@bongos/core 1.20.63 → 1.20.65

package/modules/npm-release/preview/env.js

@@ -13,6 +13,8 @@
 // is pointed at an empty scratch directory so a config file in the real home (the
 // Discord webhook file among them) is not found.
 
+const os = require('node:os');
+
 // The only names carried over from the live process.
 //   PATH            so node, and the child's own tooling, resolve
 //   NODE_ENV        production behaviour, as the live hall runs it
@@ -61,9 +63,10 @@ const MODULES_OFF = Object.freeze(PREFIXES.flatMap((pfx) => MODULE_KEYS.map((k)
  * @param {string} [o.envPrefix]   the env prefix of the copied instance's branding pack, if any
  * @param {string} [o.instanceRoot]  the scratch directory shaped like an instance root (config/,
  *                                   migrations/instance/); the child reads its host content from it
+ * @param {Function} [o.osUser]    () => the OS login name; PGUSER when none is carried
  * @returns {Record<string,string>} a fresh object, never `env` itself
  */
-function buildPreviewEnv({ env = process.env, port, scratchHome, instanceRoot, envPrefix } = {}) {
+function buildPreviewEnv({ env = process.env, port, scratchHome, instanceRoot, envPrefix, osUser = () => os.userInfo().username } = {}) {
   if (!port) throw new TypeError('buildPreviewEnv: port is required');
   if (!scratchHome) throw new TypeError('buildPreviewEnv: scratchHome is required');
   const out = {};
@@ -71,6 +74,12 @@ function buildPreviewEnv({ env = process.env, port, scratchHome, instanceRoot, e
     if (env[name] !== undefined && env[name] !== '') out[name] = String(env[name]);
   }
   if (!out.NODE_ENV) out.NODE_ENV = 'production';
+  // THE LOGIN NAME IS STATED (task 1004388). With no PGUSER the database driver takes it from
+  // USER, which an environment built from nothing does not have, and every query fails with
+  // "no PostgreSQL user name specified". The OS user is exactly who peer auth checks.
+  if (!out.PGUSER) {
+    try { const u = osUser(); if (u) out.PGUSER = String(u); } catch { /* left unset: the driver's own default */ }
+  }
   out.PORT = String(port);
   out.HOST = '127.0.0.1';
   out.HOME = scratchHome;

package/modules/npm-release/preview/supervisor.js

@@ -217,6 +217,10 @@ function createSupervisor({
       await step('create-copy', cmds.createDbCommand());
       await step('dump', cmds.dumpCommand({ liveDb, dumpFile }));
       await step('restore', cmds.restoreCommand({ dumpFile }));
+      // The dump is a full copy of the live database, sessions included, and is not needed
+      // once restored. A restart of the live service cannot finish the stop that would have
+      // removed it, so it goes now (task 1004388).
+      try { fsImpl.rmSync(dumpFile, { force: true }); } catch { /* the stop's cleanup still removes workDir */ }
       await step('migrate', cmds.migrateCommand({ cacheRoot, version, env: childEnv, instanceDir }));
 
       set({ stage: 'launch' });

package/modules/provisioning/render-standup.js

@@ -53,6 +53,13 @@ const SERVICE_RE = /^srv-[a-z0-9]{8,64}$/;
 
 // The reason a request cannot be queued, in the owner's words, or null. `body` is the
 // validated request body.
+//
+// The hall is never the app (ADR 0345 D1). A command that runs the Bongos core itself puts
+// a second, database-less copy of the project's hall on Render, where it never answers and
+// the deploy times out — measured live on project 43 (task 1004483). It cannot see through
+// the scaffold's own `npm start`, which still runs the hall; that is task 1004484.
+const HALL_COMMAND_RE = /platform-server\.js|node_modules[\\/]@bongos[\\/]core/i;
+const HALL_REFUSAL = 'That command starts the project’s Builders’ hall, which we already host — not your app. Give the command that starts your app.';
 function badRequest(body) {
   const b = body || {};
   if (!KEY_RE.test(String(b.key || ''))) return 'That doesn’t look like a Render API key. It starts with “rnd_” — create one under Account Settings → API Keys in Render.';
@@ -65,6 +72,7 @@ function badRequest(body) {
     if (!RUNTIMES.includes(b.runtime)) return 'Say what your app is built with — for example Node or Python, or Docker to use your repository’s Dockerfile.';
     if (b.runtime === 'docker' && (b.build_command || b.start_command)) return 'Docker builds and starts your app from your Dockerfile, so leave the commands out.';
     if (b.runtime !== 'docker' && !String(b.start_command || '').trim()) return 'Say how your app starts — the command Render should run, for example “npm start”.';
+    if (HALL_COMMAND_RE.test(String(b.start_command || '')) || HALL_COMMAND_RE.test(String(b.build_command || ''))) return HALL_REFUSAL;
   }
   if (b.web_plan != null && !WEB_PLANS.includes(b.web_plan)) return `“${b.web_plan}” is not a Render web plan.`;
   if (b.db_plan != null && !DB_PLANS.includes(b.db_plan)) return `“${b.db_plan}” is not a Render database plan.`;

