@askexenow/exe-os 0.9.376 → 0.9.377

package/deploy/compose/sso-edge/default.conf.template

@@ -113,6 +113,12 @@ server {
     location = /health  { auth_request off; proxy_pass http://sso_crm/healthz; }
     location = /healthz { auth_request off; proxy_pass http://sso_crm/healthz; }
 
+    # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2). Without this,
+    # /auth/logout triggers 401 -> redirect to auth with logout URL as redirect param
+    # -> infinite loop. Let the app handle logout (clear its own cookies), then it
+    # redirects to auth.askexe.com/logout for the central SSO cookie clear.
+    location = /auth/logout { auth_request off; proxy_pass http://sso_crm/auth/logout; }
+
     location / { proxy_pass http://sso_crm; }
 }
 
@@ -151,6 +157,9 @@ server {
     location = /health  { auth_request off; proxy_pass http://sso_wiki/api/ping; }
     location = /healthz { auth_request off; proxy_pass http://sso_wiki/api/ping; }
 
+    # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2).
+    location = /auth/logout { auth_request off; proxy_pass http://sso_wiki/auth/logout; }
+
     location / { proxy_pass http://sso_wiki; }
 }
 
@@ -178,7 +187,27 @@ server {
     set $sso_session_cookie $cookie_sid;              # Frappe/ERPNext session cookie
     include /etc/nginx/snippets/sso-redirect.conf;
 
-    location / { proxy_pass http://sso_erp; }
+    # ERP is the one upstream that runs a realtime socket.io service with
+    # origin authentication: frappe's realtime middleware compares the Host
+    # header against the Origin header and rejects mismatches ("Invalid
+    # origin"), and the websocket upgrade needs explicit HTTP/1.1 + Upgrade
+    # headers. A bare proxy_pass sends Host: exe-erp-nginx and no upgrade
+    # headers, so every desk socket.io connection is rejected and the desk
+    # shows "Error connecting to socket.io: Invalid origin" (found in the
+    # 2026-09-02 four-domain demo verification).
+    location / {
+        proxy_pass http://sso_erp;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        # Literal https, matching the template-level convention at the top of
+        # this file: this edge is reached via cloudflared over plain HTTP, so
+        # $scheme would report "http" for public HTTPS requests.
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 75s;
+    }
 }
 
 # ── Dashboard ────────────────────────────────────────────────────────────────
@@ -202,6 +231,9 @@ server {
     location = /health  { auth_request off; proxy_pass http://sso_dashboard/health; }
     location = /healthz { auth_request off; proxy_pass http://sso_dashboard/health; }
 
+    # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2).
+    location = /auth/logout { auth_request off; proxy_pass http://sso_dashboard/auth/logout; }
+
     location / { proxy_pass http://sso_dashboard; }
 }
 

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-02T09:40:41.834Z",
-  "manifest_sha256": "924d73f2e3e72e239a43abb555ac8a9f7f9ae48f93dc26a8d786f82af3bd0c29",
-  "package_version": "0.9.376"
+  "verified_at": "2026-09-02T16:27:58.480Z",
+  "manifest_sha256": "ece576114533d5eefd5825e465bb966df86e4e85d74e520fe6c9796f7f3d763f",
+  "package_version": "0.9.377"
 }

package/dist/build-manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "generated_at": "2026-09-02T09:40:41.714Z",
+  "generated_at": "2026-09-02T16:27:58.225Z",
   "files": [
     {
       "path": "active-agent-BOBBUJ74.js",
@@ -2464,7 +2464,7 @@
     },
     {
       "path": "hooks/manifest.json",
-      "sha256": "4ac8f0fc2ee9602262f21bf0e31caac32403b48cd52940f501f178a8b18b23e3",
+      "sha256": "aafff5a963888bc061f2b3ce1bdbedc27cc8097b090b0876624bdeb67e0bc28d",
       "bytes": 1841
     },
     {

package/dist/hooks/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-09-02T09:40:41.435Z",
+  "generatedAt": "2026-09-02T16:27:58.137Z",
   "hashes": {
     "bug-report-worker.js": "8191d9e9ad67127e44969bb4671d21f3ac603dcc8dd978960f1e50b215eac475",
     "codex-stop-task-finalizer.js": "1c7ebddd870afd357eeab64172a88163ea02957eff527a5e13c5dd24e2f1a678",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.376",
+  "version": "0.9.377",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/release-notes.json

