@bongos/core 1.19.1033 → 1.19.1034

package/modules/provisioning/routes/env-manifest.js

@@ -24,6 +24,7 @@ const api = require('../../../src/module-api');
 const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const envManifest = require('../env-manifest');
+const { failFrom } = require('../public-refusal');
 
 const log = api.logger('provisioning');
 
@@ -119,7 +120,7 @@ module.exports = function buildEnvManifestRouter() {
       });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id/env-manifest', err);
-      res.fail('env_manifest_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'env_manifest_failed');
     }
   });
 
@@ -147,7 +148,7 @@ module.exports = function buildEnvManifestRouter() {
       res.status(created ? 201 : 200).json({ ok: true, created, env_var: row, values_held: false });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/env-manifest', err);
-      res.fail('env_manifest_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'env_manifest_failed');
     }
   });
 
@@ -174,7 +175,7 @@ module.exports = function buildEnvManifestRouter() {
       res.json({ ok: true, env_var: row, values_held: false });
     } catch (err) {
       log.error('[provisioning] PATCH /provisioning/instances/:id/env-manifest/:varId', err);
-      res.fail('env_manifest_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'env_manifest_failed');
     }
   });
 
@@ -193,7 +194,7 @@ module.exports = function buildEnvManifestRouter() {
         message: 'Declaration removed. The variable\'s value, wherever you keep it, is untouched — this platform never had it.' });
     } catch (err) {
       log.error('[provisioning] DELETE /provisioning/instances/:id/env-manifest/:varId', err);
-      res.fail('env_manifest_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'env_manifest_failed');
     }
   });
 

package/modules/provisioning/routes/provisioning.js

@@ -62,6 +62,7 @@ const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285,
 const { callbackPage } = require('./callback-page');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
 const { badProjectDetail, badModuleSelection, badProjectType } = require('./body-validators');
+const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
 // the kernel ports this module provides (moved out at the size ratchet, task 1003578)
 const { registerProvisioningSeams } = require('../seams');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -211,7 +212,7 @@ module.exports = function provisioningRoutes() {
       res.json({ instances: rows.map(fleetInstance), capacity: await capacity.fleetCapacity(pool).catch(() => null) });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/fleet', err);
-      res.fail('fleet_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'fleet_failed');
     }
   });
 
@@ -226,7 +227,7 @@ module.exports = function provisioningRoutes() {
       res.json(out);
     } catch (err) {
       log.error('[provisioning] GET /provisioning/fleet/cost-ledger', err);
-      res.fail('cost_ledger_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'cost_ledger_failed');
     }
   });
 
@@ -279,7 +280,7 @@ module.exports = function provisioningRoutes() {
         message: r.created ? 'The instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/force-teardown', err);
-      res.fail('teardown_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'teardown_failed');
     }
   });
 
@@ -518,7 +519,7 @@ module.exports = function provisioningRoutes() {
       // Another instance took the address between the check above and the INSERT (task 1002901).
       if (provisioning.isDomainTaken(err)) return res.fail('domain_taken', { status: 409, message: 'That address is already held by another instance.' });
       log.error('[provisioning] POST /provisioning/instances', err);
-      res.fail('request_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'request_failed');
     }
   });
 
@@ -566,7 +567,7 @@ module.exports = function provisioningRoutes() {
       res.json({ slug, available: reason === null, reason, address: address || null });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/slug-available', err);
-      res.fail('check_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'check_failed');
     }
   });
 
@@ -586,7 +587,7 @@ module.exports = function provisioningRoutes() {
       res.json({ instances });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances', err);
-      res.fail('list_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'list_failed');
     }
   });
 
@@ -630,7 +631,7 @@ module.exports = function provisioningRoutes() {
       });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id', err);
-      res.fail('read_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'read_failed');
     }
   });
 
@@ -750,7 +751,7 @@ module.exports = function provisioningRoutes() {
       });
     } catch (err) {
       log.error('[provisioning] PATCH /provisioning/instances/:id/detail', err);
-      res.fail('detail_update_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'detail_update_failed');
     }
   });
 
@@ -805,7 +806,7 @@ module.exports = function provisioningRoutes() {
       res.json({ suggested, seeking: invites.seeking, reason: invites.reason });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id/invite-suggestions', err);
-      res.fail('invite_suggestions_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'invite_suggestions_failed');
     }
   });
 
