@bongos/core 1.19.542 → 1.19.544

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.542",
-  "core_contract": "1.19.542",
-  "source_commit": "ec461e927a5fe4bb98053989f04853aa378878ee",
+  "core_version": "1.19.544",
+  "core_contract": "1.19.544",
+  "source_commit": "39e93444ac36149c8bb957f5ae126d8aa7cd62f2",
   "source_ref": "HEAD",
-  "built_at": "2026-09-04T17:03:11.236Z",
+  "built_at": "2026-09-04T17:18:05.591Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 441,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2002,
+    "functional_verbatim": 2003,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2467,
-  "tree_sha256": "15eb33889177142913c49676b48a92f947cc04ace14b1cc1b0055e773f996645",
+  "file_count": 2468,
+  "tree_sha256": "b0c7ab244b91e9f7d26b62e0eab1f44718911676a3fa72e820c1a0df26ca25a2",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2647,7 +2647,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f5af0c300e59c22fcfeaafba88b00bd39f65afb2f51529efb0981a898aebb766"
+      "sha256": "12a76f02ae81dc2a3674d6de15040ab2131cdf4dc912b4e48291d4790be9cde1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7412,12 +7412,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3292c34b3bdbd992383b7d539a5cc5e1734ac78aff6ca476db6d3e558a60db32"
+      "sha256": "5a9a55d27d4d93812cd6e549519231de3458d772987ad429cb2ae4f746af820f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0e83db7f6c2b6d6310d2f20810817be1e483f774d64def7852895c2f85eff047"
+      "sha256": "bf0b5224da645322f40ca158a7e795b728cd9a5b05a746c46937b31702b3aed6"
     },
     {
       "path": "public-docs/index.html",
@@ -7602,7 +7602,7 @@
     {
       "path": "scripts/gds/box.js",
       "mode": "0000644",
-      "sha256": "d6533af0ebd1e75cda7816694871b4bac812b972b9e67b6f9cbbdaeaaf3f75a8"
+      "sha256": "afcebfb8e8e8f7041ee9cbfce1e9b8a46a299feb5e6e89ce4e00273135b268db"
     },
     {
       "path": "scripts/gds/build-bongos.js",
@@ -9102,7 +9102,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "980c4fd7007ae4d60c95392644476ef440e9d0e0a1eaa3aa4f19f4f3bd5cb69c"
+      "sha256": "de4fc6ed04c9b3425132b6671c6741bcbc18c8e8b5545c5ee12fe2f2f723f725"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9484,6 +9484,11 @@
       "mode": "0000644",
       "sha256": "f0718abdcaaf538bff5b7724bf848ec8a81082192fee4f492409a13faf18c578"
     },
+    {
+      "path": "tests/box_env.mjs",
+      "mode": "0000644",
+      "sha256": "38fa2cd23a84c4e5d7c9b665e906b14965783bc0c570f444764c68a539bc0073"
+    },
     {
       "path": "tests/box_host_keys.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1533,5 +1533,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.540 with no explicit bump. run 33897974683. (task 1002620)
   1.19.542 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.541 with no explicit bump. run 33898437821. (task 1002620)
+  1.19.543 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.542 with no explicit bump. run 33898997776. (task 1002620)
+  1.19.544 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.543 with no explicit bump. run 33899781074. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.542",
+  "version": "1.19.544",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.542",
+      "version": "1.19.544",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.542",
+  "version": "1.19.544",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box.js

@@ -177,6 +177,25 @@ async function resolveBuilder(pool, ref) {
 // A short, DNS-safe-ish suffix from the current time (CLI context — Date is fine).
 // ---- provision -------------------------------------------------------------
 
