@bongos/core 1.19.1076 → 1.19.1077

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1076",
-  "core_contract": "1.19.1076",
-  "source_commit": "4135e4def362d39393077ddfeb1d1dc1a9051388",
+  "core_version": "1.19.1077",
+  "core_contract": "1.19.1077",
+  "source_commit": "8213cd0b6b6ae2e91300c953bee2bed1d3558da3",
   "source_ref": "HEAD",
-  "built_at": "2026-09-29T04:46:26.745Z",
+  "built_at": "2026-09-29T10:54:54.299Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 550,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2529,
+    "functional_verbatim": 2530,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3105,
-  "tree_sha256": "9e3b295c6b90f3d06b78b0ba7c1ba67b736ff026e40d259c30ac405836f3df3e",
+  "file_count": 3106,
+  "tree_sha256": "90651971ad753afab30ed83277bfc27c910ad7279d6264170b9045d3726e1d5f",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -322,12 +322,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "3495420fb86a9487d38759379da8ef1d27df15f601bd45529f99c5edc93572bb"
+      "sha256": "9d1e621dcf8b0a3b92cd67f700fd1d48f469d55833b494147e0a4c29be452d37"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "cda0f587bb153b2d533ba34dca76742fc2c56c1468cdc745af4a7997c36c1888"
+      "sha256": "9fcd3ca52df7d24f22ee6efcd5a0167af53835ec8bd3ffad139185a7aebb90b0"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -337,17 +337,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "397284bd88c2cd78a22a724b3311808eeae80c845a72d8eaa9a5f234d12066c5"
+      "sha256": "0bbe77783e3bf8a1dd8bc594dc28372a8c982be8e10a468f97d17ec8a5ff8cfc"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "5ca74d00f9de706dd3c22d85c96c2695030b069f7ae9bece18c1153c5d856d3f"
+      "sha256": "7aa307fe6518433b5d85216d098c1d4cfedb25995aceb5717113e2233de62f48"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "024c569bd41f1f479e9de7868341d3a68906360ac457c1a5e8382397122828a0"
+      "sha256": "a9ca2bf984f00e1b6506904f789fccf8acfedd7ca7418322f50713d82680f783"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1167,7 +1167,7 @@
     {
       "path": "docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md",
       "mode": "0000644",
-      "sha256": "a9a3e35550ead0905618da94d52bb1c5824b062ae5028745c8a5bed6112c2c6d"
+      "sha256": "7735acb6a10465a34e9c1b8ce75f045256ef0ed92bd94a5f383ddf7020afee82"
     },
     {
       "path": "docs/adr/0146-configurable-reward-mode-cost-plus-only.md",
@@ -2207,12 +2207,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "539c0a101e0643dd40869beee774540b630b63fd4a368bf92614407ec919b75f"
+      "sha256": "1b53174253962c6d9d45d3fc107770fa0af26899c7a638fa2ed8be55712a001c"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "560ee79e29357daff98ee2148842ad38251f00391a7f32928c8e221f709ccb55"
+      "sha256": "efbdeaf4b09c7113ece416afdc79b4a46a4088504d5398ce02afd4d9aa5f917e"
     },
     {
       "path": "docs/architecture.md",
@@ -2742,7 +2742,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "bbf793bc4666f224874a7c6ae58cb2c6ef1532d6a5d34b32c87f3f6bb129a27a"
+      "sha256": "3c225690f0579fca6dbada87f49ee760d816a1135a3ae8ae30dcea4983ccccc8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8597,12 +8597,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f7f09866a7769adcd0ae7c8b98b95d524c8952bc7303fb1c0a7d91ab0f84b702"
+      "sha256": "f474f9d00b0d9bdcbb709d52ebb4f1e61e24b06ebe698ea4a423a3e67bfd3abe"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "fbe7987f4279fa8c73b674d136aa26ef24617bac7a7cc1514c2ed2d5c36d056d"
+      "sha256": "9fcd91f348d585a802db0d0c881b29f64c915c1af4bebe34f3c25d76f322efb8"
     },
     {
       "path": "public-docs/index.html",
@@ -8622,7 +8622,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "265af57b3e6a412024b2c35b30940a80ad4e11250aa9a187faab6ef7407b9281"
+      "sha256": "797b5505242d566628e1fef62b4afc9e66cc77708ac3115eb48791ff15b763fe"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10392,7 +10392,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "50dcaa4253f6ceac17b1949037090d572bb85b4a26e71022d903a172e352a145"
+      "sha256": "a46826214509f317fbe982265c0045edf9c3aa4c94bd2fa54232af51cbc51573"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -10472,7 +10472,7 @@
     {
       "path": "src/bongos/middleware/rate-limit.js",
       "mode": "0000644",
-      "sha256": "2c4cb05109bd3a931acba1967e1d01e4c3c069273d22b4356211aac103a04781"
+      "sha256": "efe34f92930419444ec31d84c7787488db4984ea761d1bb77d5375388758e68c"
     },
     {
       "path": "src/bongos/module-overrides.js",
@@ -10572,7 +10572,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "da0d7ee4f2d2e76577047822a955b4fbad9f8e142592746d34c9e2fddde5a5f8"
+      "sha256": "951276d7d3bd022cd9250fe8cd7bd141278d46c4bc6bc06463867f2889e52bc3"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -10692,7 +10692,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7529243c4bf7f88a907a8e6afeb27a34fff45a4b113c27b2da60005e4fb3303e"
+      "sha256": "30a3d4c45217ac814326057165b0ff3f6627a03fb15e80586e6b602bfa9e8514"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12894,6 +12894,11 @@
       "mode": "0000644",
       "sha256": "5281b73558af27b1be5a839718d845ef47190734d248a3edb5d547c92621f432"
     },
+    {
+      "path": "tests/hub_cookie_host_only.mjs",
+      "mode": "0000644",
+      "sha256": "96698c6be76c8c6d6cc5f09522d110514c420cb1a7279ca86871a034892c7328"
+    },
     {
       "path": "tests/hub_disconnect_ui.mjs",
       "mode": "0000644",
@@ -13267,7 +13272,7 @@
     {
       "path": "tests/landing_page.mjs",
       "mode": "0000644",
-      "sha256": "b9adc1877fd5dacbda5f360ed5d0584b815876337a9bba0d8a3689a2a29e2b9e"
+      "sha256": "cb0dbcf0f4cc6fc67f7eeda609b2ea4c879bd8ad9efea7556fcbb8c7afe85bd4"
     },
     {
       "path": "tests/leak_scan_allowlist.mjs",
@@ -14692,7 +14697,7 @@
     {
       "path": "tests/session_rename_fallback.mjs",
       "mode": "0000644",
-      "sha256": "8422b77c656e7e75584cf439f8ed0fb089432f3741bdd30539e8e89154a47d7c"
+      "sha256": "9d6964a9df8051430d7cf495ca1fa93c22a60b9cf6c90174da209255ff3e551d"
     },
     {
       "path": "tests/session_reward_on_land.mjs",
@@ -15122,7 +15127,7 @@
     {
       "path": "tests/subdomain_auth.mjs",
       "mode": "0000644",
-      "sha256": "24257ca4ad1a7bcefb735ee1b02609469035730e0723645f71e10eb71525bb72"
+      "sha256": "a9f2b527557bdd86ccabb6c7aff779a235cdd20374f278232cfe7451d9f22d9b"
     },
     {
       "path": "tests/sweep_app_account.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 433 operations across 67 resource groups
+- 434 operations across 67 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -163,6 +163,8 @@ function createClient(opts = {}) {
       getAuthWebAdmissionStatus: (args) => request("GET", "/auth/web/admission-status", { hasBody: false }, args),
       // GET /auth/web/callback — rank: public — GET /auth/web/callback
       getAuthWebCallback: (args) => request("GET", "/auth/web/callback", { hasBody: false }, args),
+      // GET /auth/web/handoff — rank: public — GET /auth/web/handoff
+      getAuthWebHandoff: (args) => request("GET", "/auth/web/handoff", { hasBody: false }, args),
       // GET /auth/web/start — rank: public — GET /auth/web/start
       getAuthWebStart: (args) => request("GET", "/auth/web/start", { hasBody: false }, args),
     },

