@askexenow/exe-os 0.9.372 → 0.9.374

package/deploy/compose/generate-env.ts

@@ -1,40 +1,89 @@
 import { randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
+// ---------------------------------------------------------------------------
+// IMAGE PINS — DERIVED FROM THE SIGNED MANIFEST. NEVER HAND-TYPED.
+//
+// .env used to be an INDEPENDENT source of pins: a block of hand-edited
+// `*_RELEASE_TAG` constants that had to be "kept in sync" with
+// deploy/stack-manifests/v0.9.json. It was not kept in sync. On 2026-08-20 the
+// manifest, /opt/exe-stack/.env and the compose fallback defaults disagreed on
+// 5 of 7 apps in production.
+//
+// One direction only: each repo cuts a release -> the manifest is generated
+// from those releases -> .env is DERIVED from the manifest -> the VPS pulls what
+// .env says. The version AND digest of every pin below now come from the
+// manifest and nowhere else, so drift is unrepresentable rather than merely
+// discouraged.
+//
+// The registry HOST is deployment topology, not a pin: .env.example targets
+// GHCR so local simulation runs without private update.askexe.com credentials,
+// while the same tag@digest is served by the pull-through proxy. Re-hosting
+// preserves the digest, so the artifact is identical either way.
+// ---------------------------------------------------------------------------
 const REGISTRY = "ghcr.io/askexe";
 // exe-auth (the shared SSO sign-in/sign-up SPA) ships only from the private
 // update.askexe.com registry — it is not mirrored to GHCR — so it carries its
 // own registry constant rather than reusing REGISTRY (bug 58840873).
 const AUTH_REGISTRY = "update.askexe.com/askexe";
 
-// Keep these defaults in sync with deploy/stack-manifests/v0.9.json latest.
-// deploy/compose/.env.example intentionally uses GHCR fallbacks so local
-// simulation can run without private update.askexe.com registry credentials.
-const CRM_RELEASE_TAG = "v0.9.51";
-const WIKI_RELEASE_TAG = "v0.9.26";
-const EXED_RELEASE_TAG = "v0.9.311";
-const GATEWAY_RELEASE_TAG = "v0.9.24";
-// Bug 633995f1: v0.9.5 is a quarantined build — it regressed to stock Beszel
-// (runtime uid 1001 -> 65532, data dir -> /beszel_data, entrypoint -> /beszel),
-// so it crashloops on any deployment carrying an existing monitor_hub_data
-// volume, and its agent half contradicts the generation-coupled compose
-// healthcheck. Generated .env files must never hand a customer that tag — a
-// generated .env overrides the compose default outright, so leaving this stale
-// would have silently defeated the compose pin. v0.9.4 is the last known-good
-// build. See deploy/known-bad-images.json.
-const MONITOR_RELEASE_TAG = "v0.9.4";
-const ERP_RELEASE_TAG = "v0.2.2";
-const EXE_BUILD_RELEASE_TAG = "v0.1.0";
-// Bug 58840873: pin exe-auth to the manifest-pinned tag so a generated .env never
-// lets compose fall back to its (stale) hardcoded default image. MUST equal the
-// AUTH_IMAGE_TAG tag in deploy/stack-manifests/v0.9.json and the compose default.
-const AUTH_RELEASE_TAG = "v0.5.0";
+const MANIFEST_PATH = new URL("../stack-manifests/v0.9.json", import.meta.url);
+
+type ManifestFile = {
+  latest: string;
+  stacks: Record<string, { services?: Record<string, { image?: string }> }>;
+};
+
+function loadManifestServices(): Record<string, { image?: string }> {
+  const manifest = JSON.parse(readFileSync(MANIFEST_PATH, "utf8")) as ManifestFile;
+  const services = manifest.stacks?.[manifest.latest]?.services;
+  if (!services) {
+    throw new Error(
+      `generate-env: stack manifest ${MANIFEST_PATH.pathname} has no services for latest="${manifest.latest}". ` +
+        `Refusing to generate a .env with no pins — that is exactly the silent-substitution failure ` +
+        `the manifest-as-single-source-of-truth change exists to prevent.`,
+    );
+  }
+  return services;
+}
+
+const MANIFEST_SERVICES = loadManifestServices();
+
+/**
+ * The manifest's pin for a service, re-hosted onto `registry`. FAILS LOUDLY
+ * when the manifest does not govern the service, or governs it without a
+ * digest: a missing pin must abort generation, never fall back to a literal.
+ */
+function pin(serviceKey: string, registry: string, imageName: string): string {
+  const image = MANIFEST_SERVICES[serviceKey]?.image;
+  if (!image) {
+    throw new Error(
+      `generate-env: the stack manifest does not pin "${serviceKey}". Every service .env pins must be ` +
+        `manifest-governed — add it to the manifest (exe-os stack-generate-manifest) rather than ` +
+        `hard-coding a version here.`,
+    );
+  }
+  const at = image.indexOf("@");
+  if (at === -1) {
+    throw new Error(
+      `generate-env: the manifest pin for "${serviceKey}" (${image}) carries no @sha256 digest. ` +
+        `Tags move, digests do not — refusing to emit an unpinned .env value.`,
+    );
+  }
+  const digest = image.slice(at + 1);
+  const beforeDigest = image.slice(0, at);
+  const colon = beforeDigest.lastIndexOf(":");
+  const slash = beforeDigest.lastIndexOf("/");
+  const tag = colon > slash ? beforeDigest.slice(colon + 1) : "";
+  return tag ? `${registry}/${imageName}:${tag}@${digest}` : `${registry}/${imageName}@${digest}`;
+}
 
