@bongos/core 1.24.5 → 1.24.7

package/modules/ui-design/kit/serve.js

@@ -580,6 +580,27 @@ function myGuilds(res) {
   }));
   return json(res, 200, { guilds: mine, count: mine.length });
 }
+// GET/DELETE /me/sign-in-methods (the account page's ways to sign in, task 1004995).
+// The fixture builder is GitHub-born with Google linked, held for the run so a
+// Remove reads back. Each way in carries the route's own unlink_refused, by
+// account-logins.js unlinkRefusal's rule, and DELETE refuses as the route does.
+let _ways = null;
+function waysHeld() { return _ways || (_ways = [{ provider: 'github', email: null }, { provider: 'google', email: 'octo@example.com' }]); }
+function wayRefusal(provider, count) { return provider === 'github' ? 'born_with' : count <= 1 ? 'last_way_in' : null; }
+function signInMethods(res) {
+  const held = waysHeld();
+  return json(res, 200, { methods: held.map((m) => ({ ...m, unlink_refused: wayRefusal(m.provider, held.length) })), providers: ['github', 'google'] });
+}
+function signInMethodDelete(res, provider) {
+  const held = waysHeld();
+  if (!['github', 'google'].includes(provider)) return refuse(res, 404, 'unknown_provider', 'unknown_provider');
+  if (!held.some((m) => m.provider === provider)) return refuse(res, 404, 'not_linked', 'that way in is not linked to your account');
+  const why = wayRefusal(provider, held.length);
+  if (why === 'born_with') return refuse(res, 409, why, 'your account was made with GitHub, so GitHub stays linked');
+  if (why) return refuse(res, 409, why, 'this is your only way in, so it cannot be removed — link another first');
+  _ways = held.filter((m) => m.provider !== provider);
+  return json(res, 200, { ok: true });
+}
 function myGuildRequests(res) {
   const q = heldFixture('me__guild-requests');
   const owner = ownedRequests();
@@ -790,6 +811,9 @@ const server = http.createServer((req, res) => {
     if (guild && guild[2] === '/membership' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => guildMembershipPatch(res, guild[1], body)) : json(res, 401, UNAUTH);
     if (guild && guild[2] === '/engagements' && req.method === 'POST') return AUTH ? readBody(req, (body) => guildEngagementPost(res, guild[1], body)) : json(res, 401, UNAUTH);
     if (rest === '/me/guilds' && req.method === 'GET') return AUTH ? myGuilds(res) : json(res, 401, UNAUTH);
+    if (rest === '/me/sign-in-methods' && req.method === 'GET') return AUTH ? signInMethods(res) : json(res, 401, UNAUTH);
+    const way = rest.match(/^\/me\/sign-in-methods\/([^/]+)$/);
+    if (way && req.method === 'DELETE') return AUTH ? signInMethodDelete(res, way[1]) : json(res, 401, UNAUTH);
     if (rest === '/me/guild-requests' && req.method === 'GET') return AUTH ? myGuildRequests(res) : json(res, 401, UNAUTH);
     if (rest === '/community/leaderboard' && req.method === 'GET') return communityBoard(res, u, origin);
     if (rest === '/community/search' && req.method === 'GET') return communitySearch(res, u, origin);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.5",
+  "version": "1.24.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.5",
+      "version": "1.24.7",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.5",
+  "version": "1.24.7",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10853,5 +10853,29 @@
       "id": "1005006",
       "text": "The Treasury screen now counts builder rewards in credits instead of dollars, and no longer says one credit is a dollar."
     }
+  ],
+  "1.24.6": [
+    {
+      "id": "1004976",
+      "text": "A page tweak draft nobody has touched for a day now closes by itself, as the owner asked, and the words written so far stay saved on the task."
+    },
+    {
+      "id": "1005005",
+      "text": "Claiming several tasks at once now follows the same rule as claiming one: a work session that already has a task in progress in a folder cannot pile more tasks into that same folder."
+    },
+    {
+      "id": "1004988",
+      "text": "The database itself now refuses any credit entry that spends, redeems or transfers credits; only an undo of an earlier entry may take credits away, and existing records are untouched."
+    },
+    {
+      "id": "1004995",
+      "text": "On the account page, people can now link GitHub and Google to one account, both ways, so either one opens the same account with the same credits, ranks and history. They can remove one too, but never their last way in. Two exi"
+    }
+  ],
+  "1.24.7": [
+    {
+      "id": "1005003",
+      "text": "The automatic tweak limit is now 200 rounds a month, and a project owner can change it, for the whole project and separately for each builder rank, on the project settings page."
+    }
   ]
 }

