@bongos/core 1.19.101 → 1.19.103

package/modules/platform-identity/routes/projects.js

@@ -13,6 +13,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
+const projectStats = require('../project-stats');
 
 const { pool, requireBuilder, requirePermission, validateOrRespond, parseId, corsPublicGet } = api;
 
@@ -100,7 +101,26 @@ module.exports = function projectsRoutes() {
   // rank: public — a curated public showcase; no auth by design.
   router.get('/projects/featured', async (_req, res) => {
     try {
-      res.json({ projects: await pi.listFeaturedProjects({ pool }) });
+      const projects = await pi.listFeaturedProjects({ pool });
+      // Builders + tags come from each project's OWN public API, because the
+      // apex catalog does not know them and the membership tables would report
+      // zero for every hand-wired project (task 1002771; see project-stats.js).
+      // Enrichment is best-effort by construction: a project that is down gets
+      // nulls, which the table renders as an em dash. It must never fail the
+      // listing — a broken stats fetch cannot take the catalog down with it.
+      let stats = {};
+      try {
+        stats = await projectStats.getProjectStats(projects.map((p) => p.origin));
+      } catch (err) {
+        console.error('[platform-identity] project stats enrichment failed (non-fatal):', err.message);
+      }
+      res.json({
+        projects: projects.map((p) => ({
+          ...p,
+          builders: stats[p.origin]?.builders ?? null,
+          tags: stats[p.origin]?.tags ?? null,
+        })),
+      });
     } catch (err) {
       console.error('[platform-identity] GET /projects/featured', err);
       res.fail('explore_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.101",
+  "version": "1.19.103",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.101",
+      "version": "1.19.103",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.101",
+  "version": "1.19.103",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -540,6 +540,10 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   box-shadow:0 0 0 3px color-mix(in srgb,var(--acc) 22%,transparent);}
 .tbl .ptitle{font-family:var(--font-display);font-weight:700;font-size:15px;color:var(--ink);}
 .tbl .ptag{font-size:12.5px;color:var(--ink-faint);font-weight:600;}
+.tbl .num{font-family:var(--font-mono);font-weight:500;}
+.tbl .tags{display:flex;gap:6px;flex-wrap:wrap;}
+.tbl .tags span{font-family:var(--font-mono);font-size:10.5px;padding:2px 8px;border-radius:999px;
+  border:1px solid var(--line);color:var(--ink-faint);white-space:nowrap;}
 .tbl .pill{display:inline-block;font-family:var(--font-mono);font-size:11px;padding:3px 10px;
   border-radius:999px;background:var(--accent-soft);color:var(--accent-deep);}
 :root[data-mode="dark"] .tbl .pill{color:var(--sun-lit);}
@@ -553,6 +557,7 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl .colStatus{width:1%;white-space:nowrap;}
 .tbl .colGo{width:1%;white-space:nowrap;padding-left:8px;}
 .tbl .colName{width:auto;}
+@media (max-width:780px){.tbl .colTags{display:none;}}
 
 /* ── the project card ──
    An overlay INSIDE the map, not a destination: opening a project must not cost

