@bongos/core 1.19.211 → 1.19.213

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.211",
-  "core_contract": "1.19.211",
-  "source_commit": "348da70b502ddf8be58aa20aeb71dcf7be94ec7c",
+  "core_version": "1.19.213",
+  "core_contract": "1.19.213",
+  "source_commit": "7cd1ca35002e12c66a3937a55bf8c9e6e69fd231",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T23:14:01.398Z",
+  "built_at": "2026-08-17T23:35:49.388Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1301,
+    "functional_verbatim": 1302,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1632,
-  "tree_sha256": "5d3eac725354ec0e3bd3c1d91f38bcc539a355b8e2b137de56de74ddfbe2572f",
+  "file_count": 1633,
+  "tree_sha256": "08e3fcc476f1d9209616049d1d79c946c56394953d7891706e2e41f8e3b28067",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3892,7 +3892,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "45c8a071f8bf61bd97bce83518fe3bd1b32cff99f31281c2cba84ad500359d60"
+      "sha256": "72796558274b45faec2b1a63e332100061a6ab0c690dadc42a54f1f39cb0c68e"
     },
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "aa3d213f3f3548f655bee0361f01e43ee380b54e958f8d11683ba7d94a098d2b"
+      "sha256": "b9113d8027c9a36b9d9923e3a850c655a0dfb57ce59633ba81042f1116127882"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "368f9931ba9dc39483dc3a9c488fb8df45342cccccab65d34b9a4d083fa530ed"
+      "sha256": "27122dc34fcd4dbe96f345a2cdf6045447a4a94a20217e43f52c803e25576e02"
     },
     {
       "path": "public-docs/index.html",
@@ -4547,7 +4547,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "790034f4256a31da114969853e14fdf47b43b0ad35907b4fcc14ff98897ec7d1"
+      "sha256": "603ec55ce4de6477cf5d0602e5963a096799a404b2324f12c62104023e9e0e4b"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5792,7 +5792,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "b1389bf7cb4d53a27d332106ddbcd9327d76521c2330b4763d4ed0919c52f2a5"
+      "sha256": "c5688194f21600a64ced6b27aa5c12b4f580db786ffcf85a151422635269aa40"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5998d6f2561e88ca21f3f764a48fd496767d0b2f16aeaf1a1e7cf981333c4faf"
+      "sha256": "c59f5553c52308967b71da155eab8249d7c8687a37184626b4c4b03ccf2d9fc7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6074,6 +6074,11 @@
       "mode": "0000644",
       "sha256": "0be7221de2aa3969a54dc856a9fa1548959abd18b1a6c55e67b6ca5030e7ac1d"
     },
+    {
+      "path": "tests/auth_device_start_status.mjs",
+      "mode": "0000644",
+      "sha256": "059fededeef783635945496d3183387c1c6407e84fdddf67d14e0d14a48e9dc9"
+    },
     {
       "path": "tests/auth_duplicate_cookie.mjs",
       "mode": "0000644",
@@ -7527,7 +7532,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "963b745e4b4ecd6a786f88758d57aee8680edd49d25f0cc84e3b563a5125be3b"
+      "sha256": "0471ced4ef3d16b5df6a373c04b13c1e83f2c9b2a9590734e4f02f95e195c45a"
     },
     {
       "path": "tests/provision.mjs",
@@ -7577,7 +7582,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "266f5936675c0f6eb8d64af713d215edea2b88bcab50153497ef2d23fec1ff65"
+      "sha256": "c0e2e85c84f75503438c1951b72a94cf1c74a7cd0c27b774c2dc4d46d99d6cf8"
     },
     {
       "path": "tests/public_mirror_export.mjs",
@@ -7842,7 +7847,7 @@
     {
       "path": "tests/setup_device_flow_fallback.mjs",
       "mode": "0000644",
-      "sha256": "9a9df92b732b4f13d222329877ab17f8f972ef01370c9a918b00635716c76b5e"
+      "sha256": "0a7c2f4a0ee050573040a88c6a246c773e7b13074115df4b4d715ab99c903a9c"
     },
     {
       "path": "tests/setup_smoke.mjs",

package/modules/platform-identity/routes/sso.js

@@ -303,7 +303,10 @@ module.exports = function ssoRoutes() {
       res.json(out);
     } catch (err) {
       console.error('[platform-identity] /sso/device/start', err);
-      res.fail('device_start_failed', { status: 502, message: String(err.message || 'error').slice(0, 200) });
+      // 424, not 502: Cloudflare replaces origin 5xx bodies with its own page, so a
+      // proxied upstream refusal must ride a 4xx to keep its JSON diagnosis readable
+      // externally (finding W2, task 1003052 — the core device/start twin).
+      res.fail('device_start_failed', { status: 424, message: String(err.message || 'error').slice(0, 200) });
     }
   });
 
