@bongos/core 1.19.337 → 1.19.338

package/src/bongos/routes/backup.js

@@ -23,6 +23,9 @@ const { execFile } = require('node:child_process');
 const auth = require('../auth');
 const { branding } = require('../../branding');
 const { asyncHandler } = require('./_helpers');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('../logger').logger.child({ src: 'backup' });
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
 const BACKUP_DIR = process.env.GDS_BACKUP_DIR || '/var/backups/gds';
@@ -132,15 +135,15 @@ module.exports = function buildBackupRouter() {
       triggerRunning = true;
       const startedAt = new Date().toISOString();
       const builderId = req.builder && req.builder.id;
-      console.log(`[gds] backup triggered by builder ${builderId} at ${startedAt}`);
+      log.info(`[gds] backup triggered by builder ${builderId} at ${startedAt}`);
 
       execFile('bash', [BACKUP_SCRIPT], { cwd: REPO_ROOT, timeout: 120_000 }, (err, stdout, stderr) => {
         triggerRunning = false;
         if (err) {
-          console.error(`[gds] backup trigger failed (builder ${builderId}):`, err.message);
-          if (stderr) console.error('[gds] backup stderr:', stderr.toString().trim());
+          log.error(`[gds] backup trigger failed (builder ${builderId}):`, err.message);
+          if (stderr) log.error('[gds] backup stderr:', stderr.toString().trim());
         } else {
-          console.log(`[gds] backup trigger completed (builder ${builderId})`);
+          log.info(`[gds] backup trigger completed (builder ${builderId})`);
         }
       });
 

package/src/bongos/routes/builders.js

@@ -10,6 +10,9 @@ const { validateOrRespond, LIMITS, parseId } = require('./_helpers');
 const { pool } = require('../pool');
 const seams = require('../../module-seams');
 const { branding } = require('../../branding');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('../logger').logger.child({ src: 'builders' });
 // The lifecycle (tasks · claims · ship) carved to modules/lifecycle/ (BV1.R86 /
 // ADR 0093 §3): the Archon roster, the per-builder stale-claim view, the
 // per-builder grade breakdown, and the shipped-count read resolve the `lifecycle`
@@ -89,7 +92,7 @@ function buildRankChangeBroadcast({ displayName, direction, newRank }) {
 function fireDiscordBroadcast(text) {
   if (!text) return;
   if (process.env.CHAT_DRY_RUN === '1') {
-    console.log(`[gds] [broadcast dry-run] would post: ${text}`);
+    log.info(`[gds] [broadcast dry-run] would post: ${text}`);
     return;
   }
   try {
@@ -99,13 +102,13 @@ function fireDiscordBroadcast(text) {
       { cwd: REPO_ROOT, timeout: 10_000 },
       (err, _stdout, stderr) => {
         if (err) {
-          console.log('[gds] rank-change broadcast failed (non-blocking):', err.message);
-          if (stderr) console.log('[gds] discord stderr:', stderr.toString().trim());
+          log.info('[gds] rank-change broadcast failed (non-blocking):', err.message);
+          if (stderr) log.info('[gds] discord stderr:', stderr.toString().trim());
         }
       }
     );
   } catch (e) {
-    console.log('[gds] rank-change broadcast spawn failed (non-blocking):', e && e.message);
+    log.info('[gds] rank-change broadcast spawn failed (non-blocking):', e && e.message);
   }
 }
 
