@askexenow/exe-os 0.9.411 → 0.9.413

package/dist/bin/stack-update.js

@@ -28,10 +28,12 @@ import {
   parseEnv,
   parseRetainedContainerHealth,
   patchEnv,
+  planLegacyWorkerMigration,
   printDanglingVolumes,
   printVolumeCleanupResult,
   readCurrentStackVersion,
   readRetainedComposeFiles,
+  readStagedComposeTemplate,
   reconcileStackLockFromContainers,
   removeDanglingVolumes,
   reportStackManifestSource,
@@ -50,11 +52,11 @@ import {
   verifyManifestImagesAvailable,
   warnUnmanagedManifestServices,
   withStackUpdateOperationLock
-} from "../chunk-WHUQ44F2.js";
+} from "../chunk-RIKFXHLE.js";
 import "../chunk-EC5H53YD.js";
 import {
   runVerifyStack
-} from "../chunk-HWP3WCLC.js";
+} from "../chunk-OPG237ZQ.js";
 import {
   assertPreflightGate,
   runPreflightOnManifest
@@ -66,7 +68,7 @@ import {
 import {
   logResult,
   runHealthGate
-} from "../chunk-DRHTRVDT.js";
+} from "../chunk-VBYSAQJD.js";
 import "../chunk-L25OAFOU.js";
 import "../chunk-RT57D7C4.js";
 import "../chunk-FTZET5YX.js";
@@ -2325,6 +2327,9 @@ function reportPartialRun(result) {
 }
 async function main(args = process.argv.slice(2)) {
   const opts = parseArgs(args);
+  if (opts.rollback && (opts.check || opts.dryRun || opts.verifyImages)) {
+    throw new Error("Rollback cannot be combined with --check, --dry-run or --verify-images; no rollback was performed.");
+  }
   if (opts.retainCompose && (!opts.targetVersion || !opts.serviceName || !opts.noBootstrap || !opts.skipHardening || opts.configOnly || opts.rollback || opts.resume || opts.addService || opts.removeService || opts.services?.length || opts.cleanupVolumes || opts.reconcileLock || opts.adoptDeployedPins || opts.allowRed || opts.allowUnmanifestedServices || opts.breakGlassReason || opts.strictDigest === false || !opts.verifyManifestSignature)) {
     throw new Error("--retain-compose requires explicit --target, one --service, --no-bootstrap, --skip-hardening, and no selection/config/rollback/cleanup/bypass mode");
   }
@@ -2401,10 +2406,10 @@ async function main(args = process.argv.slice(2)) {
     return;
   }
   let usingPackagedCheckTemplates = false;
-  if (opts.check && !opts.noBootstrap && !existsForCli(opts.composeFile) && !existsForCli(opts.envFile)) {
-    const packageRoot = path3.resolve(new URL("../..", import.meta.url).pathname);
-    opts.composeFile = path3.join(packageRoot, "deploy", "compose", "docker-compose.yml");
-    opts.envFile = path3.join(packageRoot, "deploy", "compose", ".env.customer.example");
+  if ((opts.check || opts.dryRun || opts.verifyImages || !opts.yes) && !opts.noBootstrap && !existsForCli(opts.composeFile) && !existsForCli(opts.envFile)) {
+    const packaged = readStagedComposeTemplate(opts, "");
+    opts.composeFile = packaged.templatePath;
+    opts.envFile = path3.join(path3.dirname(packaged.templatePath), ".env.customer.example");
     opts.noBootstrap = true;
     usingPackagedCheckTemplates = true;
   }
@@ -2418,7 +2423,7 @@ async function main(args = process.argv.slice(2)) {
     return;
   }
   let hostReport;
-  if (!opts.noBootstrap) {
+  if (!opts.noBootstrap && opts.yes && !opts.check && !opts.dryRun && !opts.verifyImages) {
     hostReport = bootstrapStackHost({ ...opts, installDocker: opts.yes, domain: opts.domain, adminEmail: opts.adminEmail });
     printHostReport(hostReport);
     if (!opts.check && !opts.dryRun) assertHostReadyForApply(hostReport);
@@ -2440,6 +2445,7 @@ async function main(args = process.argv.slice(2)) {
   );
   reportStackManifestSource(manifestLoad);
   const manifest = manifestLoad.manifest;
+  let previewServiceSelection;
