@askexenow/exe-os 0.9.382 → 0.9.384

package/deploy/compose/.env.customer.example

@@ -69,7 +69,7 @@ SMTP_PASS=
 # --- Auth gateway (exe-auth — shared SSO sign-in UI at auth.<domain>) ---
 # Bug 58840873: pin the auth image so compose never falls back to its stale
 # hardcoded default tag. Keep in sync with the manifest AUTH_IMAGE_TAG.
-AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.1@sha256:89670a15bc59255299be695525863e66f949694eec1dd8886038dc3659a4a941
+AUTH_IMAGE_TAG=update.askexe.com/askexe/exe-auth:v0.6.5@sha256:dc8c1476ef1247079a6e115450bd35681712fa06367461589998ecf943f88089
 # Bug 379e5c13: server_name / CORS from the CONFIGURED apex domain, not by naive
 # last-2-label slicing (which breaks company.co.uk → co.uk).
 AUTH_SERVER_NAME=auth.CHANGEME_DOMAIN
@@ -124,7 +124,7 @@ EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 
 # --- CRM ---
-CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8
+CRM_IMAGE_TAG=update.askexe.com/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 # The CRM's first admin — seeded at boot by WorkspaceBootstrapService, which is
@@ -138,7 +138,7 @@ EXE_CRM_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.28@sha256:61856a4c6b97ce62c62ecdc3a377139287be5860eb807d9fbb737115758d7856
+WIKI_IMAGE_TAG=update.askexe.com/askexe/exe-wiki:v0.9.33@sha256:1f9e04a557c6034e0eac85ecdf76d465eab88394614184387ecf06cd2281e7d8
 # Bug 2a8d3003 — DO NOT change this without migrating the data first.
 # The wiki's users / workspaces / workspace_documents live in `public`. Point it at a
 # different schema and Prisma will NOT error: it finds no tables, assumes a fresh
@@ -176,7 +176,7 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa
+EXE_OS_IMAGE_TAG=update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=CHANGEME_DEVICE_ID
 EXE_MCP_HOST_BIND=127.0.0.1
@@ -186,7 +186,7 @@ EXE_MCP_HOST_PORT=48739
 EXE_CLOUD_SYNC_TO_POSTGRES=true
 
 # --- ERP (Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b
+ERP_IMAGE_TAG=update.askexe.com/askexe/exe-erp:v0.3.11@sha256:5888b3e9d4ff309f37052dbdcac1fda66e235dbecb186a9ccf69380576e7b363
 # Administrator password for the ERPNext site (created on first boot).
 # bug 43854b31: this only applies at FIRST boot. To rotate it later you must also
 # run `bench --site $ERP_SITE_NAME set-admin-password <new>` inside exe-erp —

package/deploy/compose/.env.example

@@ -158,7 +158,7 @@ EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 
 # --- CRM ---
-CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8
+CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.59@sha256:40619dce57540f86dc7c8b71f1da57f44600a288f75a28850a9a9b425d0b92a6
 CRM_SERVER_URL=https://crm.CHANGEME_DOMAIN
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
 EXE_CRM_ADMIN_TOKEN=CHANGEME_EXE_CRM_ADMIN_TOKEN
@@ -209,7 +209,7 @@ WIKI_HOST_PORT=3001
 EXE_SSO_COOKIE_NAME=exe_access_token
 
 # --- exe-os ---
-EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa
+EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6
 
 # Infra image pins — manifest-derived. Compose has no fallback default for
 # these: a missing pin ABORTS the deploy instead of substituting an old image.
@@ -264,7 +264,7 @@ ERROR_REPORTING_ENABLED=true
 MONITOR_ERROR_URL=http://exe-monitor-hub:8090/api/exe-monitor/errors
 
 # --- ERP (optional — Exe ERP, Frappe/ERPNext fork) ---
-ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b
+ERP_IMAGE_TAG=ghcr.io/askexe/exe-erp:v0.3.11@sha256:5888b3e9d4ff309f37052dbdcac1fda66e235dbecb186a9ccf69380576e7b363
 ERP_ADMIN_PASSWORD=CHANGEME_ERP_ADMIN_PASSWORD
 EXE_ERP_ADMIN_TOKEN=CHANGEME_EXE_ERP_ADMIN_TOKEN
 # Frappe site name — must match the erp.<domain> the customer serves (bug e61ad373).

