@bongos/core 1.21.175 → 1.21.176

package/src/bongos/claim-attribution.js

@@ -2,7 +2,7 @@
 // src/bongos/claim-attribution.js — which of a builder's open claims does THIS
 // working tree belong to? (task 1003837)
 //
-// WHY. Two things answer that question — `scripts/gds/conductor-dispatch.js`,
+// WHY. Two things answer that question — `scripts/bongos/conductor-dispatch.js`,
 // which briefs a reviewer on the claim a diff belongs to, and
 // `.claude/hooks/conductor.js`, which measures "changed files outside your
 // claim's declared touches[]" on every prompt. They must not answer it
@@ -38,7 +38,7 @@ function claimForWorktree(claims, worktreeName) {
 // `path.basename` is the platform's: on POSIX it splits only on `/`, so a
 // Windows path arrives back whole — `C:\…\task-1003837` would BE the worktree
 // name, matching nothing. This repo keeps finding that same defect (task
-// 1003821 was two CI-invisible instances of it), and `scripts/gds/worktree.js`
+// 1003821 was two CI-invisible instances of it), and `scripts/bongos/worktree.js`
 // already normalizes backslashes first for exactly this reason.
 function worktreeNameFor(dir) {
   const d = String(dir || '').trim().replace(/\\/g, '/').replace(/\/+$/, '');

package/src/bongos/core-moves.js

@@ -27,7 +27,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { notesBetween, RELEASE_NOTES_FILE } = require('../../scripts/gds/release-notes.js');
+const { notesBetween, RELEASE_NOTES_FILE } = require('../../scripts/bongos/release-notes.js');
 
 const VERSION_RE = /^\d{1,4}\.\d{1,5}\.\d{1,6}$/;
 const ROLLED_BACK_RE = /^rolled_back:/;

package/src/bongos/core-update.js

@@ -22,7 +22,7 @@
 // than a wrong one.
 //
 // THE CHANNEL RULE IS NOT RESTATED HERE. `resolveChannelTarget` is the runner's
-// OWN function (scripts/gds/update-channel.js) and is imported, not copied: the
+// OWN function (scripts/bongos/update-channel.js) and is imported, not copied: the
 // banner must never offer a version the runner would then refuse, and ADR 0280
 // is the record of what a second copy of this contract costs when it drifts.
 //
@@ -39,7 +39,7 @@ const {
   normalizeChannel,
   resolveChannelTarget,
   versionsForFollow,
-} = require('../../scripts/gds/update-channel.js');
+} = require('../../scripts/bongos/update-channel.js');
 
 const REGISTRY_ORIGIN = 'https://registry.npmjs.org';
 // Six hours. The core publishes many times a day, but a banner is not a deploy
@@ -156,7 +156,7 @@ async function readCoreUpdate({ running, channel, get, ...deps } = {}) {
 // readCoreUpgrades — the instance's own core-upgrade ledger, newest first: when the
 // core pin last moved, from which version to which, and who or what moved it (task
 // 1002669). `core_upgrades` is written by `bongos upgrade` on every successful move and
-// rollback (scripts/gds/upgrade.js), including the unattended patch sweep's, and no
+// rollback (scripts/bongos/upgrade.js), including the unattended patch sweep's, and no
 // route read it — so "when did the pin last move" needed an SSH session. The pool is
 // injectable so the test runs with no database; the default is the instance's own.
 async function readCoreUpgrades({ limit = 20, pool = null } = {}) {

package/src/bongos/craft-mode.js

@@ -1,7 +1,7 @@
 // src/bongos/craft-mode.js — a claimed task's craft, as the pointer a session
 // follows to its playbook (task 1002992).
 //
-// WHY. The role registry (scripts/gds/discipline-modes.json) says which role
+// WHY. The role registry (scripts/bongos/discipline-modes.json) says which role
 // pack or skill each craft works from. claim.js used to PRINT that as a directive
 // block, which reaches the session only if someone reads the claim scroll by —
 // and a role pack skipped that way is invisible. This turns an entry into the same
@@ -22,7 +22,7 @@ const path = require('path');
 const { resolveCoreRoot } = require('../instance-config');
 
 function registryPath() {
-  return path.join(resolveCoreRoot(), 'scripts', 'gds', 'discipline-modes.json');
+  return path.join(resolveCoreRoot(), 'scripts', 'bongos', 'discipline-modes.json');
 }
 
