From 9541c47470f1a8aef9c996772b70a35a0e036b35 Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Sun, 2 Aug 2026 12:56:55 -0400
Subject: [PATCH] fix: resolve jump-host naming bug and setup.sh secrets list
 bug

---
 bootstrap/bootstrap.js | 1 -
 setup.sh               | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/bootstrap/bootstrap.js b/bootstrap/bootstrap.js
index c873ef1..7039d8c 100644
--- a/bootstrap/bootstrap.js
+++ b/bootstrap/bootstrap.js
@@ -573,7 +573,6 @@ function writeJumpSecrets(apiToken, oidc, localAdminPass) {
 // sshPublicKey attribute (key injection); for a hardened deployment use a
 // scoped account with an sshPublicKey write-ACL instead (see jump-host README).
 module.exports = {
-\tname: ${JSON.stringify(sso.name || 'SSO Manager')},
 \tldap: {
 \t\t// ldaps:// (636), not ldap:// (389): @simpleworkjs/ldap's client always
 \t\t// sets tlsOptions (see jump-host's models/user_ldap.js), and ldapts
diff --git a/setup.sh b/setup.sh
index 3b24e4d..5c783dd 100755
--- a/setup.sh
+++ b/setup.sh
@@ -795,6 +795,7 @@ HCL
 ensure_policy sso-admin <<'HCL'
 path "secret/data/*" { capabilities = ["create", "read", "update", "delete", "list"] }
 path "secret/metadata" { capabilities = ["list", "read", "delete"] }
+path "secret/metadata/" { capabilities = ["list", "read", "delete"] }
 path "secret/metadata/*" { capabilities = ["list", "read", "delete"] }
 HCL
 # proxy / jump-host — read only their own boot conf.