@bongos/core 1.19.1022 → 1.19.1024

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1022",
-  "core_contract": "1.19.1022",
-  "source_commit": "78c94b38feae00aa08e5c1b440d728ec55f28da1",
+  "core_version": "1.19.1024",
+  "core_contract": "1.19.1024",
+  "source_commit": "1f872aa1aae41740fd237a96d918a44b10a7eb37",
   "source_ref": "HEAD",
-  "built_at": "2026-09-25T18:53:51.798Z",
+  "built_at": "2026-09-25T19:58:25.153Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 529,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2998,
-  "tree_sha256": "8d7e5d86b5e2ae81f1ba90a090a7cacd386c3a2462e15e36053b5fd456da4928",
+  "tree_sha256": "10c61e80a11ff4a40f7719f719f309183eaa139cfef10e0d768b48cb5b5aba2d",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2222,12 +2222,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "5226255c04e9a3207de9e4cf9712cdcaf2a3fde799d76d8ed768497a271ad91b"
+      "sha256": "c43c114a44d0b4f5956e619e5248fcc67473f094c1aa9f58af0b877666a6821a"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "bf7384ef44efc40d16be639400157640c5f1a4dc746bf32bb1f80b43004ceed9"
+      "sha256": "5a0786f9cba9d26c3dc3ef41197a0ea1a00e95a068407305b86a1d880d8fd31e"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2757,7 +2757,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "fab6d085d7be616f3413e342f5b15bdac920ca925a733d0b241096eb963fe521"
+      "sha256": "fef4b48a53826405914b6b5f88bd39087b2c89791d0c22c4b807ad21a0000d7a"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5207,7 +5207,7 @@
     {
       "path": "modules/hall-ui/public/people.html",
       "mode": "0000644",
-      "sha256": "4da8ca7dc9321f3d7303332e78ec9caeb6ea65a71fa670b20f593874514585ac"
+      "sha256": "531b5b44da9f8310cdac68f7028651b9faba93537f46a7d62d2d91b534cb60ee"
     },
     {
       "path": "modules/hall-ui/public/people.js",
@@ -8312,12 +8312,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8ea99959398115dd0e10797c62e003afc4f5d9b7b1d8a868e2cfb10ac4cd3a1a"
+      "sha256": "36328e51d05e9c402d841cb01fb8c71ebc3fb1ac9ab4980d92157019d0390f74"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1c2f044ed9e03f837425f6f9836f60932f3f44fbcf9014c9cf537d6869f69b44"
+      "sha256": "7f5cea69d8281535703f3803703b34c4df2196e19284415e59152007b257208e"
     },
     {
       "path": "public-docs/index.html",
@@ -10067,7 +10067,7 @@
     {
       "path": "src/bongos/auth-github.js",
       "mode": "0000644",
-      "sha256": "e2afb2d5f5459ed307be4e6e2d57cbd283b97794f8d1a99f4df5673000270681"
+      "sha256": "9d556b0c6b4891be1aee578daf7bd62347f1dc77fe20af7ffcaeb9f61845c141"
     },
     {
       "path": "src/bongos/auth-idp.js",
@@ -10097,7 +10097,7 @@
     {
       "path": "src/bongos/db-kernel.js",
       "mode": "0000644",
-      "sha256": "dd16328ac569aa8c6af09b2700957634e2c6d368d291b015a74a8dc452dc340a"
+      "sha256": "0e346143160d09d1c9bb5e1977551222bf8d33dce9a1880537b17b1d714f719e"
     },
     {
       "path": "src/bongos/db.js",
@@ -10362,7 +10362,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ca1bd9ef0d4f4ebf2ec82a02a99bcfe7278e78ca566d8354819ab9159599700a"
+      "sha256": "e9218e1f21e4706d02bdd26c6c348c571996a23515d3b57295a71b97be5ff193"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10742,7 +10742,7 @@
     {
       "path": "tests/auth_inactive_builder.mjs",
       "mode": "0000644",
-      "sha256": "c394d1ec296d556c35f5ce8158bcc5d355774cbd81160349dee5a495a4a6d6ab"
+      "sha256": "521e4175ec619d578fe18dc23395e384f9f35be747918ed04e7d479cb0166da8"
     },
     {
       "path": "tests/auth_page_gate.mjs",
@@ -13327,7 +13327,7 @@
     {
       "path": "tests/people_name_only.mjs",
       "mode": "0000644",
-      "sha256": "a94562e7680e7153b065fa5b152e13d9880de477e7e9f2a4c9b8de0224266ead"
+      "sha256": "52885d21c83ba02f0eece097529df861ac2e01c8def1a77d7e55a07638cc076d"
     },
     {
       "path": "tests/permission_path.mjs",