package/modules/public-landing/public/projects.html

@@ -1696,6 +1696,7 @@ summary{min-height:24px;padding:3px 0;}
                     <span>Create the project now. You can choose where your app runs afterwards.</span></span>
                 </label>
               </fieldset>
+              <p class="renderWhy" id="renderLater" role="status" hidden>Your new repository has no app in it yet, so there is nothing for Render to run today. Once your builders have written the app, set it up on Render from your project’s page — it takes a minute, and asks for your Render key once. Nothing is created on Render now.</p>
               <div class="renderSetup" id="renderSetup" hidden>
                 <p class="renderWhy">Your Render key is used once, to create your app on your own Render account, and then thrown away — it is not kept, not even in this browser. Render bills you directly. A key can act on your whole Render account, so only paste it here. <a href="https://dashboard.render.com/u/settings#api-keys" target="_blank" rel="noopener noreferrer">Create a key in Render</a></p>
                 <div class="renderKeyRow">
@@ -5527,7 +5528,8 @@ summary{min-height:24px;padding:3px 0;}
     }
     function appRow() {
       if (appPlatformChoice() !== 'render') return 'Not chosen yet — you can decide later';
-      var ws = esc(state.renderOwnerName || state.renderOwnerId || '');
+      if (renderLater()) return 'Render — set up from your project’s page once your app has code. Nothing is created on Render now.';
+      var ws =esc(state.renderOwnerName || state.renderOwnerId || '');
       if (state.renderMode === 'adopt') return 'Render, workspace ' + ws + ' — link <code>' + esc(state.renderServiceName || state.renderServiceId || '') + '</code>, changing nothing on it';
       var plan = planLabel(RENDER_WEB_PLANS, state.renderPlan || 'starter');
       var db = state.renderDb ? ', with a database (' + planLabel(RENDER_DB_PLANS, state.renderDbPlan || 'basic_256mb') + ')' : ', no database';
@@ -5543,13 +5545,24 @@ summary{min-height:24px;padding:3px 0;}
        1004184). Here it reads and writes the draft (`state`), so every answer but the key
        survives a reload. The key is never on state, so a resumed draft asks for it again,
        and says why. */
+    /* A brand-new repository holds only the hall's scaffold — no app — so Render is set
+       up now only for an ADOPTED repo (task 1004483, owner call 2026-10-01). Set up on a
+       fresh one, Render ran the repo's `npm start`, which is the hall, and timed out.
+       Choosing Render for a fresh repo is still an answer: the step says when and where
+       it happens, and nothing is sent to Render at Create. */
+    function renderNow() { return appPlatformChoice() === 'render' && state.mode === 'adopt'; }
+    function renderLater() { return appPlatformChoice() === 'render' && state.mode !== 'adopt'; }
     var rc = renderConnect($, state, {
       save: saveDraft,
       repo: function () { return String(state.owner || '') + '/' + String(state.repo || ''); },
-      on: function () { return appPlatformChoice() === 'render'; },
+      on: renderNow,
       noKey: 'Check your Render key first — or choose “Decide later”.'
     });
-    function syncRenderSetup() { rc.sync(); }
+    function syncRenderSetup() {
+      var later = $('renderLater');
+      if (later) later.hidden = !renderLater();
+      rc.sync();
+    }
     function forgetRenderAnswers() { rc.forget(); }
     function validateRender() { return rc.validate(); }
     function renderRequestBody() { return rc.requestBody(); }
@@ -5557,7 +5570,13 @@ summary{min-height:24px;padding:3px 0;}
     // answer. The project exists either way; a refusal here is the APP's, and the done
     // panel says so in plain words.
     function sendRenderSetup(instanceId) {
-      if (appPlatformChoice() !== 'render' || !rc.hasKey() || !instanceId) return;
+      if (renderLater()) {
+        var later = $('doneRender');
+        later.hidden = false; later.className = 'hint';
+        later.textContent = 'Your app goes on Render once it has code: set it up from your project’s page when your builders have written it.';
+        return;
+      }
+      if (!renderNow() || !rc.hasKey() || !instanceId) return;
       var body = renderRequestBody();
       rc.drop();
       var note = $('doneRender');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.63",
+  "version": "1.20.65",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.63",
+      "version": "1.20.65",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.63",
+  "version": "1.20.65",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8503,5 +8503,21 @@
       "id": "1004405",
       "text": "When the Upgrade button refuses a jump to a new release line, it now tells you exactly which setting on /deploy to change, instead of pointing at a setting that didn't exist."
     }
+  ],
+  "1.20.64": [
+    {
+      "id": "1004483",
+      "text": "When you start a brand-new project and choose Render for your app, the wizard no longer tries to put anything on Render straight away: a new repository has no app in it yet, and Render was running the project's builders' hall"
+    },
+    {
+      "id": "1004390",
+      "text": "When someone adds a prerequisite to a job that was already waiting in the \"available work\" list, the job used to stay on that list — a builder would pick it up, and only then be told they couldn't start it yet. The listing was"
+    }
+  ],
+  "1.20.65": [
+    {
+      "id": "1004486",
+      "text": "Previewing an older version from the deploy page now works on the real server: the preview could not log in to its copy of the database, so every page in it failed. It also no longer leaves a full copy of the live database lyi"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.63'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.65'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/dependency_writes_atomic.mjs

