@askexenow/exe-os 0.9.380 → 0.9.381

package/deploy/compose/.env.example

@@ -98,7 +98,7 @@ SMTP_PASS=
 # Bug 58840873: pin the auth image so compose never falls back to its stale
 # hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG. exe-auth
 # ships only from the private update.askexe.com registry (no GHCR mirror).
-AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.1@sha256:89670a15bc59255299be695525863e66f949694eec1dd8886038dc3659a4a941
+AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.5@sha256:dc8c1476ef1247079a6e115450bd35681712fa06367461589998ecf943f88089
 # Bug 379e5c13: server_name / CORS derived from the CONFIGURED apex domain,
 # not by naive last-2-label slicing (which breaks company.co.uk → co.uk).
 AUTH_SERVER_NAME=auth.CHANGEME_DOMAIN
@@ -171,7 +171,7 @@ EXE_CRM_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.28@sha256:61856a4c6b97ce62c62ecdc3a377139287be5860eb807d9fbb737115758d7856
+WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.33@sha256:1f9e04a557c6034e0eac85ecdf76d465eab88394614184387ecf06cd2281e7d8
 # Bug 2a8d3003 — DO NOT change this without migrating the data first.
 # The wiki's users / workspaces / workspace_documents live in `public`. Point it at a
 # different schema and Prisma will NOT error: it finds no tables, assumes a fresh

package/deploy/compose/generate-env.ts

@@ -873,8 +873,63 @@ function normalizeClientName(clientName: string): string {
     .replace(/^-|-$/g, "") || "client";
 }
 
-function joinEnvLines(lines: string[]): string {
-  return `${lines.join("\n")}\n`;
+// Bug 5dc66955: a multi-word value (e.g. an SSH public key —
+// "ssh-ed25519 AAAA... comment") written to .env WITHOUT quoting breaks every
+// shell consumer that does `set -a; . /opt/exe-stack/.env`. The shell parses
+// the first whitespace-delimited token as VAR=first-word, then tries to RUN
+// the second token as a command:
+//   /opt/exe-stack/.env: line N: AAAAC3NzaC1lZDI1NTE5...: command not found
+// Under `set -e` that aborts the whole source mid-file, leaving every var
+// after the bad line unset while the script believes the environment loaded.
+// Docker Compose's own env_file parser tolerates bare multi-word values (it
+// reads to end-of-line, not to the first space), which is exactly why this
+// class of bug goes unnoticed — only shell consumers break, and nothing here
+// exercises that path.
+//
+// INVESTIGATED: this generator does NOT currently emit that SSH-key line —
+// grepped every value it writes (deploy/compose/generate-env.ts,
+// .env.example, .env.customer.example) and none holds an SSH key or any
+// other value containing a space; ssh_public_key lives only in the Ansible
+// role (deploy/ansible/group_vars/all.yml), which is a wholly separate write
+// path that never touches this file. So /opt/exe-stack/.env line 38 was
+// hand-edited on the host — that repair is NOT made here, on purpose (an
+// operator-maintained host file is not something to guess at from the repo).
+//
+// Quoting is applied ONLY to values that actually need it (contain
+// whitespace), not blanket-applied to every line. Several deploy scripts
+// read specific .env values with `grep '^VAR=' .env | cut -d= -f2-`
+// (deploy/upgrade.sh, deploy/compose/{setup,backup}.sh,
+// deploy/host/exe-db-jkt/*) — those return the literal text after `=`,
+// quote characters included, so blanket-quoting every existing token/URL/key
+// value would silently inject stray `'` characters into every one of those
+// currently-unquoted, single-word values. Every value this generator emits
+// today is single-word (verified: no `=` line here contains a space), so
+// conditional quoting changes NOTHING for any value produced today — it only
+// activates for the next multi-word value someone adds, which is exactly the
+// pattern this bug is about (and which would already be broken for
+// `set -a; .` sourcing, quoted or not, if left bare).
+function quoteEnvValue(value: string): string {
+  // Single-quote: no escape-sequence interpretation to worry about (unlike
+  // double quotes), just the standard shell trick for an embedded quote —
+  // close the quote, emit an escaped one, reopen it.
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+const ENV_ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
+const NEEDS_QUOTING = /[ \t]/;
+
+function quoteEnvLine(line: string): string {
+  const match = ENV_ASSIGNMENT.exec(line);
+  if (!match) return line; // comments, blank lines, section headers — untouched
+  const [, key, value] = match;
+  if (!NEEDS_QUOTING.test(value)) return line; // no whitespace — nothing to break, leave bare
+  const alreadyQuoted = /^'.*'$|^".*"$/.test(value);
+  if (alreadyQuoted) return line;
+  return `${key}=${quoteEnvValue(value)}`;
+}
+
+export function joinEnvLines(lines: string[]): string {
+  return `${lines.map(quoteEnvLine).join("\n")}\n`;
 }
 