package/deploy/compose/docker-compose.yml

@@ -764,7 +764,7 @@ services:
       # overridden back to exeOsMcp — see bug c604df37 above before doing that;
       # the spawn args below currently point at the wrong CLI entrypoint.
       EXE_OS_MCP_COMMAND: ${WIKI_EXE_OS_MCP_COMMAND:-npx}
-      EXE_OS_MCP_ARGS: ${WIKI_EXE_OS_MCP_ARGS:--y @askexenow/exe-os@${WIKI_EXE_OS_NPM_VERSION:-0.9.324} mcp}
+      EXE_OS_MCP_ARGS: ${WIKI_EXE_OS_MCP_ARGS:--y @askexenow/exe-os@${WIKI_EXE_OS_NPM_VERSION:-0.9.382} mcp}
       BRANDING_CONFIG_PATH: /app/branding.json
     ports:
       - "127.0.0.1:${WIKI_HOST_PORT:-3001}:3001"

package/deploy/compose/generate-env.ts

@@ -1,5 +1,6 @@
 import { randomBytes } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 // ---------------------------------------------------------------------------
 // IMAGE PINS — DERIVED FROM THE SIGNED MANIFEST. NEVER HAND-TYPED.
 //
@@ -26,7 +27,52 @@ const REGISTRY = "ghcr.io/askexe";
 // own registry constant rather than reusing REGISTRY (bug 58840873).
 const AUTH_REGISTRY = "update.askexe.com/askexe";
 
-const MANIFEST_PATH = new URL("../stack-manifests/v0.9.json", import.meta.url);
+// Bug cff0de47: the manifest used to be resolved as ONE path relative to this
+// module's own file (`../stack-manifests/v0.9.json`). The documented VPS install
+// copies `deploy/compose/*` into /opt/exe-stack WITHOUT its sibling
+// `deploy/stack-manifests/`, so the relocated generator looked for
+// /opt/stack-manifests/v0.9.json — a directory nobody ever creates — and died at
+// MODULE INITIALIZATION before generating a single line of configuration.
+//
+// Resolution is now an ordered search over EXPLICIT, configurable locations, so
+// relocating this file cannot break it:
+//   1. $EXE_STACK_MANIFEST            — explicit override (setup.sh exports it)
+//   2. <this dir>/stack-manifests/…   — manifest copied ALONGSIDE the compose files
+//   3. <this dir>/../stack-manifests/…— in-repo / in-package layout
+// A failure names every location searched instead of one phantom path.
+const MANIFEST_FILENAME = "v0.9.json";
+const MANIFEST_PATH_ENV_VAR = "EXE_STACK_MANIFEST";
+
+export function manifestSearchPaths(
+  env: NodeJS.ProcessEnv = process.env,
+  moduleUrl: string = import.meta.url,
+): string[] {
+  const paths: string[] = [];
+  const override = (env[MANIFEST_PATH_ENV_VAR] ?? "").trim();
+  if (override) paths.push(override);
+  paths.push(fileURLToPath(new URL(`./stack-manifests/${MANIFEST_FILENAME}`, moduleUrl)));
+  paths.push(fileURLToPath(new URL(`../stack-manifests/${MANIFEST_FILENAME}`, moduleUrl)));
+  return paths;
+}
+
+export function resolveManifestPath(
+  env: NodeJS.ProcessEnv = process.env,
+  moduleUrl: string = import.meta.url,
+  exists: (p: string) => boolean = existsSync,
+): string {
+  const candidates = manifestSearchPaths(env, moduleUrl);
+  for (const candidate of candidates) {
+    if (exists(candidate)) return candidate;
+  }
+  throw new Error(
+    `generate-env: the signed stack manifest (${MANIFEST_FILENAME}) was not found. Searched:\n` +
+      candidates.map((c) => `  - ${c}`).join("\n") +
+      `\nThe manifest is the single source of truth for every image pin, so generation cannot ` +
+      `continue without it. Copy deploy/stack-manifests/ next to these compose files, or set ` +
+      `${MANIFEST_PATH_ENV_VAR}=/path/to/${MANIFEST_FILENAME}. ` +
+      `This is NOT a node/tsx problem.`,
+  );
+}
 
 type ManifestFile = {
   latest: string;
@@ -34,11 +80,12 @@ type ManifestFile = {
 };
 
