@bongos/core 1.20.61 → 1.20.62

package/release-notes.json

@@ -8483,5 +8483,19 @@
       "id": "1004407",
       "text": "The Gate page now shows, for each Autobongos runner, which PC it is on, which Claude account it is spending, which code version it runs (and whether that is behind), and says \"Restarting\" while it relaunches for new code inste"
     }
+  ],
+  "1.20.62": [
+    {
+      "id": "1004047",
+      "text": "Every live project now runs a version whose update banner works, so each owner sees when an update is waiting."
+    },
+    {
+      "id": "1004420",
+      "text": "\"Try the demo\" now works. A small team picks how many people and how many hours each, writes an idea, and gets a first read of what fits. The demo picks the settings for them (the founder decides, no rewards, all managed, priv"
+    },
+    {
+      "id": "1004307",
+      "text": "The automatic update on cloudbongos.com will now always run the newest version of itself, instead of a copy stuck from August."
+    }
   ]
 }

package/scripts/gds/update-channel.js

@@ -243,6 +243,14 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
 //
 // A failure's reason is a fixed class, never psql's own text: stderr can name a DB user or host,
 // and the reason is printed into the sweep's log.
+//
+// WHICH DATABASE (task 1004307). UPDATE_CHANNEL_DB names it first. That is the one a control-plane
+// unit should set, NOT PGDATABASE: the sweep hands its own env to every upgrade it spawns
+// ({ ...process.env, ...inst.env }), so a unit-level PGDATABASE would reach any tenant whose roster
+// entry names no database of its own, and that tenant's migrate would run against the control
+// plane's database. UPDATE_CHANNEL_DB means nothing to the upgrade, so it cannot leak that way.
+// It takes a bare db name or a connection string, as psql -d does.
+const CHANNEL_DB_ENV = 'UPDATE_CHANNEL_DB';
 const CHANNEL_SOURCE_DEPLOY = 'deploy';
 const CHANNEL_SOURCE_ROSTER = 'roster';
 const DB_CHANNELS_SQL = 'SELECT slug, update_channel FROM provisioning_instances';
@@ -268,8 +276,8 @@ function channelLine(inst) {
 // { ok:false, reason } when there is no database to ask, psql is missing, or the table is absent
 // (an instance with the provisioning module off). The caller falls back to the roster and says why.
 function readDbChannels({ env = process.env, run = spawnSync } = {}) {
-  const target = env.DATABASE_URL || env.PGDATABASE;
-  if (!target) return { ok: false, reason: 'no DATABASE_URL or PGDATABASE set for the sweep' };
+  const target = env[CHANNEL_DB_ENV] || env.DATABASE_URL || env.PGDATABASE;
+  if (!target) return { ok: false, reason: `no ${CHANNEL_DB_ENV} (or DATABASE_URL / PGDATABASE) set for the sweep` };
   const r = run('psql', ['-d', target, '-At', '-F', '\t', '-v', 'ON_ERROR_STOP=1', '--no-psqlrc', '-c', DB_CHANNELS_SQL],
     { encoding: 'utf8', timeout: DB_CHANNELS_TIMEOUT_MS });
   if (!r || r.error) {
@@ -399,6 +407,7 @@ module.exports = {
   parseNpmViewVersions,
   loadSubscriptions,
   readDbChannels,
+  CHANNEL_DB_ENV,
   applyDbChannels,
   channelLine,
   psqlFailureClass,