@bongos/core 1.20.83 → 1.21.2

package/scripts/gds/session-transcript-build.js

@@ -0,0 +1,155 @@
+// scripts/gds/session-transcript-build.js — the PURE transcript→full-transcript builder.
+//
+// ADR 0051 / task 1001004: every session is stored as its FULL per-turn content
+// (user prompts, assistant text, tool calls AND their results), not just the
+// metadata + 160-char snippets buildSessionDigest keeps. This is the sibling of
+// session-digest-build.js and shares its scrubber: EVERY string leaves this file
+// through scrubSecrets (modules/security/secret-scrub.js, the task-1003 scrubber),
+// on the builder's box, before anything is uploaded. A string that reaches the
+// output unscrubbed is a defect — keep that single choke point (`clean`).
+//
+// Bounded on purpose: each text field is capped and the whole transcript has a
+// byte ceiling (head + tail kept, like buildSessionDigest's turn cap), so one
+// runaway tool result cannot make an upload that the server must reject.
+// Extended-thinking blocks are NOT captured: they are model-internal, often
+// opaque, and ADR 0051 asks for what the builder asked and what they were told.
+const { scrubSecrets } = require('../../modules/security/secret-scrub');
+
+const MAX_FIELD_CHARS = 20000;          // one prompt / reply / tool result / tool input
+const MAX_TRANSCRIPT_BYTES = 12 * 1024 * 1024; // whole upload ceiling (the server enforces the same number)
+const MAX_TRANSCRIPT_TURNS = 20000;            // the route's maxItems; the builder trims to it so the server never has to refuse
+const MAX_TURN_BYTES = 200 * 1024;            // under the route's 256 KB per-turn cap, so a many-tool-call turn is shrunk here rather than refused there
+const MAX_RAW_CHARS = 200000;                  // bound on what the scrubber is ever handed (entropy-sweep cost)
+
+// clean — the one exit for every string: drop NULs (Postgres rejects them in
+// jsonb), SCRUB, then cap. Scrub BEFORE the final cap so a credential straddling
+// the cap boundary is redacted whole rather than sliced into a fragment too short
+// for any scrub shape to recognise. The scrubber is only ever handed MAX_RAW_CHARS
+// so a multi-MB tool result cannot make the entropy sweep unbounded.
+function clean(text, extraSecrets) {
+  if (typeof text !== 'string' || text.length === 0) return undefined;
+  const flat = text.replace(/\0/g, '');
+  if (!flat) return undefined;
+  const bounded = flat.length > MAX_RAW_CHARS ? flat.slice(0, MAX_RAW_CHARS) : flat;
+  const scrubbed = scrubSecrets(bounded, extraSecrets);
+  if (!scrubbed) return undefined;
+  if (scrubbed.length <= MAX_FIELD_CHARS && flat.length === bounded.length) return scrubbed;
+  const omitted = (flat.length - bounded.length) + Math.max(0, scrubbed.length - MAX_FIELD_CHARS);
+  return `${scrubbed.slice(0, MAX_FIELD_CHARS)}…[+${omitted} chars]`;
+}
+
+function resultText(content) {
+  if (typeof content === 'string') return content;
+  if (Array.isArray(content)) {
+    return content.map((p) => (p && typeof p.text === 'string' ? p.text : '')).filter(Boolean).join('\n');
+  }
+  return '';
+}
+
+// shrinkTurn — cut every string field of an oversize turn to an even share of a
+// fixed character budget (in place), marking the cut. Already scrubbed, so this
+// only ever removes text.
+function shrinkTurn(t) {
+  const fields = [];
+  if (typeof t.text === 'string') fields.push([t, 'text']);
+  for (const c of t.tool_calls || []) if (typeof c.input === 'string') fields.push([c, 'input']);
+  for (const r of t.tool_results || []) if (typeof r.text === 'string') fields.push([r, 'text']);
+  const cap = Math.max(200, Math.floor(40000 / Math.max(1, fields.length)));
+  for (const [o, k] of fields) {
+    if (o[k].length > cap) o[k] = `${o[k].slice(0, cap)}…[+${o[k].length - cap} chars]`;
+  }
+}
+
+// buildSessionTranscript — parsed Claude Code transcript entries →
+// { turns, turnCount, byteSize, truncated }. Pure; exported for tests.
+function buildSessionTranscript(entries, opts = {}) {