+// Pure: renders the /etc/otb/box.env content cloud-init bakes onto a box (task
+// 1002466). Split out of cmdProvision so GDS_BASE — and the named-tunnel block
+// baked in beside it — can be unit-tested without DB/DO/Cloudflare.
+//
+// GDS_BASE is the FULL api base (origin + /api/gds), matching what
+// infra/box-report-*.sh already derive from the session file when the env var is
+// absent (`"$GDS_BASE/box/host-keys"` with no further path inserted) — every box
+// used to get this only as a fallback derived on-box; baking it explicitly closes
+// the one on-box script (box-source-fetch.sh, out-of-repo) that skips that
+// derivation entirely and hardcodes a different instance's origin instead.
+function buildBoxEnv({ apiOrigin, namedTunnel }) {
+  let env = `# /etc/otb/box.env — baked by box.js provision\nGDS_BASE=${String(apiOrigin).replace(/\/+$/, '')}/api/gds\n`;
+  if (namedTunnel) {
+    const { token, hostname, credential, previewHostname } = namedTunnel;
+    env += `# named tunnel (#771/#774, ADR 0038)\nBOX_TUNNEL_TOKEN=${token}\nBOX_TERMINAL_HOSTNAME=${hostname}\nBOX_TERMINAL_CREDENTIAL=${credential}\nBOX_PREVIEW_HOSTNAME=${previewHostname}\n`;
+  }
+  return env;
+}
+
 async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {
   const builder = await resolveBuilder(pool, ref);
   if (!builder) return fail(`no builder matches "${ref}"`);
@@ -272,7 +291,13 @@ async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {
   // (setTerminalAccess): the builder reads them from the hall, with no token placed
   // on the box and no box-side reporter (the quick-tunnel fallback that caused the
   // #771/#774 chicken-and-egg). ADR 0016 holds — no credential funneled into a box.
-  let boxEnv = '';
+  // GDS_BASE (task 1002466 — see buildBoxEnv above for the shape/why): a box was
+  // never actually bare here EXCEPT the one on-box script that skips the
+  // session-file fallback (box-source-fetch.sh, out-of-repo on the control-plane
+  // — see the cross-repo blocker filed alongside this fix). Baking it explicitly
+  // closes that gap for every future box regardless of which script forgets it.
+  const apiOrigin = process.env.GDS_PUBLIC_ORIGIN || instanceConfig.defaultApiBase();
+  let boxEnv = buildBoxEnv({ apiOrigin });
   let terminalHostname = null;
   let terminalCredential = null;
   if (namedTunnelEnabled()) {
@@ -286,7 +311,10 @@ async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {
       // + DNS for the live game preview. Bake its hostname so the box's
       // box-preview command can show the builder their URL (no DB row needed — the
       // host is deterministic; box-game-preview.service serves :3000 behind it).
-      boxEnv = `# /etc/otb/box.env — baked by box.js provision (#771/#774, ADR 0038 named tunnel)\nBOX_TUNNEL_TOKEN=${token}\nBOX_TERMINAL_HOSTNAME=${th}\nBOX_TERMINAL_CREDENTIAL=${terminalCredential}\nBOX_PREVIEW_HOSTNAME=${ph}\n`;
+      boxEnv = buildBoxEnv({
+        apiOrigin,
+        namedTunnel: { token, hostname: th, credential: terminalCredential, previewHostname: ph },
+      });
       console.log(`  ✓ named tunnel ready — ${th}`);
       console.log(`  ✓ live game preview — https://${ph} (ADR 0044)`);
       // The rule PUT is the ONLY thing that proves edit scope. Report its real
@@ -330,6 +358,12 @@ async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {
     builder: { id: builder.id, github_login: builder.github_login, rank: builder.rank },
     // The instance's OWN public origin (task 1002428) — a hardcoded founder host
     // here would point every newly provisioned box at the wrong instance.
+    //
+    // defaultApiBase(), deliberately NOT resolveApiBase() (task 1002466): a box
+    // belongs to the SERVER it was provisioned on, not to whichever instance this
+    // operator's own CLI session happens to be signed into right now — the two can
+    // differ (an operator provisioning boxes across instances) and the box must
+    // still call home to itself, not to the operator's other login.
     api_base: process.env.GDS_PUBLIC_ORIGIN || instanceConfig.defaultApiBase(),
   }, null, 2);
 
@@ -1265,4 +1299,4 @@ async function main() {
 
 if (require.main === module) main();
 
-module.exports = { cmdProvision, deprovisionOne, parkOne, cmdSweepIdle, cmdSweepDormant, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed, resolveBoxInfraDir, boxInfraCandidates, readCloudInit, BOX_INFRA_TEMPLATE };
+module.exports = { cmdProvision, deprovisionOne, parkOne, cmdSweepIdle, cmdSweepDormant, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed, resolveBoxInfraDir, boxInfraCandidates, readCloudInit, buildBoxEnv, BOX_INFRA_TEMPLATE };

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.542'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.544'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_env.mjs

@@ -0,0 +1,64 @@
+// tests/box_env.mjs
+//
+// task 1002466 — a provisioned box's cloud-init baked NO GDS_BASE, so any on-box
+// script that (unlike infra/box-report-*.sh) doesn't fall back to deriving it from
+// the session file's api_base had nothing telling it which instance to talk to.
+// box.js now bakes GDS_BASE explicitly via the pure buildBoxEnv() helper, split
+// out of cmdProvision so this can be pinned without DB/DO/Cloudflare.
+//
+// Pure + hermetic: buildBoxEnv takes plain inputs and returns a string. No DB, no
+// network, no droplet.
+//
+// Run:  node tests/box_env.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const box = require('../scripts/gds/box.js');
+
+const { test, summary } = makeRunner();
+
+await test('bakes GDS_BASE as the FULL api base (origin + /api/gds) — matches box-report-*.sh, not box-heartbeat.sh\'s bare-origin BASE', () => {
+  const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com' });
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
+});
+
+await test('strips a trailing slash off the origin before appending /api/gds', () => {
+  const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com/' });
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
+  assert.ok(!env.includes('//api/gds'), 'must not double the slash');
+});
+
+await test('no named tunnel: box.env carries GDS_BASE and nothing else', () => {
+  const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com' });
+  assert.ok(!/BOX_TUNNEL_TOKEN|BOX_TERMINAL_HOSTNAME|BOX_TERMINAL_CREDENTIAL|BOX_PREVIEW_HOSTNAME/.test(env));
+});
+
+await test('named tunnel: box.env carries GDS_BASE AND all four tunnel vars', () => {
+  const env = box.buildBoxEnv({
+    apiOrigin: 'https://cloudbongos.com',
+    namedTunnel: {
+      token: 'tok123', hostname: 'term-alice.example.com',
+      credential: 'cred456', previewHostname: 'sandbox-alice.example.com',
+    },
+  });
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
+  assert.match(env, /^BOX_TUNNEL_TOKEN=tok123$/m);
+  assert.match(env, /^BOX_TERMINAL_HOSTNAME=term-alice\.example\.com$/m);
+  assert.match(env, /^BOX_TERMINAL_CREDENTIAL=cred456$/m);
+  assert.match(env, /^BOX_PREVIEW_HOSTNAME=sandbox-alice\.example\.com$/m);
+});
+
+await test('every line is a clean KEY=VALUE (or a comment) — no leftover template gaps', () => {
+  const env = box.buildBoxEnv({
+    apiOrigin: 'https://cloudbongos.com',
+    namedTunnel: { token: 't', hostname: 'h', credential: 'c', previewHostname: 'p' },
+  });
+  for (const line of env.split('\n').filter(Boolean)) {
+    assert.ok(/^#/.test(line) || /^[A-Z_]+=\S+$/.test(line), `unexpected line shape: ${line}`);
+  }
+});
+
+summary();