 function loadManifestServices(): Record<string, { image?: string }> {
-  const manifest = JSON.parse(readFileSync(MANIFEST_PATH, "utf8")) as ManifestFile;
+  const manifestPath = resolveManifestPath();
+  const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as ManifestFile;
   const services = manifest.stacks?.[manifest.latest]?.services;
   if (!services) {
     throw new Error(
-      `generate-env: stack manifest ${MANIFEST_PATH.pathname} has no services for latest="${manifest.latest}". ` +
+      `generate-env: stack manifest ${manifestPath} has no services for latest="${manifest.latest}". ` +
         `Refusing to generate a .env with no pins — that is exactly the silent-substitution failure ` +
         `the manifest-as-single-source-of-truth change exists to prevent.`,
     );
@@ -192,9 +239,18 @@ export interface GenerateEnvOptions {
    * a fresh deploy and the checked-in .env.example are unchanged.
    */
   disableSignup?: boolean;
+  /**
+   * The CRM's first administrator (bug cff0de47). When supplied it is written
+   * straight into EXE_CRM_ADMIN_EMAIL instead of the CHANGEME_ADMIN_EMAIL placeholder, so the documented first-run path produces
+   * a .env that the deploy gate accepts. It is still never GUESSED — no
+   * admin@<domain> default — because it must be a real mailbox that also exists
+   * in GoTrue.
+   */
+  adminEmail?: string;
 }
 
 export function generateEnv(options: GenerateEnvOptions): string {
+  const adminEmail = (options.adminEmail ?? "").trim();
   const normalizedDomain = normalizeDomain(options.domain);
   const normalizedClientName = normalizeClientName(options.clientName);
   const gatewayWsAuthToken = randomSecret(RANDOM_SECRET_48);
@@ -318,8 +374,8 @@ export function generateEnv(options: GenerateEnvOptions): string {
     // refused (e51ca54c §10.6b). It cannot be generated — it must be a real
     // mailbox that also exists in GoTrue — so it ships as SET_MANUALLY rather
     // than as a random secret or a guessed admin@<domain>.
-    MANUAL_VALUE_COMMENT,
-    "EXE_CRM_ADMIN_EMAIL=CHANGEME_ADMIN_EMAIL",
+    ...(adminEmail ? [] : [MANUAL_VALUE_COMMENT]),
+    `EXE_CRM_ADMIN_EMAIL=${adminEmail || "CHANGEME_ADMIN_EMAIL"}`,
     `CRM_HOST_PORT=${CRM_HOST_PORT}`,
     "",
     "# --- Wiki ---",
@@ -935,7 +991,7 @@ export function joinEnvLines(lines: string[]): string {
 function printUsage(): void {
   process.stderr.write(
     "Usage:\n" +
-      "  npx tsx deploy/compose/generate-env.ts <client-name> <domain> [license-key]\n" +
+      "  npx tsx deploy/compose/generate-env.ts <client-name> <domain> [license-key] [admin-email]\n" +
       "  npx tsx deploy/compose/generate-env.ts --example\n",
   );
 }
@@ -957,13 +1013,13 @@ function main(): void {
     return;
   }
 
-  const [clientName, domain, licenseKey] = args;
+  const [clientName, domain, licenseKey, adminEmail] = args;
   if (!clientName || !domain) {
     printUsage();
     process.exit(1);
   }
 
-  process.stdout.write(generateEnv({ clientName, domain, licenseKey }));
+  process.stdout.write(generateEnv({ clientName, domain, licenseKey, adminEmail }));
 }
 
 if (isCliInvocation()) {

package/deploy/compose/setup.sh

@@ -14,17 +14,106 @@ info() { echo -e "${GREEN}[setup]${NC} $1"; }
 warn() { echo -e "${YELLOW}[setup]${NC} $1"; }
 err() { echo -e "${RED}[setup]${NC} $1" >&2; }
 