   if (opts.addService || opts.removeService) {
     const effectiveVersion = opts.targetVersion ?? manifest.latest;
     const manifestRelease = manifest.stacks[effectiveVersion];
@@ -2463,15 +2469,20 @@ async function main(args = process.argv.slice(2)) {
       currentServices.delete(opts.removeService);
       console.log(`Removed service: ${opts.removeService}`);
     }
-    saveServiceSelection(opts.envFile, [...currentServices]);
-    console.log(`Saved service selection: ${[...currentServices].join(", ")}`);
-    if (!opts.yes && !opts.check) {
+    if (opts.check || opts.dryRun || opts.verifyImages) {
+      previewServiceSelection = runScopedServiceSelection([...currentServices]);
+      console.log(`Planned service selection (not saved): ${[...currentServices].join(", ")}`);
+    } else {
+      saveServiceSelection(opts.envFile, [...currentServices]);
+      console.log(`Saved service selection: ${[...currentServices].join(", ")}`);
+    }
+    if (!opts.yes && !opts.check && !opts.dryRun && !opts.verifyImages) {
       console.log("Service selection updated. Re-run with --yes to apply.");
       return;
     }
   }
   const isRunScoped = Boolean(opts.services && opts.services.length > 0);
-  const serviceSelection = isRunScoped ? runScopedServiceSelection(opts.services) : loadServiceSelection(opts.envFile);
+  const serviceSelection = isRunScoped ? runScopedServiceSelection(opts.services) : previewServiceSelection ?? loadServiceSelection(opts.envFile);
   if (isRunScoped) {
     console.log(
       `Service scope for THIS RUN ONLY: ${opts.services.join(", ")} (the managed set in ${serviceSelectionPath(opts.envFile)} is unchanged)`
@@ -2533,7 +2544,22 @@ async function main(args = process.argv.slice(2)) {
   }
   assertDeploymentScopeAllowed(plan, opts.deploymentPersona);
   const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
-  const composeRawForGate = readFileSync3(opts.composeFile, "utf8");
+  const currentComposeRaw = readFileSync3(opts.composeFile, "utf8");
+  const hostState = listHostComposeServices(composeArgsForStack(opts.composeFile, opts.envFile));
+  const overrideFile = path3.join(path3.dirname(opts.composeFile), "docker-compose.override.yml");
+  const workerMigration = opts.retainCompose ? { raw: currentComposeRaw, changed: false } : planLegacyWorkerMigration({
+    composeRaw: currentComposeRaw,
+    targetComposeRaw: () => {
+      const staged = readStagedComposeTemplate(opts, currentComposeRaw);
+      return staged.templateFound ? staged.raw : null;
+    },
+    env: new Map(["COMPOSE_PROFILES", "EXE_OS_WORKER_IMAGE_TAG"].map((key) => [key, readKeyFromEnvFile(opts.envFile, key) ?? ""])),
+    hostServices: hostState.services,
+    hostServicesUnavailable: hostState.unavailable,
+    overrideRaw: existsSync3(overrideFile) ? readFileSync3(overrideFile, "utf8") : null
+  });
+  const composeRawForGate = workerMigration.raw;
+  if (workerMigration.changed) console.log("Planned configuration migration: clear the unused legacy embeddings-worker image default (no image will be deployed).");
   assertProductionDeployGate(plan, plannedEnvRaw, composeRawForGate, {
     breakGlassReason: opts.breakGlassReason,
     breakGlassAuditFile: opts.breakGlassAuditFile,
@@ -2541,7 +2567,6 @@ async function main(args = process.argv.slice(2)) {
     envFile: opts.envFile
   });
   {
-    const hostState = listHostComposeServices(composeArgsForStack(opts.composeFile, opts.envFile));
     assertSignedManifestDeliveryGate({
       release: manifest.stacks[plan.targetVersion],
       targetVersion: plan.targetVersion,