package/docs/copy-inventory.md

@@ -1116,7 +1116,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `bcdbded93d4e` | certain | The work board failed to load. Reload to try again. | `modules/hall-ui/public/work.js:1492` |
 | `25794c439321` | certain | Then copy the project onto your machine and run the one-shot bootstrap (it checks your setup, installs depende | `modules/hall-ui/public/hall-render.js:890` |
 | `df316c3484de` | certain | Then drive it however you like: | `modules/hall-ui/public/hall-render.js:825` |
-| `48ace42c55ef` | certain | These builders are open to recruiting but keep their cross-project record private, so only who they are is sho | `modules/hall-ui/public/people.html:54` |
+| `bc3e5d620247` | certain | These builders are open to recruiting but keep their cross-project record hidden, so only who they are is show | `modules/hall-ui/public/people.html:54` |
 | `a0140098c0e0` | certain | They already have an invitation or a join-request pending on this goal. | `modules/hall-ui/public/goals-render.js:1303` |
 | `5151cf635644` | certain | They have asked to connect. | `modules/hall-ui/public/profile-connections.js:236` |
 | `10219b02433e` | certain | They join as a member once they accept — you can change that afterwards. Nobody is added until they do. | `modules/hall-ui/public/goals-render.js:1235` |

package/docs/copy-registry.json

@@ -11554,9 +11554,9 @@
       "confidence": "certain"
     },
     {
-      "id": "48ace42c55ef",
+      "id": "bc3e5d620247",
       "surface": "builders-hall",
-      "text": "These builders are open to recruiting but keep their cross-project record private, so only who they are is shown. They are never ranked, and a role filter never finds them.",
+      "text": "These builders are open to recruiting but keep their cross-project record hidden, so only who they are is shown. They are never ranked, and a role filter never finds them.",
       "file": "modules/hall-ui/public/people.html",
       "line": 54,
       "origin": "html-text",

package/docs/module-api-changelog.md

@@ -2523,5 +2523,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1020 with no explicit bump. run 36086047874. (task 1002620)
   1.19.1022 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1021 with no explicit bump. run 36176262855. (task 1002620)
+  1.19.1023 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1022 with no explicit bump. run 36178875275. (task 1002620)
+  1.19.1024 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1023 with no explicit bump. run 36182843374. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/people.html

@@ -51,7 +51,7 @@
              response carries a row, and people.js writes it. -->
         <section class="scroll" id="people-named-scroll" aria-labelledby="people-named-h" hidden>
           <h2 id="people-named-h" class="scroll__h">Listed by name only<span class="count-pill" id="people-named-count" hidden></span></h2>
-          <p class="scroll__lede" id="people-named-lede">These builders are open to recruiting but keep their cross-project record private, so only who they are is shown. They are never ranked, and a role filter never finds them.</p>
+          <p class="scroll__lede" id="people-named-lede">These builders are open to recruiting but keep their cross-project record hidden, so only who they are is shown. They are never ranked, and a role filter never finds them.</p>
           <div id="people-named-body"></div>
           <p class="ledger__note" id="people-named-foot" hidden></p>
         </section>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1022",
+  "version": "1.19.1024",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1022",
+      "version": "1.19.1024",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1022",
+  "version": "1.19.1024",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/auth-github.js