package/clients/bongos-client/index.cjs

@@ -162,6 +162,8 @@ function createClient(opts = {}) {
       getAuthWebAdmissionStatus: (args) => request("GET", "/auth/web/admission-status", { hasBody: false }, args),
       // GET /auth/web/callback — rank: public — GET /auth/web/callback
       getAuthWebCallback: (args) => request("GET", "/auth/web/callback", { hasBody: false }, args),
+      // GET /auth/web/handoff — rank: public — GET /auth/web/handoff
+      getAuthWebHandoff: (args) => request("GET", "/auth/web/handoff", { hasBody: false }, args),
       // GET /auth/web/start — rank: public — GET /auth/web/start
       getAuthWebStart: (args) => request("GET", "/auth/web/start", { hasBody: false }, args),
     },

package/clients/bongos-client/index.d.ts

@@ -562,6 +562,8 @@ export interface BongosClient {
     getAuthWebAdmissionStatus(args?: RequestArgs): Promise<GetAuthWebAdmissionStatusResponse>;
     /** GET /auth/web/callback — rank: public */
     getAuthWebCallback(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /auth/web/handoff — rank: public */
+    getAuthWebHandoff(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /auth/web/start — rank: public */
     getAuthWebStart(args?: RequestArgs): Promise<ApiResponse>;
   };