@@ -188,4 +188,40 @@ await test('routes/tasks.js: POST uses the atomic batch writer and both writers
   assert.match(mapper, /CYCLE[\s\S]*409/);
 });
 
+// ================= the writers never DEMOTE the target (task 1004390) =================
+//
+// The decision recorded in ADR 0015 ("A dependency added AFTER promotion"): an edge
+// written against a task that is already `ready` leaves the status alone, and the
+// CLAIMABLE FEED hides the row instead (core_264 / task 1004190). The branch that was
+// rejected is the cheap one — demote the target to `backlog` here, no migration needed —
+// so it is the one that will look like a tidy-up to a future reader. These tests make
+// re-adding it go red: the writers must issue no write against `tasks` at all, which is
+// what keeps a planner's edge from silently reversing a human's `POST /promote`.
+//
+// Narrow on purpose. `SELECT id FROM tasks` (the existence check) is legitimate and
+// stays; what is forbidden is a MUTATION of the row.
+const touchesTaskRows = (log) => log.filter((q) => /^(UPDATE|DELETE FROM|INSERT INTO) tasks\b/i.test(q.sql));
+
+await test('addTaskDependencies writes edges only — it never updates the task it blocks', async () => {
+  const p = fakePool({ existing: [1, 2] });
+  await addTaskDependencies(1, [2], { pool: p });
+  assert.deepEqual(touchesTaskRows(p.log), [],
+    'a dep edge must not demote its target — ADR 0015, the rejected branch');
+  assert.ok(!has(p.log, /'backlog'/), 'and nothing here names the backlog status');
+});
+
+await test('setTaskDependencies (the full-set replace) never updates the task either', async () => {
+  const p = fakePool({ existing: [1, 2] });
+  await setTaskDependencies(1, [2], { pool: p });
+  assert.deepEqual(touchesTaskRows(p.log), []);
+  // The one DELETE it does run is scoped to the edge table, not the task row.
+  assert.ok(has(p.log, /^DELETE FROM dependencies/));
+});
+
+await test('addDependency (the generic edge) never updates the from-node', async () => {
+  const p = fakePool();
+  await addDependency('task', 1, 'task', 2, { pool: p });
+  assert.deepEqual(touchesTaskRows(p.log), []);
+});
+
 summary();

package/tests/npm_release_preview_diagnosis.mjs

@@ -149,7 +149,7 @@ test('a probe that sees a database failure fails the preview, says why, and clea
   assert.match(s.error, /schemaPending null/);
   assert.ok(events.includes('kill:SIGTERM'), 'the child was stopped');
   assert.deepEqual(calls[calls.length - 1], cmds.dropDbCommand(), 'the copy was dropped');
-  assert.equal(fake.rm.length, 1, 'the scratch directory was removed');
+  assert.equal(fake.rm.filter((p) => !String(p).replace(/\\/g, '/').endsWith('/live.dump')).length, 1, 'the scratch directory was removed');
 });
 
 test('a preview is running only once the probe says it can serve data', async () => {

