@bongos/core 1.20.39 → 1.20.40

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.39",
-  "core_contract": "1.20.39",
-  "source_commit": "5d6bec248ce87fac41937a1171ac6743ff471488",
+  "core_version": "1.20.40",
+  "core_contract": "1.20.40",
+  "source_commit": "b2b1ab60800736f857d25d84bf91ee5bd53153fb",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T00:27:49.636Z",
+  "built_at": "2026-10-01T00:37:27.302Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 564,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3274,
-  "tree_sha256": "ff380e8ab7ab557d485314ddacf18761ea6c419e7ad119f3537bbfb3d793dd58",
+  "tree_sha256": "c0d69a1151540d8702aca870e7ac26d1ed5e95c2b60eafed5a232c20fde50f71",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2222,7 +2222,7 @@
     {
       "path": "docs/adr/0349-a-version-preview-is-a-sandboxed-child-the-web-tier-launches.md",
       "mode": "0000644",
-      "sha256": "1c25e4c012e5321ffb2169e871fcbb2cea7bc823656959a6872a0af428674f3d"
+      "sha256": "7fe345d475d9540181d12544606c1c2cbfd5510e94c8fbf3599fc48d2790b3cb"
     },
     {
       "path": "docs/adr/0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md",
@@ -2812,7 +2812,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "086a0fac7811e72373874b93837f2920a3a8b1c0505dd58d301005cebd238569"
+      "sha256": "151589d412762bf79fe8fae3f48ae9ceb0a0052c0159860a1ed02a670101690c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6777,7 +6777,7 @@
     {
       "path": "modules/npm-release/preview/divert.js",
       "mode": "0000644",
-      "sha256": "f8b716868ff00ae1f14e38c4d2e8ddd32c660615b1c2b52a06d3b9b186c01825"
+      "sha256": "d7dd379f30685df8874102c40c4e68f1e7547ed85f2ec7bbaf3d98e0a7528bed"
     },
     {
       "path": "modules/npm-release/preview/env.js",
@@ -6787,7 +6787,7 @@
     {
       "path": "modules/npm-release/preview/proxy.js",
       "mode": "0000644",
-      "sha256": "6c8a352990ffc241ab83075b4cb8f216a8d03cdcd39d19e99cb1a4eb25b55778"
+      "sha256": "8b68575faf04ee2905b31a9b9e2e584723666d313612ab80be3a189ea10c6f0d"
     },
     {
       "path": "modules/npm-release/preview/runtime.js",
@@ -6817,7 +6817,7 @@
     {
       "path": "modules/npm-release/routes/preview.js",
       "mode": "0000644",
-      "sha256": "4bdc69fff014efe3c0a9535c2dbd25fc800fca723a097ee9992370a47c6bedfc"
+      "sha256": "bb2d1b5db4a13949d69177ad10bdd9d4a3e6ad77710317317e764358bc150551"
     },
     {
       "path": "modules/npm-release/routes/task-where.js",
@@ -9022,12 +9022,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e95ad9a27eb5f55ee344edbb3c5fc6280d6f58f1e6624f1a296a869439aa1cbf"
+      "sha256": "9f46a8f738d89eb715a930ddb554bf6b1bd3d027a0851e356aed3c4545354f43"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "994effd15c335b602139f038ec2a0daabe8fa2d196660a4d187ff513a0369065"
+      "sha256": "b504322a4ccdf13821f15b0c09de9c9c44383bdfa54457925772af80d80445c7"
     },
     {
       "path": "public-docs/index.html",
@@ -9047,7 +9047,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "ac05eeee55a8e591437c2b14ce073b89b4717077b0eb3a9fb73b017c732b3a29"
+      "sha256": "88bbf251ccd70e10dff2d818ed34eb8047ee80075856cde2da929f473ea03e89"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -11202,7 +11202,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "04dc5e05b911d167797ae2aeff9f250c978866d515fd95c74dc68569fa6309ce"
+      "sha256": "e3bc53481c5c7f502e3fb43c06d8ceadae02c0c57edb504aab696fff1e50af7d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14357,7 +14357,7 @@
     {
       "path": "tests/npm_release_preview_divert.mjs",
       "mode": "0000644",
-      "sha256": "be847731e116e9f5f15392668111596cbcbab74cae4f3da4ab92d780647cc9af"
+      "sha256": "154a7246124d65e9c0c487b9fd24b23d6786d2e9879cb9454ecdde50c618700d"
     },
     {
       "path": "tests/npm_release_preview_env.mjs",
@@ -14367,12 +14367,12 @@
     {
       "path": "tests/npm_release_preview_proxy.mjs",
       "mode": "0000644",
-      "sha256": "406a1183b9a799a79176191d510aa676558d569bcc6057f6164cb8857c56f4a3"
+      "sha256": "5aeb98a740acf5dc96ad456f72dfe7616a53a5a4c0ba306fa24764b5df299881"
     },
     {
       "path": "tests/npm_release_preview_routes.mjs",
       "mode": "0000644",
-      "sha256": "6e1e70a9917711a76e50f3b89d1f265fd0a169e5d0b3158f591e835cb74c2851"
+      "sha256": "187d0c93077dce3321c8063ccd04ea6033e46ee868e9530c9d6eaf5092b926a4"
     },
     {
       "path": "tests/npm_release_preview_supervisor.mjs",

