@bongos/core 1.19.725 → 1.19.727
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.bongos-core.json +179 -494
- package/.devcontainer/Dockerfile +1 -1
- package/.devcontainer/devcontainer.json +2 -2
- package/.devcontainer/healthcheck.sh +1 -1
- package/.devcontainer/init-firewall.sh +1 -1
- package/.devcontainer/post-create.sh +2 -2
- package/.env.local.example +1 -1
- package/Dockerfile +1 -1
- package/docs/copy-inventory.md +1 -1
- package/docs/copy-registry.json +9 -9
- package/docs/module-api-changelog.md +4 -0
- package/docs/recipes/devbox-app-release.md +4 -4
- package/modules/dev-box/app/scripts/dmgbuild-settings.py +5 -5
- package/modules/dev-box/app/scripts/gen-brand.js +1 -1
- package/modules/dev-box/app/src/brand.js +1 -1
- package/modules/dev-box/app/test/unit.mjs +16 -16
- package/modules/dev-box/box-access.js +1 -1
- package/modules/dev-box/routes/box.js +1 -1
- package/modules/discord/discord-approvals.js +1 -1
- package/modules/grading/grader-model.js +1 -1
- package/modules/grading/grader-prompt.js +1 -1
- package/modules/grading/grader-workers/quality.js +1 -1
- package/modules/hall-ui/module.json +1 -1
- package/modules/hall-ui/public/brand-apply.js +1 -1
- package/modules/hall-ui/public/shell.js +1 -1
- package/modules/hall-ui/public/work.js +1 -1
- package/modules/lifecycle/conflict-resolve.js +1 -1
- package/modules/lifecycle/db-analytics.js +1 -1
- package/modules/lifecycle/routes/analytics.js +1 -1
- package/modules/onboarding/approval-broadcast.js +1 -1
- package/modules/onboarding/onboarding.js +1 -1
- package/modules/provisioning/tests/liveness.mjs +1 -1
- package/modules/public-landing/public/index.html +1 -1
- package/modules/public-landing/public/projects-floor.states.json +2 -2
- package/modules/public-landing/public/projects.probes.json +4 -4
- package/modules/public-landing/public/projects.states.json +2 -2
- package/modules/status-ui/module.json +1 -1
- package/modules/status-ui/public/status.js +4 -4
- package/modules/status-ui/public/style.css +1 -1
- package/modules/ui-design/kit/fixtures/cost-summary.json +1 -1
- package/modules/ui-design/kit/fixtures/featured-hub.json +1 -1
- package/modules/ui-design/kit/fixtures/featured.json +1 -1
- package/modules/ui-design/kit/fixtures/leaderboard.json +1 -1
- package/modules/ui-design/kit/fixtures/my-projects.json +1 -1
- package/modules/ui-design/kit/fixtures/progress.json +1 -1
- package/modules/ui-design/kit/fixtures/recent-shipped.json +1 -1
- package/package-lock.json +2 -2
- package/package.json +1 -1
- package/scripts/cron/style_guide_audit.sh +1 -1
- package/scripts/discord/lib.js +1 -1
- package/scripts/discord/post.js +1 -1
- package/scripts/gds/audit-authorship.sh +1 -1
- package/scripts/gds/audit-replay.sh +29 -2
- package/scripts/gds/audit-ships.js +1 -1
- package/scripts/gds/backfill-sessions.js +2 -2
- package/scripts/gds/cf-tunnel.js +4 -4
- package/scripts/gds/claude-materialize.js +2 -2
- package/scripts/gds/cli-lib.js +6 -6
- package/scripts/gds/cutover-codemod.js +1 -1
- package/scripts/gds/dev-lib.js +2 -2
- package/scripts/gds/diagnose-achievements.js +2 -2
- package/scripts/gds/fitness-checks-identity.js +6 -4
- package/scripts/gds/gate-review.js +14 -6
- package/scripts/gds/gen-diagrams.js +1 -1
