@bongos/core 1.19.507 → 1.19.508

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.507",
-  "core_contract": "1.19.507",
-  "source_commit": "f4008a4f0c0527a72d19cfc989889a3610a164d1",
+  "core_version": "1.19.508",
+  "core_contract": "1.19.508",
+  "source_commit": "f80c3ed5ba139cbecb704b5cd064990b3ff9aaaf",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T18:09:01.161Z",
+  "built_at": "2026-09-03T18:24:24.662Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 427,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1946,
+    "functional_verbatim": 1947,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2397,
-  "tree_sha256": "cf9525f9de033ff0382bbc7986cc416062ed1a629caabc30849cc4efa1065398",
+  "file_count": 2398,
+  "tree_sha256": "8482fdb735f30dbc4866dbf952a55196a50e643fd932b0ef0bb5b701ada05eab",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2577,7 +2577,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ca0326ffd2f4996d2c4f42940ba5c2a2b40b18f9a676023918fd2cde9cd85634"
+      "sha256": "4af1ded195d83c7060e26bf72c6aa27144bfba92e2ce679e2e90d57b866a0c93"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7227,12 +7227,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e59012a1aaea2c2e25ac2a7f0c40f096bfe2cae832502cdabfe3519fdb37322d"
+      "sha256": "e9270218a7b9b405011ac398777c9eb70fca7f0cdf3010649ea7450f25d399bb"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "aae944a6300fb887bd38a4692813e2f03965d7bb044c843fe7f23a26715233d8"
+      "sha256": "6a1614277a1b71103a1882256a82e138cbdb4bfbc28be233e69cc751d7f24eed"
     },
     {
       "path": "public-docs/index.html",
@@ -8902,7 +8902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c8e168b4ae8a7dc956802de03248b6509b871e98bf0315dbd94d8dc7cc16be50"
+      "sha256": "eef34fbd7a43f793b876c07999581137f4e8e37cc0b3f03d7db41759b0271693"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10317,7 +10317,7 @@
     {
       "path": "tests/hall_page_gate_map.mjs",
       "mode": "0000644",
-      "sha256": "d529685063de8c4aa6676abf86f1180bb9cd13d27a3c372d8a3d9cf078af1999"
+      "sha256": "e65e22471469a9bf4551925f0549cfd6720aa7d5b7b7cf9df17984604e07c3cb"
     },
     {
       "path": "tests/hall_palette.mjs",
@@ -10879,6 +10879,11 @@
       "mode": "0000644",
       "sha256": "079d7eef5828912e306e9dbbe081fef6004526067bd15aa6433dc2ff1873a4be"
     },
+    {
+      "path": "tests/my_projects_surface.mjs",
+      "mode": "0000644",
+      "sha256": "03b61cb8de6713b03fe17b2b3c5d70af7c511b33b17a42295f49c36e27771470"
+    },
     {
       "path": "tests/needs_rebase.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1451,5 +1451,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.505 with no explicit bump. run 33787453336. (task 1002620)
   1.19.507 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.506 with no explicit bump. run 33788726591. (task 1002620)
+  1.19.508 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.507 with no explicit bump. run 33790206682. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.507",
+  "version": "1.19.508",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.507",
+      "version": "1.19.508",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.507",
+  "version": "1.19.508",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.507'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.508'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_page_gate_map.mjs

@@ -47,6 +47,13 @@ const ORACLE = {
   '/builders/modules': 'requireBuilderPage',
   '/builders/goals': 'requireBuilderPage',
   '/builders/roadmap': 'requireBuilderPage',
+  // Gated at this tier all along, but with no row until task 1003448 walked the
+  // module's pages: copy-desk (task 1003113) and ideas (task 1002928) are open to
+  // every rank by design, and collab's reads (task 1003172) are scoped to the
+  // caller by the server — so for all three, sign-in IS the whole gate.
+  '/builders/copy-desk': 'requireBuilderPage',
+  '/builders/ideas': 'requireBuilderPage',
+  '/builders/collab': 'requireBuilderPage',
   // task 1002710: the orientation reading rooms moved DOWN to this tier from
   // requireNonXenosPage (thetes+). They are the onboarding documents, so gating
   // them above xenos turned away the exact reader they were written for. The
@@ -92,10 +99,33 @@ const ORACLE = {
   '/builders/drachmae': null,
   '/builders/profile': null,
   '/builders/not-ready': null,
+
+  // NOT deliberate — recorded because it is true, and filed as idea 1000907
+  // (task 1003448). The detail pages are addressed by a second segment, and
+  // /builders/task/:id and /builders/idea/:id are both gated at signed-in; the
+  // id-less slugs still resolve to the same shells through BUILDERS_PAGE_RE and
+  // match no gate. No data rides the shell and every read behind it is gated
+  // server-side, so this is an inconsistency rather than an exposure — but it is
+  // a row that should turn into a real gate (or a redirect) when that is decided.
+  '/builders/task': null,
+  '/builders/idea': null,
+
+  // Gone, not public — the hall ships no my-projects page at all since task
+  // 1003308 (owner's decision: "my projects" is a user-level page the hub owns,
+  // so the hall ships no page, no link and no redirect). Nothing is served here,
+  // so there is nothing to gate. Recorded rather than left out, because "absent
+  // from the map" is indistinguishable from the oversight this file exists to
+  // catch. GONE_PAGES below keeps the row honest if the file ever returns.
+  '/builders/my-projects': null,
 };
 