@@ -312,8 +312,10 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
   // callback can persist it (encrypted, short-TTL) for the repo picker/creator.
   // auth.js stays kernel-clean — it never writes the token to the DB itself; the
   // token is surfaced ONLY on this opt-in path, so an ordinary hall sign-in never
-  // even returns it.
-  const captured = captureRepoToken ? { githubToken: accessToken, githubScope: grantedScope } : {};
+  // even returns it. Never for an offboarded builder: the gate admits every existing
+  // row, and this would re-seed the token deactivateBuilder deleted (ADR 0332, task 1004245).
+  const captured = captureRepoToken && builder.status !== 'inactive'
+    ? { githubToken: accessToken, githubScope: grantedScope } : {};
   return { token, builder, expiresAt, ...captured };
 }
 

package/src/bongos/db-kernel.js

@@ -192,7 +192,7 @@ async function upsertBuilder({ githubId, githubLogin, displayName, avatarUrl })
                                       THEN 'user'
                                       ELSE 'github' END,
            avatar_url   = EXCLUDED.avatar_url
-     RETURNING id, github_id, github_login, display_name, avatar_url, total_credits, created_at, rank, preferred_disciplines`,
+     RETURNING id, github_id, github_login, display_name, avatar_url, total_credits, created_at, rank, preferred_disciplines, status`,
     [String(githubId), githubLogin, displayName, avatarUrl ?? null]
   );
   return rows[0];

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1022'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1024'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_inactive_builder.mjs

@@ -14,6 +14,9 @@
 //      so a Cookie header stuffed with dozens of gds_session=<junk> values can't
 //      amplify into dozens of per-request DB lookups (DoS).
 //
+//   3. An offboarded builder's GitHub web sign-in must not re-seed the
+//      github_oauth_tokens row deactivateBuilder deleted (task 1004245, ADR 0332).
+//
 // lookupSession is stubbed on the db module BEFORE auth.js is required, because
 // auth.js destructures it at load time. No server/DB/network.
 //
@@ -90,5 +93,86 @@ await t('extractTokens caps the candidates it returns (DoS amplification guard)'
   assert.equal(tokens[0], 'realone', 'the Bearer token is tried first');
 });
 