+  const extra = opts.extraSecrets || [];
+  const maxBytes = opts.maxBytes || MAX_TRANSCRIPT_BYTES;
+  const maxTurns = opts.maxTurns || MAX_TRANSCRIPT_TURNS;
+  const turns = [];
+  let i = 0;
+  for (const e of Array.isArray(entries) ? entries : []) {
+    if (!e || typeof e !== 'object' || !e.message) continue;
+    const ts = typeof e.timestamp === 'string' ? e.timestamp : undefined;
+    const msg = e.message;
+    if (e.type === 'assistant') {
+      const row = { i, role: 'assistant', ts };
+      const texts = [];
+      const calls = [];
+      for (const c of Array.isArray(msg.content) ? msg.content : []) {
+        if (c && c.type === 'text' && typeof c.text === 'string') texts.push(c.text);
+        else if (c && c.type === 'tool_use') {
+          let input;
+          try { input = clean(JSON.stringify(c.input), extra); } catch (_) { input = undefined; }
+          calls.push({ name: String(c.name || '?'), input });
+        }
+      }
+      const text = clean(texts.join('\n'), extra);
+      if (text) row.text = text;
+      if (calls.length) row.tool_calls = calls;
+      if (!text && !calls.length) continue; // pure-thinking line: nothing readable
+      turns.push(row);
+      i++;
+    } else if (e.type === 'user') {
+      const row = { i, role: 'user', ts };
+      if (typeof msg.content === 'string') {
+        const text = clean(msg.content, extra);
+        if (text) row.text = text;
+      } else if (Array.isArray(msg.content)) {
+        const texts = [];
+        const results = [];
+        for (const c of msg.content) {
+          if (c && c.type === 'text' && typeof c.text === 'string') texts.push(c.text);
+          else if (c && c.type === 'tool_result') {
+            const r = { text: clean(resultText(c.content), extra) };
+            if (c.is_error) r.is_error = true;
+            results.push(r);
+          }
+        }
+        const text = clean(texts.join('\n'), extra);
+        if (text) row.text = text;
+        if (results.length) row.tool_results = results;
+      }
+      if (!row.text && !row.tool_results) continue;
+      turns.push(row);
+      i++;
+    }
+  }
+
+  // Byte ceiling: keep the head (what was asked) and the tail (how it ended),
+  // drop the middle, and SAY so — a silently shortened record reads as complete.
+  // Serialize each turn once; an oversize turn (many tool calls, each at the field
+  // cap) is shrunk field-by-field to fit, so the route's per-turn cap never refuses
+  // a transcript the builder could have trimmed. Sizes include the comma each turn
+  // costs in the array, and the total the 2 bytes of brackets, so this total is the
+  // SAME number the route measures against its ceiling.
+  const sizes = turns.map((t, idx) => {
+    let json = JSON.stringify(t);
+    let bytes = Buffer.byteLength(json, 'utf8');
+    if (bytes > MAX_TURN_BYTES) {
+      shrinkTurn(t);
+      json = JSON.stringify(t);
+      bytes = Buffer.byteLength(json, 'utf8');
+    }
+    turns[idx] = t;
+    return bytes + 1;
+  });
+  let total = sizes.reduce((a, b) => a + b, 2);
+  let out = turns;
+  let truncated = false;
+  if (total > maxBytes || turns.length > maxTurns) {
+    truncated = true;
+    const headBudget = Math.floor(maxBytes * 0.6);
+    const tailBudget = maxBytes - headBudget;
+    let h = 0; let headEnd = 0;
+    const headCount = Math.floor(maxTurns * 0.6);
+    while (headEnd < turns.length && headEnd < headCount && h + sizes[headEnd] <= headBudget) h += sizes[headEnd++];
+    let t = 0; let tailStart = turns.length;
+    while (tailStart > headEnd && (turns.length - tailStart) < maxTurns - headEnd && t + sizes[tailStart - 1] <= tailBudget) t += sizes[--tailStart];
+    out = turns.slice(0, headEnd).concat(turns.slice(tailStart));
+    total = h + t + 2;
+  }
+  return { turns: out, turnCount: turns.length, byteSize: total, truncated };
+}
+
+module.exports = { buildSessionTranscript, MAX_FIELD_CHARS, MAX_TRANSCRIPT_BYTES, MAX_TRANSCRIPT_TURNS };

