gateway:3100
 #        monitor.<domain> → http://exe-monitor-hub:8090
-#        auth.<domain>    → http://gotrue:9999
+#        auth.<domain>    → http://exe-auth:80    (auth gateway — NOT raw gotrue:9999; bug 802661a5)
 #        api.<domain>     → http://exe-os:8765
 #   No config.yml or credentials file needed — the token embeds everything.
 #
@@ -51,9 +51,12 @@ ingress:
     service: http_status:404
   - hostname: monitor.CHANGEME_DOMAIN
     service: http://exe-monitor-hub:8090
-  # Auth (GoTrue)
+  # Auth gateway (login SPA + /api/ proxy to GoTrue). Bug 802661a5: routing
+  # auth.<domain> straight to raw gotrue:9999 bypasses the exe-auth gateway —
+  # no login UI, no CORS/domain templating, and GoTrue's API is exposed as the
+  # public front door. Always route through the exe-auth container.
   - hostname: auth.CHANGEME_DOMAIN
-    service: http://gotrue:9999
+    service: http://exe-auth:80
   # exe-os daemon (MCP)
   - hostname: api.CHANGEME_DOMAIN
     service: http://exe-os:8765

package/deploy/compose/docker-compose.yml

@@ -68,6 +68,15 @@ services:
       # container recreation; push it off-box for true disaster recovery.
       - pg_wal_archive:/var/lib/postgresql/wal_archive
       - ./init-db.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
+    # bug ad645206: STABLE loopback-only host port for host-side tooling
+    # (dashboard snapshot crons, collectors, OCR workers, psql). Container IPs
+    # on the backend network (10.42.0.x) are REASSIGNED whenever the stack is
+    # recreated by an update — every script that hardcoded an IP broke silently
+    # (ECONNREFUSED for days). Host scripts must connect to
+    # 127.0.0.1:${EXE_DB_HOST_PORT} (default 55432); in-network services keep
+    # using the service hostname exe-db:5432. Never reference a container IP.
+    ports:
+      - "127.0.0.1:${EXE_DB_HOST_PORT:-55432}:5432"
     networks:
       - backend
     healthcheck:
@@ -507,7 +516,7 @@ services:
       # offline boots fail). WIKI_EXE_OS_NPM_VERSION defaults to the stack's
       # pinned exe-os npm version and is threaded into the spawn args.
       EXE_OS_MCP_COMMAND: ${WIKI_EXE_OS_MCP_COMMAND:-npx}
-      EXE_OS_MCP_ARGS: ${WIKI_EXE_OS_MCP_ARGS:--y @askexenow/exe-os@${WIKI_EXE_OS_NPM_VERSION:-0.9.318} mcp}
+      EXE_OS_MCP_ARGS: ${WIKI_EXE_OS_MCP_ARGS:--y @askexenow/exe-os@${WIKI_EXE_OS_NPM_VERSION:-0.9.322} mcp}
       BRANDING_CONFIG_PATH: /app/branding.json
     ports:
       - "127.0.0.1:${WIKI_HOST_PORT:-3001}:3001"
@@ -693,6 +702,21 @@ services:
       EXED_MCP_URL: http://exe-os:48739/mcp
       EXED_MCP_TOKEN: ${EXED_MCP_TOKEN:?EXED_MCP_TOKEN is required}
       CRM_GRAPHQL_URL: ${CRM_GRAPHQL_URL:-http://exe-crm:3000/graphql}
+      # bug 0b66164c: CRM bridge auth token. The per-service env allowlist that
+      # replaced the blanket `env_file: .env` (bug 67d62490) silently DROPPED
+      # CRM_API_TOKEN from the gateway container on the next stack update — the
+      # CRM bridge disabled itself ("CRM bridge Disabled — CRM_API_TOKEN not
+      # set") and WhatsApp→CRM contact sync stopped with no alert. Pass the
+      # token through explicitly, defaulting to the EXE_CRM_ADMIN_TOKEN that
+      # generate-env.ts already provisions (the CRM accepts it as an admin API
+      # token), so a fresh stack has a working bridge out of the box.
+      CRM_API_TOKEN: ${CRM_API_TOKEN:-${EXE_CRM_ADMIN_TOKEN:-}}
+      # bug a99c1462: opt-in Baileys v7 auth-state migration. When a gateway
+      # update crosses a Baileys major (pre-v7 auth state invalid → fresh QR +
+      # reconnect loop), set this to 1 in .env for ONE restart: the gateway
+      # archives the old WhatsApp auth (kept 7 days) and starts a clean QR
+      # pairing flow. Re-pair at https://gateway.<domain>/pair/<account>, then unset.
+      EXE_GATEWAY_CONFIRM_BAILEYS_V7_REPAIR: ${EXE_GATEWAY_CONFIRM_BAILEYS_V7_REPAIR:-}
       ERROR_REPORTING_ENABLED: "true"
       MONITOR_ERROR_URL: http://exe-monitor-hub:8090/api/exe-monitor/errors
       # bug 182c6da3 / a125785d: shared monitor secret. The hub authenticates the
@@ -721,6 +745,12 @@ services:
       # EXE_GATEWAY_HOME; the old /app/auth_info mount was unreachable when the
       # gateway used its default path. gateway.json authDir updated to match.
       - gateway_whatsapp_auth:/data/auth_info
+      # bug d16a808f/a99c1462: keep the SAME WhatsApp auth-state volume visible
+      # at the newer Baileys/default gateway path too. Some gateway builds used
+      # /data/.auth/whatsapp-* regardless of gateway.json authDir; exposing one
+      # volume at both paths prevents an image update from "losing" pairings just
+      # because the app switched auth directories.
+      - gateway_whatsapp_auth:/data/.auth
       - ./gateway.json:/data/gateway.json:ro
       # bug 02bc1bb8: PERSISTENT customer-overlay bind-mount. Anything the
       # customer drops in the host ./overlay dir (e.g. po-intake.js) is exposed
@@ -904,6 +934,11 @@ services:
         condition: service_healthy
       exe-erp-nginx:
         condition: service_healthy
+      # Bug 462d3273: the edge's /_sso_gate validates ?access_token= against
+      # GoTrue (upstream sso_gotrue → gotrue:9999) instead of trusting its
+      # presence, so the edge needs GoTrue resolvable and healthy at start.
+      gotrue:
+        condition: service_healthy
     environment:
       DOMAIN: ${DOMAIN:?DOMAIN is required — set to your customer apex domain (e.g. hygo.co)}
       # Neutralize nginx:alpine's built-in 20-envsubst-on-templates.sh: it would