 const POSTGRES_USER = "exe";
 const POSTGRES_DB = "exedb";
 const CLICKHOUSE_DB = "default";
 const CLICKHOUSE_USER = "exe";
-export const CRM_IMAGE_TAG = `${REGISTRY}/exe-crm:${CRM_RELEASE_TAG}`;
+export const CRM_IMAGE_TAG = pin("crm", REGISTRY, "exe-crm");
 const CRM_HOST_PORT = "3000";
-export const WIKI_IMAGE_TAG = `${REGISTRY}/exe-wiki:${WIKI_RELEASE_TAG}`;
+export const WIKI_IMAGE_TAG = pin("wiki", REGISTRY, "exe-wiki");
 // Bug 2a8d3003: the wiki's data lives in `public` and generated .env files must say
 // so. This constant used to be "wiki", which meant every freshly generated stack
 // pinned the wiki to an empty schema — Prisma bootstraps it silently rather than
@@ -42,13 +91,22 @@ export const WIKI_IMAGE_TAG = `${REGISTRY}/exe-wiki:${WIKI_RELEASE_TAG}`;
 const WIKI_DB_SCHEMA = "public";
 const WIKI_VECTOR_DB = "exeOsMcp";
 const WIKI_HOST_PORT = "3001";
-export const EXE_OS_IMAGE_TAG = `${REGISTRY}/exe-os:${EXED_RELEASE_TAG}`;
-export const GATEWAY_IMAGE_TAG = `${REGISTRY}/exe-gateway:${GATEWAY_RELEASE_TAG}`;
-export const MONITOR_AGENT_IMAGE_TAG = `${REGISTRY}/exe-monitor-agent:${MONITOR_RELEASE_TAG}`;
-export const MONITOR_HUB_IMAGE_TAG = `${REGISTRY}/exe-monitor-hub:${MONITOR_RELEASE_TAG}`;
-export const ERP_IMAGE_TAG = `${REGISTRY}/exe-erp:${ERP_RELEASE_TAG}`;
-export const EXE_BUILD_IMAGE_TAG = `${REGISTRY}/exe-build:${EXE_BUILD_RELEASE_TAG}`;
-export const AUTH_IMAGE_TAG = `${AUTH_REGISTRY}/exe-auth:${AUTH_RELEASE_TAG}`;
+export const EXE_OS_IMAGE_TAG = pin("exe-os", REGISTRY, "exe-os");
+export const GATEWAY_IMAGE_TAG = pin("gateway", REGISTRY, "exe-gateway");
+export const MONITOR_AGENT_IMAGE_TAG = pin("monitorAgent", REGISTRY, "exe-monitor-agent");
+export const MONITOR_HUB_IMAGE_TAG = pin("monitorHub", REGISTRY, "exe-monitor-hub");
+export const ERP_IMAGE_TAG = pin("erp", REGISTRY, "exe-erp");
+// exe-build is control-plane only (not part of the customer stack), so the
+// manifest does not govern it and there is nothing to derive. It is emitted
+// as an opt-in for askexe-control-plane hosts.
+export const EXE_BUILD_IMAGE_TAG = `${REGISTRY}/exe-build:v0.1.0`;
+export const AUTH_IMAGE_TAG = pin("auth", AUTH_REGISTRY, "exe-auth");
+// Infra pins. Compose no longer carries fallback defaults for these either, so
+// the generated .env must state them — derived from the manifest like the rest.
+// Third-party artifacts are served from the same pull-through proxy the manifest
+// names, so they are NOT re-hosted onto GHCR.
+export const EXE_DB_IMAGE = pin("exe-db", "update.askexe.com/askexe", "pgvector");
+export const OTEL_COLLECTOR_IMAGE = pin("exe-otel-collector", "update.askexe.com/askexe", "otel-collector-contrib");
 const GATEWAY_HTTP_HOST_PORT = "3100";
 const GATEWAY_WS_HOST_PORT = "3101";
 const RANDOM_SECRET_16 = 16;
@@ -172,8 +230,8 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "# http://gotrue:9999 and can reject browser tokens as iss-mismatch.",
     `GOTRUE_JWT_ISSUER=https://auth.${normalizedDomain}`,
     "# SSO redirect allow-list (bug 66f8e10a): app origins the gateway may bounce",
-    "# users back to via ?redirect=. Required for unified SSO across crm/wiki/erp.",
-    `GOTRUE_URI_ALLOW_LIST=https://crm.${normalizedDomain},https://wiki.${normalizedDomain},https://erp.${normalizedDomain}`,
+    "# users back to via ?redirect=. Required for unified SSO across crm/wiki/erp/dashboard/gateway (bug 2d2de534).",
+    `GOTRUE_URI_ALLOW_LIST=https://crm.${normalizedDomain},https://wiki.${normalizedDomain},https://erp.${normalizedDomain},https://dashboard.${normalizedDomain},https://gateway.${normalizedDomain}`,
     "# Bug 0327b017: scope the session cookie to the PARENT apex domain so it is",
     "# shared across crm/wiki/erp/auth subdomains → true SSO (no re-login).",
     `GOTRUE_COOKIE_DOMAIN=.${normalizedDomain}`,
@@ -201,6 +259,14 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "SMTP_USER=",
     "SMTP_PASS=",
     "",
+    "# --- Dashboard (exe-dashboard — customer dashboard at dashboard.<domain>) ---",
+    "# OPT-IN: the exe-dashboard compose service sits behind `profiles: [dashboard]`.",
+    "# No default is written here on purpose — the pin comes from the signed stack",
+    "# manifest (services.dashboard.image), so .env stays derived rather than",
+    "# becoming a competing source of truth that outranks it once it goes stale.",
+    "#DASHBOARD_IMAGE_TAG=update.askexe.com/askexe/exe-dashboard:vX.Y.Z@sha256:...",
+    "#DASHBOARD_PORT=3301",
+    "",
     "# --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---",
     "# Bug 58840873: pin the auth image in .env so compose never falls back to its",
     "# stale hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG.",
@@ -262,6 +328,11 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "",