package/scripts/gds/session-transcript-upload.js

@@ -0,0 +1,29 @@
+// scripts/gds/session-transcript-upload.js — send a session's FULL scrubbed
+// transcript to the corpus (ADR 0051, task 1001004).
+//
+// Shared by the SessionEnd hook (session-digest.js — fires for EVERY session) and
+// the on-ship upload (ship-session-upload.js — covers the mid-session tail), so
+// both build and send the transcript the same way. BEST-EFFORT and NON-FATAL like
+// the digest upload beside it: returns a one-line outcome string, never throws.
+// It must run AFTER the digest POST — the server creates the transcript row only
+// from the caller's own session_records row.
+const { buildSessionTranscript } = require('./session-transcript-build');
+
+async function uploadSessionTranscript(api, sessionId, entries, extraSecrets) {
+  try {
+    const t = buildSessionTranscript(entries, { extraSecrets });
+    if (!t.turns.length) return 'transcript: nothing to store.';
+    const r = await api.sessions.putSessionsSidTranscript({
+      sid: sessionId,
+      body: { turns: t.turns, truncated: t.truncated },
+    });
+    if (r && r.ok) {
+      return `transcript: stored ${t.turns.length}/${t.turnCount} turns (${Math.round(t.byteSize / 1024)} KB${t.truncated ? ', truncated to the size ceiling' : ''}).`;
+    }
+    return `transcript: skipped (PUT ${r && r.status}${r && r.data && r.data.error ? ' ' + JSON.stringify(r.data.error) : ''}).`;
+  } catch (e) {
+    return `transcript: skipped — ${e && e.message ? e.message : e}`;
+  }
+}
+
+module.exports = { uploadSessionTranscript };

package/scripts/gds/ship-session-upload.js

@@ -13,6 +13,7 @@ const path = require('node:path');
 const { cliClient, loadSession } = require('./cli-lib');
 const { resolveTranscriptPath } = require('./ship-memory-sync.js');
 const { apiErrorLine } = require('./ship-io.js');
+const { uploadSessionTranscript } = require('./session-transcript-upload.js');
 const { REPO_ROOT } = require('./ship-state.js');
 
 // ---------- Session upload-on-ship (6D.1 / ADR 0027) ----------
@@ -268,11 +269,15 @@ async function uploadSessionOnShip(taskId) {
       metrics: digest.metrics,
       model_usage: digest.metrics.model_usage || {}, // per-model tokens → cost-plus reward (task 1005)
     };
-    const r = await (await cliClient({ allowUnauthenticated: true })).sessions.postSessions({ body: payload });
+    const api = await cliClient({ allowUnauthenticated: true });
+    const r = await api.sessions.postSessions({ body: payload });
     if (r.ok) {
       console.log(
         `  session upload: stored digest (${digest.metrics.assistant_turns} assistant turns, ${digest.totalTokens} tokens, ${digest.metrics.tool_error_count} tool errors, ${digest.metrics.harness_retry_count} harness retries).`
       );
+      // ADR 0051: the full scrubbed transcript rides after the digest (the server
+      // creates it from the digest's row). Non-fatal — its outcome is a log line.
+      console.log(`  session upload: ${await uploadSessionTranscript(api, sessionId, entries, extraSecrets)}`);
     } else if (r.status === 401) {
       recordUploadSkip(taskId, {
         code: 'session_invalid',

