@bongos/core 1.19.417 → 1.19.418

package/modules/hall-ui/public/settings-sessions.js

@@ -0,0 +1,119 @@
+// modules/hall-ui/public/settings-sessions.js — the "Active sessions" panel on
+// /builders/settings (task 1003341, ADR 0206).
+//
+// WHY. A session refreshes for another 24 hours every time it is used, so one a
+// builder has forgotten about never expires; before this panel, killing a leaked
+// CLI token meant asking an Archon, because the only revoke endpoints were
+// admin-gated. This is the surface for the own-scoped remedy: see everywhere you
+// are signed in, end one, or end all of them.
+//
+// Its own file rather than more of settings.js — that file sits close to the
+// 1500-line size ratchet, and this panel is self-contained: it shares nothing
+// with the rest of the page but the `window.OTB` toolkit and the generated API
+// client, both of which are globals loaded before it.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const { escapeHtml, $, fmtDate } = window.OTB;
+  const toast = (msg) => window.OTB.toast(msg);
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+
+  const toAuth = () => window.location.assign(`${API}/auth/web/start`);
+
+  // The words a person recognises, not the column value. `source` is the same
+  // three-value set the session-scope registry declares.
+  const SOURCE_LABELS = { cli: 'Terminal', web: 'Browser', box: 'Dev box' };
+  const sourceLabel = (s) => SOURCE_LABELS[s] || 'Session';
+
+  // "3 minutes ago" beats a timestamp for the one question this panel exists to
+  // answer: is anything using this session that is not me, right now?
+  function ago(iso) {
+    const then = new Date(iso).getTime();
+    if (!Number.isFinite(then)) return 'unknown';
+    const mins = Math.max(0, Math.round((Date.now() - then) / 60000));
+    if (mins < 1) return 'just now';
+    if (mins < 60) return `${mins} minute${mins === 1 ? '' : 's'} ago`;
+    const hours = Math.round(mins / 60);
+    if (hours < 48) return `${hours} hour${hours === 1 ? '' : 's'} ago`;
+    return `${Math.round(hours / 24)} days ago`;
+  }
+
+  function rowHtml(s) {
+    const badge = s.current ? '<span class="sessions-row__badge">this session</span>' : '';
+    const agent = s.user_agent ? `<span class="sessions-row__agent">${escapeHtml(s.user_agent)}</span>` : '';
+    return `<div class="sessions-row" data-id="${escapeHtml(s.id)}">
+      <div class="sessions-row__main">
+        <strong>${escapeHtml(sourceLabel(s.source))}</strong>${badge}
+        ${agent}
+        <span class="sessions-row__when">last used ${escapeHtml(ago(s.last_used_at))} · signed in ${escapeHtml(fmtDate(s.created_at))}</span>
+      </div>
+      <button type="button" class="settings-btn settings-btn--quiet sessions-row__end">End session</button>
+    </div>`;
+  }
+
+  async function render() {
+    const list = $('#sessions-list');
+    const res = await api.request('GET', `${API}/me/sessions`);
+    if (res.status === 401) { toAuth(); return; }
+    if (!res.ok) throw new Error((res.data && res.data.message) || `HTTP ${res.status}`);
+    const sessions = (res.data && res.data.sessions) || [];
+    list.innerHTML = sessions.length
+      ? sessions.map(rowHtml).join('')
+      : '<p class="settings-card__hint">No other sessions.</p>';
+    for (const btn of list.querySelectorAll('.sessions-row__end')) {
+      btn.addEventListener('click', () => endOne(btn));
+    }
+  }
+
+  async function endOne(btn) {
+    const row = btn.closest('.sessions-row');
+    const id = row.getAttribute('data-id');
+    const isCurrent = !!row.querySelector('.sessions-row__badge');
+    if (isCurrent && !window.confirm('That is the session you are using right now. Ending it signs you out of this page.')) return;
+    btn.disabled = true;
+    try {
+      const res = await api.request('POST', `${API}/me/sessions/revoke`, { body: { session_id: id } });
+      if (res.status === 401) { toAuth(); return; }
+      if (!res.ok) throw new Error((res.data && res.data.message) || `HTTP ${res.status}`);
+      if (isCurrent) { toAuth(); return; }
+      toast('Session ended.');
+      await render();
+    } catch (err) {
+      btn.disabled = false;
+      toast(`Could not end that session: ${err.message}`);
+    }
+  }
+
+  // Sign out everywhere ends THIS browser session too — that is what "everywhere"
+  // means, and the whole point when a token has leaked — so it confirms first and
+  // then sends the builder back to sign-in rather than leaving a dead page up.
+  async function endAll() {
+    const btn = $('#sessions-revoke-all');
+    if (!window.confirm('End every session, including this one? You will need to sign in again, and any CLI token will need re-issuing.')) return;
+    btn.disabled = true;
+    try {
+      const res = await api.request('POST', `${API}/me/sessions/revoke-all`, { body: {} });
+      if (!res.ok && res.status !== 401) throw new Error((res.data && res.data.message) || `HTTP ${res.status}`);
+      toAuth();
+    } catch (err) {
+      btn.disabled = false;
+      toast(`Could not sign out everywhere: ${err.message}`);
+    }
+  }
+
+  async function setup() {
+    try {
+      await render();
+      $('#sessions-scroll').hidden = false;
+      $('#sessions-revoke-all').addEventListener('click', endAll);
+    } catch (err) {
+      // Its own try/catch, like every other section: a failing endpoint hides this
+      // panel rather than taking the settings page down with it.
+      toast(`Could not load your sessions: ${err.message}`);
+    }
+  }
+
+  setup();
+})();

