@bongos/core 1.20.80 → 1.20.81

package/modules/hall-ui/public/settings-autobongos.js

@@ -0,0 +1,156 @@
+// modules/hall-ui/public/settings-autobongos.js — the "Your Autobongos runner"
+// panel on /builders/settings (task 1004501).
+//
+// WHY THE PANEL EXISTS. The fence used to be one switch and one goal list for
+// every runner on the instance. Owner ruling, 2026-10-01: each builder says which
+// work THEIR runner takes, and a builder who has said nothing gets no autonomous
+// work. This is where they say it.
+//
+// WHAT IT READS. GET /autonomy/fence answers with the caller's EFFECTIVE fence: the
+// project allowlist narrowed to their picks, plus `scope` (what they picked, whether
+// they may run a runner, whether the owner paused them) and `project` (the
+// unnarrowed allowlist they choose from). One read, so the panel cannot disagree
+// with what the builder's runner is told. The server decides every one of those
+// facts; this page only draws them.
+//
+// WHAT IT WRITES. PUT /autonomy/me/goals with the whole list, on Save. The route
+// refuses a goal that is not allowlisted (409), and it is behind `autonomy.run`, so
+// a builder who may not run a runner is told so here instead of shown a form that
+// would fail.
+//
+// Its own file on the settings-interaction.js precedent: settings.js sits against
+// the 1500-line ratchet, and this panel shares nothing with the rest of the page.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const { escapeHtml, $ } = window.OTB;
+  const { emptyStateHtml } = window.OTBKit;
+  const toast = (msg) => window.OTB.toast(msg);
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+
+  const toAuth = () => window.location.assign(`${API}/auth/web/start`);
+
+  // The lines above the form: each one says why the runner might be idle, in the
+  // order the server checks them, so the first line a builder reads is the reason.
+  function noticesHtml(fence) {
+    const project = fence.project || {};
+    const scope = fence.scope || {};
+    const out = [];
+    if (project.enabled !== true) {
+      out.push(`The project's runner switch is off right now${project.paused_reason ? `: ${escapeHtml(project.paused_reason)}` : ''}. Your choices are kept and apply when it is back on.`);
+    }
+    if (scope.owner_paused) {
+      out.push(`The owner paused your runner${scope.owner_paused_reason ? `: ${escapeHtml(scope.owner_paused_reason)}` : ''}. Only the owner can resume it.`);
+    }
+    return out.map((t) => `<p class="prow__hint">${t}</p>`).join('');
+  }
+
+  // Goal names, by id. The fence carries only ids and the owner's note, so the
+  // names come from GET /goals — the list the Goals page draws for this same
+  // builder, so it names only goals they can already see. Best-effort: a failed
+  // read leaves the map empty and a row falls back to its number.
+  let goalNames = new Map();
+  async function loadGoalNames() {
+    try {
+      const res = await api.request('GET', `${API}/goals`);
+      if (res.ok && res.data && Array.isArray(res.data.goals)) {
+        goalNames = new Map(res.data.goals.map((g) => [Number(g.id), g.title]));
+      }
+    } catch (_) { /* names are a nicety; the picker works without them */ }
+  }
+  const goalLabel = (id) => goalNames.get(Number(id)) || `Goal ${id}`;
+
+  function render(fence) {
+    const body = $('#autobongos-body');
+    if (!body) return;
+    const scope = fence.scope || {};
+    if (scope.may_run !== true) {
+      body.innerHTML = emptyStateHtml('Your rank cannot run an Autobongos runner on this project. Ask the owner if you need one.');
+      return;
+    }
+    const goals = (fence.project && Array.isArray(fence.project.goals)) ? fence.project.goals : [];
+    if (!goals.length) {
+      body.innerHTML = noticesHtml(fence) + emptyStateHtml('The project has not allowed any goals for runners yet, so there is nothing to choose from.');
+      return;
+    }
+    const picked = new Set((scope.goals || []).map(Number));
+    body.innerHTML = `${noticesHtml(fence)}
+      <form id="autobongos-form">
+        <div class="prows">
+          ${goals.map((g) => {
+            const id = `autobongos-goal-${escapeHtml(String(g.goal_id))}`;
+            return `<label class="prow prow--pick" for="${id}">
+              <input type="checkbox" id="${id}" name="autobongos-goal" value="${escapeHtml(String(g.goal_id))}"${picked.has(Number(g.goal_id)) ? ' checked' : ''}>
+              <span class="prow__main">
+                <span class="prow__label">${escapeHtml(goalLabel(g.goal_id))}</span>
+                <span class="prow__desc">${escapeHtml([goalNames.has(Number(g.goal_id)) ? `goal ${g.goal_id}` : '', g.note || ''].filter(Boolean).join(' · '))}</span>
+              </span>
+            </label>`;
+          }).join('')}
+        </div>
+        <div class="settings-card">
+          <button type="submit" class="settings-btn" id="autobongos-save">Save</button>
+          <span class="settings-card__hint">${picked.size ? `Your runner works ${picked.size} goal${picked.size === 1 ? '' : 's'}.` : 'Your runner takes no work until you choose at least one goal.'}</span>
+        </div>
+      </form>`;
+    $('#autobongos-form').addEventListener('submit', (e) => {
+      e.preventDefault();
+      const ids = [...e.target.querySelectorAll('input[name="autobongos-goal"]:checked')].map((i) => Number(i.value));
+      save(ids);
+    });
+  }
+
+  async function load() {
+    const res = await api.request('GET', `${API}/autonomy/fence`);
+    if (res.status === 401) { toAuth(); return null; }
+    if (!res.ok) throw new Error(`fence GET → ${res.status}`);
+    return res.data;
+  }
+
+  async function save(goalIds) {
+    const status = $('#autobongos-status');
+    const btn = $('#autobongos-save');
+    if (status) status.textContent = 'Saving…';
+    if (btn) btn.disabled = true;
+    try {
+      const res = await api.request('PUT', `${API}/autonomy/me/goals`, { body: { goal_ids: goalIds } });
+      if (res.status === 401) { toAuth(); return; }
+      if (!res.ok) {
+        const env = res.data && res.data.error;
+        throw new Error((env && env.message) || `could not save (${res.status})`);
+      }
+      const msg = goalIds.length ? `Saved — your runner works ${goalIds.length} goal${goalIds.length === 1 ? '' : 's'}.` : 'Saved — your runner takes no work.';
+      if (status) status.textContent = msg;
+      toast(msg);
+      const fence = await load();
+      if (fence) render(fence);
+    } catch (err) {
+      console.error('[settings] save autobongos goals failed', err);
+      if (status) status.textContent = `Could not save: ${err.message}`;
+      toast('Could not save your runner’s goals. Try again.');
+      if (btn) btn.disabled = false;
+    }
+  }
+
+  async function setup() {
+    const section = $('#autobongos-scroll');
+    if (!section) return;
+    try {
+      const [fence] = await Promise.all([load(), loadGoalNames()]);
+      if (!fence) return;
+      render(fence);
+      section.hidden = false;
+    } catch (err) {
+      // Its own try/catch, like every other panel: a failing read shows this
+      // panel's own error rather than taking the settings page down with it.
+      console.error('[settings] failed to load autobongos scope', err);
+      section.hidden = false;
+      $('#autobongos-body').innerHTML =
+        '<p class="voices-empty">Your runner settings could not be loaded. Reload the page to try again.</p>';
+    }
+  }
+
+  setup();
+})();