package/deploy/compose/generate-env.ts

@@ -51,6 +51,10 @@ const DEFAULT_MONITOR_HUB_URL = "http://exe-monitor-hub:8090";
 const DEFAULT_MONITOR_AGENT_LISTEN = ":45876";
 const DEFAULT_EXE_MCP_HOST_BIND = "127.0.0.1";
 const DEFAULT_EXE_MCP_HOST_PORT = "48739";
+// bug ad645206: stable loopback-only host port for exe-db so host-side scripts
+// never hardcode a (reassigned-on-update) container IP. 55432 avoids colliding
+// with a host-local Postgres on 5432.
+const DEFAULT_EXE_DB_HOST_PORT = "55432";
 
 export interface GenerateEnvOptions {
   clientName: string;
@@ -73,6 +77,12 @@ export function generateEnv(options: GenerateEnvOptions): string {
     `POSTGRES_USER=${POSTGRES_USER}`,
     `POSTGRES_PASSWORD=${randomSecret(RANDOM_SECRET_32)}`,
     `POSTGRES_DB=${POSTGRES_DB}`,
+    "# bug ad645206: NEVER connect to exe-db via its container IP (10.42.0.x) —",
+    "# container IPs are reassigned on every stack update and silently break any",
+    "# script that hardcodes them. In-network services use the service hostname",
+    "# exe-db:5432; host-side scripts (crons, collectors, OCR workers) use the",
+    "# stable loopback port below (published as 127.0.0.1:<port> by compose).",
+    `EXE_DB_HOST_PORT=${DEFAULT_EXE_DB_HOST_PORT}`,
     "",
     `CLICKHOUSE_DB=${CLICKHOUSE_DB}`,
     `CLICKHOUSE_USER=${CLICKHOUSE_USER}`,
@@ -190,6 +200,17 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "GATEWAY_GOTRUE_URL=http://gotrue:9999",
     "# CRM bridge: exe-gateway reaches exe-crm through Docker service DNS.",
     `CRM_GRAPHQL_URL=${DEFAULT_CRM_GRAPHQL_URL}`,
+    "# bug 0b66164c: CRM bridge token. Compose passes CRM_API_TOKEN into the",
+    "# gateway container, defaulting to the EXE_CRM_ADMIN_TOKEN generated in the",
+    "# CRM block above — set this only to override with a dedicated token. If the",
+    "# gateway logs 'CRM bridge Disabled', check this chain and recreate the",
+    "# gateway container.",
+    "# CRM_API_TOKEN=",
+    "# bug a99c1462: one-time Baileys v7 WhatsApp auth migration. Set =1 for a",
+    "# single gateway restart after an update that invalidates WhatsApp auth",
+    "# (fresh-QR reconnect loop): old auth is archived and a clean QR pairing",
+    "# starts. Re-pair at https://gateway.<domain>/pair/<account>, then unset.",
+    "# EXE_GATEWAY_CONFIRM_BAILEYS_V7_REPAIR=1",
     "# Error forwarding to exe-monitor-hub (strongly recommended for production)",
     "ERROR_REPORTING_ENABLED=true",
     "MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors",
@@ -271,7 +292,7 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "#   erp.<domain>     → http://exe-sso-edge:80   (NOT exe-erp / exe-erp-nginx)",
     "#   gateway.<domain> → http://exe-gateway:3100  (routed directly — no SSO gate)",
     "#   monitor.<domain> → http://exe-monitor-hub:8090",
