@bongos/core 1.19.836 → 1.19.838

package/modules/discord/module.json

@@ -11,7 +11,7 @@
     "pollers": ["discord-bot"],
     "uiSections": []
   },
-  "provides": ["discord.isLinked"],
+  "provides": ["discord.isLinked", "discord.post", "discord.hasChannel"],
   "consumes": ["ideas.capture", "government", "lifecycle"],
   "dependencies": { "discord.js": "^14.26.4" }
 }

package/modules/discord/routes/discord.js

@@ -22,6 +22,7 @@ const db = require('../db');
 const shipBroadcast = require('../ship-broadcast');
 const boardBroadcast = require('../board-broadcast');
 const roleSync = require('../discord-role-sync');
+const webhook = require('../webhook');
 
 // The module's kernel seams, registered when this factory runs (the loader runs
 // it at boot, already gated to enabled instances — ADR 0083 / BV1.R47). They are
@@ -60,6 +61,30 @@ function registerSeams() {
       return { guildId, roleIds: roleId ? [roleId] : [] };
     });
   }
+  // `discord.post` — the GENERIC outbound line (task 1002494). Until now every
+  // post this module makes was driven by a listener on an event it already knew
+  // about, so a module with something to say and no event of its own — the
+  // agents event-router, whose findings declare a `discord` sink — had nothing
+  // to deliver to, and could not require a sibling module to get one (ADR 0083).
+  //
+  // THE CALLER NAMES A CHANNEL KEY, NEVER A URL. `webhook.js` owns the
+  // key→webhook allowlist and throws on an unknown key, so this port cannot be
+  // used to post anywhere the operator has not configured — and `hasWebhook`
+  // lets a caller check that BEFORE doing expensive work it would then throw
+  // away. Still outbound only (ADR 0033 §8): nothing here reads from Discord,
+  // and nothing posted through it carries authority.
+  if (!api.hasProvider('discord.post')) {
+    api.registerProvider('discord.post', async ({ channel, text } = {}) => {
+      if (!webhook.hasWebhook(channel)) {
+        return { posted: false, reason: 'no_webhook_for_channel', channel: channel || null };
+      }
+      await webhook.postWebhook(channel, String(text == null ? '' : text));
+      return { posted: true, channel };
+    });
+  }
+  if (!api.hasProvider('discord.hasChannel')) {
+    api.registerProvider('discord.hasChannel', (channel) => webhook.hasWebhook(channel));
+  }
   if (_shipListenerOff) _shipListenerOff();
   _shipListenerOff = api.on('task.shipped', (task) => shipBroadcast.postShipBroadcast(task));
   if (_strandListenerOff) _strandListenerOff();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.836",
+  "version": "1.19.838",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.836",
+      "version": "1.19.838",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.836",
+  "version": "1.19.838",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box.js

@@ -54,6 +54,8 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // INSTANCE root, riding ADR 0108's resolvers, instead of assuming it sits beside
 // box.js. ADR 0150 (BV1.R97/R98).
 const instanceConfig = require(path.join(REPO_ROOT, 'src/instance-config'));
+const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
+const { coreVersionSafe } = require('./provision-config.js');
 const BOX_INFRA_TEMPLATE = 'builder-box-cloud-init.yaml';
 
 // Ordered candidate infra/ dirs — first that actually holds the cloud-init
@@ -1120,6 +1122,8 @@ async function cmdReconcileDrift(pool, boxes, { apply }) {
 const MAX_INTENT_ATTEMPTS = numEnv('BOX_INTENT_MAX_ATTEMPTS', 3);
 
 async function cmdRunIntents(pool, boxes, boxOnboard, { apply }) {
+  const instanceRoot = process.env.BONGOS_INSTANCE_ROOT || process.cwd();
+  console.log(runnerBanner({ runnerVersion: coreVersionSafe(), runnerRoot: REPO_ROOT, instanceVersion: installedCoreVersion(instanceRoot), instanceRoot }));
   if (!apply) {
     const { rows } = await pool.query(
       `SELECT bi.*, b.github_login FROM box_intents bi
@@ -1325,4 +1329,4 @@ async function main() {
 
 if (require.main === module) main();
 
