@bongos/core 1.19.791 → 1.19.792

package/docs/copy-registry.json

@@ -68,7 +68,7 @@
         "modules/hall-ui/public/settings.js:615",
         "modules/hall-ui/public/settings.js:714",
         "modules/hall-ui/public/settings.js:794",
-        "modules/hall-ui/public/settings.js:1093"
+        "modules/hall-ui/public/settings.js:1096"
       ]
     },
     {
@@ -1520,7 +1520,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings.js:788",
-        "modules/hall-ui/public/settings.js:1346"
+        "modules/hall-ui/public/settings.js:1349"
       ]
     },
     {
@@ -3097,7 +3097,7 @@
       "surface": "builders-hall",
       "text": "Checking your key…",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1070,
+      "line": 1073,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3691,7 +3691,7 @@
       "surface": "builders-hall",
       "text": "Could not copy automatically — select and copy manually. ({…})",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 949,
+      "line": 952,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3889,7 +3889,7 @@
       "surface": "builders-hall",
       "text": "Could not load your account. Reload the page to try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1329,
+      "line": 1332,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3916,7 +3916,7 @@
       "surface": "builders-hall",
       "text": "Could not load your settings.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1332,
+      "line": 1335,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3961,7 +3961,7 @@
       "surface": "builders-hall",
       "text": "Could not remove your key. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1150,
+      "line": 1153,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3970,7 +3970,7 @@
       "surface": "builders-hall",
       "text": "Could not remove. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1149,
+      "line": 1152,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -4033,7 +4033,7 @@
       "surface": "builders-hall",
       "text": "Could not save your key. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1094,
+      "line": 1097,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4177,7 +4177,7 @@
       "surface": "builders-hall",
       "text": "Could not save. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1093,
+      "line": 1096,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -4195,7 +4195,7 @@
       "surface": "builders-hall",
       "text": "Could not set up key storage. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1130,
+      "line": 1133,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4204,7 +4204,7 @@
       "surface": "builders-hall",
       "text": "Could not set up storage. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1129,
+      "line": 1132,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -4883,15 +4883,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "d629e152f074",
-      "surface": "builders-hall",
-      "text": "Expires {…} · refreshes on use.",
-      "file": "modules/hall-ui/public/settings.js",
-      "line": 939,
-      "origin": "js-text-assign",
-      "confidence": "certain"
-    },
     {
       "id": "de62f4cc7d2e",
       "surface": "builders-hall",
@@ -5104,7 +5095,7 @@
       "surface": "builders-hall",
       "text": "Fresh CLI token issued. Paste it in your terminal:",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 929,
+      "line": 932,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5185,7 +5176,7 @@
       "surface": "builders-hall",
       "text": "Get a free key ↗",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 973,
+      "line": 976,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5734,7 +5725,7 @@
       "surface": "builders-hall",
       "text": "Image key removed.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1146,
+      "line": 1149,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5977,7 +5968,7 @@
       "surface": "builders-hall",
       "text": "Key removed.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1145,
+      "line": 1148,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5986,7 +5977,7 @@
       "surface": "builders-hall",
       "text": "Key storage is being set up by an Archon — check back shortly. {…}",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1024,
+      "line": 1027,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5995,7 +5986,7 @@
       "surface": "builders-hall",
       "text": "Key storage isn't set up yet. As an Archon you can turn it on now — the server generates and safely stores the master key (no terminal needed).",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1020,
+      "line": 1023,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6058,7 +6049,7 @@
       "surface": "builders-hall",
       "text": "Latest version: v{…}.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1418,
+      "line": 1421,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6733,7 +6724,7 @@
       "surface": "builders-hall",
       "text": "No builder account found for this sign-in.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1337,
+      "line": 1340,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7498,7 +7489,7 @@
       "surface": "builders-hall",
       "text": "Paste command copied.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 948,
+      "line": 951,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7507,7 +7498,7 @@
       "surface": "builders-hall",
       "text": "Paste your key first.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1069,
+      "line": 1072,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7921,7 +7912,7 @@
       "surface": "builders-hall",
       "text": "Re-issue failed: {…}",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 953,
+      "line": 956,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8182,7 +8173,7 @@
       "surface": "builders-hall",
       "text": "Remove your image-generation key? Art generation will stop until you add one again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1137,
+      "line": 1140,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8488,7 +8479,7 @@
       "surface": "builders-hall",
       "text": "Save key",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1005,
+      "line": 1008,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8749,7 +8740,7 @@
       "surface": "builders-hall",
       "text": "Set up key storage",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1021,
+      "line": 1024,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8767,7 +8758,7 @@
       "surface": "builders-hall",
       "text": "Setting up key storage…",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1105,
+      "line": 1108,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -11017,7 +11008,7 @@
       "surface": "builders-hall",
       "text": "Your image-generation key settings could not be loaded. Reload the page to try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1172,
+      "line": 1175,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11035,7 +11026,7 @@
       "surface": "builders-hall",
       "text": "Your key",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1001,
+      "line": 1004,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11107,7 +11098,7 @@
       "surface": "builders-hall",
       "text": "Your preferences, {…}.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1346,
+      "line": 1349,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -12196,7 +12187,7 @@
       "surface": "builders-hall",
       "text": "paste command",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 931,
+      "line": 934,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -13078,7 +13069,7 @@
       "surface": "builders-hall",
       "text": "{…} · Stored encrypted; never shown again after saving.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1007,
+      "line": 1010,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13091,6 +13082,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "a6e4ed98fbea",
+      "surface": "builders-hall",
+      "text": "{…} · revoke it any time under Active sessions.",
+      "file": "modules/hall-ui/public/settings.js",
+      "line": 942,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "d73256fbc395",
       "surface": "builders-hall",