package/dist/bin/verify-stack.js

@@ -7,7 +7,7 @@ import {
   checkSsoSessionContract,
   parseComposeServiceNames,
   runVerifyStack
-} from "../chunk-HWP3WCLC.js";
+} from "../chunk-OPG237ZQ.js";
 import "../chunk-RT57D7C4.js";
 import "../chunk-FTZET5YX.js";
 import "../chunk-6Y4B3QF6.js";

package/dist/bin/vps-health-gate.js

@@ -8,7 +8,7 @@ import {
   logResult,
   main,
   runHealthGate
-} from "../chunk-DRHTRVDT.js";
+} from "../chunk-VBYSAQJD.js";
 import "../chunk-MLKGABMK.js";
 export {
   checkCRM,

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.9.411",
-  "commit": "7831446d8e",
-  "buildTime": "2026-10-12T18:45:23.972Z"
+  "version": "0.9.413",
+  "commit": "cf66dffc1f",
+  "buildTime": "2026-10-14T21:38:04.474Z"
 }

package/dist/build-manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "generated_at": "2026-10-12T18:45:24.278Z",
+  "generated_at": "2026-10-14T21:38:04.732Z",
   "files": [
     {
       "path": "active-agent-3YCLS7GB.js",
@@ -179,7 +179,7 @@
     },
     {
       "path": "bin/cli.js",
-      "sha256": "f6ccf8070a3151f8f5d1b70827b7b6fe311c64e030e3f4992a91a349fdf6b67e",
+      "sha256": "ecc4054b893c658689be2664e4106425497519d98d1b8ab220f05a87a88d21a0",
       "bytes": 69826
     },
     {
@@ -529,7 +529,7 @@
     },
     {
       "path": "bin/registry-proxy.js",
-      "sha256": "49967e4dacf4c85b79e9595907a0052455eac8e4562dea589ebd4a4ecbbcf438",
+      "sha256": "6246f910ac5dc7ee8e424276768ce69834acc34cb1ded671b67e14402449aca9",
       "bytes": 1885
     },
     {
@@ -554,8 +554,8 @@
     },
     {
       "path": "bin/stack-update.js",
-      "sha256": "8905263c3a6033dbdc7f2168104e7348325273e5d8ad3bdc3218746806ff9fdc",
-      "bytes": 133983
+      "sha256": "d99802bc590930932894066d40e57bdd844e200a07f4f09834795f9dcb623bcc",
+      "bytes": 135594
     },
     {
       "path": "bin/update.js",
@@ -564,7 +564,7 @@
     },
     {
       "path": "bin/verify-stack.js",
-      "sha256": "243b78602db4556a9ffa28a532cc025f0901d13bf2d21d7ddc5c3ece5458a24c",
+      "sha256": "eb579bed1ecc499124d9b64ee92f12e39402faa459370d48bb8e1468c123e11b",
       "bytes": 588
     },
     {
@@ -574,7 +574,7 @@
     },
     {
       "path": "bin/vps-health-gate.js",
-      "sha256": "174a06829ed463c162e055d9a4fe10d940cc26dffc9fcf5ff7d9915a00c2d488",
+      "sha256": "c94514d9a30b1996dfd90b7f55ef7472e8b3fe02106306e39bcb985504d61329",
       "bytes": 333
     },
     {
@@ -624,7 +624,7 @@
     },
     {
       "path": "build-info.json",
-      "sha256": "dc744cb25ca287542b6f1c267113db20272b234bc0059d866bb675a50dd6a4c4",
+      "sha256": "ae2c18364e569176d61a4ca37007c3b167bcd86cbb5dcf15b40a35ccc933486f",
       "bytes": 96
     },
     {
@@ -787,11 +787,6 @@
       "sha256": "29a6acbbaa627ae4d7852dd16a33f341809f3d82940b40c67c35d39d99fdf2c4",
       "bytes": 1090
     },
-    {
-      "path": "chunk-54STF27U.js",
-      "sha256": "6247938bc9df3b4c7c59de0cd0e8524952728545a5e28c22e3b53723966beec6",