     "# --- exe-os ---",
     `EXE_OS_IMAGE_TAG=${EXE_OS_IMAGE_TAG}`,
+    "",
+    "# Infra image pins — manifest-derived. Compose has no fallback default for",
+    "# these: a missing pin ABORTS the deploy instead of substituting an old image.",
+    `EXE_DB_IMAGE=${EXE_DB_IMAGE}`,
+    `OTEL_COLLECTOR_IMAGE=${OTEL_COLLECTOR_IMAGE}`,
     `EXED_MCP_TOKEN=${randomSecret(RANDOM_SECRET_48)}`,
     `EXED_DEVICE_ID=vps-${normalizedClientName}`,
     `EXE_MCP_HOST_BIND=${DEFAULT_EXE_MCP_HOST_BIND}`,
@@ -466,7 +537,7 @@ export function generateExampleEnv(): string {
     "# Bug 51086951: JWT issuer pinned to the public auth URL so signer + consumers agree.",
     "GOTRUE_JWT_ISSUER=https://auth.CHANGEME_DOMAIN",
     "# SSO redirect allow-list (bug 66f8e10a) — app origins for unified SSO.",
-    "GOTRUE_URI_ALLOW_LIST=https://crm.CHANGEME_DOMAIN,https://wiki.CHANGEME_DOMAIN,https://erp.CHANGEME_DOMAIN",
+    "GOTRUE_URI_ALLOW_LIST=https://crm.CHANGEME_DOMAIN,https://wiki.CHANGEME_DOMAIN,https://erp.CHANGEME_DOMAIN,https://dashboard.CHANGEME_DOMAIN,https://gateway.CHANGEME_DOMAIN",
     "# Bug 0327b017: parent-domain cookie → session shared across all subdomains.",
     "GOTRUE_COOKIE_DOMAIN=.CHANGEME_DOMAIN",
     "GOTRUE_COOKIE_KEY=exe-auth",
@@ -483,6 +554,21 @@ export function generateExampleEnv(): string {
     "SMTP_USER=",
     "SMTP_PASS=",
     "",
+    "# --- Dashboard (exe-dashboard — customer dashboard at dashboard.<domain>) ---",
+    "# OPT-IN: the exe-dashboard compose service sits behind `profiles: [dashboard]`",
+    "# and is off unless you run `docker compose --profile dashboard ...`.",
+    "# DELIBERATELY UNSET AND COMMENTED OUT. Unlike the older *_IMAGE_TAG lines",
+    "# above/below, this one carries no hardcoded literal: a pinned default here is",
+    "# a second source of truth that silently outranks the manifest the moment it",
+    "# goes stale. Take the value from the signed stack manifest",
+    "# (deploy/stack-manifests/v0.9.json -> services.dashboard.image), digest and all.",
+    "# Leave it unset and compose refuses the dashboard loudly (\"has neither an image",
+    "# nor a build context specified\") instead of booting something arbitrary.",
+    "#DASHBOARD_IMAGE_TAG=update.askexe.com/askexe/exe-dashboard:vX.Y.Z@sha256:...",
+    "# Host port for the dashboard container (bound to 127.0.0.1; the tunnel and the",
+    "# SSO edge reach it over the docker network, not this port).",
+    "#DASHBOARD_PORT=3301",
+    "",
     "# --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---",
     "# Bug 58840873: pin the auth image so compose never falls back to its stale",
     "# hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG. exe-auth",
@@ -502,6 +588,23 @@ export function generateExampleEnv(): string {
     "# the sign-up UI/route instead of showing a form that always fails.",
     "AUTH_DISABLE_SIGNUP=true",
     "",
+    "# --- Session cookie contract (exe-auth v0.6.0) \u2014 INFORMATIONAL, not settings ---",
+    "# Recorded here because operators reason about XSS blast radius from this file,",
+    "# and an earlier draft of these notes described the OPPOSITE of what ships.",
+    "# exe-auth performs the GoTrue token exchange server-side in njs and sets:",
+    "#   exe_sess          HttpOnly Secure SameSite=Lax  \u2014 the real access token",
+    "#   exe_sess_refresh  HttpOnly Secure SameSite=Lax  \u2014 the real refresh token",
+    "#   exe_access_token  JS-readable, value literally \"1\" \u2014 presence sentinel only",
+    "# All three are scoped to the apex (AUTH_COOKIE_DOMAIN) so they are shared",
+    "# across product subdomains.",
+    "#",
+    "# The credentials are HttpOnly ON PURPOSE (security bug 368bf916): page",
+    "# JavaScript CANNOT read them, so an XSS on any subdomain cannot exfiltrate a",
+    "# session token from document.cookie. The only JS-readable cookie is the",
+    "# sentinel, whose value is the constant \"1\" and is not a credential.",
+    "# Apps must NOT read a token from document.cookie \u2014 send credentialed",
+    "# same-site requests and let the HttpOnly cookie ride along.",
+    "",
     ...MANAGED_PERMS_ENV_BLOCK,
     "",
     "# --- CRM ---",
@@ -542,6 +645,11 @@ export function generateExampleEnv(): string {
     "",
     "# --- exe-os ---",
     `EXE_OS_IMAGE_TAG=${EXE_OS_IMAGE_TAG}`,
+    "",
+    "# Infra image pins — manifest-derived. Compose has no fallback default for",
+    "# these: a missing pin ABORTS the deploy instead of substituting an old image.",
+    `EXE_DB_IMAGE=${EXE_DB_IMAGE}`,
+    `OTEL_COLLECTOR_IMAGE=${OTEL_COLLECTOR_IMAGE}`,
     "EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN",
     "EXED_DEVICE_ID=vps-default",
     `EXE_MCP_HOST_BIND=${DEFAULT_EXE_MCP_HOST_BIND}`,

