@bongos/core 1.19.735 → 1.19.737

package/scripts/gds/upgrade.js

@@ -27,7 +27,9 @@
 // against `--instance <consumer>` — see docs/recipes for the bootstrap note.
 
 const fs = require('node:fs');
+const os = require('node:os');
 const path = require('node:path');
+const crypto = require('node:crypto');
 const { spawnSync } = require('node:child_process');
 const { arg, hasFlag } = require('./cli-lib');
 const { writeNpmrc, hasNpmToken, resolveNpmToken } = require('./npmrc'); // ADR 0134 (task 2090): the --registry channel's env-fed .npmrc; resolveNpmToken task 1002754
@@ -170,18 +172,133 @@ function dirtyPinFiles(instanceDir, run = spawnSync) {
   return (r.stdout || '').split('\n').map((l) => l.slice(3).trim()).filter(Boolean);
 }
 
+// ---- which credential the pin push rides (task 1003081, ADR 0176 follow-up) ----
+//
+// THE BUG THIS EXISTS FOR. A PRIVATE standalone instance's `origin` authenticates with
+// a per-repo deploy key that GitHub registers READ-ONLY (ADR 0176): it can pull, never
+// push. The push leg below went `git push origin HEAD:main` regardless, so on such an
+// instance GitHub refused the pin push, the bump was not durable, and the next
+// pull-deploy `git reset --hard origin/main` + `npm ci` reinstalled the OLD core
+// against an already-migrated DB — the exact silent rollback task 1002712 closed for
+// every other path, back through a warning line nobody read. The scaffold push and the
+// re-provision pin refresh already prefer the owner's stored `repo`-scoped OAuth token
+// over the SSH origin (provision.js resolveOwnerGithubToken + buildCorePinRefreshCommit);
+// the pin push now has the same preference — the token when one is stored, the git
+// remote otherwise — and a refused push is LOUD, naming the read-only key and the fix.
+
+// The GitHub owner/name behind `remote`, or null when the remote is not a GitHub
+// repository (there is nothing to push a GitHub token at) or cannot be read. Accepts
+// the plain github.com forms and the shared SSH alias instanceRepoRemote wires
+// (`git@github-deploy:owner/repo.git`) — never another host, so a stored token is
+// never pointed at github.com/<owner>/<repo> for a repo that lives elsewhere.
+function remoteGithubRepo(instanceDir, remote = 'origin', run = spawnSync) {
+  const r = run('git', ['remote', 'get-url', remote], { cwd: instanceDir, encoding: 'utf8' });
+  if (!r || r.error || r.status !== 0) return null;
+  const url = String(r.stdout || '').trim();
+  let auth;
+  try { auth = require('./provision-repo-auth'); } catch { return null; } // a package without the provisioner has no token path
+  const repo = auth.parseTargetRef(url);
+  if (!repo) return null;
+  const host = (url.match(/^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?([^/:]+)[/:]/i) || [])[1] || '';
+  if (host.toLowerCase() !== 'github.com' && url !== auth.instanceRepoRemote(repo)) return null;
+  return repo;
+}
+
+// The deploy key `remote` authenticates with when the checkout is wired the ADR 0176
+// way (`core.sshCommand … -i <key>` in the repo's own config); null when it is not.
+// What a refused origin push is diagnosed against — GitHub's SSH refusal is a terse
+// one-liner that names no key.
+function pinnedDeployKey(instanceDir, run = spawnSync) {
+  const r = run('git', ['config', '--get', 'core.sshCommand'], { cwd: instanceDir, encoding: 'utf8' });
+  if (!r || r.error || r.status !== 0) return null;
+  const m = String(r.stdout || '').match(/(?:^|\s)-i\s+(\S+)/);
+  return m ? m[1] : null;
+}
+
+// Resolve { token, repo } for the pin push, or null → push via the git remote.
+//   repo  — the remote's GitHub owner/name (remoteGithubRepo);
+//   row   — provision-repo-auth lookupInstanceRow, used ONLY when its target_ref IS that
+//           repo, so another instance's credential is never spent on this checkout;
+//   token — provision-repo-auth resolveOwnerGithubToken (deps.getGithubToken / deps.db
+//           are its test seams), the same resolver the scaffold push uses.
+// Every miss is the origin path, not an error, and the token is never logged. The row
+// lookup and the token read BOTH live in the leaf rather than here because their default
+// requires are computed, and this file is inside the merge resolver's executed closure