package/docs/module-api-changelog.md

@@ -2056,5 +2056,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.789 with no explicit bump. run 35163350575. (task 1002620)
   1.19.791 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.790 with no explicit bump. run 35165066743. (task 1002620)
+  1.19.792 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.791 with no explicit bump. run 35166486577. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_243_cli_sessions_never_expire.sql

@@ -0,0 +1,58 @@
+-- core_243 — CLI sessions lose their idle expiry (task 1003956, ADR 0294).
+--
+-- WHAT CHANGED IN CODE. db-kernel.js createSession now records NO expiry when a
+-- caller names none (every such caller is source='cli'), and lookupSession's
+-- refresh-on-use rolls expires_at forward only for a row that already has one.
+-- Both halves are forward-looking: they govern sessions minted or used AFTER the
+-- deploy. Neither touches the dated rows already sitting in the table.
+--
+-- WHY THAT NEEDS A MIGRATION. Without this, the code change would be nearly
+-- invisible on the day it ships. Every live CLI session carries an expires_at
+-- from migration 035's backfill and from every refresh since, so each one would
+-- still lapse on its own 24h clock exactly as before — and each builder would eat
+-- one final forced re-auth to get a row the new default applies to. That is the
+-- precise annoyance the task set out to remove, delivered once more on the way
+-- out. Clearing the column here is what makes the fix arrive for people who are
+-- already signed in.
+--
+-- DIRECTION OF THE GRACE. Migration 035 faced the mirror of this and reasoned the
+-- same way: it backfilled a 24h runway specifically so introducing a TTL would
+-- not kill the session running the migration. This is that courtesy inverted —
+-- 035 pushed expiries out so nobody was signed out by a new timer; this removes
+-- them so nobody is signed out by a timer already gone from the code. In both
+-- cases the migration exists to keep a policy change off the backs of the people
+-- holding live sessions when it lands.
+--
+-- WHY source='cli' AND NOT A BLANKET UPDATE. builder_sessions holds both classes
+-- and only the CLI's expiry was asked for. A web row's expires_at is an explicit
+-- 30-day value its own flow chose (auth-idp.js / auth-github.js pass a real date,
+-- so the new NULL default never reaches them); nulling it here would silently
+-- hand browser cookies an immortality nobody decided on, and the code would not
+-- re-establish it — lookupSession only rolls an expiry it can already see, so a
+-- web row cleared by mistake stays cleared forever. The filter is the whole
+-- safety property of this statement.
+--
+-- WHY revoked_at IS NULL. A revoked row is dead by revoked_at, which lookupSession
+-- checks before it ever reads expires_at, so clearing its expiry could not revive
+-- it. It is excluded anyway: revoked rows are the audit trail of sessions somebody
+-- deliberately killed, and rewriting their columns muddies what that record says.
+-- Touch only what the change is actually about.
+--
+-- WHAT THIS DOES NOT WEAKEN. Revocation is untouched and remains the real remedy
+-- (ADR 0206): POST /me/sessions/revoke and "Sign out everywhere" kill a leaked
+-- bearer immediately, setBuilderRank sweeps every session on demotion, and
+-- requireBuilder refuses a deactivated builder on the hot path regardless of any
+-- live token. None of those consult expires_at.
+--
+-- Idempotent: re-running matches no rows the second time (expires_at is already
+-- NULL) and is a no-op.
+
+BEGIN;
+
+UPDATE builder_sessions
+   SET expires_at = NULL
+ WHERE source = 'cli'
+   AND revoked_at IS NULL
+   AND expires_at IS NOT NULL;
+
+COMMIT;