package/modules/hall-ui/public/settings.css

@@ -319,6 +319,31 @@ input.display-name-input {
   margin: 6px 0;
 }
 
+/* ---- Active sessions (task 1003341) — one row per live session, the current
+   one badged so nobody ends the page they are reading. ---- */
+.sessions-row {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+  padding: 10px 0;
+  border-bottom: 1px solid var(--border);
+}
+.sessions-row:last-child { border-bottom: 0; }
+.sessions-row__main { display: flex; flex-wrap: wrap; align-items: baseline; gap: 8px; min-width: 0; }
+.sessions-row__agent,
+.sessions-row__when { color: var(--ink-soft); font-size: 13px; }
+.sessions-row__agent { overflow-wrap: anywhere; }
+.sessions-row__when { flex-basis: 100%; }
+.sessions-row__badge {
+  font-size: 12px;
+  padding: 1px 7px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  color: var(--ink-soft);
+}
+
 /* ---- Image key (task 1013) — the "we cover it" / "action needed" banner
    uses the shared semantic status tokens. ---- */
 .artkey-banner {

package/modules/hall-ui/public/settings.html

@@ -145,6 +145,25 @@
               <p class="section-note">Tokens refresh on use; re-issuing never signs you out anywhere else.</p>
             </section>
 
+            <!-- ACTIVE SESSIONS — see and kill your own sessions without an
+                 Archon (task 1003341, ADR 0206). Rendered by settings-sessions.js
+                 against GET /api/bongos/me/sessions. -->
+            <section class="scroll" id="sessions-scroll" aria-labelledby="sessions-h" data-group="access" hidden>
+              <h2 id="sessions-h" class="scroll__h">Active sessions</h2>
+              <p class="scroll__lede">
+                Every place you are currently signed in — this browser, your terminal,
+                any dev box. A session refreshes for another 24 hours each time it is
+                used, so one you have forgotten about can stay alive indefinitely. If a
+                token has leaked, end it here.
+              </p>
+              <div id="sessions-list" class="sessions-list" aria-live="polite"></div>
+              <div class="settings-card">
+                <button type="button" class="settings-btn" id="sessions-revoke-all">Sign out everywhere</button>
+                <span class="settings-card__hint">ends every session including this one — you will be asked to sign in again.</span>
+              </div>
+              <p class="section-note">Ending a session takes effect immediately; the token stops working on its very next request.</p>
+            </section>
+
             <!-- IMAGE KEY — per-builder Gemini key (task 1013 / ADR 0073).
                  GET/PUT/DELETE /api/bongos/me/art-key/own. Write-only (set/replace/
                  remove); the full key is never shown again after save (masked,
@@ -342,5 +361,8 @@
 <!-- #807: shared dev-box panel — loaded before settings.js so OTBBoxPanel exists. -->
 <script src="/builders/box-panel.js?v=2026-06-14-domutils"></script>
 <script src="/builders/settings.js?v=2026-07-10-regroup"></script>
+<!-- task 1003341: the Active sessions panel. Its own file rather than more of
+     settings.js, which sits close to the 1500-line size ratchet. -->
+<script src="/builders/settings-sessions.js?v=2026-08-29-sessions"></script>
 </body>
 </html>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.417",
+  "version": "1.19.418",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.417",
+      "version": "1.19.418",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.417",
+  "version": "1.19.418",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/db.js