package/deploy/compose/sso-edge/default.conf.template

@@ -37,15 +37,86 @@ map $request_uri $sso_uri_access_token {
     "~[?&]access_token=(?<tok>[^&]+)" $tok;
 }
 
-# Extract the shared GoTrue session cookie (exe-auth, domain .${DOMAIN}) from
-# the Cookie header. Cross-app logout: GoTrue POST /logout clears this cookie
-# on the parent domain, so its absence signals a globally-revoked session.
-# The gate checks this alongside the app-native cookie — if the app cookie is
-# present but the GoTrue cookie is gone, the session was revoked on another app
-# and the edge forces re-auth (return 401 → login redirect).
+# Extract the shared apex SSO cookie from the Cookie header.
+#
+# THE COOKIE IS `exe_access_token` (bug 21ae2388). This map previously matched
+# `exe-auth` — a name NOTHING has ever set. That made the cross-app-logout arm
+# below fire on every single request, so any visitor holding a valid app-native
+# session was bounced back to auth forever. It is the FOURTH instance of one
+# recurring bug class: gating on a cookie name nothing mints. The first three
+# all gated on the retired `exe_sso_token` — exe-wiki f1bb40d8, exe-crm
+# 9f60e8e6, exe-erp 3938ac3d. See .github/workflows/sso-cookie-contract-monitor.yml.
+#
+# THE REAL CONTRACT (exe-auth v0.6.0, auth.njs.js setSessionCookies):
+#   exe_sess          HttpOnly Secure SameSite=Lax — the real access_token
+#   exe_sess_refresh  HttpOnly Secure SameSite=Lax — the real refresh_token
+#   exe_access_token  JS-readable, value literally "1" — presence sentinel
+# All three are scoped to the registrable apex (".${DOMAIN}") via
+# AUTH_COOKIE_DOMAIN, so they are presented across every product subdomain.
+# The two credentials are HttpOnly deliberately (security bug 368bf916) and are
+# therefore unusable as an edge signal; the sentinel is the one that is visible
+# here and is exactly what a presence gate needs.
+#
+# Cross-app logout: exe-auth's logout handler (clearSessionCookies) expires
+# exe_access_token on the apex, so its absence alongside a live app-native
+# cookie means the session was revoked on another app — the edge forces re-auth
+# (return 401 → login redirect).
+#
+# PRESENCE SIGNAL ONLY. The value is the literal "1", not a token. Never treat
+# it as a bearer credential and never forward it as one — the gate below tests
+# only whether it is empty. Token validation is step 3's GoTrue /user call.
 map $http_cookie $sso_gotrue_cookie {
     default "";
-    "~(?:^|;\s*)exe-auth=([^\s;]+)" $1;
+    "~(?:^|;\s*)exe_access_token=([^\s;]+)" $1;
+}
+
+# Static-asset exemption for the gate (see sso-redirect.conf step 0). Exempting
+# assets is required for the SPA to boot at all: the app sets its session cookie
+# only after its JS runs, so gating app.js hands a session-bearing document auth
+# HTML in place of its script -> blank page.
+#
+# MAPS OVER $request_uri, NOT $uri (bug 06a3daae). Same trap the token map
+# above documents: $sso_is_static is read inside the auth_request subrequest,
+# where $uri is the gate's own path `/_sso_gate` — never the original request
+# path — so an extension regex over $uri can never match and this exemption was
+# completely inert from the day it shipped. $request_uri IS inherited, but it
+# carries the query string, so the anchor admits `?`/`#` as well as end-of-
+# string — without that, /assets/app.js?v=abc would fall back into the gate.
+#
+# SCOPED BY PATH PREFIX, NOT BY BARE EXTENSION (P0 review of PR #874). A bare
+# extension test over $request_uri exempts ANY URL shaped like an asset, and the
+# app locations are catch-all proxies, so `/uploads/customer.png` and
+# `/api/export.js` would walk straight past the gate — the gate returns 204
+# before it ever looks at a cookie. The allow arms below are anchored at `^/`
+# on the build-output directories the SPAs actually boot from; everything else
+# — including every proxied application path — falls to `default ""` and stays
+# gated. This is now a path test AND an extension test, not a URL-shape test.
+#
+# nginx takes the FIRST matching regex in a map, so the deny arms are listed
+# first and win unconditionally over the allow arms.
+map $request_uri $sso_is_static {
+    default "";
+
+    # ── DENY (evaluated first, wins over everything below) ───────────────────
+    # Proxied application surface: API, user uploads and app-served files can
+    # never be exempt, whatever extension or query string they are dressed in.
+    "~*^/(?:api|uploads?|files|private|attachments|media|desk|app|method|admin)(?:[/?#]|$)" "";
+    # Traversal, raw or percent-encoded. $request_uri is the RAW request line:
+    # `/assets/../api/secret.js` is a prefix match here but normalizes to
+    # `/api/secret.js` before it reaches the app, so it must never be exempt.
+    "~\.\."   "";
+    "~*%2e"   "";
+    "~*%2f"   "";
+    "~*%5c"   "";
+
+    # ── ALLOW ────────────────────────────────────────────────────────────────
+    # Build-output directories only: Vite/Frappe `/assets/`, CRA/Twenty
+    # `/static/`, Next `/_next/static/`, Nuxt `/_nuxt/`, Vite-in-subdir
+    # `/build/assets/`. `[^?#]*` keeps the extension test on the PATH, so a
+    # query string can never supply the matching extension.
+    "~*^/(?:_next/static|_nuxt|assets|static|build/assets)/[^?#]*\.(?:js|mjs|css|map|png|jpe?g|gif|svg|ico|webp|woff2?|ttf)(?:[?#]|$)" "static";
+    # Root icons the browser requests on its own before any app code runs.
+    "~*^/(?:favicon\.(?:ico|svg|png)|apple-touch-icon(?:-precomposed)?\.png)(?:[?#]|$)" "static";
 }
 
