@bongos/core 1.19.736 → 1.19.738

package/scripts/gds/provision-repo.js

@@ -14,7 +14,11 @@ const crypto = require('node:crypto');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { CONFIG, REPO_ROOT, coreVersionSafe, hasNpmToken, provisionerBotEmail, registryCoreRequested } = require('./provision-config.js');
+const { CONFIG, REPO_ROOT, coreVersionSafe, provisionerBotEmail } = require('./provision-config.js');
+// The repo-identity + owner-credential leaf (task 1003081). Carved OUT of this file so
+// upgrade.js can reach these three without pulling provision*.js into the merge
+// resolver's executed closure; re-exported below so every existing caller is unchanged.
+const { instanceRepoRemote, parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo-auth.js');
 
 function dbName(inst) { return inst.db_name || inst.slug; }
 
@@ -288,25 +292,10 @@ function dbRoleGrantsCmd(inst, { privileged = false } = {}) {
 // THROW if the instance repo wasn't already cloned. These generate + run the scaffold
 // that clones an EMPTY target_ref and turns it into an installable, bootable instance.
 
-// Parse an 'owner/repo' (or a github SSH/HTTPS URL) target_ref → { owner, name }.
-// Null when unparseable, so the scaffold can fail with actionable guidance.
-function parseTargetRef(ref) {
-  const m = String(ref || '').trim()
-    .replace(/^git@[^:]+:/, '')
-    .replace(/^https?:\/\/[^/]+\//, '')
-    .match(/^([A-Za-z0-9][A-Za-z0-9_.-]*)\/([A-Za-z0-9][A-Za-z0-9_.-]*?)(?:\.git)?$/);
-  return m ? { owner: m[1], name: m[2] } : null;
-}
-
-// The git remote for an instance's OWN repo. Reuses the SAME SSH deploy alias the
-// control-plane checkout uses (git@<alias>:<owner>/<repo>.git) — NO secret in the
-// command (SSH-key auth, nothing to leak into journald), consistent with how the
-// platform repo is wired. Standing up a new instance repo therefore needs only that
-// the control plane's deploy key has WRITE access to that repo (ADR 0125). Alias is
-// overridable via PROVISION_GIT_SSH_ALIAS.
-function instanceRepoRemote(repo, { sshAlias = process.env.PROVISION_GIT_SSH_ALIAS || 'github-deploy' } = {}) {
-  return `git@${sshAlias}:${repo.owner}/${repo.name}.git`;
-}
+// parseTargetRef + instanceRepoRemote (and resolveOwnerGithubToken, below the scaffold)
+// now live in the ./provision-repo-auth.js leaf and are re-exported unchanged from here —
+// upgrade.js needs them and is inside the merge resolver's executed closure, which a require of
+// this file would have widened by five (task 1003081; see that module's header).
 
 // A minimal, VALID `bongos init` spec (init.validateSpec greenfield) from the
 // provisioning row + the owner's github login. The scaffold produces a bootable,
@@ -613,18 +602,20 @@ async function scaffoldStandaloneRepo(inst, deps) {
       exec(`git -C ${root} checkout -B main`);
     }
 
-    // Core-install path (ADR 0134, task 2090). DEFAULT = vendor a tarball built from THIS
-    // control-plane checkout (offline, proven — task 2053). OPT-IN = pull the PRIVATE
-    // @bongos/core from the npm registry (PROVISION_CORE_FROM_REGISTRY=1). The registry
-    // path needs NPM_TOKEN at `npm ci` time; if the flag is set but no token is present we
-    // FAIL SOFT to the vendored path so a tokenless standup still works (never a broken
-    // instance). The env is injectable for tests; the runner falls back to process.env.
-    const env = deps.env || process.env;
-    const wantRegistry = registryCoreRequested(env);
-    const useRegistry = wantRegistry && hasNpmToken(env);
-    if (wantRegistry && !useRegistry) {
-      log('  [scaffold] PROVISION_CORE_FROM_REGISTRY set but no NPM_TOKEN in env — falling back to the vendored-tarball core (ADR 0134 fail-soft).');
-    }
+    // Core-install path: vendor a tarball built from THIS control-plane checkout
+    // (offline, proven — task 2053).
+    //
+    // This used to be a fork: an opt-in env var selected the registry, and a missing npm
+    // credential silently failed it soft back to vendored. Both halves were auth-era and both
+    // are gone (task 1003878) — @bongos/core is public, so nothing needs a credential, and an
+    // env var that silently changed which install path ran is the divergence behind task
+    // 1003520. tests/provision.mjs pins both retired names and proves they are inert.
+    //
+    // Vendored stays the default here for a reason that has nothing to do with auth and
+    // survives the package going public: THIS CHECKOUT IS ROUTINELY AHEAD OF THE REGISTRY.
+    // A control plane on an unreleased CORE_VERSION has no published version to install, so
+    // the registry path would 404 on exactly the commits an operator most wants to stand up.
+    // Whether the vendored path still earns its keep at all is gate 6's call (task 1003879).
 
