@bongos/core 1.23.5 → 1.23.7

package/modules/onboarding/routes/access-requests.js

@@ -357,9 +357,12 @@ module.exports = function buildAccessRequestsRouter() {
   // (the device_code is spent), so the CLI can't re-poll the flow — it polls this
   // instead, then restarts sign-in once admitted. Exposes nothing the public POST
   // above doesn't already reveal through its 409s (already_member / already_approved).
-  // status ∈ member | invited | expired | pending | dismissed | none; admitted =
-  // member||invited. `expired` is an invite past its 30 days (task 1002969): the door
-  // is shut, and the CLI stops waiting rather than polling a door that will not open.
+  // status ∈ member | invited | not_admitted; admitted = member||invited (ADR 0217 D4,
+  // task 1003359). `not_admitted` covers pending, declined, a lapsed invite and no
+  // request at all, so a caller who is not the subject cannot learn that someone
+  // applied here or was turned down. It does NOT close the membership oracle —
+  // `admitted` still answers that, and the limiter below is what bounds enumeration.
+  // A lapsed invite answering `not_admitted` rather than `expired` amends ADR 0356 D4.
   // rank: public — a would-be builder is by definition outside the system.
   // Declared BEFORE `GET /access-requests` so the literal `/status` path is matched
   // as its own route (not swallowed as a query on the list route).
@@ -370,9 +373,7 @@ module.exports = function buildAccessRequestsRouter() {
   // per-IP budget: core's GET /auth/web/admission-status (the boolean twin of
   // this answer) mounts the very same instance, so the two cannot be alternated
   // for double the rate. The limiter runs before the queries, so a refused probe
-  // costs no DB work. Whether the ANSWER should also collapse — so a caller who
-  // is not the subject cannot tell pending/dismissed/none apart — is the owner's
-  // call and is filed as a blocker, not decided here.
+  // costs no DB work.
   router.get('/access-requests/status', accountExistenceReadRateLimit, async (req, res) => {
     const login = normalizeLogin(req.query.github_login);
     if (!GITHUB_LOGIN_RE.test(login)) {
@@ -386,7 +387,7 @@ module.exports = function buildAccessRequestsRouter() {
       if (member.rows.length > 0) {
         return res.json({ github_login: login, status: 'member', admitted: true });
       }
-      // Prefer an invite that still admits, else the most recent request.
+      // A live invite sorts first, so the top row admits only if it is one.
       const ar = await pool.query(
         `SELECT status, (status = 'invited' AND ${inviteExpiredSql()}) AS expired
            FROM access_requests
@@ -396,8 +397,8 @@ module.exports = function buildAccessRequestsRouter() {
         [login]
       );
       const top = ar.rows[0];
-      const status = !top ? 'none' : top.expired ? 'expired' : top.status;
-      return res.json({ github_login: login, status, admitted: status === 'invited' });
+      const invited = !!top && top.status === 'invited' && !top.expired;
+      return res.json({ github_login: login, status: invited ? 'invited' : 'not_admitted', admitted: invited });
     } catch (err) {
       console.error('[gds] GET /access-requests/status', err);
       return res.fail('status_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.5",
+  "version": "1.23.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.5",
+      "version": "1.23.7",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.5",
+  "version": "1.23.7",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10413,5 +10413,21 @@
       "id": "1004895",
       "text": "A broken module version can now be pulled back from the store, so new installs and updates stop getting it while projects that already have it are told."
     }
+  ],
+  "1.23.6": [
+    {
+      "id": "1004894",
+      "text": "Module authors can now set a price for their module, in money or credits; paid modules show their price and are marked not yet buyable until buying opens."
+    },
+    {
+      "id": "1003359",
+      "text": "People checking whether someone has applied to a project can no longer tell a pending, declined or never-filed request apart, and the sign-in tool no longer promises an approval that may never come."
+    }
+  ],
+  "1.23.7": [
+    {
+      "id": "1004896",
+      "text": "Builders can now take a module they installed from the store back off their project with one command; its folder is kept aside so nothing is lost."
+    }
   ]
 }

package/scripts/bongos/login.js

@@ -43,17 +43,24 @@ function normalizeInstanceBase(raw) {
   return s;
 }
 
-// Decide what an /access-requests/status poll means for the sign-in loop.
+// Decide what an /access-requests/status poll means for the sign-in loop. The probe
+// answers only admitted or not (ADR 0217 D4), so anything else is a wait — even an
+// older instance's `dismissed`/`expired`, which the loop no longer reads.
 function pollDecision(body) {
   if (!body || typeof body !== 'object') return 'wait';
   if (body.admitted === true) return 'admitted';
   if (body.status === 'member' || body.status === 'invited') return 'admitted';
-  if (body.status === 'dismissed') return 'dismissed';
-  // An invite past its 30 days (task 1002969): the door is shut until they invite again.
-  if (body.status === 'expired') return 'expired';
   return 'wait';
 }
 
