@bongos/core 1.20.60 → 1.20.62

package/modules/public-landing/public/projects.states.json

@@ -39,7 +39,8 @@
     "in-new": { "auth": true, "url": "/projects?view=new", "expect": { "visible": ["#panel-terms", "#termsAck"], "hidden": ["#qWrap", "#view-new .steps", "#panel-name"] } },
     "in-new-terms-refused": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["click","#panel-terms button[type=submit]"],["wait",300]], "expect": {"visible":["#panel-terms","#h-terms"],"hidden":["#panel-fork"],"text":[["#h-terms","Tick the box to go on. It’s how your project records that you acknowledged the terms."]]} },
     "in-new-fork": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["click","#termsAck"],["click","#panel-terms button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-fork",".doorPill","#wizDemo",".forkStage",".forkRoutes"],"hidden":["#panel-terms","#view-new .steps","#demoSoon",".bongoCell"]} },
-    "in-new-fork-demo": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["click","#termsAck"],["click","#panel-terms button[type=submit]"],["wait",400],["click","#wizDemo"],["wait",200]], "expect": {"visible":["#panel-fork","#demoSoon"],"attr":[["#wizDemo","aria-expanded","true"]]} },
+    "in-new-fork-demo": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["click","#termsAck"],["click","#panel-terms button[type=submit]"],["wait",400],["click","#wizDemo"],["wait",300]], "expect": {"visible":["#panel-fork","#demoSetup","#demoFitVerdict","#demoRing"],"hidden":["#forkIntro","#demoReady"],"attr":[["#wizDemo","aria-expanded","true"]]} },
+    "in-new-demo-ready": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["click","#termsAck"],["click","#panel-terms button[type=submit]"],["wait",400],["click","#wizDemo"],["wait",300],["click","[data-demo-step=\"hours\"][data-by=\"1\"]"],["click","#demoNext1"],["wait",300]], "expect": {"visible":["#demoReady",".demoLedger","#demoInvite1","#demoInvite2"],"hidden":["#demoSetup","#forkIntro"],"text":[["#demoLHours","5 hours each"]]} },
     "in-new-name": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["click","#termsAck"],["click","#panel-terms button[type=submit]"],["wait",400],["click","#panel-fork button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-name","#newName","#view-new .steps"],"hidden":["#panel-fork","#panel-terms"]} },
     "out-new": { "auth": false, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },
     "in-new-type": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["click","#termsAck"],["click","#panel-terms button[type=submit]"],["wait",400],["click","#panel-fork button[type=submit]"],["wait",400],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-type"],"hidden":["#panel-name","#qWrap"]} },

package/modules/ui-design/kit/fixtures/provisioning-instances-demo.json

@@ -0,0 +1,114 @@
+{
+  "_": "The demo route (task 1004420): provisioning-instances.json with project 101 marked as a demo whose time box has run out, so its page asks keep-your-planet. Only projects-demo.states.json points at this.",
+  "instances": [
+    {
+      "id": 101,
+      "slug": "demo",
+      "status": "active",
+      "domain": "demo.cloudbongos.com",
+      "target_ref": "builder/demo",
+      "hosting_shape": "co-tenant",
+      "onboard_mode": "scaffold",
+      "created_at": "2026-08-01T10:00:00.000Z",
+      "provisioned_at": "2026-08-01T10:20:00.000Z",
+      "updated_at": "$now-3m",
+      "last_verified_at": "$now-3m",
+      "last_verified_up": true,
+      "error_note": null,
+      "dns_note": null,
+      "torn_down_at": null,
+      "open_intent": null,
+      "demo": {
+        "people": 3,
+        "hours_each": 4,
+        "builder_hours": 12,
+        "started_at": "2026-09-28T09:00:00Z",
+        "ends_at": "2026-09-28T13:00:00Z",
+        "remaining_seconds": 0,
+        "time_up": true,
+        "outcome": null,
+        "offline_on": "2026-10-28T09:00:00.000Z",
+        "offline_soon": false
+      }
+    },
+    {
+      "id": 102,
+      "slug": "harbor",
+      "status": "provisioning",
+      "planet_template": "blob-frost-tint",
+      "planet_accent": "sun-lit",
+      "domain": null,
+      "target_ref": "builder/harbor",
+      "hosting_shape": "cloud-host",
+      "owner_monthly_usd": null,
+      "onboard_mode": "scaffold",
+      "created_at": "$now-6m",
+      "provisioned_at": null,
+      "updated_at": "$now-2m",
+      "last_verified_at": null,
+      "last_verified_up": null,
+      "error_note": null,
+      "dns_note": null,
+      "torn_down_at": null,
+      "open_intent": {
+        "action": "standup",
+        "state": "running",
+        "created_at": "$now-6m"
+      }
+    },
+    {
+      "id": 103,
+      "slug": "tidepool",
+      "status": "error",
+      "domain": "tidepool.cloudbongos.com",
+      "target_ref": "builder/tidepool",
+      "hosting_shape": "co-tenant",
+      "onboard_mode": "adopt",
+      "created_at": "2026-08-20T09:00:00.000Z",
+      "provisioned_at": null,
+      "updated_at": "$now-1d",
+      "last_verified_at": null,
+      "last_verified_up": null,
+      "error_note": "The deploy could not read the repository: it is private, and the deploy key only reads public ones.",
+      "dns_note": null,
+      "torn_down_at": null,
+      "open_intent": null
+    },
+    {
+      "id": 104,
+      "slug": "old-lantern",
+      "status": "torn_down",
+      "domain": "old-lantern.cloudbongos.com",
+      "target_ref": "builder/old-lantern",
+      "hosting_shape": "co-tenant",
+      "onboard_mode": "scaffold",
+      "created_at": "2026-07-02T09:00:00.000Z",
+      "provisioned_at": "2026-07-02T09:30:00.000Z",
+      "updated_at": "2026-08-15T12:00:00.000Z",
+      "last_verified_at": "2026-08-15T11:50:00.000Z",
+      "last_verified_up": true,
+      "error_note": null,
+      "dns_note": null,
+      "torn_down_at": "2026-08-15T12:00:00.000Z",
+      "open_intent": null
+    },
+    {
+      "id": 105,
+      "slug": "mooring",
+      "status": "active",
+      "domain": "mooring.cloudbongos.com",
+      "target_ref": "builder/mooring",
+      "hosting_shape": "co-tenant",
+      "onboard_mode": "scaffold",
+      "created_at": "2026-08-10T09:00:00.000Z",
+      "provisioned_at": "2026-08-10T09:20:00.000Z",
+      "updated_at": "$now-20m",
+      "last_verified_at": "$now-20m",
+      "last_verified_up": false,
+      "error_note": null,
+      "dns_note": null,
+      "torn_down_at": null,
+      "open_intent": null
+    }
+  ]
+}

