@bongos/core 1.24.44 → 1.24.46

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 684 operations across 85 resource groups
+- 686 operations across 85 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -195,6 +195,10 @@ function createClient(opts = {}) {
       postAuthRevoke: (args) => request("POST", "/auth/revoke", { hasBody: true }, args),
       // POST /auth/revoke-all — rank: archon — POST /auth/revoke-all
       postAuthRevokeAll: (args) => request("POST", "/auth/revoke-all", { hasBody: true }, args),
+      // POST /auth/runner-code/exchange — rank: public — POST /auth/runner-code/exchange
+      postAuthRunnerCodeExchange: (args) => request("POST", "/auth/runner-code/exchange", { hasBody: true }, args),
+      // POST /auth/runner-code/issue — rank: metic+archon — POST /auth/runner-code/issue
+      postAuthRunnerCodeIssue: (args) => request("POST", "/auth/runner-code/issue", { hasBody: true }, args),
       // GET /auth/web/admission-status — rank: public — GET /auth/web/admission-status
       getAuthWebAdmissionStatus: (args) => request("GET", "/auth/web/admission-status", { hasBody: false }, args),
       // GET /auth/web/callback — rank: public — GET /auth/web/callback

package/clients/bongos-client/index.cjs

@@ -194,6 +194,10 @@ function createClient(opts = {}) {
       postAuthRevoke: (args) => request("POST", "/auth/revoke", { hasBody: true }, args),
       // POST /auth/revoke-all — rank: archon — POST /auth/revoke-all
       postAuthRevokeAll: (args) => request("POST", "/auth/revoke-all", { hasBody: true }, args),
+      // POST /auth/runner-code/exchange — rank: public — POST /auth/runner-code/exchange
+      postAuthRunnerCodeExchange: (args) => request("POST", "/auth/runner-code/exchange", { hasBody: true }, args),
+      // POST /auth/runner-code/issue — rank: metic+archon — POST /auth/runner-code/issue
+      postAuthRunnerCodeIssue: (args) => request("POST", "/auth/runner-code/issue", { hasBody: true }, args),
       // GET /auth/web/admission-status — rank: public — GET /auth/web/admission-status
       getAuthWebAdmissionStatus: (args) => request("GET", "/auth/web/admission-status", { hasBody: false }, args),
       // GET /auth/web/callback — rank: public — GET /auth/web/callback

package/clients/bongos-client/index.d.ts

@@ -326,6 +326,10 @@ export interface PostAuthRevokeAllRequest { builder_id?: StringifiableId }
 export interface PostAuthRevokeAllResponse { ok: boolean; revoked: unknown }
 export interface PostAuthRevokeRequest { session_id?: StringifiableId }
 export interface PostAuthRevokeResponse { ok: boolean; revoked: unknown }
+export interface PostAuthRunnerCodeExchangeRequest { code: string }
+export interface PostAuthRunnerCodeExchangeResponse { ok: boolean; token: unknown; session_id: unknown; builder_login: unknown; label: unknown; api_base: unknown }
+export interface PostAuthRunnerCodeIssueRequest { label?: string }
+export interface PostAuthRunnerCodeIssueResponse { ok: boolean; code: unknown; expires_at: unknown; api_base: unknown }
 export interface PostAutonomyBuildersBuilderIdPauseRequest { paused: boolean; reason?: string }
 export interface PostAutonomyFenceGoalsRequest { goal_id: StringifiableId; note?: string }
 export interface PostAutonomyFenceGoalsResponse { goal: unknown }
@@ -847,6 +851,10 @@ export interface BongosClient {
     postAuthRevoke(args?: RequestArgs & { body?: PostAuthRevokeRequest }): Promise<PostAuthRevokeResponse>;
     /** POST /auth/revoke-all — rank: archon */
     postAuthRevokeAll(args?: RequestArgs & { body?: PostAuthRevokeAllRequest }): Promise<PostAuthRevokeAllResponse>;
+    /** POST /auth/runner-code/exchange — rank: public */
+    postAuthRunnerCodeExchange(args: RequestArgs & { body: PostAuthRunnerCodeExchangeRequest }): Promise<PostAuthRunnerCodeExchangeResponse>;
+    /** POST /auth/runner-code/issue — rank: metic+archon */
+    postAuthRunnerCodeIssue(args?: RequestArgs & { body?: PostAuthRunnerCodeIssueRequest }): Promise<PostAuthRunnerCodeIssueResponse>;
     /** GET /auth/web/admission-status — rank: public */
     getAuthWebAdmissionStatus(args?: RequestArgs): Promise<GetAuthWebAdmissionStatusResponse>;
     /** GET /auth/web/callback — rank: public */