-module.exports = { cmdProvision, deprovisionOne, parkOne, cmdSweepIdle, cmdSweepDormant, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed, resolveBoxInfraDir, boxInfraCandidates, readCloudInit, buildBoxEnv, BOX_INFRA_TEMPLATE };
+module.exports = { cmdProvision, cmdRunIntents, deprovisionOne, parkOne, cmdSweepIdle, cmdSweepDormant, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed, resolveBoxInfraDir, boxInfraCandidates, readCloudInit, buildBoxEnv, BOX_INFRA_TEMPLATE };

package/scripts/gds/doctor.js

@@ -375,12 +375,38 @@ function checkDeployTooling() {
   }
 }
 
+// Intent-runner drift (task 1002722): a runner on a stale core once turned a domain-attach
+// into a teardown (task 1002716). Only a host with *intent-runner* units shows this section,
+// so a builder laptop or dev box sees nothing.
+function runnerDriftRows(results) {
+  return (results || []).map((r) => {
+    const msg = `${r.name}: ${r.reason}`;
+    if (r.status === 'ok') return { status: 'ok', msg };
+    if (r.status === 'drift') return { status: 'fail', msg: `${msg} — repoint the unit's WorkingDirectory + ExecStart at the installed core (a systemd drop-in, as task 1002716 did).` };
+    return { status: 'warn', msg };
+  });
+}
+
+function checkRunnerDrift() {
+  let rows = [];
+  try {
+    const { collectRunnerDrift } = require('./runner-drift.js');
+    rows = runnerDriftRows(collectRunnerDrift({ instanceRoot: process.env.BONGOS_INSTANCE_ROOT || process.cwd() }));
+  } catch (_) {
+    return;
+  }
+  if (!rows.length) return;
+  section('Intent runners');
+  const emit = { ok, warn, fail };
+  for (const row of rows) emit[row.status]('runners', row.msg);
+}
+
 // --------------------------------------------------------------------------
 // main
 // --------------------------------------------------------------------------
 // Guarded so requiring this file for its pure helpers (tests/doctor_hooks.mjs)
 // does not run the checks, which shell out to git and hit the network.
-module.exports = { classifyHooksState };
+module.exports = { classifyHooksState, runnerDriftRows };
 
 if (require.main === module) (async () => {
   console.log(`${C.bold}GDS Doctor${C.reset} — local-machine health check`);
@@ -390,6 +416,7 @@ if (require.main === module) (async () => {
   checkGitPlumbing();
   await checkRepoState();
   checkEnvironment();
+  checkRunnerDrift();
 
   const fails = findings.filter((f) => f.status === 'fail').length;
   const warns = findings.filter((f) => f.status === 'warn').length;

package/scripts/gds/plain-cards.js

@@ -333,6 +333,8 @@ function cardFor(code) {
 // AGENT SURFACE ONLY: a card is written in the agent's voice ("I will…") for a
 // session to relay. A person running the `bongos` CLI reads the text above it directly,
 // and several cards name slash commands that do not exist there (tests/cli_surface.mjs).
+// The labels below are READ BACK by .claude/hooks/stuck-detector.js as its failure
+// signature (task 1003990); tests/stuck_detector.mjs reds if they drift.
 function plainCardLines(code, env = process.env) {
   const c = isTerminal(env) ? null : cardFor(code);
   if (!c) return [];

package/scripts/gds/provision.js

@@ -54,6 +54,7 @@ const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbN
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
+const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
 const { teardownInstance } = require('./provision-teardown.js');
 const { disconnectInstance } = require('./provision-disconnect.js');
 const { coreUpgradeInstance, snapshotAllCoreVersions } = require('./provision-core-upgrade.js'); // the owner's deploy door, ADR 0293
@@ -1221,6 +1222,8 @@ async function drainOAuthManifests(deps) {
 // ---------------------------------------------------------------------------
 async function cmdRunIntents(deps) {
   const { db, provisioning, log, apply } = deps;
+  const instanceRoot = deps.instanceRoot || process.env.BONGOS_INSTANCE_ROOT || process.cwd();
+  log(runnerBanner({ runnerVersion: coreVersionSafe(), runnerRoot: REPO_ROOT, instanceVersion: installedCoreVersion(instanceRoot), instanceRoot }));
   if (!apply) {
     const { rows } = await db.query(
       `SELECT pi.*, i.slug FROM provisioning_intents pi
@@ -1254,7 +1257,7 @@ async function cmdRunIntents(deps) {
       else if (intent.action === 'restart') result = await restartInstance(inst, deps);
       else if (intent.action === 'disconnect') result = await disconnectInstance(inst, deps);
       else if (intent.action === 'core-upgrade') result = await coreUpgradeInstance(inst, deps, intent); // also reads the INTENT: the version the owner previewed (ADR 0293 D4)
-      else result = { ok: false, error: `unknown intent action '${intent.action}' — refusing to guess` };
+      else result = { ok: false, error: `unknown_action '${intent.action}' — runner core ${coreVersionSafe() || '?'} does not know it (runner too old?); refusing to guess` };
       if (result && result.ok === false) {
         if (intent.attempts >= MAX_INTENT_ATTEMPTS) {
           await provisioning.resolveIntent(db, intent.id, 'error', result.error || 'op failed');