 function printUsage(): void {

package/deploy/compose/sso-edge/default.conf.template

@@ -16,18 +16,38 @@
 #   in the entrypoint so envsubst leaves them untouched.
 # ─────────────────────────────────────────────────────────────────────────────
 
-upstream sso_crm  { server exe-crm:3000; }
-upstream sso_wiki { server exe-wiki:3001; }
-upstream sso_auth { server exe-auth:80; }
+# Backend hostnames (bug 94a6a19a — see the resolver note below for why these
+# are no longer `upstream {}` blocks).
+#
 # ERP must be reached through its own nginx (gunicorn can't serve /assets/ — bug 6776edf0)
-upstream sso_erp  { server exe-erp-nginx:80; }
+#
 # Dashboard — must be on the same docker network as exe-sso-edge.
 # If the dashboard uses a separate compose (dashboard-page/docker-compose.yml),
 # ensure it joins exe-os_backend or exe-os_frontend (not the legacy exe-net).
-upstream sso_dashboard { server exe-dashboard:80; }
+#
 # Shared GoTrue — the sso-redirect snippet's /_sso_gate validates ?access_token=
-# against GET /user here instead of trusting its presence (P0 bug 462d3273).
-upstream sso_gotrue { server gotrue:9999; }
+# / the Bearer header against GET /user here instead of trusting presence
+# alone (P0 bug 462d3273, bug cc40e9ea).
+#
+# STALE-IP FIX (bug 94a6a19a): these used to be static `upstream sso_X {
+# server host:port; }` blocks. An nginx `upstream` block resolves its
+# `server` hostnames ONCE, at config load (container start or `nginx -s
+# reload`), and then proxies to that cached IP forever — Docker's embedded
+# DNS (127.0.0.11) is never consulted again. When a backend container is
+# recreated (redeploy, `docker compose up -d <service>`, OOM restart, ...) it
+# gets a new IP; the edge keeps sending traffic to the dead old one and every
+# request 502s until someone reloads/restarts THIS container too, which is
+# not otherwise required for a backend-only change.
+#
+# Fix: no `upstream` block, plus an explicit `resolver` pointed at Docker's
+# embedded DNS with a short TTL, plus a `set $x_upstream host:port;` in each
+# server block. Putting the hostname in a variable is what makes nginx defer
+# resolution to REQUEST time instead of config-load time — a static
+# `proxy_pass http://exe-crm:3000;` with no variable is just as stale as the
+# upstream block was. `valid=10s` bounds how long a dead IP can keep being
+# used after a recreate to one DNS TTL, without hammering the embedded
+# resolver on every request.
+resolver 127.0.0.11 valid=10s ipv6=off;
 
 # Extract the SSO callback token from the request line (P0 bug 462d3273).
 # The gate's auth_request subrequest does not inherit the query string, but it
@@ -37,6 +57,22 @@ map $request_uri $sso_uri_access_token {
     "~[?&]access_token=(?<tok>[^&]+)" $tok;
 }
 