+// with a pinned computed-require count of its own (task 1003081).
+async function resolvePinPushAuth({ instanceDir, remote = 'origin' }, deps = {}, run = spawnSync) {
+  const log = deps.log || console.log;
+  const repo = remoteGithubRepo(instanceDir, remote, run);
+  if (!repo) return null;
+  const auth = require('./provision-repo-auth');
+  const inst = await auth.lookupInstanceRow(instanceDir, deps);
+  if (!inst) return null;
+  const rowRepo = auth.parseTargetRef(inst.target_ref);
+  const same = (a, b) => a && b && a.owner.toLowerCase() === b.owner.toLowerCase() && a.name.toLowerCase() === b.name.toLowerCase();
+  if (!same(rowRepo, repo)) {
+    log(`  • pin push: the provisioning row for ${path.basename(instanceDir)} names ${inst.target_ref}, not ${remote}'s ${repo.owner}/${repo.name} — its owner's token is not for this checkout; pushing via ${remote}`);
+    return null;
+  }
+  const token = await auth.resolveOwnerGithubToken(inst, { ...deps, log }, { tag: '[pin-push]' });
+  if (!token) {
+    log(`  • pin push: no owner GitHub token stored for ${repo.owner}/${repo.name} — pushing via ${remote}`);
+    return null;
+  }
+  return { token, repo };
+}
+
+// The pin push over the owner's token: a chmod-600 credential-store file in the temp
+// dir carries the secret, git reads it through `credential.helper=store`, and the file
+// is removed in `finally` whatever the push did — the token is never in argv (ps,
+// journald) and never in a log line. provision.js buildCorePinRefreshCommit's shape,
+// as argv instead of a shell string.
+function pushPinViaToken({ instanceDir, token, repo, target }, run = spawnSync) {
+  const credFile = path.join(os.tmpdir(), `bongos-gitcred-pin-${process.pid}-${crypto.randomBytes(6).toString('hex')}`);
+  try {
+    fs.writeFileSync(credFile, `https://x-access-token:${token}@github.com\n`, { mode: 0o600 });
+    return run('git', ['-c', `credential.helper=store --file=${credFile}`, 'push', `https://x-access-token@github.com/${repo.owner}/${repo.name}.git`, target], {
+      cwd: instanceDir, encoding: 'utf8',
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }, // a rejected credential must fail, not sit at a password prompt
+    });
+  } finally {
+    fs.rmSync(credFile, { force: true });
+  }
+}
+
+// What git said on stderr, for a refusal line — GitHub's own reason ("ERROR: The key you
+// are authenticating with has been marked as read only", "remote: Write access to
+// repository not granted") is the fact an operator wants beside the diagnosis, and it
+// is never the LAST line: git closes with its generic `fatal:`. Prefer the server's
+// line, fall back to the last one.
+function gitSaid(r) {
+  const lines = String((r && r.stderr) || '').split('\n').map((l) => l.trim()).filter(Boolean);
+  const server = lines.filter((l) => /^(ERROR:|remote:)/i.test(l));
+  const said = server.length ? server[server.length - 1] : lines[lines.length - 1];
+  return said ? ` (git: ${said})` : '';
+}
+
 // `push: false` is CO-TENANT MODE (task 1003521). The reasoning above assumes the repo
 // of record is OURS; on a provisioned instance it is the customer's own GitHub repo, so
 // pushing there is both wrong and uncredentialed. Such an instance also has no
 // pull-deploy timer, so nothing will `reset --hard` the pin away — the commit alone
 // makes it durable, and leaves the tree clean for the customer's own pulls.
-function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = true, remote = 'origin', dryRun = false },
+//
+// `pushAuth` ({ token, repo }, from resolvePinPushAuth) makes the push ride the owner's
+// GitHub token over HTTPS (task 1003081); null pushes via `remote`. The result carries
+// `via: 'owner-token'` on the token path and `refused` ('read-only-deploy-key' |
+// 'owner-token') with a plain-sentence `error` when GitHub turned the push away.
+function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = true, remote = 'origin', dryRun = false, pushAuth = null },
   run = spawnSync, log = console.log, err = console.error) {
   const dirty = dirtyPinFiles(instanceDir, run);
   if (dirty === null) return { applicable: false, reason: 'not a git repo' };
   if (!dirty.length) return { applicable: false, reason: 'pin files already match the repo' };
 