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.60",
+  "version": "1.20.62",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.60",
+      "version": "1.20.62",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.60",
+  "version": "1.20.62",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8477,5 +8477,25 @@
       "id": "1004421",
       "text": "Every project can now have its own look, so builders who work in several projects always know which hall they are in. Creating a project has a new Look step: four ready-made looks or your own colour, a switch to tint dark mode"
     }
+  ],
+  "1.20.61": [
+    {
+      "id": "1004407",
+      "text": "The Gate page now shows, for each Autobongos runner, which PC it is on, which Claude account it is spending, which code version it runs (and whether that is behind), and says \"Restarting\" while it relaunches for new code inste"
+    }
+  ],
+  "1.20.62": [
+    {
+      "id": "1004047",
+      "text": "Every live project now runs a version whose update banner works, so each owner sees when an update is waiting."
+    },
+    {
+      "id": "1004420",
+      "text": "\"Try the demo\" now works. A small team picks how many people and how many hours each, writes an idea, and gets a first read of what fits. The demo picks the settings for them (the founder decides, no rewards, all managed, priv"
+    },
+    {
+      "id": "1004307",
+      "text": "The automatic update on cloudbongos.com will now always run the newest version of itself, instead of a copy stuck from August."
+    }
   ]
 }

package/scripts/gds/autobongos-run.js

@@ -368,7 +368,7 @@ const MAX_CLAIM_ATTEMPTS = 5;
 const LIMIT_UNKNOWN_RESET_MS = 30 * 60 * 1000;
 
 function newRunnerState() {
-  return { setAside: new Map(), queueGate: null, limitUntil: null, diskHead: null };
+  return { setAside: new Map(), queueGate: null, limitUntil: null, diskHead: null, mainHead: null };
 }
 const RUNNER_STATE = newRunnerState();
 
@@ -703,6 +703,43 @@ function writeHeartbeat(now = Date.now(), runnerState = RUNNER_STATE) {
 // is the signal.
 const RUNNER_STARTED_AT = new Date().toISOString();
 