package/docs/adr/0349-a-version-preview-is-a-sandboxed-child-the-web-tier-launches.md

@@ -96,6 +96,7 @@ What keeps that exception narrow:
   IPAddressDeny` is the follow-up and needs the droplet.
 - A preview started by the live process is stopped when that process exits, but the copy is
   dropped only by the next start or stop. It is one fixed name, so it cannot pile up.
+- **Correction, 2026-09-30 (task 1004466): the proxy strips every upstream `Set-Cookie`.** Same origin means a cookie the child set replaced the live hall's own (`cb_stealth`, the session) and locked the owner out of `/deploy`. The child's cookies now stay with the child; the steering cookie is the only one this module writes, and its clear repeats the set's Path, SameSite and Secure.
 
 ## Consequences
 

package/docs/module-api-changelog.md

@@ -2735,5 +2735,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.37 with no explicit bump. run 36794921587. (task 1002620)
   1.20.39 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.38 with no explicit bump. run 36796243918. (task 1002620)
+  1.20.40 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.39 with no explicit bump. run 36797045221. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/npm-release/preview/divert.js

@@ -44,9 +44,19 @@ function pathOf(req) {
   return q === -1 ? url : url.slice(0, q);
 }
 
-/** The Set-Cookie value that removes the steering cookie. */
-function clearCookie() {
-  return `${COOKIE_NAME}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax`;
+/** Path/HttpOnly/SameSite/Secure the steering cookie is set with; the clear repeats them. */
+function steerFlags(req) {
+  return `HttpOnly; SameSite=Lax${req && req.secure ? '; Secure' : ''}`;
+}
+
+/** The Set-Cookie value that sets the steering cookie. */
+function setCookie(version, req) {
+  return `${COOKIE_NAME}=${version}; Path=/; ${steerFlags(req)}`;
+}
+
+/** The Set-Cookie value that removes it: same Path, SameSite and Secure as the set (task 1004466). */
+function clearCookie(req) {
+  return `${COOKIE_NAME}=; Path=/; Max-Age=0; ${steerFlags(req)}`;
 }
 
 // Run an express-style gate to its verdict without letting it write a response of its own:
@@ -77,14 +87,14 @@ function createDivert({ supervisor, forward, requireBuilder, requirePermission }
     const st = supervisor.status();
     if (st.state !== 'running' || st.version !== wanted) {
       // The preview this cookie pointed at is gone: drop the cookie and serve the live hall.
-      res.append('Set-Cookie', clearCookie());
+      res.append('Set-Cookie', clearCookie(req));
       return next();
     }
     const p = pathOf(req);
     if (AUTH_PATH.test(p) || PREVIEW_PATH.test(p)) return next();
     if (req.headers.authorization) return next();
     if (!(await passes(requireBuilder, req)) || !(await passes(mayPreview, req))) {
-      res.append('Set-Cookie', clearCookie());
+      res.append('Set-Cookie', clearCookie(req));
       return next();
     }
     supervisor.touch();
@@ -92,4 +102,4 @@ function createDivert({ supervisor, forward, requireBuilder, requirePermission }
   };
 }
 