   const branch = gitCurrentBranch(instanceDir, run);
+  const target = `HEAD:${branch || 'main'}`;
+  // Single-quote the interpolated values. Nothing here executes these strings — they
+  // are printed for a human to paste — but an unquoted branch or remote carrying shell
+  // metacharacters would misbehave once pasted, so emit them paste-safe.
+  const q = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
+  const at = `git -C ${q(instanceDir)}`;
 
   if (!commitPin) {
     if (!push) {
@@ -198,12 +315,7 @@ function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = tru
     err('    On a pull-deploy instance the next push to the repo of record makes deploy.sh');
     err(`    'git reset --hard ${remote}/${branch || 'main'}', which REVERTS this pin and lets npm ci`);
     err(`    reinstall ${fromVersion || 'the previous core'}. Re-run with --commit-pin, or commit + push:`);
-    // Single-quote the interpolated values. Nothing here executes this string — it is
-    // printed for a human to paste — but an unquoted branch or remote carrying shell
-    // metacharacters would misbehave once pasted, so emit it paste-safe.
-    const q = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
-    const at = `git -C ${q(instanceDir)}`;
-    err(`      ${at} add ${PIN_FILES.map(q).join(' ')} && ${at} commit -m ${q(`pin @bongos/core ${toVersion}`)} && ${at} push ${q(remote)} ${q(`HEAD:${branch || 'main'}`)}`);
+    err(`      ${at} add ${PIN_FILES.map(q).join(' ')} && ${at} commit -m ${q(`pin @bongos/core ${toVersion}`)} && ${at} push ${q(remote)} ${q(target)}`);
     return { applicable: true, committed: false, pushed: false, dirty, warned: true };
   }
 
@@ -232,11 +344,62 @@ function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = tru
     return { applicable: true, committed: true, pushed: false, dirty, pushSkipped: true };
   }
 
