@askexenow/exe-os 0.9.410 → 0.9.412

package/dist/{chunk-R3N5BCMM.js → chunk-O3BLL6MY.js}

@@ -4,7 +4,7 @@ import {
 import {
   flushBatch,
   writeMemory
-} from "./chunk-X2EBM5BQ.js";
+} from "./chunk-LSHUX7P4.js";
 import {
   SUPPORT_PRODUCTS,
   isWellFormedCommit,

package/dist/{chunk-SLG3T26A.js → chunk-O6KQAJCC.js}

@@ -1,10 +1,10 @@
 import {
   withScopedReadWindow
-} from "./chunk-S2DTXCV6.js";
+} from "./chunk-KN5GAVCG.js";
 import {
   requireOrgPartnerBinding,
   resolvePartnerIdentities
-} from "./chunk-XCKTCOK3.js";
+} from "./chunk-CJ6CS2IH.js";
 import {
   allocateOutboundSeq,
   approveBriefManually,
@@ -22,7 +22,7 @@ import {
   sealMailboxEnvelope,
   unrecordedText,
   verifyManifest
-} from "./chunk-XMMWBLQK.js";
+} from "./chunk-XQ7BIVLI.js";
 import {
   queueMailboxDeposit
 } from "./chunk-3FGBBJYM.js";

package/dist/{chunk-2WOHFX4Z.js → chunk-OHHZNNUD.js}

@@ -10,7 +10,7 @@ import {
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-KNEEOZWN.js";
+} from "./chunk-EOWJXCYC.js";
 import {
   EXE_AI_DIR,
   loadConfig

package/dist/{chunk-HWP3WCLC.js → chunk-OPG237ZQ.js}

@@ -13,7 +13,6 @@ import {
 
 // src/bin/verify-stack.ts
 import { execSync } from "child_process";
-import { createHash } from "crypto";
 import { readFileSync, existsSync } from "fs";
 import http from "http";
 import path from "path";
@@ -36,6 +35,18 @@ function evaluateProduct(probes) {
   const layer = gatingLayerOf(probes);
   const findings = [];
   const at = (p) => `landed on ${p.finalHost} (status ${p.status}, ${p.hops} hop(s))`;
+  for (const [scenario, probe] of Object.entries({
+    anonymous: probes.anonymous,
+    "forged-session": probes.forgedSession,
+    "sentinel-only": probes.sentinelOnly,
+    "real-session": probes.realSession
+  })) {
+    if (probe?.admissionError) findings.push({
+      scenario,
+      severity: "violation",
+      detail: probe.admissionError
+    });
+  }
   if (layer === "client-gated") {
     findings.push({
       scenario: "anonymous",
@@ -68,11 +79,12 @@ function evaluateProduct(probes) {
   }
   const real = probes.realSession;
   if (real) {
-    if (real.hops > MAX_SSO_HANDOFF_HOPS) {
+    const limit = probes.app === "exe-erp" && real.verifiedNativeSession ? 4 : MAX_SSO_HANDOFF_HOPS;
+    if (real.hops > limit) {
       findings.push({
         scenario: "real-session",
         severity: "violation",
-        detail: `a real apex session took ${real.hops} redirect(s) reaching ${probes.host}, over the contract's ${MAX_SSO_HANDOFF_HOPS} \u2014 ${at(real)}. An unbounded hop count here is the CRM livelock (bug 83ba9546 regression): the edge and the app are disagreeing about the handoff and bouncing the user between them.`
+        detail: `a real apex session took ${real.hops} redirect(s) reaching ${probes.host}, over the contract's ${limit} \u2014 ${at(real)}. An unbounded hop count here is the CRM livelock (bug 83ba9546 regression): the edge and the app are disagreeing about the handoff and bouncing the user between them.`
       });
     } else if (real.finalHost !== probes.host) {
       findings.push({
@@ -135,6 +147,130 @@ function parseApexCookies(setCookieLines) {
   return jar;
 }
 