 // The `modes` map, or {} for a missing / unparsable file.

package/src/bongos/db-kernel.js

@@ -83,12 +83,16 @@ async function getFoundingBuilder() {
 // onboarding/stale-claim/box/audit data (that stays behind GET /builders/roster,
 // Archon-only); id/login/name/avatar/rank is no more sensitive than what
 // GET /leaderboard already exposes publicly, just without the credits cutoff.
-async function listActiveBuilders() {
+// Accounts tagged is_tester (migration core_278) stay out unless the caller is a
+// management read that has to see them to untag them (includeTesters).
+async function listActiveBuilders({ includeTesters = false } = {}) {
   const { rows } = await pool.query(
     `SELECT id, github_login, display_name, avatar_url, rank
        FROM builders
       WHERE status = 'active'
-      ORDER BY COALESCE(display_name, github_login)`
+        AND (is_tester = false OR $1::boolean)
+      ORDER BY COALESCE(display_name, github_login)`,
+    [includeTesters]
   );
   return rows;
 }
@@ -280,6 +284,12 @@ async function accessStateByLogin(login) {
 // code agree on one number.
 const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
+// SESSION_IDLE_LIMIT_MS — a session of any source, CLI included, that has not
+// been used for this long is dead (ADR 0383, superseding ADR 0294's "CLI
+// sessions never expire"). Measured on last_used_at, so a session in use never
+// hits it; the own-sessions list hides the same rows.
+const SESSION_IDLE_LIMIT_MS = 10 * 24 * 60 * 60 * 1000; // 10 days
+
 // sessionTokenHash — the ONE place a bearer becomes the value this table stores
 // (task 1003372, audit A1, migration core_249). SHA-256 hex, matching the
 // migration's `encode(sha256(token::bytea), 'hex')` byte for byte, so a row
@@ -376,7 +386,7 @@ function sessionPermsSelect() {
 async function lookupSession(token) {
   if (!token) return null;
   const { rows } = await pool.query(
-    `SELECT s.id AS session_id, s.builder_id, s.expires_at, s.revoked_at, s.source,
+    `SELECT s.id AS session_id, s.builder_id, s.expires_at, s.revoked_at, s.source, s.last_used_at,
             b.github_id, b.github_login, b.display_name, b.avatar_url, b.total_credits,
             b.rank, b.status, b.system_role, b.anthropic_user_id${sessionPermsSelect()}
        FROM builder_sessions s
@@ -388,6 +398,7 @@ async function lookupSession(token) {
   if (!row) return null;
   if (row.revoked_at) return null;
   if (row.expires_at && row.expires_at < new Date()) return null;
+  if (row.last_used_at && Date.now() - new Date(row.last_used_at).getTime() > SESSION_IDLE_LIMIT_MS) return null;
   // Refresh-on-use. last_used_at always moves — the own-sessions list (ADR 0206)
   // is how a person spots a session they don't recognise, and that reading is the
   // whole remedy now that CLI rows never lapse. expires_at only rolls forward for
@@ -422,6 +433,7 @@ module.exports = {
   RANK_TIER,
   RANKS,
   SESSION_TTL_MS,
+  SESSION_IDLE_LIMIT_MS,
   upsertBuilder,
   seatFirstAdminIfUnclaimed,
   archonExists,

package/src/bongos/db.js

@@ -41,7 +41,7 @@ const {
   // Auth/identity/admission + the rank vocabulary carved to db-kernel (ADR 0102,
   // finishing ADR 0091 §1). Re-exported below so db.js's other importers + its own
   // internal uses (setBuilderRank's RANKS.indexOf, etc.) stay byte-identical.
-  RANKS, SESSION_TTL_MS, upsertBuilder, seatFirstAdminIfUnclaimed,
+  RANKS, SESSION_TTL_MS, SESSION_IDLE_LIMIT_MS, upsertBuilder, seatFirstAdminIfUnclaimed,
   getBuilderByGithubId, hasInvitedAccessRequest, createSession, lookupSession,
   // The bearer → stored-value transform (task 1003372, core_249). revokeSession
   // below is the one helper here still handed a raw bearer rather than an id.
@@ -115,7 +115,7 @@ async function linkAnthropicAccount(builderId, { email, userId }) {
 
 // recordAutonomyRun() + lastAutonomyHead() (the autonomy_runs slice) carved into
 // modules/autonomy/db.js (BV1.R83 / ADR 0093 §1). The MAS autonomy gate
-// (scripts/gds/autonomy-gate.js, a CLI) reads them directly from the module; core
+// (scripts/bongos/autonomy-gate.js, a CLI) reads them directly from the module; core
 // never calls them. The autonomy_runs TABLE (migration 126) stays in core
 // migrations/ (the shared-schema additive rule).
 