-  const pushed = run('git', ['push', remote, `HEAD:${branch || 'main'}`], { cwd: instanceDir, encoding: 'utf8' });
+  // Committed but not pushed is still doomed: deploy.sh resets to the REMOTE. So every
+  // refusal below is LOUD (task 1003081) — the pull-deploy consequence, the diagnosis,
+  // and a by-hand push that can actually write.
+  const revert = () => err(`    The next pull-deploy 'git reset --hard ${remote}/${branch || 'main'}' + npm ci then reinstalls ${fromVersion || 'the previous core'}.`);
+
+  if (pushAuth && pushAuth.token && pushAuth.repo) {
+    const { repo } = pushAuth;
+    let pushed = null;
+    try {
+      pushed = pushPinViaToken({ instanceDir, token: pushAuth.token, repo, target }, run);
+    } catch (e) {
+      // The credential file could not even be written (an unwritable temp dir): say so
+      // and fall through to the remote — a public origin may still take it.
+      err(`  ! could not stage the owner's GitHub credential (${e && e.message}) — pushing via ${remote} instead`);
+    }
+    if (pushed && !pushed.error && pushed.status === 0) {
+      log(`  ✓ pushed the pin to ${repo.owner}/${repo.name}@${branch || 'main'} via the owner's GitHub token — a pull-deploy reset can no longer revert it`);
+      return { applicable: true, committed: true, pushed: true, dirty, via: 'owner-token' };
+    }
+    if (pushed) {
+      err(`  ! PIN NOT PUSHED — GitHub refused the push over the owner's GitHub token, so this bump is NOT durable.`);
+      err(`    The stored token could not write ${repo.owner}/${repo.name}: it may have expired (they live an hour), or`);
+      err(`    lack the \`repo\` scope (\`public_repo\` cannot write a private repository — ADR 0155).${gitSaid(pushed)}`);
+      revert();
+      err('    Fix: have the instance owner reconnect GitHub with repository access, then re-run `bongos upgrade --commit-pin`;');
+      err('    or push the commit yourself with a credential that can write:');
+      err(`      ${at} push ${q(`https://github.com/${repo.owner}/${repo.name}.git`)} ${q(target)}`);
+      return {
+        applicable: true, committed: true, pushed: false, dirty, refused: 'owner-token',
+        error: `GitHub refused the pin push over the owner's GitHub token (expired, or missing the repo scope) — the pin is committed locally but not on ${repo.owner}/${repo.name}`,
+      };
+    }
+  }
+
+  const pushed = run('git', ['push', remote, target], { cwd: instanceDir, encoding: 'utf8' });
   if (!pushed || pushed.error || pushed.status !== 0) {
-    // Committed but not pushed is still doomed: deploy.sh resets to the REMOTE.
+    const key = pinnedDeployKey(instanceDir, run);
+    if (key) {
+      // A wired private instance (ADR 0176): the key can pull, never push, and no owner
+      // token was stored to push with instead — the bug this leg exists for.
+      const repo = remoteGithubRepo(instanceDir, remote, run);
+      err(`  ! PIN NOT PUSHED — GitHub refused the push to ${remote}, so this bump is NOT durable.`);
+      err(`    ${remote} authenticates with the deploy key at ${key}, which is registered READ-ONLY on the`);
+      err(`    repository (ADR 0176): it can pull, never push. No owner GitHub token is stored to push with instead.${gitSaid(pushed)}`);
+      revert();
+      err('    Fix: have the instance owner reconnect GitHub with repository access (that stores a short-lived repo token),');
+      err(`    then re-run \`bongos upgrade --commit-pin\` where that token is readable — the control plane, with --instance ${q(instanceDir)};`);
+      err('    or push the commit yourself with a credential that can write:');
+      err(`      ${at} push ${q(`https://github.com/${repo ? `${repo.owner}/${repo.name}` : '<owner>/<repo>'}.git`)} ${q(target)}`);
+      return {
+        applicable: true, committed: true, pushed: false, dirty, refused: 'read-only-deploy-key',
+        error: `GitHub refused the pin push: ${remote} authenticates with the read-only deploy key at ${key}, and no owner GitHub token is stored to push with — the pin is committed locally but not on the remote`,
+      };
+    }
     err(`  ! commit landed locally but the push to ${remote} FAILED — this bump is still not durable.`);
-    err(`    Push it: git -C ${instanceDir} push ${remote} HEAD:${branch || 'main'}`);
+    err(`    Push it: git -C ${instanceDir} push ${remote} ${target}`);
     return { applicable: true, committed: true, pushed: false, dirty, error: 'git push failed' };
   }
   log(`  ✓ pushed the pin to ${remote}/${branch || 'main'} — a pull-deploy reset can no longer revert it`);
@@ -1144,14 +1307,23 @@ async function runUpgrade(opts, deps = {}) {
 
