@bongos/core 1.19.212 → 1.19.213

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.212",
-  "core_contract": "1.19.212",
-  "source_commit": "2b4762e127c88a4114c66c25801c21aef9ebf2d9",
+  "core_version": "1.19.213",
+  "core_contract": "1.19.213",
+  "source_commit": "7cd1ca35002e12c66a3937a55bf8c9e6e69fd231",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T23:23:19.730Z",
+  "built_at": "2026-08-17T23:35:49.388Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1301,
+    "functional_verbatim": 1302,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1632,
-  "tree_sha256": "a403f7e947eaebd53f2d3b95ff22cc32202aec1c2c0d05aa5e8fdc68dccd599c",
+  "file_count": 1633,
+  "tree_sha256": "08e3fcc476f1d9209616049d1d79c946c56394953d7891706e2e41f8e3b28067",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3892,7 +3892,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "45c8a071f8bf61bd97bce83518fe3bd1b32cff99f31281c2cba84ad500359d60"
+      "sha256": "72796558274b45faec2b1a63e332100061a6ab0c690dadc42a54f1f39cb0c68e"
     },
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "61ee2e3d2da104909ace97881b37ba3fe85535e4f1ca2adfe430c2e12a93a087"
+      "sha256": "b9113d8027c9a36b9d9923e3a850c655a0dfb57ce59633ba81042f1116127882"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3e6a4e9d8281f4911612230833fa96b8ff7f3461f38e5655eafaff2f032aa1fb"
+      "sha256": "27122dc34fcd4dbe96f345a2cdf6045447a4a94a20217e43f52c803e25576e02"
     },
     {
       "path": "public-docs/index.html",
@@ -5792,7 +5792,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "b1389bf7cb4d53a27d332106ddbcd9327d76521c2330b4763d4ed0919c52f2a5"
+      "sha256": "c5688194f21600a64ced6b27aa5c12b4f580db786ffcf85a151422635269aa40"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a97718759370258d16378f3e7794180173fabef4053c2f3f1d28c7357affc5dc"
+      "sha256": "c59f5553c52308967b71da155eab8249d7c8687a37184626b4c4b03ccf2d9fc7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6074,6 +6074,11 @@
       "mode": "0000644",
       "sha256": "0be7221de2aa3969a54dc856a9fa1548959abd18b1a6c55e67b6ca5030e7ac1d"
     },
+    {
+      "path": "tests/auth_device_start_status.mjs",
+      "mode": "0000644",
+      "sha256": "059fededeef783635945496d3183387c1c6407e84fdddf67d14e0d14a48e9dc9"
+    },
     {
       "path": "tests/auth_duplicate_cookie.mjs",
       "mode": "0000644",
@@ -7842,7 +7847,7 @@
     {
       "path": "tests/setup_device_flow_fallback.mjs",
       "mode": "0000644",
-      "sha256": "9a9df92b732b4f13d222329877ab17f8f972ef01370c9a918b00635716c76b5e"
+      "sha256": "0a7c2f4a0ee050573040a88c6a246c773e7b13074115df4b4d715ab99c903a9c"
     },
     {
       "path": "tests/setup_smoke.mjs",

package/modules/platform-identity/routes/sso.js

@@ -303,7 +303,10 @@ module.exports = function ssoRoutes() {
       res.json(out);
     } catch (err) {
       console.error('[platform-identity] /sso/device/start', err);
-      res.fail('device_start_failed', { status: 502, message: String(err.message || 'error').slice(0, 200) });
+      // 424, not 502: Cloudflare replaces origin 5xx bodies with its own page, so a
+      // proxied upstream refusal must ride a 4xx to keep its JSON diagnosis readable
+      // externally (finding W2, task 1003052 — the core device/start twin).
+      res.fail('device_start_failed', { status: 424, message: String(err.message || 'error').slice(0, 200) });
     }
   });
 
@@ -343,7 +346,11 @@ module.exports = function ssoRoutes() {
       res.json({ state: 'ok', assertion });
     } catch (err) {
       console.error('[platform-identity] /sso/device/poll', err);
-      res.fail('device_poll_failed', { status: 500, message: 'internal error' });
+      // 424, matching the core device/poll (finding W2, task 1003052): this catch
+      // proxies the hub's GitHub poll refusals, and a 5xx body never survives
+      // Cloudflare. (The !out.client_id branch above keeps its 500: an internal
+      // invariant breach, not an upstream proxy.)
+      res.fail('device_poll_failed', { status: 424, message: 'internal error' });
     }
   });
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.212",
+  "version": "1.19.213",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.212",
+      "version": "1.19.213",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.212",
+  "version": "1.19.213",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/routes/auth.js

