From a40326778eb06442de003e8aad9c4b977c716b61 Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Sun, 2 Aug 2026 12:26:19 -0400
Subject: [PATCH 1/3] fix: setup.sh color escape and unbound variable

---
 setup.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/setup.sh b/setup.sh
index 0d02c8f..3b24e4d 100755
--- a/setup.sh
+++ b/setup.sh
@@ -1044,7 +1044,7 @@ echo "$JUMP_HOSTS_OUT" | sed 's/^/[setup] /'
 
 # ── 8. Summary ───────────────────────────────────────────────────────────────
 echo
-info "\033[1;32mDone. Your SSO + proxy stack is up.\033[0m"
+echo -e "\033[1;34m[setup]\033[0m \033[1;32mDone. Your SSO + proxy stack is up.\033[0m"
 echo
 echo "  SSO Manager UI:    https://${SSO_HOST}   (fronted by the proxy under TLS)"
 echo "                      first-run fallback: http://127.0.0.1:${SSO_PORT:-3001}"
@@ -1056,7 +1056,7 @@ echo "  Jump host (web):    https://${JUMP_HOST:-jump.${SSO_HOST#sso.}}   (audit
 echo
 echo "  First admin login credentials are in ./config/sso-secrets.js:"
 echo "    user: ${ADMIN_UID}"
-echo "    pass: ${CFG_ADMIN_PASS}"
+echo "    pass: ${CFG_ADMIN_PASS:-<see ./config/sso-secrets.js>}"
 echo
 echo "  Proxy local admin (anti-lockout fallback if the SSO is unreachable):"
 echo "    user: proxyadmin2"

From 9541c47470f1a8aef9c996772b70a35a0e036b35 Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Sun, 2 Aug 2026 12:56:55 -0400
Subject: [PATCH 2/3] fix: resolve jump-host naming bug and setup.sh secrets
 list bug

---
 bootstrap/bootstrap.js | 1 -
 setup.sh               | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/bootstrap/bootstrap.js b/bootstrap/bootstrap.js
index c873ef1..7039d8c 100644
--- a/bootstrap/bootstrap.js
+++ b/bootstrap/bootstrap.js
@@ -573,7 +573,6 @@ function writeJumpSecrets(apiToken, oidc, localAdminPass) {
 // sshPublicKey attribute (key injection); for a hardened deployment use a
 // scoped account with an sshPublicKey write-ACL instead (see jump-host README).
 module.exports = {
-\tname: ${JSON.stringify(sso.name || 'SSO Manager')},
 \tldap: {
 \t\t// ldaps:// (636), not ldap:// (389): @simpleworkjs/ldap's client always
 \t\t// sets tlsOptions (see jump-host's models/user_ldap.js), and ldapts
diff --git a/setup.sh b/setup.sh
index 3b24e4d..5c783dd 100755
--- a/setup.sh
+++ b/setup.sh
@@ -795,6 +795,7 @@ HCL
 ensure_policy sso-admin <<'HCL'
 path "secret/data/*" { capabilities = ["create", "read", "update", "delete", "list"] }
 path "secret/metadata" { capabilities = ["list", "read", "delete"] }
+path "secret/metadata/" { capabilities = ["list", "read", "delete"] }
 path "secret/metadata/*" { capabilities = ["list", "read", "delete"] }
 HCL
 # proxy / jump-host — read only their own boot conf.

From 43b8307e54b2d7ab2b28f488f30c08f3f5f47565 Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Sun, 2 Aug 2026 13:13:50 -0400
Subject: [PATCH 3/3] docs: note docker compose v1 incompatibility

---
 README.md          | 3 +--
 docs/quickstart.md | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 632abfd..09bf931 100644
--- a/README.md
+++ b/README.md
@@ -140,8 +140,7 @@ Optional extra ports (only if you need them):
 
 ### 4. Docker + Docker Compose
 
-Any recent Docker with Compose — the v2 plugin (`docker compose`) or the v1
-standalone (`docker-compose`) both work.
+You must use the modern Docker Compose v2 plugin (`docker compose`). The older v1 standalone (`docker-compose`) is not compatible with the BuildKit images generated by this suite and will fail with a `ContainerConfig` KeyError during deployment.
 
 ---
 
diff --git a/docs/quickstart.md b/docs/quickstart.md
index 633bbfc..65da8f5 100644
--- a/docs/quickstart.md
+++ b/docs/quickstart.md
@@ -12,8 +12,7 @@ description: Step-by-step first run for theta-suite — prerequisites, setup.env
 
 ## Prerequisites
 
-- A Linux host with **Docker** + **Docker Compose** (the v2 plugin `docker
-  compose` or the v1 standalone `docker-compose` both work).
+- A Linux host with **Docker + Docker Compose** (you must use the modern `docker compose` v2 plugin; the older `docker-compose` v1 standalone will fail on BuildKit images).
 - Two hostnames that resolve to the host: one for the SSO UI (your `stack.ssoHost`),
   one for the proxy mgmt UI (your `stack.proxyHost`). On a real network add DNS
   records; for a local try, add them to `/etc/hosts`.