package/tests/npm_release_preview_env.mjs

@@ -98,3 +98,26 @@ test('a missing port or scratch home is refused rather than guessed', () => {
   assert.throws(() => buildPreviewEnv({ env: LIVE, scratchHome: '/h' }), /port/);
   assert.throws(() => buildPreviewEnv({ env: LIVE, port: 1 }), /scratchHome/);
 });
+
+// THE FIRST REAL RUN ON THE DROPLET (task 1004388). The live hall connects by Unix-socket peer
+// auth with no PGUSER set, so the database driver takes the login name from USER — and an
+// environment built from nothing has no USER. Every query in the preview then failed with
+// "no PostgreSQL user name specified", while the migration (psql, which asks the OS) passed.
+// The login name is therefore stated: the carried PGUSER when there is one, else the OS user
+// this process runs as — the same identity peer auth would have checked.
+test('with no PGUSER to carry, the preview logs in as the OS user it runs as', () => {
+  const { PGUSER, ...noUser } = LIVE;
+  const out = buildPreviewEnv({ env: noUser, port: 3190, scratchHome: '/h', osUser: () => 'lars' });
+  assert.equal(out.PGUSER, 'lars');
+});
+
+test('a carried PGUSER wins over the OS user', () => {
+  const out = buildPreviewEnv({ env: LIVE, port: 3190, scratchHome: '/h', osUser: () => 'lars' });
+  assert.equal(out.PGUSER, 'hall');
+});
+
+test('an OS user that cannot be read leaves PGUSER unset rather than failing the start', () => {
+  const { PGUSER, ...noUser } = LIVE;
+  const out = buildPreviewEnv({ env: noUser, port: 3190, scratchHome: '/h', osUser: () => { throw new Error('no passwd entry'); } });
+  assert.equal('PGUSER' in out, false);
+});

package/tests/npm_release_preview_supervisor.mjs

@@ -46,6 +46,8 @@ function rig({ failOn, probeResults, env } = {}) {
 }
 
 const fwd = (x) => String(x).split(String.fromCharCode(92)).join('/');
+// The scratch directory's own removals; the dump file is removed separately, right after the restore.
+const scratchRms = (r) => r.filter((p) => !fwd(p).endsWith('/live.dump'));
 const DROP = { cmd: 'dropdb', args: ['--if-exists', '--force', PREVIEW_DB] };
 
 test('a start runs install, copy, restore and migrate, in that order, then launches and waits for health', async () => {
@@ -92,7 +94,7 @@ for (const failOn of ['npm', 'dropdb', 'createdb', 'dump', 'pg_restore', 'bash']
     assert.match(s.error, failOn === 'dropdb' ? /could not be dropped/ : /failed [(]exit 3[)]/);
     assert.equal(fake.spawned.length, 0, 'no process was started');
     if (failOn !== 'dropdb') assert.deepEqual(calls[calls.length - 1], DROP, 'the copy is dropped last');
-    assert.equal(rmCalls.length, 1, 'the scratch directory is removed');
+    assert.equal(scratchRms(rmCalls).length, 1, 'the scratch directory is removed');
   });
 }
 
@@ -102,7 +104,7 @@ test('a preview that never answers is stopped and cleaned up', async () => {
   assert.equal(sup.status().state, 'failed');
   assert.match(sup.status().error, /did not answer/);
   assert.equal(fake.killed, 1);
-  assert.equal(rmCalls.length, 1);
+  assert.equal(scratchRms(rmCalls).length, 1);
 });
 
 test('only one preview at a time: a second version is refused, the same version is not restarted', async () => {
@@ -139,7 +141,7 @@ test('stop kills the child, drops the copy, removes scratch and returns to idle'
   await sup.stop();
   assert.equal(fake.killed, 1);
   assert.deepEqual(calls[calls.length - 1], DROP);
-  assert.equal(rmCalls.length, 1);
+  assert.equal(scratchRms(rmCalls).length, 1);
   assert.equal(sup.status().state, 'idle');
   assert.equal(sup.status().version, null);
   assert.equal(sup.start('1.19.1001').ok, true, 'and a new one may start');
@@ -201,3 +203,16 @@ test('when the running version is not in the list the window counts from the new
   assert.equal(previewable('1.19.1029', { published, running: '0.0.1' }).ok, true);
   assert.equal(previewable('1.19.1028', { published, running: '0.0.1' }).ok, false);
 });
+
+// THE DUMP IS A FULL COPY OF THE LIVE DATABASE, sessions included (task 1004388). It is needed
+// only until the restore has read it; leaving it to the stop's cleanup meant a restart of the
+// live service (which cannot finish an async stop) left it in /tmp — found there 11 hours on.
+test('the dump file is deleted as soon as the restore has read it, before the child launches', async () => {
+  const { sup, rmCalls, fake } = rig();
+  const r = sup.start('1.19.1000');
+  await r.done;
+  const dumpRm = rmCalls.findIndex((p) => fwd(p).endsWith('/live.dump'));
+  assert.ok(dumpRm >= 0, 'the dump was never removed: ' + JSON.stringify(rmCalls));
+  assert.equal(sup.status().state, 'running');
+  assert.equal(fake.spawned.length, 1);
+});