     // materialize config/ + .claude/ + a pinned package.json + lockfile via `bongos init`.
     // --no-seed: the instance's own DB is seeded by migrate, not here (and on the adopt path
@@ -638,27 +629,21 @@ async function scaffoldStandaloneRepo(inst, deps) {
     // BLOCKING pre-flight finding still hard-stops — it cannot be waved through). init refuses
     // --adopt together with --force, so the two flag sets are mutually exclusive by design.
     //
-    // Two mutually exclusive core-resolution shapes, orthogonal to the mode:
-    //   registry (--registry-core): caret pin + env-fed .npmrc; `npm ci` pulls from the
-    //     registry. init generates the lockfile (NPM_TOKEN is present — we gated on it).
-    //   vendored (--vendor-core, default): a tarball built from this checkout, file:-pinned.
+    // Core resolution is vendored (--vendor-core): a tarball built from this checkout,
+    // file:-pinned. init still accepts --registry-core for an operator who explicitly wants
+    // a published version, and that flag no longer needs any credential.
     const modeFlags = mode === 'adopt' ? '--adopt --accept' : '--force';
     const spec = instanceInitSpec(inst, { ownerLogin });
     const specPath = path.join(os.tmpdir(), `bongos-init-${inst.slug}.json`);
     writeFile(specPath, JSON.stringify(spec, null, 2));
-    if (useRegistry) {
-      log(`  [scaffold] core install: registry — PRIVATE @bongos/core@${coreV} via env-fed NPM_TOKEN (ADR 0134)`);
-      exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed ${modeFlags} --registry-core`);
-    } else {
-      // Vendored tarball — resolveVendorableCoreTarball's three-rung ladder (shared
-      // with the re-provision pin refresh, task 1003050).
-      const { tgz, packDest } = resolveVendorableCoreTarball({
-        instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:',
-      });
-      exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed ${modeFlags} --vendor-core ${tgz}`);
-      // init --vendor-core COPIED the tarball into the child's vendor/ — the temp pack dir is spent.
-      if (packDest) exec(`rm -rf ${packDest}`);
-    }
+    // Vendored tarball — resolveVendorableCoreTarball's three-rung ladder (shared
+    // with the re-provision pin refresh, task 1003050).
+    const { tgz, packDest } = resolveVendorableCoreTarball({
+      instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:',
+    });
+    exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed ${modeFlags} --vendor-core ${tgz}`);
+    // init --vendor-core COPIED the tarball into the child's vendor/ — the temp pack dir is spent.
+    if (packDest) exec(`rm -rf ${packDest}`);
 
     // 4. commit + push to the instance's own main (keep node_modules out).
     //
@@ -711,24 +696,6 @@ async function scaffoldStandaloneRepo(inst, deps) {
 
 // ── private-repo deploy key (ADR 0176, task 1002735; walk finding N4) ────────────
 
-// The instance owner's stored `repo`-scoped OAuth token (ADR 0155), or null (none
-// stored, org-owned repo, secret-box off). Shared by the scaffold push, the
-// private-repo deploy-key wiring, and the teardown revoke. `deps.getGithubToken` is
-// injectable for tests; production resolves it lazily against the core db slice
-// with the runner's pool.
-async function resolveOwnerGithubToken(inst, deps, { tag = '[repo-auth]' } = {}) {
-  if (!inst.owner_builder_id) return null;
-  try {
-    const fetchTok = deps.getGithubToken
-      || ((bid) => require(path.join(REPO_ROOT, 'src/bongos/db')).getGithubToken({ builderId: bid, p: deps.db }));
-    const r = await fetchTok(inst.owner_builder_id);
-    return r && r.token ? r.token : null;
-  } catch (e) {
-    (deps.log || (() => {}))(`  ${tag} owner OAuth token lookup failed (${e && e.message})`);
-    return null;
-  }
-}
-
 function deployKeyTitle(inst) { return `cloudbongos-deploy-${inst.slug}`; }
 // Beside the checkout's own metadata: untracked by definition, survives the deploy's
 // `git reset --hard`, and dies with the checkout rather than accreting in ~/.ssh.

package/scripts/gds/provision.js

@@ -360,11 +360,9 @@ async function provisionInstance(inst, deps) {
     // repo + install the pinned @bongos/core, so the migrate + service below run
     // from the INSTANCE root, not this control-plane checkout. cwd = standaloneRoot.
     // boxExec = the control plane (where scaffoldStandaloneRepo just created the dir).
-    // REGISTRY CORE (ADR 0134): when the scaffold pinned the registry core, the committed
-    // .npmrc reads `_authToken=${NPM_TOKEN}` — so `npm ci` resolves the PRIVATE package
-    // only if NPM_TOKEN is in this runner's env (makeExec inherits process.env). The
-    // scaffold already gated on the token, so it is present; the VENDORED default needs
-    // no token (the tarball is committed). A tokenless registry `npm ci` 404s cleanly.
+    // CORE RESOLUTION: the vendored default needs no network at all (the tarball is
+    // committed). A registry pin resolves from the public registry — @bongos/core is public
+    // (task 1003872), so `npm ci` needs no credential either way (task 1003878).
     const root = standaloneRoot(inst);
     log('  [code] standalone — pull instance repo + npm ci (pinned @bongos/core)');
     boxExec(standalonePullCmd(), { cwd: root });