@@ -1,14 +1,21 @@
 {
-  "current": "0.9.376",
+  "current": "0.9.377",
   "notes": {
-    "0.9.376": {
-      "version": "0.9.376",
+    "0.9.377": {
+      "version": "0.9.377",
       "date": "2026-09-02",
       "features": [],
-      "fixes": [],
+      "fixes": [
+        "fetch full history+tags in publish checkouts for the ref-provenance guard (#1029)",
+        "exempt /auth/logout from the SSO gate in crm/wiki/dashboard vhosts (bug 96f8b2b2) (#1027)",
+        "sso-edge erp vhost preserves Host + websocket upgrade headers (#1024)",
+        "refuse to push a tag stamped with a non-AskExe identity (#1021)"
+      ],
       "security": [],
       "other": [
-        "bump to v0.9.376 (#1022)"
+        "bump to v0.9.377 (#1031)",
+        "cross-arch builds use the docker driver (Rosetta), not bundled qemu (#1030)",
+        "migrate release/x64 lanes off build-my onto the local ci-linux VM (#1026)"
       ],
       "migration_notes": []
     },

package/stack.release.json

@@ -4,8 +4,8 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.376",
-  "image": "ghcr.io/askexe/exe-os:v0.9.376",
+  "version": "0.9.377",
+  "image": "ghcr.io/askexe/exe-os:v0.9.377",
   "imageEnv": "EXE_OS_IMAGE_TAG",
   "imageDigestTodo": "TODO(bug 32d6e02f), NARROWED by bug 81ca8903. The top-level `image` is tag-only BY CONSTRUCTION and that is correct: it names the tag the release run is about to build, whose digest does not exist until the push (see the 'Cross-check built digest against the manifest pin' step in .github/workflows/release-stack-image.yml). Demanding a digest here is unsatisfiable, which is why this TODO kept surviving. The one genuinely resolvable case it also covered — components.erp, built in a DIFFERENT repo and therefore already sitting in the registry — is now resolved and digest-pinned below. What remains open is ONLY components.dashboard, and not for the reason this TODO claimed: ghcr.io/askexe/exe-dashboard:v0.9.372 DOES NOT EXIST. .github/workflows/release-dashboard-image.yml has produced exactly one run in its lifetime (id 32405074431, 2026-08-20, tag v0.9.374) and that run FAILED, so the dashboard release lane has never emitted a single v* tag — the only refs in ghcr.io/askexe/exe-dashboard are the floating :main and :sha-<sha> dev refs from dashboard-image.yml. The dashboard pin is therefore a PHANTOM, not an unresolved digest, and it is deliberately left tag-only here rather than silently repointed at a :main digest, because choosing which dashboard bytes constitute a release is a release decision, not a lint fix. FAIL-CLOSED still holds and is enforced where it bites: scripts/publish-stack-release.mjs verifyServicePin() refuses to publish any tag-only app image into the customer manifest.",
   "components": {
@@ -16,7 +16,7 @@
       "note": "Bug 81ca8903: was `ghcr.io/askexe/exe-erp:v0.9.312` — a tag that has never existed. ERP is versioned on its own 0.x line; v0.9.312 is an EXE-OS version number that bumpVersions() stamped onto this component because rebaseImageTag() rebased every tag-only component image to the exe-os release version regardless of which repo built it. That rebase is now scoped (same commit) so it can no longer forge tags for independently-versioned components. Repinned to the real, current ERP release v0.3.4, digest resolved live from ghcr.io/askexe/exe-erp on 2026-09-01. Digest-pinning is also what makes this entry self-defending: rebaseImageTag() returns any `@sha256:`-bearing ref untouched. Prior intent for the record (bug 790794e8) was v0.2.0-final8, the first ERP image shipping the realtime/socketio entrypoint (exe-erp PR #15); final3/final7 crash-looped exe-erp-websocket on a missing socketio.js. v0.3.4 supersedes it."
     },
     "dashboard": {
-      "image": "ghcr.io/askexe/exe-dashboard:v0.9.376",
+      "image": "ghcr.io/askexe/exe-dashboard:v0.9.377",
       "env": "DASHBOARD_IMAGE_TAG",
       "composeService": "exe-dashboard",
       "versionLockstep": true,
@@ -110,5 +110,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.376"
+  "sourceVersion": "0.9.377"
 }