@@ -830,7 +831,7 @@ module.exports = function provisioningRoutes() {
         options: { ...provisioning.SETTINGS_VOCAB, ...provisioning.PLANET_VOCAB } });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id/settings', err);
-      res.fail('settings_read_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'settings_read_failed');
     }
   });
 
@@ -983,7 +984,7 @@ module.exports = function provisioningRoutes() {
       res.json({ ok: true, saved: provisioning.effectiveSettings(updated), planet: provisioning.planetChoice(updated), push });
     } catch (err) {
       log.error('[provisioning] PATCH /provisioning/instances/:id/settings', err);
-      res.fail('settings_update_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'settings_update_failed');
     }
   });
 
@@ -1020,7 +1021,7 @@ module.exports = function provisioningRoutes() {
         message: r.created ? 'Your instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/teardown', err);
-      res.fail('teardown_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'teardown_failed');
     }
   });
 
@@ -1079,7 +1080,7 @@ module.exports = function provisioningRoutes() {
         : 'A restart is already under way for this project.' });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/restart', err);
-      res.fail('restart_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'restart_failed');
     }
   });
 
@@ -1224,7 +1225,7 @@ module.exports = function provisioningRoutes() {
       // Same race on the attach side: the index refuses the UPDATE, so nothing is recorded and nothing is enqueued.
       if (provisioning.isDomainTaken(err)) return res.fail('domain_taken', { status: 409, message: 'That address is already in use by another instance.' });
       log.error('[provisioning] POST /provisioning/instances/:id/domain', err);
-      res.fail('domain_attach_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'domain_attach_failed');
     }
   });
 
@@ -1282,7 +1283,7 @@ module.exports = function provisioningRoutes() {
       });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/github-app', err);
-      res.fail('github_app_manifest_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'github_app_manifest_failed');
     }
   });
 

package/modules/provisioning/routes/repo-private.js

@@ -16,6 +16,7 @@ const api = require('../../../src/module-api');
 const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const repoPrivate = require('../repo-private');
+const { failFrom } = require('../public-refusal');
 
 const log = api.logger('provisioning');
 
@@ -74,7 +75,7 @@ module.exports = function buildRepoPrivateRouter() {
           : 'Making the repository private is already under way for this project.' });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/repo-private', err);
-      res.fail('repo_private_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'repo_private_failed');
     }
   });
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1033",
+  "version": "1.19.1034",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1033",
+      "version": "1.19.1034",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1033",
+  "version": "1.19.1034",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7379,6 +7379,46 @@
     }
   ],
   "1.19.1033": [
+    {
+      "id": "1004179",
+      "text": "If the overnight builder can't start its worker at all, it now notices and slows down instead of quietly working through your whole task list breaking things."
+    },
+    {
+      "id": "1003648",
+      "text": "If a change is ever too big for one of the automatic reviewers, it now tries again with less attached material instead of silently failing — and the failure is recognised for what it is."
+    },
+    {
+      "id": "1002863",
+      "text": "Every change to the core is now automatically installed the way a brand-new project installs it, given a fresh empty database, and checked that the app really runs on that database — so a release that cannot set up its own dat"
+    },
+    {
+      "id": "1004126",
+      "text": "When the platform refuses a project action (for example, taking its own server offline), the owner now sees the real reason instead of \"internal error\"."
+    },
+    {
+      "id": "1004287",
+      "text": "A code comment in the shipping tool now describes what one of its helpers actually returns; nothing a user sees changes."
+    },
+    {
+      "id": "1001441",
+      "text": "A new Cloud Bongos project can now configure its build-and-ship settings with its own standard names, instead of names inherited from the original project; the old names still work."
+    },
+    {
+      "id": "1002839",
+      "text": "The grader that checks every shipped task now runs through one central engine that future kinds of work can plug into; its verdicts are unchanged, checked against 376 real past grades."
+    },
+    {
+      "id": "1003647",
+      "text": "The sample data used to preview the builder website no longer contains real people's names, photos, accounts or money figures; stand-ins are written instead, automatically, every time the samples are refreshed."
+    },
+    {
+      "id": "1002903",
+      "text": "When an automatic reviewer gives work a low mark without naming a problem, the builder is now told exactly that — nothing to fix, ask again — instead of being told to fix problems that do not exist."
+    },
+    {
+      "id": "1003764",
+      "text": "When a finished task is stuck waiting to be added to the project, the tools now say which automatic test failed and how to fix it, instead of just saying \"waiting\" — and the status check no longer errors out when you ask about"
+    },
     {
       "id": "1004218",
       "text": "Every new core release now carries its own list of what changed, so the Deploy page on any project can show what an upgrade brings in, starting with the next release."
@@ -7407,5 +7447,35 @@
       "id": "1004170",
       "text": "Builders on a Mac no longer get a permanently failing local test run: the database backup scripts and two server cleanup scripts now work the same on a Mac as on the server."
     }
+  ],
+  "1.19.1034": [
+    {
+      "id": "1004273",
+      "text": "The shipping tool once again refuses to run from an out-of-date copy of itself, now that its code is split across many files, so a builder no longer gets the same unexplained ship failure over and over."
+    },
+    {
+      "id": "1002707",
+      "text": "Owners on Windows can now start their project on their own computer with one command, bongos dev, instead of being told to set up Linux or Docker first; it finds Postgres and Git Bash itself and explains any missing step in pl"
+    },
+    {
+      "id": "1002880",
+      "text": "There is now one page listing every password and key the project needs, what each is for and where it is kept, plus a one-line check the owner can run on the server to see which are already in place, so nobody is asked to crea"
+    },
+    {
+      "id": "1002843",
+      "text": "A new read-only report measures whether the four AI reviewers that grade each ship actually disagree with each other, and it refuses to give a number when there are too few real decisions to trust one."
+    },
+    {
+      "id": "1002844",
+      "text": "The grading design document now says plainly which four tools are not part of the grader and why, with a test that fails if that ever stops being true."
+    },
+    {
+      "id": "1004065",
+      "text": "When a hosted project is upgraded, the platform now tries to save the new version to the project's GitHub repository itself, and the Deploy page says plainly when it could not, instead of reporting a clean success."
+    },
+    {
+      "id": "1004288",
+      "text": "The setup instructions an AI assistant follows on a fresh copy of a project no longer claim the core package is private, so a real download failure is no longer mistaken for normal."
+    }
   ]
 }

