@bongos/core 1.20.61 → 1.20.63

package/release-notes.json

@@ -8483,5 +8483,25 @@
       "id": "1004407",
       "text": "The Gate page now shows, for each Autobongos runner, which PC it is on, which Claude account it is spending, which code version it runs (and whether that is behind), and says \"Restarting\" while it relaunches for new code inste"
     }
+  ],
+  "1.20.62": [
+    {
+      "id": "1004047",
+      "text": "Every live project now runs a version whose update banner works, so each owner sees when an update is waiting."
+    },
+    {
+      "id": "1004420",
+      "text": "\"Try the demo\" now works. A small team picks how many people and how many hours each, writes an idea, and gets a first read of what fits. The demo picks the settings for them (the founder decides, no rewards, all managed, priv"
+    },
+    {
+      "id": "1004307",
+      "text": "The automatic update on cloudbongos.com will now always run the newest version of itself, instead of a copy stuck from August."
+    }
+  ],
+  "1.20.63": [
+    {
+      "id": "1004405",
+      "text": "When the Upgrade button refuses a jump to a new release line, it now tells you exactly which setting on /deploy to change, instead of pointing at a setting that didn't exist."
+    }
   ]
 }

package/scripts/gds/provision-core-upgrade.js

@@ -137,11 +137,26 @@ function targetFault(to, available, installed, channel, channelAllows) {
     return `could not read the core version installed at this instance — nothing was changed. An upgrade that cannot say where it is starting from cannot be bounded by the '${channel}' channel.`;
   }
   if (channelAllows && !channelAllows(installed, to, channel)) {
-    return `core ${to} is outside this project's '${channel}' update channel — nothing was changed. Change the channel first if this is deliberate.`;
+    return `core ${to} is outside this project's '${channel}' update channel — nothing was changed. ${channelNextStep(channel)}`;
   }
   return null;
 }
 
+// The step that gets a channel-refused move through, named by the control a person can
+// actually reach (task 1004405). The old line said "change the channel first" while no
+// channel could be changed; the update rule on /deploy (task 1004445) is that control now,
+// and its labels are the words used here. `minor` is the widest rule, so a move it refuses
+// (a major, a prerelease) has no rule to widen to and is named as the by-hand step it is.
+function channelNextStep(channel) {
+  if (channel === 'pinned') {
+    return 'Its update rule on /deploy is "Stay put"; change it to "Fixes only" or "Fixes and new releases", then move again.';
+  }
+  if (channel === 'minor') {
+    return 'No update rule moves a project across a major version or onto a prerelease; that move is made by hand with upgrade.js (docs/recipes/upgrading-the-core.md).';
+  }
+  return 'To take a new release line, set this project\'s update rule on /deploy to "Fixes and new releases" (or press "Allow new releases and move"), then move again.';
+}
+
 // The update channel that bounds a move for THIS instance (task 1004445): the row's own
 // `update_channel`, normalised by update-channel.js so anything unknown or absent (a row
 // read before migration provisioning_029) falls back to DEFAULT_CHANNEL. PURE. One helper

package/scripts/gds/update-channel.js

@@ -243,6 +243,14 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
 //
 // A failure's reason is a fixed class, never psql's own text: stderr can name a DB user or host,
 // and the reason is printed into the sweep's log.
+//
+// WHICH DATABASE (task 1004307). UPDATE_CHANNEL_DB names it first. That is the one a control-plane
+// unit should set, NOT PGDATABASE: the sweep hands its own env to every upgrade it spawns
+// ({ ...process.env, ...inst.env }), so a unit-level PGDATABASE would reach any tenant whose roster
+// entry names no database of its own, and that tenant's migrate would run against the control
+// plane's database. UPDATE_CHANNEL_DB means nothing to the upgrade, so it cannot leak that way.
+// It takes a bare db name or a connection string, as psql -d does.
+const CHANNEL_DB_ENV = 'UPDATE_CHANNEL_DB';
 const CHANNEL_SOURCE_DEPLOY = 'deploy';
 const CHANNEL_SOURCE_ROSTER = 'roster';
 const DB_CHANNELS_SQL = 'SELECT slug, update_channel FROM provisioning_instances';
@@ -268,8 +276,8 @@ function channelLine(inst) {
 // { ok:false, reason } when there is no database to ask, psql is missing, or the table is absent
 // (an instance with the provisioning module off). The caller falls back to the roster and says why.
 function readDbChannels({ env = process.env, run = spawnSync } = {}) {
-  const target = env.DATABASE_URL || env.PGDATABASE;
-  if (!target) return { ok: false, reason: 'no DATABASE_URL or PGDATABASE set for the sweep' };
+  const target = env[CHANNEL_DB_ENV] || env.DATABASE_URL || env.PGDATABASE;
+  if (!target) return { ok: false, reason: `no ${CHANNEL_DB_ENV} (or DATABASE_URL / PGDATABASE) set for the sweep` };
   const r = run('psql', ['-d', target, '-At', '-F', '\t', '-v', 'ON_ERROR_STOP=1', '--no-psqlrc', '-c', DB_CHANNELS_SQL],
     { encoding: 'utf8', timeout: DB_CHANNELS_TIMEOUT_MS });
   if (!r || r.error) {
@@ -399,6 +407,7 @@ module.exports = {
   parseNpmViewVersions,
   loadSubscriptions,
   readDbChannels,
+  CHANNEL_DB_ENV,
   applyDbChannels,
   channelLine,
   psqlFailureClass,