 map $http_upgrade $sso_conn_upgrade {

package/deploy/compose/sso-edge/sso-redirect.conf

@@ -7,13 +7,17 @@
 # advertised "single front door" does not exist.
 #
 # ── How it works ────────────────────────────────────────────────────────────
-#  1. Every request runs the edge auth gate (auth_request → /_sso_gate).
+#  0. Static assets (JS/CSS/images/fonts, via the $sso_is_static map) are
+#     exempted from the gate and answered 204 — see step 0 inside /_sso_gate
+#     for why gating them deadlocks first page load.
+#  1. Every other request runs the edge auth gate (auth_request → /_sso_gate).
 #  2. If the app session cookie is present the request passes (the app validates
 #     its own session server-side — the cookie name differs per app; set it via
 #     $sso_session_cookie below). Cross-app logout: the edge also checks for the
-#     shared GoTrue cookie (exe-auth on .${DOMAIN}); if the app cookie is present
-#     but the GoTrue cookie is gone, the session was revoked on another app and
-#     the edge forces re-auth.
+#     shared apex SSO cookie `exe_access_token` (set on .${DOMAIN} by exe-auth's
+#     njs handlers — a NON-CREDENTIAL presence sentinel whose value is literally
+#     "1"); if the app cookie is present but that sentinel is gone, the session
+#     was revoked on another app and the edge forces re-auth.
 #  3. If the request carries ?access_token= (the SSO callback), the edge
 #     VALIDATES the token against the shared GoTrue (`GET /user` with
 #     `Authorization: Bearer <token>`) before letting it through. P0 bug
@@ -22,6 +26,8 @@
 #     trusted — only a token GoTrue accepts passes.
 #  4. Anything else 401s inside the gate and is 302-redirected to:
 #       https://auth.<domain>/?product=<App>&redirect=https://<app>.<domain><uri>
+#     A 403 from the GoTrue /user validation subrequest is mapped to the same
+#     login redirect, so it is never leaked raw to the browser.
 #  5. The gateway authenticates against the shared GoTrue and bounces the user
 #     back to the app URL with ?access_token=<jwt>&refresh_token=<...>. The app
 #     consumes the token and sets its session cookie — subsequent requests carry
@@ -31,7 +37,7 @@
 # These are templated values — replace before installing, or render with envsubst
 # (DOMAIN, APP_NAME, APP_SUBDOMAIN, APP_SESSION_COOKIE):
 #
-#   # TWO http-context declarations MUST exist once per nginx config (the
+#   # FOUR http-context declarations MUST exist once per nginx config (the
 #   # compose edge ships them in sso-edge/default.conf.template; host-nginx
 #   # installs add them next to their `include`s — see sso-redirect.README.md):
 #   #
@@ -45,6 +51,34 @@
 #       default "";
 #       "~[?&]access_token=(?<tok>[^&]+)" $tok;
 #   }
+#   # 3. The shared apex SSO cookie — the cross-app-logout signal. The name is
+#   #    `exe_access_token` (bug 21ae2388: this used to read a nonexistent
+#   #    `exe-auth`, which 401'd every authenticated request). Presence only —
+#   #    the value is the literal "1", never a bearer token:
+#   map $http_cookie $sso_gotrue_cookie {
+#       default "";
+#       "~(?:^|;\s*)exe_access_token=([^\s;]+)" $1;
+#   }
+#   # 4. The static-asset exemption (see step 0 inside /_sso_gate). Like #2
+#   #    this MUST map over $request_uri: inside the auth_request subrequest
+#   #    $uri is `/_sso_gate`, so a map over $uri never matches and the
+#   #    exemption is silently inert (bug 06a3daae). $request_uri includes the
+#   #    query string, hence the `[?#]` anchor instead of a bare `$`.
+#   #    It must ALSO be anchored to the build-output PATH PREFIXES: a bare
+#   #    extension test exempts any URL shaped like an asset, and since the app
+#   #    location is a catch-all proxy that hands `/uploads/customer.png` and