package/scripts/gds/start.js

@@ -587,7 +587,7 @@ function instanceNotRunningCard({ origin, depsMissing } = {}) {
     out.push(`${surface.strong(`Don't run ${surface.code('bongos dev')} for this.`)} It stands up a separate local instance with its own empty database — it cannot show you this board, and it would hide the outage behind an empty one.`);
     if (depsMissing) {
       out.push('');
-      out.push(`(The ${surface.code('bongos')} CLI isn't installed here. It's optional — the website above is the same board. ${surface.code('@bongos/core')} is a ${surface.strong('private')} package, so installing it needs an ${surface.code('NPM_TOKEN')}; a 404 without one is expected, not a missing version.)`);
+      out.push(`(The ${surface.code('bongos')} CLI isn't installed here. It's optional — the website above is the same board. ${surface.code('@bongos/core')} is ${surface.strong('public')} on npm, so ${surface.code('npm install @bongos/core')} needs no token or login; a failure here is a real error, not the expected tokenless 404 it used to be.)`);
     }
     return out.join('\n');
   }

package/scripts/gds/update-channel.js

@@ -122,9 +122,9 @@ function resolveChannelTarget({ installed, channel, available } = {}) {
 
 // ---- registry: what versions of the core are published? ---------------------
 
-// List published versions of @bongos/core from the registry via `npm view … versions --json`
-// (ADR 0134 — the private scoped package resolves through the instance's env-fed .npmrc, so run this
-// with cwd inside an instance that has one + NPM_TOKEN in env). Fail-SOFT: any error returns
+// List published versions of @bongos/core from the registry via `npm view … versions --json`.
+// The package is public (task 1003872), so this needs no credential and no instance-local
+// `.npmrc` — any cwd resolves it. Fail-SOFT: any error returns
 // { ok:false } so the routine skips that instance rather than crashing the whole sweep. `run` +
 // `pkg` are injectable for tests.
 function listAvailableVersions({ cwd = process.cwd(), pkg = CORE_PKG, run = spawnSync, env = process.env } = {}) {

package/scripts/gds/upgrade.js

@@ -27,10 +27,11 @@
 // against `--instance <consumer>` — see docs/recipes for the bootstrap note.
 
 const fs = require('node:fs');
+const os = require('node:os');
 const path = require('node:path');
+const crypto = require('node:crypto');
 const { spawnSync } = require('node:child_process');
 const { arg, hasFlag } = require('./cli-lib');
-const { writeNpmrc, hasNpmToken, resolveNpmToken } = require('./npmrc'); // ADR 0134 (task 2090): the --registry channel's env-fed .npmrc; resolveNpmToken task 1002754
 
 const CORE_PKG = '@bongos/core';
 const ARTIFACT = 'bongos-core';
@@ -96,9 +97,9 @@ function writePin(instanceDir, vendorRel, fsImpl = fs) {
   return prev;
 }
 
-// Rewrite the consumer package.json to pin an EXACT registry version (ADR 0134, task
-// 2090): the registry sibling of writePin. `npm install` then resolves @bongos/core@version
-// from the registry (auth via the env-fed .npmrc). Returns the previous dep string.
+// Rewrite the consumer package.json to pin an EXACT registry version: the registry sibling
+// of writePin. `npm install` then resolves @bongos/core@version from the public registry —
+// no credential, since the package is public (task 1003872). Returns the previous dep string.
 function writeRegistryPin(instanceDir, version, fsImpl = fs) {
   const pkgPath = path.join(instanceDir, 'package.json');
   const pkg = readJson(pkgPath, fsImpl);
@@ -170,18 +171,133 @@ function dirtyPinFiles(instanceDir, run = spawnSync) {
   return (r.stdout || '').split('\n').map((l) => l.slice(3).trim()).filter(Boolean);
 }
 