package/modules/hall-ui/public/settings.js

@@ -913,7 +913,10 @@
       if (res.status === 401) { toAuth(); return; }
       const body = (res.data || {});
       if (!res.ok) throw new Error(body.message || `HTTP ${res.status}`);
-      const expires = body.expires_at ? new Date(body.expires_at).toLocaleString() : 'unknown';
+      // No expires_at is the NORMAL case for a CLI bearer since ADR 0294 — say so
+      // plainly. 'unknown' read as a gap in the page's knowledge; the absence of a
+      // date is the fact, and the revoke is what replaced the timer.
+      const expires = body.expires_at ? `Expires ${new Date(body.expires_at).toLocaleString()}` : 'Never expires';
       const pasteCommand = body.paste_command || '';
       // The secret is QUOTED (settings.css `.quote`): a 64-character token cannot
       // be a line of prose, so it sits one tonal step down with its own foot. Same
@@ -936,7 +939,7 @@
       copyBtn.id = 'cli-reissue-copy';
       copyBtn.textContent = 'Copy';
       const hint = el('span', 'settings-card__hint');
-      hint.textContent = `Expires ${expires} · refreshes on use.`;
+      hint.textContent = `${expires} · revoke it any time under Active sessions.`;
       const foot = el('div', 'quote__foot');
       foot.append(copyBtn, hint);
       const quote = el('div', 'quote');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.791",
+  "version": "1.19.792",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.791",
+      "version": "1.19.792",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.791",
+  "version": "1.19.792",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box-auth-check.js

@@ -93,7 +93,7 @@ async function probeMe(tokenInfo) {
 function printReauth({ boxScoped }) {
   const why = boxScoped
     ? 'This box holds the BOX-SCOPED bootstrap token (source=box, ADR 0053) — it can bootstrap the box but is refused (403) on claim / ship / publish.'
-    : 'This session token is EXPIRED or revoked (CLI tokens carry a 24h idle TTL).';
+    : 'This session token is REVOKED or otherwise rejected (CLI tokens do not expire on their own — ADR 0294).';
   console.log('[otb] ── dev box: RE-AUTH BEFORE YOU WORK ──');
   console.log(`[otb] ${why}`);
   console.log('[otb] ⚠ FIRST STEP this session: get the builder onto a real CLI session BEFORE claiming or shipping —');