package/public-landing/projects.html

@@ -182,6 +182,8 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       <thead>
         <tr>
           <th class="colName" data-sort="name" aria-sort="ascending">Project</th>
+          <th class="right" data-sort="builders">Builders</th>
+          <th class="colTags">Runs</th>
           <th class="right colStatus">Status</th>
           <th class="colGo"></th>
         </tr>
@@ -196,6 +198,8 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
           <td class="colName"><span class="pname"><span class="pdot" style="--acc:var(--accent)"></span>
             <span><span class="ptitle" data-brand-product-inline>Cloud Bongos</span><span id="selfPill"></span><br>
             <span class="ptag">this platform</span></span></span></td>
+          <td class="right num" id="selfBuilders">—</td>
+          <td class="colTags" id="selfTags">—</td>
           <td class="right colStatus"><span class="chip calm"><span class="cdot"></span>—</span></td>
           <td class="colGo"><a class="btn small ghost" href="#" data-self-open>Open →</a></td>
         </tr>
@@ -568,6 +572,18 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     if (!me) return 'none';
     return me.rank === 'archon' ? 'owner' : 'builder';
   }
+  /* A tag is a module the project RUNS beyond the core set — a fact it declares
+     about itself, not a guess about what it is. Capped so one heavily-moduled
+     project cannot blow the column open; the overflow is counted, never hidden
+     silently. null = we could not ask (em dash); [] = asked, runs nothing beyond
+     core, which is a real answer and still reads as a dash in the cell. */
+  var TAG_CAP = 3;
+  function tagsHtml(tags) {
+    if (!Array.isArray(tags) || !tags.length) return '—';
+    var shown = tags.slice(0, TAG_CAP).map(function (t) { return '<span>' + esc(t) + '</span>'; });
+    if (tags.length > TAG_CAP) shown.push('<span>+' + (tags.length - TAG_CAP) + '</span>');
+    return '<span class="tags">' + shown.join('') + '</span>';
+  }
   function matchesMapQuery(p, q) {
     if (!q) return true;
     return (String(p.name || '') + ' ' + String(p.tagline || '')).toLowerCase().indexOf(q) !== -1;
@@ -622,6 +638,13 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
           accentOf(p) + '"></span>' +
           '<span><span class="ptitle">' + esc(p.name) + '</span>' + pill + '<br>' +
           '<span class="ptag">' + esc(p.tagline || '') + '</span></span></span></td>' +
+        /* Builders and Runs come from the project's OWN public API, enriched
+           server-side (task 1002771). null is unknown — the project was
+           unreachable — and an em dash says exactly that. 0 is a real answer and
+           renders as 0, because "nobody has joined yet" is a different fact from
+           "we could not ask". */
+        '<td class="right num">' + (p.builders == null ? '—' : esc(String(p.builders))) + '</td>' +
+        '<td class="colTags">' + tagsHtml(p.tags) + '</td>' +
         /* liveness on a catalog row is NOT probed by this surface. A chip that
            said "live" here would claim more than anything verified (C6); the
            verification overlay on owned orbs is its own task. */
@@ -641,6 +664,15 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     });
     list.sort(function (x, y) {
       if (mapSort.key === 'name') return String(x.name || '').localeCompare(String(y.name || '')) * mapSort.dir;
+      /* unknown (null) sorts to the BOTTOM in both directions — it is not a low
+         number, and letting it ride the comparator would rank "we could not ask"
+         above a project that honestly has one builder */
+      if (mapSort.key === 'builders') {
+        if (x.builders == null && y.builders == null) return 0;
+        if (x.builders == null) return 1;
+        if (y.builders == null) return -1;
+        return (x.builders - y.builders) * mapSort.dir;
+      }
       return 0;
     });
     renderOrbs(list);
@@ -759,6 +791,25 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     if (ev.key === 'Escape') closeCard();
   });
 
+  /* The platform's own row is not in the catalog (it is synthesized — task
+     1002760), so the server-side enrichment never sees it. It can answer for
+     itself though: this is its own origin, so one same-origin call gets the same
+     number by the same rule the server applies to everyone else — real builders,
+     machine accounts excluded. Its Runs cell stays a dash honestly: every module
+     this instance enables is a CORE module, so it declares nothing beyond the
+     baseline and there is no tag to show. */
+  function loadSelfStats() {
+    return fetch(API + '/public/leaderboard', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (d) {
+        var rows = (d && d.leaderboard) || [];
+        if (!rows.length) return;
+        var real = rows.filter(function (b) { return !/-system$/.test(String(b.github_login || '')); });
+        $('selfBuilders').textContent = String(real.length);
+      })
+      .catch(function () { /* unreachable → the dash already in the markup stands */ });
+  }
+
   function loadCatalog() {
     fetch(API + '/projects/featured', { credentials: 'same-origin' })
       .then(function (res) { if (!res.ok) throw new Error('catalog'); return res.json(); })
@@ -1467,7 +1518,9 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     })
     /* the catalog is PUBLIC, so it loads either way — the map is the view a
        signed-out stranger lands on and it must not depend on identity */
-    .then(loadCatalog, loadCatalog);
+    .then(loadCatalog, loadCatalog)
+    /* the platform's own count is public too, so it loads either way */
+    .then(loadSelfStats, loadSelfStats);
 })();
 </script>
 </body>

package/scripts/gds/dev-lib.js

@@ -112,6 +112,7 @@ function resolveRunParams({
   env = process.env,
   userInfo = os.userInfo,
   argv = [],
+  mode = null,
 } = {}) {
   const facts = loadBrandingFacts({ instanceRoot, coreRoot, f });
   const modules = readJsonSafe(path.join(instanceRoot, 'config', 'modules.json'), f) || {};
@@ -119,6 +120,9 @@ function resolveRunParams({
 
   const portOverride = argFrom(argv, '--port');
   const dbOverride = argFrom(argv, '--db');
+  // 'server' = a real host (systemd-supervised, no auto-login, outward health
+  // probe); 'local' = the ADR 0149 laptop path. Same six steps either way.
+  const runMode = mode || (argv.includes('--server') ? 'server' : 'local');
 
   const port = portOverride ? parsePort(`http://x:${portOverride}`, parsePort(facts.publicOrigin)) : parsePort(facts.publicOrigin);
   const dbName = deriveDbName({ brandingDbName: facts.brandingDbName, instanceRoot, override: dbOverride });
@@ -126,16 +130,19 @@ function resolveRunParams({
   let pgUser = env.PGUSER;
   if (!pgUser) { try { pgUser = userInfo().username; } catch { pgUser = undefined; } }
 