@@ -733,6 +733,50 @@ async function revokeAllSessionsForBuilder(builderId) {
   return rowCount;
 }
 
+// ---------- own-scoped session self-service (task 1003341) ----------
+//
+// The three helpers below are the account holder's OWN remedy for a leaked
+// bearer, and every one of them carries `builder_id = $caller` in its WHERE
+// clause. That predicate is the isolation: an id belonging to somebody else
+// matches no row, so a caller who guesses a stranger's session id learns
+// nothing and changes nothing. src/bongos/routes/my-sessions.js is the only
+// caller and always passes req.builder.id — never a client-supplied value.
+
+// listActiveSessionsForBuilder — the live (unrevoked, unexpired) sessions on one
+// account, newest-used first. Returns only what a person needs to RECOGNISE a
+// session — where it came from, when it was minted, when it was last used, what
+// client held it. The `token` column is deliberately never selected: a list that
+// returned tokens would turn one stolen session into all of them.
+
+async function listActiveSessionsForBuilder(builderId) {
+  const { rows } = await pool.query(
+    `SELECT id, source, user_agent, created_at, last_used_at, expires_at
+       FROM builder_sessions
+      WHERE builder_id = $1
+        AND revoked_at IS NULL
+        AND (expires_at IS NULL OR expires_at > now())
+      ORDER BY last_used_at DESC, id DESC`,
+    [builderId]
+  );
+  return rows;
+}
+
+// revokeSessionForBuilder — kill ONE session the caller owns. The own-scoped twin
+// of revokeSessionById: same effect, but it can only ever reach a row on the
+// caller's own account. Returns 1 when a session was killed, 0 when the id was
+// already revoked, expired, unknown, or somebody else's — the four cases are
+// deliberately indistinguishable to the caller.
+
+async function revokeSessionForBuilder(sessionId, builderId) {
+  const { rowCount } = await pool.query(
+    `UPDATE builder_sessions
+        SET revoked_at = now()
+      WHERE id = $1 AND builder_id = $2 AND revoked_at IS NULL`,
+    [sessionId, builderId]
+  );
+  return rowCount;
+}
+
 // -------------------------------------------------------------------------
 // Versions
 // -------------------------------------------------------------------------
@@ -994,6 +1038,8 @@ module.exports = {
   revokeSession,
   revokeSessionById,
   revokeAllSessionsForBuilder,
+  listActiveSessionsForBuilder,
+  revokeSessionForBuilder,
   hasCliSession,
   SESSION_TTL_MS,
   LIVE_RANK_LADDER,

package/src/bongos/route-rank-check.js

@@ -197,6 +197,16 @@ const EXPECTED_RANKS = {
   // session revocation (kill another builder's / all sessions)
   'POST /auth/revoke': 'perm:auth.session.revoke',
   'POST /auth/revoke-all': 'perm:auth.session.revoke',
+  // deliberately any-builder (task 1003341) — the OWN-scoped half of the same
+  // capability. These reach only the caller's own sessions (every statement is
+  // keyed on req.builder.id), so a rank floor here would just put an Archon back
+  // between a person and their own leaked token, which is the gap they close.
+  // Pinned in BOTH directions: an accidental rank/permission gate would silently
+  // re-break the self-serve remedy, and a widening to `public` would hand an
+  // anonymous caller a sign-out button.
+  'GET /me/sessions': 'any-builder',
+  'POST /me/sessions/revoke': 'any-builder',
+  'POST /me/sessions/revoke-all': 'any-builder',
   // forensic surfaces
   'GET /audit-log': 'perm:audit_log.read',
   'GET /builders/roster': 'perm:builder.roster.read',

