@bongos/core 1.19.1030 → 1.19.1031

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1030",
-  "core_contract": "1.19.1030",
-  "source_commit": "198e316ae502b4929018d6c592d28fd6bfa3b81d",
+  "core_version": "1.19.1031",
+  "core_contract": "1.19.1031",
+  "source_commit": "04f5126869533ad9e3a29fa072dd288ba6e63f3b",
   "source_ref": "HEAD",
-  "built_at": "2026-09-25T21:18:42.202Z",
+  "built_at": "2026-09-25T21:32:54.328Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 529,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3014,
-  "tree_sha256": "980cdb45376b2b35067d51b269d2709e1e1922dcbfb541554877cbcb9ae0c9e1",
+  "tree_sha256": "05efd2e30efe440d0892c97889cdea81127c2544ef93366c2b054750750fceb3",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2757,7 +2757,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "bb67419c4dd3f2311a231615a96bd462cc6806b6e3a1967ea0614e3966ef9b0e"
+      "sha256": "6f37eb2ce46310219bfc4f0c4820e67f6afda57cfe76cb2a0e8cf75d3bd6577d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8362,12 +8362,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ab4b3ba1d87734173359f3ade610dc804a339ac3a518e7e5efebee2a1ff68cd0"
+      "sha256": "eb24a6596bec145cc1e850a0c17f5f9a5a05bf4b5762785c063ac9711788417e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ddb2d7173af124e48c454d0ba5db240e96d35541495fe7cf414246b1df433cd7"
+      "sha256": "84bad55379e5b9c61129a8d4cae7b074f22ba99984543dd1ac990688ac73efcb"
     },
     {
       "path": "public-docs/index.html",
@@ -8542,7 +8542,7 @@
     {
       "path": "scripts/gds/autobongos-run.js",
       "mode": "0000644",
-      "sha256": "24f0be946550a89f717278a418ebb68330fad3c7cdd45d3b79e85315564c7425"
+      "sha256": "9fe8be8bc38039f700b6aab8b52508c162252513cc6b5b87aacb7dc48648937a"
     },
     {
       "path": "scripts/gds/autobongos-service.cmd",
@@ -8552,7 +8552,7 @@
     {
       "path": "scripts/gds/autobongos-service.ps1",
       "mode": "0000644",
-      "sha256": "3f3e44969809b3c22c9cf338af68695af6e835b861ac056d38408a4be1d202a7"
+      "sha256": "ed95f836655535827c14a32caf197fee7c238e15d8e8bf7a9e987b78ab266887"
     },
     {
       "path": "scripts/gds/autobongos-verify.js",
@@ -10412,7 +10412,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "439c0db441cc17b1ce9da268d30703325667f137d05f4b810786b356c9d56cfd"
+      "sha256": "320ce97feaea53ab38c025dbba20001ef89643b0519151e010c7456e0dd727eb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10847,7 +10847,7 @@
     {
       "path": "tests/autobongos_loop.mjs",
       "mode": "0000644",
-      "sha256": "2f9c2b4e115b2c7411748cfe5179344bcc0e45c855c68102821966ab63ccbc21"
+      "sha256": "8ba5a6b492ae5afabb13f9e44d2f82cb873a094a659425554f0d105bd979aff4"
     },
     {
       "path": "tests/autobongos_verify.mjs",

package/docs/module-api-changelog.md

@@ -2539,5 +2539,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1028 with no explicit bump. run 36189693139. (task 1002620)
   1.19.1030 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1029 with no explicit bump. run 36190779629. (task 1002620)
+  1.19.1031 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1030 with no explicit bump. run 36192093201. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1030",
+  "version": "1.19.1031",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1030",
+      "version": "1.19.1031",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1030",
+  "version": "1.19.1031",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/autobongos-run.js