+  const publicOrigin = facts.publicOrigin.replace(/\/+$/, '');
+
   return {
     instanceRoot,
     coreRoot,
+    mode: runMode,
     port,
-    host: HOST,
+    host: deriveBindHost({ publicOrigin, mode: runMode, override: argFrom(argv, '--bind') || env.HOST }),
     dbName,
     pgHost: env.PGHOST || 'localhost',
     pgUser,
     pgPassword: env.PGPASSWORD || undefined,
-    publicOrigin: facts.publicOrigin.replace(/\/+$/, ''),
+    publicOrigin,
     firstAdmin: facts.firstAdmin,
     envPrefix: facts.envPrefix,
     configDir: facts.configDir,
@@ -257,7 +264,7 @@ function stop(params, deps = {}) {
 // /healthz (needs no DB); authConfigured comes from /api/gds/healthz.
 async function health(params, deps = {}) {
   const fetchImpl = deps.fetchImpl || fetch;
-  const base = `http://${HOST}:${params.port}`;
+  const base = `http://${probeHost(params)}:${params.port}`;
   const timeout = deps.healthTimeoutMs || 4000;
   let up = false;
   try {
@@ -300,10 +307,209 @@ function depsInstallPlan({ instanceRoot, f = fs } = {}) {
     : { needed: true, cmd: 'install', args: ['install'] };
 }
 