+// ---- which credential the pin push rides (task 1003081, ADR 0176 follow-up) ----
+//
+// THE BUG THIS EXISTS FOR. A PRIVATE standalone instance's `origin` authenticates with
+// a per-repo deploy key that GitHub registers READ-ONLY (ADR 0176): it can pull, never
+// push. The push leg below went `git push origin HEAD:main` regardless, so on such an
+// instance GitHub refused the pin push, the bump was not durable, and the next
+// pull-deploy `git reset --hard origin/main` + `npm ci` reinstalled the OLD core
+// against an already-migrated DB — the exact silent rollback task 1002712 closed for
+// every other path, back through a warning line nobody read. The scaffold push and the
+// re-provision pin refresh already prefer the owner's stored `repo`-scoped OAuth token
+// over the SSH origin (provision.js resolveOwnerGithubToken + buildCorePinRefreshCommit);
+// the pin push now has the same preference — the token when one is stored, the git
+// remote otherwise — and a refused push is LOUD, naming the read-only key and the fix.
+
+// The GitHub owner/name behind `remote`, or null when the remote is not a GitHub
+// repository (there is nothing to push a GitHub token at) or cannot be read. Accepts
+// the plain github.com forms and the shared SSH alias instanceRepoRemote wires
+// (`git@github-deploy:owner/repo.git`) — never another host, so a stored token is
+// never pointed at github.com/<owner>/<repo> for a repo that lives elsewhere.
+function remoteGithubRepo(instanceDir, remote = 'origin', run = spawnSync) {
+  const r = run('git', ['remote', 'get-url', remote], { cwd: instanceDir, encoding: 'utf8' });
+  if (!r || r.error || r.status !== 0) return null;
+  const url = String(r.stdout || '').trim();
+  let auth;
+  try { auth = require('./provision-repo-auth'); } catch { return null; } // a package without the provisioner has no token path
+  const repo = auth.parseTargetRef(url);
+  if (!repo) return null;
+  const host = (url.match(/^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?([^/:]+)[/:]/i) || [])[1] || '';
+  if (host.toLowerCase() !== 'github.com' && url !== auth.instanceRepoRemote(repo)) return null;
+  return repo;
+}
+
+// The deploy key `remote` authenticates with when the checkout is wired the ADR 0176
+// way (`core.sshCommand … -i <key>` in the repo's own config); null when it is not.
+// What a refused origin push is diagnosed against — GitHub's SSH refusal is a terse
+// one-liner that names no key.
+function pinnedDeployKey(instanceDir, run = spawnSync) {
+  const r = run('git', ['config', '--get', 'core.sshCommand'], { cwd: instanceDir, encoding: 'utf8' });
+  if (!r || r.error || r.status !== 0) return null;
+  const m = String(r.stdout || '').match(/(?:^|\s)-i\s+(\S+)/);
+  return m ? m[1] : null;
+}
+
+// Resolve { token, repo } for the pin push, or null → push via the git remote.
+//   repo  — the remote's GitHub owner/name (remoteGithubRepo);
+//   row   — provision-repo-auth lookupInstanceRow, used ONLY when its target_ref IS that
+//           repo, so another instance's credential is never spent on this checkout;
+//   token — provision-repo-auth resolveOwnerGithubToken (deps.getGithubToken / deps.db
+//           are its test seams), the same resolver the scaffold push uses.
+// Every miss is the origin path, not an error, and the token is never logged. The row
+// lookup and the token read BOTH live in the leaf rather than here because their default
+// requires are computed, and this file is inside the merge resolver's executed closure
+// with a pinned computed-require count of its own (task 1003081).
+async function resolvePinPushAuth({ instanceDir, remote = 'origin' }, deps = {}, run = spawnSync) {
+  const log = deps.log || console.log;
+  const repo = remoteGithubRepo(instanceDir, remote, run);
+  if (!repo) return null;
+  const auth = require('./provision-repo-auth');
+  const inst = await auth.lookupInstanceRow(instanceDir, deps);
+  if (!inst) return null;
+  const rowRepo = auth.parseTargetRef(inst.target_ref);
+  const same = (a, b) => a && b && a.owner.toLowerCase() === b.owner.toLowerCase() && a.name.toLowerCase() === b.name.toLowerCase();
+  if (!same(rowRepo, repo)) {
+    log(`  • pin push: the provisioning row for ${path.basename(instanceDir)} names ${inst.target_ref}, not ${remote}'s ${repo.owner}/${repo.name} — its owner's token is not for this checkout; pushing via ${remote}`);
+    return null;
+  }
+  const token = await auth.resolveOwnerGithubToken(inst, { ...deps, log }, { tag: '[pin-push]' });
+  if (!token) {
+    log(`  • pin push: no owner GitHub token stored for ${repo.owner}/${repo.name} — pushing via ${remote}`);
+    return null;
+  }
+  return { token, repo };
+}
+
+// The pin push over the owner's token: a chmod-600 credential-store file in the temp
+// dir carries the secret, git reads it through `credential.helper=store`, and the file
+// is removed in `finally` whatever the push did — the token is never in argv (ps,
+// journald) and never in a log line. provision.js buildCorePinRefreshCommit's shape,
+// as argv instead of a shell string.
+function pushPinViaToken({ instanceDir, token, repo, target }, run = spawnSync) {
+  const credFile = path.join(os.tmpdir(), `bongos-gitcred-pin-${process.pid}-${crypto.randomBytes(6).toString('hex')}`);
+  try {
+    fs.writeFileSync(credFile, `https://x-access-token:${token}@github.com\n`, { mode: 0o600 });
+    return run('git', ['-c', `credential.helper=store --file=${credFile}`, 'push', `https://x-access-token@github.com/${repo.owner}/${repo.name}.git`, target], {
+      cwd: instanceDir, encoding: 'utf8',
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }, // a rejected credential must fail, not sit at a password prompt
+    });
+  } finally {
+    fs.rmSync(credFile, { force: true });
+  }
+}
+
+// What git said on stderr, for a refusal line — GitHub's own reason ("ERROR: The key you
+// are authenticating with has been marked as read only", "remote: Write access to
+// repository not granted") is the fact an operator wants beside the diagnosis, and it
+// is never the LAST line: git closes with its generic `fatal:`. Prefer the server's
+// line, fall back to the last one.
+function gitSaid(r) {
+  const lines = String((r && r.stderr) || '').split('\n').map((l) => l.trim()).filter(Boolean);
+  const server = lines.filter((l) => /^(ERROR:|remote:)/i.test(l));
+  const said = server.length ? server[server.length - 1] : lines[lines.length - 1];
+  return said ? ` (git: ${said})` : '';
+}
+
 // `push: false` is CO-TENANT MODE (task 1003521). The reasoning above assumes the repo
 // of record is OURS; on a provisioned instance it is the customer's own GitHub repo, so
 // pushing there is both wrong and uncredentialed. Such an instance also has no
 // pull-deploy timer, so nothing will `reset --hard` the pin away — the commit alone
 // makes it durable, and leaves the tree clean for the customer's own pulls.
-function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = true, remote = 'origin', dryRun = false },
+//
+// `pushAuth` ({ token, repo }, from resolvePinPushAuth) makes the push ride the owner's
+// GitHub token over HTTPS (task 1003081); null pushes via `remote`. The result carries
+// `via: 'owner-token'` on the token path and `refused` ('read-only-deploy-key' |
+// 'owner-token') with a plain-sentence `error` when GitHub turned the push away.
+function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = true, remote = 'origin', dryRun = false, pushAuth = null },
   run = spawnSync, log = console.log, err = console.error) {
   const dirty = dirtyPinFiles(instanceDir, run);
   if (dirty === null) return { applicable: false, reason: 'not a git repo' };
   if (!dirty.length) return { applicable: false, reason: 'pin files already match the repo' };
 
