@bongos/core 1.19.336 → 1.19.338

package/src/bongos/routes/auth.js

@@ -7,6 +7,9 @@ const { pairStore } = require('../app-pair');
 const { publicOrigin, parseCookie, validateOrRespond } = require('./_helpers');
 const { branding } = require('../../branding');
 const seams = require('../../module-seams');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('../logger').logger.child({ src: 'auth' });
 
 function escapeHtml(s) {
   return String(s ?? '').replace(/[&<>"']/g, (c) => ({
@@ -358,7 +361,7 @@ module.exports = function buildAuthRouter() {
       const out = await auth.startDeviceFlow();
       res.json(out);
     } catch (err) {
-      console.error('[gds] device/start', err);
+      log.error('[gds] device/start', err);
       // Surface the underlying reason (task 2126). A thrown device-flow start is almost
       // always a GitHub OAuth-App misconfig (device_flow_disabled / bad client) — safe,
       // non-secret, and actionable — so return it instead of an opaque "internal error".
@@ -394,7 +397,7 @@ module.exports = function buildAuthRouter() {
       if (err && err.code === 'NOT_APPROVED') {
         return res.status(403).json({ state: 'not_approved', error: 'not_approved' });
       }
-      console.error('[gds] device/poll', err);
+      log.error('[gds] device/poll', err);
       // 424 for the same reason as device/start above (finding W2, task 1003052):
       // this catch proxies GitHub's poll refusals too, and a 5xx body never
       // survives Cloudflare — the JSON envelope (its code at minimum) must.
@@ -432,7 +435,7 @@ module.exports = function buildAuthRouter() {
       }
       // A bad / expired / forged / wrong-audience assertion is an auth failure (401),
       // not a server error — never mint a session for it.
-      console.error('[gds] /auth/device/exchange', err);
+      log.error('[gds] /auth/device/exchange', err);
       res.fail('invalid_assertion', { status: 401, message: String(err.message || 'invalid assertion').slice(0, 160) });
     }
   });
@@ -536,7 +539,7 @@ module.exports = function buildAuthRouter() {
       return res.json({ admitted: !!admitted });
     } catch (err) {
       // Fail closed and quietly — the page just keeps polling.
-      console.error('[gds] auth/web/admission-status', err);
+      log.error('[gds] auth/web/admission-status', err);
       return res.json({ admitted: false });
     }
   });
@@ -594,7 +597,7 @@ module.exports = function buildAuthRouter() {
         try {
           await db.upsertGithubToken({ builderId: builder.id, token: githubToken, scope: githubScope });
         } catch (e) {
-          console.error('[gds] web/callback: repo-token capture failed (non-blocking):', e.message);
+          log.error('[gds] web/callback: repo-token capture failed (non-blocking):', e.message);
         }
       }
       // The state cookie is apex-scoped now (#734) — clear it with the same
@@ -636,7 +639,7 @@ module.exports = function buildAuthRouter() {
         } catch (probeErr) {
           // Never let the classifier turn a clean 403 into a 500 — fall through
           // to the existing page, which is the safe answer for a stranger.
-          console.error('[gds] web/callback admission classify', probeErr);
+          log.error('[gds] web/callback admission classify', probeErr);
         }
         if (expectedSoon) {
           return res.status(202).type('text/html').send(renderAccessPendingPage(err.login, recoveryStartHref(req)));
@@ -657,7 +660,7 @@ module.exports = function buildAuthRouter() {
           },
         ));
       }
-      console.error('[gds] web/callback', err);
+      log.error('[gds] web/callback', err);
       res.status(500).type('text/html').send(renderAuthErrorPage(
         'The handshake threw an error',
         `The server tried to exchange the auth code for a session and something went wrong: ${err.message}. Try again; if it persists, ask the ${admitterLabel()} to investigate the server logs.`,
@@ -778,7 +781,7 @@ module.exports = function buildAuthRouter() {
           });
           joined = true;
         } catch (e) {
-          console.log('[gds] discord auto-join failed (non-blocking):', e.message);
+          log.info('[gds] discord auto-join failed (non-blocking):', e.message);
         }
       }
       // F5 role-sync belt-and-braces (ADR 0033 §4): set/repair the rank-role even
@@ -790,7 +793,7 @@ module.exports = function buildAuthRouter() {
       // callback returns there (settings.js surfaces the ?discord= toast).
       res.redirect(joined ? '/builders/settings?discord=joined' : '/builders/settings?discord=linked');
     } catch (err) {
-      console.error('[gds] discord/callback', err);
+      log.error('[gds] discord/callback', err);
       res.status(500).type('text/html').send(renderAuthErrorPage(
         'The Discord link threw an error',
         `Linking failed unexpectedly. Try again; if it persists, ask the ${admitterLabel()} to check the server logs.`,
@@ -814,13 +817,13 @@ module.exports = function buildAuthRouter() {
         )(null);
         if (guildId) {
           auth.removeDiscordGuildMember({ guildId, discordUserId: link.discord_user_id })
-            .then((r) => console.log(`[gds] discord unlink kick: ${r.removed ? 'removed' : r.reason}`))
-            .catch((e) => console.log('[gds] discord unlink kick failed (non-blocking):', e.message));
+            .then((r) => log.info(`[gds] discord unlink kick: ${r.removed ? 'removed' : r.reason}`))
+            .catch((e) => log.info('[gds] discord unlink kick failed (non-blocking):', e.message));
         }
       }
       res.json({ ok: true, unlinked: removed });
     } catch (err) {
-      console.error('[gds] discord/unlink', err);
+      log.error('[gds] discord/unlink', err);
       res.fail('unlink_failed', 500);
     }
   });
@@ -897,7 +900,7 @@ module.exports = function buildAuthRouter() {
       if (builder) await db.revokeAllSessionsForBuilder(builder.id);
       res.json({ ok: true });
     } catch (err) {
-      console.error('[gds] /auth/backchannel-logout revoke', err);
+      log.error('[gds] /auth/backchannel-logout revoke', err);
       res.fail('server_error', { status: 500, message: 'logout failed' });
     }
   });
@@ -941,7 +944,7 @@ module.exports = function buildAuthRouter() {
         paste_command: `node scripts/gds/paste-token.js ${token}`,
       });
     } catch (err) {
-      console.error('[gds] POST /auth/cli-token/issue', err);
+      log.error('[gds] POST /auth/cli-token/issue', err);
       res.fail('issue_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -968,7 +971,7 @@ module.exports = function buildAuthRouter() {
       const revoked = await db.revokeSessionById(id);
       res.json({ ok: true, revoked });
     } catch (err) {
-      console.error('[gds] POST /auth/revoke', err);
+      log.error('[gds] POST /auth/revoke', err);
       res.fail('revoke_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -995,7 +998,7 @@ module.exports = function buildAuthRouter() {
       const revoked = await db.revokeAllSessionsForBuilder(id);
       res.json({ ok: true, revoked });
     } catch (err) {
-      console.error('[gds] POST /auth/revoke-all', err);
+      log.error('[gds] POST /auth/revoke-all', err);
       res.fail('revoke_all_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -1092,7 +1095,7 @@ module.exports = function buildAuthRouter() {
       }
       res.json({ ok: true });
     } catch (err) {
-      console.error('[gds] POST /auth/app-pair/approve', err);
+      log.error('[gds] POST /auth/app-pair/approve', err);
       res.fail('approve_failed', { status: 500, message: 'internal error' });
     }
   });