package/modules/hall-ui/public/settings.html

@@ -163,6 +163,23 @@
               <p class="section-note">Ending a session takes effect immediately; the token stops working on its very next request.</p>
             </section>
 
+            <!-- YOUR AUTOBONGOS RUNNER — which goals your own unattended runner
+                 works (task 1004501). Rendered by settings-autobongos.js against
+                 GET /autonomy/fence (your effective fence) and PUT
+                 /autonomy/me/goals. Picking nothing means your runner takes no
+                 work. The project allowlist and the master switch stay the
+                 owner's, on the Gate page. -->
+            <section class="scroll" id="autobongos-scroll" aria-labelledby="autobongos-h" data-group="access" hidden>
+              <h2 id="autobongos-h" class="scroll__h">Your Autobongos runner</h2>
+              <p class="scroll__lede">
+                Choose which goals your own runner works while you are away. You can
+                only choose from the goals the project allows. If you choose none, your
+                runner takes no work.
+              </p>
+              <div id="autobongos-body" aria-live="polite"></div>
+              <p class="settings-status" id="autobongos-status" role="status" aria-live="polite"></p>
+            </section>
+
             <!-- IMAGE KEY — per-builder Gemini key (task 1013 / ADR 0073).
                  GET/PUT/DELETE /api/bongos/me/art-key/own. Write-only (set/replace/
                  remove); the full key is never shown again after save (masked,
@@ -425,5 +442,7 @@
 <script src="/builders/settings-render.js?v=2026-09-16-render-levels"></script>
 <!-- task 1004296: Settings → Software update. Own file on the same precedent. -->
 <script src="/builders/settings-software-update.js?v=2026-09-26-update"></script>
+<!-- task 1004501: Settings → Your Autobongos runner. Own file on the same precedent. -->
+<script src="/builders/settings-autobongos.js?v=2026-10-01-autobongos"></script>
 </body>
 </html>

package/modules/hall-ui/public/settings.js

@@ -1066,6 +1066,7 @@
     'privacy': 'account-hub-scroll',
     'disciplines': 'craft-scroll',
     'cli': 'cli-scroll',
+    'autobongos': 'autobongos-scroll',
     'art-key': 'art-key',
     'interaction': 'interaction-scroll',
     'wandering': 'wandering-scroll',

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.80",
+  "version": "1.20.81",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.80",
+      "version": "1.20.81",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.80",
+  "version": "1.20.81",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8625,5 +8625,11 @@
       "id": "1003907",
       "text": "Autobongos has now been proven against the live project: it shipped work by itself with nobody watching, refused every kind of work it is not allowed to touch, and recovered from restarts and network failures on its own. The o"
     }
+  ],
+  "1.20.81": [
+    {
+      "id": "1004501",
+      "text": "Each builder now chooses which goals their own Autobongos runner works, in Settings, from the goals the project allows. A builder who chooses nothing gets no unattended work. Who may run a runner at all is now a project permis"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.80'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.81'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');