+// What the loop says when it stops waiting. It cannot know whether the request is
+// still pending, was declined, or rode a lapsed invite, so it promises nothing.
+function waitTimeoutMessage(base) {
+  return "✖ Stopped waiting after 30 minutes — you haven't been let in yet. If your request was turned down "
+    + "or your invite has run out, waiting longer won't change that. Ask the project's owner, "
+    + `then re-run \`bongos login ${base}\`.`;
+}
+
 // --- I/O helpers -------------------------------------------------------------
 
 async function fetchJson(url, opts = {}) {
@@ -300,16 +307,8 @@ async function main() {
         log('\n  ✓ Approved! Finishing sign-in — approve once more in your browser.');
         break;
       }
-      if (decision === 'dismissed') {
-        console.error('\n✖ your access request was declined.');
-        process.exit(1);
-      }
-      if (decision === 'expired') {
-        console.error('\n✖ your invite has expired — ask the project to invite you again.');
-        process.exit(1);
-      }
       if (Date.now() > admitDeadline) {
-        console.error('\n✖ timed out waiting for approval — re-run `bongos login` once an Archon has approved you.');
+        console.error(`\n${waitTimeoutMessage(base)}`);
         process.exit(1);
       }
       process.stdout.write('.');
@@ -357,4 +356,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { normalizeInstanceBase, pollDecision, runDeviceFlow, logOtherInstances };
+module.exports = { normalizeInstanceBase, pollDecision, waitTimeoutMessage, runDeviceFlow, logOtherInstances };