@@ -666,6 +666,28 @@ async function deactivateBuilder({ builderId, reason, actorBuilderId }) {
 }
 
 
+// setBuilderTester — mark or unmark a builder account as a tester (migration core_278,
+// task 1004845). A tester keeps its credits, history and sign-in; it only drops out of
+// the public leaderboard and the any-builder directory. Returns the updated row, or
+// null when no such builder exists; a machine principal throws TARGET_IS_SYSTEM_PRINCIPAL
+// and is never changed. The request audit middleware records the write.
+async function setBuilderTester({ builderId, isTester }) {
+  return withTx(async (client) => {
+    const { rows: found } = await client.query(
+      `SELECT id, system_role FROM builders WHERE id = $1 FOR UPDATE`,
+      [builderId]
+    );
+    if (!found[0]) return null;
+    if (found[0].system_role) throw { code: 'TARGET_IS_SYSTEM_PRINCIPAL' };
+    const { rows } = await client.query(
+      `UPDATE builders SET is_tester = $2 WHERE id = $1
+       RETURNING id, github_login, display_name, rank, status, is_tester`,
+      [builderId, !!isTester]
+    );
+    return rows[0];
+  });
+}
+
 async function reactivateBuilder({ builderId, actorBuilderId }) {
   return withTx(async (client) => {
     const { rows } = await client.query(
@@ -832,7 +854,9 @@ async function revokeAllSessionsForBuilder(builderId) {
 // account, newest-used first. Returns only what a person needs to RECOGNISE a
 // session — where it came from, when it was minted, when it was last used, what
 // client held it. The `token` column is deliberately never selected: a list that
-// returned tokens would turn one stolen session into all of them.
+// returned tokens would turn one stolen session into all of them. A session
+// idle past SESSION_IDLE_LIMIT_MS no longer authenticates (ADR 0383), so it is
+// left off the list too.
 
 async function listActiveSessionsForBuilder(builderId) {
   const { rows } = await pool.query(
@@ -841,8 +865,9 @@ async function listActiveSessionsForBuilder(builderId) {
       WHERE builder_id = $1
         AND revoked_at IS NULL
         AND (expires_at IS NULL OR expires_at > now())
+        AND last_used_at > now() - ($2::bigint * INTERVAL '1 millisecond')
       ORDER BY last_used_at DESC, id DESC`,
-    [builderId]
+    [builderId, SESSION_IDLE_LIMIT_MS]
   );
   return rows;
 }
@@ -1119,6 +1144,7 @@ module.exports = {
   getBuilderRoleChoices,
   RANKS,
   setBuilderRank,
+  setBuilderTester,
   getLatestRankChangeForBuilder,
   deactivateBuilder,
   reactivateBuilder,

package/src/bongos/github-repos.js

@@ -298,7 +298,7 @@ async function makeRepoPublic(token, ref = {}) {
 // Flip one repo PRIVATE. Only the control-plane runner may call this, and only AFTER
 // ensurePrivateRepoAccess has wired the project's own read-only deploy key: the
 // shared key cannot read a private repo, so flipping first breaks the next deploy
-// pull (walk finding N4, ADR 0176). scripts/gds/provision-repo-private.js is that
+// pull (walk finding N4, ADR 0176). scripts/bongos/provision-repo-private.js is that
 // caller (task 1004193); no web route calls it. Returns the same shape as getUserRepo.
 async function makeRepoPrivate(token, ref = {}) {
   return setRepoPrivate(token, ref, true);

