@bongos/core 1.20.64 → 1.20.65

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.64",
-  "core_contract": "1.20.64",
-  "source_commit": "575676341f5c84eab982a6e546119e8b477740a3",
+  "core_version": "1.20.65",
+  "core_contract": "1.20.65",
+  "source_commit": "d83ddd9aee9444dee8d60cf40c8dcb9b3d32e296",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T10:53:37.791Z",
+  "built_at": "2026-10-01T11:03:38.854Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 572,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3390,
-  "tree_sha256": "52d2e7e9c9429a83086dcfccfa49a001131cd68200e4e4c6713eb3cd7f6326c3",
+  "tree_sha256": "ede972bceb550b8da7d974492895636275f2f66415178c7632b00d1d85e3dbe0",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2207,7 +2207,7 @@
     {
       "path": "docs/adr/0349-a-version-preview-is-a-sandboxed-child-the-web-tier-launches.md",
       "mode": "0000644",
-      "sha256": "7fe345d475d9540181d12544606c1c2cbfd5510e94c8fbf3599fc48d2790b3cb"
+      "sha256": "b609d870b217440a12839ce675617973aac721e9f017e831ff208e06567c9939"
     },
     {
       "path": "docs/adr/0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7a7ee07e1f53d9a35fb896d8b88c0b03ee3437d7b60dcd85f94c49fe2317bd05"
+      "sha256": "9754d3deec186136216507d8dfc84c40eaf82c4ca40c63f48ad60884527452bf"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7142,7 +7142,7 @@
     {
       "path": "modules/npm-release/preview/env.js",
       "mode": "0000644",
-      "sha256": "d9716eea3c3c233eb0397fa0976de9dfcb8a87a8e3b802c5bbea4e5568e691f9"
+      "sha256": "018bdef460587e17cb6bf1fd622a2b14f671a777a1e36e4aeb00e798da5f30c3"
     },
     {
       "path": "modules/npm-release/preview/proxy.js",
@@ -7157,7 +7157,7 @@
     {
       "path": "modules/npm-release/preview/supervisor.js",
       "mode": "0000644",
-      "sha256": "fd27648c4d75e03ec541f1295a05ffd05aae957bbf0748215497b624106cf12e"
+      "sha256": "cd708c56ae7bba361c139aba9cfccbe8501843db1c4f54bcd0c0dcf93e76f83c"
     },
     {
       "path": "modules/npm-release/public/task-widget.js",
@@ -9447,12 +9447,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e76e52c17163b9b22e508e70795ddc77484f81fd47a2ccc156fd39ea4123c39f"
+      "sha256": "9c2fa6e82319388a9b4b7c68acb6aabf12cf447cc9df068c9351540e39e41f6e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "456223fa87e0f237ec34208c0019990f0c76a4fadfd6812797812c1d36113125"
+      "sha256": "253fd4502f205668e930fb1863b1dbc47f376462139e3a33809d84bb62157110"
     },
     {
       "path": "public-docs/index.html",
@@ -9472,7 +9472,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "412a73973976c63d7bf974f72354cdbeae90720c79b923c97f8b1f7d8cb81e9a"
+      "sha256": "e041a1335bad43a910cce4057eaf312ec70054008fef566a5b07f373fbddd8aa"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -11652,7 +11652,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e63e10c38215257f0811ee1300826615a5922a000872faf02d6aa835043ca281"
+      "sha256": "b8165107a23910ad35f528a86cd39ddff17a185fe7081f7cb8fb03f0c072a813"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14877,7 +14877,7 @@
     {
       "path": "tests/npm_release_preview_diagnosis.mjs",
       "mode": "0000644",
-      "sha256": "9a246f9a29da48eaed7d0f19e156f1f63a48afb0277ab8ce02f7d6dc07c6d92b"
+      "sha256": "1d0fe23920e58d8838d6753750097d55c0c36d32d30d8f14ddd916a8bea908d6"
     },
     {
       "path": "tests/npm_release_preview_divert.mjs",
@@ -14887,7 +14887,7 @@
     {
       "path": "tests/npm_release_preview_env.mjs",
       "mode": "0000644",
-      "sha256": "f25208db9870e67ac3b53456a97fbc02d2ab56a01974c82d1e264222ea063639"
+      "sha256": "9febec41c155f29a2e22a7fa7dc8059be1fe6a36ff1845dceb85f87e695f42c3"
     },
     {
       "path": "tests/npm_release_preview_proxy.mjs",
@@ -14902,7 +14902,7 @@
     {
       "path": "tests/npm_release_preview_supervisor.mjs",
       "mode": "0000644",
-      "sha256": "d699b5b2a6b36169cfcdd925bf6b580c0238a6125174469a0129ca7945b1e69b"
+      "sha256": "f326bc26e3b137dc8e17a22beeb08861181d35dc881ec1762e05377b9d9430e7"
     },
     {
       "path": "tests/npm_release_where.mjs",

