@bongos/core 1.19.330 → 1.19.331

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.330",
-  "core_contract": "1.19.330",
-  "source_commit": "acf9d9dd29679f6c527824b2803950999664958e",
+  "core_version": "1.19.331",
+  "core_contract": "1.19.331",
+  "source_commit": "cc85e05304300cfad9f701b9f9432f1f74b5cf53",
   "source_ref": "HEAD",
-  "built_at": "2026-08-24T23:30:13.047Z",
+  "built_at": "2026-08-25T00:01:28.994Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 324,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1811,
-  "tree_sha256": "40c5457e809c4588d34d3be61fccf5c49606fc002cbf64170aaf50c56ffa7652",
+  "tree_sha256": "68c81c790b852a7c79d261a2d55f43ec6c2dbc17f1e89a80757b41023f929748",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "d1d2622e002edaed8a98deb8b69ff5a77c6eeab7993e3b0e7f1513f32ff027c6"
+      "sha256": "7b204f9621ced68ef54b9f74aa8fbec53ab2fa81b0380133c762950ac4de1479"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -4667,12 +4667,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9bb6d40a874f3fa2ac02ff97883933dd86765c7c0d0f12aee6914961584b9702"
+      "sha256": "0d95e9a5ad8a6d63dba589cbe1bc8f4497bebf1470776bdbfcf21f470a7bb81e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2b5ad8d6ae7d079ecc2d53f39c32f076521b843514fe80b71851f80440463ab6"
+      "sha256": "ab2dde9733b1e67f8099474fc5d998b4e4c2060b2ac239ddd16db36bd1570fa5"
     },
     {
       "path": "public-docs/index.html",
@@ -6342,7 +6342,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "c5688194f21600a64ced6b27aa5c12b4f580db786ffcf85a151422635269aa40"
+      "sha256": "bb62110c21a07745a8bcfd3e2cf94f29deec1de5baea9d62fa903febcca54f2b"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -6452,7 +6452,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "da4209544a6cd0b389cccc563cd45f6c04fc22816f7b132772024f77fa2900f8"
+      "sha256": "11aa1bff9445edc29d7fe5034536edc7a6758e2f3d4c91d4b16a45c8ca1091ba"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8277,7 +8277,7 @@
     {
       "path": "tests/post_login_landing.mjs",
       "mode": "0000644",
-      "sha256": "942b2a9b0d5e2d2dd337b3ff738b7193ce0936d196a936f61bef51b74ed11ad0"
+      "sha256": "08a7496090f4617cef7e270afddcef8ee3a0b58bff6920b56bc2f2bbb49ed4ca"
     },
     {
       "path": "tests/pre_compact.mjs",

package/config/branding.neutral.json

@@ -103,7 +103,7 @@
     }
   },
   "landing": {
-    "_note": "Where a successful sign-in lands when no explicit ?return= / same-apex Referer was carried (auth.js postLoginLanding). Portable default '/builders' — the hall always exists. A platform-home instance points this at its own front door (cloudbongos.com → '/gate/', the orbs). Validated through the open-redirect allowlist; env override <PREFIX>_POST_LOGIN_LANDING. Task 1002240.",
+    "_note": "Where a successful sign-in lands when no explicit ?return= / same-apex Referer was carried (auth.js postLoginLanding). Portable default '/builders' — the hall always exists. A platform-home instance points this at its own front door (cloudbongos.com → '/', its landing page; the retired '/gate/' orb sky folds to '/' — task 1003233). Validated through the open-redirect allowlist; env override <PREFIX>_POST_LOGIN_LANDING. Task 1002240.",
     "postLogin": "/builders"
   },
   "envPrefix": "CLOUDBONGOS"

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.330",
+  "version": "1.19.331",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.330",
+      "version": "1.19.331",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.330",
+  "version": "1.19.331",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/routes/auth.js