package/clients/bongos-client/index.mjs

@@ -159,6 +159,8 @@ export function createClient(opts = {}) {
       getAuthWebAdmissionStatus: (args) => request("GET", "/auth/web/admission-status", { hasBody: false }, args),
       // GET /auth/web/callback — rank: public — GET /auth/web/callback
       getAuthWebCallback: (args) => request("GET", "/auth/web/callback", { hasBody: false }, args),
+      // GET /auth/web/handoff — rank: public — GET /auth/web/handoff
+      getAuthWebHandoff: (args) => request("GET", "/auth/web/handoff", { hasBody: false }, args),
       // GET /auth/web/start — rank: public — GET /auth/web/start
       getAuthWebStart: (args) => request("GET", "/auth/web/start", { hasBody: false }, args),
     },

package/docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md

@@ -1,5 +1,12 @@
 # 0145 — A free "own-repo" hosted project tier needs domain separation + per-project isolation (not a bare cloudbongos.com subdomain)
 
+- **Status update 2026-09-29 — Finding 1 is FIXED by host-only hub cookies ([task 1004357](https://cloudbongos.com/builders#/task/1004357); build sequence step 1, the cookie half).** Option A was chosen over a separate registrable domain for halls: it needs no new domain, no DNS or TLS work and no change to any project's address, and it closes the hole for every hall already live. What changed, all in `src/bongos/routes/auth.js`:
+  - **Nothing the hub sets carries a `Domain` attribute any more.** The session is `__Host-bongos_session` over https (a browser only accepts a `__Host-` cookie that is Secure, `Path=/` and host-only), plain `bongos_session` on local http. The OAuth and Discord handshake cookies are host-only too.
+  - **`builders.` / `status.` / `www.` get the session through a one-time handoff.** A sign-in begun on one of them restarts on the canonical host (the only host the GitHub callback reaches). The canonical host then redirects back with a single-use, 60-second code bound to that one host, and `GET /auth/web/handoff` trades it for that host's own host-only copy of the same token. A builder already signed in on the apex who opens `builders.` skips GitHub entirely. A code is only ever minted for one of the hub's four hosts, never a hall.
+  - **Existing browsers are moved over.** Every hub API request that carries a pre-fix session cookie and no `__Host-` one re-issues the same token host-only and expires the apex-scoped copy.
+  - **Proof:** `tests/hub_cookie_host_only.mjs` runs the real router through an RFC 6265 cookie jar and asserts a hall at `<handle>.<apex>` receives no hub cookie after the full flow.
+  - **Still open from step 1:** CSRF tokens on state-changing hub endpoints. `SameSite=Lax` does not separate a hall from the hub, because they are the same site. The legacy session names are still ACCEPTED on read (so nobody was signed out at deploy), which leaves a hall able to plant a cookie under an old name. Retiring those names (task 1003706's Part 4) closes that. A token copied by a hall BEFORE this shipped stays valid until it expires or its builder signs out.
+
 - **Status update 2026-09-28 — Finding 1 is OPEN again, and permanently ([ADR 0345](0345-we-host-every-projects-hall-and-its-app-deploys-where-the-owner-chooses.md) decision 6).** Project halls now stay hosted on our box, so ADR 0323's "closed by removing its precondition" below no longer holds. Measured: the hub still sets `Domain=.cloudbongos.com`, and a hall loads modules from its own repository, so a hall at one of our addresses can read a visiting hub builder's session. The sign-in hardening is a **blocking prerequisite again** for any new hall at one of our addresses, filed as [task 1004357](https://cloudbongos.com/builders#/task/1004357). A hall on the owner's own domain is not exposed.
 - **Status:** **Superseded in part by [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md)** (2026-09-21). Three of this ADR's decisions are replaced: the free tier becomes a **capped trial**, not all-free; customer projects leave the shared box for a managed platform, so **container isolation on our own box is no longer the plan**; and **Finding 1 is closed by removing its precondition** — with no customer code on a `cloudbongos.com` subdomain there is no tenant to receive the hub session cookie, so the sign-in hardening in the build sequence below is no longer a blocking prerequisite (it remains worth doing on its own merits). The two security FINDINGS below stand as analysis and are the reason the new direction is safe.
 - **Status:** Accepted — owner decided 2026-07-15: **keep `cloudbongos.com`** (no separate domain), **container** isolation, **all-free** for now. Choosing the literal same domain makes hardening core sign-in a required prerequisite (see "Decisions" + "Required build sequence"). Build unblocked ([task 1002251](https://cloudbongos.com/builders#/task/1002251)); blocker 1000080 resolved.