@@ -320,9 +320,13 @@ module.exports = function buildAuthRouter() {
       // Surface the underlying reason (task 2126). A thrown device-flow start is almost
       // always a GitHub OAuth-App misconfig (device_flow_disabled / bad client) — safe,
       // non-secret, and actionable — so return it instead of an opaque "internal error".
-      // 502: the failure is upstream (GitHub), not a bug in this server.
+      // 424 (failed dependency), NOT 502: the failure IS upstream (GitHub), but
+      // Cloudflare replaces an origin 5xx body with its own bare error page, so the
+      // diagnosis never reached an external caller — the walk's single most likely
+      // fresh-instance auth failure could only be read via curl on the box itself
+      // (finding W2, task 1003052). A 4xx passes the proxy with the JSON intact.
       const reason = String(err && err.message ? err.message : 'internal error').slice(0, 300);
-      res.fail('device_start_failed', { status: 502, message: reason });
+      res.fail('device_start_failed', { status: 424, message: reason });
     }
   });
 
@@ -349,7 +353,10 @@ module.exports = function buildAuthRouter() {
         return res.status(403).json({ state: 'not_approved', error: 'not_approved' });
       }
       console.error('[gds] device/poll', err);
-      res.fail('device_poll_failed', { status: 500, message: 'internal error' });
+      // 424 for the same reason as device/start above (finding W2, task 1003052):
+      // this catch proxies GitHub's poll refusals too, and a 5xx body never
+      // survives Cloudflare — the JSON envelope (its code at minimum) must.
+      res.fail('device_poll_failed', { status: 424, message: 'internal error' });
     }
   });
 

package/src/module-api.js

@@ -851,8 +851,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.210 with no explicit bump. run 32079512489. (task 1002620)
 //   1.19.212 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.211 with no explicit bump. run 32080157462. (task 1002620)
+//   1.19.213 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.212 with no explicit bump. run 32081051255. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.212'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.213'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_device_start_status.mjs