+// src/lib/sso-admission-probe.ts
+import { createHash } from "crypto";
+var CALLBACK = "/api/method/erpnext.exe_auth.api.gotrue_login_callback";
+var START = "/api/method/erpnext.exe_auth.api.gotrue_login_start";
+var loopback = (u) => u.hostname === "127.0.0.1" || u.hostname === "localhost";
+async function probeAdmission(url, jar, timeoutMs, options) {
+  const app = new URL(url), auth = new URL(options.authUrl);
+  let current = app, hops = 0, resumed = false, started = false;
+  const local = {};
+  let actorEmail;
+  const safe = (u) => !u.username && !u.password && (u.origin === app.origin || u.origin === auth.origin) && (u.protocol === "https:" || u.protocol === "http:" && loopback(u));
+  const headers = (u, apexOnly = false) => ({
+    accept: "text/html,application/xhtml+xml",
+    "user-agent": "exe-os-verify-stack/sso-session-contract",
+    cookie: cookieHeader({
+      ...jar,
+      ...u.origin === app.origin && !apexOnly ? local : {}
+    })
+  });
+  const result = (status, body, admissionError) => ({
+    finalHost: current.host,
+    hops,
+    status,
+    sawPasswordField: htmlHasPasswordField(body),
+    bodyFingerprint: createHash("sha256").update(body).digest("hex"),
+    ...admissionError ? { admissionError } : {},
+    ...resumed && actorEmail && !admissionError ? { verifiedNativeSession: true } : {}
+  });
+  for (; ; ) {
+    if (!safe(current))
+      return result(0, "", "SSO redirect left the trusted HTTPS origins");
+    const res = await fetch(current, {
+      headers: headers(current),
+      redirect: "manual",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (options.service === "exe-erp" && current.origin === app.origin) {
+      for (const line of res.headers.getSetCookie()) {
+        const [pair = "", ...attrs] = line.split(";");
+        const eq = pair.indexOf("="), name = pair.slice(0, eq).trim();
+        if (eq < 1 || !["sid", "exe_sso_state"].includes(name)) continue;
+        const domain = attrs.find((a) => /^\s*domain=/i.test(a))?.split("=")[1]?.trim().replace(/^\./, "");
+        if (domain && domain !== app.hostname) continue;
+        local[name] = pair.slice(eq + 1).trim();
+      }
+      if (current.pathname === START) started = true;
+    }
+    if (res.status >= 300 && res.status < 400 && res.headers.get("location")) {
+      current = new URL(res.headers.get("location"), current);
+      if (++hops < 6) continue;
+      return result(res.status, "", "SSO redirect budget exhausted");
+    }
+    if (options.service === "exe-erp" && options.email && jar.exe_sess && !resumed && started && current.origin === auth.origin && current.pathname === "/login" && res.ok && current.searchParams.has("redirect")) {
+      const callback = new URL(current.searchParams.get("redirect"), current);
+      if (!safe(callback) || callback.origin !== app.origin || callback.pathname !== CALLBACK || !local.exe_sso_state || callback.searchParams.get("state") !== local.exe_sso_state || [...callback.searchParams.keys()].some((k) => k !== "state")) {
+        return result(
+          res.status,
+          "",
+          "ERP callback origin, path or state did not match its initiating cookie"
+        );
+      }
+      const me = await fetch(new URL("/auth/me", auth), {
+        headers: headers(auth),
+        redirect: "manual",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      const actor = me.ok ? await me.json() : null;
+      if (!actor || actor.ok !== true || typeof actor.sub !== "string" || !actor.sub || typeof actor.email !== "string" || !options.email || actor.email.toLowerCase() !== options.email.toLowerCase()) {
+        return result(
+          me.status,
+          "",
+          "Auth did not validate the expected SSO identity"
+        );
+      }
+      actorEmail = actor.email;
+      resumed = true;
+      current = callback;
+      if (++hops < 6) continue;
+      return result(0, "", "SSO redirect budget exhausted");
+    }
+    const body = await res.text();
+    if (options.email && !res.ok) {
+      return result(res.status, body, "Real-session product request was not successful");
+    }
+    if (resumed && current.origin === app.origin && res.ok) {
+      const identity = await fetch(
+        new URL("/api/method/frappe.auth.get_logged_user", app),
+        {
+          headers: headers(app),
+          redirect: "manual",
+          signal: AbortSignal.timeout(timeoutMs)
+        }
+      );
+      const user = identity.ok ? await identity.json() : null;
+      if (!local.sid || local.sid === "Guest" || !user || user.message !== actorEmail) {
+        return result(
+          identity.status,
+          body,
+          "ERP native session did not match the validated Auth identity"
+        );
+      }
+      const control = await fetch(new URL("/api/method/frappe.auth.get_logged_user", app), {
+        headers: headers(app, true),
+        redirect: "manual",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      const guest = control.ok ? await control.json() : null;
+      const location = control.headers.get("location");
+      const refusal = location ? new URL(location, app) : null;
+      const refused = control.status >= 300 && control.status < 400 && refusal && safe(refusal) && (refusal.origin === auth.origin || refusal.origin === app.origin && [START, "/login"].includes(refusal.pathname));
+      if (!(guest?.message === "Guest" || [401, 403].includes(control.status) || refused)) {
+        return result(control.status, body, "ERP identity was not independently bound to its native session");
+      }
+    } else if (resumed) {
+      return result(
+        res.status,
+        body,
+        "ERP callback did not finish on the expected product"
+      );
+    }
+    return result(res.status, body);
+  }
+}
+
 // src/bin/verify-stack.ts
 var DEFAULT_COMPOSE = "/opt/exe-stack/docker-compose.yml";
 var DEFAULT_ENV = "/opt/exe-stack/.env";
@@ -518,57 +654,11 @@ async function checkSsoCookieContract(deployed, urlOverrides) {
     message: `${Object.keys(urls).length} product(s) free of retired SSO cookie names`
   };
 }
-var MAX_PROBE_HOPS = 6;
 var SSO_ADMISSION_APPS = {
   "exe-crm": "crm",
   "exe-erp": "erp",
   "exe-wiki": "wiki"
 };
-async function probeAdmission(url, jar, timeoutMs) {
-  let current = url;
-  let hops = 0;
-  const headers = {
-    // Some edges vary their gate on Accept; ask for a document like a browser does.
-    accept: "text/html,application/xhtml+xml",
-    "user-agent": "exe-os-verify-stack/sso-session-contract"
-  };
-  const cookie = cookieHeader(jar);
-  if (cookie) headers.cookie = cookie;
-  for (; ; ) {
-    const res = await fetch(current, {
-      headers,
-      redirect: "manual",
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (res.status >= 300 && res.status < 400) {
-      const location = res.headers.get("location");
-      if (location) {
-        hops += 1;
-        current = new URL(location, current).toString();
-        if (hops < MAX_PROBE_HOPS) continue;
-      }
-      return {
-        finalHost: new URL(current).host,
-        hops,
-        status: res.status,
-        sawPasswordField: false,
-        bodyFingerprint: `redirect:${res.status}:${location ?? ""}`
-      };
-    }
-    let body = "";
-    try {
-      body = await res.text();
-    } catch {
-    }
-    return {
-      finalHost: new URL(current).host,
-      hops,
-      status: res.status,
-      sawPasswordField: htmlHasPasswordField(body),
-      bodyFingerprint: createHash("sha256").update(body).digest("hex")
-    };
-  }
-}
 async function loginForApexCookies(authUrl, email, password, timeoutMs) {
   let res;
   try {
@@ -642,8 +732,22 @@ async function checkSsoSessionContract(env, deployed, overrides) {
   const settled = await Promise.all(
     pairs.map(async (pair) => {
       try {
-        return { pair, probe: await probeAdmission(pair.target.baseUrl, pair.jar, CHECK_TIMEOUT_MS * 2) };
+        return { pair, probe: await probeAdmission(pair.target.baseUrl, pair.jar, CHECK_TIMEOUT_MS * 2, {
+          authUrl,
+          service: pair.target.service,
+          email: pair.scenario === "real-session" ? email : void 0
+        }) };
       } catch (err) {
+        if (pair.scenario === "real-session") {
+          return { pair, probe: {
+            finalHost: pair.target.host,
+            hops: 0,
+            status: 0,
+            sawPasswordField: false,
+            bodyFingerprint: "",
+            admissionError: "Real-session admission probe could not complete safely"
+          } };
+        }
         return { pair, error: err instanceof Error ? err.message : String(err) };
       }
     })