+#   #    `/api/export.js` straight past the gate. Deny arms come first because
+#   #    nginx takes the FIRST matching regex in a map:
+#   map $request_uri $sso_is_static {
+#       default "";
+#       "~*^/(?:api|uploads?|files|private|attachments|media|desk|app|method|admin)(?:[/?#]|$)" "";
+#       "~\.\."   "";
+#       "~*%2e"   "";
+#       "~*%2f"   "";
+#       "~*%5c"   "";
+#       "~*^/(?:_next/static|_nuxt|assets|static|build/assets)/[^?#]*\.(?:js|mjs|css|map|png|jpe?g|gif|svg|ico|webp|woff2?|ttf)(?:[?#]|$)" "static";
+#       "~*^/(?:favicon\.(?:ico|svg|png)|apple-touch-icon(?:-precomposed)?\.png)(?:[?#]|$)" "static";
+#   }
 #
 #   server {
 #     server_name crm.${DOMAIN};
@@ -70,9 +104,47 @@
 # are app-native sessions the edge cannot verify against GoTrue); each app fully
 # validates its own session server-side. The edge gate's job is the login funnel
 # plus never letting an unvalidated bearer token skip it (bug 462d3273).
-# Cross-app logout adds a GoTrue-cookie check: if the app-native cookie is present
-# but the shared GoTrue cookie is absent, the edge 401s — the session was revoked
-# on another app and the app-native cookie is stale.
+# Cross-app logout adds a sentinel-cookie check: if the app-native cookie is
+# present but the shared apex `exe_access_token` sentinel is absent, the edge
+# 401s — the session was revoked on another app and the app-native cookie is
+# stale. This is ALWAYS ON; it is the mechanism that makes "log out once, out
+# everywhere" real across crm/wiki/erp/dashboard.
+#
+# ── SCOPE OF THE STATIC-ASSET EXEMPTION ──────────────────────────────────────
+# Step 0 exempts a request from the gate BEFORE any cookie check, matching on
+# $request_uri (bug 06a3daae — $uri is `/_sso_gate` inside the subrequest).
+#
+# The exemption is scoped by PATH PREFIX **and** extension, never by extension
+# alone. An extension-only test is a pure URL-shape test, and because each app
+# location is a catch-all `proxy_pass`, it would hand `/uploads/customer.png`
+# or `/api/export.js` a 204 from the gate and proxy them to the app with no SSO
+# at all. Only these prefixes can ever be exempt:
+#
+#     /_next/static/   /_nuxt/   /assets/   /static/   /build/assets/
+#     /favicon.{ico,svg,png}   /apple-touch-icon[-precomposed].png
+#
+# and only when the PATH (not the query string) also ends in a known asset
+# extension. Deny arms listed FIRST in the map — nginx takes the first matching
+# regex — make it explicit that /api/, /uploads/, /files/, /private/, /media/,
+# /attachments/, /desk, /app, /method and /admin can NEVER be exempt whatever
+# their extension or query string, and reject traversal forms (`..`, %2e, %2f,
+# %5c) so a raw `/assets/../api/secret.js` cannot prefix-match here and then
+# normalize into the API before it reaches the app.
+#
+# What is still true of anything that IS exempt: it is a URL test, not a
+# content test. If an app serves user content out of one of those build-output
+# prefixes, that content is reachable unauthenticated at the edge. Two reasons
+# that is acceptable:
+#   1. Every app validates its own session server-side. The edge gate is the
+#      LOGIN FUNNEL, not the authorization boundary — an exempted request still
+#      reaches an app that will refuse to serve it to an unauthenticated user.
+#   2. Without the exemption the stack does not work at all: the SPA only sets
+#      its session cookie after its JS runs, so gating app.js returns auth HTML
+#      in place of the script and the app never boots (blank page).
+#
+# The limit of that reasoning: never serve private content from one of the
+# prefixes above, and do not rely on the edge gate for an app that does no
+# authorization of its own.
 # ─────────────────────────────────────────────────────────────────────────────
 
