@bongos/core 1.19.318 → 1.19.320

package/scripts/gds/update-channel.js

@@ -159,6 +159,18 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
       service: r.service ? String(r.service) : null,
       healthUrl: r.healthUrl ? String(r.healthUrl) : null,
       channel: normalizeChannel(r.channel == null ? defaultChannel : r.channel),
+      // Deploy topology (task 1003219). Optional, and only meaningful together: with
+      // versionUrl + deployTimer present the sweep can hand the bump to go-live.js and
+      // inherit its backup, pull-deploy-timer guard and INDEPENDENT box-side version
+      // read-back. Absent, the sweep falls back to calling `bongos upgrade` directly.
+      // Carried through here because a normalizer that silently drops a field makes an
+      // entry look enrolled while the capability it names never engages.
+      versionUrl: r.versionUrl ? String(r.versionUrl) : null,
+      deployTimer: r.deployTimer ? String(r.deployTimer) : null,
+      deployService: r.deployService ? String(r.deployService) : null,
+      backupDb: r.backupDb ? String(r.backupDb) : null,
+      backupDir: r.backupDir ? String(r.backupDir) : null,
+      registryPackage: r.registryPackage ? String(r.registryPackage) : null,
       // Per-instance env merged into the `bongos upgrade` child (e.g. PGDATABASE so the migrate step
       // hits THIS instance's DB, not the control plane's — see the live-op learnings for demo). Only
       // string values are kept; anything else is ignored.

package/scripts/status-probe.mjs

@@ -34,10 +34,30 @@ import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
+import { createRequire } from 'node:module';
+
+// Target + User-Agent come from the INSTANCE's own branding pack (task 1002757).
+// Both were founder literals, so another instance's uptime CI probed the founder
+// host and reported ITS health as their own. No literal fallback for the target:
+// a probe with nothing to probe must say so, not silently watch someone else.
+const requireCjs = createRequire(import.meta.url);
+const brandingSafe = () => { try { return requireCjs('../src/branding'); } catch { return null; } };
+const defaultTarget = () => {
+  const b = brandingSafe();
+  try {
+    const origin = b && b.branding().domains?.publicOrigin;
+    return origin ? `${String(origin).replace(/\/+$/, '')}/healthz` : null;
+  } catch { return null; }
+};
+const defaultUserAgent = () => {
+  const b = brandingSafe();
+  try { return `${b.userAgent().split('/')[0]}-status-probe/1.0 (+github-actions)`; }
+  catch { return 'cloud-bongos-status-probe/1.0 (+github-actions)'; }
+};
 
 const DEFAULTS = {
   dir: '.',
-  target: 'https://amazonprimea.com/healthz',
+  target: defaultTarget(),
   attempts: 3,
   'timeout-ms': 15000,
   'gap-ms': 10000,
@@ -70,7 +90,7 @@ async function attempt(target, timeoutMs) {
     const res = await fetch(target, {
       signal: ac.signal,
       redirect: 'manual', // a 200 must come from the origin, not a redirect chain
-      headers: { 'User-Agent': 'amazonprimea-status-probe/1.0 (+github-actions)' },
+      headers: { 'User-Agent': defaultUserAgent() },
     });
     return { ok: res.status === 200, httpStatus: res.status, latencyMs: Date.now() - start };
   } catch (_) {
@@ -125,6 +145,14 @@ async function main() {
   const historyFile = path.join(dir, 'history.jsonl');
   const statusFile = path.join(dir, 'status.json');
 
+  // No target means the branding pack names no public origin and none was passed
+  // (task 1002757 — there is deliberately no founder-host fallback to probe).
+  if (!args.target) {
+    console.error('status-probe: no target. Pass --target <url>, or give this instance a domains.publicOrigin in config/branding.json.');
+    process.exitCode = 2;
+    return;
+  }
+
   const result = await probe({
     target: args.target,
     attempts: args.attempts,

package/src/module-api.js

@@ -1063,8 +1063,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.316 with no explicit bump. run 32669571610. (task 1002620)
 //   1.19.318 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.317 with no explicit bump. run 32669798745. (task 1002620)
+//   1.19.319 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.318 with no explicit bump. run 32670195088. (task 1002620)
+//   1.19.320 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.319 with no explicit bump. run 32678147546. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.318'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.320'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/go_live.mjs

