@bongos/core 1.19.1034 → 1.19.1036

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1034",
+  "version": "1.19.1036",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1034",
+      "version": "1.19.1036",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1034",
+  "version": "1.19.1036",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7477,5 +7477,25 @@
       "id": "1004288",
       "text": "The setup instructions an AI assistant follows on a fresh copy of a project no longer claim the core package is private, so a real download failure is no longer mistaken for normal."
     }
+  ],
+  "1.19.1035": [
+    {
+      "id": "1004275",
+      "text": "Marking a task shipped by hand now recognises work that already reached the project through its own merged request, instead of refusing it and making the builder wait for the automatic check minutes later."
+    },
+    {
+      "id": "1002669",
+      "text": "The owner can now check from their own laptop what the automatic background jobs decided and when the project's core software was last upgraded, instead of logging into the server to find out."
+    }
+  ],
+  "1.19.1036": [
+    {
+      "id": "1004286",
+      "text": "Pressing delete on the platform's own server is still refused, and now it no longer quietly cancels a restart you had already asked for."
+    },
+    {
+      "id": "1004174",
+      "text": "The owner of a hosted project can now upgrade it themselves: the \"you're behind\" banner on their project links to the Deploy page on the hub, which lets a project's owner move their own project, and only their own."
+    }
   ]
 }

package/scripts/gds/provision-core-upgrade.js

@@ -140,6 +140,16 @@ function targetFault(to, available, installed, channel, channelAllows) {
   return null;
 }
 
+// The builder id a queued move is attributed to, from the actor the web tier recorded.
+// PURE. Two doors reach the move (ADR 0339): an Archon (`api:archon:<id>`) and, since
+// task 1004174, the project's own owner (`api:owner:<id>`). Both carry the id, because
+// it becomes `--requested-by` on the core_upgrades ledger (ADR 0293 D5). Anything else
+// yields '' — the id is interpolated into a shell command, so only digits ever pass.
+function requestedByOf(intent) {
+  const m = intent && typeof intent.requested_by === 'string' && /^api:(?:archon|owner):(\d+)$/.exec(intent.requested_by);
+  return m ? m[1] : '';
+}
+
 /**
  * Perform a queued core-pin move. Returns { ok } — NEVER throws for an expected refusal.
  *
@@ -224,9 +234,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   // it the pin lives only in the working tree, and the next pull-deploy resets it away —
   // the silent thirteen-release revert upgrade.js's own header records.
   const versionUrl = `http://127.0.0.1:${inst.port}/version`;
-  const requestedBy = intent.requested_by && /^api:archon:(\d+)$/.test(intent.requested_by)
-    ? intent.requested_by.replace(/^api:archon:/, '')
-    : '';
+  const requestedBy = requestedByOf(intent);
   // Built by the SAME function the preview uses, so "what you were shown" and "what runs"
   // cannot drift apart into two hand-maintained flag lists (task 1004121).
   // The preview probes; the move must probe identically or the two commands diverge on
@@ -982,4 +990,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { UPGRADE_SHAPES, CHANGE_CAP, REPO_NOTES, repoNote, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { UPGRADE_SHAPES, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };

package/src/bongos/auth.js

@@ -461,7 +461,13 @@ const PAGE_GATES = Object.freeze({
   // preview discloses the exact core version the box serves and how far behind it is
   // — a vulnerability window, and exactly the kind of topology ADR 0043 keeps off
   // unauthenticated surfaces.
-  requireCorePinPage: Object.freeze({ permission: 'core.pin.move', deniedTo: '/builders' }),
+  //
+  // SINCE ADR 0339 (task 1004174) its routes admit a SECOND audience — a hosted
+  // project's own owner, for that project only — so the shell follows through the same
+  // `alsoAdmits` door /people uses (ADR 0210). It admits the SHELL for an owner of any
+  // live project; which project they may read or move is still the routes' question,
+  // asked per request against that project's row.
+  requireCorePinPage: Object.freeze({ permission: 'core.pin.move', deniedTo: '/builders', alsoAdmits: 'isProjectOwner' }),
   // The /fleet cost page (task 1001949) — on `provisioning.fleet.manage`, the SAME atom
   // its one read (GET /provisioning/fleet/cost-ledger) checks: every owner's projects
   // and what they cost, so the page reaches exactly as far as the data does.
@@ -469,7 +475,7 @@ const PAGE_GATES = Object.freeze({
 });
 
 // The `alsoAdmits` door — "is this visitor the page's OTHER audience?", asked of
-// the module that owns the answer, only for the one gate that declares one.
+// the module that owns the answer, only for a gate that declares one.
 //
 // FAIL-CLOSED, EVERY WAY IT CAN FAIL: a gate with no `alsoAdmits`, a hub module
 // that is off (every non-hub instance), a port that never grew the function, or a

package/src/bongos/core-update.js

@@ -144,4 +144,26 @@ async function readCoreUpdate({ running, channel, get, ...deps } = {}) {
   return coreUpdateVerdict({ running, available: r.ok ? r.versions : [], channel });
 }
 
