@bongos/core 1.23.21 → 1.24.1

package/src/bongos/device-approval.js

@@ -0,0 +1,140 @@
+// src/bongos/device-approval.js — command-line sign-in approved in the browser
+// (task 1004993, ADR 0396).
+//
+// WHY. The CLI's sign-in has always been GitHub's own device flow: the terminal
+// shows a code and the person types it at github.com. A person who signs in with
+// Google has no GitHub account to type it into. So when this instance offers
+// Google sign-in, the CLI's device flow is served HERE instead: the terminal gets
+// a code and a link to this instance's own approval page, the person signs in
+// there with GitHub or Google as they would in the browser, checks the code and
+// presses Approve, and the terminal's next poll receives a CLI session.
+//
+// The CLI needs no change for this: /auth/device/start and /auth/device/poll keep
+// their request and response shapes, and the CLI already opens whatever
+// `verification_uri` it is handed.
+//
+// WHAT HOLDS IT SAFE. Approving is a cookie-session POST (the same rule as
+// /auth/cli-token/issue: a bearer cannot mint a bearer), it binds the CLI session
+// to whoever approved, and the page tells the person to check the code matches
+// their terminal and to cancel a link someone sent them — the device-code
+// phishing risk GitHub's own page carries, stated the same way. A code is
+// single-use, lives FLOW_TTL_MS and is forgotten once polled to completion.
+//
+// In-memory, like GitHub's device flows in auth-config.js: a restart drops a
+// pending sign-in and the person runs it again.
+'use strict';
+
+const crypto = require('node:crypto');
+
+const FLOW_TTL_MS = 10 * 60 * 1000;
+const POLL_INTERVAL_S = 5;
+const FLOWS_MAX = 10000;
+// No vowels, so a code never spells a word; no look-alike letters.
+const USER_CODE_ALPHABET = 'BCDFGHJKLMNPQRSTVWXZ';
+
+const flows = new Map(); // device_code → flow
+const byUserCode = new Map(); // user_code → device_code
+
+function prune(now) {
+  for (const [deviceCode, f] of flows) {
+    if (f.expiresAt <= now) forget(deviceCode);
+  }
+}
+
+function forget(deviceCode) {
+  const f = flows.get(deviceCode);
+  if (f) byUserCode.delete(f.userCode);
+  flows.delete(deviceCode);
+}
+
+function newUserCode() {
+  let out = '';
+  for (let i = 0; i < 8; i++) out += USER_CODE_ALPHABET[crypto.randomInt(USER_CODE_ALPHABET.length)];
+  return `${out.slice(0, 4)}-${out.slice(4)}`;
+}
+
+// A code as a person might type it (lower case, spaces, no dash) → canonical
+// XXXX-XXXX, or null when it cannot be one.
+function normalizeUserCode(raw) {
+  const letters = String(raw || '').toUpperCase().replace(/[^A-Z]/g, '');
+  if (letters.length !== 8 || [...letters].some((c) => !USER_CODE_ALPHABET.includes(c))) return null;
+  return `${letters.slice(0, 4)}-${letters.slice(4)}`;
+}
+
+// Start a sign-in for the terminal → the same shape GitHub's device/code answers,
+// so the CLI reads it unchanged. `pageUrl` is this instance's approval page.
+function startBrowserDeviceFlow({ pageUrl, now = Date.now() }) {
+  prune(now);
+  while (flows.size >= FLOWS_MAX) forget(flows.keys().next().value);
+  const deviceCode = crypto.randomBytes(32).toString('hex');
+  let userCode = newUserCode();
+  while (byUserCode.has(userCode)) userCode = newUserCode();
+  flows.set(deviceCode, { userCode, expiresAt: now + FLOW_TTL_MS, lastPolledAt: 0, result: null });
+  byUserCode.set(userCode, deviceCode);
+  const complete = `${pageUrl}?code=${encodeURIComponent(userCode)}`;
+  return {
+    device_code: deviceCode,
+    user_code: userCode,
+    // The CLI opens verification_uri, so it carries the code: the page opens
+    // with it filled in. verification_uri_complete is the standard name for it.
+    verification_uri: complete,
+    verification_uri_complete: complete,
+    expires_in: Math.round(FLOW_TTL_MS / 1000),
+    interval: POLL_INTERVAL_S,
+  };
+}
+
+// The pending flow a typed code names, or null (unknown, expired, already decided).
+function pendingFlow(userCode, now = Date.now()) {
+  const code = normalizeUserCode(userCode);
+  const deviceCode = code && byUserCode.get(code);
+  const f = deviceCode && flows.get(deviceCode);
+  if (!f || f.expiresAt <= now || f.result) return null;
+  return { deviceCode, userCode: code };
+}
+
+// The signed-in person approved (or cancelled) the code. On approve, `mint` is
+// called once to create the CLI session for THIS person and its result is held
+// for the terminal's next poll. → true when a pending code was decided.
+async function decideDeviceFlow({ userCode, approve, mint, now = Date.now() }) {
+  const p = pendingFlow(userCode, now);
+  if (!p) return false;
+  const f = flows.get(p.deviceCode);
+  // Decide before the await, so a double-submit cannot mint twice.
+  f.result = { state: 'deciding' };
+  try {
+    f.result = approve ? { state: 'ok', ...(await mint()) } : { state: 'denied' };
+  } catch (err) {
+    f.result = null; // undecided again: the person can retry
+    throw err;
+  }
+  return true;
+}
+
+// Is this a device code this file issued (rather than GitHub's)?
+function isBrowserDeviceCode(deviceCode) {
+  return typeof deviceCode === 'string' && flows.has(deviceCode);
+}
+
+// The terminal's poll → { state: 'pending' | 'slow_down' | 'ok' | 'denied' | 'expired', … }.
+// The same states pollDeviceFlow answers for GitHub's flow.
+function pollBrowserDeviceFlow(deviceCode, now = Date.now()) {
+  const f = flows.get(deviceCode);
+  if (!f) return { state: 'expired' };
+  if (f.expiresAt <= now) { forget(deviceCode); return { state: 'expired' }; }
+  if (now - f.lastPolledAt < POLL_INTERVAL_S * 1000) return { state: 'slow_down', interval: POLL_INTERVAL_S };
+  f.lastPolledAt = now;
+  if (!f.result || f.result.state === 'deciding') return { state: 'pending' };
+  forget(deviceCode); // the token leaves exactly once
+  return f.result;
+}
+
+module.exports = {
+  FLOW_TTL_MS,
+  normalizeUserCode,
+  startBrowserDeviceFlow,
+  pendingFlow,
+  decideDeviceFlow,
+  isBrowserDeviceCode,
+  pollBrowserDeviceFlow,
+};