+// ===================== SERVER MODE (task 1002398, ADR 0162) =====================
+// The SAME boot path — deps -> Postgres -> createdb -> migrate -> env -> server ->
+// health — retargeted at a real host. Four decisions differ from local, and every
+// one of them is a pure function here so tests/dev_lib.mjs can prove it without a
+// host: where to bind, how to start Postgres, how the DB role gets bootstrapped
+// under peer auth, and what supervises the process.
+
+// `bongos serve stop` arrives as argv ['--server','stop'] once bin/bongos.js
+// prefixes the mode flag, and `--port 3006 status` puts a VALUE where the old
+// `argv[0]` scan looked for the subcommand. Resolve the subcommand by skipping
+// flags and the values they consume, so flag order never changes the verb.
+const VALUE_FLAGS = new Set(['--port', '--db', '--bind', '--user', '--env-file']);
+
+function parseSub(argv = [], fallback = 'up') {
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--') break;
+    if (a.startsWith('-')) { if (VALUE_FLAGS.has(a)) i++; continue; }
+    return a;
+  }
+  return fallback;
+}
+
+// Where the server binds. Local is always loopback. On a real host the right
+// answer is derivable from the origin the instance is CONFIGURED for, so an
+// operator never has to reason about it:
+//   https://…            -> a TLS-terminating proxy fronts us  -> 127.0.0.1
+//   http://localhost:…   -> a local-shaped origin on a host     -> 127.0.0.1
+//   http://<public>:…    -> nothing in front of us yet          -> 0.0.0.0
+// An explicit --bind (or HOST in the environment) still wins over all of it.
+function deriveBindHost({ publicOrigin, mode = 'local', override } = {}) {
+  if (override) return String(override);
+  if (mode !== 'server') return HOST;
+  let u;
+  try { u = new URL(String(publicOrigin)); } catch { return HOST; }
+  if (u.protocol === 'https:') return HOST;
+  if (u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '::1') return HOST;
+  return '0.0.0.0';
+}
+
+// The address to PROBE for health. Binding 0.0.0.0 still answers on loopback;
+// binding one specific address does not, so probe whatever we actually bound.
+function probeHost(params = {}) {
+  const h = params.host || HOST;
+  return (h === '0.0.0.0' || h === '::') ? HOST : h;
+}
+
+function serviceName(params) { return `bongos-${sanitizeDbName(params.dbName) || 'instance'}`; }
+function unitPath(params, { systemdDir = '/etc/systemd/system' } = {}) {
+  return path.posix.join(systemdDir, `${serviceName(params)}.service`);
+}
+// Secrets (PGPASSWORD, GitHub OAuth creds) belong in a root-owned 0600 file the
+// unit references, NEVER in Environment= lines — `systemctl show` and the journal
+// expose those to any user on the box.
+function envFilePath(params, { etcBase = '/etc/bongos' } = {}) {
+  return path.posix.join(etcBase, `${serviceName(params)}.env`);
+}
+
+// The unit's Environment= set: ONLY the keys the boot path resolves. Deliberately
+// not buildEnv() — that spreads the caller's whole environment, which under
+// systemd would bake a builder's shell (tokens included) into a root-owned file.
+function unitEnvironment(params) {
+  const pairs = [
+    ['PORT', String(params.port)],
+    ['HOST', params.host],
+    ['PGHOST', params.pgHost],
+    ['PGDATABASE', params.dbName],
+    ['NODE_ENV', 'production'],
+  ];
+  if (params.pgUser) pairs.push(['PGUSER', params.pgUser]);
+  if (params.gdsOnly) pairs.push(['MEDUSA_GDS_ONLY', '1']);
+  pairs.push([`${params.envPrefix}_INSTANCE_ROOT`, params.instanceRoot]);
+  return pairs;
+}
+
+// systemd accepts Environment="K=v with spaces"; quote every value so a path with
+// a space (or a quote) can't split the assignment.
+function quoteUnitValue(v) { return `"${String(v).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`; }
+
+function renderSystemdUnit(params, { nodePath = process.execPath, user, group, envFile } = {}) {
+  const env = unitEnvironment(params).map(([k, v]) => `Environment=${quoteUnitValue(`${k}=${v}`)}`);
+  const lines = [
+    '[Unit]',
+    `Description=Cloud Bongos instance ${params.dbName} (bongos serve)`,
+    'Wants=network-online.target',
+    // postgresql.service may not exist (managed/remote DB) — After= on an absent
+    // unit is a no-op, so this is safe either way and orders us correctly when it
+    // IS local. No Requires=: a remote-DB host must still boot.
+    'After=network-online.target postgresql.service',
+    '',
+    '[Service]',
+    'Type=simple',
+    `WorkingDirectory=${params.instanceRoot}`,
+    `ExecStart=${nodePath} ${serverEntry(params)}`,
+    ...env,
+    `EnvironmentFile=-${envFile || envFilePath(params)}`,
+    // Survive a crash AND a reboot — the whole point of moving off the pid file.
+    'Restart=always',
+    'RestartSec=3',
+    'NoNewPrivileges=yes',
+    'StandardOutput=journal',
+    'StandardError=journal',
+  ];
+  if (user) lines.push(`User=${user}`);
+  if (group) lines.push(`Group=${group}`);
+  lines.push('', '[Install]', 'WantedBy=multi-user.target', '');
+  return lines.join('\n');
+}
+
+// Can this host supervise with systemd, and do we need sudo to install the unit?
+function systemdPlan({ platform = process.platform, has = () => false, isRoot = false } = {}) {
+  if (platform !== 'linux') return { available: false, reason: `systemd is linux-only (this host is ${platform})` };
+  if (!has('systemctl')) return { available: false, reason: 'systemctl is not on PATH' };