package/src/bongos/llm-cache.js

@@ -29,7 +29,7 @@ const { pool } = require('./pool');
 // the pool is unreachable — so before this, every cache op silently degraded to
 // miss/no-store and the cache could never hit. Fix: keep the pool as the server
 // fast path; fall back to the GDS API when the pool is unavailable. The core
-// NEVER statically requires the CLI layer (scripts/gds/cli-lib.js) — that would
+// NEVER statically requires the CLI layer (scripts/bongos/cli-lib.js) — that would
 // drag session/fetch plumbing into the always-on server and cross the core↔host
 // boundary the fitness gate guards. Instead the consumer (which already imports
 // cli-lib) INJECTS apiCall via setApiFallback(). If it's never set, behaviour is

package/src/bongos/llm-pricing.js

@@ -6,7 +6,7 @@
 // only TOKEN counts. This module is the small, auditable table + pure function
 // that turns those tokens into dollars.
 //
-// Pure: no I/O, no Date.now(), no network. Imported by scripts/gds/session-cost.js
+// Pure: no I/O, no Date.now(), no network. Imported by scripts/bongos/session-cost.js
 // (and available as the grader's envelope-absent fallback). Unit-tested in
 // tests/llm-pricing.mjs.
 //

package/src/bongos/metrics.js

@@ -7,7 +7,7 @@
 // keeps package.json deps minimal, and the format is small + easy to test.
 //
 // CORE-SAFE: lives under src/bongos/ so it's held to the core↔host import boundary
-// (scripts/gds/fitness.js §1) — it imports only ./pool + ../build-info, nothing
+// (scripts/bongos/fitness.js §1) — it imports only ./pool + ../build-info, nothing
 // from the game runtime, so a non-game Cloud Bongos instance runs it unchanged.
 //
 // WHAT IT EXPOSES

package/src/bongos/middleware/rate-limit.js

@@ -20,7 +20,7 @@
 //                            unauthenticated /public/* surface (mounted there by
 //                            routes/public.js, NOT globally — the two write
 //                            limiters above bypass reads by design). It exists
-//                            because /public/uptime + /public/repo-health run
+//                            because /public/repo-health runs
 //                            multi-row 90-day aggregates on every uncached call,
 //                            so the surface is a DoS / cost-amplification target
 //                            (red-team #604 / task 1035). 120/min clears a legit
@@ -451,7 +451,7 @@ module.exports = {
   selfMeteredRoutes,
   DEFAULT_READ_LIMIT,
   DEFAULT_READ_MAX_TRACKED_IPS,
-  // exported for tests + the security-baseline-check script
+  // exported for tests
   PER_IP_WINDOW_MS,
   PER_IP_LIMIT,
   PER_SESSION_WINDOW_MS,

package/src/bongos/module-listing.js

@@ -254,7 +254,99 @@ async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null, maxPrice =
   return out;
 }
 