-      "bytes": 44776
-    },
     {
       "path": "chunk-557C2IGL.js",
       "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
@@ -802,6 +797,11 @@
       "sha256": "be62387389c3e7572937bbb4dd16d7b1b7d8412519da9e5184970e0e2903dc41",
       "bytes": 22775
     },
+    {
+      "path": "chunk-5DLZJ3MY.js",
+      "sha256": "92f2a77f33866d1a5948b5977783676a45820ba6b44908b873776912e0001380",
+      "bytes": 3766
+    },
     {
       "path": "chunk-5DMAMQNU.js",
       "sha256": "19a9706b415bb25b177a37e1192d9df7d2cfc60cf3c0d997fc5d87c5001e59b1",
@@ -1132,11 +1132,6 @@
       "sha256": "72d6557a872c40e78d45a4e3adc793ac24d437e567b133b701f04203aea5a859",
       "bytes": 12949
     },
-    {
-      "path": "chunk-DRHTRVDT.js",
-      "sha256": "d3452468dcb0a27330ff6807ccbad6f957a6427a099d9bd2a867743d34b10258",
-      "bytes": 7587
-    },
     {
       "path": "chunk-DRTJCG6B.js",
       "sha256": "cf3ce4cf6c9cdba17a8a5e3d9f0c78ae42f1cb72f1a06608cc8da1fb27f06a76",
@@ -1342,11 +1337,6 @@
       "sha256": "a73bf84b9ddbd1b17f015dfb536fa2c87a05759bd7f8a33ec99bf37435ecdcdf",
       "bytes": 37638
     },
-    {
-      "path": "chunk-HWP3WCLC.js",
-      "sha256": "c6bd6a6824ccad9848e5dd323301b8bfe09222bc4f02516f220588bf5e359447",
-      "bytes": 39986
-    },
     {
       "path": "chunk-IC2AONBH.js",
       "sha256": "a36b4578fc5a22358234f1268894f828ba992cc68300413d4c2ac09d5b6a78e5",
@@ -1642,6 +1632,11 @@
       "sha256": "49c15064d81c686c9f3e36c08b8f49c41380ee87ed91a2c87b5280584ba61f45",
       "bytes": 15398
     },
+    {
+      "path": "chunk-OPG237ZQ.js",
+      "sha256": "bb7a843a54a6f1593d03b51729042108856b25e48fa7e555e234cb89f3deaee7",
+      "bytes": 45241
+    },
     {
       "path": "chunk-ORCCI2VV.js",
       "sha256": "a37bac62b7a21c982e0b3452ecedc0d6701215fece2336e45834cf1ba7f6fc03",
@@ -1777,6 +1772,11 @@
       "sha256": "c20bef017d05b8cc9c956d0a506eff0c31b14c3c1befdacf31e7f4fa008fbbdb",
       "bytes": 1549
     },
+    {
+      "path": "chunk-RIKFXHLE.js",
+      "sha256": "ec22ba327e38c90d0f3bf3211f2b789a5addb0e378a0a0112ee36457540a09dd",
+      "bytes": 286000
+    },
     {
       "path": "chunk-RJ67XAJU.js",
       "sha256": "48fb50b39022099eec6ec9ab7183d5d4e67b7f777d2eb3c2db1ea75af89c404a",
@@ -1942,6 +1942,11 @@
       "sha256": "2177b5e9109243a74fbaf9d67367db6a7b029b9aa7347cc232e3e354ad6c8768",
       "bytes": 7289
     },
+    {
+      "path": "chunk-VBYSAQJD.js",
+      "sha256": "dd5853a20a5092445dc86cc33fdc0e8f45777980fd98dd56c8fbea4d0a7e84a1",
+      "bytes": 7587
+    },
     {
       "path": "chunk-VGMACSEV.js",
       "sha256": "4a51d1fb50f1389160ec2d06ebeb702976a647212f7731ab58f562de3f53f215",
@@ -1967,6 +1972,11 @@
       "sha256": "5b4f1603c33ffbae21010d78cca899592e9f46576fa96be79fa044354506b221",
       "bytes": 19195
     },
+    {
+      "path": "chunk-W3ABSZ6G.js",
+      "sha256": "6380ccbf98ed850ed45daff314a6d85607e246ab333502d969e1d885e2da7b11",