+  if (isRoot) return { available: true, sudo: false };
+  if (!has('sudo')) return { available: false, reason: 'installing a unit needs root, and sudo is not on PATH' };
+  return { available: true, sudo: true };
+}
+
+// Prefix a step with non-interactive sudo when we are not already root. `sudo -n`
+// never prompts: on a host without passwordless sudo it fails fast with a clear
+// error instead of hanging a deploy on a hidden password prompt.
+function withSudo(step, { isRoot = false, sudo = true } = {}) {
+  if (isRoot || !sudo) return step;
+  return { ...step, cmd: 'sudo', args: ['-n', step.cmd, ...step.args] };
+}
+
+// Ordered candidates for "start Postgres", best-first for the platform. dev.js
+// tries each until pg_isready passes. Homebrew keeps its own branch there (the
+// formula name has to be discovered at runtime); everything else is decided here.
+function pgStartPlan({ platform = process.platform, has = () => false, env = process.env, isRoot = false } = {}) {
+  const out = [];
+  if (platform === 'darwin' && has('brew')) out.push({ cmd: 'brew', args: ['services', 'start'], needsFormula: true, label: 'Homebrew' });
+  if (platform === 'linux') {
+    if (has('systemctl')) out.push(withSudo({ cmd: 'systemctl', args: ['start', 'postgresql'], label: 'systemd' }, { isRoot }));
+    else if (has('service')) out.push(withSudo({ cmd: 'service', args: ['postgresql', 'start'], label: 'service' }, { isRoot }));
+  }
+  if (has('pg_ctl') && env.PGDATA) out.push({ cmd: 'pg_ctl', args: ['start', '-w', '-D', env.PGDATA], label: 'pg_ctl' });
+  return out;
+}
+
+// Postgres identifiers are case-folded unless quoted, and a role name reaches the
+// server as SQL text — quote it properly and refuse anything that isn't a plain
+// identifier rather than interpolating a surprise into a CREATE ROLE.
+const SAFE_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function quoteIdent(s) { return `"${String(s).replace(/"/g, '""')}"`; }
+
+// The fresh-Debian wall: `apt-get install postgresql` creates exactly ONE role,
+// `postgres`, reachable only by peer auth as the postgres OS user. A deploy user
+// running `createdb` gets 'role "deploy" does not exist' — which reads like a
+// broken install and is really just an unbootstrapped cluster. These two steps,
+// run as the postgres superuser, are the whole fix.
+function pgBootstrapPlan({ pgUser, dbName, isRoot = false, has = () => false } = {}) {
+  if (!pgUser || !SAFE_IDENT.test(pgUser)) return { ok: false, reason: `refusing to bootstrap an unsafe role name: ${pgUser || '(none)'}` };
+  if (!dbName || !SAFE_IDENT.test(dbName)) return { ok: false, reason: `refusing to bootstrap an unsafe database name: ${dbName || '(none)'}` };
+  // Reach the postgres superuser the way this host allows: `sudo -u postgres` for
+  // a normal deploy user (and for root when sudo exists), else `su postgres -c`
+  // when we are already root on a minimal image with no sudo installed.
+  let asPostgres;
+  if (has('sudo')) asPostgres = (cmd, args, label) => ({ cmd: 'sudo', args: ['-n', '-u', 'postgres', cmd, ...args], label });
+  else if (isRoot) asPostgres = (cmd, args, label) => ({ cmd: 'su', args: ['postgres', '-c', shellJoin([cmd, ...args])], label });
+  else return { ok: false, reason: 'bootstrapping the role needs the postgres superuser (root or sudo)' };
+
+  return {
+    ok: true,
+    steps: [
+      { ...asPostgres('psql', ['-v', 'ON_ERROR_STOP=1', '-tAc',
+        `SELECT 1 FROM pg_roles WHERE rolname='${pgUser}'`], 'check role'), id: 'check-role' },
+      { ...asPostgres('psql', ['-v', 'ON_ERROR_STOP=1', '-c',
+        `CREATE ROLE ${quoteIdent(pgUser)} LOGIN CREATEDB`], 'create role'), id: 'create-role' },
+      { ...asPostgres('createdb', ['-O', pgUser, dbName], 'create database'), id: 'create-db' },
+    ],
+  };
+}
+
+// Quote an argv into a single `su -c` string. Only ever fed argv this module
+// built from validated identifiers, but quote anyway — `su -c` is a shell.
+function shellJoin(argv) {
+  return argv.map((a) => (/^[A-Za-z0-9_@%+=:,./-]+$/.test(a) ? a : `'${String(a).replace(/'/g, `'\\''`)}'`)).join(' ');
+}
+
+// Health as seen from OUTSIDE — does the origin the instance advertises actually
+// answer? On a server that also exercises DNS, the proxy, and TLS, which the
+// loopback probe cannot see. Advisory: DNS may legitimately not be wired yet.
+async function publicHealth(params, deps = {}) {
+  const fetchImpl = deps.fetchImpl || fetch;
+  const timeout = deps.healthTimeoutMs || 6000;
+  try {
+    const r = await fetchImpl(`${params.publicOrigin}/healthz`, { signal: AbortSignal.timeout(timeout) });
+    return { reachable: r.status < 500, status: r.status };
+  } catch (e) {
+    return { reachable: false, error: e && e.message ? e.message : String(e) };
+  }
+}
+
 module.exports = {
   HOST, DEFAULT_PORT, CORE_ROOT,
   readJsonSafe, loadBrandingFacts, parsePort, sanitizeDbName, deriveDbName,
   resolveRunParams, buildEnv, authWillWork, depsInstallPlan,
   slug, pidPath, logPath, readPid, pidAlive, isRunning, serverEntry,
   startDetached, stop, health, argFrom,
+  // server mode (task 1002398). withSudo/quoteIdent/shellJoin stay private —
+  // they are implementation details of the plans above, not a callable surface.
+  parseSub, deriveBindHost, probeHost, serviceName, unitPath, envFilePath,
+  unitEnvironment, renderSystemdUnit, systemdPlan, pgStartPlan,
+  pgBootstrapPlan, publicHealth,
 };