+# Read one KEY from .env, empty if absent. Used to decide whether a RE-RUN
+# already has the configuration this run did not pass on the command line.
+get_env_var() {
+  [[ -f .env ]] || { echo ""; return 0; }
+  local raw
+  raw=$(grep -E "^$1=" .env 2>/dev/null | head -n1 | cut -d= -f2- || true)
+  # set_env_var writes dotenv DOUBLE-QUOTED values, so undo that quoting here —
+  # otherwise a re-run compares `"true"` against `true` and takes the wrong
+  # branch. Values written by generate-env.ts are unquoted and pass through.
+  if [[ ${#raw} -ge 2 && "$raw" == '"'*'"' ]]; then
+    local bs='\' dq='"' dollar='$'
+    raw="${raw:1:${#raw}-2}"
+    raw="${raw//$dollar$dollar/$dollar}"
+    raw="${raw//"$bs$dq"/$dq}"
+    raw="${raw//"$bs$bs"/$bs}"
+  fi
+  printf '%s\n' "$raw"
+}
+
+# Set (or append) one KEY=VALUE in .env WITHOUT echoing the value. sed cannot be
+# used safely here: secrets contain /, & and = which are sed metacharacters.
+#
+# COMPOSE INTERPOLATES .env VALUES, so a `$` written raw is not a `$`. An SMTP
+# password of `abc$TOKEN` is read by Compose as the variable TOKEN and becomes
+# `abc` — the credential is silently changed, email verification and password
+# reset stop working, and nothing in the stack reports a wrong password as
+# anything but a failed login. Measured:
+#
+#   .env: SMTP_PASS=abc$TOKEN   -> docker compose config -> P: abc
+#   .env: SMTP_PASS=abc$$TOKEN  -> docker compose config -> P: abc$$TOKEN
+#
+# (`docker compose config` re-escapes a literal `$` as `$$` on output, which is
+# how the second line reads back as the intended `abc$TOKEN`.)
+#
+# ESCAPING `$` IS NOT ENOUGH: an UNQUOTED value also loses everything from the
+# first `#`, and its surrounding whitespace. Measured the same way:
+#
+#   .env: SMTP_PASS=abc #def    -> docker compose config -> P: abc
+#   .env: SMTP_PASS="abc #def"  -> docker compose config -> P: abc #def
+#
+# So values are written dotenv DOUBLE-QUOTED, with `\`, `"` and `$` escaped.
+# These are literal secrets and hostnames, never expressions — nothing here is
+# meant to interpolate. get_env_var() undoes exactly this quoting.
+set_env_var() {
+  local key="$1" value="$2"
+  # The replacement side of ${var//x/y} IS expanded, so a literal `$$` written
+  # there becomes the shell's PID — `abc$TOKEN` came out as `abc87319TOKEN`.
+  # Going through a variable whose value is a single `$` keeps both characters
+  # literal, because an expansion's RESULT is not expanded again.
+  local dollar='$' bs='\' dq='"'
+  # The PATTERN side is quoted: an unquoted `$bs` is a lone backslash, which the
+  # pattern matcher reads as an escape character and matches nothing, so `a\b`
+  # went out unescaped and Compose read `\b` as a BACKSPACE byte.
+  value="${value//"$bs"/$bs$bs}"   # backslash first: it escapes the rest
+  value="${value//$dq/$bs$dq}"
+  value="${value//$dollar/$dollar$dollar}"
+  value="$dq$value$dq"
+  SEV_KEY="$key" SEV_VALUE="$value" awk '
+    $0 ~ "^" ENVIRON["SEV_KEY"] "=" { print ENVIRON["SEV_KEY"] "=" ENVIRON["SEV_VALUE"]; found=1; next }
+    { print }
+    END { if (!found) print ENVIRON["SEV_KEY"] "=" ENVIRON["SEV_VALUE"] }
+  ' .env > .env.setenv.tmp && mv .env.setenv.tmp .env
+  chmod 600 .env 2>/dev/null || true
+}
+
 # Parse args
-CLIENT="" DOMAIN="" LICENSE=""
+CLIENT="" DOMAIN="" LICENSE="" ADMIN_EMAIL="" TUNNEL_TOKEN=""
+SMTP_HOST="" SMTP_PORT="" SMTP_USER="" SMTP_PASS="" NO_EMAIL="no"
 while [[ $# -gt 0 ]]; do
   case $1 in
     --client) CLIENT="$2"; shift 2;;
     --domain) DOMAIN="$2"; shift 2;;
     --license) LICENSE="$2"; shift 2;;
+    --admin-email) ADMIN_EMAIL="$2"; shift 2;;
+    --tunnel-token) TUNNEL_TOKEN="$2"; shift 2;;
+    --smtp-host) SMTP_HOST="$2"; shift 2;;
+    --smtp-port) SMTP_PORT="$2"; shift 2;;
+    --smtp-user) SMTP_USER="$2"; shift 2;;
+    --smtp-pass) SMTP_PASS="$2"; shift 2;;
+    --no-email) NO_EMAIL="yes"; shift 1;;
     *) err "Unknown arg: $1"; exit 1;;
   esac
 done
-[[ -z "$CLIENT" || -z "$DOMAIN" ]] && { err "Usage: ./setup.sh --client <name> --domain <domain>"; exit 1; }