package/src/bongos/routes/backup.js

@@ -23,6 +23,9 @@ const { execFile } = require('node:child_process');
 const auth = require('../auth');
 const { branding } = require('../../branding');
 const { asyncHandler } = require('./_helpers');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('../logger').logger.child({ src: 'backup' });
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
 const BACKUP_DIR = process.env.GDS_BACKUP_DIR || '/var/backups/gds';
@@ -132,15 +135,15 @@ module.exports = function buildBackupRouter() {
       triggerRunning = true;
       const startedAt = new Date().toISOString();
       const builderId = req.builder && req.builder.id;
-      console.log(`[gds] backup triggered by builder ${builderId} at ${startedAt}`);
+      log.info(`[gds] backup triggered by builder ${builderId} at ${startedAt}`);
 
       execFile('bash', [BACKUP_SCRIPT], { cwd: REPO_ROOT, timeout: 120_000 }, (err, stdout, stderr) => {
         triggerRunning = false;
         if (err) {
-          console.error(`[gds] backup trigger failed (builder ${builderId}):`, err.message);
-          if (stderr) console.error('[gds] backup stderr:', stderr.toString().trim());
+          log.error(`[gds] backup trigger failed (builder ${builderId}):`, err.message);
+          if (stderr) log.error('[gds] backup stderr:', stderr.toString().trim());
         } else {
-          console.log(`[gds] backup trigger completed (builder ${builderId})`);
+          log.info(`[gds] backup trigger completed (builder ${builderId})`);
         }
       });
 