package/dist/{chunk-2LJ2GZEE.js → chunk-PDQGR5LZ.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-LBEBSXZA.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/lib/token-budget.ts
 var WARN_THRESHOLD = 0.8;

package/dist/{chunk-UBTKHJCB.js → chunk-PTF5TB6O.js}

@@ -1,13 +1,16 @@
+import {
+  SlackAdapter
+} from "./chunk-ORCCI2VV.js";
 import {
   IMessageAdapter
 } from "./chunk-2SRG3B3D.js";
 import {
   createCRMWebhookHandler,
   parseTwentyWebhook
-} from "./chunk-K464YYT5.js";
+} from "./chunk-RHJOTGEU.js";
 import {
   WhatsAppAdapter
-} from "./chunk-K6XWIJN7.js";
+} from "./chunk-3N24FV22.js";
 import {
   SignalAdapter
 } from "./chunk-RJT7H2KR.js";
@@ -17,9 +20,6 @@ import {
 import {
   DiscordAdapter
 } from "./chunk-N5RRQOAC.js";
-import {
-  SlackAdapter
-} from "./chunk-ORCCI2VV.js";
 import {
   BotRegistry,
   BotRuntime,
@@ -42,7 +42,7 @@ import {
   retryWithBackoff,
   routeMessage,
   validateGatewayConfig
-} from "./chunk-DLHE4PCM.js";
+} from "./chunk-XEAZJXMZ.js";
 import {
   OllamaProvider
 } from "./chunk-FWFFZGSC.js";