@@ -0,0 +1,101 @@
+// tests/auth_device_start_status.mjs — a proxied upstream refusal must SURVIVE
+// Cloudflare (walk finding W2, task 1003052).
+//
+// The repro this pins: GitHub refuses POST /auth/device/start (e.g. Device Flow
+// disabled on the app) and the route used to proxy that as HTTP 502 with a JSON
+// diagnosis in the body — but Cloudflare REPLACES origin 5xx bodies with its own
+// bare "error code: 502" page, so an external caller got zero information; the
+// real message was only readable via curl on the box itself. The fix is the
+// status-code choice: a 4xx (424 failed dependency) passes the proxy with the
+// JSON envelope intact.
+//
+// DB-free + network-free: auth.startDeviceFlow / authConfigured are stubbed on
+// the cached auth module (the github_token_store.mjs pattern).
+//
+// THE SWEEP (task 1003052's done-when requires it recorded): upstream-refusal
+// proxies found on the auth surface and how each was dispositioned —
+//   • device_start_failed (core routes/auth.js + the platform-identity SSO
+//     twin) — FIXED, 502 → 424 (the W2 repro itself).
+//   • device_poll_failed catch blocks (both files) — FIXED, 500 → 424: the
+//     poll leg proxies GitHub refusals the same way.
+//   • sso.js `!out.client_id` → device_poll_failed 500 — KEPT 500: an internal
+//     invariant breach, not an upstream proxy.
+//   • routes/github.js github_error 502 ×4 (repo list/create + visibility
+//     read/flip) — NOTED, not fixed: same eaten-body class, but the consuming
+//     UI already renders generic copy on any failure; candidates for the same
+//     4xx treatment.
+//   • platform-identity my-projects.js join_relay_failed 502 — NOTED: same class.
+//   • auth_not_configured / idp_not_configured 503s — NOTED: config-state
+//     answers, not upstream proxies, but their bodies are equally eaten by
+//     Cloudflare (the blocker-1000105 class) if external diagnosability ever
+//     matters there.
+//   • api-errors.js catalogs bad_gateway=502 — any route leaning on it
+//     inherits the hazard.
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const auth = require(path.join(ROOT, 'src/bongos/auth.js'));
+const buildAuthRouter = require(path.join(ROOT, 'src/bongos/routes/auth.js'));
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+function fakeRes() {
+  const res = { _status: 200, _body: null };
+  res.status = (c) => { res._status = c; return res; };
+  res.json = (b) => { res._body = b; return res; };
+  attachFail({}, res, () => {});
+  return res;
+}
+function finalHandler(router, method, pth) {
+  const layer = router.stack.find((l) => l.route && l.route.path === pth && l.route.methods[method]);
+  const stack = layer.route.stack;
+  return stack[stack.length - 1].handle;
+}
+
+test('an upstream device-flow refusal answers 424 with the diagnosis intact — never a Cloudflare-eaten 5xx', async () => {
+  const orig = { configured: auth.authConfigured, start: auth.startDeviceFlow };
+  auth.authConfigured = () => true;
+  auth.startDeviceFlow = async () => {
+    throw new Error('GitHub rejected device-flow start: device_flow_disabled — terminal sign-in needs Device Flow enabled on the app.');
+  };
+  try {
+    const handler = finalHandler(buildAuthRouter(), 'post', '/auth/device/start');
+    const res = fakeRes();
+    await handler({}, res);
+    assert.equal(res._status, 424, 'a 4xx passes Cloudflare with its body; a 5xx does not');
+    assert.ok(res._status < 500, 'the whole 5xx range is the Cloudflare-intercepted range');
+    assert.equal(res._body.error.code, 'device_start_failed');
+    assert.match(res._body.error.message, /device_flow_disabled/,
+      'the upstream reason travels in the body — this is the diagnosis W2 lost');
+  } finally {
+    auth.authConfigured = orig.configured;
+    auth.startDeviceFlow = orig.start;
+  }
+});
+
+test('the sweep holds: no device-flow refusal site anywhere proxies a 5xx from a catch', () => {
+  // The same refusal codes are minted in two places (the core routes and the
+  // platform-identity SSO hub twins); a consumer must never see two statuses.
+  // The one sanctioned 500 is sso.js's `!out.client_id` internal-invariant
+  // branch — recognizable because it is NOT inside a catch's console.error run.
+  for (const file of [
+    'src/bongos/routes/auth.js',
+    'modules/platform-identity/routes/sso.js',
+  ]) {
+    const src = fs.readFileSync(path.join(ROOT, file), 'utf8');
+    for (const m of src.matchAll(/device_start_failed',\s*\{\s*status:\s*(\d+)/g)) {
+      assert.ok(Number(m[1]) < 500,
+        `${file} proxies device_start_failed as ${m[1]} — Cloudflare eats 5xx bodies (W2)`);
+    }
+    for (const m of src.matchAll(/console\.error\([^\n]*device\/poll[^\n]*\);[\s\S]{0,400}?device_poll_failed',\s*\{\s*status:\s*(\d+)/g)) {
+      assert.ok(Number(m[1]) < 500,
+        `${file}'s device/poll catch proxies device_poll_failed as ${m[1]} — same W2 class`);
+    }
+  }
+});

package/tests/setup_device_flow_fallback.mjs

@@ -51,10 +51,12 @@ const ta = async (name, fn) => {
 
 console.log('isDeviceFlowDisabled — the refusal detector:');
 
-// The REAL shape: routes/auth.js res.fail('device_start_failed', {status:502,
+// The REAL shape: routes/auth.js res.fail('device_start_failed', {status:424,
 // message: 'GitHub rejected device-flow start: device_flow_disabled — …'}).
+// (424 since task 1003052 — a 502's body was eaten by Cloudflare; the detector
+// matches on TEXT, so both the new 424 and an older server's 502 register.)
 const REAL_REFUSAL = {
-  ok: false, status: 502,
+  ok: false, status: 424,
   data: { error: { code: 'device_start_failed', message: 'GitHub rejected device-flow start: device_flow_disabled — terminal sign-in needs Device Flow enabled on the app: open https://github.com/settings/apps, open your app, check "Enable Device Flow", and save. Web sign-in is unaffected.' } },
 };
 
@@ -62,6 +64,10 @@ t('matches the real device_start_failed envelope carrying device_flow_disabled',
   assert.equal(setup.isDeviceFlowDisabled(REAL_REFUSAL), true);
 });
 
+t('still matches an older server\'s 502 shape — the CLI talks to many core versions', () => {
+  assert.equal(setup.isDeviceFlowDisabled({ ...REAL_REFUSAL, status: 502 }), true);
+});
+
 t('matches a legacy flat error shape too', () => {
   assert.equal(setup.isDeviceFlowDisabled({ ok: false, status: 502, data: { error: 'device_start_failed', message: 'x device_flow_disabled y' } }), true);
 });