package/src/bongos/routes/builders.js

@@ -10,6 +10,9 @@ const { validateOrRespond, LIMITS, parseId } = require('./_helpers');
 const { pool } = require('../pool');
 const seams = require('../../module-seams');
 const { branding } = require('../../branding');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('../logger').logger.child({ src: 'builders' });
 // The lifecycle (tasks · claims · ship) carved to modules/lifecycle/ (BV1.R86 /
 // ADR 0093 §3): the Archon roster, the per-builder stale-claim view, the
 // per-builder grade breakdown, and the shipped-count read resolve the `lifecycle`
@@ -89,7 +92,7 @@ function buildRankChangeBroadcast({ displayName, direction, newRank }) {
 function fireDiscordBroadcast(text) {
   if (!text) return;
   if (process.env.CHAT_DRY_RUN === '1') {
-    console.log(`[gds] [broadcast dry-run] would post: ${text}`);
+    log.info(`[gds] [broadcast dry-run] would post: ${text}`);
     return;
   }
   try {
@@ -99,13 +102,13 @@ function fireDiscordBroadcast(text) {
       { cwd: REPO_ROOT, timeout: 10_000 },
       (err, _stdout, stderr) => {
         if (err) {
-          console.log('[gds] rank-change broadcast failed (non-blocking):', err.message);
-          if (stderr) console.log('[gds] discord stderr:', stderr.toString().trim());
+          log.info('[gds] rank-change broadcast failed (non-blocking):', err.message);
+          if (stderr) log.info('[gds] discord stderr:', stderr.toString().trim());
         }
       }
     );
   } catch (e) {
-    console.log('[gds] rank-change broadcast spawn failed (non-blocking):', e && e.message);
+    log.info('[gds] rank-change broadcast spawn failed (non-blocking):', e && e.message);
   }
 }
 
@@ -182,7 +185,7 @@ module.exports = function buildBuildersRouter() {
       if (err && err.code === 'MULTI_RUNG_PROMOTION') {
         return res.fail('multi_rung_promotion', { status: 400, message: `Promotions advance one rung at a time. From ${err.from}, the next rung is ${err.next_rung} — promote there first.`, details: { from: err.from, to: err.to, next_rung: err.next_rung } });
       }
-      console.error('[gds] PATCH /builders/:id/rank', err);
+      log.error('[gds] PATCH /builders/:id/rank', err);
       res.fail('rank_change_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -233,7 +236,7 @@ module.exports = function buildBuildersRouter() {
       if (err && err.code === 'NOT_INACTIVE') {
         return res.fail('not_inactive', 409, { status: err.status });
       }
-      console.error('[gds] PATCH /builders/:id/status', err);
+      log.error('[gds] PATCH /builders/:id/status', err);
       res.fail('status_change_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -268,7 +271,7 @@ module.exports = function buildBuildersRouter() {
       if (!updated) return res.fail('builder_not_found', 404);
       res.json({ builder: updated });
     } catch (err) {
-      console.error('[gds] PATCH /builders/:id/budget', err);
+      log.error('[gds] PATCH /builders/:id/budget', err);
       res.fail('budget_change_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -301,7 +304,7 @@ module.exports = function buildBuildersRouter() {
       const builders = await lc().getBuildersRoster({ staleHours });
       res.json({ builders, stale_hours: staleHours });
     } catch (err) {
-      console.error('[gds] GET /builders/roster', err);
+      log.error('[gds] GET /builders/roster', err);
       res.fail('roster_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -319,7 +322,7 @@ module.exports = function buildBuildersRouter() {
       const builders = await db.listActiveBuilders();
       res.json({ builders });
     } catch (err) {
-      console.error('[gds] GET /builders/directory', err);
+      log.error('[gds] GET /builders/directory', err);
       res.fail('directory_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -348,7 +351,7 @@ module.exports = function buildBuildersRouter() {
       const builders = await lc().gradeByBuilder(days);
       res.json({ window_days: days, builders });
     } catch (err) {
-      console.error('[gds] GET /grades/by-builder', err);
+      log.error('[gds] GET /grades/by-builder', err);
       res.fail('grades_by_builder_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -377,7 +380,7 @@ module.exports = function buildBuildersRouter() {
       const claims = await lc().getActiveClaimsForBuilderWithStale(targetId, { staleHours });
       res.json({ builder_id: targetId, claims, stale_hours: staleHours });
     } catch (err) {
-      console.error('[gds] GET /builders/:id/active-claims', err);
+      log.error('[gds] GET /builders/:id/active-claims', err);
       res.fail('active_claims_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -432,7 +435,7 @@ module.exports = function buildBuildersRouter() {
       res.set('Cache-Control', 'private, max-age=10');
       res.json({ builder_id: targetId, onboarding: shaped });
     } catch (err) {
-      console.error('[gds] GET /builders/:id/onboarding', err);
+      log.error('[gds] GET /builders/:id/onboarding', err);
       res.fail('onboarding_read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -513,7 +516,7 @@ module.exports = function buildBuildersRouter() {
         achievements,
       });
     } catch (err) {
-      console.error('[gds] GET /builders/:id/profile', err);
+      log.error('[gds] GET /builders/:id/profile', err);
       res.fail('profile_read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -549,7 +552,7 @@ module.exports = function buildBuildersRouter() {
       });
       res.json({ change, greeting });
     } catch (err) {
-      console.error('[gds] GET /builders/me/pending-rank-change', err);
+      log.error('[gds] GET /builders/me/pending-rank-change', err);
       res.fail('pending_rank_change_failed', { status: 500, message: 'internal error' });
     }
   });