- package/scripts/gds/leak-scan-allowlist.js +293 -0
- package/scripts/gds/learning-capture.js +1 -1
- package/scripts/gds/linkify-refs.js +2 -2
- package/scripts/gds/local-preview-lib.js +1 -1
- package/scripts/gds/mirror-lineage-check.js +1 -1
- package/scripts/gds/mirror-redact.js +17 -2
- package/scripts/gds/newcomer-floor.templates.json +1 -1
- package/scripts/gds/package-core.js +18 -1
- package/scripts/gds/paste-token.js +1 -1
- package/scripts/gds/provision-units.js +2 -2
- package/scripts/gds/publish-manifest.js +15 -0
- package/scripts/gds/repo-metrics.js +1 -1
- package/scripts/gds/sandbox-stage.js +1 -1
- package/scripts/gds/seed-bongos-coreB-tranche1-tasks.js +1 -1
- package/scripts/gds/seed-bongos-coreB-tranche2-tasks.js +1 -1
- package/scripts/gds/seed-bongos-goal-hierarchy-tasks.js +1 -1
- package/scripts/gds/seed-bongos-tasks.js +2 -2
- package/scripts/gds/seed-gds-v4-tasks.js +1 -1
- package/scripts/gds/seed-medusa-tasks.js +10 -10
- package/scripts/gds/seed-module-upstreaming.js +1 -1
- package/scripts/gds/seed-productization-tasks.js +6 -6
- package/scripts/gds/seed-provisioning-tasks.js +2 -2
- package/scripts/gds/seed-staging.sh +19 -6
- package/scripts/gds/ship-deploy-target.js +1 -1
- package/scripts/gds/ship-flow.js +1 -1
- package/scripts/gds/smoke-gds.js +1 -1
- package/scripts/status-probe.mjs +2 -2
- package/src/bongos/auth-discord.js +2 -2
- package/src/bongos/live-channel.js +1 -1
- package/src/bongos/permission-path-check.js +80 -3
- package/src/bongos/pool.js +1 -1
- package/src/bongos/routes/auth.js +11 -11
- package/src/bongos/routes/security.js +1 -1
- package/src/bongos/routes.js +1 -1
- package/src/branding.js +1 -1
- package/src/devbox-downloads.js +1 -1
- package/src/instance-config.js +2 -2
- package/src/module-api.js +1 -1
- package/src/module-loader/provenance.js +2 -2
- package/tests/art_stage.mjs +2 -2
- package/tests/auth_anthropic_identity.mjs +1 -1
- package/tests/auth_duplicate_cookie.mjs +1 -1
- package/tests/auth_error_brand.mjs +1 -1
- package/tests/auth_inactive_builder.mjs +1 -1
- package/tests/backup_cli.mjs +4 -4
- package/tests/bongos_box_connect.mjs +2 -2
- package/tests/bongos_downloads.mjs +2 -2
- package/tests/bongos_login.mjs +5 -5
- package/tests/box_connect_e2e.mjs +2 -2
- package/tests/box_dns_repoint.mjs +10 -10
- package/tests/box_host_keys.mjs +1 -1
- package/tests/box_onboard.mjs +9 -9
- package/tests/box_scope_session.mjs +1 -1
- package/tests/box_terminal_ssrf.mjs +7 -7
- package/tests/boxes.mjs +9 -9
- package/tests/branding.mjs +2 -2
- package/tests/bump_version.mjs +2 -2
- package/tests/cf_tunnel.mjs +40 -40
- package/tests/cli_token_reissue.mjs +7 -7
- package/tests/cloud_bongos_pack.mjs +1 -1
- package/tests/currency_label.mjs +8 -8
- package/tests/dev_lib.mjs +4 -4
- package/tests/devbox_dmg_backdrop.mjs +1 -1
- package/tests/devbox_downloads.mjs +2 -2
- package/tests/devbox_icons.mjs +1 -1
- package/tests/discord_approvals.mjs +1 -1
- package/tests/discord_oauth.mjs +2 -2
- package/tests/executed_closure.mjs +6 -1
- package/tests/first_admin_bootstrap.mjs +1 -1
- package/tests/gate_approvals.mjs +5 -5
- package/tests/government_protected_surfaces.mjs +137 -0
- package/tests/grade_aggregates_unavailable.mjs +1 -1
- package/tests/hook_user_agents.mjs +2 -2