-    "#   auth.<domain>    → http://gotrue:9999",
+    "#   auth.<domain>    → http://exe-auth:80    (auth gateway — NOT raw gotrue:9999; bug 802661a5)",
     "#   api.<domain>     → http://exe-os:8765",
     MANUAL_VALUE_COMMENT,
     "CLOUDFLARE_TUNNEL_TOKEN=",
@@ -296,6 +317,12 @@ export function generateExampleEnv(): string {
     `POSTGRES_USER=${POSTGRES_USER}`,
     "POSTGRES_PASSWORD=CHANGEME_POSTGRES_PASSWORD",
     `POSTGRES_DB=${POSTGRES_DB}`,
+    "# bug ad645206: NEVER connect to exe-db via its container IP (10.42.0.x) —",
+    "# container IPs are reassigned on every stack update and silently break any",
+    "# script that hardcodes them. In-network services use the service hostname",
+    "# exe-db:5432; host-side scripts (crons, collectors, OCR workers) use the",
+    "# stable loopback port below (published as 127.0.0.1:<port> by compose).",
+    `EXE_DB_HOST_PORT=${DEFAULT_EXE_DB_HOST_PORT}`,
     "",
     `CLICKHOUSE_DB=${CLICKHOUSE_DB}`,
     `CLICKHOUSE_USER=${CLICKHOUSE_USER}`,
@@ -425,6 +452,17 @@ export function generateExampleEnv(): string {
     "GATEWAY_GOTRUE_URL=http://gotrue:9999",
     "# CRM bridge: exe-gateway reaches exe-crm through Docker service DNS.",
     `CRM_GRAPHQL_URL=${DEFAULT_CRM_GRAPHQL_URL}`,
+    "# bug 0b66164c: CRM bridge token. Compose passes CRM_API_TOKEN into the",
+    "# gateway container, defaulting to the EXE_CRM_ADMIN_TOKEN generated in the",
+    "# CRM block above — set this only to override with a dedicated token. If the",
+    "# gateway logs 'CRM bridge Disabled', check this chain and recreate the",
+    "# gateway container.",
+    "# CRM_API_TOKEN=",
+    "# bug a99c1462: one-time Baileys v7 WhatsApp auth migration. Set =1 for a",
+    "# single gateway restart after an update that invalidates WhatsApp auth",
+    "# (fresh-QR reconnect loop): old auth is archived and a clean QR pairing",
+    "# starts. Re-pair at https://gateway.<domain>/pair/<account>, then unset.",
+    "# EXE_GATEWAY_CONFIRM_BAILEYS_V7_REPAIR=1",
     "# Error forwarding to exe-monitor-hub (strongly recommended for production)",
     "ERROR_REPORTING_ENABLED=true",
     "MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors",
@@ -516,7 +554,7 @@ export function generateExampleEnv(): string {
     "#   erp.<domain>     → http://exe-sso-edge:80   (NOT exe-erp / exe-erp-nginx)",
     "#   gateway.<domain> → http://exe-gateway:3100  (routed directly — no SSO gate)",
     "#   monitor.<domain> → http://exe-monitor-hub:8090",
-    "#   auth.<domain>    → http://gotrue:9999",
+    "#   auth.<domain>    → http://exe-auth:80    (auth gateway — NOT raw gotrue:9999; bug 802661a5)",
     "#   api.<domain>     → http://exe-os:8765",
     MANUAL_VALUE_COMMENT,
     "CLOUDFLARE_TUNNEL_TOKEN=CHANGEME_CLOUDFLARE_TUNNEL_TOKEN",