package/src/bongos/routes/public.js

@@ -19,6 +19,9 @@ const { clientBranding, branding } = require('../../branding');
 const { clientModules } = require('../../modules');
 const { publicReadRateLimitMiddleware } = require('../middleware/rate-limit');
 const { parseId, corsPublicGet, parsePagination, pageMeta } = require('./_helpers');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('../logger').logger.child({ src: 'public' });
 
 // Pure projection for the single-task resolver. Exported for unit tests.
 // Privacy gate: a full title/value_summary is exposed ONLY for already-public
@@ -282,7 +285,7 @@ module.exports = function buildPublicRouter() {
       res.set('Cache-Control', 'public, max-age=30');
       res.json({ services: result });
     } catch (err) {
-      console.error('[gds] GET /public/uptime', err);
+      log.error('[gds] GET /public/uptime', err);
       res.fail('uptime_failed', 500);
     }
   });
@@ -355,7 +358,7 @@ module.exports = function buildPublicRouter() {
         trend: trendRows.rows,
       });
     } catch (err) {
-      console.error('[gds] GET /public/repo-health', err);
+      log.error('[gds] GET /public/repo-health', err);
       res.fail('repo_health_failed', 500);
     }
   });
@@ -394,7 +397,7 @@ module.exports = function buildPublicRouter() {
       res.set('Cache-Control', 'public, max-age=60');
       res.json({ task: projectPublicTask(task) });
     } catch (err) {
-      console.error('[gds] GET /public/tasks/:id', err);
+      log.error('[gds] GET /public/tasks/:id', err);
       res.fail('task_resolve_failed', 500);
     }
   });
@@ -415,7 +418,7 @@ module.exports = function buildPublicRouter() {
       res.set('Cache-Control', 'public, max-age=60');
       res.json({ idea: projectPublicIdea(rows[0]) });
     } catch (err) {
-      console.error('[gds] GET /public/ideas/:id', err);
+      log.error('[gds] GET /public/ideas/:id', err);
       res.fail('idea_resolve_failed', 500);
     }
   });
@@ -432,7 +435,7 @@ module.exports = function buildPublicRouter() {
       res.set('Cache-Control', 'public, max-age=60');
       res.json({ blocker: projectPublicBlocker(rows[0]) });
     } catch (err) {
-      console.error('[gds] GET /public/blockers/:id', err);
+      log.error('[gds] GET /public/blockers/:id', err);
       res.fail('blocker_resolve_failed', 500);
     }
   });
@@ -461,7 +464,7 @@ module.exports = function buildPublicRouter() {
         blockers: blockers.rows.map((r) => Number(r.id)),
       });
     } catch (err) {
-      console.error('[gds] GET /public/ref-ids', err);
+      log.error('[gds] GET /public/ref-ids', err);
       res.fail('ref_ids_failed', 500);
     }
   });

package/src/bongos/uptime-poller.js

@@ -10,6 +10,9 @@
 
 const http = require('node:http');
 const { pool } = require('./pool');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('./logger').logger.child({ src: 'uptime-poller' });
 
 const INTERVAL_MS = 60_000;
 const TIMEOUT_MS  = 8_000;
@@ -65,26 +68,26 @@ async function runChecks() {
         [svc.name, status, latency ?? null]
       );
     } catch (err) {
-      console.error(`[uptime] check failed for ${svc.name}:`, err.message);
+      log.error(`[uptime] check failed for ${svc.name}:`, err.message);
     }
   }
 