+      "bytes": 44776
+    },
     {
       "path": "chunk-W4H2MZAS.js",
       "sha256": "cce67b1fec0b0c19a2099d1d8ae4f10a1097f59d70317570efa85d04400ed6f5",
@@ -1982,21 +1992,11 @@
       "sha256": "1b9948f2debbef6df967904c57797a46739dfbffe17493f3e5786d6e05d71701",
       "bytes": 50904
     },
-    {
-      "path": "chunk-WC44PNZU.js",
-      "sha256": "ddaee681898a3a9899fb8344b85f05f47fe2b2d7b8f48308e494b63e042c5052",
-      "bytes": 3766
-    },
     {
       "path": "chunk-WCGNCH3Q.js",
       "sha256": "4a905397d309c73ed4ad5d1ec488309541be3eec2fc6021d275f433ca92cc7a9",
       "bytes": 2265
     },
-    {
-      "path": "chunk-WHUQ44F2.js",
-      "sha256": "25b05355f18e18f5f5c80dc465fce50869af66825e6ca7be14ed595d9926ffd6",
-      "bytes": 275037
-    },
     {
       "path": "chunk-WJWRQQMS.js",
       "sha256": "288c40cefdb07850759e0d9bb48d5fd7b3e8bdff9e128b44780c626b0e0ef2a9",
@@ -2604,7 +2604,7 @@
     },
     {
       "path": "hooks/manifest.json",
-      "sha256": "9d55042634eb4e0f419e855ab60be3b39974d3f09e4d7b1173e875f334cd9bed",
+      "sha256": "6e4d658cb0eb906d2ea17974d9448cb11a0e1b3ed45fd4fcd92c9480ba1469f2",
       "bytes": 1841
     },
     {
@@ -2919,7 +2919,7 @@
     },
     {
       "path": "lib/registry-proxy.js",
-      "sha256": "32257fcbf92713bc59bec9f2c6189cdc264feae5f68ec96fc443a5897d2e439b",
+      "sha256": "8c19b7462382a7b98887843ce2bb5f19b1b6e236819c95841f4b26ad4924d460",
       "bytes": 749
     },
     {
@@ -3513,9 +3513,9 @@
       "bytes": 111
     },
     {
-      "path": "stack-generate-manifest-SU6OFFY7.js",
-      "sha256": "eb2109ae5b9b0d493e808b4c81486fd2de39e84d429b50ab59c0ace1d76173aa",
-      "bytes": 56960
+      "path": "stack-generate-manifest-MVJDTU4F.js",
+      "sha256": "08e90e042fb2c3a3891b667d0e5edd757ae308ee56835c70b502b2a2bd8973a5",
+      "bytes": 54817
     },
     {
       "path": "stack-init-5VKL5PL5.js",
@@ -3523,19 +3523,19 @@
       "bytes": 4761
     },
     {
-      "path": "stack-promote-MJF436JD.js",
-      "sha256": "45324465991756db5a4bef259f52cb5d3f3a03423c2e78067a38fdab3095dea5",
+      "path": "stack-promote-BMGEY6SQ.js",
+      "sha256": "77f706cfcd451b7a82cbfbe7cb9b1e884aee6f1f6824046bc244fb6d753bf945",
       "bytes": 7425
     },
     {
-      "path": "stack-release-S37R57XC.js",
-      "sha256": "8bdcd6d6a27d5e234da655acb201f4763dc7bdaf80d13323b135731b621cad3a",
-      "bytes": 117404
+      "path": "stack-release-64UJ6Y4W.js",
+      "sha256": "736e14e7a747a039b8464fd322f967b4a4eb026d77191ec558bc2ce97449dc3a",
+      "bytes": 115927
     },
     {
-      "path": "stack-update-XXDRKGGR.js",
-      "sha256": "a76298354a9acefc167ab902853c0104606353d1d4e749442ce53dffd76f7a21",
-      "bytes": 8231
+      "path": "stack-update-EBATTQPP.js",
+      "sha256": "48c4711a26259d079b26e7d675d3c086f1daadba511e13c4efddfe6211e80f44",
+      "bytes": 8289
     },
     {
       "path": "stalled-dispatch-escalation-MHLYH2PT.js",