   const branch = gitCurrentBranch(instanceDir, run);
+  const target = `HEAD:${branch || 'main'}`;
+  // Single-quote the interpolated values. Nothing here executes these strings — they
+  // are printed for a human to paste — but an unquoted branch or remote carrying shell
+  // metacharacters would misbehave once pasted, so emit them paste-safe.
+  const q = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
+  const at = `git -C ${q(instanceDir)}`;
 
   if (!commitPin) {
     if (!push) {
@@ -198,12 +314,7 @@ function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = tru
     err('    On a pull-deploy instance the next push to the repo of record makes deploy.sh');
     err(`    'git reset --hard ${remote}/${branch || 'main'}', which REVERTS this pin and lets npm ci`);
     err(`    reinstall ${fromVersion || 'the previous core'}. Re-run with --commit-pin, or commit + push:`);
-    // Single-quote the interpolated values. Nothing here executes this string — it is
-    // printed for a human to paste — but an unquoted branch or remote carrying shell
-    // metacharacters would misbehave once pasted, so emit it paste-safe.
-    const q = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
-    const at = `git -C ${q(instanceDir)}`;
-    err(`      ${at} add ${PIN_FILES.map(q).join(' ')} && ${at} commit -m ${q(`pin @bongos/core ${toVersion}`)} && ${at} push ${q(remote)} ${q(`HEAD:${branch || 'main'}`)}`);
+    err(`      ${at} add ${PIN_FILES.map(q).join(' ')} && ${at} commit -m ${q(`pin @bongos/core ${toVersion}`)} && ${at} push ${q(remote)} ${q(target)}`);
     return { applicable: true, committed: false, pushed: false, dirty, warned: true };
   }
 
@@ -232,11 +343,62 @@ function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = tru
     return { applicable: true, committed: true, pushed: false, dirty, pushSkipped: true };
   }
 