package/scripts/bongos/module-remove.js

@@ -0,0 +1,122 @@
+'use strict';
+//
+// scripts/bongos/module-remove.js — `bongos module remove <key>`: take a module this
+// project installed from the store back off it (task 1004896, goal 1000091).
+//
+// WHY it moves the folder aside instead of deleting it. Install places a store
+// module under the instance's own modules/, which is also where a project keeps the
+// modules it builds itself; the only thing that tells the two apart is whether the
+// store knows the key. A wrong guess must cost nothing, so the folder is MOVED to
+// var/removed-modules/<key>-<version>-<stamp>/ and the command says where: putting it
+// back is one move, and deleting it for good is a separate, deliberate step.
+//
+// What it refuses, before touching anything:
+//   - a module the core ships (it is the core's, not this project's);
+//   - a module that is switched on — in config/env here, or in the hall's on/off
+//     switch when the server answers — because the loader would mount a module whose
+//     files are gone;
+//   - a key the store does not know: that is this project's own code, not a store copy.
+// What it leaves alone, on purpose (owner, 2026-10-26): the module's database tables
+// (reinstalling brings the data back; the output says so), and the entitlement (a
+// paid module can be installed again without paying twice). Nothing on the server is
+// written: update checks and install reports read the modules on disk, so once the
+// folder is gone they stop on their own.
+//
+// It lives in its own file because scripts/bongos/module.js sits near the 1,500-line
+// ratchet; module.js dispatches to it and re-exports cmdRemove.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { KEY_RE } = require('../../src/module-loader/manifest-schema');
+
+const REMOVE_USAGE = 'usage: bongos module remove <key>';
+
+// Where removed folders go: <instance root>/var/removed-modules (beside the other
+// instance-local state the core keeps under var/, never inside the core package).
+function removedModulesDir(instanceRoot) {
+  return path.join(instanceRoot, 'var', 'removed-modules');
+}
+
+// A filesystem-safe timestamp for the parked folder's name. Pure.
+function stamp(now) {
+  return now.toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z');
+}
+
+// Is the key switched on in the hall's switch? true / false, or null when the
+// server could not say (offline, older core) — then the local verdict stands.
+async function hallEnabled(call, key) {
+  try {
+    const res = await call('GET', '/modules');
+    if (!res.ok || !res.data || !Array.isArray(res.data.modules)) return null;
+    const row = res.data.modules.find((m) => m.key === key);
+    return row ? row.enabled === true : null;
+  } catch { return null; }
+}
+
+async function cmdRemove(args, {
+  log = console.log, errlog = console.error,
+  gather, request, storeRequest, storeError,
+  instanceRoot = require('../../src/instance-config').resolveInstanceRoot(),
+  now = () => new Date(),
+} = {}) {
+  const key = args[0];
+  if (!key || key.startsWith('--') || !KEY_RE.test(key)) {
+    errlog('bongos module remove: name the module — a lowercase kebab-case key');
+    errlog(REMOVE_USAGE);
+    return 2;
+  }
+
+  const dir = path.join(instanceRoot, 'modules', key);
+  let rows = [];
+  try { rows = gather().rows; } catch (e) { errlog(`bongos module remove: ${e.message}`); return 1; }
+  const row = rows.find((r) => r.key === key);
+  if (row && row.source === 'core') {
+    errlog(`REFUSING: "${key}" ships with the core, not from the store. Switch it off instead if you do not want it.`);
+    return 1;
+  }
+  if (!fs.existsSync(dir)) {
+    errlog(`REFUSING: "${key}" is not installed in this project (no modules/${key}/ folder).`);
+    return 1;
+  }
+  if (row && row.enabled) {
+    errlog(`REFUSING: "${key}" is switched on. Switch it off first — remove "${key}": true from config/modules.json (or its <PREFIX>_MODULE_ setting) — then run this again.`);
+    return 1;
+  }
+
+  let call;
+  try { call = request || storeRequest(); }
+  catch (e) { errlog(`bongos module remove: ${e.message}`); return 1; }
+  if (await hallEnabled(call, key) === true) {
+    errlog(`REFUSING: "${key}" is switched on in the hall's Modules tab. Switch it off there first, then run this again.`);
+    return 1;
+  }
+  let res;
+  try { res = await call('GET', `/store/modules/${encodeURIComponent(key)}/listing`); }
+  catch (e) { errlog(`bongos module remove: the store could not be reached — ${e.message}`); return 1; }
+  if (res.status === 404) {
+    errlog(`REFUSING: the store has no module "${key}", so modules/${key}/ is this project's own code, not a store copy. Nothing was moved; delete it by hand if you mean to.`);
+    return 1;
+  }
+  if (!res.ok) { errlog(`bongos module remove: the store answered ${storeError(res)}`); return 1; }
+
+  const version = (row && row.version) || 'unknown';
+  const parked = path.join(removedModulesDir(instanceRoot), `${key}-${version}-${stamp(now())}`);
+  try {
+    fs.mkdirSync(path.dirname(parked), { recursive: true });
+    // A `*` .gitignore, so a parked folder never dirties the instance tree that
+    // `bongos upgrade` requires clean (the var/task-visuals precedent, task 1004381).
+    const ignore = path.join(path.dirname(parked), '.gitignore');
+    if (!fs.existsSync(ignore)) fs.writeFileSync(ignore, '*\n');
+    fs.renameSync(dir, parked);
+  } catch (e) {
+    errlog(`bongos module remove: could not move modules/${key}/ aside — ${e.message}. Nothing was removed.`);
+    return 1;
+  }
+  log(`✓ Removed "${key}" ${version} from this project.`);
+  log(`  Its folder was moved to ${path.relative(instanceRoot, parked)} — move it back to modules/${key}/ to undo, or delete it when you are sure.`);
+  log('  Its database tables were left in place, so reinstalling brings its data back.');
+  log(`  You still own it: \`bongos module install ${key}\` puts it back without buying it again.`);
+  return 0;
+}
+
+module.exports = { cmdRemove };