+[[ -z "$CLIENT" || -z "$DOMAIN" ]] && { err "Usage: ./setup.sh --client <name> --domain <domain> --admin-email <you@your-domain> [--tunnel-token <token>] [--smtp-host <host> --smtp-user <user> --smtp-pass <pass> | --no-email] [--license <key>]"; exit 1; }
+# bug cff0de47: the CRM seeds its FIRST workspace owner from EXE_CRM_ADMIN_EMAIL.
+# Without it the CRM boots healthy with no workspace and no user, and the first
+# sign-in is refused with no way in. Ask for it here rather than deploying a
+# stack nobody can log into (preflight refuses it either way).
+if [[ -z "$ADMIN_EMAIL" ]]; then
+  if [[ -t 0 ]]; then
+    read -r -p "  Admin email (owns the CRM/wiki; must be a real mailbox): " ADMIN_EMAIL
+  fi
+fi
+if [[ -z "$ADMIN_EMAIL" ]]; then
+  err "--admin-email is required. It becomes EXE_CRM_ADMIN_EMAIL: the mailbox that"
+  err "owns this stack. The CRM seeds its first workspace for exactly this address;"
+  err "without it the CRM comes up healthy but empty and NOBODY can sign in."
+  err "  ./setup.sh --client $CLIENT --domain $DOMAIN --admin-email you@$DOMAIN${LICENSE:+ --license $LICENSE}"
+  exit 1
+fi
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 cd "$SCRIPT_DIR"
@@ -59,13 +148,44 @@ else
   # so any failure of the generator silently deployed ancient images that bypass
   # the manifest's digest-pinning entirely. There is NO safe inline fallback for
   # image tags — fail loudly instead and let the operator install node/npx.
+  # Bug cff0de47: generate-env.ts reads the SIGNED STACK MANIFEST at module
+  # initialization. The documented install copies deploy/compose/* into
+  # /opt/exe-stack without its sibling deploy/stack-manifests/, so the generator
+  # died on a manifest path that exists only inside the npm package — and the
+  # error below blamed node/tsx, sending the operator to debug the wrong thing.
+  # Locate the manifest explicitly and hand the generator its path.
+  if [[ -z "${EXE_STACK_MANIFEST:-}" ]]; then
+    for candidate in \
+      "$SCRIPT_DIR/stack-manifests/v0.9.json" \
+      "$SCRIPT_DIR/../stack-manifests/v0.9.json" \
+      "$(npm root -g 2>/dev/null)/@askexenow/exe-os/deploy/stack-manifests/v0.9.json"; do
+      if [[ -f "$candidate" ]]; then EXE_STACK_MANIFEST="$candidate"; break; fi
+    done
+  fi
+  if [[ -z "${EXE_STACK_MANIFEST:-}" || ! -f "${EXE_STACK_MANIFEST}" ]]; then
+    err "Stack manifest v0.9.json not found. Searched:"
+    err "  - \$EXE_STACK_MANIFEST (${EXE_STACK_MANIFEST:-unset})"
+    err "  - $SCRIPT_DIR/stack-manifests/v0.9.json"
+    err "  - $SCRIPT_DIR/../stack-manifests/v0.9.json"
+    err "  - \$(npm root -g)/@askexenow/exe-os/deploy/stack-manifests/v0.9.json"
+    err ""
+    err "The manifest is the single source of truth for every image pin, so .env"
+    err "cannot be generated without it. This is NOT a node/tsx problem."
+    err "Fix: run 'exe-os stack-init --dir $SCRIPT_DIR' (it copies the compose files"
+    err "AND the manifest), or set EXE_STACK_MANIFEST=/path/to/v0.9.json."
+    exit 1
+  fi
+  info "Using stack manifest: $EXE_STACK_MANIFEST"
+  export EXE_STACK_MANIFEST
   if command -v node >/dev/null 2>&1 && command -v npx >/dev/null 2>&1; then
     # Run via npx tsx (the project is pure ESM — require() is forbidden).
-    if ! npx --yes tsx "$SCRIPT_DIR/generate-env.ts" "$CLIENT" "$DOMAIN" "${LICENSE:-}" > .env 2>/tmp/exe-generate-env.err; then
+    if ! npx --yes tsx "$SCRIPT_DIR/generate-env.ts" "$CLIENT" "$DOMAIN" "${LICENSE:-}" "$ADMIN_EMAIL" > .env 2>/tmp/exe-generate-env.err; then
       rm -f .env
       err "generate-env.ts failed — refusing to write a .env with stale fallback image tags."
       err "Generator error:"; cat /tmp/exe-generate-env.err >&2 || true
-      err "Fix node/tsx and re-run setup.sh (the inline fallback was removed: bug 716c0f6e)."
+      err "If the error above is about a missing manifest, see EXE_STACK_MANIFEST"
+      err "(currently: $EXE_STACK_MANIFEST). Otherwise fix node/tsx and re-run"
+      err "setup.sh (the inline fallback was removed: bug 716c0f6e)."
       exit 1
     fi
   else
@@ -80,6 +200,79 @@ else
   info ".env generated with auto-generated secrets (chmod 600)"
 fi
 