package/src/bongos/routes/my-sessions.js

@@ -0,0 +1,128 @@
+// src/bongos/routes/my-sessions.js — a builder's own auth sessions: see them, kill them.
+//
+// WHY. A CLI bearer refreshes to now()+24h on every authenticated call (the
+// refresh-on-use UPDATE in db-kernel.js lookupSession), so a token that keeps
+// being used never expires on its own. Until these routes existed the only
+// remedy for a LEAKED one was POST /auth/revoke-all, gated on the admin
+// `auth.session.revoke` atom — so the victim had to find an Archon to sign them
+// out, and a single-owner self-hosted instance may not have a second Archon at
+// all. That is the gap this file closes: the account holder gets the remedy
+// directly, without anybody's permission but their own.
+//
+// THE INVARIANT, and the only thing that really matters when editing this file:
+// the account is ALWAYS req.builder.id, resolved by requireBuilder from the
+// session the caller actually presented. It is never read from the query
+// string, the request body, or the path. Every statement underneath carries
+// `builder_id = <caller>` in its WHERE clause, so an id belonging to somebody
+// else matches no row: a caller who guesses a stranger's session id gets
+// `revoked: 0` and learns nothing about whether it existed.
+//
+// WHY ITS OWN FILE rather than three more routes in routes/auth.js. The
+// cross-builder admin pair next door legitimately takes its target from the
+// request body — that is what makes it an admin route. Keeping the own-scoped
+// half in a separate file lets tests/own_session_revoke.mjs assert the
+// no-caller-named-id rule over this source WHOLE, with no carve-out for a
+// neighbouring route to hide behind. routes/auth.js is also the largest file in
+// the directory; this work does not belong in it.
+//
+// The token value is never selected, never logged, and never returned — a list
+// that handed back tokens would turn one stolen session into all of them.
+//
+// The 24h sliding refresh itself is deliberately left alone here; ADR 0206
+// records why an absolute ceiling is a separate decision from this remedy.
+
+const express = require('express');
+const auth = require('../auth');
+const db = require('../db');
+const { validateOrRespond } = require('./_helpers');
+const log = require('../logger').logger.child({ src: 'my-sessions' });
+
+// A bigserial id as the client may spell it. Matched (and then PASSED) as a
+// string rather than coerced through Number: a bigint above 2^53 would lose
+// precision on the way through, and a parameterized comparison against a bigint
+// column takes the text form without complaint.
+const SESSION_ID_RE = /^[0-9]{1,19}$/;
+
+// The list shape a person needs to RECOGNISE one of their own sessions: where it
+// came from, when it was minted, when it was last used, what client held it —
+// plus which row is the very request being served, so the UI can warn before
+// somebody signs out the browser they are reading the page in.
+function presentSession(row, currentSessionId) {
+  return {
+    id: String(row.id),
+    source: row.source,
+    user_agent: row.user_agent ?? null,
+    created_at: row.created_at,
+    last_used_at: row.last_used_at,
+    expires_at: row.expires_at,
+    current: currentSessionId !== null && String(row.id) === currentSessionId,
+  };
+}
+
+// The id of the session THIS request authenticated with, as a string, or null
+// when the auth layer did not leave one (no live row can then be marked current,
+// which is the safe direction — the UI simply omits the "this is you" badge).
+function currentSessionId(req) {
+  const id = req.gdsSession && req.gdsSession.session_id;
+  return id === undefined || id === null ? null : String(id);
+}
+
+module.exports = function buildMySessionsRouter() {
+  const router = express.Router();
+
+  // GET /api/bongos/me/sessions — every live session on the CALLER's account.
+  // rank: any-builder (own identity only) — a builder owns their own sessions;
+  // the account is req.builder.id, never a caller-named one, so there is nothing
+  // here for a rank gate to protect.
+  router.get('/me/sessions', auth.requireBuilder, async (req, res) => {
+    try {
+      const rows = await db.listActiveSessionsForBuilder(req.builder.id);
+      const current = currentSessionId(req);
+      res.json({ sessions: rows.map((row) => presentSession(row, current)) });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'GET /me/sessions failed');
+      res.fail('list_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /api/bongos/me/sessions/revoke — kill ONE of the caller's own sessions.
+  // Body: { session_id }. Response: { ok, revoked: 0|1 }. Revoking the session
+  // that made the request is allowed and immediate: the response is written from
+  // a request that already authenticated, and the next call with that token
+  // fails. `revoked: 0` covers "already gone", "never existed" and "not yours"
+  // alike — the caller must not be able to probe for other people's session ids.
+  // rank: any-builder (own identity only) — the WHERE clause is the boundary.
+  router.post('/me/sessions/revoke', auth.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, { session_id: {} })) return;
+    const raw = req.body && req.body.session_id;
+    if (raw === undefined || raw === null || !SESSION_ID_RE.test(String(raw))) {
+      return res.fail('bad_session_id', { status: 400, message: 'session_id must be a positive integer id from GET /me/sessions' });
+    }
+    try {
+      const revoked = await db.revokeSessionForBuilder(String(raw), req.builder.id);
+      res.json({ ok: true, revoked });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'POST /me/sessions/revoke failed');
+      res.fail('revoke_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /api/bongos/me/sessions/revoke-all — sign out everywhere. Kills EVERY
+  // live session on the caller's account, the one making the request included.
+  // That total sweep is the point: this is the button somebody presses when they
+  // believe a token has leaked, and a remedy that spared one session would leave
+  // them guessing which. They sign in again afterwards. Response: { ok, revoked }.
+  // rank: any-builder (own identity only) — the sweep is keyed on req.builder.id.
+  router.post('/me/sessions/revoke-all', auth.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {})) return;
+    try {
+      const revoked = await db.revokeAllSessionsForBuilder(req.builder.id);
+      res.json({ ok: true, revoked });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'POST /me/sessions/revoke-all failed');
+      res.fail('revoke_all_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/src/bongos/routes.js