@@ -296,48 +296,40 @@ test("'could not check' is a distinct halt from 'absent'", () => {
 // `env K=V` list that omits it drops it too. This cost a real failed go-live.
 // ---------------------------------------------------------------------------
 
-test('a forwarded secret NEVER enters argv — it is handed over via --preserve-env', () => {
-  const cmd = G.asOwner({ runAs: 'lars', env: { PGDATABASE: 'cb' } }, 'npm install', { forward: ['NPM_TOKEN'] });
-  assert.match(cmd, /--preserve-env=NPM_TOKEN/);
-  // THE REGRESSION (task 1003218). `env K="$K"` kept the value out of the script TEXT,
-  // but the shell expands it before sudo runs and sudo LOGS THE FULL argv — which put
-  // the real token into the droplet's persistent journal 26 times. So the command must
-  // not mention the variable as an assignment at all, by reference or otherwise.
-  assert.ok(!/NPM_TOKEN=/.test(cmd.replace('--preserve-env=NPM_TOKEN', '')),
-    'a secret must never appear as an argv assignment — sudo logs argv');
-  // Non-secret config is still passed plainly; seeing PGDATABASE in a log is useful.
+test('a privileged npm command DERIVES its token — no secret in argv at all', () => {
+  const cmd = G.asOwner({ runAs: 'lars', env: { PGDATABASE: 'cb' } }, 'npm install', { needsNpm: true });
+  // THE REGRESSION, TWICE (task 1003218). `env NPM_TOKEN="$NPM_TOKEN"` put the value in
+  // sudo's COMMAND= field. `--preserve-env=NPM_TOKEN` moved it to sudo's ENV= field —
+  // a different field of the SAME log line, which is not a fix. sudo logs its whole
+  // invocation, so the only safe answer is that the secret is never part of it.
+  assert.ok(!/NPM_TOKEN=npm_/.test(cmd), 'no token VALUE may appear');
+  assert.ok(!/--preserve-env/.test(cmd), '--preserve-env logs the value in ENV=');
+  assert.ok(!/env [^;]*NPM_TOKEN="\$NPM_TOKEN"/.test(cmd), 'no by-reference assignment in argv either');
+  // What SHOULD be there: the child deriving it, and refusing to run on an empty read.
+  assert.match(cmd, /_authToken/);
+  assert.match(cmd, /EMPTY NPM_TOKEN/);
+  // Non-secret config still travels plainly.
   assert.match(cmd, /PGDATABASE=cb/);
 });
 
-test('forwarding is only wired when the target names an env file to source from', () => {
-  // Otherwise K="$K" expands to empty and silently does nothing — a quiet no-op
-  // is worse than not trying.
-  assert.deepEqual(G.npmForward({ npmEnvFile: '/etc/x/npm.env' }), ['NPM_TOKEN']);
-  assert.deepEqual(G.npmForward({}), []);
+test('an empty token ABORTS rather than half-running', () => {
+  // An empty token sends npm to the PUBLIC registry, which 404s the private core, which
+  // auto-rolls-back "cleanly" — a failure that teaches you nothing. Fail loudly instead.
+  assert.match(G.NPM_AUTH_PREAMBLE, /exit 12/);
 });
 