package/scripts/gds/upgrade-commit-identity.js

@@ -0,0 +1,32 @@
+'use strict';
+
+// scripts/gds/upgrade-commit-identity.js — WHO the pin commit is signed by when the project's
+// git names nobody (task 1004514). Kept out of upgrade.js, which sits at the 1500-line cap.
+//
+// THE BUG. persistPin staged the new pin and ran `git commit`. In a repo with no
+// user.name/user.email — none in the repo, none global for the account the upgrade runs as —
+// git refuses ("Please tell me who you are"), so the move reported success with the pin
+// STAGED but never committed. The next move then read its own leftovers as a dirty tree and
+// spent its one automatic fix (wedge-remedy.js) committing them. Seen live on 2026-10-01: a
+// throwaway hosted project on cloudbongos.com, and hermeslines-marketing, whose repo carries no
+// identity while every scaffolded one does (provision-repo.js sets it at scaffold time).
+//
+// THE FIX IS A FALLBACK, NEVER AN OVERRIDE. A repo or account that names someone keeps
+// signing as them. Only an empty answer gets the provisioner's own identity, the one the
+// scaffold commits as, through git's AUTHOR/COMMITTER env — so nothing is written into the
+// owner's git config, and the argv stays exactly what it was.
+
+/**
+ * Env for `git commit` in `instanceDir`: null when git already names a committer there, else
+ * the provisioner's identity. Asks git itself, so repo, global and system config all count.
+ */
+function commitIdentityEnv(instanceDir, run, env = process.env) {
+  const r = run('git', ['config', 'user.email'], { cwd: instanceDir, encoding: 'utf8' });
+  if (r && !r.error && r.status === 0 && String(r.stdout || '').trim()) return null;
+  if (env.GIT_AUTHOR_EMAIL || env.GIT_COMMITTER_EMAIL) return null;   // the caller already chose
+  const { provisionerBotName, provisionerBotEmail } = require('./instance-apex.js');
+  const name = provisionerBotName(), email = provisionerBotEmail(env);
+  return { ...env, GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_COMMITTER_NAME: name, GIT_COMMITTER_EMAIL: email };
+}
+
+module.exports = { commitIdentityEnv };

package/scripts/gds/upgrade.js

@@ -352,7 +352,7 @@ function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = tru
     err('  ! could not stage the pin files — commit + push them by hand or the next deploy reverts this bump.');
     return { applicable: true, committed: false, pushed: false, dirty, error: 'git add failed' };
   }
-  const commit = run('git', ['commit', '-m', message], { cwd: instanceDir, encoding: 'utf8' });
+  const idEnv = require('./upgrade-commit-identity').commitIdentityEnv(instanceDir, run), commit = run('git', ['commit', '-m', message], { cwd: instanceDir, encoding: 'utf8', ...(idEnv ? { env: idEnv } : {}) }); // a repo naming nobody still commits (task 1004514)
   if (!commit || commit.error || commit.status !== 0) {
     err('  ! could not commit the pin — commit + push it by hand or the next deploy reverts this bump.');
     return { applicable: true, committed: false, pushed: false, dirty, error: 'git commit failed' };

package/scripts/hall-preview/refresh-fixtures.js

@@ -76,6 +76,8 @@ const SNAPSHOTS = [
   ['public/grades?days=7', 'public__grades'],
   ['public/repo-health?days=30', 'public__repo-health'],
   ['public/bounty-table', 'public__bounty-table'],
+  // the roster and the Standing card read the public list, with its roles (task 1004437)
+  ['public/leaderboard', 'public__leaderboard'],
   ['public/cost-summary', 'public__cost-summary'],
   ['public/progress', 'public__progress'],
   ['public/recent-shipped', 'public__recent-shipped'],

package/src/bongos/db.js

@@ -207,6 +207,18 @@ async function getBuilderRoleChoice(builderId) {
   return rows[0] ?? null;
 }
 