+# Step 2a: Cloudflare tunnel token.
+#
+# bug cff0de47: the gated deploy at the end of this script REFUSES to run
+# without a tunnel token (the cloudflared service has no compose profile gate,
+# so a stack without a token has no public ingress). The customer guide used to
+# hand the token over in a LATER step than the one that runs this script, so the
+# documented order could never complete on a fresh machine. Take it here.
+if [[ -n "$TUNNEL_TOKEN" ]]; then
+  set_env_var CLOUDFLARE_TUNNEL_TOKEN "$TUNNEL_TOKEN"
+  info "Cloudflare tunnel token written to .env"
+else
+  warn "No --tunnel-token given. The deploy step below REQUIRES CLOUDFLARE_TUNNEL_TOKEN"
+  warn "in .env (Zero Trust > Networks > Tunnels > your tunnel > install token)."
+  warn "Set it and re-run this script, or re-run with --tunnel-token <token>."
+fi
+
+# Step 2a-ii: Email delivery.
+#
+# bug cff0de47: a freshly generated .env ships SMTP_HOST empty and
+# GOTRUE_MAILER_AUTOCONFIRM=false, and the deploy preflight REFUSES that
+# combination — password-reset and email-verification would silently never
+# send. Every fresh install hit it, and the customer guide never mentioned
+# email at all. Ask for it here rather than deploying a stack whose recovery
+# flow is dead, or record the operator's explicit decision to run without email.
+if [[ "$NO_EMAIL" == "yes" ]]; then
+  set_env_var GOTRUE_MAILER_AUTOCONFIRM "true"
+  warn "Email flows DISABLED (--no-email): GOTRUE_MAILER_AUTOCONFIRM=true."
+  warn "Sign-ups are auto-confirmed and there is NO password-reset email."
+  warn "Signup stays disabled (invite-only), so this does not open registration."
+elif [[ -n "$SMTP_HOST" ]]; then
+  set_env_var SMTP_HOST "$SMTP_HOST"
+  if [[ -n "$SMTP_PORT" ]]; then set_env_var SMTP_PORT "$SMTP_PORT"; fi
+  if [[ -n "$SMTP_USER" ]]; then set_env_var SMTP_USER "$SMTP_USER"; fi
+  if [[ -n "$SMTP_PASS" ]]; then set_env_var SMTP_PASS "$SMTP_PASS"; fi
+  # GOTRUE_MAILER_AUTOCONFIRM IS DERIVED FROM THE MAILER DECISION, not left at
+  # whatever a previous run wrote. Switching a `--no-email` install to SMTP used
+  # to leave AUTOCONFIRM=true behind: setup announced that verification would
+  # send while GoTrue kept auto-confirming every account without ever proving
+  # the mailbox belonged to the person signing up — and preflight's smtp_recovery
+  # check short-circuits on AUTOCONFIRM=true, so nothing downstream said
+  # otherwise. Each branch here writes the flag its own decision implies.
+  # (codex on PR #1152)
+  set_env_var GOTRUE_MAILER_AUTOCONFIRM "false"
+  info "SMTP configured ($SMTP_HOST) — email verification and password reset will send."
+elif [[ -n "$(get_env_var SMTP_HOST)" ]]; then
+  # A RE-RUN IS NOT A FRESH INSTALL. This script is documented as re-runnable —
+  # the customer guide's own tunnel-token retry re-invokes it — and demanding
+  # the email flags again on every invocation made that retry fail on a stack
+  # that was already configured correctly. Judge the EFFECTIVE configuration in
+  # .env, not the flags of this particular run. (codex on PR #1152)
+  info "SMTP already configured in .env ($(get_env_var SMTP_HOST)) — keeping it."
+  if [[ "$(get_env_var GOTRUE_MAILER_AUTOCONFIRM)" == "true" ]]; then
+    # No decision was made THIS run, so this is reported, not silently flipped:
+    # SMTP + AUTOCONFIRM=true can be deliberate on an invite-only stack.
+    warn "...but GOTRUE_MAILER_AUTOCONFIRM=true, so accounts are auto-confirmed"
+    warn "WITHOUT verifying the mailbox. Re-run with --smtp-host to enforce"
+    warn "verification, or set GOTRUE_MAILER_AUTOCONFIRM=false in .env."
+  fi
+elif [[ "$(get_env_var GOTRUE_MAILER_AUTOCONFIRM)" == "true" ]]; then
+  warn "Email flows already DISABLED in .env (GOTRUE_MAILER_AUTOCONFIRM=true) — keeping that choice."
+  warn "Sign-ups are auto-confirmed and there is NO password-reset email."
+else
+  err "No email delivery configured. A stack with SMTP_HOST empty and"
+  err "GOTRUE_MAILER_AUTOCONFIRM=false cannot send password-reset or"
+  err "email-verification messages, and the deploy gate refuses it."
+  err ""
+  err "Either supply SMTP credentials:"
+  err "  --smtp-host smtp.example.com --smtp-port 587 --smtp-user <user> --smtp-pass <pass>"
+  err "or run without email flows (sign-ups auto-confirmed, no password reset):"
+  err "  --no-email"
+  exit 1
+fi
+
 # Step 2b: Host-access consent for the monitor agent.
 #
 # exe-monitor-agent reports fleet health to the monitoring hub, but to do so it
@@ -235,7 +428,7 @@ fi
 