-test('an unvetted variable name never reaches the command', () => {
-  const cmd = G.asOwner({ runAs: 'me' }, 'x', { forward: ['GOOD', 'bad name', '$(id)', '1BAD'] });
-  assert.match(cmd, /--preserve-env=GOOD/);
-  assert.ok(!cmd.includes('bad name') && !cmd.includes('$(id)') && !cmd.includes('1BAD'));
-});
-
-test('with no privilege drop a secret needs no mention at all', () => {
-  // The child already inherits our environment, so naming it would be pure exposure.
-  const cmd = G.asOwner({ env: { A: 'b' } }, 'x', { forward: ['NPM_TOKEN'] });
-  assert.equal(cmd, 'env A=b x');
+test('a command that does not need npm is left alone', () => {
+  const cmd = G.asOwner({ runAs: 'me', env: { PGDATABASE: 'mydb' } }, 'echo hi');
+  assert.equal(cmd, 'sudo -u me -H env PGDATABASE=mydb HOME=/home/me echo hi');
   assert.ok(!cmd.includes('NPM_TOKEN'));
 });
 
-test('no forwarding leaves the documented sudo shape untouched', () => {
-  assert.equal(G.asOwner({ runAs: 'me', env: { PGDATABASE: 'mydb' } }, 'echo hi'),
-    'sudo -u me -H env PGDATABASE=mydb HOME=/home/me echo hi');
+test('with no privilege drop the command still derives its own auth', () => {
+  const cmd = G.asOwner({ env: { A: 'b' } }, 'npm x', { needsNpm: true });
+  assert.ok(!cmd.startsWith('sudo'));
+  assert.match(cmd, /_authToken/);
 });
 
-// ---------------------------------------------------------------------------
-// A failed run must say what the tool said
-// ---------------------------------------------------------------------------
-
 test('the report surfaces the failing tool’s own words', () => {
   const out = G.renderReport({
     ok: false, failedAt: 'UPGRADE', targetName: 'web', from: '1.19.305', to: '1.19.306',
@@ -378,3 +370,44 @@ test('a spawn error is handled, not thrown', () => {
   const r = G.refreshMain({ run: () => ({ error: new Error('ENOENT'), status: null }) });
   assert.equal(r.ok, false);
 });
+
+// ---------------------------------------------------------------------------
+// Local execution — one engine, two callers (task 1003219)
+//
+// The nightly lane runs ON the box, so it cannot reach the deploy path through ssh.
+// Without a local mode it would need a second implementation, and the two would
+// drift — which is exactly how the unattended deploy ended up with WEAKER checks
+// than the manual one (no backup, no timer guard, no independent read-back).
+// ---------------------------------------------------------------------------
+
+test('a target with no ssh host is local; one with an ssh host is not', () => {
+  const base = { instanceDir: '/i', service: 's.service', healthUrl: 'http://h', versionUrl: 'http://v', deployTimer: 'd.timer' };
+  assert.equal(G.isLocalTarget(base), true);
+  assert.equal(G.isLocalTarget({ ...base, ssh: 'my-box' }), false);
+});
+
+test('ssh is OPTIONAL — a local target validates clean', () => {
+  const local = { instanceDir: '/i', service: 's.service', healthUrl: 'http://h', versionUrl: 'http://v', deployTimer: 'd.timer' };
+  assert.deepEqual(G.validateTarget('local', local), []);
+});
+
+test('the remaining required fields are still enforced for a local target', () => {
+  const errs = G.validateTarget('local', { instanceDir: '/i' });
+  for (const f of ['service', 'healthUrl', 'versionUrl', 'deployTimer']) {
+    assert.match(errs.join(' '), new RegExp(`missing required field "${f}"`));
+  }
+  // ssh must NOT be demanded any more.
+  assert.ok(!/missing required field "ssh"/.test(errs.join(' ')));
+});
+
+test('`local` is a boolean flag, not a shell token', () => {
+  const base = { instanceDir: '/i', service: 's.service', healthUrl: 'http://h', versionUrl: 'http://v', deployTimer: 'd.timer' };
+  assert.deepEqual(G.validateTarget('t', { ...base, local: true }), []);
+  assert.match(G.validateTarget('t', { ...base, local: 'yes' }).join(' '), /must be true or false/);
+});
+
+test('gitRefExists reports rather than throwing', () => {
+  assert.equal(G.gitRefExists('x', { run: () => ({ status: 0 }) }), true);
+  assert.equal(G.gitRefExists('x', { run: () => ({ status: 1 }) }), false);
+  assert.equal(G.gitRefExists('x', { run: () => ({ error: new Error('ENOENT') }) }), false);
+});