package/scripts/gds/autobongos-run.js

@@ -49,6 +49,7 @@ const fence = require('../../modules/autonomy/fence.js');
 // where it would not be inside modules/ — which is exactly why fence.js takes the
 // hits as an argument instead of matching them itself.
 const { matchProtected } = require('../../src/bongos/permission-path-check');
+const { resolveEnv, envPrefix, LEGACY_ENV_PREFIXES } = require('../../src/instance-config');
 const cadence = require('../../modules/autonomy/cadence.js');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
@@ -206,11 +207,18 @@ async function pickTask(goals, deps = {}) {
 // own required vars), to reach the instance (BONGOS_API_BASE), and to be told it
 // is a subagent. It does NOT need a git push credential — the road to main is the
 // server-mediated pipeline (ADR 0307 §6) — so none is passed.
+function claudeBinEnvNames() {
+  return [...new Set([envPrefix(), ...LEGACY_ENV_PREFIXES].map((p) => `${p}_CLAUDE_BIN`)), 'CLAUDE_BIN'];
+}
+
 const WORKER_ENV_ALLOW = [
   'PATH', 'HOME', 'SHELL', 'LANG', 'LC_ALL', 'TZ', 'TMPDIR', 'USER', 'LOGNAME',
   'SystemRoot', 'windir', 'COMSPEC', 'PATHEXT', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'TEMP', 'TMP',
   'BONGOS_API_BASE', 'CLOUDBONGOS_API_BASE',
-  'OTB_CLAUDE_BIN', 'CLAUDE_BIN',
+  // Every spelling resolveWorkerBin below can read (task 1001441): the branded
+  // <PREFIX>_CLAUDE_BIN, the legacy ones, and the unprefixed CLAUDE_BIN. A name
+  // missing here would be set on the host and silently absent in the worker.
+  ...claudeBinEnvNames(),
   'XDG_CONFIG_HOME',
   // THE WORKER'S OWN CREDENTIAL, and it has to be here (task 1003907, found by
   // running it). On a desktop, the claude CLI authenticates from the credential
@@ -257,7 +265,7 @@ const MAX_WORKER_OUTPUT = 8 * 1024 * 1024;   // a misbehaving worker must not gr
 // laid-out install should still run, and a corrupted schema surfaces as a failed
 // worker rather than as a refusal to start at all.
 function resolveWorkerBin(env = process.env, platform = process.platform) {
-  const override = env.OTB_CLAUDE_BIN || env.CLAUDE_BIN;
+  const override = resolveEnv('CLAUDE_BIN', { env }) || env.CLAUDE_BIN;
   if (override) return { bin: override, shell: platform === 'win32' && /\.(cmd|bat)$/i.test(override) };
   if (platform !== 'win32') return { bin: 'claude', shell: false };
   for (const dir of String(env.PATH || env.Path || '').split(path.delimiter)) {