package/docs/adr/0349-a-version-preview-is-a-sandboxed-child-the-web-tier-launches.md

@@ -97,6 +97,7 @@ What keeps that exception narrow:
 - A preview started by the live process is stopped when that process exits, but the copy is
   dropped only by the next start or stop. It is one fixed name, so it cannot pile up.
 - **Correction, 2026-09-30 (task 1004466): the proxy strips every upstream `Set-Cookie`.** Same origin means a cookie the child set replaced the live hall's own (`cb_stealth`, the session) and locked the owner out of `/deploy`. The child's cookies now stay with the child; the steering cookie is the only one this module writes, and its clear repeats the set's Path, SameSite and Secure.
+- **Correction, 2026-10-01 (task 1004486): the child is handed `PGUSER`.** The droplet's hall connects by socket peer auth with no `PGUSER`, so the driver names its login from `USER`, which an environment built from nothing does not have: every query in the copy failed. When no `PGUSER` is carried, the child gets the OS user it runs as (the identity peer auth checks anyway). And the dump file, a full copy of the live database, is now deleted as soon as the restore has read it; a service restart had left one in `/tmp` for eleven hours.
 
 ## Consequences
 

package/docs/module-api-changelog.md

@@ -2785,5 +2785,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.62 with no explicit bump. run 36850426143. (task 1002620)
   1.20.64 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.63 with no explicit bump. run 36851876428. (task 1002620)
+  1.20.65 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.64 with no explicit bump. run 36852902728. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/npm-release/preview/env.js

@@ -13,6 +13,8 @@
 // is pointed at an empty scratch directory so a config file in the real home (the
 // Discord webhook file among them) is not found.
 
+const os = require('node:os');
+
 // The only names carried over from the live process.
 //   PATH            so node, and the child's own tooling, resolve
 //   NODE_ENV        production behaviour, as the live hall runs it
@@ -61,9 +63,10 @@ const MODULES_OFF = Object.freeze(PREFIXES.flatMap((pfx) => MODULE_KEYS.map((k)
  * @param {string} [o.envPrefix]   the env prefix of the copied instance's branding pack, if any
  * @param {string} [o.instanceRoot]  the scratch directory shaped like an instance root (config/,
  *                                   migrations/instance/); the child reads its host content from it
+ * @param {Function} [o.osUser]    () => the OS login name; PGUSER when none is carried
  * @returns {Record<string,string>} a fresh object, never `env` itself
  */
-function buildPreviewEnv({ env = process.env, port, scratchHome, instanceRoot, envPrefix } = {}) {
+function buildPreviewEnv({ env = process.env, port, scratchHome, instanceRoot, envPrefix, osUser = () => os.userInfo().username } = {}) {
   if (!port) throw new TypeError('buildPreviewEnv: port is required');
   if (!scratchHome) throw new TypeError('buildPreviewEnv: scratchHome is required');
   const out = {};
@@ -71,6 +74,12 @@ function buildPreviewEnv({ env = process.env, port, scratchHome, instanceRoot, e
     if (env[name] !== undefined && env[name] !== '') out[name] = String(env[name]);
   }
   if (!out.NODE_ENV) out.NODE_ENV = 'production';
+  // THE LOGIN NAME IS STATED (task 1004388). With no PGUSER the database driver takes it from
+  // USER, which an environment built from nothing does not have, and every query fails with
+  // "no PostgreSQL user name specified". The OS user is exactly who peer auth checks.
+  if (!out.PGUSER) {
+    try { const u = osUser(); if (u) out.PGUSER = String(u); } catch { /* left unset: the driver's own default */ }
+  }
   out.PORT = String(port);
   out.HOST = '127.0.0.1';
   out.HOME = scratchHome;