+# Extract a Developer API bearer token from `Authorization: Bearer <token>`
+# (bug cc40e9ea). auth_request DOES inherit request headers (unlike the query
+# string above), so the subrequest reads this directly off $http_authorization.
+# Anchored to require the `Bearer` scheme (case-insensitive) and at least one
+# non-whitespace token character; a missing header, an empty/whitespace-only
+# token, or any other scheme (Basic, Digest, a bare garbage string) all miss
+# every arm and resolve to the map's `default ""` below — presence of the
+# header alone can never satisfy this map. The extracted value is still only a
+# CANDIDATE credential: sso-redirect.conf's /_sso_gate validates it against
+# GoTrue /user in step 3 exactly like every other bearer source, so a
+# well-formed-but-invalid token is rejected there, not trusted here.
+map $http_authorization $sso_header_bearer {
+    default "";
+    "~*^Bearer\s+(?<tok>\S.*)$" $tok;
+}
+
 # Extract the shared apex SSO cookie from the Cookie header.
 #
 # THE COOKIE IS `exe_access_token` (bug 21ae2388). This map previously matched
@@ -105,21 +141,33 @@ server {
     set $sso_app_url        "https://crm.${DOMAIN}";
     set $sso_product        "CRM";
     set $sso_session_cookie $cookie_tokenPair;        # Twenty/CRM session cookie
+    # Re-resolved per request via the file-level `resolver` (bug 94a6a19a) —
+    # see the note above the old upstream blocks.
+    set $crm_upstream    exe-crm:3000;
+    set $gotrue_upstream gotrue:9999;                 # used by sso-redirect.conf's /_sso_gate
     include /etc/nginx/snippets/sso-redirect.conf;
 
     # Bug d3ba1136: public monitors hit /health as well as /healthz. Keep both
     # exact paths outside the SSO gate and proxy them to CRM's real health
     # endpoint so they never fall through to the app shell HTML.
-    location = /health  { auth_request off; proxy_pass http://sso_crm/healthz; }
-    location = /healthz { auth_request off; proxy_pass http://sso_crm/healthz; }
+    location = /health  { auth_request off; proxy_pass http://$crm_upstream/healthz; }
+    location = /healthz { auth_request off; proxy_pass http://$crm_upstream/healthz; }
 
     # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2). Without this,
     # /auth/logout triggers 401 -> redirect to auth with logout URL as redirect param
     # -> infinite loop. Let the app handle logout (clear its own cookies), then it
     # redirects to auth.askexe.com/logout for the central SSO cookie clear.
-    location = /auth/logout { auth_request off; proxy_pass http://sso_crm/auth/logout; }
-
-    location / { proxy_pass http://sso_crm; }
+    location = /auth/logout { auth_request off; proxy_pass http://$crm_upstream/auth/logout; }
+
+    # No URI after $crm_upstream (bug 94a6a19a): nginx's location-prefix
+    # substitution (the thing a *static* `proxy_pass http://host/path;` relies
+    # on) is only computed for a literal, config-time-known target. The moment
+    # the host is a variable, that substitution is undefined, so the directive
+    # must be written exactly as it was before (bare host, no trailing path) —
+    # nginx then falls back to its other documented behavior for "proxy_pass
+    # without URI": forward $request_uri unchanged. That is the exact routing
+    # this location already had; only the DNS timing changed.
+    location / { proxy_pass http://$crm_upstream; }
 }
 
 # ── Wiki ─────────────────────────────────────────────────────────────────────
@@ -149,18 +197,21 @@ server {
     # If exe-wiki ever mints a real server-side session cookie, set that name
     # here — never the sentinel.
     set $sso_session_cookie "";
+    set $wiki_upstream   exe-wiki:3001;                # re-resolved per request (bug 94a6a19a)
+    set $gotrue_upstream gotrue:9999;                   # used by sso-redirect.conf's /_sso_gate
     include /etc/nginx/snippets/sso-redirect.conf;
 