+// ---- web sign-in cannot re-seed an offboarded builder's GitHub token --------
+// The admission gate admits every EXISTING builder, so an inactive one still
+// completes the web flow. The fake DB runs the REAL upsertBuilder SQL and answers
+// only the columns its RETURNING list names, so this fails if `status` ever drops
+// out of that list. GitHub is a stubbed fetch; the callback is the real handler.
+const { pool } = require('../src/bongos/pool.js');
+const { envPrefix } = require('../src/instance-config.js');
+const coreDb = require('../src/bongos/db.js');
+const buildAuthRouter = require('../src/bongos/routes/auth.js');
+
+process.env[`${envPrefix()}_GITHUB_CLIENT_ID`] = 'test-client';
+process.env[`${envPrefix()}_GITHUB_CLIENT_SECRET`] = 'test-secret';
+
+const GH_TOKEN = 'gho_repo_scoped_token';
+const ROW = {
+  id: 77, github_id: '4242', github_login: 'offboarded-ghost', display_name: 'Ghost', avatar_url: null,
+  total_credits: 12, created_at: new Date(0), rank: 'xenos', preferred_disciplines: null,
+};
+let builderRow = null;
+const pick = (list) => Object.fromEntries(list.split(',').map((c) => c.trim()).map((c) => [c, builderRow[c]]));
+pool.query = async (sql) => {
+  if (/INSERT INTO builders\b/.test(sql)) return { rows: [pick(sql.split('RETURNING')[1])] };
+  if (/FROM builders WHERE github_id/.test(sql)) return { rows: [pick(sql.match(/SELECT([\s\S]*?)FROM/)[1])] };
+  return { rows: [], rowCount: 0 };
+};
+globalThis.fetch = async (url) => {
+  if (String(url) === 'https://github.com/login/oauth/access_token') {
+    return { ok: true, json: async () => ({ access_token: GH_TOKEN, scope: 'read:user,repo' }) };
+  }
+  if (String(url) === 'https://api.github.com/user') {
+    return { ok: true, json: async () => ({ id: 4242, login: ROW.github_login, name: 'Ghost', avatar_url: null }) };
+  }
+  throw new Error(`unexpected fetch in test: ${url}`);
+};
+const tokenWrites = [];
+coreDb.upsertGithubToken = async (args) => { tokenWrites.push(args); return { stored: true }; };
+
+const callback = buildAuthRouter().stack
+  .find((l) => l.route?.path === '/auth/web/callback' && l.route.methods.get).route.stack[0].handle;
+async function signInWithRepoOptIn() {
+  const req = {
+    query: { state: 'st8', code: 'c0de' }, secure: false,
+    headers: { cookie: 'gds_oauth_state=st8; gds_oauth_repos=1', host: 'localhost', 'user-agent': 'test' },
+  };
+  const res = {
+    redirectedTo: null, statusCode: 200, cookies: {},
+    cookie(name, value) { this.cookies[name] = value; return this; },
+    clearCookie() { return this; },
+    redirect(to) { this.redirectedTo = to; },
+    status(code) { this.statusCode = code; return this; },
+    type() { return this; },
+    send() { return this; },
+  };
+  await callback(req, res);
+  return res;
+}
+
+await t('offboarded builder: an opted-in web sign-in never reaches upsertGithubToken', async () => {
+  builderRow = { ...ROW, status: 'inactive' };
+  tokenWrites.length = 0;
+  const res = await signInWithRepoOptIn();
+  assert.equal(tokenWrites.length, 0, 'the token deactivateBuilder deleted must not be written back');
+  assert.ok(res.redirectedTo, 'sign-in itself is not refused: requireBuilder denies the session per request');
+});
+
+await t('offboarded builder: completeWebFlow never hands the repo token back', async () => {
+  builderRow = { ...ROW, status: 'inactive' };
+  const out = await auth.completeWebFlow({ code: 'c0de', redirectUri: 'http://localhost/cb', captureRepoToken: true });
+  assert.equal(out.githubToken, undefined);
+  assert.equal(out.githubScope, undefined);
+});
+
+await t('active builder: an opted-in web sign-in still captures the repo token (control)', async () => {
+  builderRow = { ...ROW, status: 'active' };
+  tokenWrites.length = 0;
+  await signInWithRepoOptIn();
+  assert.equal(tokenWrites.length, 1, 'the wizard repo-token capture keeps working');
+  assert.equal(tokenWrites[0].builderId, ROW.id);
+  assert.equal(tokenWrites[0].token, GH_TOKEN);
+});
+
 console.log(`\n${pass} passed, ${fail} failed`);
 process.exit(fail === 0 ? 0 : 1);

package/tests/people_name_only.mjs

@@ -149,7 +149,8 @@ await test('the page carries the name-only panel, hidden until the server sends
   assert.match(PEOPLE_HTML, /id="people-named-h"[^>]*>[^<]+<span class="count-pill" id="people-named-count" hidden>/,
     'a heading with its own count');
   const lede = (PEOPLE_HTML.match(/<p class="scroll__lede" id="people-named-lede">([^<]+)<\/p>/) || [])[1] || '';
-  assert.match(lede, /private/i, 'the lede says why these builders show no record');
+  assert.match(lede, /hidden/i, 'the lede says why these builders show no record, in the same word Settings uses (hide_stats)');
+  assert.doesNotMatch(lede, /private/i, '"private" is account_visibility\'s word, not hide_stats\'');
   assert.match(lede, /ranked/i, 'and that they are never ranked');
   assert.match(lede, /filter/i, 'and that a role filter never finds them');
   assert.match(PEOPLE_HTML, /id="people-named-body"/, 'and a mount for the ledger');