   // Make the pin durable (task 1002712). Runs LAST — only a verified-healthy
   // upgrade is worth persisting, and a rolled-back one returned long before here.
+  //
+  // Which credential the push rides is resolved HERE (async — it may read the token
+  // store) and handed to persistPin, which stays synchronous — and only when a push is
+  // actually coming: --commit-pin without --pin-no-push, not a dry run, and the pin
+  // files really are dirty. Nothing reads a credential it will not spend (task 1003081).
+  const remote = opts.gitRemote || 'origin';
+  const pushComing = !!opts.commitPin && !opts.pinNoPush && !dryRun && (dirtyPinFiles(instanceDir, run) || []).length > 0;
+  const pushAuth = pushComing ? await (deps.resolvePinPushAuth || resolvePinPushAuth)({ instanceDir, remote }, deps, run) : null;
   const pin = persistPin({
     instanceDir,
     fromVersion,
     toVersion: targetVersion,
     commitPin: opts.commitPin,
     push: !opts.pinNoPush,
-    remote: opts.gitRemote || 'origin',
+    remote,
     dryRun: opts.dryRun,
+    pushAuth,
   }, run, log, err);
 
   const ok = versionOk && healthOk !== false && servedOk !== false;
@@ -1211,6 +1383,7 @@ async function main(argv = process.argv.slice(2)) {
       '  --skip-pin-verify    do not verify the integrity pin (tree_sha256 + tarball.sha256) after install',
       '  --require-pin        treat a MISSING reference manifest as fatal (default: warn — a MISMATCH is always fatal)',
       '  --no-rollback-on-failure  do NOT auto-revert on a failed install/pin-verify/migrate/health check (default: auto-rollback ON)',
+      '  --commit-pin         commit + push package.json/-lock so a pull-deploy reset cannot revert the bump. The push rides the instance owner\'s stored GitHub token when one is stored (a PRIVATE instance\'s origin is a read-only deploy key — ADR 0176), else the git remote (--git-remote <name>, default origin); a refused push is reported loudly with the fix',
       '  --pin-no-push        with --commit-pin: commit the pin but do NOT push it — for an instance whose repo of record is not ours (a provisioned co-tenant), where the push is wrong and no pull-deploy can revert the commit',
       '  --dry-run            show the plan; change nothing',
       '  --force              skip the clean-tree + same-version guards',
@@ -1233,7 +1406,9 @@ async function main(argv = process.argv.slice(2)) {
 module.exports = {
   runUpgrade, parseArgs, main, rollback,
   versionFromTgzPath, versionFromDep, readInstalledCoreVersion, readPinnedCoreVersion, writePin, writeRegistryPin, restorePin,
-  vendorTarball, gitTreeClean, persistPin, dirtyPinFiles, gitCurrentBranch, PIN_FILES, preflightDbIdentity, resolveInstanceDb, preflightModules, reportModulePreflight, npmInstall, runMigrate, regenerateApiArtifacts, regenerateNavDocs, NAV_WHOLE_FILE_GENERATORS, missingDocAssets, healDocAssets, DOC_ASSET_GENERATORS, restartService, recordLedger, pollHealth, deriveVersionUrl, pollServedVersion,
+  vendorTarball, gitTreeClean, persistPin, dirtyPinFiles, gitCurrentBranch, PIN_FILES, preflightDbIdentity,
+  resolveInstanceDb, preflightModules, reportModulePreflight, npmInstall, runMigrate, regenerateApiArtifacts, regenerateNavDocs, NAV_WHOLE_FILE_GENERATORS, missingDocAssets, healDocAssets, DOC_ASSET_GENERATORS, restartService, recordLedger, pollHealth, deriveVersionUrl, pollServedVersion,
+  resolvePinPushAuth, remoteGithubRepo, pinnedDeployKey, // task 1003081 — the pin push prefers the owner's GitHub token (ADR 0176 follow-up)
   readManifest, resolveReferenceManifest, verifyInstalledPin, // task 1002216 (audit H8) — integrity-pin verification
   CORE_PKG, ARTIFACT, vendorRelFor,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.735'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.737'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/executed_closure.mjs