- package/tests/init.mjs +6 -6
- package/tests/instance_config.mjs +1 -1
- package/tests/instance_manifest.mjs +5 -5
- package/tests/instance_mismatch_guard.mjs +13 -13
- package/tests/leak_scan_allowlist.mjs +94 -0
- package/tests/migrate_root_resolution.mjs +4 -4
- package/tests/mirror_redact.mjs +28 -4
- package/tests/module_catalog.mjs +5 -5
- package/tests/module_submissions.mjs +3 -3
- package/tests/package_core.mjs +1 -1
- package/tests/parallel-load.mjs +6 -6
- package/tests/projects_hub.mjs +2 -2
- package/tests/provision.mjs +50 -50
- package/tests/provisioning_github_app_routes.mjs +1 -1
- package/tests/provisioning_onboard_mode.mjs +2 -2
- package/tests/publish_reconciler.mjs +4 -4
- package/tests/sandbox_stage.mjs +1 -1
- package/tests/scrubber_corpus.mjs +3 -3
- package/tests/search_isolation.mjs +1 -1
- package/tests/session_records.mjs +1 -1
- package/tests/ship_card.mjs +6 -6
- package/tests/ship_ci_deploy.mjs +1 -1
- package/tests/single_host_hall.mjs +9 -9
- package/tests/smoke_preflight.mjs +1 -1
- package/tests/smoke_target.mjs +1 -1
- package/tests/status-probe.mjs +1 -1
- package/tests/status_mirror_sync.mjs +1 -1
- package/docs/adr/0004-amazonprimea-name-and-trademark-acceptance.md +0 -45
- package/docs/design/mocks/_schemes.css +0 -604
- package/docs/design/mocks/component-sheet.html +0 -428
- package/docs/design/mocks/hall/_tokens.css +0 -370
- package/docs/design/mocks/hall/board/v1.html +0 -846
- package/docs/design/mocks/hall/board/v2.html +0 -858
- package/docs/design/mocks/hall/board/v3.html +0 -884
- package/docs/design/mocks/hall/goals/v1.html +0 -1212
- package/docs/design/mocks/hall/goals/v2.html +0 -1192
- package/docs/design/mocks/hall/goals/v3.html +0 -1205
- package/docs/design/mocks/hall/hall-sheet.html +0 -244
- package/docs/design/mocks/hall/reading/v1.html +0 -1125
- package/docs/design/mocks/hall/reading/v2.html +0 -1177
- package/docs/design/mocks/hall/reading/v3.html +0 -1150
- package/docs/design/mocks/hall/settings/v1.html +0 -1238
- package/docs/design/mocks/hall/settings/v2.html +0 -1235
- package/docs/design/mocks/hall/settings/v3.html +0 -1299
- package/docs/design/mocks/hall/task/v1.html +0 -633
- package/docs/design/mocks/hall/task/v2.html +0 -646
- package/docs/design/mocks/hall/task/v3.html +0 -647
- package/docs/design/mocks/hub/assets/r3-space-deepfield-half.jpg +0 -0
- package/docs/design/mocks/hub/assets/r3-space-deepfield-half.jpg.json +0 -13
- package/docs/design/mocks/hub/assets/r3-space-dust-half.jpg +0 -0
- package/docs/design/mocks/hub/assets/r3-space-dust-half.jpg.json +0 -13
- package/docs/design/mocks/hub/assets/r3-space-nebula-half.jpg +0 -0
- package/docs/design/mocks/hub/assets/r3-space-nebula-half.jpg.json +0 -13
- package/docs/design/mocks/hub/assets/r3-space-starfield-half.jpg +0 -0
- package/docs/design/mocks/hub/assets/r3-space-starfield-half.jpg.json +0 -13
- package/docs/design/mocks/hub/hub-sheet.html +0 -192
- package/docs/design/mocks/hub/mine.html +0 -465
- package/docs/design/mocks/hub/picker.html +0 -421
- package/docs/design/mocks/hub/planets.html +0 -356
- package/docs/design/mocks/hub/v1.html +0 -1209
- package/docs/design/mocks/hub/v2.html +0 -1257
- package/docs/design/mocks/hub/v3.html +0 -1496