   // Prune old rows (fire-and-forget)
   pool.query(
     `DELETE FROM uptime_checks WHERE checked_at < now() - interval '${PRUNE_DAYS} days'`
-  ).catch((err) => console.error('[uptime] prune error:', err.message));
+  ).catch((err) => log.error('[uptime] prune error:', err.message));
 }
 
 function start() {
   // Stagger first check by 10s so the server finishes binding before we hit it
   setTimeout(() => {
-    runChecks().catch((err) => console.error('[uptime] initial check error:', err.message));
+    runChecks().catch((err) => log.error('[uptime] initial check error:', err.message));
     setInterval(() => {
-      runChecks().catch((err) => console.error('[uptime] check error:', err.message));
+      runChecks().catch((err) => log.error('[uptime] check error:', err.message));
     }, INTERVAL_MS);
   }, 10_000);
 
-  console.log('[uptime] poller started — checking every 60s');
+  log.info('[uptime] poller started — checking every 60s');
 }
 
 module.exports = { start };

package/src/module-api.js

@@ -19,6 +19,9 @@
 // modules behind kernel-composed auth is BV1.R41 / task 1410.
 
 const auth = require('./bongos/auth');
+const util = require('node:util');
+// task 1003208: api.logger() returns a real pino child from here (see below).
+const { logger: coreLogger } = require('./bongos/logger');
 const { pool, instanceDbName } = require('./bongos/pool');
 const branding = require('./branding');
 const instanceConfig = require('./instance-config');
@@ -1099,18 +1102,53 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.334 with no explicit bump. run 32795232997. (task 1002620)
 //   1.19.336 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.335 with no explicit bump. run 32795564021. (task 1002620)
+//   1.19.337 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.336 with no explicit bump. run 32795896926. (task 1002620)
+//   1.19.338 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.337 with no explicit bump. run 32796733697. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.336'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.338'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
+// task 1003208 (goal 1000079): this USED TO BE `console.log(tag, ...a)`. Every
+// module that had "adopted the logger" was therefore still writing unstructured
+// text to stdout with no request correlation and no redaction — the criterion's
+// complaint ("used across the server paths, not just installed") was true even of
+// the files that looked migrated. It now returns a real pino child from
+// src/bongos/logger.js, so every existing call site became structured,
+// correlated and redacted without one of them changing.
+//
+// CONSOLE-COMPATIBLE ON PURPOSE. Call sites were written against console's
+// signature — `log.warn('failed:', err.message)` — and pino's is
+// `(mergingObject, message)`, which silently DROPS console-style extra args. So:
+//   * OBJECT arguments are merged into the record, never formatted into the
+//     message. That is what makes redaction work: pino censors by FIELD PATH, so
+//     `log.info('token was', { token: 'abc' })` logs token:"[Redacted]", where
+//     flattening to a string would have written the secret out verbatim.
+//   * everything else goes through util.format — exactly what console does — so
+//     the message text is unchanged.
+//   * an Error is passed as `err` so pino serialises its stack and type.
+// A secret INTERPOLATED into a message string is still not redactable here; that
+// is the scrubber's and the prevent hook's job, as logger.js's own header says.
 function logger(moduleKey) {
-  const tag = `[${moduleKey || 'module'}]`;
-  return {
-    info: (...a) => console.log(tag, ...a),
-    warn: (...a) => console.warn(tag, ...a),
-    error: (...a) => console.error(tag, ...a),
+  const child = coreLogger.child({ module: moduleKey || 'module' });
+  const emit = (level) => (...args) => {
+    if (args.length === 0) return child[level]('');
+    const bindings = {};
+    const rest = [];
+    let hasBindings = false;
+    for (const a of args) {
+      if (a instanceof Error) { bindings.err = a; hasBindings = true; continue; }
+      if (a !== null && typeof a === 'object' && !Array.isArray(a)) {
+        Object.assign(bindings, a); hasBindings = true; continue;
+      }
+      rest.push(a);
+    }
+    const msg = rest.length ? util.format(...rest) : '';
+    return hasBindings ? child[level](bindings, msg) : child[level](msg);
   };
+  return { info: emit('info'), warn: emit('warn'), error: emit('error'), debug: emit('debug') };
 }
 