package/dist/{chunk-WC44PNZU.js → chunk-5DLZJ3MY.js}

@@ -1,6 +1,6 @@
 import {
   canonicalizeStackManifest
-} from "./chunk-WHUQ44F2.js";
+} from "./chunk-RIKFXHLE.js";
 
 // src/lib/stack-manifest-write.ts
 import { readFileSync, statSync, writeFileSync } from "fs";

package/dist/{chunk-HWP3WCLC.js → chunk-OPG237ZQ.js}

@@ -13,7 +13,6 @@ import {
 
 // src/bin/verify-stack.ts
 import { execSync } from "child_process";
-import { createHash } from "crypto";
 import { readFileSync, existsSync } from "fs";
 import http from "http";
 import path from "path";
@@ -36,6 +35,18 @@ function evaluateProduct(probes) {
   const layer = gatingLayerOf(probes);
   const findings = [];
   const at = (p) => `landed on ${p.finalHost} (status ${p.status}, ${p.hops} hop(s))`;
+  for (const [scenario, probe] of Object.entries({
+    anonymous: probes.anonymous,
+    "forged-session": probes.forgedSession,
+    "sentinel-only": probes.sentinelOnly,
+    "real-session": probes.realSession
+  })) {
+    if (probe?.admissionError) findings.push({
+      scenario,
+      severity: "violation",
+      detail: probe.admissionError
+    });
+  }
   if (layer === "client-gated") {
     findings.push({
       scenario: "anonymous",
@@ -68,11 +79,12 @@ function evaluateProduct(probes) {
   }
   const real = probes.realSession;
   if (real) {
-    if (real.hops > MAX_SSO_HANDOFF_HOPS) {
+    const limit = probes.app === "exe-erp" && real.verifiedNativeSession ? 4 : MAX_SSO_HANDOFF_HOPS;
+    if (real.hops > limit) {
       findings.push({
         scenario: "real-session",
         severity: "violation",
-        detail: `a real apex session took ${real.hops} redirect(s) reaching ${probes.host}, over the contract's ${MAX_SSO_HANDOFF_HOPS} \u2014 ${at(real)}. An unbounded hop count here is the CRM livelock (bug 83ba9546 regression): the edge and the app are disagreeing about the handoff and bouncing the user between them.`
+        detail: `a real apex session took ${real.hops} redirect(s) reaching ${probes.host}, over the contract's ${limit} \u2014 ${at(real)}. An unbounded hop count here is the CRM livelock (bug 83ba9546 regression): the edge and the app are disagreeing about the handoff and bouncing the user between them.`
       });
     } else if (real.finalHost !== probes.host) {
       findings.push({
@@ -135,6 +147,130 @@ function parseApexCookies(setCookieLines) {
   return jar;
 }
 