-  const pushed = run('git', ['push', remote, `HEAD:${branch || 'main'}`], { cwd: instanceDir, encoding: 'utf8' });
+  // Committed but not pushed is still doomed: deploy.sh resets to the REMOTE. So every
+  // refusal below is LOUD (task 1003081) — the pull-deploy consequence, the diagnosis,
+  // and a by-hand push that can actually write.
+  const revert = () => err(`    The next pull-deploy 'git reset --hard ${remote}/${branch || 'main'}' + npm ci then reinstalls ${fromVersion || 'the previous core'}.`);
+
+  if (pushAuth && pushAuth.token && pushAuth.repo) {
+    const { repo } = pushAuth;
+    let pushed = null;
+    try {
+      pushed = pushPinViaToken({ instanceDir, token: pushAuth.token, repo, target }, run);
+    } catch (e) {
+      // The credential file could not even be written (an unwritable temp dir): say so
+      // and fall through to the remote — a public origin may still take it.
+      err(`  ! could not stage the owner's GitHub credential (${e && e.message}) — pushing via ${remote} instead`);
+    }
+    if (pushed && !pushed.error && pushed.status === 0) {
+      log(`  ✓ pushed the pin to ${repo.owner}/${repo.name}@${branch || 'main'} via the owner's GitHub token — a pull-deploy reset can no longer revert it`);
+      return { applicable: true, committed: true, pushed: true, dirty, via: 'owner-token' };
+    }
+    if (pushed) {
+      err(`  ! PIN NOT PUSHED — GitHub refused the push over the owner's GitHub token, so this bump is NOT durable.`);
+      err(`    The stored token could not write ${repo.owner}/${repo.name}: it may have expired (they live an hour), or`);
+      err(`    lack the \`repo\` scope (\`public_repo\` cannot write a private repository — ADR 0155).${gitSaid(pushed)}`);
+      revert();
+      err('    Fix: have the instance owner reconnect GitHub with repository access, then re-run `bongos upgrade --commit-pin`;');
+      err('    or push the commit yourself with a credential that can write:');
+      err(`      ${at} push ${q(`https://github.com/${repo.owner}/${repo.name}.git`)} ${q(target)}`);
+      return {
+        applicable: true, committed: true, pushed: false, dirty, refused: 'owner-token',
+        error: `GitHub refused the pin push over the owner's GitHub token (expired, or missing the repo scope) — the pin is committed locally but not on ${repo.owner}/${repo.name}`,
+      };
+    }
+  }
+
+  const pushed = run('git', ['push', remote, target], { cwd: instanceDir, encoding: 'utf8' });
   if (!pushed || pushed.error || pushed.status !== 0) {
-    // Committed but not pushed is still doomed: deploy.sh resets to the REMOTE.
+    const key = pinnedDeployKey(instanceDir, run);
+    if (key) {
+      // A wired private instance (ADR 0176): the key can pull, never push, and no owner
+      // token was stored to push with instead — the bug this leg exists for.
+      const repo = remoteGithubRepo(instanceDir, remote, run);
+      err(`  ! PIN NOT PUSHED — GitHub refused the push to ${remote}, so this bump is NOT durable.`);
+      err(`    ${remote} authenticates with the deploy key at ${key}, which is registered READ-ONLY on the`);
+      err(`    repository (ADR 0176): it can pull, never push. No owner GitHub token is stored to push with instead.${gitSaid(pushed)}`);
+      revert();
+      err('    Fix: have the instance owner reconnect GitHub with repository access (that stores a short-lived repo token),');
+      err(`    then re-run \`bongos upgrade --commit-pin\` where that token is readable — the control plane, with --instance ${q(instanceDir)};`);
+      err('    or push the commit yourself with a credential that can write:');
+      err(`      ${at} push ${q(`https://github.com/${repo ? `${repo.owner}/${repo.name}` : '<owner>/<repo>'}.git`)} ${q(target)}`);
+      return {
+        applicable: true, committed: true, pushed: false, dirty, refused: 'read-only-deploy-key',
+        error: `GitHub refused the pin push: ${remote} authenticates with the read-only deploy key at ${key}, and no owner GitHub token is stored to push with — the pin is committed locally but not on the remote`,
+      };
+    }
     err(`  ! commit landed locally but the push to ${remote} FAILED — this bump is still not durable.`);
-    err(`    Push it: git -C ${instanceDir} push ${remote} HEAD:${branch || 'main'}`);
+    err(`    Push it: git -C ${instanceDir} push ${remote} ${target}`);
     return { applicable: true, committed: true, pushed: false, dirty, error: 'git push failed' };
   }
   log(`  ✓ pushed the pin to ${remote}/${branch || 'main'} — a pull-deploy reset can no longer revert it`);
@@ -315,13 +477,13 @@ function reportModulePreflight(mods, targetVersion, { log = console.log, err = c
   return lines;
 }
 
-function npmInstall(instanceDir, run = spawnSync, extraEnv = null) {
+function npmInstall(instanceDir, run = spawnSync) {
   // `npm install` (NOT `npm ci`): the pin just changed, so the lockfile must be regenerated from the
   // new tarball; `npm ci` would refuse on the package.json↔lock divergence.
-  // extraEnv (task 1002754): the registry path injects a resolved NPM_TOKEN here so the
-  // instance `.npmrc`'s `${NPM_TOKEN}` expansion never shadows a valid user-level token.
+  // This used to take an extraEnv carrying a resolved npm credential, because the instance
+  // `.npmrc`'s env expansion could shadow a valid user-level one (task 1002754). The core is
+  // public and writes no `.npmrc`, so there is no credential to resolve (task 1003878).
   const opts = { cwd: instanceDir, stdio: 'inherit' };
-  if (extraEnv) opts.env = { ...process.env, ...extraEnv };
   const r = run('npm', ['install', '--no-audit', '--no-fund'], opts);
   return !r || r.error ? { ok: false, reason: r && r.error ? r.error.message : 'spawn failed' } : { ok: r.status === 0, code: r.status };
 }
@@ -820,11 +982,8 @@ async function rollback({ instanceDir, snapshot, fromVersion, toVersion, opts },
   try { restore(instanceDir, snapshot.prevPin, fsImpl); result.restoreOk = true; log(`  ✓ restored pin → ${snapshot.prevPin}`); }
   catch (e) { result.restoreOk = false; err(`  ! could not restore pin (${e.message}) — package.json may need manual repair`); }
 