@@ -182,7 +185,7 @@ module.exports = function buildBuildersRouter() {
       if (err && err.code === 'MULTI_RUNG_PROMOTION') {
         return res.fail('multi_rung_promotion', { status: 400, message: `Promotions advance one rung at a time. From ${err.from}, the next rung is ${err.next_rung} — promote there first.`, details: { from: err.from, to: err.to, next_rung: err.next_rung } });
       }
-      console.error('[gds] PATCH /builders/:id/rank', err);
+      log.error('[gds] PATCH /builders/:id/rank', err);
       res.fail('rank_change_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -233,7 +236,7 @@ module.exports = function buildBuildersRouter() {
       if (err && err.code === 'NOT_INACTIVE') {
         return res.fail('not_inactive', 409, { status: err.status });
       }
-      console.error('[gds] PATCH /builders/:id/status', err);
+      log.error('[gds] PATCH /builders/:id/status', err);
       res.fail('status_change_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -268,7 +271,7 @@ module.exports = function buildBuildersRouter() {
       if (!updated) return res.fail('builder_not_found', 404);
       res.json({ builder: updated });
     } catch (err) {
-      console.error('[gds] PATCH /builders/:id/budget', err);
+      log.error('[gds] PATCH /builders/:id/budget', err);
       res.fail('budget_change_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -301,7 +304,7 @@ module.exports = function buildBuildersRouter() {
       const builders = await lc().getBuildersRoster({ staleHours });
       res.json({ builders, stale_hours: staleHours });
     } catch (err) {
-      console.error('[gds] GET /builders/roster', err);
+      log.error('[gds] GET /builders/roster', err);
       res.fail('roster_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -319,7 +322,7 @@ module.exports = function buildBuildersRouter() {
       const builders = await db.listActiveBuilders();
       res.json({ builders });
     } catch (err) {
-      console.error('[gds] GET /builders/directory', err);
+      log.error('[gds] GET /builders/directory', err);
       res.fail('directory_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -348,7 +351,7 @@ module.exports = function buildBuildersRouter() {
       const builders = await lc().gradeByBuilder(days);
       res.json({ window_days: days, builders });
     } catch (err) {
-      console.error('[gds] GET /grades/by-builder', err);
+      log.error('[gds] GET /grades/by-builder', err);
       res.fail('grades_by_builder_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -377,7 +380,7 @@ module.exports = function buildBuildersRouter() {
       const claims = await lc().getActiveClaimsForBuilderWithStale(targetId, { staleHours });
       res.json({ builder_id: targetId, claims, stale_hours: staleHours });
     } catch (err) {
-      console.error('[gds] GET /builders/:id/active-claims', err);
+      log.error('[gds] GET /builders/:id/active-claims', err);
       res.fail('active_claims_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -432,7 +435,7 @@ module.exports = function buildBuildersRouter() {
       res.set('Cache-Control', 'private, max-age=10');
       res.json({ builder_id: targetId, onboarding: shaped });
     } catch (err) {
-      console.error('[gds] GET /builders/:id/onboarding', err);
+      log.error('[gds] GET /builders/:id/onboarding', err);
       res.fail('onboarding_read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -513,7 +516,7 @@ module.exports = function buildBuildersRouter() {
         achievements,
       });
     } catch (err) {
-      console.error('[gds] GET /builders/:id/profile', err);
+      log.error('[gds] GET /builders/:id/profile', err);
       res.fail('profile_read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -549,7 +552,7 @@ module.exports = function buildBuildersRouter() {
       });
       res.json({ change, greeting });
     } catch (err) {
-      console.error('[gds] GET /builders/me/pending-rank-change', err);
+      log.error('[gds] GET /builders/me/pending-rank-change', err);
       res.fail('pending_rank_change_failed', { status: 500, message: 'internal error' });
     }
   });

package/src/bongos/routes/public.js

@@ -19,6 +19,9 @@ const { clientBranding, branding } = require('../../branding');
 const { clientModules } = require('../../modules');
 const { publicReadRateLimitMiddleware } = require('../middleware/rate-limit');
 const { parseId, corsPublicGet, parsePagination, pageMeta } = require('./_helpers');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('../logger').logger.child({ src: 'public' });
 
 // Pure projection for the single-task resolver. Exported for unit tests.
 // Privacy gate: a full title/value_summary is exposed ONLY for already-public
@@ -282,7 +285,7 @@ module.exports = function buildPublicRouter() {
       res.set('Cache-Control', 'public, max-age=30');
       res.json({ services: result });
     } catch (err) {
-      console.error('[gds] GET /public/uptime', err);
+      log.error('[gds] GET /public/uptime', err);
       res.fail('uptime_failed', 500);
     }
   });
@@ -355,7 +358,7 @@ module.exports = function buildPublicRouter() {
         trend: trendRows.rows,
       });
     } catch (err) {
-      console.error('[gds] GET /public/repo-health', err);
+      log.error('[gds] GET /public/repo-health', err);
       res.fail('repo_health_failed', 500);
     }
   });
@@ -394,7 +397,7 @@ module.exports = function buildPublicRouter() {
       res.set('Cache-Control', 'public, max-age=60');
       res.json({ task: projectPublicTask(task) });
     } catch (err) {
-      console.error('[gds] GET /public/tasks/:id', err);
+      log.error('[gds] GET /public/tasks/:id', err);
       res.fail('task_resolve_failed', 500);
     }
   });
@@ -415,7 +418,7 @@ module.exports = function buildPublicRouter() {
       res.set('Cache-Control', 'public, max-age=60');
       res.json({ idea: projectPublicIdea(rows[0]) });
     } catch (err) {
-      console.error('[gds] GET /public/ideas/:id', err);
+      log.error('[gds] GET /public/ideas/:id', err);
       res.fail('idea_resolve_failed', 500);
     }
   });
@@ -432,7 +435,7 @@ module.exports = function buildPublicRouter() {
       res.set('Cache-Control', 'public, max-age=60');
       res.json({ blocker: projectPublicBlocker(rows[0]) });
     } catch (err) {
-      console.error('[gds] GET /public/blockers/:id', err);
+      log.error('[gds] GET /public/blockers/:id', err);
       res.fail('blocker_resolve_failed', 500);
     }
   });
@@ -461,7 +464,7 @@ module.exports = function buildPublicRouter() {
         blockers: blockers.rows.map((r) => Number(r.id)),
       });
     } catch (err) {
-      console.error('[gds] GET /public/ref-ids', err);
+      log.error('[gds] GET /public/ref-ids', err);
       res.fail('ref_ids_failed', 500);
     }
   });