package/scripts/bongos/run-unit-tests.js

@@ -259,6 +259,10 @@ const INTEGRATION = new Set([
   // task 1004914 (ADR 0385 D8): the payout gate tables from the real migration —
   // append-only, no silent hold, who may appeal, decide and co-sign, the gate end to end.
   'payout_gates_db',
+  // task 1004988 (ADR 0385 D2): credit_log from the real migration — Postgres
+  // refuses a spend, redemption or transfer row; only a reversal of an existing
+  // row may be negative, and core_194's clawback still books.
+  'credit_log_no_spend_db',
   // task 1004408: migration platform_identity_028 deletes the old hub invite's
   // pending rows before a cutoff it reads from the core_upgrades ledger. Only a real
   // engine runs the DO block, the numeric version compare and the one-shot guard.

package/src/bongos/auth-github.js

@@ -189,7 +189,8 @@ async function pollDeviceFlow(deviceCode, userAgent) {
     // admitted only if open enrollment is on OR an Archon marked their
     // access_request 'invited'. An EXISTING builder ALWAYS passes, so an approved
     // builder can never be locked out of CLI enrollment. See ADR 0050.
-    const existing = await getBuilderByGithubId(ghUser.id);
+    const personKey = await githubPersonKey(ghUser);
+    const existing = await getBuilderByGithubId(personKey);
     // Only consult the access_request table for a genuine first-timer (and only
     // when open enrollment is off) — an existing builder short-circuits to
     // ALWAYS-pass, matching completeWebFlow's `if (!existing)` lookup.
@@ -202,7 +203,7 @@ async function pollDeviceFlow(deviceCode, userAgent) {
       }
     }
     let builder = await upsertBuilder({
-      githubId: ghUser.id,
+      githubId: personKey,
       githubLogin: ghUser.login,
       displayName: ghUser.name || ghUser.login,
       avatarUrl: ghUser.avatar_url,
@@ -243,12 +244,26 @@ async function pollDeviceFlow(deviceCode, userAgent) {
 // hub provides the function, so every other instance skips it. The identity is
 // GitHub's answer for the exchanged code, never a request field. Best-effort: a
 // failed stamp must not cost the sign-in, and the next sign-in writes it.
-async function recordHubSignin(ghUser) {
+// Who a GitHub sign-in reaches (task 1004995, the ADR 0393 carry-over). On the
+// hub a GitHub account may be linked to someone who joined with Google, whose
+// builder row is keyed on their minted person key, not the GitHub id — so the
+// hub is asked first, or the sign-in would make that person a second account.
+// Off the hub there is no port and the GitHub id is the key, as it always was.
+// Not best-effort: if the hub cannot answer, the sign-in fails rather than guess.
+async function githubPersonKey(ghUser) {
+  const hub = seams.resolveOptional('platform-identity.hub');
+  if (!hub || typeof hub.personKeyForGithub !== 'function') return String(ghUser.id);
+  return (await hub.personKeyForGithub(String(ghUser.id))) || String(ghUser.id);
+}
+
+async function recordHubSignin(ghUser, personKey) {
   try {
     const hub = seams.resolveOptional('platform-identity.hub');
     if (!hub || typeof hub.recordHubSignin !== 'function') return;
     await hub.recordHubSignin({
-      githubId: String(ghUser.id),
+      githubId: String(personKey || ghUser.id),
+      githubUserId: String(ghUser.id),
+      email: typeof ghUser.email === 'string' ? ghUser.email : null,
       githubLogin: ghUser.login,
       displayName: ghUser.name || ghUser.login,
       avatarUrl: ghUser.avatar_url,
@@ -293,7 +308,8 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
   // so they cannot drift. An owner who wants fully-open self-enrollment sets
   // OTB_OPEN_XENOS_ENROLLMENT truthy (no code change); default = invite required.
   // See ADR 0050.
-  const existing = await getBuilderByGithubId(ghUser.id);
+  const personKey = await githubPersonKey(ghUser);
+  const existing = await getBuilderByGithubId(personKey);
   if (!existing && !openEnrollmentEnabled()) {
     const approved = await hasInvitedAccessRequest(ghUser.login);
     // Pass `login` so the configured-firstAdmin bypass (firstTimeAdmissionBlocked
@@ -315,7 +331,7 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
     }
   }
   let builder = await upsertBuilder({
-    githubId: ghUser.id,
+    githubId: personKey,
     githubLogin: ghUser.login,
     displayName: ghUser.name || ghUser.login,
     avatarUrl: ghUser.avatar_url,
@@ -345,7 +361,7 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
   });
   // V3.R75 (#294): tick the onboarding state machine. Best-effort.
   await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
-  await recordHubSignin(ghUser);
+  await recordHubSignin(ghUser, personKey);
   // Wizard opt-in only (task 1002099 / ADR 0143): when the caller asked to capture
   // repo access, hand the GitHub access token + granted scope back so the web
   // callback can persist it (encrypted, short-TTL) for the repo picker/creator.
@@ -372,6 +388,7 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
 module.exports = {
   buildAuthorizeUrl,
   completeWebFlow,
+  exchangeCodeForToken,
   fetchGithubUser,
   newSessionToken,
   pollDeviceFlow,