 // ─── reconstruct the URL→gate map from the source ───────────────────────────
 // 1. every `const NAME_RE = /…/;` (the page-matching regexes)
+// The eval below turns a matched regex LITERAL back into a RegExp. Its only
+// input is this repo's own serve-internal.js, read from a path fixed at the top
+// of this file — never a caller's string, never anything fetched. Keep it that
+// way: sourcing SRC from anywhere an outsider can influence makes this arbitrary
+// code execution rather than a parser.
 function readRegexes(src) {
   const out = new Map();
   const re = /const\s+([A-Z0-9_]+_RE)\s*=\s*(\/(?:\\.|\[(?:\\.|[^\]])*\]|[^/\\])+\/[gimsuy]*)\s*;/g;
@@ -170,6 +200,47 @@ test('path-normalization tricks do not slip past a gate', () => {
   }
 });
 
+// ═══ exhaustiveness — the reason a page can go missing from the oracle ═══════
+// The ORACLE above is hand-written, so until now a page could ship with NO gate
+// and NO row and nothing would notice — the same blind spot that let /sessions
+// and /scouting ship ungated, and that left /my-projects out of the map entirely
+// (task 1003448). Walking the module's own pages turns "someone remembered to
+// add a row" into "the tree is walked", which is the half this test was missing.
+const HALL_PAGES_DIR = path.join(ROOT, 'modules/hall-ui/public');
+
+function hallPageUrls() {
+  return fs.readdirSync(HALL_PAGES_DIR)
+    .filter((f) => f.endsWith('.html'))
+    .map((f) => (f === 'index.html' ? '/builders/' : `/builders/${f.replace(/\.html$/, '')}`));
+}
+
+test('every hall page the module ships has a row in the oracle', () => {
+  const missing = hallPageUrls().filter((url) => !(url in ORACLE));
+  assert.deepEqual(missing, [],
+    `hall pages with no ORACLE row: ${missing.join(', ')} — give each a gate, or a deliberate null with the reason`);
+});
+
+// A page can also LEAVE the hall, and then `null` claims something weaker than
+// "the shell is public": nothing is served at that URL at all. Spelling those out
+// keeps the row honest — if the file ever comes back, the null stops describing
+// reality, and this fails instead of quietly waving an ungated shell through.
+const GONE_PAGES = {
+  // Removed by an owner decision in task 1003308 — "my projects" is a user-level
+  // page the hub already owns, so the hall ships no page, no link and no
+  // redirect. tests/hall_settings_world.mjs pins the deletion itself; this row
+  // pins what the deletion means for the gate map.
+  '/builders/my-projects': 'task 1003308 — the hub owns "my projects"',
+};
+
+test('a row that is null because the page left the hall serves no page', () => {
+  for (const [url, why] of Object.entries(GONE_PAGES)) {
+    assert.equal(ORACLE[url], null, `${url} is gone (${why}), so it can carry no gate`);
+    const file = path.join(HALL_PAGES_DIR, `${url.replace('/builders/', '')}.html`);
+    assert.ok(!fs.existsSync(file),
+      `${url} is back, so "${why}" no longer holds — give it a real gate and a real row`);
+  }
+});
+
 test('no gated page is left matching only a REMOVED gate function', () => {
   // requireNonXenosPage still EXISTS in auth.js (page.view.builder is a live
   // catalog atom an Archon can attach to a custom role) but task 1002710 left it