-module.exports = { readCoreUpdate };
+// readCoreUpgrades — the instance's own core-upgrade ledger, newest first: when the
+// core pin last moved, from which version to which, and who or what moved it (task
+// 1002669). `core_upgrades` is written by `bongos upgrade` on every successful move and
+// rollback (scripts/gds/upgrade.js), including the unattended patch sweep's, and no
+// route read it — so "when did the pin last move" needed an SSH session. The pool is
+// injectable so the test runs with no database; the default is the instance's own.
+async function readCoreUpgrades({ limit = 20, pool = null } = {}) {
+  const db = pool || require('./pool').pool;
+  const { rows } = await db.query(
+    `SELECT id, from_version, to_version, source_commit, note, applied_at, source, requested_by_builder_id
+       FROM core_upgrades
+      ORDER BY applied_at DESC, id DESC
+      LIMIT $1`,
+    [limit]
+  );
+  return rows.map((r) => ({
+    ...r,
+    id: String(r.id),
+    requested_by_builder_id: r.requested_by_builder_id == null ? null : String(r.requested_by_builder_id),
+  }));
+}
+
+module.exports = { readCoreUpdate, readCoreUpgrades };

package/src/bongos/routes/core-update.js

@@ -21,9 +21,35 @@
 const express = require('express');
 const { asyncHandler } = require('./_helpers');
 const auth = require('../auth');
-const { readCoreUpdate } = require('../core-update');
+const { readCoreUpdate, readCoreUpgrades } = require('../core-update');
+const { loadIdpConfig } = require('../auth-config');
 
-module.exports = function buildCoreUpdateRouter() {
+// WHERE A HOSTED PROJECT'S OWNER TAKES THE UPGRADE (task 1004174, ADR 0339): the hub's
+// own deploy door, scoped to this project — `<hub>/deploy?project=<slug>`. The act stays
+// on the control plane (ADR 0293 D1); this instance only names the address, so it gains
+// no capability. Both halves are already here on a federated project: provisioning
+// writes the hub origin and this project's hub client id, which IS its slug (ADR 0246),
+// into web.env. null when this instance is not federated with a hub — a self-hosted
+// instance, or the hub itself — so the hall offers no link rather than a wrong one.
+// Only the origin and the client id are read; the client secret never leaves auth-config.
+function hubDeployUrl(config) {
+  if (!config || typeof config.origin !== 'string' || !config.clientId) return null;
+  if (!/^https?:\/\/[^\s"'<>]+$/i.test(config.origin)) return null;
+  return `${config.origin.replace(/\/+$/, '')}/deploy?project=${encodeURIComponent(String(config.clientId))}`;
+}
+
+function safeIdpConfig() {
+  try { return loadIdpConfig(); } catch { return null; }
+}
+
+// ?limit for GET /core-upgrades: an integer 1..100, else 20.
+function upgradesLimit(raw) {
+  const n = Number.parseInt(String(raw ?? ''), 10);
+  if (!Number.isFinite(n)) return 20;
+  return Math.min(100, Math.max(1, n));
+}
+
+function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
   const router = express.Router();
 
   router.get(
@@ -41,9 +67,30 @@ module.exports = function buildCoreUpdateRouter() {
       // that cannot name its own core reports `no_answer` and renders no banner.
       let running = null;
       try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
-      res.json({ ok: true, update: await readCoreUpdate({ running }) });
+      res.json({ ok: true, update: await readCoreUpdate({ running }), deploy_url: hubDeployUrl(safeIdpConfig()) });
     }, { errorCode: 'core_update_failed', message: false }),
   );
 
+  // GET /core-upgrades — the instance's own core-upgrade ledger, newest first: when
+  // the pin last moved, from and to which version, and whether a person or the
+  // unattended sweep moved it (task 1002669). READ-ONLY. Gated on the SAME atom as
+  // /core-update above and the deploy door, for the same first reason: it names the
+  // exact core this box has run and when, which is a vulnerability-window disclosure
+  // (ADR 0043). No new atom, so no migration. ?limit=1..100 (default 20).
+  router.get(
+    '/core-upgrades',
+    auth.requireBuilder,
+    auth.requirePermission('core.pin.move'),
+    asyncHandler('GET /core-upgrades', async (req, res) => {
+      let running = null;
+      try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
+      const limit = upgradesLimit(req.query.limit);
+      res.json({ ok: true, running, limit, upgrades: await upgrades({ limit }) });
+    }, { errorCode: 'core_upgrades_unreadable', message: false }),
+  );
+
   return router;
-};
+}
+
+module.exports = buildCoreUpdateRouter;
+module.exports.hubDeployUrl = hubDeployUrl;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1034'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1036'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');