package/scripts/bongos/module-store-cli.js

@@ -0,0 +1,182 @@
+'use strict';
+//
+// scripts/bongos/module-store-cli.js — the module STORE from the terminal: the store
+// client every store verb calls, and `bongos module store` / `bongos module price`
+// (tasks 1003811, 1004894). Carved out of scripts/bongos/module.js, which requires
+// and re-exports all of it, so `bongos module <verb>` and every importer are
+// unchanged.
+//
+// WHY its own file. module.js crossed the 1,500-line ratchet (fitness.js) when the
+// price command landed, and these pieces share one concern — talking to the store —
+// while the rest of module.js works on the checkout's own modules/ tree.
+//
+// Like module.js it may be required by the server process, so cli-lib's
+// session/fetch plumbing is required lazily inside storeRequest, never at load.
+
+const { KEY_RE } = require('../../src/module-loader/manifest-schema');
+
+// The store half of the CLI, over three calls (src/bongos/routes/modules.js):
+// acquire (take the entitlement, learn the version), download the tarball, and
+// once the files are placed, record the version acquired. Injected in tests.
+function storeRequest() {
+  // Lazy require — cli-lib's session/fetch plumbing must never load in the server
+  // process, which requires this file too (the same reason cmdPublish gives).
+  const { readSessionToken, dispatchedFetch, noKeepAliveDispatcher, CLI_USER_AGENT } = require('./cli-lib');
+  const session = readSessionToken();
+  if (!session) throw new Error('no Bongos session — run `bongos setup` first');
+  const call = async (method, urlPath, { json, binary = false } = {}) => {
+    const res = await dispatchedFetch(`${session.apiBase}/api/bongos${urlPath}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${session.token}`, 'User-Agent': CLI_USER_AGENT,
+        ...(json ? { 'Content-Type': 'application/json' } : {}),
+      },
+      body: json ? JSON.stringify(json) : undefined,
+      dispatcher: noKeepAliveDispatcher(),
+    });
+    if (binary && res.ok) return { ok: true, status: res.status, buf: Buffer.from(await res.arrayBuffer()) };
+    const text = await res.text();
+    let data;
+    try { data = text ? JSON.parse(text) : null; } catch { data = { raw: text }; }
+    return { ok: res.ok, status: res.status, data };
+  };
+  // Where the store lives, so install can print a full link to the how-to page.
+  call.apiBase = session.apiBase;
+  return call;
+}
+
+// The hall page that shows a version's HOWTO.md (task 1004366) — the Modules tab,
+// opened on one version. null when the version shipped without one (published
+// before ADR 0347's gate), so install never prints a link that would 404.
+function howtoLink(key, version, files, apiBase) {
+  if (!files.some((f) => f.path === 'HOWTO.md')) return null;
+  const p = `/builders/modules?howto=${encodeURIComponent(key)}&version=${encodeURIComponent(version)}`;
+  return apiBase ? `${String(apiBase).replace(/\/+$/, '')}${p}` : p;
+}
+
+function storeError(res) {
+  const err = res.data && (res.data.error || res.data);
+  return (err && (err.message || err.code)) || `HTTP ${res.status}`;
+}
+
+// ---------------------------------------------------------------------------
+// bongos module store — what the store lists (task 1003811)
+// ---------------------------------------------------------------------------
+
+const STORE_USAGE = 'usage: bongos module store [--sort <part>] [--max-cents N] [--max-credits N] [--json]';
+
+// The query GET /store/modules takes, from argv. Returns { query } or { error }.
+// The server checks the values too; this only refuses what is not a value at all.
+function storeQuery(args) {
+  const params = [];
+  for (const [flag, param] of [['--sort', 'sort'], ['--max-cents', 'max_cents'], ['--max-credits', 'max_credits']]) {
+    const i = args.indexOf(flag);
+    if (i === -1) continue;
+    const v = args[i + 1];
+    if (!v || v.startsWith('--')) return { error: `${flag} needs a value` };
+    params.push(`${param}=${encodeURIComponent(v)}`);
+  }
+  return { query: params.length ? `?${params.join('&')}` : '' };
+}
+
+function formatPrice(price) {
+  if (!price || price.free) return 'free';
+  const parts = [];
+  if (price.cents != null) parts.push(`$${(price.cents / 100).toFixed(2)}`);
+  if (price.credits != null) parts.push(`${price.credits} credits`);
+  return parts.join(' or ') || 'free';
+}
+
+function formatPlace(category) {
+  if (!category) return '';
+  return category.label ? `${category.parent_title} › ${category.label}` : category.parent_title;
+}
+
+// Pure renderer over the GET /store/modules body. It keeps the server's order and