 if [[ -n "$EXE_CLI" ]]; then
   info "Step 4+5: Deploying via '$EXE_CLI stack-update' (preflight + proxy auth + health-gated rollout + rollback)..."
-  if ! "$EXE_CLI" stack-update --yes; then
+  if ! "$EXE_CLI" stack-update --yes --domain "$DOMAIN" --admin-email "$ADMIN_EMAIL"; then
     err "stack-update failed — the gated deploy refused or rolled back. Review the"
     err "output above. Do NOT bypass with raw 'docker compose up' — fix the cause"
     err "(preflight RED, image pull, or health failure) and re-run setup.sh."
@@ -249,7 +442,7 @@ else
   err ""
   err "Install the CLI and re-run setup.sh:"
   err "  npm install -g exe-os"
-  err "  ./setup.sh --client $CLIENT --domain $DOMAIN${LICENSE:+ --license $LICENSE}"
+  err "  ./setup.sh --client $CLIENT --domain $DOMAIN --admin-email $ADMIN_EMAIL${LICENSE:+ --license $LICENSE}"
   exit 1
 fi
 
@@ -259,7 +452,12 @@ docker ps --format 'table {{.Names}}\t{{.Status}}'
 echo ""
 info "Stack deployed! Next steps:"
 echo "  1. Configure Cloudflare tunnel (if not done)"
-echo "  2. Open https://crm.${DOMAIN} to create admin account"
+# bug cff0de47: this used to say "to create admin account". GoTrue signup is OFF
+# by default (invite-only), so there is no account to create in the CRM UI — the
+# admin is SEEDED from EXE_CRM_ADMIN_EMAIL and must also be created in GoTrue.
+echo "  2. Create the GoTrue user for ${ADMIN_EMAIL} (signup is DISABLED by default —"
+echo "     see CUSTOMER-GUIDE.md 'Create Your Admin Account'), then sign in at"
+echo "     https://crm.${DOMAIN}"
 echo "  3. Open https://wiki.${DOMAIN} to set up wiki"
 echo "  4. Configure WhatsApp: edit gateway.json, restart gateway, pair at https://gateway.${DOMAIN}/pair/<name>"
 echo "  5. Verify: curl https://crm.${DOMAIN}/healthz && curl https://wiki.${DOMAIN}/api/ping"

package/deploy/compose/sso-edge/default.conf.template

@@ -153,6 +153,24 @@ server {
     location = /health  { auth_request off; proxy_pass http://$crm_upstream/healthz; }
     location = /healthz { auth_request off; proxy_pass http://$crm_upstream/healthz; }
 
+    # G5 served-freshness (bug 529f45cf). See the doctrine note in
+    # sso-redirect.conf: an ungated path is granted EXPLICITLY, by exact match,
+    # never by a wildcard. Without this the watchdog's GET /__version was caught
+    # by the gate and 302'd to the auth login page, so the probe read auth's
+    # HTML and could not distinguish "wrong version" from "gated" from "down" —
+    # the served-freshness axis was unreadable for every SSO-gated surface.
+    #
+    # WHY UNAUTHENTICATED, DELIBERATELY: the response is a git sha/ref/repo and
+    # a build time, all of which the signed stack manifest already publishes
+    # unauthenticated at update.askexe.com/v1/stack-manifest.json. It leaks
+    # nothing the fleet does not already state publicly. The alternative —
+    # teaching the watchdog to hold an SSO session per surface — would put a
+    # live credential in a nightly job, widen its blast radius across five
+    # hosts, and make credential expiry look identical to real drift. A monitor
+    # whose failure mode is indistinguishable from the thing it monitors is the
+    # blind-monitor class this whole sweep is closing.
+    location = /__version { auth_request off; proxy_pass http://$crm_upstream/__version; }
+
     # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2). Without this,
     # /auth/logout triggers 401 -> redirect to auth with logout URL as redirect param
     # -> infinite loop. Let the app handle logout (clear its own cookies), then it
@@ -207,6 +225,9 @@ server {
     location = /health  { auth_request off; proxy_pass http://$wiki_upstream/api/ping; }
     location = /healthz { auth_request off; proxy_pass http://$wiki_upstream/api/ping; }
 