package/scripts/gds/cli-lib.js

@@ -521,9 +521,9 @@ function printUnauthGuidanceAndExit() {
   }
   console.error('');
   console.error('  Possible causes:');
-  console.error('    - Your session token expired (24h idle TTL, auto-refreshes on each request)');
-  console.error('    - Your token was revoked by an Archon');
+  console.error('    - Your token was revoked — by you ("Sign out everywhere") or by an Archon');
   console.error('    - A recent deploy applied an auth-changing migration (see deploy banner)');
+  console.error('    - This instance is older than ADR 0294 and still expires idle CLI sessions');
   console.error('');
   console.error('  Once re-authed, re-run whichever command you were trying.');
   // `doctor` is checkout-only — it is not one of the public CLI's verbs (ADR 0258).

package/scripts/gds/reauth.js

@@ -3,11 +3,13 @@
 //
 // The fast, UI-first path to refresh an expired/invalid GDS CLI session.
 //
-// Why this exists: CLI bearer tokens carry a 24h idle TTL (refresh-on-use) for
-// auth-token hygiene (GDS-V3 criterion C9) — a leaked or abandoned token in the
-// plaintext session file dies on its own instead of living forever. That's a
-// keeper. The friction it caused (re-auth via the slow Device Flow, terminal
-// codes, Gemini-key prompts) is NOT a keeper. This script is the fix:
+// Why this exists: a CLI session can stop working — revoked from the hall's
+// "Sign out everywhere", swept by a demotion, or invalidated by an auth-changing
+// deploy. (It no longer stops working from mere disuse: ADR 0294 removed the idle
+// expiry, because the timer only ever signed out the legitimate holder while
+// refresh-on-use kept a thief's copy alive.) Whatever killed it, the friction of
+// getting back in — the slow Device Flow, terminal codes, Gemini-key prompts — is
+// not something to keep. This script is the fix:
 //
 //   1. Detect — is the current session still valid? (GET /api/gds/me)
 //        valid   → print who you are + exit 0. Nothing to do.
@@ -133,8 +135,8 @@ async function main() {
     const b = (res.data && res.data.builder) || {};
     console.log(`Your GDS CLI session is valid — no re-auth needed.`);
     console.log(`  Signed in as ${b.github_login || '?'}${b.rank ? ` (rank: ${b.rank})` : ''}.`);
-    console.log('  (Sessions carry a 24h idle TTL and refresh on every use, so an');
-    console.log('   actively-used session stays alive.)');
+    console.log('  (CLI sessions do not expire — they last until revoked. Kill one from');
+    console.log('   Settings → Active sessions, or "Sign out everywhere".)');
     process.exit(0);
   }
 

package/scripts/gds/run-unit-tests.js

@@ -145,6 +145,13 @@ const INTEGRATION = new Set([
   // prove the CHECK actually refuses a stored fourth state, that the backfill lands on a
   // pre-migration row, and that publishableSql and projectPublishability agree.
   'project_visibility_db',
+  // task 1003956 (ADR 0294): that CLI sessions really never expire. The DB-free
+  // sibling (auth_session_ttl) pins the constant, createSession's value against a
+  // stub pool, and the TEXT of the refresh statement — but a regex over source
+  // proves the characters are there, not that Postgres does what they mean. Only a
+  // real engine can show the CASE guard leaving a NULL alone on an actual use,
+  // which is exactly where the removed timeout would come back.
+  'auth_session_expiry_db',
   'scouting_rollup_fanout', 'session_records',
   // task 1003217: the cost-row RAISE against real SQL. Every claim in it IS the
   // SQL — an ON CONFLICT DO UPDATE guarded to move a row only upward, and a

package/src/bongos/auth-github.js

@@ -218,6 +218,8 @@ async function pollDeviceFlow(deviceCode, userAgent) {
       source: 'cli',
       userAgent: userAgent ?? null,
       // CLI tokens have no expiry (manually revocable). Web tokens expire.
+      // True again as of ADR 0294: migration 035 made this line a lie for two years
+      // by defaulting a null to a TTL, and removing that default restored it.
       expiresAt: null,
     });
     // V3.R75 (#294): tick the onboarding state machine. Best-effort — auth

package/src/bongos/db-kernel.js

@@ -262,16 +262,25 @@ async function accessStateByLogin(login) {
 
 // --- Auth sessions (kernel: the builder_sessions token store auth.js drives) ----
 