     # Bug d3ba1136: wiki's actual health probe is /api/ping. Expose the standard
     # monitor aliases as exact, ungated health routes so /health cannot return
     # a false-healthy SPA HTML page.
-    location = /health  { auth_request off; proxy_pass http://sso_wiki/api/ping; }
-    location = /healthz { auth_request off; proxy_pass http://sso_wiki/api/ping; }
+    location = /health  { auth_request off; proxy_pass http://$wiki_upstream/api/ping; }
+    location = /healthz { auth_request off; proxy_pass http://$wiki_upstream/api/ping; }
 
     # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2).
-    location = /auth/logout { auth_request off; proxy_pass http://sso_wiki/auth/logout; }
+    location = /auth/logout { auth_request off; proxy_pass http://$wiki_upstream/auth/logout; }
 
-    location / { proxy_pass http://sso_wiki; }
+    # No URI after $wiki_upstream — see the CRM vhost's comment above (bug 94a6a19a).
+    location / { proxy_pass http://$wiki_upstream; }
 }
 
 # ── Auth ─────────────────────────────────────────────────────────────────────
@@ -168,12 +219,17 @@ server {
     listen 80;
     server_name auth.${DOMAIN};
 
+    # Re-resolved per request via the file-level `resolver` (bug 94a6a19a).
+    set $gotrue_upstream gotrue:9999;
+    set $auth_upstream   exe-auth:80;
+
     # Route auth.<domain> through this edge too, so exact health aliases can
     # probe GoTrue instead of the auth SPA's nginx fallback.
-    location = /health  { proxy_pass http://sso_gotrue/health; }
-    location = /healthz { proxy_pass http://sso_gotrue/health; }
+    location = /health  { proxy_pass http://$gotrue_upstream/health; }
+    location = /healthz { proxy_pass http://$gotrue_upstream/health; }
 
-    location / { proxy_pass http://sso_auth; }
+    # No URI after $auth_upstream — see the CRM vhost's comment (bug 94a6a19a).
+    location / { proxy_pass http://$auth_upstream; }
 }
 
 # ── ERP ──────────────────────────────────────────────────────────────────────
@@ -185,6 +241,9 @@ server {
     set $sso_app_url        "https://erp.${DOMAIN}";
     set $sso_product        "ERP";
     set $sso_session_cookie $cookie_sid;              # Frappe/ERPNext session cookie
+    # Re-resolved per request via the file-level `resolver` (bug 94a6a19a).
+    set $erp_upstream    exe-erp-nginx:80;
+    set $gotrue_upstream gotrue:9999;                  # used by sso-redirect.conf's /_sso_gate
     include /etc/nginx/snippets/sso-redirect.conf;
 
     # ERP is the one upstream that runs a realtime socket.io service with
@@ -195,8 +254,10 @@ server {
     # headers, so every desk socket.io connection is rejected and the desk
     # shows "Error connecting to socket.io: Invalid origin" (found in the
     # 2026-09-02 four-domain demo verification).
+    #
+    # No URI after $erp_upstream — see the CRM vhost's comment (bug 94a6a19a).
     location / {
-        proxy_pass http://sso_erp;
+        proxy_pass http://$erp_upstream;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         # Literal https, matching the template-level convention at the top of
@@ -226,15 +287,18 @@ server {
     # app-native session cookie to name instead, so leave this empty and let
     # steps 2-3 validate the apex `exe_sess` cookie against GoTrue.
     set $sso_session_cookie "";
+    set $dashboard_upstream exe-dashboard:80;          # re-resolved per request (bug 94a6a19a)
+    set $gotrue_upstream    gotrue:9999;                # used by sso-redirect.conf's /_sso_gate
     include /etc/nginx/snippets/sso-redirect.conf;
 
-    location = /health  { auth_request off; proxy_pass http://sso_dashboard/health; }
-    location = /healthz { auth_request off; proxy_pass http://sso_dashboard/health; }
+    location = /health  { auth_request off; proxy_pass http://$dashboard_upstream/health; }
+    location = /healthz { auth_request off; proxy_pass http://$dashboard_upstream/health; }
 
     # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2).
-    location = /auth/logout { auth_request off; proxy_pass http://sso_dashboard/auth/logout; }
+    location = /auth/logout { auth_request off; proxy_pass http://$dashboard_upstream/auth/logout; }
 
-    location / { proxy_pass http://sso_dashboard; }
+    # No URI after $dashboard_upstream — see the CRM vhost's comment (bug 94a6a19a).
+    location / { proxy_pass http://$dashboard_upstream; }
 }
 
 # Default — unknown host or edge-generated error → branded shared error pages

package/deploy/compose/sso-edge/sso-redirect.conf

@@ -38,13 +38,18 @@
 # These are templated values — replace before installing, or render with envsubst
 # (DOMAIN, APP_NAME, APP_SUBDOMAIN, APP_SESSION_COOKIE):
 #
-#   # THREE http-context declarations MUST exist once per nginx config (the
-#   # compose edge ships them in sso-edge/default.conf.template; host-nginx
-#   # installs add them next to their `include`s — see sso-redirect.README.md):
+#   FOUR http-context declarations MUST exist once per nginx config (the
+#   compose edge ships them in sso-edge/default.conf.template; host-nginx
+#   installs add them next to their `include`s — see sso-redirect.README.md):
 #   #
-#   # 1. The shared GoTrue upstream the gate validates tokens against
-#   #    (compose: `server gotrue:9999`; host nginx: the published port):
-#   upstream sso_gotrue { server 127.0.0.1:9999; }
+#   # 1. A resolver + a per-server $gotrue_upstream variable the gate
+#   #    validates tokens against (bug 94a6a19a: a static `upstream sso_gotrue
+#   #    { server ...; }` block resolves its hostname ONCE at config load and
+#   #    never re-resolves it, so it goes stale — and 502s — the moment the
+#   #    GoTrue container is recreated with a new IP):
+#   resolver 127.0.0.11 valid=10s ipv6=off;      # Docker embedded DNS (host nginx: your resolver)
+#   # ... then inside EACH server block that includes this snippet:
+#   #     set $gotrue_upstream gotrue:9999;      # compose: container name; host nginx: 127.0.0.1:9999
 #   # 2. The callback-token extractor. The auth_request subrequest does not
 #   #    inherit the query string, but it DOES inherit $request_uri, so the
 #   #    token is mapped from it:
@@ -52,7 +57,16 @@
 #       default "";
 #       "~[?&]access_token=(?<tok>[^&]+)" $tok;
 #   }
-#   # 3. The shared apex SSO cookie — the cross-app-logout signal. The name is
+#   # 3. The Developer API bearer-header extractor (bug cc40e9ea) — a
+#   #    well-formed `Authorization: Bearer <token>` request must be read at
+#   #    the edge or a programmatic client always falls through to a 401 ->
+#   #    HTML login redirect. Extraction only; step 3 below still validates
+#   #    whatever this pulls out against GoTrue before trusting it:
+#   map $http_authorization $sso_header_bearer {
+#       default "";
+#       "~*^Bearer\s+(?<tok>\S.*)$" $tok;
+#   }
+#   # 4. The shared apex SSO cookie — the cross-app-logout signal. The name is
 #   #    `exe_access_token` (bug 21ae2388: this used to read a nonexistent
 #   #    `exe-auth`, which 401'd every authenticated request). Presence only —
 #   #    the value is the literal "1", never a bearer token:
@@ -227,7 +241,30 @@ location = /_sso_gate {
     #    Precedence keeps the callback param first purely for backward
     #    compatibility with any older auth build still mid-rollout; it is still
     #    validated, never trusted on presence (bug 462d3273 stays fixed).
+    #
+    #    Bug cc40e9ea: an `Authorization: Bearer <token>` request — the
+    #    Developer API pattern — was never inspected at all (nothing here read
+    #    $http_authorization), so a programmatic client always fell through to
+    #    "no credential" and got a 401 -> HTML login redirect for what should
+    #    have been an API response. $sso_header_bearer (map on $http_authorization,
+    #    defined alongside the other gate maps) extracts the token ONLY when the
+    #    header is a well-formed `Bearer <token>`; a missing header, a header
+    #    with no scheme, an empty/whitespace-only token, or a non-Bearer scheme
+    #    (e.g. Basic) all fail the map and leave this "" — they fall through to
+    #    the cookie arm exactly like today, never satisfying the gate on
+    #    presence alone. Whatever token IS extracted is still just a candidate:
+    #    it flows into the same step 3 GoTrue /user validation as every other
+    #    source below, so a well-formed-but-bogus Bearer value is rejected
+    #    there, not trusted here. This is chosen over exempting an /api/v1/*
+    #    path prefix (rejected: a path exemption widens the unauthenticated
+    #    surface to anything ever served under that prefix, present or future;
+    #    a header check narrows to a single well-formed credential shape and
+    #    still funnels through the existing validation, so it cannot become a
+    #    bypass on its own).
     set $sso_bearer $sso_uri_access_token;
+    if ($sso_bearer = "") {
+        set $sso_bearer $sso_header_bearer;
+    }
     if ($sso_bearer = "") {
         set $sso_bearer $cookie_exe_sess;
     }
@@ -246,7 +283,10 @@ location = /_sso_gate {
     #    server-side exchange of the apex `exe_sess` cookie for its own session
     #    (exe-wiki / exe-erp / exe-crm, bug d0652644 and related) — the edge is
     #    the login funnel, not the authorization boundary, exactly as before.
-    proxy_pass http://sso_gotrue/user;
+    # $gotrue_upstream is set by every including server block (bug 94a6a19a —
+    # re-resolved per request via the file-level `resolver`, not a static
+    # upstream{} cached at config load).
+    proxy_pass http://$gotrue_upstream/user;
     proxy_pass_request_body off;
     proxy_set_header Content-Length "";
     proxy_set_header Authorization "Bearer $sso_bearer";