package/scripts/gds/runner-drift.js

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+// scripts/gds/runner-drift.js — do the intent-runner units run the core this instance installed? (task 1002722)
+//
+// WHY. For weeks the prod intent runners ran core 1.19.2 from a retired clone while the
+// instance served a current core, so an owner's domain-attach click executed as a TEARDOWN
+// (task 1002716). The hotfix repointed the units with systemd drop-ins; nothing noticed the
+// drift, and the only tell was a PWD in sudo logs. This reads each `*intent-runner*` unit the
+// way systemd does (a drop-in overrides the base file), finds the core package the ExecStart
+// script lives in, and compares its version to the instance's installed @bongos/core.
+//
+// A unit whose version cannot be read — a shell wrapper that picks the core at runtime, a
+// missing package — is UNRESOLVED, never ok: a gate that guesses green is the incident again.
+//
+//   node scripts/gds/runner-drift.js [--instance-root <dir>] [--json]
+//     exit 0 = every unit resolved and matched (or no systemd here), 1 = drift, 2 = bad usage.
+//     Unresolved units are listed but do not fail the run. `bongos doctor` runs the same check.
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const CORE_NAMES = ['@bongos/core', '@cloudbongos/core'];
+const P = path.posix;   // unit files describe the Linux control plane, whatever runs the tests
+
+// The effective WorkingDirectory + ExecStart lines from `systemctl cat` output. Later files
+// are drop-ins: a later WorkingDirectory wins, an empty `ExecStart=` clears the list, and a
+// drop-in that only ADDS one leaves the base command running too (oneshot runs them all).
+function effectiveUnit(catText) {
+  let workingDirectory = null;
+  let execs = [];
+  for (const raw of String(catText || '').split(/\r?\n/)) {
+    const line = raw.trim();
+    const m = line.match(/^(WorkingDirectory|ExecStart)=(.*)$/);
+    if (!m) continue;
+    const value = m[2].trim();
+    if (m[1] === 'WorkingDirectory') workingDirectory = value.replace(/^-/, '') || null;
+    else if (value === '') execs = [];
+    else execs.push(value);
+  }
+  return { workingDirectory, execStarts: execs };
+}
+
+// The absolute path of the .js script an ExecStart runs, or null when its first argument is
+// not one (a shell wrapper decides at runtime which core it loads).
+function runnerScriptPath({ workingDirectory, execStart }) {
+  const tokens = String(execStart || '').trim().split(/\s+/).filter(Boolean);
+  if (!tokens.length) return null;
+  let i = 0;
+  if (P.basename(tokens[i].replace(/^[@\-:+!]+/, '')) === 'env') {
+    i++;
+    while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) i++;
+  }
+  const script = tokens.slice(i + 1).find((tok) => !tok.startsWith('-'));
+  if (!script || !/\.[cm]?js$/.test(script)) return null;
+  if (script.startsWith('/')) return script;
+  return workingDirectory ? P.join(workingDirectory, script) : null;
+}
+
+function readJson(p, fsImpl) {
+  try { return JSON.parse(fsImpl.readFileSync(p, 'utf8')); } catch { return null; }
+}
+
+// The core version a script belongs to: the nearest enclosing @bongos/core package, or a
+// source checkout's CORE_VERSION. Null when neither is found.
+function coreVersionFor(scriptPath, { fsImpl = fs } = {}) {
+  let dir = P.dirname(String(scriptPath || ''));
+  for (;;) {
+    const pkg = readJson(P.join(dir, 'package.json'), fsImpl);
+    if (pkg && CORE_NAMES.includes(pkg.name) && pkg.version) return String(pkg.version);
+    try {
+      const m = String(fsImpl.readFileSync(P.join(dir, 'src', 'module-api.js'), 'utf8')).match(/CORE_VERSION\s*=\s*['"]([^'"]+)['"]/);
+      if (m) return m[1];
+    } catch { /* not a checkout root */ }
+    const up = P.dirname(dir);
+    if (up === dir) return null;
+    dir = up;
+  }
+}
+
+function installedCoreVersion(instanceRoot, { fsImpl = fs } = {}) {
+  if (!instanceRoot) return null;
+  for (const name of CORE_NAMES) {
+    const pkg = readJson(P.join(instanceRoot, 'node_modules', name, 'package.json'), fsImpl);
+    if (pkg && pkg.version) return String(pkg.version);
+  }
+  return null;
+}
+
+function assessExecStart({ workingDirectory, execStart, instanceVersion, instanceRoot, fsImpl }) {