package/docs/api/openapi.json

@@ -1662,6 +1662,27 @@
         "security": []
       }
     },
+    "/auth/web/handoff": {
+      "get": {
+        "operationId": "get_auth_web_handoff",
+        "tags": [
+          "auth"
+        ],
+        "summary": "GET /auth/web/handoff",
+        "description": "GET /auth/web/handoff?code=&return= — the far side of the one-time session handoff (task 1004357). The canonical host minted `code` for THIS host after a sign-in (or for a builder already signed in there); trading it sets this host's own host-only copy of the session, then lands on `return` — a relative path only, so the handoff can never become an open redirect. rank: public — auth establishment; the one-time code is the bearer, bound to this exact host, single-use and alive for HANDOFF_TTL_MS.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/auth.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/auth/web/start": {
       "get": {
         "operationId": "get_auth_web_start",
@@ -27716,7 +27737,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 433,
+  "x-endpoint-count": 434,
   "x-schema-count": 466,
   "x-undocumented-bodies": 11,
   "x-response-schemas": 319,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 433 endpoints across 75 route files.
+> **Generated from the live route files** — the route file is authoritative. 434 endpoints across 75 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -61,7 +61,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/audit-log` | `metic+archon` | — | GET /api/bongos/audit-log?limit=&offset=&builder_id=&method= Paginated, newest-first. |
 
-## `auth` (14)
+## `auth` (15)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -78,6 +78,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/auth/revoke-all` | `archon` | `builder_id` | POST /auth/revoke-all — V3.R38 / task 259. |
 | GET | `/api/bongos/auth/web/admission-status` | `public` | — | GET /auth/web/admission-status?login=X — the probe renderAccessPendingPage polls (task 1002097). |
 | GET | `/api/bongos/auth/web/callback` | `public` | — | OAuth callback; the state cookie + code are the bearer. |
+| GET | `/api/bongos/auth/web/handoff` | `public` | — | GET /auth/web/handoff?code=&return= — the far side of the one-time session handoff (task 1004357). |
 | GET | `/api/bongos/auth/web/start` | `public` | — | /auth/web — browser flow (used by the /builders page). |
 
 ## `autonomy` (8)

package/docs/module-api-changelog.md

@@ -2643,5 +2643,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         the doorway loses nothing inside 1.x; it goes at the next MAJOR.
   1.19.1076 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1075 with no explicit bump. run 36523068301. (task 1002620)
+  1.19.1077 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1076 with no explicit bump. run 36558431394. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1076",
+  "version": "1.19.1077",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1076",
+      "version": "1.19.1077",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1076",
+  "version": "1.19.1077",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7849,5 +7849,11 @@
       "id": "1003898",
       "text": "The dev box's removal is written up in one decision record (ADR 0346), and the 20 older records that described it now point there. The live guides, the design mockups and the README no longer tell anyone to use a dev box."
     }
+  ],
+  "1.19.1077": [
+    {
+      "id": "1004357",
+      "text": "A project's hall on one of our addresses can no longer read the sign-in of a hub builder who visits it. Hub sign-in cookies now stay on the exact address that set them. builders. and status. still sign you in automatically thr"
+    }
   ]
 }

package/src/bongos/auth.js

@@ -69,7 +69,14 @@ const MAX_AUTH_TOKEN_CANDIDATES = 6;
 // in the wild, so the list is three long, not two (task 1003704). The server
 // SETS only the head; routes/auth.js clears the tail on the next write. Part 4
 // (task 1003706) retires the tail behind a test of its absence.
-const SESSION_COOKIE_NAMES = Object.freeze(['bongos_session', 'gds_session', 'pms_session']);
+//
+// The head is `__Host-bongos_session` (task 1004357, ADR 0145 Finding 1): a
+// browser only accepts a `__Host-` cookie that is Secure, Path=/ and carries NO
+// Domain attribute, so the prefix itself guarantees the session never reaches a
+// project hall on another subdomain. A browser refuses a `__Host-` cookie over
+// plain http, so localhost dev keeps setting `bongos_session` (host-only there
+// too) — routes/auth.js picks between the first two by the request's scheme.
+const SESSION_COOKIE_NAMES = Object.freeze(['__Host-bongos_session', 'bongos_session', 'gds_session', 'pms_session']);
 
 function extractTokens(req) {
   const out = [];

package/src/bongos/middleware/rate-limit.js

@@ -157,7 +157,7 @@ function pruneAndCount(bucket, now, windowMs) {
 // Deliberately duplicated from SESSION_COOKIE_NAMES in src/bongos/auth.js rather
 // than imported: this middleware is dependency-free by design. The copy is pinned
 // against the real list by tests/session_rename_fallback.mjs (task 1003704).
-const SESSION_COOKIE_RES = ['bongos_session', 'gds_session', 'pms_session']
+const SESSION_COOKIE_RES = ['__Host-bongos_session', 'bongos_session', 'gds_session', 'pms_session']
   .map((n) => new RegExp('(?:^|;\\s*)' + n + '=([^;]+)'));
 
 function extractSessionKey(req) {