+// The same two facts for a whole list of builders, in ONE statement (task
+// 1004437): the public leaderboard names every row's roles. Map<idString, row>.
+async function getBuilderRoleChoices(builderIds) {
+  const ids = (builderIds || []).map(String).filter((v) => /^[1-9]\d*$/.test(v));
+  if (!ids.length) return new Map();
+  const { rows } = await pool.query(
+    `SELECT id, preferred_disciplines, main_discipline FROM builders WHERE id = ANY($1::bigint[])`,
+    [ids]
+  );
+  return new Map(rows.map((r) => [String(r.id), r]));
+}
+
 // The builder-PREFS db slice — the five per-builder preference jsonb columns on
 // `builders` (skill_model_prefs / sound_prefs / behavior_prefs / event_sound_prefs)
 // — was carved into modules/builder-settings/db.js (BV1.R80 / ADR 0093 §1). Core
@@ -1103,6 +1115,7 @@ module.exports = {
   updateBuilderDisciplines,
   UPDATE_BUILDER_DISCIPLINES_SQL,
   getBuilderRoleChoice,
+  getBuilderRoleChoices,
   RANKS,
   setBuilderRank,
   getLatestRankChangeForBuilder,

package/src/bongos/role-stats.js

@@ -149,7 +149,41 @@ async function readRoleStats(builderId, { shippedCount = 0, getRoleChoice } = {}
   return composeRoleStats({ choice, byCraft, shippedCount, artist, ideator });
 }
 
-// Only the reader is exported: the pure halves above are reached through it
+// readRolesForBuilders — the same main/shown rules for a WHOLE LIST at once
+// (task 1004437 / WA6.RP07): the public leaderboard names each builder's roles
+// and ranks a role by the credits earned in it, so every row needs its `shown`
+// crafts and its ledger split. Two reads for the whole page of rows, never one
+// per row: the role choices (`getRoleChoices`, one statement) and economy's
+// `creditsByCraft`, which already batches. Returns Map<idString, { main,
+// main_basis, shown, credits_by_craft }>, every id asked for present. Counts and
+// sums only, as the profile's tally is: nothing here is behind a sign-in.
+async function readRolesForBuilders(builderIds, { getRoleChoices } = {}) {
+  const ids = [...new Set((builderIds || []).map(String).filter((v) => /^[1-9]\d*$/.test(v)))];
+  const out = new Map();
+  if (!ids.length) return out;
+  const reward = seams.resolveOptional('reward');
+  const [choices, byCraftMap] = await Promise.all([
+    getRoleChoices ? getRoleChoices(ids) : new Map(),
+    reward && typeof reward.creditsByCraft === 'function' ? reward.creditsByCraft(ids) : null,
+  ]);
+  for (const id of ids) {
+    const choice = (choices && choices.get(id)) || null;
+    const byCraft = byCraftMap ? (byCraftMap.get(id) || null) : null;
+    const preferred = (choice && choice.preferred_disciplines) || [];
+    const { main, basis } = resolveMainRole({ mainDiscipline: choice && choice.main_discipline, preferred, byCraft });
+    out.set(id, {
+      main,
+      main_basis: basis,
+      shown: shownCrafts({ main, preferred, byCraft }),
+      credits_by_craft: byCraft
+        ? { engineer: byCraft.engineer, artist: byCraft.artist, ideator: byCraft.ideator, other: byCraft.other, total: byCraft.total }
+        : null,
+    });
+  }
+  return out;
+}
+
+// Only the readers are exported: the pure halves above are reached through them
 // (tests/profile_role_stats.mjs drives them via the real route), and an export
 // nothing imports is dead surface to the knip ratchet.
-module.exports = { readRoleStats };
+module.exports = { readRoleStats, readRolesForBuilders };