package/src/bongos/uptime-poller.js

@@ -10,6 +10,9 @@
 
 const http = require('node:http');
 const { pool } = require('./pool');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('./logger').logger.child({ src: 'uptime-poller' });
 
 const INTERVAL_MS = 60_000;
 const TIMEOUT_MS  = 8_000;
@@ -65,26 +68,26 @@ async function runChecks() {
         [svc.name, status, latency ?? null]
       );
     } catch (err) {
-      console.error(`[uptime] check failed for ${svc.name}:`, err.message);
+      log.error(`[uptime] check failed for ${svc.name}:`, err.message);
     }
   }
 
   // Prune old rows (fire-and-forget)
   pool.query(
     `DELETE FROM uptime_checks WHERE checked_at < now() - interval '${PRUNE_DAYS} days'`
-  ).catch((err) => console.error('[uptime] prune error:', err.message));
+  ).catch((err) => log.error('[uptime] prune error:', err.message));
 }
 
 function start() {
   // Stagger first check by 10s so the server finishes binding before we hit it
   setTimeout(() => {
-    runChecks().catch((err) => console.error('[uptime] initial check error:', err.message));
+    runChecks().catch((err) => log.error('[uptime] initial check error:', err.message));
     setInterval(() => {
-      runChecks().catch((err) => console.error('[uptime] check error:', err.message));
+      runChecks().catch((err) => log.error('[uptime] check error:', err.message));
     }, INTERVAL_MS);
   }, 10_000);
 
-  console.log('[uptime] poller started — checking every 60s');
+  log.info('[uptime] poller started — checking every 60s');
 }
 
 module.exports = { start };

package/src/module-api.js

@@ -19,6 +19,9 @@
 // modules behind kernel-composed auth is BV1.R41 / task 1410.
 
 const auth = require('./bongos/auth');
+const util = require('node:util');
+// task 1003208: api.logger() returns a real pino child from here (see below).
+const { logger: coreLogger } = require('./bongos/logger');
 const { pool, instanceDbName } = require('./bongos/pool');
 const branding = require('./branding');
 const instanceConfig = require('./instance-config');
@@ -1101,18 +1104,51 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.335 with no explicit bump. run 32795564021. (task 1002620)
 //   1.19.337 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.336 with no explicit bump. run 32795896926. (task 1002620)
+//   1.19.338 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.337 with no explicit bump. run 32796733697. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.337'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.338'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
+// task 1003208 (goal 1000079): this USED TO BE `console.log(tag, ...a)`. Every
+// module that had "adopted the logger" was therefore still writing unstructured
+// text to stdout with no request correlation and no redaction — the criterion's
+// complaint ("used across the server paths, not just installed") was true even of
+// the files that looked migrated. It now returns a real pino child from
+// src/bongos/logger.js, so every existing call site became structured,
+// correlated and redacted without one of them changing.
+//
+// CONSOLE-COMPATIBLE ON PURPOSE. Call sites were written against console's
+// signature — `log.warn('failed:', err.message)` — and pino's is
+// `(mergingObject, message)`, which silently DROPS console-style extra args. So:
+//   * OBJECT arguments are merged into the record, never formatted into the
+//     message. That is what makes redaction work: pino censors by FIELD PATH, so
+//     `log.info('token was', { token: 'abc' })` logs token:"[Redacted]", where
+//     flattening to a string would have written the secret out verbatim.
+//   * everything else goes through util.format — exactly what console does — so
+//     the message text is unchanged.
+//   * an Error is passed as `err` so pino serialises its stack and type.
+// A secret INTERPOLATED into a message string is still not redactable here; that
+// is the scrubber's and the prevent hook's job, as logger.js's own header says.
 function logger(moduleKey) {
-  const tag = `[${moduleKey || 'module'}]`;
-  return {
-    info: (...a) => console.log(tag, ...a),
-    warn: (...a) => console.warn(tag, ...a),
-    error: (...a) => console.error(tag, ...a),
+  const child = coreLogger.child({ module: moduleKey || 'module' });
+  const emit = (level) => (...args) => {
+    if (args.length === 0) return child[level]('');
+    const bindings = {};
+    const rest = [];
+    let hasBindings = false;
+    for (const a of args) {
+      if (a instanceof Error) { bindings.err = a; hasBindings = true; continue; }
+      if (a !== null && typeof a === 'object' && !Array.isArray(a)) {
+        Object.assign(bindings, a); hasBindings = true; continue;
+      }
+      rest.push(a);
+    }
+    const msg = rest.length ? util.format(...rest) : '';
+    return hasBindings ? child[level](bindings, msg) : child[level](msg);
   };
+  return { info: emit('info'), warn: emit('warn'), error: emit('error'), debug: emit('debug') };
 }
 