package/src/bongos/llm-pricing.js

@@ -283,4 +283,20 @@ function componentsFromModelUsage(modelUsage) {
   };
 }
 
-module.exports = { PRICES, FAMILY_CURRENT_MODEL, familyFor, priceUsage, canonicalizeModelId, priceModelUsage, componentsFromModelUsage };
+// SERVER-TOOL FEES (task 1004937, ADR 0394 §3). The Messages API's web search is
+// billed per search on top of tokens: $10 per 1,000 searches, i.e. $0.01 each.
+// Web fetch has no fee of its own; the fetched page is billed as input tokens,
+// which priceUsage already prices. This is the one place the search price is
+// spelled. Source: Anthropic's published web-search price as cached in the
+// claude-api reference (2026-10-06), NOT re-verified against the live pricing
+// page; the first real Market Watch run (task 1004942) is the measurement.
+const WEB_SEARCH_USD_PER_REQUEST = 0.01;
+
+// priceWebSearches(n) — USD for n web searches (usage.server_tool_use.web_search_requests).
+// A missing or garbage count prices as zero searches, never NaN.
+function priceWebSearches(n) {
+  const k = Number(n);
+  return Number.isFinite(k) && k > 0 ? k * WEB_SEARCH_USD_PER_REQUEST : 0;
+}
+
+module.exports = { PRICES, FAMILY_CURRENT_MODEL, familyFor, priceUsage, canonicalizeModelId, priceModelUsage, componentsFromModelUsage, WEB_SEARCH_USD_PER_REQUEST, priceWebSearches };

package/src/bongos/metrics.js

@@ -51,9 +51,28 @@ function renderLabels(labels) {
   return '{' + keys.map((k) => `${k}="${escapeLabelValue(labels[k])}"`).join(',') + '}';
 }
 