package/deploy/stack-manifests/v0.9.json

@@ -2721,11 +2721,13 @@
           "category": "app"
         },
         "wiki": {
-          "image": "update.askexe.com/askexe/exe-wiki:v0.9.28@sha256:61856a4c6b97ce62c62ecdc3a377139287be5860eb807d9fbb737115758d7856",
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.33@sha256:1f9e04a557c6034e0eac85ecdf76d465eab88394614184387ecf06cd2281e7d8",
           "env": "WIKI_IMAGE_TAG",
           "composeService": "exe-wiki",
           "healthUrl": "http://127.0.0.1:3001/api/ping",
-          "category": "app"
+          "category": "app",
+          "description": "exe-wiki v0.9.33 — typography unified onto the shared @askexenow/exe-theme tokens. plus-jakarta-sans removed repo-wide, and a latent bug fixed: font-headline was defined in Tailwind but no rule ever applied it, so h1-h6 had silently inherited the body font and wiki headings had never once rendered in Epilogue. Also dark first paint before stylesheets load, so switching between CRM, wiki and ERP no longer flashes white.",
+          "gitSha": "3f35bd9c52543987e2ebaec9e5876cc6c6fd8f3a"
         },
         "gateway": {
           "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
@@ -2752,13 +2754,13 @@
           "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
         },
         "auth": {
-          "image": "update.askexe.com/askexe/exe-auth:v0.6.1@sha256:89670a15bc59255299be695525863e66f949694eec1dd8886038dc3659a4a941",
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.5@sha256:dc8c1476ef1247079a6e115450bd35681712fa06367461589998ecf943f88089",
           "env": "AUTH_IMAGE_TAG",
           "composeService": "exe-auth",
           "healthUrl": "http://127.0.0.1:3300/api/health",
           "category": "auth",
-          "description": "exe-auth v0.6.1 — the v0.6.0 hardening (GoTrue admin API no longer public; nginx 404s /api/admin|invite; query strings redacted from access + error logs) PLUS the four fixes that merged after v0.6.0 was tagged and had never been built into any image (bug 9e054a59): /api/recover CORS + method restriction (0f9fbebe); a recovery link can no longer mint a session and link hashes are sent as token_hash (056abf8d, c9b62c91); the Secure cookie flag fails closed and HSTS is set (bb99ceda); the session token is kept out of upstream request lines, shape-checked, and a service_role JWT is refused (bff591fe). Verified inside this exact digest, not from a green badge.",
-          "gitSha": "633e7a4d9930aad8b0ce6783a1b3bc2f96b454a8"
+          "description": "exe-auth v0.6.5 — an already-authenticated user switching between ERP, wiki and CRM no longer sees the login page flash. The session is now validated SERVER-SIDE before any login markup is sent, so an authenticated request gets a bare 302 (bug 910ff2a5). A forged exe_access_token sentinel still receives the login page, so this is not an auth bypass. Also strips the leading dot from AUTH_COOKIE_DOMAIN (bug ee4b831d).",
+          "gitSha": "e119d1fa1fd08f2faf951f9998fe33393cf8b258"
         },
         "erp": {
           "image": "update.askexe.com/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b",
@@ -2809,6 +2811,6 @@
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "zJx3MxMUaco9bPRAPvmMs8qFXScuuAS9xWXSQBgtzKJB3ERe5aNvb+f6O39jWjxAvoPUQUObPjCuhwbu0aD8AQ=="
+    "signature": "UAQm9FB5Ai8KaBSGe6LEkBfXZ3XtBFT/5/8DozCK1v7f8llD33AhrAF11HEttf33z3w/weWhxZEXG3yGIWw/Dg=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-07T16:50:49.001Z",
-  "manifest_sha256": "27bcfdc27713439f36c09113cba1c029e503a2cdbfba354f02fcc898bcf54982",
-  "package_version": "0.9.380"
+  "verified_at": "2026-09-08T02:19:11.078Z",
+  "manifest_sha256": "b55b6c21dd560116c3ce9ca67bbfc648b6a910b0bed064e64b9f36e13576ea74",
+  "package_version": "0.9.381"
 }