@@ -343,7 +346,11 @@ module.exports = function ssoRoutes() {
       res.json({ state: 'ok', assertion });
     } catch (err) {
       console.error('[platform-identity] /sso/device/poll', err);
-      res.fail('device_poll_failed', { status: 500, message: 'internal error' });
+      // 424, matching the core device/poll (finding W2, task 1003052): this catch
+      // proxies the hub's GitHub poll refusals, and a 5xx body never survives
+      // Cloudflare. (The !out.client_id branch above keeps its 500: an internal
+      // invariant breach, not an upstream proxy.)
+      res.fail('device_poll_failed', { status: 424, message: 'internal error' });
     }
   });
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.211",
+  "version": "1.19.213",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.211",
+      "version": "1.19.213",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.211",
+  "version": "1.19.213",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -626,6 +626,14 @@ h1[tabindex="-1"]:focus{outline:none;}
       <div class="card" id="mRepoVisibility">
         <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Repository visibility</h2>
         <div id="mRepoVis"><p class="finePrint">Checking the repository on GitHub…</p></div>
+        <!-- the limitation itself, one click away (grade follow-up task 1003077):
+             the refusal above states it; this fold explains it and links the
+             tracked fix. The hall link is apex-only — a child instance keeps the
+             explanation, not another platform's task tracker. -->
+        <details class="finePrint" id="mRepoVisWhy">
+          <summary>Why can’t it be private yet?</summary>
+          <p>The platform deploys a project by reading its code from GitHub with a shared read-only credential — and private repositories don’t admit it. A private repository’s next deploy would simply fail, so the switch stays off until each project gets its own deploy credential. <!--apex-only:start-->That work is tracked as <a href="{{buildersOrigin}}#/task/1002735" target="_blank" rel="noopener">task 1002735</a> in the builders’ hall.<!--apex-only:end--></p>
+        </details>
       </div>
 
       <div class="card" id="mDelete">

package/src/bongos/routes/auth.js

@@ -320,9 +320,13 @@ module.exports = function buildAuthRouter() {
       // Surface the underlying reason (task 2126). A thrown device-flow start is almost
       // always a GitHub OAuth-App misconfig (device_flow_disabled / bad client) — safe,
       // non-secret, and actionable — so return it instead of an opaque "internal error".
-      // 502: the failure is upstream (GitHub), not a bug in this server.
+      // 424 (failed dependency), NOT 502: the failure IS upstream (GitHub), but
+      // Cloudflare replaces an origin 5xx body with its own bare error page, so the
+      // diagnosis never reached an external caller — the walk's single most likely
+      // fresh-instance auth failure could only be read via curl on the box itself
+      // (finding W2, task 1003052). A 4xx passes the proxy with the JSON intact.
       const reason = String(err && err.message ? err.message : 'internal error').slice(0, 300);
-      res.fail('device_start_failed', { status: 502, message: reason });
+      res.fail('device_start_failed', { status: 424, message: reason });
     }
   });
 
@@ -349,7 +353,10 @@ module.exports = function buildAuthRouter() {
         return res.status(403).json({ state: 'not_approved', error: 'not_approved' });
       }
       console.error('[gds] device/poll', err);
-      res.fail('device_poll_failed', { status: 500, message: 'internal error' });
+      // 424 for the same reason as device/start above (finding W2, task 1003052):
+      // this catch proxies GitHub's poll refusals too, and a 5xx body never
+      // survives Cloudflare — the JSON envelope (its code at minimum) must.
+      res.fail('device_poll_failed', { status: 424, message: 'internal error' });
     }
   });
 

package/src/module-api.js

@@ -849,8 +849,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.209 with no explicit bump. run 32078135414. (task 1002620)
 //   1.19.211 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.210 with no explicit bump. run 32079512489. (task 1002620)
+//   1.19.212 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.211 with no explicit bump. run 32080157462. (task 1002620)
+//   1.19.213 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.212 with no explicit bump. run 32081051255. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.211'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.213'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_device_start_status.mjs