@@ -22,6 +22,10 @@ const buildInstanceRouter = require('./routes/instance');
 const buildAuthRouter = require('./routes/auth');
 const buildGithubRouter = require('./routes/github');
 const buildMeRouter = require('./routes/me');
+// The own-scoped session self-service (list / revoke one / sign out everywhere,
+// task 1003341). Its own router rather than three more routes on the /me
+// aggregator or the admin pair in routes/auth.js — see that file's header.
+const buildMySessionsRouter = require('./routes/my-sessions');
 const buildBuildersRouter = require('./routes/builders');
 // The LIFECYCLE routes (tasks · claims · versions · done-when · goals ·
 // dependencies · gate-approvals · analytics) carved into modules/lifecycle/
@@ -124,6 +128,7 @@ function buildGdsRouter() {
   router.use(buildAuthRouter());
   router.use(buildGithubRouter());
   router.use(buildMeRouter());
+  router.use(buildMySessionsRouter());
   router.use(buildBuildersRouter());
   // tasks · claims · versions · done-when · goals · dependencies · analytics now
   // mount via moduleLoader.mountModuleRoutes below (lifecycle module, BV1.R86) —

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.417'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.418'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/own_scope_guard.mjs

@@ -79,6 +79,11 @@ const OWN_SCOPED_SURFACES = [
     why: 'the /me aggregator: identity, rank, credits, streak, claims and prefs for the CALLER. Every slice keys on req.builder.id.',
     crossOwner: [],
   },
+  {
+    file: 'src/bongos/routes/my-sessions.js',
+    why: "the caller's OWN auth sessions — list, revoke one, sign out everywhere (task 1003341, ADR 0206). Every statement carries builder_id = req.builder.id, so a session id belonging to somebody else matches no row. Kept OUT of routes/auth.js precisely so this whole file can be held to the own-scope rule: the admin cross-builder pair next door takes its target from the body, which is what makes it admin.",
+    crossOwner: [],
+  },
   {
     file: 'modules/builder-settings/routes/settings.js',
     why: 'the per-builder preference domain (wandering, skill, sound, render, model-allocation, display name) carved out of /me — read and write, all keyed on req.builder.id.',