package/deploy/compose/sso-edge/default.conf.template

@@ -20,6 +20,17 @@ upstream sso_crm  { server exe-crm:3000; }
 upstream sso_wiki { server exe-wiki:3001; }
 # ERP must be reached through its own nginx (gunicorn can't serve /assets/ — bug 6776edf0)
 upstream sso_erp  { server exe-erp-nginx:80; }
+# Shared GoTrue — the sso-redirect snippet's /_sso_gate validates ?access_token=
+# against GET /user here instead of trusting its presence (P0 bug 462d3273).
+upstream sso_gotrue { server gotrue:9999; }
+
+# Extract the SSO callback token from the request line (P0 bug 462d3273).
+# The gate's auth_request subrequest does not inherit the query string, but it
+# does inherit $request_uri — this map is how /_sso_gate reads the token.
+map $request_uri $sso_uri_access_token {
+    default "";
+    "~[?&]access_token=(?<tok>[^&]+)" $tok;
+}
 
 map $http_upgrade $sso_conn_upgrade {
     default upgrade;

package/deploy/compose/sso-edge/sso-redirect.conf

@@ -1,5 +1,5 @@
 # ─────────────────────────────────────────────────────────────────────────────
-# Unified SSO redirect snippet  (bug 66f8e10a)
+# Unified SSO redirect snippet  (bug 66f8e10a, hardened for bug 462d3273)
 #
 # Funnels UNAUTHENTICATED visitors of an app subdomain (crm / wiki / erp) to the
 # central auth gateway at auth.<domain>, then lets the gateway redirect them back
@@ -7,20 +7,42 @@
 # advertised "single front door" does not exist.
 #
 # ── How it works ────────────────────────────────────────────────────────────
-#  1. nginx checks for a session cookie that the app sets once authenticated.
-#     The cookie name differs per app (Twenty/CRM, Wiki, Frappe/ERP) — set it
-#     via $sso_session_cookie below.
-#  2. If the cookie is ABSENT, nginx 302-redirects to:
+#  1. Every request runs the edge auth gate (auth_request → /_sso_gate).
+#  2. If the app session cookie is present the request passes (the app validates
+#     its own session server-side — the cookie name differs per app; set it via
+#     $sso_session_cookie below).
+#  3. If the request carries ?access_token= (the SSO callback), the edge
+#     VALIDATES the token against the shared GoTrue (`GET /user` with
+#     `Authorization: Bearer <token>`) before letting it through. P0 bug
+#     462d3273: the edge previously trusted the mere PRESENCE of the query
+#     param, so `?access_token=anything` bypassed the gate. Presence is never
+#     trusted — only a token GoTrue accepts passes.
+#  4. Anything else 401s inside the gate and is 302-redirected to:
 #       https://auth.<domain>/?product=<App>&redirect=https://<app>.<domain><uri>
-#  3. The gateway authenticates against the shared GoTrue and bounces the user
-#     back to the app URL with ?access_token=<jwt>&refresh_token=<...>.
-#  4. The app consumes the token (it already shares GoTrue) and sets its session
-#     cookie — subsequent requests carry the cookie and skip the redirect.
+#  5. The gateway authenticates against the shared GoTrue and bounces the user
+#     back to the app URL with ?access_token=<jwt>&refresh_token=<...>. The app
+#     consumes the token and sets its session cookie — subsequent requests carry
+#     the cookie and skip the GoTrue round-trip (gate returns 204 locally).
 #
 # ── Per-customer install ────────────────────────────────────────────────────
 # These are templated values — replace before installing, or render with envsubst
 # (DOMAIN, APP_NAME, APP_SUBDOMAIN, APP_SESSION_COOKIE):
 #
+#   # TWO http-context declarations MUST exist once per nginx config (the
+#   # compose edge ships them in sso-edge/default.conf.template; host-nginx
+#   # installs add them next to their `include`s — see sso-redirect.README.md):
+#   #
+#   # 1. The shared GoTrue upstream the gate validates tokens against
+#   #    (compose: `server gotrue:9999`; host nginx: the published port):
+#   upstream sso_gotrue { server 127.0.0.1:9999; }
+#   # 2. The callback-token extractor. The auth_request subrequest does not
+#   #    inherit the query string, but it DOES inherit $request_uri, so the
+#   #    token is mapped from it:
+#   map $request_uri $sso_uri_access_token {
+#       default "";
+#       "~[?&]access_token=(?<tok>[^&]+)" $tok;
+#   }
+#
 #   server {
 #     server_name crm.${DOMAIN};
 #     set $sso_auth_base   "https://auth.${DOMAIN}";
@@ -40,24 +62,71 @@
 # the stack with Cloudflare Tunnel instead of host nginx, implement the same gate
 # with Cloudflare Access (see sso-redirect.README.md) — cloudflared ingress alone
 # cannot express a cookie-conditional redirect.
+#
+# NOTE: cookie PRESENCE is still trusted at the edge (the CRM/ERP session cookies
+# are app-native sessions the edge cannot verify against GoTrue); each app fully
+# validates its own session server-side. The edge gate's job is the login funnel
+# plus never letting an unvalidated bearer token skip it (bug 462d3273).
 # ─────────────────────────────────────────────────────────────────────────────
 