- package/docs/design/mocks/hub/wizard.html +0 -421
- package/docs/design/mocks/landing/landing-sheet.html +0 -131
- package/docs/design/mocks/landing/v1.html +0 -956
- package/docs/design/mocks/landing/v2.html +0 -708
- package/docs/design/mocks/landing/v3.html +0 -911
- package/docs/design/mocks/landing-page-mock.html +0 -687
- package/docs/design/mocks/landing-palettes.html +0 -103
- package/docs/design/mocks/projects-hub-mock.html +0 -991
- package/docs/design/mocks/projects-hub-variants.html +0 -146
- package/docs/design/mocks/projects-page-mock.html +0 -167
- package/docs/design/mocks/world/blue-hud/_tokens.css +0 -246
- package/docs/design/mocks/world/blue-hud/hall.html +0 -595
- package/docs/design/mocks/world/blue-hud/landing.html +0 -424
- package/docs/design/mocks/world/blue-hud/status.html +0 -410
- package/docs/design/mocks/world/chrome-blobs/_tokens.css +0 -479
- package/docs/design/mocks/world/chrome-blobs/hall.html +0 -553
- package/docs/design/mocks/world/chrome-blobs/landing-b.html +0 -581
- package/docs/design/mocks/world/chrome-blobs/landing.html +0 -328
- package/docs/design/mocks/world/chrome-blobs/status.html +0 -416
- package/docs/design/mocks/world/natgeo-editorial/_tokens.css +0 -377
- package/docs/design/mocks/world/natgeo-editorial/hall.html +0 -649
- package/docs/design/mocks/world/natgeo-editorial/landing-b.html +0 -743
- package/docs/design/mocks/world/natgeo-editorial/landing.html +0 -475
- package/docs/design/mocks/world/natgeo-editorial/status.html +0 -437
- package/docs/design/mocks/world/organic-cards/_tokens.css +0 -462
- package/docs/design/mocks/world/organic-cards/hall.html +0 -625
- package/docs/design/mocks/world/organic-cards/landing-b.html +0 -736
- package/docs/design/mocks/world/organic-cards/landing.html +0 -420
- package/docs/design/mocks/world/organic-cards/status.html +0 -458
- package/docs/design/mocks/world/world-sheet.html +0 -156
package/tests/ship_ci_deploy.mjs
CHANGED
|
@@ -133,7 +133,7 @@ test('resolveDeployTarget: blank/whitespace config values are treated as unset',
|
|
|
133
133
|
|
|
134
134
|
// ---- 1c. resolveInstanceBase precedence + the "no hardcoded host" guarantee (task 1002232) ----
|
|
135
135
|
// The ci-land /version + /healthz probes, the ci PR-body deploy note, and the
|
|
136
|
-
// manual-confirm curl guidance all baked in `https://
|
|
136
|
+
// manual-confirm curl guidance all baked in `https://example.com`, so a
|
|
137
137
|
// ci-land / manual-confirm on a migrated instance pointed at the WRONG box. The
|
|
138
138
|
// helper derives the origin: env → session api_base → branding publicOrigin → null.
|
|
139
139
|
// Every case injects env/sessionApiBase/branding so the machine's own env + session
|
|
@@ -60,7 +60,7 @@ test('single-host instance: the configured buildersOrigin host IS the hall host'
|
|
|
60
60
|
[
|
|
61
61
|
'emersonian-circles.cloudbongos.com',
|
|
62
62
|
'builders.anything.com',
|
|
63
|
-
'
|
|
63
|
+
'example.com',
|
|
64
64
|
'status.emersonian-circles.cloudbongos.com',
|
|
65
65
|
'evil.example',
|
|
66
66
|
'',
|
|
@@ -71,7 +71,7 @@ test('single-host instance: the configured buildersOrigin host IS the hall host'
|
|
|
71
71
|
// Back-compat: a builders.<apex> host still matches via startsWith("builders.").