package/modules/npm-release/preview/supervisor.js

@@ -217,6 +217,10 @@ function createSupervisor({
       await step('create-copy', cmds.createDbCommand());
       await step('dump', cmds.dumpCommand({ liveDb, dumpFile }));
       await step('restore', cmds.restoreCommand({ dumpFile }));
+      // The dump is a full copy of the live database, sessions included, and is not needed
+      // once restored. A restart of the live service cannot finish the stop that would have
+      // removed it, so it goes now (task 1004388).
+      try { fsImpl.rmSync(dumpFile, { force: true }); } catch { /* the stop's cleanup still removes workDir */ }
       await step('migrate', cmds.migrateCommand({ cacheRoot, version, env: childEnv, instanceDir }));
 
       set({ stage: 'launch' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.64",
+  "version": "1.20.65",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.64",
+      "version": "1.20.65",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.64",
+  "version": "1.20.65",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8513,5 +8513,11 @@
       "id": "1004390",
       "text": "When someone adds a prerequisite to a job that was already waiting in the \"available work\" list, the job used to stay on that list — a builder would pick it up, and only then be told they couldn't start it yet. The listing was"
     }
+  ],
+  "1.20.65": [
+    {
+      "id": "1004486",
+      "text": "Previewing an older version from the deploy page now works on the real server: the preview could not log in to its copy of the database, so every page in it failed. It also no longer leaves a full copy of the live database lyi"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.64'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.65'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/npm_release_preview_diagnosis.mjs

@@ -149,7 +149,7 @@ test('a probe that sees a database failure fails the preview, says why, and clea
   assert.match(s.error, /schemaPending null/);
   assert.ok(events.includes('kill:SIGTERM'), 'the child was stopped');
   assert.deepEqual(calls[calls.length - 1], cmds.dropDbCommand(), 'the copy was dropped');
-  assert.equal(fake.rm.length, 1, 'the scratch directory was removed');
+  assert.equal(fake.rm.filter((p) => !String(p).replace(/\\/g, '/').endsWith('/live.dump')).length, 1, 'the scratch directory was removed');
 });
 
 test('a preview is running only once the probe says it can serve data', async () => {

package/tests/npm_release_preview_env.mjs

@@ -98,3 +98,26 @@ test('a missing port or scratch home is refused rather than guessed', () => {
   assert.throws(() => buildPreviewEnv({ env: LIVE, scratchHome: '/h' }), /port/);
   assert.throws(() => buildPreviewEnv({ env: LIVE, port: 1 }), /scratchHome/);
 });
+
+// THE FIRST REAL RUN ON THE DROPLET (task 1004388). The live hall connects by Unix-socket peer
+// auth with no PGUSER set, so the database driver takes the login name from USER — and an
+// environment built from nothing has no USER. Every query in the preview then failed with
+// "no PostgreSQL user name specified", while the migration (psql, which asks the OS) passed.
+// The login name is therefore stated: the carried PGUSER when there is one, else the OS user
+// this process runs as — the same identity peer auth would have checked.
+test('with no PGUSER to carry, the preview logs in as the OS user it runs as', () => {
+  const { PGUSER, ...noUser } = LIVE;
+  const out = buildPreviewEnv({ env: noUser, port: 3190, scratchHome: '/h', osUser: () => 'lars' });
+  assert.equal(out.PGUSER, 'lars');
+});
+
+test('a carried PGUSER wins over the OS user', () => {
+  const out = buildPreviewEnv({ env: LIVE, port: 3190, scratchHome: '/h', osUser: () => 'lars' });
+  assert.equal(out.PGUSER, 'hall');
+});
+
+test('an OS user that cannot be read leaves PGUSER unset rather than failing the start', () => {
+  const { PGUSER, ...noUser } = LIVE;
+  const out = buildPreviewEnv({ env: noUser, port: 3190, scratchHome: '/h', osUser: () => { throw new Error('no passwd entry'); } });
+  assert.equal('PGUSER' in out, false);
+});