+// --- series cap (task 1004924) ---------------------------------------------
+// Every distinct label set is a series held in memory forever, so a label fed by
+// request input can grow the heap without bound. Past this many series a metric
+// takes no NEW label set: it folds into an overflow series instead. A metric with
+// a route label folds only the route to 'other' (method and status are bounded
+// sets already, so the overflow is a handful of series); any other metric folds
+// every label to 'other', one series.
+const MAX_SERIES_PER_METRIC = 2000;
+const OVERFLOW = 'other';
+
+function capLabels(series, labels) {
+  if (series.size < MAX_SERIES_PER_METRIC || series.has(labelKey(labels))) return labels;
+  if ('route' in labels) return { ...labels, route: OVERFLOW };
+  const all = {};
+  for (const k of Object.keys(labels)) all[k] = OVERFLOW;
+  return all;
+}
+
 function incCounter(name, help, labels = {}, by = 1) {
   let c = counters.get(name);
   if (!c) { c = { help, series: new Map() }; counters.set(name, c); }
+  labels = capLabels(c.series, labels);
   const key = labelKey(labels);
   const s = c.series.get(key);
   if (s) s.value += by;
@@ -63,6 +82,7 @@ function incCounter(name, help, labels = {}, by = 1) {
 function observeHistogram(name, help, labels, value) {
   let h = histograms.get(name);
   if (!h) { h = { help, series: new Map() }; histograms.set(name, h); }
+  labels = capLabels(h.series, labels);
   const key = labelKey(labels);
   let s = h.series.get(key);
   if (!s) { s = { labels, buckets: new Array(HIST_BUCKETS.length).fill(0), sum: 0, count: 0 }; h.series.set(key, s); }
@@ -74,8 +94,14 @@ function observeHistogram(name, help, labels, value) {
 }
 
 // --- event-loop lag sampler (unref'd so it never holds the process open) ---
+// Sampled every 10 s, not every second (task 1004961): a 1 s timer woke an idle
+// hosted instance once a second forever, which burns CPU credits on a small
+// droplet. perf_hooks.monitorEventLoopDelay() was considered and rejected — its
+// native sampler is itself a repeating libuv timer firing every `resolution` ms
+// (default 10 ms), so it would wake the loop far MORE often, not less. The gauge
+// keeps its name and meaning: the most recent sampled lag, in seconds.
 let _lagSeconds = 0;
-const _LAG_INTERVAL_MS = 1000;
+const _LAG_INTERVAL_MS = 10_000;
 const _lagTimer = setInterval(() => {
   const start = process.hrtime.bigint();
   setImmediate(() => {
@@ -100,6 +126,26 @@ function normalizeRoute(p) {
   return '/' + parts.join('/');
 }
 
+// routeLabel — the route label for one finished request (task 1004924). The
+// literal path is caller-chosen (every scanner hit on /wp-admin/x.php or /.env
+// is a new path), so it is never the label on its own:
+//   - a matched Express route labels by its PATTERN (mount path + route path),
+//     a fixed set only the code can grow;
+//   - a 404 with no matched route is the single label 'unmatched';
+//   - anything else unrouted (static files) keeps the normalized path, and the
+//     per-metric series cap above bounds even that.
+const UNMATCHED = 'unmatched';
+function routeLabel(req, status) {
+  const r = req.route;
+  if (r && r.path != null) {
+    const base = req.baseUrl && req.baseUrl !== '/' ? normalizeRoute(req.baseUrl) : '';
+    const p = typeof r.path === 'string' ? r.path : String(r.path);
+    return (base + p) || '/';
+  }
+  if (status === 404) return UNMATCHED;
+  return normalizeRoute(req.path);
+}
+
 // --- HTTP middleware ------------------------------------------------------
 function httpMiddleware() {
   return (req, res, next) => {
@@ -107,9 +153,9 @@ function httpMiddleware() {
     if (req.path === '/metrics' || req.path === '/healthz') return next();
     const start = process.hrtime.bigint();
     res.on('finish', () => {
-      const route = normalizeRoute(req.path);
       const method = req.method;
       const status = res.statusCode;
+      const route = routeLabel(req, status);
       incCounter('gds_http_requests_total', 'Total HTTP requests by method, normalized route, and status code.',
         { method, route, status: String(status) });
       const dur = Number(process.hrtime.bigint() - start) / 1e9;