 module.exports = {

package/tests/logger.mjs

@@ -87,3 +87,70 @@ test('requestIdMiddleware adopts a valid inbound id and echoes it; mints otherwi
   const huge = mk({ 'x-request-id': 'x'.repeat(500) });
   assert.match(huge.req.reqId, /^[0-9a-f]{16}$/, 'over-long inbound id is not adopted');
 });
+
+// ---------------------------------------------------------------------------
+// task 1003208 (goal 1000079) — the DOORWAY logger, which is what server paths
+// actually call.
+//
+// api.logger() used to be `console.log(tag, ...args)`. Every module that had
+// "adopted the logger" was therefore still emitting unstructured text with no
+// correlation and no redaction, so the tests above proved a property of a logger
+// almost nothing in modules/ was using. These run the REAL doorway in a
+// subprocess — pino writes through sonic-boom straight to the fd, so capturing
+// the singleton in-process is not possible, and a re-built copy would prove
+// something about the copy.
+// ---------------------------------------------------------------------------
+const { spawnSync } = require('node:child_process');
+
+function runDoorway(body) {
+  const r = spawnSync(process.execPath, ['-e', `
+    const api = require(${JSON.stringify(path.join(ROOT, 'src', 'module-api.js'))});
+    const log = api.logger('probe');
+    ${body}
+  `], { encoding: 'utf8' });
+  assert.equal(r.status, 0, `doorway probe exited ${r.status}: ${r.stderr}`);
+  return r.stdout.split('\n').filter((l) => l.trim().startsWith('{')).map((l) => JSON.parse(l));
+}
+
+test('api.logger emits STRUCTURED json, not console text (the 1003208 regression)', () => {
+  const [line] = runDoorway(`log.info('mounted');`);
+  assert.equal(line.msg, 'mounted');
+  assert.equal(line.module, 'probe', 'the namespace is a field, not a "[tag]" prefix');
+  assert.equal(typeof line.level, 'number');
+  assert.ok(line.time, 'carries a timestamp');
+});
+
+test('a secret handed to api.logger console-style is redacted in the emitted line', () => {
+  const [line] = runDoorway(`log.info('storing credentials', { token: 'PLANTED-SECRET-VALUE', ok: true });`);
+  assert.equal(line.token, '[Redacted]', 'the secret-bearing FIELD is censored');
+  assert.equal(line.ok, true, 'the neighbouring field survives');
+  assert.equal(line.msg, 'storing credentials');
+  assert.ok(!JSON.stringify(line).includes('PLANTED-SECRET-VALUE'),
+    'the planted secret appears nowhere in the record');
+});
+
+test('object args MERGE rather than being formatted into the message', () => {
+  // This is the property redaction depends on: pino censors by field path, so an
+  // object flattened into the message string would emit the secret verbatim.
+  const [line] = runDoorway(`log.warn('ctx', { password: 'hunter2' }, 'and more');`);
+  assert.equal(line.password, '[Redacted]');
+  assert.equal(line.msg, 'ctx and more', 'non-object args still format exactly as console did');
+});
+
+test('an Error arg is serialised, not stringified into the message', () => {
+  const [line] = runDoorway(`log.error('failed', new Error('boom'));`);
+  assert.equal(line.msg, 'failed');
+  assert.equal(line.err.type, 'Error');
+  assert.equal(line.err.message, 'boom');
+  assert.ok(line.err.stack, 'the stack is kept as a field');
+});
+
+test('a secret INTERPOLATED into the message is NOT redacted — the honest boundary', () => {
+  // Documented rather than pretended: pino redacts by field path, so a secret
+  // pasted into free text is the scrubber's and the prevent hook's job. Asserting
+  // it here stops anyone reading the tests above and concluding the logger alone
+  // makes a leak impossible.
+  const [line] = runDoorway(`log.info('token=' + 'PLANTED-SECRET-VALUE');`);
+  assert.ok(line.msg.includes('PLANTED-SECRET-VALUE'),
+    'interpolated secrets survive — redaction is field-path based, by design');
+});

package/tests/provisioning_github_app_routes.mjs

@@ -11,10 +11,13 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 import http from 'node:http';
 
 const require = createRequire(import.meta.url);
-const ROOT = new URL('..', import.meta.url).pathname;
+// fileURLToPath, not .pathname: a checkout path with a space reads back percent-encoded
+// (and drive-prefixed) from .pathname on Windows, and require() cannot follow it
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
 