@@ -273,18 +273,27 @@ function configuredOAuthOrigin() {
 // was stashed for this sign-in. Configurable per instance via
 // branding.landing.postLogin (env override <PREFIX>_POST_LOGIN_LANDING) so a
 // platform-home instance can land visitors on its OWN front door —
-// cloudbongos.com sets it to /gate/ (the orbs) so a visitor who signs in from
-// the orbs returns to the orbs, never auto-redirected into the builders' hall
-// (task 1002240). Every other instance keeps the portable default '/builders':
-// the hall always exists, a /gate/ orbs site does not. The configured value is
-// run through the SAME open-redirect allowlist as ?return= (safeReturnTo), so a
-// misconfigured landing can never become an open redirect; anything unsafe or
-// absent falls back to '/builders'. Takes an optional resolved pack so the pure
-// path is unit-testable without disk I/O (mirrors clientBranding()).
+// cloudbongos.com points it at '/' (its landing page) so a visitor who signs in
+// from the front door returns to it, never auto-redirected into the builders'
+// hall (task 1002240). Every other instance keeps the portable default
+// '/builders': the hall always exists, a front door of its own may not. The
+// configured value is run through the SAME open-redirect allowlist as ?return=
+// (safeReturnTo), so a misconfigured landing can never become an open redirect;
+// anything unsafe or absent falls back to '/builders'. Takes an optional
+// resolved pack so the pure path is unit-testable without disk I/O (mirrors
+// clientBranding()).
+//
+// /gate/ — the orb sky this knob was first written for — was retired with the
+// landing-page front door (task 1002743) and the apex answers a bare 404 there,
+// so a pack still pointing at it would land every cookie-less sign-in on a
+// 404. It folds to '/' instead (task 1003233).
+const RETIRED_LANDINGS = new Set(['/gate']);
 function postLoginLanding(brand) {
   try {
     const b = brand || branding();
-    return safeReturnTo(b.landing?.postLogin) || '/builders';
+    const configured = safeReturnTo(b.landing?.postLogin) || '/builders';
+    const bare = configured.replace(/\/+$/, '').split('?')[0] || '/';
+    return RETIRED_LANDINGS.has(bare) ? '/' : configured;
   } catch {
     return '/builders';
   }
@@ -568,7 +577,7 @@ module.exports = function buildAuthRouter() {
       // Land back where sign-in began if a validated return target was stashed
       // (e.g. the builders subdomain bounced through here); else the instance's
       // configured post-login landing (default '/builders'; cloudbongos.com →
-      // /gate/, the orbs — task 1002240).
+      // '/', its landing page — task 1002240).
       const returnTo = safeReturnTo(parseCookie(req, RETURN_COOKIE));
       res.clearCookie(RETURN_COOKIE, domainOpts);
       res.redirect(returnTo || postLoginLanding());

package/src/module-api.js

@@ -1087,8 +1087,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.328 with no explicit bump. run 32788827293. (task 1002620)
 //   1.19.330 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.329 with no explicit bump. run 32789596635. (task 1002620)
+//   1.19.331 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.330 with no explicit bump. run 32791877167. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.330'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.331'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/post_login_landing.mjs

@@ -1,42 +1,42 @@
-// tests/post_login_landing.mjs — the configurable post-sign-in landing (task 1002240).
+// tests/post_login_landing.mjs — where a cookie-less sign-in lands (task 1003233,
+// the pre-walk ops check for goal 1000058).
 //
-// postLoginLanding(brand) resolves the redirect target used after a successful
-// web sign-in when NO explicit ?return= / same-apex Referer was carried. It is
-// the ONE seam that lets a platform-home instance (cloudbongos.com) land a
-// visitor back on its orbs (/gate/) instead of the builders' hall, while every
-// other instance keeps the portable '/builders' default (the hall always
-// exists; a /gate/ orbs site does not). Pure over an injected brand pack, and
-// hardened through the SAME open-redirect allowlist as ?return= (safeReturnTo),
-// so a misconfigured landing can never become an open redirect.
-//
-// Pure function, no DB — requiring the route module does not open a pool.
+// The walk found that config/branding.neutral.json still documented the
+// platform-home landing as '/gate/' — the orb sky retired with the landing-page
+// front door (task 1002743), a bare 404 on the apex since. The live instance
+// pack already points at '/', so nothing was broken on the box; this pins the
+// fold that keeps an old pack from ever landing a founder on that 404, and the
+// note that no longer sends an operator there.
 