package/src/bongos/middleware/rate-limit.js

@@ -118,6 +118,12 @@ const DEFAULT_READ_LIMIT     = 600;
 // address-rotating caller must not be able to grow the map without bound between sweeps
 // (same bound as modules/platform-identity/read-rate-limit.js).
 const DEFAULT_READ_MAX_TRACKED_IPS = 10000;
+// Hard size cap on EVERY bucket map below (task 1004964). The sweep bounds them by
+// time only, once per SWEEP_MS; a flood from many source addresses would otherwise
+// grow a map for up to five minutes before it runs. At the cap the oldest-inserted
+// key is evicted first (a Map iterates in insertion order), so the newest callers
+// keep their buckets. A limiter may set a tighter cap (DEFAULT_READ_MAX_TRACKED_IPS).
+const MAX_TRACKED_KEYS = 50000;
 const OPT_OUT_REASON_MIN_LENGTH = 20;
 const SWEEP_MS              = 5 * 60 * 1000;
 
@@ -138,6 +144,15 @@ const WRITE_METHODS = new Set(['POST', 'PATCH', 'PUT', 'DELETE']);
 // limiter — the public router answers CORS preflights and returns 204 first.
 const READ_METHODS  = new Set(['GET', 'HEAD']);
 
+// newBucket(map, key, cap) — start an empty bucket for a key not yet tracked,
+// evicting the oldest-inserted key first while the map is at its cap.
+function newBucket(map, key, cap = MAX_TRACKED_KEYS) {
+  while (map.size >= cap) map.delete(map.keys().next().value);
+  const bucket = [];
+  map.set(key, bucket);
+  return bucket;
+}
+
 function pruneAndCount(bucket, now, windowMs) {
   const cutoff = now - windowMs;
   // arr is the in-place timestamps array; trim in place.
@@ -219,7 +234,7 @@ function rateLimitMiddleware(req, res, next) {
   // --- per-IP ---
   const ip = req.ip || req.socket?.remoteAddress || 'unknown';
   let ipBucket = ipBuckets.get(ip);
-  if (!ipBucket) { ipBucket = []; ipBuckets.set(ip, ipBucket); }
+  if (!ipBucket) ipBucket = newBucket(ipBuckets, ip);
   const ipCount = pruneAndCount(ipBucket, now, PER_IP_WINDOW_MS);
   if (ipCount >= PER_IP_LIMIT) {
     const oldest = ipBucket[0];
@@ -235,7 +250,7 @@ function rateLimitMiddleware(req, res, next) {
   const sessionKey = extractSessionKey(req);
   if (sessionKey) {
     let sBucket = sessionBuckets.get(sessionKey);
-    if (!sBucket) { sBucket = []; sessionBuckets.set(sessionKey, sBucket); }
+    if (!sBucket) sBucket = newBucket(sessionBuckets, sessionKey);
     const sCount = pruneAndCount(sBucket, now, PER_SESSION_WINDOW_MS);
     if (sCount >= PER_SESSION_LIMIT) {
       const oldest = sBucket[0];
@@ -266,7 +281,7 @@ function publicReadRateLimitMiddleware(req, res, next) {
   const now = Date.now();
   const ip = req.ip || req.socket?.remoteAddress || 'unknown';
   let bucket = publicReadBuckets.get(ip);
-  if (!bucket) { bucket = []; publicReadBuckets.set(ip, bucket); }
+  if (!bucket) bucket = newBucket(publicReadBuckets, ip);
   const count = pruneAndCount(bucket, now, PUBLIC_READ_WINDOW_MS);
   if (count >= PUBLIC_READ_LIMIT) {
     const oldest = bucket[0];
@@ -287,18 +302,14 @@ function publicReadRateLimitMiddleware(req, res, next) {
 // names that budget in the 429 body + headers so a caller can tell which ceiling
 // it hit. Keyed on req.ip — the same real-client-IP resolution the write limiter
 // uses (Caddy forwards the client IP, server sets 'trust proxy').
-function perIpSlidingWindow(buckets, { limit, windowMs, scope, maxTracked = Infinity }) {
+function perIpSlidingWindow(buckets, { limit, windowMs, scope, maxTracked = MAX_TRACKED_KEYS }) {
   return markMetered(function slidingWindowRateLimit(req, res, next) {
     const now = Date.now();
     const ip = req.ip || req.socket?.remoteAddress || 'unknown';
     let bucket = buckets.get(ip);
-    if (!bucket) {
-      // Bound the map: a caller rotating source addresses (an IPv6 /64) mints a fresh
-      // bucket per request. Evict the longest-tracked entry (Map iterates oldest first).
-      if (buckets.size >= maxTracked) buckets.delete(buckets.keys().next().value);
-      bucket = [];
-      buckets.set(ip, bucket);
-    }
+    // Bound the map: a caller rotating source addresses (an IPv6 /64) mints a fresh
+    // bucket per request. Evict the longest-tracked entry (Map iterates oldest first).
+    if (!bucket) bucket = newBucket(buckets, ip, maxTracked);
     if (pruneAndCount(bucket, now, windowMs) >= limit) {
       const retryAfter = Math.max(1, Math.ceil((bucket[0] + windowMs - now) / 1000));
       res.set('Retry-After', String(retryAfter));
@@ -451,6 +462,7 @@ module.exports = {
   selfMeteredRoutes,
   DEFAULT_READ_LIMIT,
   DEFAULT_READ_MAX_TRACKED_IPS,
+  MAX_TRACKED_KEYS,
   // exported for tests
   PER_IP_WINDOW_MS,
   PER_IP_LIMIT,
@@ -463,3 +475,10 @@ module.exports = {
   PROJECT_FEED_WINDOW_MS,
   PROJECT_FEED_LIMIT,
 };
+
+// Test seam (task 1004964): the bucket maps, so a test can show each stays capped.
+// Assigned after the export list, not inside it: an object literal there stops
+// cjs-module-lexer, and ESM tests lose every named export after it.
+module.exports._bucketMaps = {
+  ipBuckets, sessionBuckets, publicReadBuckets, accountExistenceBuckets, projectFeedBuckets, defaultReadBuckets,
+};