 // Stub the data-access fns BEFORE the route factory captures the module object.
 const provisioning = require(`${ROOT}/modules/provisioning/provisioning.js`);
@@ -92,6 +95,42 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
   const html = await res.text();
   t('good state → 200 text/html progress page wired to auto-open', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /Setting up your instance/.test(html) && /Placing credentials/.test(html) && /__CB_SETUP__/.test(html) && html.includes('GOODSTATE'), `status=${res.status}`);
   t('the page names the instance host', /mercury\.example\.com/.test(html));
+  // task 1003236: a same-tab return (pop-up blocked → form target=_self) must never be
+  // navigated away from the checklist. The page carries a hidden way back, and the
+  // countdown sits behind the pop-up guard.
+  t('carries a hidden "finish your remaining setup steps" link back to the wizard', /<p class="muted hidden" id="back"><a href="\/projects\?view=new">Finish your remaining setup steps/.test(html));
+  t('the auto-open countdown is reachable only past the pop-up guard', /var popup=!!window\.opener\|\|window\.name==='ghAppSetup';/.test(html) && /if\(!popup\)\{[^}]*return;\}\s*var n=4;\(function tick\(\)\{if\(n<=0\)\{location\.href=target;/.test(html) && (html.match(/location\.href=target/g) || []).length === 1);
+
+  // Run the served script itself (not a copy) against a minimal DOM, once as the
+  // wizard's pop-up and once as a same-tab return, and watch what it does to location.
+  const script = (html.match(/<script>\s*(\(function\(\)\{[\s\S]*?)<\/script>\s*<\/body>/) || [])[1];
+  t('the progress page ships the client script', typeof script === 'string' && script.length > 200);
+  async function runCallback({ opener, name }) {
+    const vm = await import('node:vm');
+    const el = () => { const cls = new Set(); return { textContent: '', classList: { add: (...c) => c.forEach((x) => cls.add(x)), remove: (...c) => c.forEach((x) => cls.delete(x)), contains: (c) => cls.has(c) }, querySelector: () => el() }; };
+    const els = { steps: el(), status: el(), cta: el(), go: el(), foot: el(), back: el() };
+    els.steps.querySelector = () => el();
+    els.back.classList.add('hidden'); els.cta.classList.add('hidden');
+    const timers = [];
+    const sandbox = {
+      __CB_SETUP__: { state: 'GOODSTATE', domain: 'mercury.example.com' },
+      opener, name,
+      document: { getElementById: (id) => els[id] || null },
+      location: { pathname: '/api/bongos/provisioning/github-app/callback', href: 'about:callback' },
+      fetch: async () => ({ ok: true, json: async () => ({ ok: true, ready: true, status: 'done' }) }),
+      setTimeout: (fn) => { timers.push(fn); return timers.length; },
+      encodeURIComponent,
+    };
+    sandbox.window = sandbox;
+    vm.runInNewContext(script, sandbox);
+    for (let i = 0; i < 5; i++) await new Promise((r) => setImmediate(r)); // let the poll's promise chain settle
+    for (let guard = 0; guard < 10 && timers.length; guard++) { const fn = timers.shift(); fn(); }
+    return { href: sandbox.location.href, go: els.go.textContent, backHidden: els.back.classList.contains('hidden'), foot: els.foot.textContent };
+  }
+  const popup = await runCallback({ opener: {}, name: 'ghAppSetup' });
+  t('as the wizard’s pop-up it still counts down and opens the instance', popup.href === 'https://mercury.example.com', JSON.stringify(popup));
+  const sameTab = await runCallback({ opener: null, name: '' });
+  t('as a same-tab return it stays put: door shown, way back revealed, no navigation', sameTab.href === 'about:callback' && sameTab.go === 'Open mercury.example.com →' && sameTab.backHidden === false && /checklist is waiting/.test(sameTab.foot), JSON.stringify(sameTab));
 }
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=X&state=NOPE`);