@@ -0,0 +1,101 @@
+// tests/auth_device_start_status.mjs — a proxied upstream refusal must SURVIVE
+// Cloudflare (walk finding W2, task 1003052).
+//
+// The repro this pins: GitHub refuses POST /auth/device/start (e.g. Device Flow
+// disabled on the app) and the route used to proxy that as HTTP 502 with a JSON
+// diagnosis in the body — but Cloudflare REPLACES origin 5xx bodies with its own
+// bare "error code: 502" page, so an external caller got zero information; the
+// real message was only readable via curl on the box itself. The fix is the
+// status-code choice: a 4xx (424 failed dependency) passes the proxy with the
+// JSON envelope intact.
+//
+// DB-free + network-free: auth.startDeviceFlow / authConfigured are stubbed on
+// the cached auth module (the github_token_store.mjs pattern).
+//
+// THE SWEEP (task 1003052's done-when requires it recorded): upstream-refusal
+// proxies found on the auth surface and how each was dispositioned —
+//   • device_start_failed (core routes/auth.js + the platform-identity SSO
+//     twin) — FIXED, 502 → 424 (the W2 repro itself).
+//   • device_poll_failed catch blocks (both files) — FIXED, 500 → 424: the
+//     poll leg proxies GitHub refusals the same way.
+//   • sso.js `!out.client_id` → device_poll_failed 500 — KEPT 500: an internal
+//     invariant breach, not an upstream proxy.
+//   • routes/github.js github_error 502 ×4 (repo list/create + visibility
+//     read/flip) — NOTED, not fixed: same eaten-body class, but the consuming
+//     UI already renders generic copy on any failure; candidates for the same
+//     4xx treatment.
+//   • platform-identity my-projects.js join_relay_failed 502 — NOTED: same class.
+//   • auth_not_configured / idp_not_configured 503s — NOTED: config-state
+//     answers, not upstream proxies, but their bodies are equally eaten by
+//     Cloudflare (the blocker-1000105 class) if external diagnosability ever
+//     matters there.
+//   • api-errors.js catalogs bad_gateway=502 — any route leaning on it
+//     inherits the hazard.
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const auth = require(path.join(ROOT, 'src/bongos/auth.js'));
+const buildAuthRouter = require(path.join(ROOT, 'src/bongos/routes/auth.js'));
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+function fakeRes() {
+  const res = { _status: 200, _body: null };
+  res.status = (c) => { res._status = c; return res; };
+  res.json = (b) => { res._body = b; return res; };
+  attachFail({}, res, () => {});
+  return res;
+}
+function finalHandler(router, method, pth) {
+  const layer = router.stack.find((l) => l.route && l.route.path === pth && l.route.methods[method]);
+  const stack = layer.route.stack;
+  return stack[stack.length - 1].handle;
+}
+
+test('an upstream device-flow refusal answers 424 with the diagnosis intact — never a Cloudflare-eaten 5xx', async () => {
+  const orig = { configured: auth.authConfigured, start: auth.startDeviceFlow };
+  auth.authConfigured = () => true;
+  auth.startDeviceFlow = async () => {
+    throw new Error('GitHub rejected device-flow start: device_flow_disabled — terminal sign-in needs Device Flow enabled on the app.');
+  };
+  try {
+    const handler = finalHandler(buildAuthRouter(), 'post', '/auth/device/start');
+    const res = fakeRes();
+    await handler({}, res);
+    assert.equal(res._status, 424, 'a 4xx passes Cloudflare with its body; a 5xx does not');
+    assert.ok(res._status < 500, 'the whole 5xx range is the Cloudflare-intercepted range');
+    assert.equal(res._body.error.code, 'device_start_failed');
+    assert.match(res._body.error.message, /device_flow_disabled/,
+      'the upstream reason travels in the body — this is the diagnosis W2 lost');
+  } finally {
+    auth.authConfigured = orig.configured;
+    auth.startDeviceFlow = orig.start;
+  }
+});
+
+test('the sweep holds: no device-flow refusal site anywhere proxies a 5xx from a catch', () => {
+  // The same refusal codes are minted in two places (the core routes and the
+  // platform-identity SSO hub twins); a consumer must never see two statuses.
+  // The one sanctioned 500 is sso.js's `!out.client_id` internal-invariant
+  // branch — recognizable because it is NOT inside a catch's console.error run.
+  for (const file of [
+    'src/bongos/routes/auth.js',
+    'modules/platform-identity/routes/sso.js',
+  ]) {
+    const src = fs.readFileSync(path.join(ROOT, file), 'utf8');
+    for (const m of src.matchAll(/device_start_failed',\s*\{\s*status:\s*(\d+)/g)) {
+      assert.ok(Number(m[1]) < 500,
+        `${file} proxies device_start_failed as ${m[1]} — Cloudflare eats 5xx bodies (W2)`);
+    }
+    for (const m of src.matchAll(/console\.error\([^\n]*device\/poll[^\n]*\);[\s\S]{0,400}?device_poll_failed',\s*\{\s*status:\s*(\d+)/g)) {
+      assert.ok(Number(m[1]) < 500,
+        `${file}'s device/poll catch proxies device_poll_failed as ${m[1]} — same W2 class`);
+    }
+  }
+});

package/tests/projects_hub.mjs

@@ -1028,6 +1028,21 @@ test('the reconnect door asks for repository access and returns to this project'
     'and returns to the exact project being managed');
 });
 