+// ---------------------------------------------------------------------------
+// Why a module is or is not listed (task 1003810, criterion wa5-curated-listing)
+// ---------------------------------------------------------------------------
+//
+// An author held out of the catalog must be able to see why, or they are silently
+// buried. "Below the bar" alone is not something they can act on, so the answer
+// names the reason in a sentence, says what would change it, and carries the same
+// parts reading the catalog shows (the weakest parts first). The reasons are
+// placeVersion's, plus two the catalog drops before it gets that far: `delisted`
+// and `no_version`. Being past the cap of ten per category is a reason of its own
+// once the cap exists (task 1003809); it is not one yet.
+function explainPlacement({ placement, reason }, { overall = null, floor = QUALITY_FLOOR, security = null, weaknesses = [] } = {}) {
+  const weakest = weaknesses.slice(0, 3).map((w) => `${w.title} (${w.score})`).join(', ');
+  const say = (why, nextStep) => ({ listed: placement !== 'excluded', placement, reason, why, next_step: nextStep });
+  switch (reason) {
+    case 'delisted':
+      return say('This module was taken out of the store by a Metic+ person. People who hold it keep it.',
+        'A delisted module takes no new versions and is not listed again.');
+    case 'no_version':
+      return say('This module has no published version the store can read.',
+        'Publish a version with `bongos module publish`.');
+    case 'not_assessed':
+      return say('This version has not been assessed yet. Every published version is checked automatically.',
+        'Wait for the check to finish. If it never does, a Metic+ person can run it again.');
+    case 'security_not_passed':
+      if (security && security.outcome === 'failed') {
+        return say(`This version failed the Security gate${security.reason ? `: ${security.reason}` : '.'} A version that fails it is never listed, whatever it scores.`,
+          'Fix what the Security gate found and publish a new version.');
+      }
+      return say('The Security gate has not finished for this version. Nothing is listed until it passes.',
+        'Wait for the check to finish. If it never does, a Metic+ person can run it again.');
+    case 'no_score':
+      return say('None of this version\'s parts could be scored yet, so it has no overall score to compare with the floor.',
+        'Add tests that run, and a how-to; installs and reliability are scored as projects use it.');
+    case 'below_floor':
+      return say(`This version scored ${overall} out of 100. The store lists modules that score at least ${floor}.${weakest ? ` Its weakest parts: ${weakest}.` : ''}`,
+        'Improve its weakest parts and publish a new version. The newest version is the one judged.');
+    case 'new':
+      return say('This version is listed with a New label. It is not ranked until it has real install and reliability data.',
+        'Nothing to do: it is ranked once projects have installed and used it.');
+    default:
+      return say(`This version is listed: it passed the Security gate and scored ${overall} out of 100, at or above the floor of ${floor}.`,
+        null);
+  }
+}
+
+// Where one module stands in the catalog, and why: null for a key the store does not
+// know, else { module_key, title, status, version, version_id, floor, overall,
+// listed, placement, reason, why, next_step, security, parts, strengths, weaknesses,
+// unmeasured }. Judges the same version the catalog does: the newest published one.
+// What the Security gate found is told only to the module's author (`viewerId`): to
+// anyone else it would point at a weakness the author has not fixed yet.
+async function readListing(key, { db, floor = QUALITY_FLOOR, viewerId = null } = {}) {
+  const pool = db || require('./pool').pool;
+  const { rows: mods } = await pool.query(
+    'SELECT module_key, title, status, author_id FROM store_modules WHERE module_key = $1', [key]);
+  const mod = mods[0];
+  if (!mod) return null;
+  const head = { module_key: mod.module_key, title: mod.title, status: mod.status, floor };
+  const { rows: versions } = await pool.query(
+    'SELECT module_key, id AS version_id, version, published_at FROM store_module_versions WHERE module_key = $1', [key]);
+  const newest = newestPerModule(versions)[0];
+  const empty = { security: null, ...readParts([], { floor }) };
+  if (mod.status === 'delisted' || !newest) {
+    const reason = mod.status === 'delisted' ? 'delisted' : 'no_version';
+    return { ...head, version: newest ? newest.version : null, version_id: newest ? newest.version_id : null, overall: null,
+      ...explainPlacement({ placement: 'excluded', reason }, { floor }), ...empty };
+  }
+  const { rows: scores } = await pool.query(
+    `SELECT DISTINCT ON (version_id) version_id, overall, security_passed, is_new
+       FROM module_assessment_scores
+      WHERE version_id = ANY($1)
+      ORDER BY version_id, computed_at DESC, id DESC`, [[newest.version_id]]);
+  const { rows: signals } = await pool.query(
+    `SELECT DISTINCT ON (version_id, part) version_id, part, outcome, score, sample_size, reason
+       FROM module_assessment_signals
+      WHERE version_id = ANY($1)
+      ORDER BY version_id, part, measured_at DESC, id DESC`, [[newest.version_id]]);
+  const score = scores[0] || null;
+  const sec = signals.find((s) => s.part === 'security');
+  const isAuthor = viewerId != null && String(mod.author_id) === String(viewerId);
+  const security = sec ? { outcome: sec.outcome, reason: (isAuthor && sec.reason) || null } : null;
+  const reading = readParts(signals, { floor });
+  const placed = placeVersion(score, floor);
+  const overall = score && placed.placement !== 'new' ? score.overall : null;
+  return {
+    ...head, version: newest.version, version_id: newest.version_id, overall,
+    ...explainPlacement(placed, { overall, floor, security, weaknesses: reading.weaknesses }),
+    security, ...reading,
+  };
+}
+
 module.exports = {
   QUALITY_FLOOR, STRONG_AT, SORT_PARTS, RANKING, placeVersion, readParts, sortByPart,
-  priceOf, withinMaxPrice, rankListed, listCatalog,
+  priceOf, withinMaxPrice, rankListed, listCatalog, explainPlacement, readListing,
 };