package/src/bongos/module-scope-map.js

@@ -50,7 +50,7 @@ const MODULE_GLOBS = {
     'src/bongos/permission-path-check.js', 'src/bongos/sensitive-surfaces.js',
     // task 1004024: the auth.js carve (db-kernel.js, above, is db.js's), now protected.
     'src/bongos/auth-admission.js', 'src/bongos/auth-config.js', 'src/bongos/auth-discord.js',
-    'src/bongos/auth-github.js', 'src/bongos/auth-idp.js',
+    'src/bongos/auth-github.js', 'src/bongos/auth-google.js', 'src/bongos/auth-idp.js',
     'src/bongos/middleware/', 'src/bongos/live-channel.js', 'src/bongos/secret-box.js',
     'src/bongos/repo-info.js', 'src/bongos/api-path-404.js', 'src/bongos/serve-internal.js',
     'src/bongos/module-scope-map.js', 'src/bongos/hierarchy-config.js',
@@ -182,10 +182,23 @@ const MODULE_GLOBS = {
   'page-notes': [
     'modules/page-notes/',
   ],
+  // AI generation for artists (task 1004916, ADR 0392): keys, prepaid balance, generate.
+  'ai-studio': [
+    'modules/ai-studio/',
+  ],
   // The /raise investor page (task 1004847, ADR 0384): hub-only.
   raise: [
     'modules/raise/',
   ],
+  // Market Watch (task 1004935, goal 1000137): a weekly AI watch on a project's
+  // market. default:false; its data layer landed in task 1004936 (no routes yet). Its tests
+  // are listed by EXACT path: this file's format has no wildcards (header above), so a
+  // 'tests/market_watch_*' entry would match nothing. Add each new market_watch test here by name.
+  'market-watch': [
+    'modules/market-watch/', 'tests/market_watch_module.mjs',
+    'tests/market_watch_data.mjs', 'tests/market_watch_data_db.mjs',
+    'tests/market_watch_run.mjs',
+  ],
   // --- builder prefs (wandering/skill/sound/render) + builder-needs ---
   // Carved into modules/builder-settings/ (BV1.R80 / ADR 0093 §1): the five pref
   // libs + builder-needs + their db slice + the `/me/*-prefs` routes + the
@@ -525,6 +538,8 @@ const MODULE_GLOBS = {
   //     enforcement, not methodology prose. ---
   methodology: [
     'CLAUDE.md',
+    // the same instruction core for every other AI model (task 1004922)
+    'AGENTS.md', 'GEMINI.md',
     'docs/',
     '.claude/skills/', '.claude/rules/',
     'scripts/bongos/start.js', 'scripts/bongos/discipline-modes.json',