package/src/bongos/project-settings.js

@@ -52,6 +52,9 @@ const SETTING_KEYS = {
   SHIP_MODE: 'ship.mode',
   TWEAK_AUTOPICKUP: 'tweak.autopickup',
   TWEAK_AUTOPICKUP_CAP: 'tweak.autopickup_monthly_cap',
+  // Per-rank caps (task 1005003): one row per live rank, this prefix + the rank
+  // (rankCapKey). An empty value means the rank follows the project cap.
+  TWEAK_AUTOPICKUP_RANK_CAP_PREFIX: 'tweak.autopickup_rank_cap.',
   SPEND_CAP: 'treasury.spend_cap_usd',
   // Testing new module versions first (task 1003802, ADR 0344 D1): module-testing.js.
   MODULE_TESTER: 'modules.tester',
@@ -292,9 +295,10 @@ function describeShipMode(resolved) {
 // (modules/lifecycle/autopickup.js); this file only resolves the numbers.
 const AUTOPICKUP_MODES = Object.freeze(['off', 'on']);
 const DEFAULT_AUTOPICKUP = 'off';
-// 20 rounds: a grade costs the project a few dollars, so 20 is a bounded, legible
-// monthly spend at about the level of one active artist (ADR 0371 D5).
-const DEFAULT_AUTOPICKUP_CAP = 20;
+// 200 rounds: the owner's decision on task 1004971 (2026-10-29, Q7), raising ADR
+// 0371 D5's first figure of 20. A project can set its own number, and a cap per
+// builder rank (task 1005003); this is only the answer for a project that has not.
+const DEFAULT_AUTOPICKUP_CAP = 200;
 // Past 1000 the cap is an off switch typed as a big number; that should be asked
 // for out loud, the same reasoning as MAX_ROT_DAYS.
 const MAX_AUTOPICKUP_CAP = 1000;
@@ -318,6 +322,16 @@ function parseAutopickupCap(raw) {
 
 // One knob through its parser: { value, source, invalid }. Never throws; an
 // unreadable database answers the default, the resolveShipMode posture.
+// `row` is the already-read row (or undefined); parseRow never touches the DB.
+function parseRow(key, row, parse, pick, fallback) {
+  if (row && row.value != null && row.value !== '') {
+    const got = parse(row.value);
+    if (pick(got) != null) return { value: pick(got), source: 'project_settings', invalid: null };
+    return { value: fallback, source: 'default', invalid: { where: `project_settings['${key}']`, raw: String(row.value), reason: got.reason } };
+  }
+  return { value: fallback, source: 'default', invalid: null };
+}
+
 async function resolveOne(key, parse, pick, fallback) {
   let row = null;
   try {
@@ -326,31 +340,60 @@ async function resolveOne(key, parse, pick, fallback) {
     logger.error(`project_settings read failed; falling back to the default ${key}: ${err && err.message}`);
     return { value: fallback, source: 'default', invalid: null };
   }
-  if (row && row.value != null && row.value !== '') {
-    const got = parse(row.value);
-    if (pick(got) != null) return { value: pick(got), source: 'project_settings', invalid: null };
-    return { value: fallback, source: 'default', invalid: { where: `project_settings['${key}']`, raw: String(row.value), reason: got.reason } };
-  }
-  return { value: fallback, source: 'default', invalid: null };
+  return parseRow(key, row, parse, pick, fallback);
+}
+
+// rankCapKey(rank) — the row holding one rank's own cap (task 1005003). ONE ROW
+// PER RANK, deliberately: setting or clearing a rank is a single upsert, so two
+// people editing two different ranks at once can never overwrite each other (a
+// shared JSON object would be read-modify-write and lose one edit). An empty
+// value means "no cap of its own" (the null-is-meaningful rule above).
+function rankCapKey(rank) {
+  return `${SETTING_KEYS.TWEAK_AUTOPICKUP_RANK_CAP_PREFIX}${rank}`;
 }
 