package/scripts/gds/backfill-cost.js

@@ -12,23 +12,28 @@
 //
 // If no path is given, the script searches for the ledger in the
 // expected locations (current art/iterations/, sibling worktrees, or
-// $OTB_COST_LEDGER env var).
+// $<PREFIX>_COST_LEDGER env var — BONGOS_COST_LEDGER on a vanilla instance, the
+// legacy OTB_COST_LEDGER still read).
 
 const fs = require('node:fs');
 const path = require('node:path');
 const { cliClient, requireSession, fmtUsd } = require('./cli-lib');
+const { resolveEnv, envPrefix } = require('../../src/instance-config');
 // Cost-attribution audit carved into modules/economy/cost-classify.js (BV1.R77 /
 // ADR 0093 §1-2). A CLI may require a module directly (the memory/grading-carve
 // precedent — grade-smoke.js requires modules/grading/grader).
 const { auditCostAttribution, formatAuditReport } = require('../../modules/economy/cost-classify');
 
-const KNOWN_LEDGER_PATHS = [
-  process.env.OTB_COST_LEDGER,
+// The places a ledger is looked for, env override first. A function so the test can
+// hand it an env; resolved once below for the CLI.
+const knownLedgerPaths = (env = process.env) => [
+  resolveEnv('COST_LEDGER', { env }),
   path.resolve(__dirname, '../../art/iterations/cost_ledger.jsonl'),
   // Two historical absolute-path fallbacks (under the old Desktop folder name)
   // were dropped after the project-folder rename. Pass the ledger path as a CLI
-  // arg or set OTB_COST_LEDGER to point at any non-default location.
+  // arg or set <PREFIX>_COST_LEDGER to point at any non-default location.
 ];
+const KNOWN_LEDGER_PATHS = knownLedgerPaths();
 
 function findLedger(argPath) {
   const candidates = argPath ? [argPath, ...KNOWN_LEDGER_PATHS] : KNOWN_LEDGER_PATHS;
@@ -106,7 +111,7 @@ async function main() {
 
   const ledgerPath = findLedger(argPath);
   if (!ledgerPath) {
-    console.error('No cost_ledger.jsonl found. Pass a path or set OTB_COST_LEDGER.');
+    console.error(`No cost_ledger.jsonl found. Pass a path or set ${envPrefix()}_COST_LEDGER.`);
     console.error('Searched:');
     for (const p of KNOWN_LEDGER_PATHS) if (p) console.error(`  - ${p}`);
     process.exit(2);
@@ -159,7 +164,13 @@ async function main() {
   process.exit(failed > 0 ? 1 : 0);
 }
 
-main().catch((err) => {
-  console.error('backfill-cost.js failed:', err);
-  process.exit(1);
-});
+// Run only when invoked directly: requiring this file (the test does, for
+// knownLedgerPaths) must never start a backfill.
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('backfill-cost.js failed:', err);
+    process.exit(1);
+  });
+}
+
+module.exports = { knownLedgerPaths };

package/scripts/gds/claim.js

@@ -225,8 +225,8 @@ function captureHeadSha() {
 // origin/main. The completion cards + skills are CLI-script features that ride
 // the LOCAL checkout, not the deployed server — a worktree branched from a stale
 // main silently lacks them (the root cause behind the missing cards in session
-// 1c1e12d7: claimed/shipped task 1274 on old scripts). Mirrors ship.js's
-// TOOLING_PATHS preflight, but as a NUDGE — claiming on old scripts is fine, you
+// 1c1e12d7: claimed/shipped task 1274 on old scripts). Mirrors the ship's
+// TOOLING_PATHSPECS preflight (ship-preflight-steps.js), but as a NUDGE — claiming on old scripts is fine, you
 // just miss features. Strictly best-effort + fail-open (never break/slow a claim).
 const STALE_TOOLING_DIRS = ['scripts/gds', 'src/bongos', '.claude/skills'];
 function warnIfToolingStale() {