package/tests/helpers.mjs

@@ -142,3 +142,16 @@ export function lifecycleDbSource(modulesDir = path.join(ROOT, 'modules')) {
     .sort();
   return files.map((f) => fs.readFileSync(path.join(dir, f), 'utf8')).join('\n');
 }
+
+// shipCliSource — the ship CLI as one source string.
+//
+// The companion to lifecycleDbSource above, for the same reason: task 1003205
+// carved the 4,613-line scripts/gds/ship.js into ship.js (a re-export facade +
+// the CLI entry point) plus ship-*.js phase modules. Tests that assert "the ship
+// CLI does X" by regexing its source mean the CLI as a whole, not one file.
+export function shipCliSource(scriptsDir = path.join(ROOT, 'scripts', 'gds')) {
+  const files = fs.readdirSync(scriptsDir)
+    .filter((f) => f === 'ship.js' || (f.startsWith('ship-') && f.endsWith('.js')))
+    .sort();
+  return files.map((f) => fs.readFileSync(path.join(scriptsDir, f), 'utf8')).join('\n');
+}

package/tests/provision.mjs

@@ -144,10 +144,16 @@ t('buildCorePinRefreshCommit (the commit step): git sequence, token-URL push, an
     root: '/srv/bongos/spike-harbor', fromVersion: '1.19.2', toVersion: '1.19.196',
     repo, ownerToken: 'ghs_xxx', credFile: '/tmp/cred',
   });
+  // task 1002757: the bot email is RESOLVED (env → instance apex → neutral
+  // .invalid), never the hub's own address hardcoded — a self-hosted provisioner
+  // must not attribute its commits to the hub. Assert against the resolver so
+  // this pins the behaviour, not one instance's literal.
   assert.deepEqual(withTok.config, [
     'git -C /srv/bongos/spike-harbor config user.name "Cloud Bongos"',
-    'git -C /srv/bongos/spike-harbor config user.email "bot@cloudbongos.com"',
+    `git -C /srv/bongos/spike-harbor config user.email "${P.provisionerBotEmail()}"`,
   ]);
+  assert.equal(P.provisionerBotEmail({ PROVISION_BOT_EMAIL: 'ops@acme.test' }), 'ops@acme.test', 'env override wins');
+  assert.doesNotMatch(P.provisionerBotEmail({}), /amazonprimea/i, 'never a founder-host address');
   assert.equal(withTok.add, 'git -C /srv/bongos/spike-harbor add -A');
   assert.match(withTok.commit, /@bongos\/core 1\.19\.2 -> 1\.19\.196 \(task 1003050\)/);
   assert.match(withTok.push, /store --file=\/tmp\/cred.*x-access-token@github\.com\/jaxri\/spike-harbor\.git HEAD:main/);

package/tests/regrade_eligibility.mjs

@@ -198,5 +198,48 @@ test('buildGradePayload confidence defaults to null when signals omit it', () =>
   assert.equal(body.subagent_output.confidence, null);
 });
 