+// src/lib/sso-admission-probe.ts
+import { createHash } from "crypto";
+var CALLBACK = "/api/method/erpnext.exe_auth.api.gotrue_login_callback";
+var START = "/api/method/erpnext.exe_auth.api.gotrue_login_start";
+var loopback = (u) => u.hostname === "127.0.0.1" || u.hostname === "localhost";
+async function probeAdmission(url, jar, timeoutMs, options) {
+  const app = new URL(url), auth = new URL(options.authUrl);
+  let current = app, hops = 0, resumed = false, started = false;
+  const local = {};
+  let actorEmail;
+  const safe = (u) => !u.username && !u.password && (u.origin === app.origin || u.origin === auth.origin) && (u.protocol === "https:" || u.protocol === "http:" && loopback(u));
+  const headers = (u, apexOnly = false) => ({
+    accept: "text/html,application/xhtml+xml",
+    "user-agent": "exe-os-verify-stack/sso-session-contract",
+    cookie: cookieHeader({
+      ...jar,
+      ...u.origin === app.origin && !apexOnly ? local : {}
+    })
+  });
+  const result = (status, body, admissionError) => ({
+    finalHost: current.host,
+    hops,
+    status,
+    sawPasswordField: htmlHasPasswordField(body),
+    bodyFingerprint: createHash("sha256").update(body).digest("hex"),
+    ...admissionError ? { admissionError } : {},
+    ...resumed && actorEmail && !admissionError ? { verifiedNativeSession: true } : {}
+  });
+  for (; ; ) {
+    if (!safe(current))
+      return result(0, "", "SSO redirect left the trusted HTTPS origins");
+    const res = await fetch(current, {
+      headers: headers(current),
+      redirect: "manual",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (options.service === "exe-erp" && current.origin === app.origin) {
+      for (const line of res.headers.getSetCookie()) {
+        const [pair = "", ...attrs] = line.split(";");
+        const eq = pair.indexOf("="), name = pair.slice(0, eq).trim();
+        if (eq < 1 || !["sid", "exe_sso_state"].includes(name)) continue;
+        const domain = attrs.find((a) => /^\s*domain=/i.test(a))?.split("=")[1]?.trim().replace(/^\./, "");
+        if (domain && domain !== app.hostname) continue;
+        local[name] = pair.slice(eq + 1).trim();
+      }
+      if (current.pathname === START) started = true;
+    }
+    if (res.status >= 300 && res.status < 400 && res.headers.get("location")) {
+      current = new URL(res.headers.get("location"), current);
+      if (++hops < 6) continue;
+      return result(res.status, "", "SSO redirect budget exhausted");
+    }
+    if (options.service === "exe-erp" && options.email && jar.exe_sess && !resumed && started && current.origin === auth.origin && current.pathname === "/login" && res.ok && current.searchParams.has("redirect")) {
+      const callback = new URL(current.searchParams.get("redirect"), current);
+      if (!safe(callback) || callback.origin !== app.origin || callback.pathname !== CALLBACK || !local.exe_sso_state || callback.searchParams.get("state") !== local.exe_sso_state || [...callback.searchParams.keys()].some((k) => k !== "state")) {
+        return result(
+          res.status,
+          "",
+          "ERP callback origin, path or state did not match its initiating cookie"
+        );
+      }
+      const me = await fetch(new URL("/auth/me", auth), {
+        headers: headers(auth),
+        redirect: "manual",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      const actor = me.ok ? await me.json() : null;
+      if (!actor || actor.ok !== true || typeof actor.sub !== "string" || !actor.sub || typeof actor.email !== "string" || !options.email || actor.email.toLowerCase() !== options.email.toLowerCase()) {
+        return result(
+          me.status,
+          "",
+          "Auth did not validate the expected SSO identity"
+        );
+      }
+      actorEmail = actor.email;
+      resumed = true;
+      current = callback;
+      if (++hops < 6) continue;
+      return result(0, "", "SSO redirect budget exhausted");
+    }
+    const body = await res.text();
+    if (options.email && !res.ok) {
+      return result(res.status, body, "Real-session product request was not successful");
+    }
+    if (resumed && current.origin === app.origin && res.ok) {
+      const identity = await fetch(
+        new URL("/api/method/frappe.auth.get_logged_user", app),
+        {
+          headers: headers(app),