+test('the refusal carries a LINK to the limitation, never prose alone (task 1003077)', () => {
+  assert.match(HUB, /id="mRepoVisWhy"/, 'the why-fold is real markup beside the section body');
+  const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
+  assert.ok(fold, 'the fold must be extractable');
+  assert.match(fold, /shared read-only credential/, 'the WHY is stated in plain words');
+  assert.match(fold, /\{\{buildersOrigin\}\}#\/task\/1002735/,
+    'the tracked fix is a real link, hall-origin server-stamped (never client-filled)');
+  // apex-only: a child instance keeps the explanation, not another platform's tracker
+  const at = HUB.indexOf('{{buildersOrigin}}#/task/1002735');
+  const before = HUB.slice(0, at);
+  const opens = (before.match(/<!--apex-only:start-->/g) || []).length;
+  const closes = (before.match(/<!--apex-only:end-->/g) || []).length;
+  assert.equal(opens - closes, 1, 'the task link sits inside an apex-only sentinel pair');
+});
+
 test('making a repo public asks first — exposure is never one accidental click', () => {
   const fn = (SCRIPT.match(/function askRepoPublic\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
   assert.ok(fn, 'askRepoPublic() must be extractable');

package/tests/public_landing_projects.mjs

@@ -129,6 +129,15 @@ test('the repo-visibility section is served live, with the private direction ref
   assert.doesNotMatch(body, /visibility:\s*'private'/,
     'no served code path may send the private direction');
   assert.match(body, /repos=1/, 'the reconnect door asks for repository access');
+  // the limitation is one click away (task 1003077). This DB-free serve is the
+  // STANDALONE shape, where apex-only spans are stripped — so the explanation
+  // must survive while the cloudbongos task link must NOT (a child instance
+  // never shows another platform's tracker). The link itself is pinned inside
+  // its sentinels by tests/projects_hub.mjs.
+  assert.match(body, /id="mRepoVisWhy"/, 'the why-fold is served');
+  assert.match(body, /shared read-only credential/, 'the explanation survives the strip');
+  assert.doesNotMatch(body, /#\/task\/1002735/,
+    'the apex-only task link is stripped from a standalone serve');
 });
 
 test('the empty state points a new owner at the wizard view — never at a hall', async () => {

package/tests/setup_device_flow_fallback.mjs

@@ -51,10 +51,12 @@ const ta = async (name, fn) => {
 
 console.log('isDeviceFlowDisabled — the refusal detector:');
 
-// The REAL shape: routes/auth.js res.fail('device_start_failed', {status:502,
+// The REAL shape: routes/auth.js res.fail('device_start_failed', {status:424,
 // message: 'GitHub rejected device-flow start: device_flow_disabled — …'}).
+// (424 since task 1003052 — a 502's body was eaten by Cloudflare; the detector
+// matches on TEXT, so both the new 424 and an older server's 502 register.)
 const REAL_REFUSAL = {
-  ok: false, status: 502,
+  ok: false, status: 424,
   data: { error: { code: 'device_start_failed', message: 'GitHub rejected device-flow start: device_flow_disabled — terminal sign-in needs Device Flow enabled on the app: open https://github.com/settings/apps, open your app, check "Enable Device Flow", and save. Web sign-in is unaffected.' } },
 };
 
@@ -62,6 +64,10 @@ t('matches the real device_start_failed envelope carrying device_flow_disabled',
   assert.equal(setup.isDeviceFlowDisabled(REAL_REFUSAL), true);
 });
 
+t('still matches an older server\'s 502 shape — the CLI talks to many core versions', () => {
+  assert.equal(setup.isDeviceFlowDisabled({ ...REAL_REFUSAL, status: 502 }), true);
+});
+
 t('matches a legacy flat error shape too', () => {
   assert.equal(setup.isDeviceFlowDisabled({ ok: false, status: 502, data: { error: 'device_start_failed', message: 'x device_flow_disabled y' } }), true);
 });