-  // 2. reinstall the previous core. Same credential resolution as the forward path
-  //    (task 1002754): the previous pin may be a registry pin too, and a rollback
-  //    must never fail on the env-shadowing trap the forward install just avoided.
-  const rbCred = resolveNpmToken();
-  const inst = npmInstall(instanceDir, run, rbCred.source === 'user-npmrc' ? { NPM_TOKEN: rbCred.token } : null);
+  // 2. reinstall the previous core.
+  const inst = npmInstall(instanceDir, run);
   result.reinstallOk = !!inst.ok;
   if (inst.ok) log('  ✓ reinstalled previous core');
   else err(`  ! reinstall of previous core failed (${inst.reason || 'exit ' + inst.code}) — the instance may need manual repair`);
@@ -931,24 +1090,16 @@ async function runUpgrade(opts, deps = {}) {
     return { ok: false, error: 'post-restart health check is mandatory for a bump that restarts the service, but no --health-url was given.\n  Pass --health-url <url> to confirm the new core serves after restart, or --no-health-check to explicitly skip the confirmation.' };
   }
 
-  // 2. bump the pin. Two mutually exclusive core sources (ADR 0134, task 2090):
-  //    REGISTRY (--registry): pin @bongos/core@<version> + ensure the env-fed .npmrc, so
-  //      the `npm install` below pulls the PRIVATE package from the registry (needs NPM_TOKEN).
+  // 2. bump the pin. Two mutually exclusive core sources:
+  //    REGISTRY (--registry): pin @bongos/core@<version> and let `npm install` pull it from
+  //      the public registry. No credential — the package is public (task 1003872), which
+  //      also retired the whole resolve-a-token-and-inject-it dance (task 1002754/1003878).
   //    VENDORED (default, --from <tgz>): copy the .tgz into vendor/ + rewrite the file: dep.
-  let installEnv = null;
   if (opts.registry) {
     if (opts.from) return { ok: false, error: '--registry and --from are mutually exclusive (registry pull vs vendored tarball) — pick one core source' };
-    // task 1002754 — resolve the credential HERE instead of demanding a hand-exported
-    // env var: env NPM_TOKEN wins, else the user-level ~/.npmrc's literal token is
-    // injected into the install's env so the instance `.npmrc`'s `${NPM_TOKEN}`
-    // expansion (which OUTRANKS the user-level key and expands EMPTY when unset)
-    // can never shadow a working credential again.
-    const cred = resolveNpmToken();
-    if (!cred.token) log('  ! no NPM_TOKEN in env and no literal token in ~/.npmrc — `npm install` will 404 on the PRIVATE @bongos/core until a read-only automation token is provided (ADR 0134).');
-    else if (cred.source === 'user-npmrc') { installEnv = { NPM_TOKEN: cred.token }; log('  ✓ registry credential: inherited from the user-level ~/.npmrc (no NPM_TOKEN export needed — task 1002754)'); }
     const prevPin = dryRun ? null : writeRegistryPin(instanceDir, targetVersion, fsImpl);
-    if (!dryRun) { writeNpmrc(instanceDir, { fsImpl, overwrite: false, log }); snapshot = { prevPin, prevVersion: fromVersion }; }
-    log(`  ${dryRun ? '[dry-run] would pin' : '✓ pinned'} ${CORE_PKG} → ${targetVersion} (registry)${dryRun ? ' + write an env-fed .npmrc' : ''}${prevPin ? `  (was ${prevPin})` : ''}`);
+    if (!dryRun) { snapshot = { prevPin, prevVersion: fromVersion }; }
+    log(`  ${dryRun ? '[dry-run] would pin' : '✓ pinned'} ${CORE_PKG} → ${targetVersion} (registry)${prevPin ? `  (was ${prevPin})` : ''}`);
   } else {
     let vendorRel = opts.pinPath || (opts.from ? null : vendorRelFor(targetVersion));
     if (opts.from) {
@@ -967,7 +1118,7 @@ async function runUpgrade(opts, deps = {}) {
   if (dryRun) { log('  [dry-run] would: npm install → npm run migrate → materialize .claude → regen API docs+client → restart → verify'); return { ok: true, dryRun: true, fromVersion, toVersion: targetVersion }; }
 
   // 3. npm install.
-  const inst = npmInstall(instanceDir, run, installEnv);
+  const inst = npmInstall(instanceDir, run);
   if (!inst.ok) {
     const error = `npm install failed (${inst.reason || 'exit ' + inst.code})`;
     if (rollbackOnFailure && snapshot) {
@@ -1144,14 +1295,23 @@ async function runUpgrade(opts, deps = {}) {
 
   // Make the pin durable (task 1002712). Runs LAST — only a verified-healthy
   // upgrade is worth persisting, and a rolled-back one returned long before here.
+  //
+  // Which credential the push rides is resolved HERE (async — it may read the token
+  // store) and handed to persistPin, which stays synchronous — and only when a push is
+  // actually coming: --commit-pin without --pin-no-push, not a dry run, and the pin
+  // files really are dirty. Nothing reads a credential it will not spend (task 1003081).
+  const remote = opts.gitRemote || 'origin';
+  const pushComing = !!opts.commitPin && !opts.pinNoPush && !dryRun && (dirtyPinFiles(instanceDir, run) || []).length > 0;
+  const pushAuth = pushComing ? await (deps.resolvePinPushAuth || resolvePinPushAuth)({ instanceDir, remote }, deps, run) : null;
   const pin = persistPin({
     instanceDir,
     fromVersion,
     toVersion: targetVersion,
     commitPin: opts.commitPin,
     push: !opts.pinNoPush,
-    remote: opts.gitRemote || 'origin',
+    remote,
     dryRun: opts.dryRun,
+    pushAuth,
   }, run, log, err);
 