|
|
72
72
|
assert.equal(v['builders.anything.com'], true);
|
|
73
73
|
// A DIFFERENT apex is NOT the hall host, so its /builders redirect still fires.
|
|
74
|
-
assert.equal(v['
|
|
74
|
+
assert.equal(v['example.com'], false);
|
|
75
75
|
// The status subdomain of the single host is a status host, not the hall.
|
|
76
76
|
assert.equal(v['status.emersonian-circles.cloudbongos.com'], false);
|
|
77
77
|
// Unrelated / empty hosts are never the hall.
|
|
@@ -83,16 +83,16 @@ test('conventional two-host instance: the apex stays a NON-builders host (no reg
|
|
|
83
83
|
const v = buildersHostVerdicts(
|
|
84
84
|
{
|
|
85
85
|
domains: {
|
|
86
|
-
publicOrigin: 'https://
|
|
87
|
-
buildersOrigin: 'https://builders.
|
|
88
|
-
statusOrigin: 'https://status.
|
|
86
|
+
publicOrigin: 'https://example.com',
|
|
87
|
+
buildersOrigin: 'https://builders.example.com',
|
|
88
|
+
statusOrigin: 'https://status.example.com',
|
|
89
89
|
},
|
|
90
90
|
},
|
|
91
|
-
['builders.
|
|
91
|
+
['builders.example.com', 'example.com', 'status.example.com'],
|
|
92
92
|
);
|
|
93
93
|
// The dedicated subdomain is the hall (both the startsWith and the config branch agree).
|
|
94
|
-
assert.equal(v['builders.
|
|
94
|
+
assert.equal(v['builders.example.com'], true);
|
|
95
95
|
// The apex is NOT the hall — /builders must still 301 to the subdomain here.
|
|
96
|
-
assert.equal(v['
|
|
97
|
-
assert.equal(v['status.
|
|
96
|
+
assert.equal(v['example.com'], false);
|
|
97
|
+
assert.equal(v['status.example.com'], false);
|
|
98
98
|
});
|
|
@@ -31,7 +31,7 @@ await t('isLocalTarget: localhost / 127.0.0.1 / ::1 / 0.0.0.0 are local', () =>
|
|
|
31
31
|
});
|
|
32
32
|
|
|
33
33
|
await t('isLocalTarget: prod + LAN hosts are NOT local (remote stays a real failure)', () => {
|
|
34
|
-
for (const h of ['
|
|
34
|
+
for (const h of ['example.com', 'status.example.com', '10.0.0.5', 'example.com']) {
|
|
35
35
|
assert.equal(isLocalTarget(h), false, `${h} should be remote`);
|
|
36
36
|
}
|
|
37
37
|
});
|
package/tests/smoke_target.mjs
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
//
|
|
3
3
|
// Task 1002418 — smoke-gds.js must verify THIS instance, never a hardcoded one.
|
|
4
4
|
//
|
|
5
|
-
// The bug: `BASE = GDS_API_BASE || PMS_API_BASE || '
|
|
5
|
+
// The bug: `BASE = GDS_API_BASE || PMS_API_BASE || '<the founder instance apex>'`.