-// SESSION_TTL_MS — session TTL on create/refresh. Centralized so the migration's
-// grace formula, the tests, and the code agree on one number.
+// SESSION_TTL_MS — the roll-forward window for a session that HAS an expiry.
+// It is no longer a default: a caller that names no expiry gets none (ADR 0294).
+// What still reads it is refresh-on-use below, which rolls an already-dated row
+// (the web flow's) forward on each request. Centralized so the tests and the
+// code agree on one number.
 const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
-// createSession — mint a builder_sessions row. Defaults expiry to NOW()+TTL when
-// the caller passes null/undefined (refresh-on-use keeps active sessions alive).
+// createSession — mint a builder_sessions row.
+//
+// A null/undefined expiresAt means NO EXPIRY (expires_at NULL), which
+// lookupSession honours as never-expires. That is the CLI's contract (ADR 0294,
+// restoring 003_pms.sql's original one): a `bongos` sign-in lasts until it is
+// revoked, because an idle expiry only ever logged out the legitimate holder —
+// the remedy for a leaked bearer is the own-scoped revoke of ADR 0206, which is
+// immediate where a timer is not. Every caller that passes null is source='cli'.
+//
+// Web callers pass an explicit date (30 days) and are untouched by this default.
 async function createSession({ builderId, token, source, userAgent, expiresAt }) {
-  const effectiveExpiresAt = expiresAt === undefined || expiresAt === null
-    ? new Date(Date.now() + SESSION_TTL_MS)
-    : expiresAt;
+  const effectiveExpiresAt = expiresAt ?? null;
   const { rows } = await pool.query(
     `INSERT INTO builder_sessions (builder_id, token, source, user_agent, expires_at)
      VALUES ($1, $2, $3, $4, $5)
@@ -282,9 +291,10 @@ async function createSession({ builderId, token, source, userAgent, expiresAt })
 }
 
 // lookupSession — resolve a live (unrevoked, unexpired) session token to its
-// builder identity, and refresh-on-use (bump last_used_at + roll expiry forward,
-// fire-and-forget). Returns null for missing/revoked/expired. Read fresh per
-// request, never cached (ADR 0016).
+// builder identity, and refresh-on-use (bump last_used_at, and roll expiry
+// forward for a row that has one, fire-and-forget). Returns null for
+// missing/revoked/expired; a row with expires_at NULL never expires. Read fresh
+// per request, never cached (ADR 0016).
 //
 // The governance FOLD (task 1002556): when the governance module is enabled, the
 // same round-trip also aggregates the builder's raw permission grant keys, so
@@ -335,11 +345,19 @@ async function lookupSession(token) {
   if (!row) return null;
   if (row.revoked_at) return null;
   if (row.expires_at && row.expires_at < new Date()) return null;
+  // Refresh-on-use. last_used_at always moves — the own-sessions list (ADR 0206)
+  // is how a person spots a session they don't recognise, and that reading is the
+  // whole remedy now that CLI rows never lapse. expires_at only rolls forward for
+  // a row that HAS one: the CASE is what stops a use from minting an expiry on a
+  // never-expires row and quietly reintroducing the timeout per ADR 0294.
   pool
     .query(
       `UPDATE builder_sessions
           SET last_used_at = now(),
-              expires_at   = now() + ($2::int * INTERVAL '1 millisecond')
+              expires_at   = CASE
+                               WHEN expires_at IS NULL THEN NULL
+                               ELSE now() + ($2::int * INTERVAL '1 millisecond')
+                             END
         WHERE id = $1`,
       [row.session_id, SESSION_TTL_MS]
     )