+// adds nothing to it: listed in rank, then New, never ranked.
+function formatStore(body) {
+  const out = [];
+  out.push('bongos module store — what the store lists, best first');
+  out.push(`  floor ${body.floor} out of 100 · at most ${body.cap} per sub-category`);
+  out.push(`  ${body.ranking}`);
+  if (body.sort) {
+    const part = (body.sort_parts || []).find((x) => x.part === body.sort);
+    out.push(`  sorted by ${part ? part.title : body.sort}`);
+  }
+  const max = body.max_price;
+  if (max) out.push(`  at most ${[max.cents != null ? `$${(max.cents / 100).toFixed(2)}` : null, max.credits != null ? `${max.credits} credits` : null].filter(Boolean).join(' or ')}`);
+  out.push('');
+  const listed = body.listed || [];
+  if (!listed.length) out.push('  Nothing is listed yet.');
+  listed.forEach((m, i) => {
+    out.push(`  ${String(i + 1).padStart(2)}. ${m.key}@${m.version}  ${m.overall}/100  ${formatPrice(m.price)}${m.buyable === false ? ' (not yet buyable)' : ''}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
+  });
+  const fresh = body.new || [];
+  if (fresh.length) {
+    out.push('');
+    out.push('  New — not ranked until projects have installed and used them:');
+    for (const m of fresh) out.push(`      ${m.key}@${m.version}  ${formatPrice(m.price)}${m.buyable === false ? ' (not yet buyable)' : ''}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
+  }
+  out.push('');
+  out.push('  Why a module is not here: GET /store/modules/<key>/listing');
+  return out.join('\n');
+}
+
+async function cmdStore(args, { log = console.log, errlog = console.error, request } = {}) {
+  const q = storeQuery(args);
+  if (q.error) { errlog(`bongos module store: ${q.error}`); errlog(STORE_USAGE); return 2; }
+  let call;
+  try { call = request || storeRequest(); }
+  catch (e) { errlog(`bongos module store: ${e.message}`); return 1; }
+  let res;
+  try { res = await call('GET', `/store/modules${q.query}`); }
+  catch (e) { errlog(`bongos module store: the store could not be reached — ${e.message}`); return 1; }
+  if (!res.ok) { errlog(`bongos module store: the store answered ${storeError(res)}`); return res.status === 400 ? 2 : 1; }
+  if (args.includes('--json')) { log(JSON.stringify(res.data, null, 2)); return 0; }
+  log(formatStore(res.data || {}));
+  return 0;
+}
+
+// ---------------------------------------------------------------------------
+// bongos module price — the author sets a module's price (task 1004894)
+// ---------------------------------------------------------------------------
+
+const PRICE_USAGE = 'usage: bongos module price <key> [--cents N] [--credits N]   (0 in either makes it free)';
+
+// argv -> { key, cents, credits } or { error }. Pure.
+function priceArgs(args) {
+  const key = args[0];
+  if (!key || key.startsWith('--') || !KEY_RE.test(key)) return { error: 'name the module: a lowercase kebab-case key' };
+  const out = { key, cents: null, credits: null };
+  for (const [flag, field] of [['--cents', 'cents'], ['--credits', 'credits']]) {
+    const i = args.indexOf(flag);
+    if (i === -1) continue;
+    const v = args[i + 1];
+    if (!v || !/^\d{1,9}$/.test(v)) return { error: `${flag} needs a whole number, 0 or more` };
+    out[field] = Number(v);
+  }
+  if (out.cents === null && out.credits === null) return { error: 'give --cents, --credits or both' };
+  return out;
+}
+
+async function cmdPrice(args, { log = console.log, errlog = console.error, request } = {}) {
+  const p = priceArgs(args);
+  if (p.error) { errlog(`bongos module price: ${p.error}`); errlog(PRICE_USAGE); return 2; }
+  let call;
+  try { call = request || storeRequest(); }
+  catch (e) { errlog(`bongos module price: ${e.message}`); return 1; }
+  let res;
+  try { res = await call('POST', `/store/modules/${encodeURIComponent(p.key)}/price`, { json: { cents: p.cents, credits: p.credits } }); }
+  catch (e) { errlog(`bongos module price: the store could not be reached — ${e.message}`); return 1; }
+  if (!res.ok) { errlog(`bongos module price: the store answered ${storeError(res)}`); return res.status === 400 ? 2 : 1; }
+  const withFree = (p) => ({ ...p, free: p.cents === 0 || p.credits === 0 });
+  const shown = formatPrice(withFree(res.data.price));
+  const was = res.data.previous ? formatPrice(withFree(res.data.previous)) : 'free (no price set)';
+  log(`✓ "${p.key}" now costs ${shown} (was ${was}).`);
+  if (shown !== 'free') log('  Buying is not open yet, so the store lists it as not yet buyable until it is.');
+  return 0;
+}
+
+module.exports = {
+  storeRequest, storeError, howtoLink, formatStore, cmdStore, priceArgs, cmdPrice,
+};