   const ok = versionOk && healthOk !== false && servedOk !== false;
@@ -1198,7 +1358,7 @@ async function main(argv = process.argv.slice(2)) {
       '',
       '  --to <version>       target core version — presence switches from pre-check to a real bump',
       '  --from <tgz>         source tarball to vendor into vendor/ (else it must already be there)',
-      '  --registry           pull @bongos/core@<--to> from the npm registry (env-fed .npmrc + NPM_TOKEN) instead of vendoring a tarball (ADR 0134); mutually exclusive with --from',
+      '  --registry           pull @bongos/core@<--to> from the public npm registry (no token needed) instead of vendoring a tarball; mutually exclusive with --from',
       '  --instance <dir>     consumer instance root (default: cwd)',
       '  --service <unit>     systemd unit to restart after applying',
       '  --restart-cmd <cmd>  explicit restart command (overrides --service)',
@@ -1211,6 +1371,7 @@ async function main(argv = process.argv.slice(2)) {
       '  --skip-pin-verify    do not verify the integrity pin (tree_sha256 + tarball.sha256) after install',
       '  --require-pin        treat a MISSING reference manifest as fatal (default: warn — a MISMATCH is always fatal)',
       '  --no-rollback-on-failure  do NOT auto-revert on a failed install/pin-verify/migrate/health check (default: auto-rollback ON)',
+      '  --commit-pin         commit + push package.json/-lock so a pull-deploy reset cannot revert the bump. The push rides the instance owner\'s stored GitHub token when one is stored (a PRIVATE instance\'s origin is a read-only deploy key — ADR 0176), else the git remote (--git-remote <name>, default origin); a refused push is reported loudly with the fix',
       '  --pin-no-push        with --commit-pin: commit the pin but do NOT push it — for an instance whose repo of record is not ours (a provisioned co-tenant), where the push is wrong and no pull-deploy can revert the commit',
       '  --dry-run            show the plan; change nothing',
       '  --force              skip the clean-tree + same-version guards',
@@ -1233,7 +1394,9 @@ async function main(argv = process.argv.slice(2)) {
 module.exports = {
   runUpgrade, parseArgs, main, rollback,
   versionFromTgzPath, versionFromDep, readInstalledCoreVersion, readPinnedCoreVersion, writePin, writeRegistryPin, restorePin,
-  vendorTarball, gitTreeClean, persistPin, dirtyPinFiles, gitCurrentBranch, PIN_FILES, preflightDbIdentity, resolveInstanceDb, preflightModules, reportModulePreflight, npmInstall, runMigrate, regenerateApiArtifacts, regenerateNavDocs, NAV_WHOLE_FILE_GENERATORS, missingDocAssets, healDocAssets, DOC_ASSET_GENERATORS, restartService, recordLedger, pollHealth, deriveVersionUrl, pollServedVersion,
+  vendorTarball, gitTreeClean, persistPin, dirtyPinFiles, gitCurrentBranch, PIN_FILES, preflightDbIdentity,
+  resolveInstanceDb, preflightModules, reportModulePreflight, npmInstall, runMigrate, regenerateApiArtifacts, regenerateNavDocs, NAV_WHOLE_FILE_GENERATORS, missingDocAssets, healDocAssets, DOC_ASSET_GENERATORS, restartService, recordLedger, pollHealth, deriveVersionUrl, pollServedVersion,
+  resolvePinPushAuth, remoteGithubRepo, pinnedDeployKey, // task 1003081 — the pin push prefers the owner's GitHub token (ADR 0176 follow-up)
   readManifest, resolveReferenceManifest, verifyInstalledPin, // task 1002216 (audit H8) — integrity-pin verification
   CORE_PKG, ARTIFACT, vendorRelFor,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.736'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.738'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/executed_closure.mjs

@@ -97,6 +97,14 @@ test('every computed require inside the closure is one we have accounted for', (
     // floor) is lazy and inside a function.
     ['scripts/gds/package-core.js', 6],   // publish-manifest/mirror-redact/secret-scrub/leak-scan-allowlist/…
     ['scripts/gds/upgrade.js', 1],        // a `node -e` child, not a require in this process
+    // Added by task 1003081: upgrade.js's pin push needs the owner-credential helpers,
+    // and requiring provision.js for them would have pulled provision-config/-repo/-units
+    // (7/1/1 unaccounted computed requires) into the closure. This LEAF is the whole of
+    // that growth: 3 computed requires — src/bongos/db in resolveOwnerGithubToken, and
+    // modules/provisioning + src/bongos/pool in lookupInstanceRow — each inside a function
+    // body reached only from the pin push, which no generator calls. Its top level requires
+    // node builtins only, so it drags nothing else in behind it.
+    ['scripts/gds/provision-repo-auth.js', 3],
     ['scripts/gds/gen-api-docs.js', 1],   // require(path.join(CORE_ROOT,'package.json')) — JSON
   ]);