package/tests/projects_hub_app_step.mjs

@@ -99,7 +99,9 @@ function load({ draft = {}, answers = {} } = {}) {
     },
     querySelectorAll(sel) { assert.equal(sel, '#appOpts input[name=appPlatform]'); return inputs; },
   };
-  const state = Object.assign({ appPlatform: 'later', owner: 'example-owner', repo: 'spike' }, draft);
+  // mode 'adopt' by default: since task 1004483 the Render flow runs at creation only for an
+  // adopted repo — a fresh one has no app yet. The fresh-repo cases set mode themselves.
+  const state = Object.assign({ appPlatform: 'later', owner: 'example-owner', repo: 'spike', mode: 'adopt' }, draft);
   const fetch = async (url, init) => {
     const body = init && init.body ? JSON.parse(init.body) : null;
     calls.push({ url, method: init && init.method, body });
@@ -417,6 +419,37 @@ test('after Create the key is sent once, to the new project, and then dropped',
   assert.equal(w.calls.filter((c) => c.url.endsWith('/render')).length, 1, 'a second send has nothing to send');
 });
 
+// task 1004483 — live on project 43: a fresh repo holds only the hall's scaffold, so Render
+// ran the hall and timed out. A fresh repo records the choice and creates nothing on Render.
+test('a brand-new repo choosing Render asks for no key, says when it happens, and sends nothing at Create', async () => {
+  const w = load({ answers: ANSWERS, draft: { appPlatform: 'render', mode: 'greenfield' } });
+  w.syncRenderSetup();
+  assert.equal(w.$('renderLater').hidden, false, 'the note shows');
+  assert.equal(w.$('renderSetup').hidden, true, 'no key, workspace or plan questions');
+  assert.equal(w.validateRender(), true, 'Next is not blocked on a key nobody needs yet');
+  assert.match(w.appRow(), /^Render — set up from your project’s page once your app has code\. Nothing is created on Render now\.$/);
+  w.sendRenderSetup(42);
+  await flush();
+  assert.equal(w.calls.filter((c) => c.url.endsWith('/render')).length, 0, 'nothing is sent to Render');
+  assert.equal(w.$('doneRender').hidden, false);
+  assert.match(w.$('doneRender').textContent, /once it has code: set it up from your project’s page/);
+  assert.equal(w.watches.length, 0, 'there is no app progress to watch');
+});
+
+test('switching the same draft to an adopted repo brings the full Render flow back', () => {
+  const w = load({ draft: { appPlatform: 'render', mode: 'greenfield' } });
+  w.syncRenderSetup();
+  assert.equal(w.$('renderLater').hidden, false);
+  w.state.mode = 'adopt';
+  w.syncRenderSetup();
+  assert.equal(w.$('renderLater').hidden, true);
+  assert.equal(w.$('renderSetup').hidden, false);
+  assert.equal(w.validateRender(), false, 'an adopted repo needs the key checked');
+  w.state.appPlatform = 'later';
+  w.syncRenderSetup();
+  assert.equal(w.$('renderLater').hidden, true, 'Decide later shows neither');
+});
+
 test('a refused setup request says the project is still being created', async () => {
   const w = load({ answers: { ...ANSWERS, '/api/bongos/provisioning/instances/42/render': { status: 409, message: 'This project has no GitHub repository linked.' } }, draft: { appPlatform: 'render' } });
   w.typeKey(KEY);

package/tests/provisioning_render_route.mjs

@@ -136,6 +136,9 @@ for (const [name, body, re] of [
   ['an unknown runtime', { ...GREEN, runtime: 'cobol' }, /built with/],
   ['a native runtime with no start command', { ...GREEN, start_command: '  ' }, /how your app starts/],
   ['docker with commands', { ...GREEN, runtime: 'docker' }, /leave the commands out/],
+  // task 1004483 — the hall is never the app; on Render it has no database and times out
+  ['a start command that runs the hall', { ...GREEN, start_command: 'node node_modules/@bongos/core/src/platform-server.js' }, /starts the project’s Builders’ hall/],
+  ['the hall by its file alone', { ...GREEN, start_command: 'node platform-server.js' }, /starts the project’s Builders’ hall/],
   ['adopt saying how to build', { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'adopt', service_id: 'srv-abcdefgh1234', runtime: 'node' }, /exactly as it is/],
 ]) {
   await ta(`${name} → 400, nothing kept`, async () => {