package/clients/bongos-client/index.mjs

@@ -191,6 +191,10 @@ export function createClient(opts = {}) {
       postAuthRevoke: (args) => request("POST", "/auth/revoke", { hasBody: true }, args),
       // POST /auth/revoke-all — rank: archon — POST /auth/revoke-all
       postAuthRevokeAll: (args) => request("POST", "/auth/revoke-all", { hasBody: true }, args),
+      // POST /auth/runner-code/exchange — rank: public — POST /auth/runner-code/exchange
+      postAuthRunnerCodeExchange: (args) => request("POST", "/auth/runner-code/exchange", { hasBody: true }, args),
+      // POST /auth/runner-code/issue — rank: metic+archon — POST /auth/runner-code/issue
+      postAuthRunnerCodeIssue: (args) => request("POST", "/auth/runner-code/issue", { hasBody: true }, args),
       // GET /auth/web/admission-status — rank: public — GET /auth/web/admission-status
       getAuthWebAdmissionStatus: (args) => request("GET", "/auth/web/admission-status", { hasBody: false }, args),
       // GET /auth/web/callback — rank: public — GET /auth/web/callback

package/docs/adr/0307-autobongos-a-deterministic-supervisor-and-agentic-workers.md

@@ -156,6 +156,21 @@ the declared-touches gate above leaves. The list covers the files that implement
 those checks; the one route line that calls the server check sits in a protected
 file, and a test on the list drives that route.
 
+**The runner signs in with its own login** (task 1004547, goal 1000139; owner
+decisions 2026-11-06). Until then a worker ran under its builder's CLI session, so
+the server knew a runner's claim only by the worktree name the runner chose, and a
+worker carried its installer's full authority, enough to move a live core pin (found
+by task 1004974). Now a Metic+ builder issues a one-time code from the hall (a
+browser cookie only, so no token can mint a login; single use; 15 minutes), and the
+PC trades it for a session of source `runner` (`src/bongos/runner-login.js`). Three
+things follow, all server-side. Every claim that login makes carries
+`claims.autonomous`, set from the session and never the body, and the publish guard
+reads it, so a renamed worktree no longer hides a runner. The login **acts at Metic
+at most** and **holds no system permission**, so the kill switch, rank changes and
+core moves are out of its reach, and the project-owner door to a core move is shut to
+it. Removing the PC is the ordinary own-session revoke. The worktree-name check is
+kept for runners not yet moved to their own login.
+
 ### 7. Workers run with blanket `bypassPermissions`
 