+          redirect: "manual",
+          signal: AbortSignal.timeout(timeoutMs)
+        }
+      );
+      const user = identity.ok ? await identity.json() : null;
+      if (!local.sid || local.sid === "Guest" || !user || user.message !== actorEmail) {
+        return result(
+          identity.status,
+          body,
+          "ERP native session did not match the validated Auth identity"
+        );
+      }
+      const control = await fetch(new URL("/api/method/frappe.auth.get_logged_user", app), {
+        headers: headers(app, true),
+        redirect: "manual",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      const guest = control.ok ? await control.json() : null;
+      const location = control.headers.get("location");
+      const refusal = location ? new URL(location, app) : null;
+      const refused = control.status >= 300 && control.status < 400 && refusal && safe(refusal) && (refusal.origin === auth.origin || refusal.origin === app.origin && [START, "/login"].includes(refusal.pathname));
+      if (!(guest?.message === "Guest" || [401, 403].includes(control.status) || refused)) {
+        return result(control.status, body, "ERP identity was not independently bound to its native session");
+      }
+    } else if (resumed) {
+      return result(
+        res.status,
+        body,
+        "ERP callback did not finish on the expected product"
+      );
+    }
+    return result(res.status, body);
+  }
+}
+
 // src/bin/verify-stack.ts
 var DEFAULT_COMPOSE = "/opt/exe-stack/docker-compose.yml";
 var DEFAULT_ENV = "/opt/exe-stack/.env";
@@ -518,57 +654,11 @@ async function checkSsoCookieContract(deployed, urlOverrides) {
     message: `${Object.keys(urls).length} product(s) free of retired SSO cookie names`
   };
 }
-var MAX_PROBE_HOPS = 6;
 var SSO_ADMISSION_APPS = {
   "exe-crm": "crm",
   "exe-erp": "erp",
   "exe-wiki": "wiki"
 };
-async function probeAdmission(url, jar, timeoutMs) {
-  let current = url;
-  let hops = 0;
-  const headers = {
-    // Some edges vary their gate on Accept; ask for a document like a browser does.
-    accept: "text/html,application/xhtml+xml",
-    "user-agent": "exe-os-verify-stack/sso-session-contract"
-  };
-  const cookie = cookieHeader(jar);
-  if (cookie) headers.cookie = cookie;
-  for (; ; ) {
-    const res = await fetch(current, {
-      headers,
-      redirect: "manual",
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (res.status >= 300 && res.status < 400) {
-      const location = res.headers.get("location");
-      if (location) {
-        hops += 1;
-        current = new URL(location, current).toString();
-        if (hops < MAX_PROBE_HOPS) continue;
-      }
-      return {
-        finalHost: new URL(current).host,
-        hops,
-        status: res.status,
-        sawPasswordField: false,
-        bodyFingerprint: `redirect:${res.status}:${location ?? ""}`
-      };
-    }
-    let body = "";
-    try {
-      body = await res.text();
-    } catch {
-    }
-    return {
-      finalHost: new URL(current).host,
-      hops,
-      status: res.status,
-      sawPasswordField: htmlHasPasswordField(body),
-      bodyFingerprint: createHash("sha256").update(body).digest("hex")
-    };
-  }
-}
 async function loginForApexCookies(authUrl, email, password, timeoutMs) {
   let res;
   try {
@@ -642,8 +732,22 @@ async function checkSsoSessionContract(env, deployed, overrides) {
   const settled = await Promise.all(
     pairs.map(async (pair) => {
       try {
-        return { pair, probe: await probeAdmission(pair.target.baseUrl, pair.jar, CHECK_TIMEOUT_MS * 2) };
+        return { pair, probe: await probeAdmission(pair.target.baseUrl, pair.jar, CHECK_TIMEOUT_MS * 2, {
+          authUrl,
+          service: pair.target.service,
+          email: pair.scenario === "real-session" ? email : void 0
+        }) };
       } catch (err) {
+        if (pair.scenario === "real-session") {
+          return { pair, probe: {
+            finalHost: pair.target.host,
+            hops: 0,
+            status: 0,
+            sawPasswordField: false,
+            bodyFingerprint: "",
+            admissionError: "Real-session admission probe could not complete safely"
+          } };
+        }
         return { pair, error: err instanceof Error ? err.message : String(err) };
       }
     })