-# Decide whether the request is authenticated. If the app session cookie is
-# present we treat the request as authenticated and do NOT redirect.
-# $sso_session_cookie must be set by the including server block (default: empty).
-set $sso_needs_login 1;
-if ($sso_session_cookie) {
-    set $sso_needs_login 0;
+# Run the gate for every request on this vhost. The gate is a zero-cost local
+# check when the session cookie is present; it only round-trips to GoTrue for
+# the ?access_token= SSO callback. A gate 401 becomes the login redirect below.
+# Requires nginx built with ngx_http_auth_request_module (present in the
+# official nginx / nginx:alpine builds).
+auth_request /_sso_gate;
+error_page 401 = @sso_login;
+
+location = /_sso_gate {
+    internal;
+    auth_request off; # never gate the gate (recursion guard)
+
+    # The gate must answer the auth subrequest with a PLAIN 401 — without this
+    # override, the server-level `error_page 401 = @sso_login` would intercept
+    # the internally-generated 401s below and turn the subrequest into a 302,
+    # which auth_request rejects ("auth request unexpected status: 302").
+    error_page 401 = @sso_gate_deny;
+
+    # 1. App session cookie present → authenticated (app re-validates it).
+    if ($sso_session_cookie) {
+        return 204;
+    }
+
+    # 2. No cookie and no token → unauthenticated → login redirect.
+    #    $sso_uri_access_token comes from the REQUIRED http-context map (see
+    #    header comment): the auth_request subrequest does not inherit the
+    #    query string (so $arg_access_token is empty here) and server-level
+    #    `set` re-runs empty in the subrequest — but $request_uri IS inherited,
+    #    so a map over it yields the callback token reliably.
+    if ($sso_uri_access_token = "") {
+        return 401;
+    }
+
+    # 3. SSO callback: VALIDATE the token against the shared GoTrue.
+    #    GET /user returns 200 only for a currently-valid access token; any
+    #    401/403 propagates and triggers the login redirect. If GoTrue is
+    #    unreachable the subrequest 5xx fails the gate (fail closed).
+    proxy_pass http://sso_gotrue/user;
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+    proxy_set_header Authorization "Bearer $sso_uri_access_token";
+    proxy_set_header Cookie "";
+    proxy_connect_timeout 5s;
+    proxy_send_timeout 5s;
+    proxy_read_timeout 5s;
 }
 
-# Never redirect the SSO callback itself (it carries ?access_token=) or static/
-# health/API paths — only redirect top-level navigations.
-if ($arg_access_token) {
-    set $sso_needs_login 0;
+# Plain-401 sink for the gate subrequest (see error_page inside /_sso_gate).
+# recursive_error_pages is off by default, so this terminal 401 is not
+# re-intercepted by the server-level error_page.
+location @sso_gate_deny {
+    auth_request off;
+    return 401;
 }
 
-# Perform the redirect for unauthenticated top-level page loads.
+# Login redirect for unauthenticated top-level page loads.
 # $request_uri preserves the path + query the user was trying to reach.
-if ($sso_needs_login = 1) {
+location @sso_login {
+    auth_request off;
     return 302 "$sso_auth_base/?product=$sso_product&redirect=$sso_app_url$request_uri";
 }