package/dist/{active-agent-2JP4PR6N.js → active-agent-GE6HDADY.js}

@@ -8,15 +8,15 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-PMS7CQJD.js";
+} from "./chunk-TKTEFYPH.js";
 import "./chunk-K4ESASPL.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-UYOIKBBL.js";
+import "./chunk-MAOKR5AL.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-RE5GF2NF.js";
+import "./chunk-GODDBYPL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";

package/dist/{active-agent-PM6IXYLO.js → active-agent-GZ6O7KKS.js}

@@ -7,15 +7,15 @@ import {
   resolveAgentAttribution,
   resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-PMS7CQJD.js";
+} from "./chunk-TKTEFYPH.js";
 import "./chunk-K4ESASPL.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-UYOIKBBL.js";
+import "./chunk-MAOKR5AL.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-RE5GF2NF.js";
+import "./chunk-GODDBYPL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";

package/dist/{agent-defs-generator-HH4Q5KY4.js → agent-defs-generator-3VHBN56U.js}

@@ -5,11 +5,11 @@ import "./chunk-AM7S2TY6.js";
 import {
   loadEmployeesSync,
   validateEmployeeName
-} from "./chunk-UYOIKBBL.js";
+} from "./chunk-MAOKR5AL.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-RE5GF2NF.js";
+import "./chunk-GODDBYPL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";

package/dist/{agentic-ontology-OB6ZJQOJ.js → agentic-ontology-6X5Z5QPD.js}

@@ -10,7 +10,7 @@ import {
   insertOntologyForMemory,
   ontologyPayload,
   stableId
-} from "./chunk-2PL5IC7K.js";
+} from "./chunk-4G5MWV7O.js";
 import "./chunk-MLKGABMK.js";
 export {
   ONTOLOGY_YIELD_EVERY,