-module.exports = { createDivert, cookieVersion, clearCookie, AUTH_PATH, PREVIEW_PATH };
+module.exports = { createDivert, cookieVersion, clearCookie, setCookie, AUTH_PATH, PREVIEW_PATH };

package/modules/npm-release/preview/proxy.js

@@ -74,7 +74,10 @@ function createProxy({ port, banner, exitHref, httpImpl = http } = {}) {
       { host: '127.0.0.1', port: port(), method: req.method, path: req.originalUrl || req.url, headers },
       (upRes) => {
         const out = {};
-        for (const [k, v] of Object.entries(upRes.headers)) if (!HOP.has(k)) out[k] = v;
+        // SET-COOKIE NEVER CROSSES (task 1004466). The preview shares the live hall's origin,
+        // so a cookie it set would overwrite the live hall's own (cb_stealth, the session,
+        // the steering cookie) and lock its owner out. Its cookies stay with the child.
+        for (const [k, v] of Object.entries(upRes.headers)) if (!HOP.has(k) && k.toLowerCase() !== 'set-cookie') out[k] = v;
         const isPage = /^text\/html\b/i.test(String(upRes.headers['content-type'] || ''));
         if (!isPage) {
           res.writeHead(upRes.statusCode, out);

package/modules/npm-release/routes/preview.js

@@ -20,8 +20,8 @@
 
 const express = require('express');
 const api = require('../../../src/module-api');
-const { createDivert, clearCookie } = require('../preview/divert');
-const { createProxy, COOKIE_NAME } = require('../preview/proxy');
+const { createDivert, clearCookie, setCookie } = require('../preview/divert');
+const { createProxy } = require('../preview/proxy');
 const { previewable } = require('../preview/supervisor');
 const { VERSION_RE, PACKAGE } = require('../preview/commands');
 
@@ -119,14 +119,15 @@ module.exports = function buildNpmReleasePreviewRouter({
     if (!VERSION_RE.test(v) || st.state !== 'running' || st.version !== v) {
       return failure(res, 409, 'preview_not_running', 'That preview is not running.');
     }
-    const secure = req.secure ? '; Secure' : '';
-    res.append('Set-Cookie', `${COOKIE_NAME}=${v}; Path=/; HttpOnly; SameSite=Lax${secure}`);
+    res.append('Set-Cookie', setCookie(v, req));
+    res.set('Cache-Control', 'no-store');
     sup.touch();
     return res.redirect(302, '/');
   });
 
   router.get('/npm-release/preview/exit', api.requireBuilder, mayPreview, (req, res) => {
-    res.append('Set-Cookie', clearCookie());
+    res.append('Set-Cookie', clearCookie(req));
+    res.set('Cache-Control', 'no-store');
     res.redirect(302, '/deploy');
   });
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.39",
+  "version": "1.20.40",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.39",
+      "version": "1.20.40",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.39",
+  "version": "1.20.40",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8343,5 +8343,11 @@
       "id": "1004464",
       "text": "Setting up an app on Render from the project wizard no longer fails when the owner leaves the build command empty. The box now comes filled in with Render's usual build command for the chosen language, which the owner can chan"
     }
+  ],
+  "1.20.40": [
+    {
+      "id": "1004466",
+      "text": "Stop the version preview from overwriting the live hall's cookies, and make leaving a preview reliably clear it."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.39'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.40'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/npm_release_preview_divert.mjs

@@ -159,6 +159,16 @@ test('a cookie for a preview that is not running is dropped and the live hall an
   }
 });
 
+test('the clearing cookie repeats the set attributes, Secure included (task 1004466)', () => {
+  const { setCookie } = require('../modules/npm-release/preview/divert.js');
+  for (const secure of [false, true]) {
+    const req = { secure };
+    const attrs = (c) => c.split('; ').slice(1).filter((a) => !/^Max-Age=/.test(a)).join('; ');
+    assert.equal(attrs(clearCookie(req)), attrs(setCookie('1.19.1000', req)), 'secure=' + secure);
+    assert.equal(/; Secure$/.test(clearCookie(req)), secure);
+  }
+});
+
 test('the clearing cookie expires the steering cookie for the whole site', () => {
   assert.match(clearCookie(), /^bongos_preview=; Path=\/; Max-Age=0/);
 });

package/tests/npm_release_preview_proxy.mjs

@@ -137,6 +137,32 @@ test('JSON and other non-page answers pass through untouched, headers included',
   assert.doesNotMatch(res.text, /banner/);
 });
 