package/tests/my_projects_surface.mjs

@@ -0,0 +1,112 @@
+// tests/my_projects_surface.mjs
+//
+// GUARD (task 1003448): pins the three answers the "/my-projects is unreachable"
+// audit finding actually has, so that none of them is a claim in a session log
+// that the next reader has to take on faith.
+//
+// The audit (2026-08-30) reported the hall's my-projects page as unreachable and
+// ungated, and flagged the second half as "NOT CONFIRMED AS A LEAK — check the
+// API gates first, then decide whether the fix is a gate, a nav entry, or both".
+// By the time the task was worked, the answer to "a gate or a nav entry" had
+// become "neither":
+//
+//   1. WHERE THE PAGE WENT. Task 1003308 deleted it on an owner decision — "my
+//      projects" is a user-level page the hub already owns, so the hall ships no
+//      page, no link and no redirect. A nav entry would reverse that decision and
+//      a page gate would guard a URL that resolves to no file. (The deletion
+//      itself is pinned by tests/hall_settings_world.mjs; the gate map's row for
+//      it by tests/hall_page_gate_map.mjs.)
+//   2. WHETHER ANYTHING LEAKED. No: every /my-projects* route is sign-in-gated
+//      and reads the caller's OWN identity off the session. This is the half the
+//      audit could not confirm, so it is asserted here rather than described.
+//   3. WHAT IS STILL MISSING. The invitations half has no caller anywhere — no
+//      surface fetches the invite list, so a builder holding an invitation still
+//      cannot act on it. That is tracked work (task 1002970, idea 1000903), and
+//      pinning it keeps a known gap from decaying back into an unknown one.
+//
+// Static reads only (no import of the app, no DB) → runs in the `unit` gate.
+//
+// Run:  node --test --test-reporter=tap tests/my_projects_surface.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+const ROUTES = 'modules/platform-identity/routes/my-projects.js';
+
+// ── 1. the page is gone from the hall, by decision ──────────────────────────
+// Kept to the ONE fact this file's other assertions lean on: there is no hall
+// page, so "unreachable from the hall" is a decision to honour and not a defect
+// to fix. tests/hall_settings_world.mjs owns the full deletion pin.
+test('the hall ships no my-projects page, so there is nothing to link or gate', () => {
+  const dir = path.join(ROOT, 'modules/hall-ui/public');
+  const strays = fs.readdirSync(dir).filter((f) => f.startsWith('my-projects'));
+  assert.deepEqual(strays, [],
+    'task 1003308 removed the hall page (the hub owns "my projects") — if it is back, that decision changed and this file, the nav and the page gate all need revisiting');
+});
+
+// ── 2. the "not confirmed as a leak" half, confirmed ────────────────────────
+// The audit's worry was a shell served to anyone who asked. The shell is gone,
+// but the routes behind it outlived it, so the gate is what matters now.
+const MY_PROJECTS_ROUTES = [
+  "router.get('/my-projects'",
+  "router.post('/my-projects/join'",
+  "router.get('/my-projects/invites'",
+  "router.post('/my-projects/invites/:clientId/accept'",
+  "router.post('/my-projects/invites/:clientId/decline'",
+  "router.post('/my-projects/:clientId/leave'",
+];
+
+test('every /my-projects route is sign-in gated', () => {
+  const src = read(ROUTES);
+  for (const decl of MY_PROJECTS_ROUTES) {
+    const at = src.indexOf(decl);
+    assert.notEqual(at, -1, `${decl} — route missing; this list is stale`);
+    // The gate is the argument immediately after the path, so read the rest of
+    // that line rather than the whole file: a requireBuilder somewhere else in
+    // the module must not vouch for a route that carries no gate of its own.
+    const line = src.slice(at, src.indexOf('\n', at));
+    assert.match(line, /,\s*requireBuilder\s*,/,
+      `${decl} must carry requireBuilder — an ungated route here exposes cross-project membership`);
+  }
+});
+
+test('every /my-projects handler reads the caller identity from the session', () => {
+  // The gate only proves SOMEONE is signed in. What keeps one builder out of
+  // another's projects is that the github_id comes off req.builder and is never
+  // accepted from the caller — no :githubId param, no body-supplied account.
+  const src = read(ROUTES);
+  assert.ok(src.includes('req.builder.github_id'), 'identity must come off the session');
+  assert.doesNotMatch(src, /\/my-projects[^']*:githubId/,
+    'no /my-projects route may take an account id as a path parameter');
+  assert.doesNotMatch(src, /githubId:\s*(?:req\.body|req\.query)/,
+    'no /my-projects handler may take the account id from the request body or query');
+});
+
+// ── 3. the gap that is left, named and tracked ─────────────────────────────
+test('the invitations API still has no caller — the tracked gap, pinned', () => {
+  // Deliberately asserts a MISSING feature. Task 1003308 removed the only
+  // surface that fetched invitations, so a builder who holds one has nowhere to
+  // accept or decline it. Task 1002970 (blocked on task 1002969) and idea
+  // 1000903 own the replacement; this pin exists so the gap stays visible until
+  // one of them lands, and so it is impossible to close this quietly.
+  const surfaces = [];
+  const modules = path.join(ROOT, 'modules');
+  for (const key of fs.readdirSync(modules)) {
+    const pub = path.join(modules, key, 'public');
+    if (!fs.existsSync(pub)) continue;
+    for (const f of fs.readdirSync(pub)) {
+      if (!/\.(js|html)$/.test(f)) continue;
+      if (fs.readFileSync(path.join(pub, f), 'utf8').includes('/my-projects/invites')) {
+        surfaces.push(`modules/${key}/public/${f}`);
+      }
+    }
+  }
+  assert.deepEqual(surfaces, [],
+    `an invitations surface exists now (${surfaces.join(', ')}) — good: delete this pin and close task 1002970 / idea 1000903`);
+});