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
 import { createRequire } from 'node:module';
-const require = createRequire(import.meta.url);
-const { postLoginLanding } = require('../src/bongos/routes/auth.js');
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-let pass = 0, fail = 0;
-function ok(cond, msg) {
-  if (cond) { pass++; console.log(`  ok  ${msg}`); }
-  else { fail++; console.log(`  FAIL ${msg}`); }
-}
-
-console.log('\npostLoginLanding — portable default is the hall:');
-ok(postLoginLanding({}) === '/builders', 'no landing config → /builders');
-ok(postLoginLanding({ landing: {} }) === '/builders', 'empty landing block → /builders');
-// No-arg path reads the real committed neutral pack, which ships postLogin:'/builders'.
-ok(postLoginLanding() === '/builders', 'committed neutral pack → /builders');
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { postLoginLanding } = require(path.join(ROOT, 'src/bongos/routes/auth.js'));
 
-console.log('\npostLoginLanding — an instance lands visitors on its own front door:');
-ok(postLoginLanding({ landing: { postLogin: '/gate/' } }) === '/gate/', 'cloudbongos orbs → /gate/');
-ok(postLoginLanding({ landing: { postLogin: '/gate/?entered=1' } }) === '/gate/?entered=1', 'relative path with query preserved');
+test('a pack that still names the retired /gate/ lands on the front door, not a 404', () => {
+  assert.equal(postLoginLanding({ landing: { postLogin: '/gate/' } }), '/');
+  assert.equal(postLoginLanding({ landing: { postLogin: '/gate' } }), '/');
+});
 
-console.log('\npostLoginLanding — a misconfigured landing can never become an open redirect:');
-ok(postLoginLanding({ landing: { postLogin: 'https://evil.com/' } }) === '/builders', 'foreign https origin → fallback');
-ok(postLoginLanding({ landing: { postLogin: '//evil.com' } }) === '/builders', 'protocol-relative → fallback');
-ok(postLoginLanding({ landing: { postLogin: 'javascript:alert(1)' } }) === '/builders', 'javascript: scheme → fallback');
-ok(postLoginLanding({ landing: { postLogin: '/a\\b' } }) === '/builders', 'backslash path → fallback');
-ok(postLoginLanding({ landing: { postLogin: 42 } }) === '/builders', 'non-string value → fallback');
+test('every live landing passes through untouched; absent or unsafe falls back to the hall', () => {
+  assert.equal(postLoginLanding({ landing: { postLogin: '/' } }), '/', 'cloudbongos.com today');
+  assert.equal(postLoginLanding({ landing: { postLogin: '/projects' } }), '/projects');
+  assert.equal(postLoginLanding({ landing: { postLogin: '/builders' } }), '/builders');
+  assert.equal(postLoginLanding({ landing: {} }), '/builders');
+  assert.equal(postLoginLanding({}), '/builders');
+  assert.equal(postLoginLanding({ landing: { postLogin: 'https://evil.example/x' } }), '/builders', 'the open-redirect allowlist still governs');
+  assert.equal(postLoginLanding({ landing: { postLogin: '//evil.example' } }), '/builders');
+});
 
-console.log(`\nPost-login-landing tests: ${pass} passed, ${fail} failed`);
-if (fail) process.exit(1);
+test('the neutral pack no longer documents the retired landing as live', () => {
+  const pack = JSON.parse(fs.readFileSync(path.join(ROOT, 'config/branding.neutral.json'), 'utf8'));
+  assert.equal(pack.landing.postLogin, '/builders', 'the portable default is unchanged');
+  assert.doesNotMatch(pack.landing._note, /'\/gate\/', the orbs/, 'the note stops calling /gate/ a front door');
+  assert.match(pack.landing._note, /retired '\/gate\/'/, 'and says what became of it');
+});