 # Run the gate for every request on this vhost. The gate is a zero-cost local
@@ -82,6 +154,11 @@
 # official nginx / nginx:alpine builds).
 auth_request /_sso_gate;
 error_page 401 = @sso_login;
+# A 403 from the gate's GoTrue /user validation must funnel to login too, not
+# leak raw to the browser. Safe: proxy_intercept_errors is not enabled on the
+# app proxy_pass blocks, so a genuine 403 from an upstream app is NOT converted
+# — only the auth_request subrequest's own status reaches this mapping.
+error_page 403 = @sso_login;
 
 location = /_sso_gate {
     internal;
@@ -93,12 +170,31 @@ location = /_sso_gate {
     # which auth_request rejects ("auth request unexpected status: 302").
     error_page 401 = @sso_gate_deny;
 
+    # 0. Static assets (JS/CSS/images/fonts via the $sso_is_static http-context
+    #    map) pass BEFORE any cookie check. Assets are non-sensitive — all SPA
+    #    data flows only via the authenticated APIs, which stay fully gated —
+    #    and gating them deadlocks first page load: the SPA sets its session
+    #    cookie only AFTER it boots, so answering app.js with the auth HTML
+    #    leaves a session-bearing document that can never boot (blank page).
+    #    See the SCOPE note in the header: the map is path-prefix scoped, so
+    #    only build-output directories can reach this 204 — /api/* and
+    #    /uploads/* stay gated no matter what extension they carry.
+    #    The map MUST be over $request_uri, not $uri: in here $uri is
+    #    `/_sso_gate`, so a $uri-based map never matches (bug 06a3daae).
+    if ($sso_is_static) {
+        return 204;
+    }
+
     # 1. App session cookie present → check for cross-app logout.
-    #    The GoTrue cookie (exe-auth, domain .${DOMAIN}) is shared across all
-    #    subdomains. GoTrue POST /logout clears it globally. If the app-native
-    #    cookie is present but the GoTrue cookie is gone, the session was
-    #    revoked on another app — force re-auth instead of trusting the stale
-    #    app cookie.
+    #    The shared apex cookie is `exe_access_token` (domain .${DOMAIN}), set
+    #    by exe-auth's njs login handler and expired by its logout handler. It
+    #    is a NON-CREDENTIAL presence sentinel — its value is literally "1", so
+    #    only its presence is meaningful and it is never used as a bearer token.
+    #    If the app-native cookie is present but the sentinel is gone, the
+    #    session was revoked on another app — force re-auth instead of trusting
+    #    the stale app cookie.
+    #    Bug 21ae2388: this arm matched a cookie named `exe-auth` that nothing
+    #    has ever minted, so it fired unconditionally and 401'd every request.
     set $sso_auth_check "";
     if ($sso_session_cookie) {
         set $sso_auth_check "app";