@@ -97,6 +97,14 @@ test('every computed require inside the closure is one we have accounted for', (
     // floor) is lazy and inside a function.
     ['scripts/gds/package-core.js', 6],   // publish-manifest/mirror-redact/secret-scrub/leak-scan-allowlist/…
     ['scripts/gds/upgrade.js', 1],        // a `node -e` child, not a require in this process
+    // Added by task 1003081: upgrade.js's pin push needs the owner-credential helpers,
+    // and requiring provision.js for them would have pulled provision-config/-repo/-units
+    // (7/1/1 unaccounted computed requires) into the closure. This LEAF is the whole of
+    // that growth: 3 computed requires — src/bongos/db in resolveOwnerGithubToken, and
+    // modules/provisioning + src/bongos/pool in lookupInstanceRow — each inside a function
+    // body reached only from the pin push, which no generator calls. Its top level requires
+    // node builtins only, so it drags nothing else in behind it.
+    ['scripts/gds/provision-repo-auth.js', 3],
     ['scripts/gds/gen-api-docs.js', 1],   // require(path.join(CORE_ROOT,'package.json')) — JSON
   ]);
 

package/tests/package_core.mjs

@@ -16,7 +16,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import zlib from 'node:zlib';
 import crypto from 'node:crypto';
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 
@@ -385,18 +385,35 @@ t('buildPackageJson: prunes to express+pg+pino, keeps the source ranges + the un
   assert.equal(pkg.exports['./module-loader/loader'], './src/module-loader/loader.js');
   assert.equal(pkg.exports['./modules'], './src/modules.js');
   assert.equal(pkg.exports['./module-seams'], './src/module-seams.js');
-  // task 2089 / ADR 0134 — the synthesized package publishes PRIVATE by default.
-  assert.deepEqual(pkg.publishConfig, { access: 'restricted' });
+  // task 1003872 / ADR 0283 — the synthesized package publishes PUBLIC
+  // (superseding ADR 0134's pre-launch `restricted`).
+  assert.deepEqual(pkg.publishConfig, { access: 'public' });
 });
 
-t('publishArgs: private (restricted) publish, dry-run unless live (task 2089 / ADR 0134)', () => {
+t('publishArgs: public publish, dry-run unless live (task 1003872 / ADR 0283)', () => {
   const tgz = 'dist/bongos-core-1.14.0.tgz';
-  // Default: dry-run, restricted (never public, never a real upload).
-  assert.deepEqual(publishArgs(tgz, false), ['publish', tgz, '--access', 'restricted', '--dry-run']);
-  // Live: still restricted (private) — the permanent publish is never public here.
-  assert.deepEqual(publishArgs(tgz, true), ['publish', tgz, '--access', 'restricted']);
-  // Belt-and-suspenders: `--access public` must never appear on the pre-launch path.
-  assert.ok(!publishArgs(tgz, true).includes('public'));
+  // Default: dry-run — building must never be a real upload, whatever the access.
+  assert.deepEqual(publishArgs(tgz, false), ['publish', tgz, '--access', 'public', '--dry-run']);
+  assert.deepEqual(publishArgs(tgz, true), ['publish', tgz, '--access', 'public']);
+  // The posture is stated at the call site AND in publishConfig, so neither one
+  // drifting alone can silently take the package back to private.
+  assert.ok(!publishArgs(tgz, true).includes('restricted'));
+});
+
+// THE PUBLISH LANE IS THE PATH THAT ACTUALLY RUNS (task 1003872). package-core's
+// own `--publish` is the manual owner path; CI publishes the tarball itself, with
+// its own `--access` flag. Flipping only package-core.js would have left the real
+// releases restricted — the same shape as task 1003870, where the workflow did not
+// arm the gate its own header comment claimed.
+t('the publish workflow publishes PUBLIC, matching publishArgs', () => {
+  const yml = readFileSync(new URL('../.github/workflows/publish.yml', import.meta.url), 'utf8');
+  const m = yml.match(/npm publish "\$TGZ" --access (\w+)/);
+  assert.ok(m, 'publish.yml must publish the packaged tarball with an explicit --access');
+  assert.equal(m[1], 'public', 'the lane that actually releases must publish public, not restricted');
+  assert.ok(
+    !/--access restricted/.test(yml),
+    'no restricted publish may survive anywhere in the lane',
+  );
 });
 
 t('buildPackageJson: omits `overrides` when the source has none', () => {