package/dist/{chunk-5F3E57TQ.js → chunk-PYXXL7N7.js}

@@ -22,7 +22,7 @@ var OrgOriginProvenanceError = class extends Error {
 async function mintOrgOriginStamp(input) {
   if (!input.orgId) throw new OrgOriginProvenanceError("An org-origin stamp requires a non-empty org_id (\xA71.5)");
   if (!input.requestId) throw new OrgOriginProvenanceError("An org-origin stamp requires a request id");
-  const { getTaskRequest } = await import("./task-request-inbox-RXAT2QJF.js");
+  const { getTaskRequest } = await import("./task-request-inbox-2TN4ZUH2.js");
   const req = getTaskRequest(input.orgId, input.requestId);
   if (!req) {
     throw new OrgOriginProvenanceError(

package/dist/{chunk-HLNRLXUS.js → chunk-Q6KUBP6R.js}

@@ -1,24 +1,24 @@
 import {
   recordSessionKill
-} from "./chunk-AEOB4JCJ.js";
+} from "./chunk-3GGMHSY2.js";
 import {
   sessionScopeFilter,
   verifyPaneAtCapacity,
   writeNotification
-} from "./chunk-WSYIQKZ6.js";
+} from "./chunk-GM4UEZDE.js";
 import {
   listSessions
-} from "./chunk-6T5RC3L4.js";
+} from "./chunk-QSW5DHMZ.js";
 import {
   getTransport
 } from "./chunk-VI4ATC6I.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-WLV27PAO.js";
+} from "./chunk-JGBYZTWH.js";
 import {
   getClient,
   isCoordinatorName
-} from "./chunk-LBEBSXZA.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/lib/capacity-monitor.ts
 var CAPACITY_PATTERNS = [

package/dist/{chunk-AGY2KUQ6.js → chunk-QJWLQXR7.js}

@@ -2,7 +2,7 @@ import {
   deleteKeychainSecret,
   getKeychainSecret,
   setKeychainSecret
-} from "./chunk-IQCC6WFI.js";
+} from "./chunk-4J77TCTX.js";
 
 // src/lib/consent-passphrase.ts
 import crypto from "crypto";

package/dist/{chunk-ZEDLED43.js → chunk-QOFQY7BJ.js}

@@ -85,7 +85,7 @@ async function getRetrievalHealth() {
     totalMemories = Number(totalRes.rows[0]?.cnt ?? 0);
     memoriesWithVectors = Number(vectorRes.rows[0]?.cnt ?? 0);
     try {
-      const { getGraphStats } = await import("./graph-query-CRIH4DXF.js");
+      const { getGraphStats } = await import("./graph-query-7YA3YNKL.js");
       const stats = await getGraphStats(client);
       entities = stats.entities;
       relationships = stats.relationships;

package/dist/{chunk-6T5RC3L4.js → chunk-QSW5DHMZ.js}

@@ -1,6 +1,6 @@
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-WLV27PAO.js";
+} from "./chunk-JGBYZTWH.js";
 import {
   atomicWriteJsonSync
 } from "./chunk-HSGBZSCA.js";

package/dist/{chunk-54Q7M2AG.js → chunk-QV26G2BF.js}

@@ -22,7 +22,7 @@ import {
 import {
   getCachedMonitorIdentity,
   recomputeEnvelopeWrapKey
-} from "./chunk-2K7IKLBL.js";
+} from "./chunk-7SHU5MOD.js";
 
 // src/lib/crypto.ts
 import crypto from "crypto";

package/dist/{chunk-5WNZGNQL.js → chunk-RHHEYC6H.js}

@@ -4,10 +4,10 @@ import {
   extractIdentifiers,
   isGarbageEntity,
   normalizeEntityName
-} from "./chunk-26CY4EAR.js";
+} from "./chunk-HTFM7ZDD.js";
 import {
   getClient
-} from "./chunk-LBEBSXZA.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/lib/memory-graph-extractor.ts
 function relationshipId(sourceId, targetId, relType) {
@@ -432,7 +432,7 @@ async function upsertMemoryGraph(result, memoryId, opts) {
     });
   }
   try {
-    const { createCoOccurrenceEdges } = await import("./co-occurrence-MKZ6YWSQ.js");
+    const { createCoOccurrenceEdges } = await import("./co-occurrence-F5TMSEQZ.js");
     await createCoOccurrenceEdges(result.entities, memoryId, { linkOnly });
   } catch {
   }

package/dist/{chunk-K464YYT5.js → chunk-RHJOTGEU.js}

@@ -1,6 +1,6 @@
 import {
   processCRMEvent
-} from "./chunk-XDWIJBTY.js";
+} from "./chunk-CFO47VW4.js";
 
 // src/gateway/adapters/crm-webhook.ts
 function parseTwentyWebhook(payload) {