package/deploy/stack-manifests/v0.9.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "latest": "0.9.28",
+  "latest": "0.9.29",
   "stacks": {
     "0.9.0": {
       "version": "0.9.0",
@@ -1906,11 +1906,119 @@
           "category": "infra"
         }
       }
+    },
+    "0.9.29": {
+      "version": "0.9.29",
+      "releasedAt": "2026-07-04T00:00:00Z",
+      "notes": "exe-os v0.9.324 (#305 daemon event-loop, #307 orchestration dispatch, #308 customer-readiness, #309 MCP transport isolation + coordinator-orphan reaper), exe-gateway v0.9.28 (#55: WhatsApp auth persistence, crm-bridge push_name, overlay loading, raw-event replay ON CONFLICT, health adapter state, Prisma migrations), exe-crm v0.9.53 (#58: startup-crash WorkspaceDomainsService + upgrade command + version resolution + k8s hardening), exe-wiki v0.9.27 (#34: test-teardown). Other services unchanged from 0.9.28.",
+      "npmVersion": "0.9.324",
+      "services": {
+        "exe-db": {
+          "image": "pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.27@sha256:a422e787f06850a5302dc560bfb1b944d8b35927607ded762bbda610fb7db48d",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v0.9.28@sha256:b3ab35cf00490711c4ae945d06da042cb285ca1c07902ea1c2e28ca540741a5d",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — CRM bridge fix, BYOK alias, SQL race fix, Baileys WA version floor"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v0.9.5@sha256:cada7dace00ccb629aa10976e80e20d7d25685042519bd2aec58ab4bf35ff0cd",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v0.9.5@sha256:1af31893cc8b1e51892be7d7705fa6c6b3108af8366b1fa8da2879d8ae21ec88",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.1.0@sha256:5de4fe282c60c9877b6a0e22cfba43f6222982d81eb315667e9479eb94d94d7a",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/api/health",
+          "category": "auth"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.2.0-final8@sha256:15bb6020b109b4dfd51d245273ffa88bbfbaf0de09da05a09e6b6f9344b00c46",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning"
+        },
+        "gotrue": {
+          "image": "supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "clickhouse/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "cloudflare/cloudflared@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        }
+      }
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "QYIPCDJ7lIcg4E3qgzq9vZnOEvN8D5JZFKAxb8ho+uWrS6aHAyWJv3VLZTRNG9+dO5XbfG4CLCJMbTo4bMpPCA=="
+    "signature": "7e/1gwcJB83aPHZPJHEnZRI/Nc4Rr5NZn4qyqk3f9Bv6KruxygvvagcUs/u+NPjWrzyXIUK5nimpGsaulJf7DQ=="
   }
 }

package/dist/{active-agent-M5NJFEBM.js → active-agent-CVSB2EER.js}

@@ -6,12 +6,12 @@ import {
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
   writeActiveAgent
-} from "./chunk-EOPSIIEH.js";
+} from "./chunk-ID3V4BWS.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-XLNF3CIO.js";
+import "./chunk-QGOMYIVT.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-WXRVHXVP.js";
+import "./chunk-7577GDDG.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";

package/dist/{active-agent-SHM4QSRJ.js → active-agent-IUVRZOSF.js}

@@ -5,12 +5,12 @@ import {
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
   writeActiveAgent
-} from "./chunk-EOPSIIEH.js";
+} from "./chunk-ID3V4BWS.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-XLNF3CIO.js";
+import "./chunk-QGOMYIVT.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-WXRVHXVP.js";
+import "./chunk-7577GDDG.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";

package/dist/{agentic-ontology-HQKCU7LG.js → agentic-ontology-2QFPBIQP.js}

@@ -10,7 +10,7 @@ import {
   insertOntologyForMemory,
   ontologyPayload,
   stableId
-} from "./chunk-DY3J6GQO.js";
+} from "./chunk-H43BPGIV.js";
 import "./chunk-MLKGABMK.js";
 export {
   ONTOLOGY_YIELD_EVERY,

package/dist/backfill-gate-J7UXFNXU.js

@@ -0,0 +1,19 @@
+import {
+  NOT_PARKED_SQL,
+  PARKED_EMBEDDING_MODEL,
+  PARKED_EMBEDDING_MODEL_PREFIX,
+  backfillKillSwitchEnabled,
+  computeBackfillDisabled,
+  countActionableNullVectors
+} from "./chunk-KPIN44GZ.js";
+import "./chunk-7Y5UDEVM.js";
+import "./chunk-SHIICYJW.js";
+import "./chunk-MLKGABMK.js";
+export {
+  NOT_PARKED_SQL,
+  PARKED_EMBEDDING_MODEL,
+  PARKED_EMBEDDING_MODEL_PREFIX,
+  backfillKillSwitchEnabled,
+  computeBackfillDisabled,
+  countActionableNullVectors
+};