package/tests/npm_release_preview_supervisor.mjs

@@ -46,6 +46,8 @@ function rig({ failOn, probeResults, env } = {}) {
 }
 
 const fwd = (x) => String(x).split(String.fromCharCode(92)).join('/');
+// The scratch directory's own removals; the dump file is removed separately, right after the restore.
+const scratchRms = (r) => r.filter((p) => !fwd(p).endsWith('/live.dump'));
 const DROP = { cmd: 'dropdb', args: ['--if-exists', '--force', PREVIEW_DB] };
 
 test('a start runs install, copy, restore and migrate, in that order, then launches and waits for health', async () => {
@@ -92,7 +94,7 @@ for (const failOn of ['npm', 'dropdb', 'createdb', 'dump', 'pg_restore', 'bash']
     assert.match(s.error, failOn === 'dropdb' ? /could not be dropped/ : /failed [(]exit 3[)]/);
     assert.equal(fake.spawned.length, 0, 'no process was started');
     if (failOn !== 'dropdb') assert.deepEqual(calls[calls.length - 1], DROP, 'the copy is dropped last');
-    assert.equal(rmCalls.length, 1, 'the scratch directory is removed');
+    assert.equal(scratchRms(rmCalls).length, 1, 'the scratch directory is removed');
   });
 }
 
@@ -102,7 +104,7 @@ test('a preview that never answers is stopped and cleaned up', async () => {
   assert.equal(sup.status().state, 'failed');
   assert.match(sup.status().error, /did not answer/);
   assert.equal(fake.killed, 1);
-  assert.equal(rmCalls.length, 1);
+  assert.equal(scratchRms(rmCalls).length, 1);
 });
 
 test('only one preview at a time: a second version is refused, the same version is not restarted', async () => {
@@ -139,7 +141,7 @@ test('stop kills the child, drops the copy, removes scratch and returns to idle'
   await sup.stop();
   assert.equal(fake.killed, 1);
   assert.deepEqual(calls[calls.length - 1], DROP);
-  assert.equal(rmCalls.length, 1);
+  assert.equal(scratchRms(rmCalls).length, 1);
   assert.equal(sup.status().state, 'idle');
   assert.equal(sup.status().version, null);
   assert.equal(sup.start('1.19.1001').ok, true, 'and a new one may start');
@@ -201,3 +203,16 @@ test('when the running version is not in the list the window counts from the new
   assert.equal(previewable('1.19.1029', { published, running: '0.0.1' }).ok, true);
   assert.equal(previewable('1.19.1028', { published, running: '0.0.1' }).ok, false);
 });
+
+// THE DUMP IS A FULL COPY OF THE LIVE DATABASE, sessions included (task 1004388). It is needed
+// only until the restore has read it; leaving it to the stop's cleanup meant a restart of the
+// live service (which cannot finish an async stop) left it in /tmp — found there 11 hours on.
+test('the dump file is deleted as soon as the restore has read it, before the child launches', async () => {
+  const { sup, rmCalls, fake } = rig();
+  const r = sup.start('1.19.1000');
+  await r.done;
+  const dumpRm = rmCalls.findIndex((p) => fwd(p).endsWith('/live.dump'));
+  assert.ok(dumpRm >= 0, 'the dump was never removed: ' + JSON.stringify(rmCalls));
+  assert.equal(sup.status().state, 'running');
+  assert.equal(fake.spawned.length, 1);
+});