package/src/bongos/routes/public.js

@@ -37,6 +37,7 @@ const { clientBranding, branding } = require('../../branding');
 const { clientModules } = require('../../modules');
 const { publicReadRateLimitMiddleware } = require('../middleware/rate-limit');
 const { parseId, corsPublicGet, parsePagination, pageMeta } = require('./_helpers');
+const { readRolesForBuilders } = require('../role-stats');
 // task 1003208: structured logging — was console.*. A core file logs through
 // the kernel logger directly; only MODULES go via api.logger (the doorway).
 const log = require('../logger').logger.child({ src: 'public' });
@@ -235,9 +236,19 @@ module.exports = function buildPublicRouter() {
     // 100 preserves the prior ceiling. `page` is additive (readers of .leaderboard
     // unchanged). Mirrors the authed /leaderboard.
     const { limit, offset } = parsePagination(req, { defaultLimit: 100, maxLimit: 200 });
-    const rows = await seams.resolveOptional('reward').getLeaderboardWithAchievements(offset + limit, 5);
+    const rows = (await seams.resolveOptional('reward').getLeaderboardWithAchievements(offset + limit, 5)).slice(offset, offset + limit);
+    // task 1004437 (WA6.RP07): each row names its roles, main first, and carries
+    // the credits each craft earned, so a role filter ranks by a figure the row
+    // itself publishes (ADR 0255). Two reads for the page, not one per row. A
+    // failure costs the roles, never the board: the rows still go out.
+    try {
+      const roles = await readRolesForBuilders(rows.map((r) => r.id), { getRoleChoices: db.getBuilderRoleChoices });
+      for (const r of rows) r.roles = roles.get(String(r.id)) || null;
+    } catch (err) {
+      log.error({ err }, 'leaderboard roles failed');
+    }
     res.set('Cache-Control', 'public, max-age=60');
-    res.json({ leaderboard: rows.slice(offset, offset + limit), page: pageMeta(limit, offset) });
+    res.json({ leaderboard: rows, page: pageMeta(limit, offset) });
   });
 
   // rank: public — est-vs-actual aggregate.

package/src/bongos/routes.js

@@ -93,6 +93,9 @@ function buildGdsRouter() {
     if (
       req.path === '/memory/sync' ||
       req.path === '/sessions' ||
+      // ADR 0051 / task 1001004: the full-transcript upload (MB-scale), which
+      // mounts its own 16 MB parser in modules/sessions/routes/sessions.js.
+      /^\/sessions\/[A-Za-z0-9_-]+\/transcript$/.test(req.path) ||
       req.path === '/llm-cache/store' ||
       /^\/tasks\/\d+\/publish-branch$/.test(req.path) ||
       // task 1003109: the ship-time task visual — a base64 image up to ~5.3 MB

package/src/branding.js

@@ -94,6 +94,15 @@ const ENV_OVERRIDES = [
   ['NIGHT_TINT', ['project', 'nightTint']],
   ['LOOK_ACCENT', ['project', 'lookAccent']],
   ['LOGO_URL', ['project', 'logoUrl']],
+  // The birth marker (task 1004506): set by the platform only on a project created
+  // through the startup flow, so a project made before that never has it (spec D8).
+  // FOUNDING_BIRTH is when the platform made the row; DEMO_PEOPLE / DEMO_HOURS are the
+  // demo's time box, empty for a real project. The onboarding module reads them once to
+  // start genesis (modules/onboarding/founding-birth.js). SERVER-ONLY: clientBranding
+  // publishes no `founding` block.
+  ['FOUNDING_BIRTH', ['founding', 'birth']],
+  ['DEMO_PEOPLE', ['founding', 'demoPeople']],
+  ['DEMO_HOURS', ['founding', 'demoHours']],
 ];
 
 const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.83'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.2'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/achievements_reconcile.mjs

@@ -100,6 +100,19 @@ function fakeClient({ eligible = new Set(), unlocked = new Set(), credits = 0 })
     if (s.includes("reason = 'ship.net_negative'")) {
       return { rows: [{ n: eligible.has('subtractor') ? 3 : 0 }], rowCount: 1 };
     }
+    // the craft achievements (task 1004438): ONE facts read answers all seven
+    if (s.startsWith('select bool_or(reason like $2) as ignited')) {
+      return {
+        rows: [{
+          ignited: eligible.has('first-thought-ignited'),
+          full_idea: eligible.has('first-full-idea'),
+          ratified: eligible.has('first-board-ratification'),
+          pages: eligible.has('ten-pages-approved') ? 10 : eligible.has('first-page-approved') ? 1 : 0,
+          best_thought_tasks: eligible.has('thought-built-ten') ? 10 : 0,
+        }],
+        rowCount: 1,
+      };
+    }
     return no;
   });