+  const scriptPath = runnerScriptPath({ workingDirectory, execStart });
+  const base = { scriptPath, runnerVersion: null, instanceVersion };
+  if (!scriptPath) return { ...base, status: 'unresolved', reason: `ExecStart does not run a .js script directly (${execStart}) — cannot tell which core it loads` };
+  const runnerVersion = coreVersionFor(scriptPath, { fsImpl });
+  const found = { ...base, runnerVersion };
+  if (!runnerVersion) return { ...found, status: 'unresolved', reason: `no core version found above ${scriptPath}` };
+  if (!instanceVersion) return { ...found, status: 'unresolved', reason: `no installed @bongos/core under ${instanceRoot}` };
+  if (runnerVersion === instanceVersion) return { ...found, status: 'ok', reason: `runs core ${runnerVersion}` };
+  return { ...found, status: 'drift', reason: `runs core ${runnerVersion} (${scriptPath}) but the instance installed ${instanceVersion} at ${instanceRoot}` };
+}
+
+// One verdict per unit, from its WORST ExecStart: drift, then unresolved, then ok.
+function assessRunnerUnit({ name, catText, instanceRoot, fsImpl = fs }) {
+  const { workingDirectory, execStarts } = effectiveUnit(catText);
+  const instanceVersion = installedCoreVersion(instanceRoot, { fsImpl });
+  if (!execStarts.length) return { name, status: 'unresolved', reason: 'no ExecStart in the unit', scriptPath: null, runnerVersion: null, instanceVersion };
+  const all = execStarts.map((execStart) => assessExecStart({ workingDirectory, execStart, instanceVersion, instanceRoot, fsImpl }));
+  const worst = ['drift', 'unresolved', 'ok'].map((s) => all.find((r) => r.status === s)).find(Boolean);
+  return { name, ...worst };
+}
+
+function parseUnitList(stdout) {
+  return String(stdout || '').split(/\r?\n/).map((l) => l.trim().split(/\s+/)[0]).filter((n) => n && n.endsWith('.service'));
+}
+
+// The first line of every run-intents, so a journal grep shows a stale runner at once.
+function runnerBanner({ runnerVersion, runnerRoot, instanceVersion, instanceRoot }) {
+  const tail = instanceVersion ? `instance core ${instanceVersion} at ${instanceRoot}` : `no installed core at ${instanceRoot}`;
+  const line = `runner core ${runnerVersion || '?'} from ${runnerRoot} (${tail})`;
+  return runnerVersion && instanceVersion && runnerVersion !== instanceVersion ? `⚠ DRIFT: ${line}` : line;
+}
+
+// Every intent-runner unit on this host, assessed. Null when there is no systemd to ask.
+function collectRunnerDrift({ instanceRoot }) {
+  const run = (args) => spawnSync('systemctl', args, { encoding: 'utf8', timeout: 15000 });
+  const list = run(['list-units', '--all', '--plain', '--no-legend', '--no-pager', '--type=service', '*intent-runner*']);
+  if (list.error || list.status !== 0) return null;
+  return parseUnitList(list.stdout).map((name) => {
+    const cat = run(['cat', '--no-pager', name]);
+    return assessRunnerUnit({ name, catText: cat.status === 0 ? cat.stdout : '', instanceRoot });
+  });
+}
+
+function main(argv) {
+  const at = argv.indexOf('--instance-root');
+  const instanceRoot = (at >= 0 ? argv[at + 1] : null) || process.env.BONGOS_INSTANCE_ROOT;
+  if (!instanceRoot) {
+    console.error('runner-drift: name the instance root — --instance-root <dir> or BONGOS_INSTANCE_ROOT');
+    return 2;
+  }
+  const results = collectRunnerDrift({ instanceRoot });
+  if (argv.includes('--json')) console.log(JSON.stringify({ instanceRoot, systemd: results !== null, units: results || [] }, null, 2));
+  else if (results === null) console.log('runner-drift: no systemd on this host — nothing to check');
+  else if (!results.length) console.log('runner-drift: no *intent-runner* units on this host');
+  else for (const r of results) console.log(`${r.status === 'ok' ? '✓' : r.status === 'drift' ? '✖' : '?'} ${r.name}: ${r.reason}`);
+  return results && results.some((r) => r.status === 'drift') ? 1 : 0;
+}
+
+module.exports = { effectiveUnit, runnerScriptPath, coreVersionFor, installedCoreVersion, assessRunnerUnit, parseUnitList, runnerBanner, collectRunnerDrift };
+
+if (require.main === module) process.exitCode = main(process.argv.slice(2));

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.836'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.838'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');