+test('a Set-Cookie from the preview never reaches the browser (it would overwrite the live hall cookies), task 1004466', async () => {
+  const cookies = ['cb_stealth=child; Path=/', '__Host-sid=child; Path=/; Secure', 'bongos_preview=; Max-Age=0'];
+  for (const [type, body] of [['application/json', '{}'], ['text/html; charset=utf-8', '<html><body>x</body></html>']]) {
+    const http = fakeHttp(() => ({ headers: { 'content-type': type, 'set-cookie': cookies, 'x-keep': 'yes' }, body }));
+    const res = new FakeRes();
+    make(http)(request(), res);
+    await finish(res);
+    assert.equal(Object.keys(res.headers).filter((k) => k.toLowerCase() === 'set-cookie').length, 0, type);
+    assert.equal(res.headers['x-keep'], 'yes', 'other headers still pass');
+  }
+});
+
+test('a streamed answer with a Set-Cookie is still streamed, cookie dropped', async () => {
+  const stream = new PassThrough();
+  const http = fakeHttp(() => ({ headers: { 'content-type': 'text/event-stream', 'set-cookie': 'cb_stealth=child' }, stream }));
+  const res = new FakeRes();
+  make(http)(request(), res);
+  await tick();
+  stream.write('data: one\n\n');
+  await tick();
+  assert.equal(res.headers['set-cookie'], undefined);
+  assert.equal(res.text, 'data: one\n\n');
+  stream.end();
+  await finish(res);
+});
+
 test('an event stream is streamed, not held: the first chunk arrives before the stream ends', async () => {
   const stream = new PassThrough();
   const http = fakeHttp(() => ({ headers: { 'content-type': 'text/event-stream' }, stream }));

package/tests/npm_release_preview_routes.mjs

@@ -52,6 +52,7 @@ let base;
 before(async () => {
   state = { state: 'idle', version: null };
   const app = express();
+  app.set('trust proxy', true);
   app.use(express.json());
   app.use('/api/bongos', buildRouter({ supervisor, listPublished: async () => registry, runningVersion: () => '1.19.1040' }));
   server = http.createServer(app);
@@ -60,10 +61,10 @@ before(async () => {
 });
 after(() => new Promise((r) => server.close(r)));
 
-function call(method, url, { cookie = 'sid=good', body } = {}) {
+function call(method, url, { cookie = 'sid=good', body, extra } = {}) {
   return new Promise((resolve, reject) => {
     const data = body === undefined ? null : JSON.stringify(body);
-    const headers = { host: 'builders.example.test' };
+    const headers = { host: 'builders.example.test', ...(extra || {}) };
     if (cookie) headers.cookie = cookie;
     if (data) { headers['content-type'] = 'application/json'; headers['content-length'] = Buffer.byteLength(data); }
     const r = http.request({ host: '127.0.0.1', port: base, path: '/api/bongos' + url, method, headers }, (res) => {
@@ -178,6 +179,18 @@ test('enter sets the steering cookie for the running version and goes to the hal
   assert.match(c, /^bongos_preview=1\.19\.1030; Path=\/; HttpOnly; SameSite=Lax/);
 });
 
+test('exit clears with the same attributes enter set, Secure included, and is not cached (task 1004466)', async () => {
+  state = { state: 'running', version: '1.19.1030' };
+  for (const extra of [undefined, { 'x-forwarded-proto': 'https' }]) {
+    const e = await call('GET', '/npm-release/preview/enter?v=1.19.1030', { extra });
+    const x = await call('GET', '/npm-release/preview/exit', { extra });
+    const attrs = (r) => [].concat(r.headers['set-cookie'])[0].split('; ').slice(1).filter((a) => !/^Max-Age=/.test(a)).join('; ');
+    assert.equal(attrs(x), attrs(e));
+    assert.equal(/Secure/.test(attrs(x)), Boolean(extra));
+    assert.equal(x.headers['cache-control'], 'no-store');
+  }
+});
+
 test('enter refuses a preview that is not the one running, and sets no cookie', async () => {
   for (const [st, v] of [[{ state: 'idle', version: null }, '1.19.1030'], [{ state: 'starting', version: '1.19.1030' }, '1.19.1030'], [{ state: 'running', version: '1.19.1031' }, '1.19.1030'], [{ state: 'running', version: '1.19.1030' }, 'zzz']]) {
     state = st;