+// claudeAccountLabel — WHICH Claude account this machine's workers spend
+// (task 1004407), as a label and never a secret. Workers inherit
+// ANTHROPIC_API_KEY and CLAUDE_CODE_OAUTH_TOKEN from this process
+// (WORKER_ENV_ALLOW), and either one outranks the stored login, so those are
+// named first, by the variable that is set and never by its value. Otherwise it
+// is the login Claude Code itself records in ~/.claude.json (oauthAccount): the
+// email, plus the organisation when it has one. Read on every beat, so signing
+// a different account in shows up without a restart; null when nothing can be
+// read, which the card leaves blank rather than guessing.
+function claudeAccountLabel({ env = process.env, readFile = (p) => fs.readFileSync(p, 'utf8') } = {}) {
+  if (env.ANTHROPIC_API_KEY) return 'an API key (ANTHROPIC_API_KEY)';
+  if (env.CLAUDE_CODE_OAUTH_TOKEN) return 'a Claude token (CLAUDE_CODE_OAUTH_TOKEN)';
+  try {
+    const dir = env.CLAUDE_CONFIG_DIR || os.homedir();
+    const acct = JSON.parse(readFile(path.join(dir, '.claude.json'))).oauthAccount || {};
+    const email = typeof acct.emailAddress === 'string' ? acct.emailAddress.trim() : '';
+    if (!email) return null;
+    const org = typeof acct.organizationName === 'string' ? acct.organizationName.trim() : '';
+    return (org ? `${email} · ${org}` : email).slice(0, 200);
+  } catch (_) { return null; }
+}
+
+// heartbeatIdentity — the fields that say which code and which account (task
+// 1004407). Undefined fields are dropped, so a runner that cannot read its own
+// commit sends nothing for it rather than an empty string the route would refuse.
+function heartbeatIdentity(deps = {}) {
+  const st = deps.state || RUNNER_STATE;
+  const out = {
+    head: LOADED_HEAD || undefined,
+    disk_head: st.diskHead && st.diskHead !== LOADED_HEAD ? st.diskHead : undefined,
+    main_head: st.mainHead || undefined,
+    claude_account: (deps.claudeAccountLabel || claudeAccountLabel)() || undefined,
+  };
+  for (const k of Object.keys(out)) if (out[k] === undefined) delete out[k];
+  return out;
+}
+
 async function postHeartbeat(fields = {}, deps = {}) {
   try {
     const api = deps.api || await (require('./cli-lib').cliClient)();
@@ -711,6 +748,7 @@ async function postHeartbeat(fields = {}, deps = {}) {
         host: os.hostname(),
         pid: process.pid,
         started_at: RUNNER_STARTED_AT,
+        ...heartbeatIdentity(deps),
         ...fields,
       },
     });
@@ -870,6 +908,9 @@ async function codeDrifted(deps = {}) {
   let tip = null;
   try { tip = await runFetchHead(deps); } catch (_) { return null; }
   if (!tip) return null;
+  // Kept for the heartbeat (task 1004407), so the hall can say "behind main"
+  // without the server ever reaching GitHub itself.
+  (deps.state || RUNNER_STATE).mainHead = tip;
   return tip !== base ? { from: base.slice(0, 8), to: String(tip).slice(0, 8) } : false;
 }
 
@@ -1147,6 +1188,6 @@ module.exports = {
   readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, resolveWorkerBin,
   worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
-  isRunnerTree, RUNNER_TREE_RE, postHeartbeat, RUNNER_STARTED_AT, failureReason,
+  isRunnerTree, RUNNER_TREE_RE, postHeartbeat, claudeAccountLabel, RUNNER_STARTED_AT, failureReason,
   newRunnerState, loadedFiles, supervisorTouched, refreshCheckout, LIMIT_UNKNOWN_RESET_MS, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
 };

package/scripts/gds/update-channel.js

@@ -243,6 +243,14 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
 //
 // A failure's reason is a fixed class, never psql's own text: stderr can name a DB user or host,
 // and the reason is printed into the sweep's log.
+//
+// WHICH DATABASE (task 1004307). UPDATE_CHANNEL_DB names it first. That is the one a control-plane
+// unit should set, NOT PGDATABASE: the sweep hands its own env to every upgrade it spawns
+// ({ ...process.env, ...inst.env }), so a unit-level PGDATABASE would reach any tenant whose roster
+// entry names no database of its own, and that tenant's migrate would run against the control
+// plane's database. UPDATE_CHANNEL_DB means nothing to the upgrade, so it cannot leak that way.
+// It takes a bare db name or a connection string, as psql -d does.
+const CHANNEL_DB_ENV = 'UPDATE_CHANNEL_DB';
 const CHANNEL_SOURCE_DEPLOY = 'deploy';
 const CHANNEL_SOURCE_ROSTER = 'roster';
 const DB_CHANNELS_SQL = 'SELECT slug, update_channel FROM provisioning_instances';
@@ -268,8 +276,8 @@ function channelLine(inst) {
 // { ok:false, reason } when there is no database to ask, psql is missing, or the table is absent
 // (an instance with the provisioning module off). The caller falls back to the roster and says why.
 function readDbChannels({ env = process.env, run = spawnSync } = {}) {
-  const target = env.DATABASE_URL || env.PGDATABASE;
-  if (!target) return { ok: false, reason: 'no DATABASE_URL or PGDATABASE set for the sweep' };
+  const target = env[CHANNEL_DB_ENV] || env.DATABASE_URL || env.PGDATABASE;
+  if (!target) return { ok: false, reason: `no ${CHANNEL_DB_ENV} (or DATABASE_URL / PGDATABASE) set for the sweep` };
   const r = run('psql', ['-d', target, '-At', '-F', '\t', '-v', 'ON_ERROR_STOP=1', '--no-psqlrc', '-c', DB_CHANNELS_SQL],
     { encoding: 'utf8', timeout: DB_CHANNELS_TIMEOUT_MS });
   if (!r || r.error) {
@@ -399,6 +407,7 @@ module.exports = {
   parseNpmViewVersions,
   loadSubscriptions,
   readDbChannels,
+  CHANNEL_DB_ENV,
   applyDbChannels,
   channelLine,
   psqlFailureClass,