package/src/bongos/optimizer.js

@@ -29,6 +29,7 @@
 // per-task est_minutes <= timeBudgetMin guard already enforces that.
 
 const { pool } = require('./pool');
+const { resolveCapabilities, feedNeedsClause } = require('./task-needs');
 // touches[] cleanup [5/8] (task 880): the same prefix-aware overlap matcher the
 // claim guard uses, so the planner's "parallel-safe set" agrees with what
 // claimTask / claimTasksBatch will actually allow.
@@ -77,6 +78,12 @@ const UNSHIPPED_DEPS_GUARD = `
                    OR (d.to_kind = 'goal'      AND EXISTS (SELECT 1 FROM goals              x WHERE x.id = d.to_id AND x.status <> 'achieved')))
             )`;
 
+// An artist's page claim is a MARKER, never a file-overlap block (task 1004947).
+// Hand copy of notPageMarkerSql('c', 't2') in modules/lifecycle/page-tweak-artist.js
+// (core cannot require a module, ADR 0083); tests/page_tweak_marker_sql.mjs pins
+// the two together, as claimable_blocker_status.mjs does for the guards above.
+const PAGE_MARKER_GUARD = `NOT (COALESCE(t2.source, '') = 'page-tweak' AND c.worktree_name IS NULL AND c.creator_session_id IS NULL)`;
+
 const VALID_MODES = ['active', 'check-in', 'autonomous'];
 const DEFAULT_MAX_PARALLEL = 3;
 
@@ -108,6 +115,11 @@ async function optimizeSession({ builderId, mode, timeBudgetMin, maxParallel })
   // whose blocker had been resolved stayed invisible here. A comment asking the
   // next editor to remember is not enforcement: tests/claimable_blocker_status.mjs
   // now asserts this file, db-tasks.js and the migration carry the same predicate.
+  // task 1004950 / ADR 0395: recommend only what this builder can do — the same
+  // rule as listClaimableTasks. An autonomous plan runs unattended, so it never
+  // holds `owner` (an agent cannot make the owner's decision).
+  const caps = await resolveCapabilities(builderId);
+  const feedCaps = mode === 'autonomous' ? caps.filter((c) => c !== 'owner') : caps;
   const { rows } = await pool.query(
     `SELECT ct.*, sf.fits_session_modes, sf.credits_per_minute
        FROM (
@@ -120,6 +132,7 @@ ${OPEN_BLOCKER_GUARD}${UNSHIPPED_DEPS_GUARD}
               SELECT 1 FROM claims c
                 JOIN tasks t2 ON t2.id = c.task_id
                WHERE c.released_at IS NULL
+                 AND ${PAGE_MARKER_GUARD}
                  AND t2.touches && t.touches
             )
        ) ct
@@ -142,6 +155,7 @@ ${OPEN_BLOCKER_GUARD}${UNSHIPPED_DEPS_GUARD}
            FROM tasks t
        ) sf ON sf.id = ct.id
       WHERE $1 = ANY(sf.fits_session_modes)
+        AND ${feedNeedsClause('ct', '$3')}
         AND NOT EXISTS (
           SELECT 1 FROM claims c
            WHERE c.task_id = ct.id
@@ -152,7 +166,7 @@ ${OPEN_BLOCKER_GUARD}${UNSHIPPED_DEPS_GUARD}
                ct.priority ASC NULLS LAST,
                COALESCE(ct.est_minutes_calibrated, ct.est_minutes) ASC NULLS LAST,
                ct.id ASC`,
-    [mode, builderId]
+    [mode, builderId, feedCaps]
   );
 
   const chosen = [];