+// ---------- task 1003221: don't prescribe a command the caller can't run ----------
+//
+// The 'confirmed' answer hardcoded "run /merge-mode", which lands by pushing main
+// via push-main.js (SEC #863 / ADR 0043) and needs an authenticated gh plus a main
+// checkout. A server-mediated builder (pushVia()==='server' — every dev box) has
+// neither, so the advice was unreachable by construction. It cost a real builder
+// 163 minutes on 2026-08-21. strandNextStep already had the right wording for both
+// modes; these pin that the two modes now diverge and that neither regresses.
+
+test('1003221 a server-mediated builder is NOT told to run /merge-mode', () => {
+  const v = evaluateRegradeEligibility({
+    task: { id: 601, title: 't', status: 'confirmed' },
+    lastClaim: null,
+    builder: { id: 7, rank: 'archon' },
+    pushMode: 'server',
+  });
+  assert.equal(v.ok, false);
+  assert.match(v.reason, /already 'confirmed'/, 'still says why a re-grade is refused');
+  assert.doesNotMatch(v.reason, /run \/merge-mode/, 'must not prescribe the unreachable command');
+  assert.match(v.reason, /ship\.js 601/, 'names the command that DOES work here');
+  assert.match(v.reason, /NOT available here/, 'and says plainly why /merge-mode is out');
+});
+
+test('1003221 a laptop builder still gets /merge-mode (no regression)', () => {
+  const v = evaluateRegradeEligibility({
+    task: { id: 602, title: 't', status: 'confirmed' },
+    lastClaim: null,
+    builder: { id: 7, rank: 'archon' },
+    pushMode: 'local',
+  });
+  assert.match(v.reason, /\/merge-mode/, 'the laptop path keeps its working advice');
+  assert.match(v.reason, /ship\.js 602/, 'and still offers the resume alternative');
+});
+
+test('1003221 omitting pushMode keeps the historical wording (backward compatible)', () => {
+  const v = evaluateRegradeEligibility({
+    task: { id: 603, title: 't', status: 'confirmed' },
+    lastClaim: null,
+    builder: { id: 7, rank: 'archon' },
+  });
+  assert.match(v.reason, /\/merge-mode/, 'an old caller/test that passes no pushMode is unchanged');
+});
+
 console.log(`\n--regrade eligibility (#678) tests: ${passed} passed, ${failed} failed`);
 process.exit(failed > 0 ? 1 : 0);

package/tests/ship_assurance.mjs

@@ -33,6 +33,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import url from 'node:url';
+import { shipCliSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
@@ -178,8 +179,9 @@ await t('the CLI carries the declaration through its deliberate-empty path', ()
   // Without this, the gate would refuse exactly the --db-only / --allow-empty
   // flow CLAUDE.md calls a supported shape — turning a correctness fix into a
   // regression for the builders who rely on it.
-  const src = read('scripts/gds/ship.js');
-  assert.match(src, /no_artifact:\s*true/, 'ship.js must send the declaration on an empty land');
+  // task 1003205: the ship CLI is ship.js + ship-*.js now — read the family.
+  const src = shipCliSource();
+  assert.match(src, /no_artifact:\s*true/, 'the ship CLI must send the declaration on an empty land');
   assert.match(src, /landed\(\{ noArtifact: true/,
     'and the deliberate-empty land sites must mark themselves as such');
 });

package/tests/ship_publish_error.mjs

@@ -115,5 +115,48 @@ test('the "non-fast-forward" wording triggers the same hint through the envelope
 });
 