 module.exports = {

package/tests/logger.mjs

@@ -87,3 +87,70 @@ test('requestIdMiddleware adopts a valid inbound id and echoes it; mints otherwi
   const huge = mk({ 'x-request-id': 'x'.repeat(500) });
   assert.match(huge.req.reqId, /^[0-9a-f]{16}$/, 'over-long inbound id is not adopted');
 });
+
+// ---------------------------------------------------------------------------
+// task 1003208 (goal 1000079) — the DOORWAY logger, which is what server paths
+// actually call.
+//
+// api.logger() used to be `console.log(tag, ...args)`. Every module that had
+// "adopted the logger" was therefore still emitting unstructured text with no
+// correlation and no redaction, so the tests above proved a property of a logger
+// almost nothing in modules/ was using. These run the REAL doorway in a
+// subprocess — pino writes through sonic-boom straight to the fd, so capturing
+// the singleton in-process is not possible, and a re-built copy would prove
+// something about the copy.
+// ---------------------------------------------------------------------------
+const { spawnSync } = require('node:child_process');
+
+function runDoorway(body) {
+  const r = spawnSync(process.execPath, ['-e', `
+    const api = require(${JSON.stringify(path.join(ROOT, 'src', 'module-api.js'))});
+    const log = api.logger('probe');
+    ${body}
+  `], { encoding: 'utf8' });
+  assert.equal(r.status, 0, `doorway probe exited ${r.status}: ${r.stderr}`);
+  return r.stdout.split('\n').filter((l) => l.trim().startsWith('{')).map((l) => JSON.parse(l));
+}
+
+test('api.logger emits STRUCTURED json, not console text (the 1003208 regression)', () => {
+  const [line] = runDoorway(`log.info('mounted');`);
+  assert.equal(line.msg, 'mounted');
+  assert.equal(line.module, 'probe', 'the namespace is a field, not a "[tag]" prefix');
+  assert.equal(typeof line.level, 'number');
+  assert.ok(line.time, 'carries a timestamp');
+});
+
+test('a secret handed to api.logger console-style is redacted in the emitted line', () => {
+  const [line] = runDoorway(`log.info('storing credentials', { token: 'PLANTED-SECRET-VALUE', ok: true });`);
+  assert.equal(line.token, '[Redacted]', 'the secret-bearing FIELD is censored');
+  assert.equal(line.ok, true, 'the neighbouring field survives');
+  assert.equal(line.msg, 'storing credentials');
+  assert.ok(!JSON.stringify(line).includes('PLANTED-SECRET-VALUE'),
+    'the planted secret appears nowhere in the record');
+});
+
+test('object args MERGE rather than being formatted into the message', () => {
+  // This is the property redaction depends on: pino censors by field path, so an
+  // object flattened into the message string would emit the secret verbatim.
+  const [line] = runDoorway(`log.warn('ctx', { password: 'hunter2' }, 'and more');`);
+  assert.equal(line.password, '[Redacted]');
+  assert.equal(line.msg, 'ctx and more', 'non-object args still format exactly as console did');
+});
+
+test('an Error arg is serialised, not stringified into the message', () => {
+  const [line] = runDoorway(`log.error('failed', new Error('boom'));`);
+  assert.equal(line.msg, 'failed');
+  assert.equal(line.err.type, 'Error');
+  assert.equal(line.err.message, 'boom');
+  assert.ok(line.err.stack, 'the stack is kept as a field');
+});
+
+test('a secret INTERPOLATED into the message is NOT redacted — the honest boundary', () => {
+  // Documented rather than pretended: pino redacts by field path, so a secret
+  // pasted into free text is the scrubber's and the prevent hook's job. Asserting
+  // it here stops anyone reading the tests above and concluding the logger alone
+  // makes a leak impossible.
+  const [line] = runDoorway(`log.info('token=' + 'PLANTED-SECRET-VALUE');`);
+  assert.ok(line.msg.includes('PLANTED-SECRET-VALUE'),
+    'interpolated secrets survive — redaction is field-path based, by design');
+});