package/dist/{backfill-metadata-Y5JOMDH5.js → backfill-metadata-4NI4MZEE.js}

@@ -2,11 +2,11 @@
 import {
   disposeStore,
   initStore
-} from "./chunk-EFCSQEGP.js";
-import "./chunk-OYDB7EPN.js";
+} from "./chunk-OKLZXKO6.js";
+import "./chunk-TYAM2ROO.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-PJ4SNSDY.js";
+import "./chunk-SFUNP5Q6.js";
 import "./chunk-5MOYSU5A.js";
 import "./chunk-5QCIWWFA.js";
 import "./chunk-76CJBM36.js";
@@ -15,11 +15,11 @@ import {
   getClient,
   getEmployeeNamesByRole,
   loadEmployeesSync
-} from "./chunk-UYOIKBBL.js";
+} from "./chunk-MAOKR5AL.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-RE5GF2NF.js";
+import "./chunk-GODDBYPL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";

package/dist/{backup-verify-TS5AHG4F.js → backup-verify-7UQ5PXRZ.js}

@@ -4,7 +4,7 @@ import {
 import {
   getLatestBackup,
   reasonFromBackupName
-} from "./chunk-RE5GF2NF.js";
+} from "./chunk-GODDBYPL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";

package/dist/{behavior-injection-QU5ZDYCP.js → behavior-injection-LZSLBWIF.js}

@@ -19,19 +19,19 @@ import {
   selectInjectedBehaviors,
   selectRelevantBehaviors,
   selectRelevantBehaviorsWithReasons
-} from "./chunk-PB6I2JCZ.js";
-import "./chunk-NZPNGCRU.js";
+} from "./chunk-CSAK5WHK.js";
+import "./chunk-VMEZNP7H.js";
 import "./chunk-QV5CQLQH.js";
 import "./chunk-QGGH7LOU.js";
-import "./chunk-EFCSQEGP.js";
-import "./chunk-OYDB7EPN.js";
+import "./chunk-OKLZXKO6.js";
+import "./chunk-TYAM2ROO.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-PJ4SNSDY.js";
+import "./chunk-SFUNP5Q6.js";
 import "./chunk-5MOYSU5A.js";
 import "./chunk-5QCIWWFA.js";
 import "./chunk-76CJBM36.js";
-import "./chunk-UPLHE5JH.js";
+import "./chunk-WATC3K3F.js";
 import "./chunk-ZKJ5S23O.js";
 import "./chunk-GPUOUUHA.js";
 import "./chunk-BTSWFMEH.js";
@@ -41,11 +41,11 @@ import "./chunk-NLEW62VC.js";
 import "./chunk-GPJIBLP4.js";
 import "./chunk-V3WLC5TJ.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-UYOIKBBL.js";
+import "./chunk-MAOKR5AL.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-RE5GF2NF.js";
+import "./chunk-GODDBYPL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";

package/dist/{behavior-promotion-XZ3EGXZX.js → behavior-promotion-7IZKCZFC.js}

@@ -9,15 +9,15 @@ import {
   listPromotionCandidates,
   promoteBehaviorToIdentity,
   promotedRulesDropped
-} from "./chunk-LIU53YDQ.js";
-import "./chunk-NZPNGCRU.js";
+} from "./chunk-CURJYC3V.js";
+import "./chunk-VMEZNP7H.js";
 import "./chunk-QV5CQLQH.js";
 import "./chunk-QGGH7LOU.js";
-import "./chunk-EFCSQEGP.js";
-import "./chunk-OYDB7EPN.js";
+import "./chunk-OKLZXKO6.js";
+import "./chunk-TYAM2ROO.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-PJ4SNSDY.js";
+import "./chunk-SFUNP5Q6.js";
 import "./chunk-5MOYSU5A.js";
 import "./chunk-5QCIWWFA.js";
 import "./chunk-76CJBM36.js";
@@ -30,11 +30,11 @@ import "./chunk-NLEW62VC.js";
 import "./chunk-GPJIBLP4.js";
 import "./chunk-V3WLC5TJ.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-UYOIKBBL.js";
+import "./chunk-MAOKR5AL.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-RE5GF2NF.js";
+import "./chunk-GODDBYPL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";