|
|
6
6
|
// A builder signed into any other instance who shipped without an env override
|
|
7
7
|
// smoked the founder's box, which is healthy, so the ship reported
|
|
8
8
|
// "smoke=clean" about a system it never touched. resolveSmokeTarget replaces the
|
package/tests/status-probe.mjs
CHANGED
|
@@ -22,7 +22,7 @@ const ok = (name) => { passed++; console.log(' ✓', name); };
|
|
|
22
22
|
// --- parseArgs: defaults, overrides, numeric coercion ---
|
|
23
23
|
{
|
|
24
24
|
const a = parseArgs([]);
|
|
25
|
-
assert.equal(a.target, 'https://
|
|
25
|
+
assert.equal(a.target, 'https://example.com/healthz');
|
|
26
26
|
assert.equal(a.attempts, 3);
|
|
27
27
|
assert.equal(a['timeout-ms'], 15000);
|
|
28
28
|
ok('parseArgs returns defaults');
|
|
@@ -117,6 +117,6 @@ test('the publisher source hardcodes no host identity (the ratchet this slice in
|
|
|
117
117
|
.split(/\r?\n/)
|
|
118
118
|
.map((l) => l.replace(/(^|[^:])\/\/.*$/, '$1'))
|
|
119
119
|
.join('\n');
|
|
120
|
-
const hit = stripped.match(/
|
|
120
|
+
const hit = stripped.match(/example|example-owner|example world/i);
|
|
121
121
|
assert.equal(hit, null, `scripts/status-mirror-sync.js hardcodes the host identity "${hit && hit[0]}" — resolve it from branding() instead`);
|
|
122
122
|
});
|
|
@@ -1,45 +0,0 @@
|
|
|
1
|
-
# 0004 — "Example" as the in-world civilization name (trademark risk knowingly accepted)
|
|
2
|
-
|
|
3
|
-
- **Status:** Accepted
|
|
4
|
-
- **Date:** 2026-05-08
|
|
5
|
-
- **Deciders:** Lars
|
|
6
|
-
|
|
7
|
-
## Context
|
|
8
|
-
|
|
9
|
-
The world needs a name for the new civilization that grows around the washed-ashore shipping container. The name should:
|
|
10
|
-
|
|
11
|
-
- Read as belonging in the ancient-Greek setting
|
|
12
|
-
- Carry the brand wink — Example undercuts Amazon-style logistics, and the container is the inciting object
|
|
13
|
-
- Be coined (not a real Greek place name we'd mispresent)
|
|
14
|
-
|
|
15
|
-
The candidate "Example" landed because it does triple duty: a tongue-in-cheek nod to **Amazon Prime**, a callback to the **Amazons** of Greek mythology (warrior tribe — fits the early-civilization setting), and a believable coined place-name.
|
|
16
|
-
|
|
17
|
-
The obvious problem: it contains the protected marks "Amazon" and "Amazon Prime." Amazon's legal team enforces trademark aggressively.
|
|
18
|
-
|
|
19
|
-
## Decision
|
|
20
|
-
|
|
21
|
-
We will use **Example** as the civilization name, knowingly accepting the trademark risk.
|
|
22
|
-
|
|
23
|
-
To minimize the cost of a forced rebrand, the name must be treated as a **single string in one config**. It must not be baked into:
|
|
24
|
-
|
|
25
|
-
- Class names, type names, function names, file names
|
|
26
|
-
- Database schemas (table/column/enum names)
|
|
27
|
-
- Asset filenames
|
|
28
|
-
- URL paths beyond the apex domain itself
|
|
29
|
-
|
|
30
|
-
The apex domain `example.com` is the painful piece on rebrand — accepted.
|
|
31
|
-
|
|
32
|
-
## Alternatives considered
|
|
33
|
-
|
|
34
|
-
- **A cleaner coined name (e.g. "Hermeia," "Korykos," "Boreas")** — eliminates trademark exposure but loses the brand wink that ties the world to Example's positioning against Amazon-scale logistics. Lars judged the brand wink worth the risk.
|
|
35
|
-
- **Use the name only in dialog/UI text, not as the formal civilization name** — half-measure that doesn't actually reduce legal exposure (the trademark issue is the use, not the formality).
|
|
36
|
-
|
|
37
|
-
## Consequences
|
|
38
|
-
|
|
39
|
-
- **Open legal risk.** Probability of Amazon legal making contact is non-zero, especially if the project gets visible.
|
|
40
|
-
- **Contingency plan, ready to execute on first contact:**
|
|
41
|
-
1. Rebrand the civilization name (text-only — should be a single config string)
|
|
42
|
-
2. Swap the apex domain (most painful step — DNS, certs, links, anything that has hardcoded `example.com`)
|
|
43
|
-
3. World lore, container, vendor, and all game mechanics stay unchanged
|
|
44
|
-
- **Operating constraint for all future development:** every time the name is about to be embedded in code, file paths, schemas, or assets, **stop** and instead reference it indirectly through one config value.
|
|
45
|
-
- **Documented as an open risk in the project framing** so future sessions and team members understand the posture is "accepted, not unaware."
|