-// resolveTweakAutopickup() — { mode, cap, source: { mode, cap }, invalid: [...] }.
-// mode is always 'off' or 'on', cap always a usable positive integer.
+// resolveTweakAutopickup() — { mode, cap, rank_caps, source: { mode, cap },
+// invalid: [...] }. mode is always 'off' or 'on', cap always a usable positive
+// integer, rank_caps always an object of live-ladder rank → cap (empty when no rank
+// has its own). Every row is read in ONE query; each rank cap goes through
+// parseAutopickupCap, the project cap's own parser, so the two cannot disagree.
 async function resolveTweakAutopickup() {
-  const m = await resolveOne(SETTING_KEYS.TWEAK_AUTOPICKUP, parseAutopickup, (g) => g.mode, DEFAULT_AUTOPICKUP);
-  const c = await resolveOne(SETTING_KEYS.TWEAK_AUTOPICKUP_CAP, parseAutopickupCap, (g) => g.cap, DEFAULT_AUTOPICKUP_CAP);
+  // Lazy: the ladder is the kernel's one copy (tests/rank_tier_single_source.mjs).
+  const ladder = require('./db-kernel').LIVE_RANK_LADDER;
+  const keys = [SETTING_KEYS.TWEAK_AUTOPICKUP, SETTING_KEYS.TWEAK_AUTOPICKUP_CAP, ...ladder.map(rankCapKey)];
+  let byKey = new Map();
+  try {
+    const { rows } = await pool.query('SELECT key, value FROM project_settings WHERE key = ANY($1::text[])', [keys]);
+    byKey = new Map(rows.map((row) => [row.key, row]));
+  } catch (err) {
+    logger.error(`project_settings read failed; falling back to the default tweak auto-pickup settings: ${err && err.message}`);
+  }
+  const m = parseRow(SETTING_KEYS.TWEAK_AUTOPICKUP, byKey.get(SETTING_KEYS.TWEAK_AUTOPICKUP), parseAutopickup, (g) => g.mode, DEFAULT_AUTOPICKUP);
+  const c = parseRow(SETTING_KEYS.TWEAK_AUTOPICKUP_CAP, byKey.get(SETTING_KEYS.TWEAK_AUTOPICKUP_CAP), parseAutopickupCap, (g) => g.cap, DEFAULT_AUTOPICKUP_CAP);
+  const rankCaps = {};
+  const invalid = [m.invalid, c.invalid];
+  for (const rank of ladder) {
+    const r = parseRow(rankCapKey(rank), byKey.get(rankCapKey(rank)), parseAutopickupCap, (g) => g.cap, null);
+    if (r.value != null) rankCaps[rank] = r.value;
+    invalid.push(r.invalid);
+  }
   return {
     mode: m.value,
     cap: c.value,
+    rank_caps: rankCaps,
     source: { mode: m.source, cap: c.source },
-    invalid: [m.invalid, c.invalid].filter(Boolean),
+    invalid: invalid.filter(Boolean),
   };
 }
 
 function describeTweakAutopickup(resolved) {
   const r = resolved || {};
   if (r.mode !== 'on') return 'Off: a submitted page waits until a person runs /tweak for it.';
-  return `On: a running Autobongos runner applies submitted pages on its own, up to ${r.cap} a month. The artist still approves every one.`;
+  const ranks = Object.entries(r.rank_caps || {});
+  const byRank = ranks.length
+    ? ` Some builder ranks have their own limit: ${ranks.map(([rank, n]) => `${rank} ${n}`).join(', ')}.`
+    : '';
+  return `On: a running Autobongos runner applies submitted pages on its own, up to ${r.cap} a month.${byRank} The artist still approves every one.`;
 }
 
 // THE SPEND CAP (task 1004712, ADR 0379). The owner's ruling: there is NO spend
@@ -416,6 +459,7 @@ module.exports = {
   MAX_AUTOPICKUP_CAP,
   parseAutopickup,
   parseAutopickupCap,
+  rankCapKey,
   resolveTweakAutopickup,
   describeTweakAutopickup,
   MAX_SPEND_CAP_USD,

package/src/bongos/routes/auth-google.js

@@ -26,8 +26,9 @@ const { pool } = require('../pool');
 const { parseCookie, validateOrRespond } = require('./_helpers');
 const { googleConfigured, buildGoogleAuthorizeUrl, exchangeGoogleCode, completeGoogleFlow } = require('../auth-google');
 const { pendingFlow, decideDeviceFlow, normalizeUserCode } = require('../device-approval');
-const { renderDeviceApprovalPage } = require('../sign-in-pages');
+const { renderDeviceApprovalPage, renderExistingAccountHint } = require('../sign-in-pages');
 const authRoutes = require('./auth');
+const authLink = require('./auth-link');
 const log = require('../logger').logger.child({ src: 'auth-google' });
 
 // state.nonce for one Google sign-in, host-only, alive as long as GitHub's handshake.
@@ -77,11 +78,52 @@ function sameSitePost(req) {
   try { return new URL(origin).hostname.toLowerCase() === authRoutes.reqHost(req); } catch { return false; }
 }
 
+// Is this a first Google sign-in whose verified address an account that signs in
+// with GitHub also shows? Then the person is offered that account before a second
+// one is made (task 1004995). A suggestion only: an unverified address never
+// counts, and a failed read shows no hint rather than blocking the sign-in.
+async function suggestsExistingGithub(identity) {
+  if (!identity || !identity.emailVerified || !identity.email) return false;
+  const hub = seams.resolveOptional('platform-identity.hub');
+  if (!hub || typeof hub.googleSignInHint !== 'function') return false;
+  try {
+    const hint = await hub.googleSignInHint({ subject: identity.subject, email: identity.email });
+    return Array.isArray(hint) && hint.includes('github');
+  } catch (err) {
+    log.error({ err: err && err.message }, '[auth] google sign-in hint');
+    return false;
+  }
+}
+
+// The second half of Link Google (task 1004995): the Google account the person
+// just picked becomes another way into the account they are signed in to, or the
+// account page says why not. Never a sign-in, and never a merge.
+async function finishGoogleLink(req, res, { expectedState, nonce, state, code, error }) {
+  if (!authLink.hubLinker()) return sendNotOffered(res);
+  if (error || !code || !state || !expectedState || !nonce || state !== expectedState) {
+    return res.redirect(authLink.linkLanding('google', { refused: error === 'access_denied' ? 'cancelled' : 'expired' }));
+  }
+  let session = null;
+  try { session = await auth.resolveSession(req); } catch (err) { log.error({ err: err && err.message }, '[auth] google link session'); }
+  if (!session || session.status === 'inactive') return res.redirect('/account');
+  try {
+    const identity = await exchangeGoogleCode({ code, redirectUri: googleRedirectUri(), nonce });
+    const out = await authLink.linkToSession({
+      session, provider: 'google', subject: identity.subject,
+      email: identity.emailVerified ? identity.email : null,
+    });
+    return res.redirect(authLink.linkLanding('google', out));
+  } catch (err) {
+    log.error({ err: err && err.message }, '[auth] google link');
+    return res.redirect(authLink.linkLanding('google', { refused: 'failed' }));
+  }
+}
+
 module.exports = function buildAuthGoogleRouter() {
   const router = express.Router();
 
   // rank: public — entry into the Google OAuth handshake; identity establishment only.
-  router.get('/auth/google/start', (req, res) => {
+  router.get('/auth/google/start', async (req, res) => {
     if (!googleConfigured()) return sendNotOffered(res);
     // Begun on builders./status.? Restart on the canonical host, where the
     // callback lands and can read the host-only state cookie back.
@@ -93,8 +135,24 @@ module.exports = function buildAuthGoogleRouter() {
     }
     const state = crypto.randomBytes(16).toString('hex');
     const nonce = crypto.randomBytes(16).toString('hex');
-    handshakeCookie(req, res, GOOGLE_STATE_COOKIE, `${state}.${nonce}`);
-    const returnTo = authRoutes.safeReturnTo(req.query.return) || authRoutes.safeReturnTo(req.headers.referer);
+    // Link Google to the signed-in person (task 1004995). Google matches redirect
+    // URIs exactly, so a link shares this handshake and the callback reads the
+    // flag back from the host-only state cookie, never from the query.
+    if (req.query.link === '1') {
+      if (!authLink.hubLinker()) return sendNotOffered(res);
+      let session = null;
+      try { session = await auth.resolveSession(req); } catch (err) { log.error({ err: err && err.message }, '[auth] google link start session'); }
+      if (!session || session.status === 'inactive') return res.redirect('/account');
+      handshakeCookie(req, res, GOOGLE_STATE_COOKIE, `${state}.${nonce}.link`);
+      return res.redirect(buildGoogleAuthorizeUrl({ state, nonce, redirectUri: googleRedirectUri() }));
+    }
+    // `fresh=1` is "Make a new account with Google" on the existing-account hint
+    // (task 1004995): the person has seen the hint, so it is not shown again, and
+    // the return target set by the first attempt is kept (the referrer is now
+    // the callback, which is no place to land).
+    const fresh = req.query.fresh === '1';
+    handshakeCookie(req, res, GOOGLE_STATE_COOKIE, fresh ? `${state}.${nonce}.fresh` : `${state}.${nonce}`);
+    const returnTo = !fresh && (authRoutes.safeReturnTo(req.query.return) || authRoutes.safeReturnTo(req.headers.referer));
     if (returnTo) handshakeCookie(req, res, authRoutes.RETURN_COOKIE, returnTo);
     res.redirect(buildGoogleAuthorizeUrl({ state, nonce, redirectUri: googleRedirectUri() }));
   });
@@ -103,9 +161,10 @@ module.exports = function buildAuthGoogleRouter() {
   router.get('/auth/google/callback', async (req, res) => {
     if (!googleConfigured()) return sendNotOffered(res);
     const startHref = `${authRoutes.apiBase(req)}/auth/google/start`;
-    const [expectedState, nonce] = String(parseCookie(req, GOOGLE_STATE_COOKIE) || '').split('.');
+    const [expectedState, nonce, mode] = String(parseCookie(req, GOOGLE_STATE_COOKIE) || '').split('.');
     const { state, code, error } = req.query;
     res.clearCookie(GOOGLE_STATE_COOKIE);
+    if (mode === 'link') return finishGoogleLink(req, res, { expectedState, nonce, state, code, error });
     if (error) {
       // access_denied is the person pressing Cancel at Google: not a fault.
       return res.status(400).type('text/html').send(authRoutes.renderAuthErrorPage(
@@ -123,6 +182,13 @@ module.exports = function buildAuthGoogleRouter() {
     }
     try {
       const identity = await exchangeGoogleCode({ code, redirectUri: googleRedirectUri(), nonce });
+      if (mode !== 'fresh' && await suggestsExistingGithub(identity)) {
+        const base = authRoutes.apiBase(req);
+        return res.type('text/html').send(renderExistingAccountHint({
+          githubHref: `${base}/auth/web/start?via=github&return=${encodeURIComponent('/account#aWaysIn')}`,
+          newAccountHref: `${base}/auth/google/start?fresh=1`,
+        }));
+      }
       const { token, expiresAt, created } = await completeGoogleFlow({ identity, userAgent: req.headers['user-agent'] });
       authRoutes.setSessionCookie(req, res, token, expiresAt);
       const returnTo = authRoutes.safeReturnTo(parseCookie(req, authRoutes.RETURN_COOKIE));

package/src/bongos/routes/auth-link.js

@@ -0,0 +1,132 @@
+// src/bongos/routes/auth-link.js — linking a second way in to the signed-in
+// person: Link GitHub here, Link Google through the Google routes (task 1004995).
+//
+// A link is a sign-in with the other account, made while already signed in. It
+// never merges: a way in that already reaches another person is refused, and the
+// account page says so plainly (owner, 2026-10-29). Both answers land on
+// /account, which owns the words:
+//
+//   GET /auth/link/github/start       → GitHub's account picker (state cookie)
+//   GET /auth/web/callback/link       → checks the state, trades the code, links
+//
+// The GitHub callback is a SUBDIRECTORY of the sign-in callback on purpose:
+// GitHub accepts any redirect_uri below the registered one, so linking needs no
+// change to the owner's GitHub app. (Google matches redirect URIs exactly, so its
+// link rides the sign-in callback with a flag — routes/auth-google.js.)
+//
+// Linking needs the hub (the platform-identity.hub port's linkLogin). Off the hub
+// every route here answers "not offered".
+'use strict';
+
+const express = require('express');
+const crypto = require('node:crypto');
+
+const auth = require('../auth');
+const db = require('../db');
+const seams = require('../../module-seams');
+const { parseCookie } = require('./_helpers');
+const { buildAuthorizeUrl, exchangeCodeForToken, fetchGithubUser } = require('../auth-github');
+const authRoutes = require('./auth');
+const log = require('../logger').logger.child({ src: 'auth-link' });
+
+const LINK_STATE_COOKIE = 'bongos_link_state';
+const LINK_CALLBACK_PATH = '/api/bongos/auth/web/callback/link';
+
+function linkRedirectUri() {
+  return `${authRoutes.webRedirectOrigin().replace(/\/+$/, '')}${LINK_CALLBACK_PATH}`;
+}
+
+// The hub's linkLogin, or null where linking is not offered.
+function hubLinker() {
+  const hub = seams.resolveOptional('platform-identity.hub');
+  return hub && typeof hub.linkLogin === 'function' ? hub : null;
+}
+
+// Where the account page shows a link's answer. Pure; exported for the test.
+// `out` is linkLogin's answer, or { refused: 'taken' } decided here.
+function linkLanding(provider, out) {
+  const q = out && out.linked ? `linked=${provider}` : `link_refused=${(out && out.refused) || 'failed'}&provider=${provider}`;
+  return `/account?${q}#aWaysIn`;
+}
+
+// Link a way in to the signed-in person, then keep their builder row's login in
+// step for GitHub (the hub shows the real login once GitHub is linked, ADR 0396).
+async function linkToSession({ session, provider, subject, email, githubLogin }) {
+  const out = await hubLinker().linkLogin({ personKey: String(session.github_id), provider, subject, email, githubLogin });
+  if (out.linked && provider === 'github' && githubLogin) {
+    await db.upsertBuilder({
+      githubId: String(session.github_id),
+      githubLogin,
+      displayName: session.display_name || githubLogin,
+      avatarUrl: session.avatar_url || null,
+    });
+  }
+  return out;
+}
+
+function notOffered(res) {
+  return res.status(404).type('text/html').send(authRoutes.renderAuthErrorPage(
+    'Linking isn’t offered here',
+    'This site does not keep more than one way in per account.',
+  ));
+}
+
+function isSecure(req) {
+  return !!(req.secure || req.headers['x-forwarded-proto'] === 'https');
+}
+
+module.exports = function buildAuthLinkRouter() {
+  const router = express.Router();
+
+  // rank: public — an OAuth entry point that gates itself: with no live session it
+  //   sends the person to /account, so only a signed-in person ever links (ADR 0396).
+  router.get('/auth/link/github/start', async (req, res) => {
+    if (!hubLinker()) return notOffered(res);
+    let session = null;
+    try { session = await auth.resolveSession(req); } catch (err) { log.error({ err: err && err.message }, '[auth] link start session'); }
+    if (!session || session.status === 'inactive') return res.redirect('/account');
+    const state = crypto.randomBytes(16).toString('hex');
+    res.cookie(LINK_STATE_COOKIE, state, { httpOnly: true, sameSite: 'lax', secure: isSecure(req), maxAge: authRoutes.HANDSHAKE_COOKIE_MS });
+    // The account picker, so the person can choose a GitHub account other than
+    // the one this browser is signed in to at github.com.
+    res.redirect(buildAuthorizeUrl(state, linkRedirectUri(), { switchAccount: true }));
+  });
+
+  // rank: public — the OAuth callback for linking; the state cookie + code are the
+  //   bearer, and the live session cookie names the person (no session: /account).
+  router.get('/auth/web/callback/link', async (req, res) => {
+    if (!hubLinker()) return notOffered(res);
+    const expected = parseCookie(req, LINK_STATE_COOKIE);
+    res.clearCookie(LINK_STATE_COOKIE);
+    const { state, code, error } = req.query;
+    if (error || !code || !state || !expected || state !== expected) {
+      return res.redirect(linkLanding('github', { refused: error === 'access_denied' ? 'cancelled' : 'expired' }));
+    }
+    let session = null;
+    try { session = await auth.resolveSession(req); } catch (err) { log.error({ err: err && err.message }, '[auth] link callback session'); }
+    if (!session || session.status === 'inactive') return res.redirect('/account');
+    try {
+      const { accessToken } = await exchangeCodeForToken(code, linkRedirectUri());
+      const ghUser = await fetchGithubUser(accessToken);
+      // A GitHub account with its own builder row here is its own account, with
+      // its own credits and history: say so, never merge (owner, 2026-10-29).
+      if (String(ghUser.id) !== String(session.github_id) && await db.getBuilderByGithubId(String(ghUser.id))) {
+        return res.redirect(linkLanding('github', { refused: 'taken' }));
+      }
+      const out = await linkToSession({
+        session, provider: 'github', subject: String(ghUser.id),
+        email: typeof ghUser.email === 'string' ? ghUser.email : null, githubLogin: ghUser.login,
+      });
+      return res.redirect(linkLanding('github', out));
+    } catch (err) {
+      log.error({ err: err && err.message }, '[auth] web/callback/link');
+      return res.redirect(linkLanding('github', { refused: 'failed' }));
+    }
+  });
+
+  return router;
+};
+
+module.exports.linkLanding = linkLanding;
+module.exports.linkToSession = linkToSession;
+module.exports.hubLinker = hubLinker;

package/src/bongos/routes.js

@@ -24,6 +24,7 @@ const buildFeedbackRouter = require('./routes/feedback');
 const buildAuthRouter = require('./routes/auth');
 // Google sign-in + the browser page that approves a CLI sign-in (task 1004993).
 const buildAuthGoogleRouter = require('./routes/auth-google');
+const buildAuthLinkRouter = require('./routes/auth-link');
 const buildGithubRouter = require('./routes/github');
 const buildMeRouter = require('./routes/me');
 // The own-scoped session self-service (list / revoke one / sign out everywhere,
@@ -170,6 +171,7 @@ function buildGdsRouter() {
   router.use(buildFeedbackRouter());
   router.use(buildAuthRouter());
   router.use(buildAuthGoogleRouter());
+  router.use(buildAuthLinkRouter());
   router.use(buildGithubRouter());
   router.use(buildMeRouter());
   router.use(buildMySessionsRouter());

package/src/bongos/sign-in-pages.js

@@ -75,6 +75,25 @@ function renderSignInChooser({ githubHref, googleHref }) {
   });
 }
 
+// A first Google sign-in whose address an account that signs in with GitHub
+// already shows (task 1004995). Nothing is joined and the page names no one: it
+// offers the account the person may already have, where they can link Google,
+// or a new, separate account. The second button restarts the Google sign-in
+// with the hint switched off, because the code Google sent is spent.
+function renderExistingAccountHint({ githubHref, newAccountHref }) {
+  return renderPage({
+    title: 'sign in',
+    heading: 'You may already have an account',
+    subtitle: 'An account that signs in with GitHub uses the same email as this Google account.',
+    bodyHtml: `      <p>If that account is yours, sign in with GitHub, then add Google under <b>ways to sign in</b> on your account page. Both will open the same account, with the same credits and history.</p>
+      <div class="signinChoices">
+        <a class="landing__btn" href="${escapeHtml(githubHref)}">${GITHUB_MARK}Sign in with GitHub</a>
+        <a class="landing__btn" href="${escapeHtml(newAccountHref)}">${GOOGLE_MARK}Make a new account with Google</a>
+      </div>
+      <p class="landing__note">We never join accounts on our own, even when the emails match.</p>`,
+  });
+}
+
 // The command-line approval page, in its four states:
 //   'enter'    — no code, or one that is unknown or expired: ask for it
 //   'signin'   — a live code, nobody signed in: offer both ways in
@@ -135,4 +154,4 @@ ${choiceButtons(view)}
   });
 }
 
-module.exports = { renderSignInChooser, renderDeviceApprovalPage };
+module.exports = { renderSignInChooser, renderExistingAccountHint, renderDeviceApprovalPage };

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.5'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.7'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');