 console.log('');
+// ---------- task 1003221: a non-fast-forward has TWO causes ----------
+//
+// The hint used to give ONE diagnosis — "the server already moved <branch>" — and
+// prescribe `reset onto origin/<branch>`. That is right when the server is ahead
+// and DESTRUCTIVE when it is not: a builder who rebased or amended an
+// already-published branch would be told to throw away the commits they just made.
+// That was the real 2026-08-21 case. opts.localHistoryRewritten discriminates;
+// null (git could not tell) must keep the original wording rather than guess.
+const NFF = {
+  error: { code: 'publish_failed', message: 'publish_failed',
+           details: { step: 'push', reason: '! [rejected] main -> main (non-fast-forward)' } },
+};
+
+test('1003221 rewritten local history is told to MERGE, never reset', () => {
+  const out = ship.formatPublishFailure(NFF, 500, 'claude/x', { localHistoryRewritten: true });
+  assert.match(out, /APPEND-ONLY/);
+  assert.match(out, /git merge origin\/claude\/x/, 'names the merge that actually recovers');
+  assert.match(out, /Do NOT reset or re-rebase/, 'and forbids the lossy move explicitly');
+  assert.doesNotMatch(out, /reset onto/, 'must not carry the server-ahead remedy');
+});
+
+test('1003221 a server-ahead non-fast-forward keeps the reset remedy', () => {
+  const out = ship.formatPublishFailure(NFF, 500, 'claude/x', { localHistoryRewritten: false });
+  assert.match(out, /the server already moved claude\/x/);
+  assert.match(out, /reset onto origin\/claude\/x/);
+  assert.doesNotMatch(out, /APPEND-ONLY/);
+});
+
+test('1003221 an UNKNOWN cause (null) does not invent a diagnosis', () => {
+  const unknown = ship.formatPublishFailure(NFF, 500, 'claude/x', { localHistoryRewritten: null });
+  const legacy = ship.formatPublishFailure(NFF, 500, 'claude/x');
+  assert.equal(unknown, legacy, 'null must be byte-identical to the pre-fix wording');
+  assert.match(unknown, /reset onto/);
+});
+
+test('1003221 a non-NFF failure gains no hint from either flag', () => {
+  const other = { error: { code: 'publish_failed', details: { step: 'bundle', reason: 'bad object' } } };
+  for (const v of [true, false, null]) {
+    const out = ship.formatPublishFailure(other, 500, 'claude/x', { localHistoryRewritten: v });
+    assert.doesNotMatch(out, /APPEND-ONLY|reset onto/, `flag ${v} must not add a remedy to an unrelated failure`);
+  }
+});
+
 console.log(`ship_publish_error: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/update_channel.mjs

@@ -184,3 +184,36 @@ t('loadSubscriptions: an entry without a dir is dropped (cannot be upgraded)', (
 
 console.log(`\nupdate_channel: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);
+
+// ---------------------------------------------------------------------------
+// Deploy topology survives normalization (task 1003219)
+//
+// The sweep can only hand a bump to go-live.js — and so inherit its backup, its
+// pull-deploy-timer guard and its independent box-side read-back — if the roster's
+// topology actually REACHES the entry. The first cut of this dropped the new fields
+// on the floor, so an instance that named them looked enrolled while the sweep
+// quietly kept using the weaker direct path. A normalizer that silently discards a
+// field is indistinguishable from a feature that does not work.
+// ---------------------------------------------------------------------------
+
+test('deploy topology is carried through loadSubscriptions', () => {
+  const entry = {
+    slug: 's', dir: '/i', service: 'x.service', healthUrl: 'http://h',
+    versionUrl: 'http://v', deployTimer: 'd.timer', deployService: 'd.service',
+    backupDb: 'db', backupDir: '~/b', registryPackage: '@scope/core',
+  };
+  const fsImpl = { readFileSync: () => JSON.stringify({ instances: [entry] }) };
+  const { instances } = loadSubscriptions({ instanceDir: '/x', fsImpl });
+  assert.equal(instances.length, 1);
+  for (const k of ['versionUrl', 'deployTimer', 'deployService', 'backupDb', 'backupDir', 'registryPackage']) {
+    assert.equal(instances[0][k], entry[k], `${k} must survive normalization`);
+  }
+});
+
+test('an entry that names no topology reports null, not undefined', () => {
+  const fsImpl = { readFileSync: () => JSON.stringify({ instances: [{ slug: 's', dir: '/i' }] }) };
+  const { instances } = loadSubscriptions({ instanceDir: '/x', fsImpl });
+  for (const k of ['versionUrl', 'deployTimer', 'deployService', 'backupDb', 'backupDir']) {
+    assert.equal(instances[0][k], null, `${k} should be an explicit null`);
+  }
+});