package/deploy/stack-manifests/v0.9.30-apps.json

@@ -52,7 +52,7 @@
           "env": "ERP_IMAGE_TAG",
           "composeService": "exe-erp",
           "healthUrl": "http://127.0.0.1:8069/api/method/ping",
-          "healthHost": "erp.askexe.com",
+          "healthHost": "${ERP_SITE_NAME:-erp.localhost}",
           "required": false,
           "category": "app",
           "description": "Enterprise Resource Planning"

package/deploy/stack-manifests/v0.9.json

@@ -2752,13 +2752,13 @@
           "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
         },
         "auth": {
-          "image": "update.askexe.com/askexe/exe-auth:v0.6.0@sha256:e615aec50a75706c23db1652d18bca5f1b68cc7e0fe3d92963b7ebbc7a834733",
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.1@sha256:89670a15bc59255299be695525863e66f949694eec1dd8886038dc3659a4a941",
           "env": "AUTH_IMAGE_TAG",
           "composeService": "exe-auth",
           "healthUrl": "http://127.0.0.1:3300/api/health",
           "category": "auth",
-          "description": "exe-auth v0.6.0 — GoTrue's admin API is no longer published on the public internet (nginx returns 404 for /api/admin|invite); query strings redacted from nginx access + error logs. First image verified by the armed G2 provenance gate.",
-          "gitSha": "0658b41bf9eae04b83cd4eecdf23eb1426b9e781"
+          "description": "exe-auth v0.6.1 — the v0.6.0 hardening (GoTrue admin API no longer public; nginx 404s /api/admin|invite; query strings redacted from access + error logs) PLUS the four fixes that merged after v0.6.0 was tagged and had never been built into any image (bug 9e054a59): /api/recover CORS + method restriction (0f9fbebe); a recovery link can no longer mint a session and link hashes are sent as token_hash (056abf8d, c9b62c91); the Secure cookie flag fails closed and HSTS is set (bb99ceda); the session token is kept out of upstream request lines, shape-checked, and a service_role JWT is refused (bff591fe). Verified inside this exact digest, not from a green badge.",
+          "gitSha": "633e7a4d9930aad8b0ce6783a1b3bc2f96b454a8"
         },
         "erp": {
           "image": "update.askexe.com/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b",
@@ -2809,6 +2809,6 @@
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "6ujWYOE1oXzshL8TxwgcKvZTubhCUyuoMxGAhqu84DgN3mBEG/R3psOlEv+GmqBmbD43D3ysyxIxHxG9alMzCw=="
+    "signature": "zJx3MxMUaco9bPRAPvmMs8qFXScuuAS9xWXSQBgtzKJB3ERe5aNvb+f6O39jWjxAvoPUQUObPjCuhwbu0aD8AQ=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-08-14T09:06:28.983Z",
-  "manifest_sha256": "80c62cd3f4b5f8ade7df79e58361f9eb10ae7d03c9aa2462c65dd9894ff73d07",
-  "package_version": "0.9.372"
+  "verified_at": "2026-08-20T18:51:08.214Z",
+  "manifest_sha256": "185d088d5d3a1b4d1f2d293248438af3df4498155f42a6f9cfc35521103d5b70",
+  "package_version": "0.9.374"
 }

package/dist/{active-agent-GRT5MKD5.js → active-agent-ONPPEWQV.js}

@@ -7,22 +7,23 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-KYFFVTGO.js";
-import "./chunk-2ADYTOHQ.js";
+} from "./chunk-55BEFF4V.js";
+import "./chunk-K4ESASPL.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-5DCCKHDY.js";
-import "./chunk-TKDITWDN.js";
+import "./chunk-TAMDAOCU.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-UTDMTQNH.js";
+import "./chunk-DSJI76XL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-QMSEL5YS.js";
+import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{active-agent-L2ZSSXDK.js → active-agent-UJKMG7LJ.js}

@@ -8,22 +8,23 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-KYFFVTGO.js";
-import "./chunk-2ADYTOHQ.js";
+} from "./chunk-55BEFF4V.js";
+import "./chunk-K4ESASPL.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-5DCCKHDY.js";
-import "./chunk-TKDITWDN.js";
+import "./chunk-TAMDAOCU.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-UTDMTQNH.js";
+import "./chunk-DSJI76XL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-QMSEL5YS.js";
+import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {