@bongos/core 1.24.77 → 1.24.79

package/scripts/bongos/autobongos-host.js

@@ -8,6 +8,7 @@
 //   node scripts/bongos/autobongos-host.js status [--json]
 //   node scripts/bongos/autobongos-host.js start | stop
 //   node scripts/bongos/autobongos-host.js install | uninstall
+//   node scripts/bongos/autobongos-host.js digest [--since 24h]   # the night, in five answers
 //   node scripts/bongos/autobongos-host.js run          # what the start entry runs
 //
 // WHY. The runner could only be hosted one way: a Windows scheduled task
@@ -73,16 +74,31 @@ const LOG_ROTATE_BYTES = 20 * 1024 * 1024;
 function runnerHome(env = process.env, home = os.homedir(), repoRoot = REPO_ROOT) {
   if (env.AUTOBONGOS_HOME) return path.resolve(env.AUTOBONGOS_HOME);
   if (path.basename(repoRoot) === 'repo' && isRunnerCopy(repoRoot)) return path.dirname(repoRoot);
-  return path.join(home, '.cloudbongos-runner');
+  return path.join(home, RUNNER_DIR);
 }
 
-// hostPaths — every file this program owns, from one root. `config` is handed to
-// the supervisor as BONGOS_CONFIG_ROOT, which is what keeps its login apart.
+// The runner's folder in the person's home. Named once: the read-deny rule that
+// keeps agents out of the runner's login names this same folder
+// (scripts/bongos/claude-materialize.js RUNNER_CONFIG_DENY), and a test holds the
+// two together.
+const RUNNER_DIR = '.cloudbongos-runner';
+
+// hostPaths — every file this program owns. `configRoot` is handed to the
+// supervisor as BONGOS_CONFIG_ROOT, which is what keeps its login apart.
+//
+// THE LOGIN LIVES IN ONE PLACE ON EVERY DEVICE (task 1005186): configRoot is always
+// <home>/.cloudbongos-runner/config, WHATEVER AUTOBONGOS_HOME says. That variable
+// moves the runner's copy of the project, its logs and its lock; it does not move
+// the login. The reason is the deny rule: agents are refused reads under exactly
+// that folder, and a login that could be put somewhere else by an environment
+// variable would be a login the rule does not cover — on precisely the device
+// someone had customised. One runner per device already, so there is nothing a
+// second config folder would be for.
 function hostPaths(env = process.env, home = os.homedir()) {
   const root = runnerHome(env, home);
   return {
     root,
-    configRoot: path.join(root, 'config'),
+    configRoot: path.join(home, RUNNER_DIR, 'config'),
     logDir: path.join(root, 'logs'),
     log: path.join(root, 'logs', 'autobongos.log'),
     lock: path.join(root, 'host.json'),
@@ -755,6 +771,12 @@ async function waitForCheckIn({ session, fetchImpl = fetch, timeoutMs = 90000, s
   return false;
 }
 
+// The digest CLI and its arguments, for `digest`: the same file a builder would
+// run by hand, with whatever they passed handed through.
+function digestArgv(rest = []) {
+  return [path.join(REPO_ROOT, 'scripts', 'bongos', 'autobongos-digest.js'), ...rest];
+}
+
 // ── the commands ───────────────────────────────────────────────────────────
 
 async function runCommand({ paths = hostPaths() } = {}) {
@@ -819,6 +841,13 @@ async function main(argv) {
     console.log('Whether it is WORKING is on its card in Settings: the card reads its check-ins.');
     return 0;
   }
+  if (cmd === 'digest') {
+    // The runner's run log lives under ITS config root, so the digest has to be
+    // run with that root or it reads the builder's own (empty) one and reports a
+    // missing log (task 1005097).
+    const r = spawnSync(process.execPath, digestArgv(argv.slice(1)), { stdio: 'inherit', env: supervisorEnv(process.env, paths, dirName) });
+    return r.status === null ? 1 : r.status;
+  }
   if (cmd === 'install') {
     const e = install({ paths });
     console.log(e.kind === 'none' ? 'This system has no start-at-sign-in entry yet; use start after each restart.' : 'The runner now starts whenever you sign in to this device.');
@@ -842,7 +871,7 @@ async function main(argv) {
     for (const line of stopReport(result, { installed })) console.log(line);
     return result.outcome === 'still_running' || (cmd === 'uninstall' && installed) ? 1 : 0;
   }
-  console.error('usage: autobongos-host.js setup --code <code> --api-base <url> | status [--json] | start | stop | install | uninstall | run');
+  console.error('usage: autobongos-host.js setup --code <code> --api-base <url> | status [--json] | start | stop | install | uninstall | digest [--since 24h] | run');
   return 2;
 }
 
@@ -865,5 +894,5 @@ module.exports = {
   pidAlive, lockHolder, wantsAwake, keepAwakeCommand, makeKeepAwake, runLoop,
   windowsRunArgv, windowsRunCommand, windowsStartSpawn, legacyBootTaskInstalled, launchdPlist,
   stopRunner, stopReport, exchangeCode, claudeState, waitForCheckIn,
-  signIn, cleanBase, install, removeStartEntry, installedState, status,
+  signIn, cleanBase, install, removeStartEntry, installedState, status, digestArgv,
 };

package/scripts/bongos/autobongos-run.js

@@ -455,12 +455,18 @@ function worktreeName(taskId) {
 // A failure of EITHER read returns the shape that refuses. An unreachable
 // instance and a thrown kill switch are different facts, but they license the
 // same action: do nothing.
+// THIS DEVICE is named on the read (task 1005094): the server folds the device's
+// own Run switch into the answer, so a builder's Stop on this machine arrives as
+// `enabled: false` with nothing for this file to decide. The name is the same
+// os.hostname() the heartbeat reports, which is how the two rows line up.
+const fenceArgs = () => ({ query: { host: os.hostname() } });
+
 async function readFence(deps = {}) {
   const api = deps.api || await (require('./cli-lib').cliClient)();
   let raw = null;
   let graderBypassed = null;
   try {
-    const r = await api.autonomy.getAutonomyFence();
+    const r = await api.autonomy.getAutonomyFence(fenceArgs());
     if (r && r.ok) raw = r.data;
   } catch (_) { /* unreadable → refuses below */ }
   try {
@@ -1011,7 +1017,9 @@ async function pollSignals(deps = {}) {
     if (r) head = r;
   } catch (_) { /* null */ }
   try {
-    const f = await api.autonomy.getAutonomyFence();
+    // Named the same way, so a press of Run on this device moves the stamp the
+    // wait is watching and the runner wakes inside a poll instead of an idle.
+    const f = await api.autonomy.getAutonomyFence(fenceArgs());
     if (f && f.ok) fenceUpdatedAt = f.data.updated_at || null;
   } catch (_) { /* null */ }
   try {
@@ -1233,9 +1241,15 @@ async function forever(opts, deps = {}) {
   // `config_idle:<code>` instead of "waiting", so the hall shows the fix rather
   // than "alive" for ten hours. Any row that is not that refusal ends the stretch.
   let idle = null;
+  // When a resting runner resumes, in epoch seconds (task 1005094): the reset the
+  // last hold named. Sent on every beat that is not about a task, so the device's
+  // Run button can show "Resting until 3:40" for the whole wait, not just for the
+  // one beat that followed the hold. Any row that is not such a hold clears it.
+  let restUntil = null;
   const clock = () => (deps.now ? deps.now() : Date.now());
   const beat = async (rawFields) => {
-    const fields = configIdle.markBeat(rawFields, idle, clock());
+    const resting = restUntil && !(rawFields && rawFields.working_task_id) ? { ...rawFields, hold_until: restUntil } : rawFields;
+    const fields = configIdle.markBeat(resting, idle, clock());
     // The runner state is passed, not defaulted: the file names `disk_head` from
     // it (task 1004406), and an injected state must reach the beat that reports it.
     try { beatFile(Date.now(), deps.state || RUNNER_STATE); } catch (_) { /* a runner that cannot write its file still runs */ }
@@ -1281,6 +1295,7 @@ async function forever(opts, deps = {}) {
       row = await iterate(opts, deps);
       emit(row);
       idle = configIdle.trackIdle(idle, row, clock());
+      restUntil = row.event === 'hold' && Number(row.sleep_until) > 0 ? Number(row.sleep_until) : null;
       // Carry the task id so the hall can tell "quiet because it is building
       // task 1234" from "quiet because it is dead". A worker may hold the loop for
       // ninety minutes, and without this every honest hour of work looks like a

package/scripts/bongos/claude-materialize.js

@@ -481,10 +481,29 @@ const STARTER_DENY_SECRETS = [
   'Read(**/*.pem)', 'Read(**/id_rsa*)', 'Read(**/id_ed25519*)',
 ];
 const SESSION_STORE_DENY = `Read(~/.config/${ic.FALLBACK_DIR}/instances/**)`;
+// An Autobongos runner keeps ITS OWN login and files in a folder of its own (task 1005095:
+// BONGOS_CONFIG_ROOT, so adding a laptop as a runner never touches the builder's CLI session).
+// That put the runner's session file, and the session store beside it, outside every rule above,
+// which all stop at ~/.config — so on a runner device a worker could open the file and read the
+// runner's login (task 1005186). The whole folder is denied rather than one file name: the
+// runner's heartbeat and run log sit there too and no agent has a reason to read any of it, and
+// a rule on the folder cannot be stepped around by a session file under a new name.
+// The folder name is the device program's (scripts/bongos/autobongos-host.js hostPaths); it is
+// spelled here rather than required from there because this file is the installer and must not
+// load the runner, and tests/claude_materialize.mjs fails if the two ever name different places.
+const RUNNER_CONFIG_DENY = 'Read(~/.cloudbongos-runner/config/**)';
+
+// The rules that name a FIXED place, whatever the instance is called.
+const FIXED_PLACE_DENY = [SESSION_STORE_DENY, RUNNER_CONFIG_DENY];
 
 // A checkout's settings.json takes the identity rebrand like every copied file, and the store's
 // dir is one of the core's `.config/<dir>` literals it rewrites. The store does not move with the
 // brand (task 1003741), so its rule is put back where the CLI reads it (task 1004155).
+//
+// The runner rule needs no putting back: the rebrand rewrites `.config/<core dir>` literals, and
+// the runner's folder is not one (measured: with the put-back removed, the three-brand case in
+// tests/claude_materialize.mjs still holds). That case is what would notice a future rebrand
+// rule broad enough to carry it off.
 function rebrandSettings(text, rebrand) {
   const moved = rebrand(SESSION_STORE_DENY);
   return rebrand(text).split(JSON.stringify(moved)).join(JSON.stringify(SESSION_STORE_DENY));
@@ -504,7 +523,7 @@ function credentialDeny(branding = {}) {
   return [
     ...STARTER_DENY_SECRETS,
     ...dirs.flatMap((dir) => credentialFiles.map((file) => `Read(~/.config/${dir}/${file})`)),
-    SESSION_STORE_DENY,
+    ...FIXED_PLACE_DENY,
   ];
 }
 

package/scripts/bongos/stranded-rows.js

@@ -30,6 +30,19 @@
 // MERGE commit's body, where GitHub echoes the branch's subject. A subject-only scan
 // misses the one case this file exists for.
 //
+// A SECOND FORM, because the convention moved (task 1005187). Builders, and ship.js's
+// own regeneration commits, now mostly write the task at the START of the subject:
+// `task N - words`, `task N: words`, with an optional conventional prefix in front
+// (`fix: task N - words`, `wip(scope): task N - words`). Measured over the last 400
+// commits on main on 2026-11-10: 140 subjects in that form against 53 lines ending
+// `(task N)`, covering 18 distinct tasks — under the floor of 20 the live-repo test
+// holds, which is how main went red. So both forms count. The new one is read off the
+// SUBJECT only, and only at its start, followed by a dash or a colon: the same
+// "this commit DID task N" statement, and still not "mentions N" (a subject such as
+// "see task N for why", or any body line naming a task, is not counted). A merge
+// commit's subject is GitHub's, so for one of those the first line of its body — the
+// pull request's own title, which GitHub echoes there — is read the same way.
+//
 // MEASURED on this repo before shipping: 877 ids are named as an authoring subject
 // across 4,784 commits, and ZERO of them are open `ready`/`backlog` rows (434 of
 // those). So today's board is clean and the signal is not merely quiet — the same
@@ -66,13 +79,37 @@ const SEP = `${SOH}COMMIT${SOH}`;
 // mentioned N", and the second is the noise that made the supersession half undoable.
 const AUTHORED_RE = /\(task (\d{6,7})\)\s*$/;
 
+// The second convention: the task leads the subject, after an optional conventional
+// prefix, and is followed by a dash or a colon. Read off a TITLE line only (see
+// titleLines) — never off every line, which is where "mentions N" lives.
+const LEADING_RE = /^(?:[a-z]+(?:\([^)]*\))?!?:\s*)?task (\d{6,7})\s*[-:\u2013\u2014]/i;
+const MERGE_SUBJECT_RE = /^Merge pull request #\d+ /;
+
+// The lines of a message that are a TITLE: its subject, and for a GitHub merge commit
+// the first line of the body too, where GitHub echoes the pull request's own title.
+function titleLines(lines) {
+  const at = lines.findIndex((l) => l);
+  if (at === -1) return [];
+  const out = [lines[at]];
+  if (MERGE_SUBJECT_RE.test(lines[at])) {
+    const echoed = lines.slice(at + 1).find((l) => l);
+    if (echoed) out.push(echoed);
+  }
+  return out;
+}
+
 // PURE — every task id a commit message claims to have DONE. Exported so the rule is
 // testable without a repo: a scanner that quietly stops matching reports a clean board,
 // which is indistinguishable from a healthy one.
 function authoredIds(message) {
   const out = new Set();
-  for (const line of String(message || '').split('\n')) {
-    const m = AUTHORED_RE.exec(line.trim());
+  const lines = String(message || '').split('\n').map((l) => l.trim());
+  for (const line of lines) {
+    const m = AUTHORED_RE.exec(line);
+    if (m) out.add(m[1]);
+  }
+  for (const line of titleLines(lines)) {
+    const m = LEADING_RE.exec(line);
     if (m) out.add(m[1]);
   }
   return out;

package/scripts/hall-preview/server.js

@@ -214,6 +214,13 @@ const CANNED_WRITES = [
   ['POST', /^ai-studio\/uploads$/, 'ai-studio__uploads.post'],
   ['POST', /^ai-studio\/requests$/, 'ai-studio__requests.post'],
   ['POST', /^ai-studio\/topup$/, 'ai-studio__topup.post'],
+  // Settings > Your Autobongos runner (task 1005094): a press of Run or Stop, a
+  // setup code for Add a device, and Remove (the login, then the card), so the
+  // Starting face, the setup command and the removal toast render here.
+  ['POST', /^autonomy\/runners\/[^/]+\/run$/, 'autonomy__runners__run.post'],
+  ['POST', /^auth\/runner-code\/issue$/, 'auth__runner-code__issue.post'],
+  ['POST', /^me\/sessions\/revoke$/, 'me__sessions__revoke.post'],
+  ['DELETE', /^autonomy\/runners\/[^/]+$/, 'autonomy__runners.delete'],
 ];
 
 // A DATE THAT ROTS CANNOT DEMO AN AGE SIGNAL (task 1004041). The help-request

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.77'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.79'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autobongos_host.mjs

@@ -221,6 +221,21 @@ test('the supervisor runs under the runner\'s own config root, and keeps a gauge
   assert.equal(host.supervisorEnv({ AUTOBONGOS_GAUGE_FILE: '/set/by/hand' }, paths).AUTOBONGOS_GAUGE_FILE, '/set/by/hand');
 });
 
+test('AUTOBONGOS_HOME moves the runner\'s copy, logs and lock, and never the login', () => {
+  // The login must stay where the read-deny rule looks for it (task 1005186): a
+  // device someone customised is the last one that should fall outside the rule.
+  const home = path.join(tmp, 'fixed-login-home');
+  const standard = host.hostPaths({}, home);
+  const custom = host.hostPaths({ AUTOBONGOS_HOME: path.join(tmp, 'somewhere-else') }, home);
+  assert.equal(standard.configRoot, path.join(home, '.cloudbongos-runner', 'config'));
+  assert.equal(custom.configRoot, standard.configRoot, 'the same folder under the person\'s home, whatever the variable says');
+  assert.equal(custom.root, path.join(tmp, 'somewhere-else'));
+  assert.equal(custom.log, path.join(tmp, 'somewhere-else', 'logs', 'autobongos.log'));
+  assert.equal(custom.lock, path.join(tmp, 'somewhere-else', 'host.json'));
+  // And that is the folder the supervisor and its workers are pointed at.
+  assert.equal(host.supervisorEnv({ AUTOBONGOS_HOME: path.join(tmp, 'somewhere-else') }, custom).BONGOS_CONFIG_ROOT, standard.configRoot);
+});
+
 test('under BONGOS_CONFIG_ROOT every session path moves, and the builder\'s own session is not a fallback', () => {
   const root = fresh('cfgroot');
   const probe = `
@@ -617,3 +632,34 @@ test('the PowerShell bootstrap stops with a sentence on an incomplete command, a
   // long dash turns into mojibake inside a string — or a parse error.
   assert.equal(/[^\x00-\x7F]/.test(readFileSync(PS1, 'utf8')), false);
 });
+
+// ── the night, read from the runner's own files (task 1005097) ───────────────
+
+test('the digest is read from the RUNNER’s run log: bare, the digest CLI looks in the builder’s own folder and finds none', () => {
+  const home = fresh('digest-home');
+  const paths = host.hostPaths({ AUTOBONGOS_HOME: home }, home);
+  const dirName = require('../src/instance-config').configDirName();
+  const logDir = path.join(paths.configRoot, dirName);
+  mkdirSync(logDir, { recursive: true });
+  writeFileSync(path.join(logDir, 'autobongos-runs.jsonl'), `${JSON.stringify({
+    at: new Date().toISOString(), event: 'worked', task_id: 424242, title: 'the task the runner built',
+    outcome: 'claims_shipped', verified: true, ledger_status: 'shipped', ledger_shape: 'shipped', cost_usd: 1.5,
+  })}\n`);
+
+  const argv = host.digestArgv(['--all', '--json']);
+  assert.equal(path.basename(argv[0]), 'autobongos-digest.js');
+  assert.deepEqual(argv.slice(1), ['--all', '--json'], 'whatever the person passed is handed through');
+
+  // Through the device program: the runner's night.
+  // The login folder is always under the person's home (task 1005186), so the
+  // child is given this test's stand-in home: HOME on a Mac or Linux, USERPROFILE
+  // on Windows. Otherwise it would read the real one.
+  const viaHost = spawnSync(process.execPath, [HOST_JS, 'digest', '--all', '--json'], { encoding: 'utf8', env: { ...process.env, HOME: home, USERPROFILE: home, AUTOBONGOS_HOME: home, AUTOBONGOS_LOG_FILE: '' } });
+  assert.equal(viaHost.status, 0, viaHost.stderr);
+  assert.ok(viaHost.stdout.includes('424242'), 'the task the runner built is in it');
+
+  // Bare, with an empty folder standing in for the builder's own: nothing to read.
+  const bare = spawnSync(process.execPath, argv, { encoding: 'utf8', env: { ...process.env, BONGOS_CONFIG_ROOT: fresh('digest-builder-root'), AUTOBONGOS_LOG_FILE: '' } });
+  assert.equal(bare.status, 0, 'the digest never fails a morning');
+  assert.equal(bare.stdout.includes('424242'), false, 'which is why the guide sends people through the device program');
+});

package/tests/autonomy_config_idle.mjs

@@ -223,10 +223,15 @@ test('the hall draws idle_config as a warning with the fix, on the Gate page and
   const gate = fs.readFileSync('modules/hall-ui/public/gate.js', 'utf8');
   assert.match(gate, /idle_config: 'warn'/, 'the dot is a warning, not ok');
   assert.match(gate, /h\.state === 'idle_config'[\s\S]{0,200}h\.remedy/, 'the checklist carries the remedy');
-  const panel = fs.readFileSync('modules/hall-ui/public/settings-autobongos.js', 'utf8');
-  assert.match(panel, /'GET', `\$\{API\}\/autonomy\/runners`/);
-  assert.match(panel, /h\.state !== 'idle_config'/);
-  assert.match(panel, /escapeHtml\(h\.remedy/);
+  // In Settings the device's own card says it (task 1005094): asked of the real
+  // button logic, with the verdict the server attaches to that runner.
+  const RB = require('../modules/hall-ui/public/runner-button.js');
+  const idle = describeRunner({ host: 'winbox', last_seen_at: new Date().toISOString(), last_event: 'config_idle:gauge_unknown', run_requested: true }, { nowMs: Date.now() });
+  assert.equal(idle.state, 'idle_config');
+  const open = { enabled: true, scope: { goals: [1] }, project: { enabled: true, goals: [{ goal_id: 1 }] } };
+  const b = RB.buttonState({ runner: { host: 'winbox', run_requested: true, last_seen_at: new Date().toISOString(), health: idle }, fence: open, nowMs: Date.now() });
+  assert.equal(b.tone, 'warn', 'a warning on the card, not ok');
+  assert.ok(b.sub.includes(idle.why) && b.sub.includes(idle.remedy), 'the card carries why it is idle and the fix');
 });
 
 // ── the route: POST /autonomy/heartbeat posts through the discord.post port ──