+    # G5 served-freshness — see the CRM vhost's note (bug 529f45cf).
+    location = /__version { auth_request off; proxy_pass http://$wiki_upstream/__version; }
+
     # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2).
     location = /auth/logout { auth_request off; proxy_pass http://$wiki_upstream/auth/logout; }
 
@@ -246,6 +267,27 @@ server {
     set $gotrue_upstream gotrue:9999;                  # used by sso-redirect.conf's /_sso_gate
     include /etc/nginx/snippets/sso-redirect.conf;
 
+    # G5 served-freshness — see the CRM vhost's note (bug 529f45cf).
+    #
+    # HONEST ABOUT WHAT THIS DOES AND DOES NOT FIX: exe-erp does not implement
+    # /__version yet (that is a change in AskExe/exe-erp, not here). Today this
+    # location turns a MISLEADING answer into an honest one — the probe stops
+    # reading auth.askexe.com's login HTML and starts reading ERP's own 404, so
+    # served-freshness reports ERP as unverifiable-because-unimplemented rather
+    # than silently comparing a login page against a git sha. It becomes a real
+    # verification the moment exe-erp ships the route; nothing here changes then.
+    #
+    # Host is preserved and the standard forwarded headers are set, matching the
+    # main location block below — a bare proxy_pass would send
+    # Host: exe-erp-nginx, which frappe's origin check rejects.
+    location = /__version {
+        auth_request off;
+        proxy_pass http://$erp_upstream/__version;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+
     # ERP is the one upstream that runs a realtime socket.io service with
     # origin authentication: frappe's realtime middleware compares the Host
     # header against the Origin header and rejects mismatches ("Invalid
@@ -294,6 +336,9 @@ server {
     location = /health  { auth_request off; proxy_pass http://$dashboard_upstream/health; }
     location = /healthz { auth_request off; proxy_pass http://$dashboard_upstream/health; }
 
+    # G5 served-freshness — see the CRM vhost's note (bug 529f45cf).
+    location = /__version { auth_request off; proxy_pass http://$dashboard_upstream/__version; }
+
     # Logout endpoint must be exempt from SSO gate (bug 96f8b2b2).
     location = /auth/logout { auth_request off; proxy_pass http://$dashboard_upstream/auth/logout; }
 

package/deploy/compose/sso-edge/sso-redirect.conf

@@ -146,8 +146,17 @@
 # make it fire). That is not a typo fix — it would newly open a real bypass for
 # every path whose URI ends in an asset extension, including user-uploaded CRM
 # attachments and wiki images. If a future app genuinely needs an ungated path,
-# give it an explicit `location = /path { auth_request off; }` (as the /health
-# and /auth/logout routes already do), never an extension-shaped wildcard.
+# give it an explicit `location = /path { auth_request off; }` (as the /health,
+# /auth/logout and /__version routes already do), never an extension-shaped
+# wildcard.
+#
+# /__version is the third such grant (bug 529f45cf). It is exact-match, it is
+# read-only, and its body is a git sha/ref/repo already published without
+# authentication in the signed stack manifest — so it widens no disclosure. It
+# exists because the G5 served-freshness watchdog could not read ANY gated
+# surface: every probe was 302'd to the login page, and the watchdog compared a
+# git sha against auth's HTML. That is the shape this gate must never take —
+# a control that cannot see reporting its blindness as ordinary traffic.
 # ─────────────────────────────────────────────────────────────────────────────
 
 # Run the gate for every request on this vhost. The gate is a zero-cost local

package/deploy/stack-manifests/v0.9.30-apps.json

@@ -76,6 +76,6 @@
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "ib9CL9sD/5c2q6M1UQDA1BUf9WT6iI18gUyCmY3+TitjVhIeAf5bTTyfs/FiWAAn8penUVWp21p65KJgSW1PCA=="
+    "signature": "hZxmmxAMTi7l2yI0XDe3vnm35xl7z6A+BVcLFZopjULs9Q+v9CsqvoaLoDv6APiBfsagwr1wPmN0A7Uw0GrJBw=="
   }
 }