 `--permission-prompt-tool` exists and is print-mode only, so routing every

package/docs/api/openapi.json

@@ -2356,6 +2356,94 @@
         ]
       }
     },
+    "/auth/runner-code/exchange": {
+      "post": {
+        "operationId": "post_auth_runner_code_exchange",
+        "tags": [
+          "auth"
+        ],
+        "summary": "POST /auth/runner-code/exchange",
+        "description": "POST /auth/runner-code/exchange — task 1004547. The PC sends the one-time code and gets back its own login (a 'runner' session). Body: { code }. rank: public — auth establishment; the one-time code is the bearer. A wrong, used or expired code all answer the same 401, so nothing is learned from which. The router's per-IP write limit (rateLimitMiddleware) is its abuse ceiling; the code is 256 bits, so guessing one is not a race worth a limiter of its own.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/auth.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAuthRunnerCodeExchangeRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostAuthRunnerCodeExchangeResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
+    "/auth/runner-code/issue": {
+      "post": {
+        "operationId": "post_auth_runner_code_issue",
+        "tags": [
+          "auth"
+        ],
+        "summary": "POST /auth/runner-code/issue",
+        "description": "POST /auth/runner-code/issue — task 1004547 (goal 1000139). A ONE-TIME CODE an Autobongos PC trades for its own login (src/bongos/runner-login.js). Body: { label? } — the PC's name, shown later in the builder's sessions list. rank: metic+archon — running a runner is Metic+ today (owner, 2026-11-06). Cookie ONLY, like /auth/cli-token/issue: a bearer — a CLI token or a runner's own login — must never be able to mint another login. The code is returned once; only its hash is stored. It works once and expires in 15 minutes.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/auth.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAuthRunnerCodeIssueRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostAuthRunnerCodeIssueResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/auth/web/admission-status": {
       "get": {
         "operationId": "get_auth_web_admission_status",
@@ -36146,6 +36234,67 @@
           "revoked"
         ]
       },
+      "PostAuthRunnerCodeExchangeRequest": {
+        "type": "object",
+        "properties": {
+          "code": {
+            "type": "string",
+            "maxLength": 200
+          }
+        },
+        "required": [
+          "code"
+        ],
+        "additionalProperties": false
+      },
+      "PostAuthRunnerCodeExchangeResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "token": {},
+          "session_id": {},
+          "builder_login": {},
+          "label": {},
+          "api_base": {}
+        },
+        "required": [
+          "ok",
+          "token",
+          "session_id",
+          "builder_login",
+          "label",
+          "api_base"
+        ]
+      },
+      "PostAuthRunnerCodeIssueRequest": {
+        "type": "object",
+        "properties": {
+          "label": {
+            "type": "string",
+            "maxLength": 200
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostAuthRunnerCodeIssueResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "code": {},
+          "expires_at": {},
+          "api_base": {}
+        },
+        "required": [
+          "ok",
+          "code",
+          "expires_at",
+          "api_base"
+        ]
+      },
       "PostAutonomyBuildersBuilderIdPauseRequest": {
         "type": "object",
         "properties": {
@@ -42907,9 +43056,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 684,
-  "x-schema-count": 719,
+  "x-endpoint-count": 686,
+  "x-schema-count": 723,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 457,
+  "x-response-schemas": 459,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 684 endpoints across 117 route files.
+> **Generated from the live route files** — the route file is authoritative. 686 endpoints across 117 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -78,7 +78,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/audit-log` | `metic+archon` | — | GET /api/bongos/audit-log?limit=&offset=&builder_id=&method= Paginated, newest-first. |
 
-## `auth` (21)
+## `auth` (23)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -98,6 +98,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/auth/logout` | `any-builder` | — | own session, no rank gate (a Xenos can log themselves out). |
 | POST | `/api/bongos/auth/revoke` | `archon` | `session_id` | POST /auth/revoke — V3.R38 / task 259. |
 | POST | `/api/bongos/auth/revoke-all` | `archon` | `builder_id` | POST /auth/revoke-all — V3.R38 / task 259. |
+| POST | `/api/bongos/auth/runner-code/exchange` | `public` | `code` | POST /auth/runner-code/exchange — task 1004547. |
+| POST | `/api/bongos/auth/runner-code/issue` | `metic+archon` | `label` | POST /auth/runner-code/issue — task 1004547 (goal 1000139). |
 | GET | `/api/bongos/auth/web/admission-status` | `public` | — | GET /auth/web/admission-status?login=X — the probe renderAccessPendingPage polls (task 1002097). |
 | GET | `/api/bongos/auth/web/callback` | `public` | — | OAuth callback; the state cookie + code are the bearer. |
 | GET | `/api/bongos/auth/web/callback/link` | `public` | — | the OAuth callback for linking; the state cookie + code are the bearer, and the live session cookie names the person (no session: <redacted> |