@@ -162,6 +162,20 @@ const WORKER_ENV_ALLOW = [
   'BONGOS_API_BASE', 'CLOUDBONGOS_API_BASE',
   'OTB_CLAUDE_BIN', 'CLAUDE_BIN',
   'XDG_CONFIG_HOME',
+  // THE WORKER'S OWN CREDENTIAL, and it has to be here (task 1003907, found by
+  // running it). On a desktop, the claude CLI authenticates from the credential
+  // store under USERPROFILE/HOME, which are already allowed - so this list looked
+  // complete. On a HEADLESS host there is no interactive login to have written
+  // one, and setup.js's own preflight says to set CLAUDE_CODE_OAUTH_TOKEN there
+  // instead. Stripping it meant every worker on the machine this was built for
+  // started unauthenticated, exited in ~2s, and the run recorded only "worker
+  // output was not JSON".
+  //
+  // This is not the leak the list exists to prevent. The worker IS a Claude
+  // session; its own auth is the one credential it cannot do its job without.
+  // Everything the comment above refuses - DB URLs, git and npm tokens - stays
+  // refused.
+  'CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY',
 ];
 
 function workerEnv(source = process.env, extra = {}) {
@@ -175,12 +189,46 @@ function workerEnv(source = process.env, extra = {}) {
 
 const MAX_WORKER_OUTPUT = 8 * 1024 * 1024;   // a misbehaving worker must not grow memory until the timeout
 
+// resolveWorkerBin — WHICH `claude`, and whether it needs a shell.
+//
+// THE BUG THIS EXISTS FOR (task 1003907, found by running it on the real Windows
+// host). On Windows `claude` on PATH is a .cmd shim, and Node has refused to
+// spawn .cmd/.bat without a shell since CVE-2024-27980 — so this used to pass
+// `shell: process.platform === 'win32'`. But `shell: true` does not pass argv
+// through: it CONCATENATES it into one command line that cmd.exe re-parses,
+// which destroys every embedded quote. `--json-schema` is a JSON blob made
+// almost entirely of quotes, so claude received a mangled argument and exited in
+// ~2s with `--json-schema is not valid JSON`. Every worker. Every run. Forever —
+// and the cadence classes that as `quiet`, so it never trips the failure ladder.
+//
+// The npm package ships a REAL claude.exe beside the shim, so prefer it: a true
+// executable spawns with shell:false and exact argv, and nothing re-parses.
+// Falling back to the old behaviour is deliberate — a host with a differently
+// laid-out install should still run, and a corrupted schema surfaces as a failed
+// worker rather than as a refusal to start at all.
+function resolveWorkerBin(env = process.env, platform = process.platform) {
+  const override = env.OTB_CLAUDE_BIN || env.CLAUDE_BIN;
+  if (override) return { bin: override, shell: platform === 'win32' && /\.(cmd|bat)$/i.test(override) };
+  if (platform !== 'win32') return { bin: 'claude', shell: false };
+  for (const dir of String(env.PATH || env.Path || '').split(path.delimiter)) {
+    if (!dir) continue;
+    const candidates = [
+      path.join(dir, 'node_modules', '@anthropic-ai', 'claude-code', 'bin', 'claude.exe'),
+      path.join(dir, 'claude.exe'),
+    ];
+    for (const c of candidates) {
+      try { if (fs.existsSync(c)) return { bin: c, shell: false }; } catch (_) {}
+    }
+  }
+  return { bin: 'claude', shell: true };
+}
+
 // spawnWorker — one headless session, bounded by WALL CLOCK, in the task's own
 // working tree.
 async function spawnWorker({ task, model, timeoutMs, cwd, deps = {} }) {
   const spawnFn = deps.spawn || spawn;
   const sessionId = deps.sessionId || crypto.randomUUID();   // pinned, so the session can be resumed
-  const bin = process.env.OTB_CLAUDE_BIN || process.env.CLAUDE_BIN || 'claude';
+  const { bin, shell: workerShell } = deps.resolveBin ? deps.resolveBin() : resolveWorkerBin();
   const isRoot = typeof process.getuid === 'function' && process.getuid() === 0;
   const args = buildWorkerArgs({ sessionId, model, isRoot });
   const prompt = buildWorkerPrompt({ task });
@@ -194,7 +242,7 @@ async function spawnWorker({ task, model, timeoutMs, cwd, deps = {} }) {
         // `claude -p` with an open inherited stdin waits seconds for input that
         // never comes, on every single spawn.
         stdio: ['pipe', 'pipe', 'pipe'],
-        shell: process.platform === 'win32',   // `claude` is a .cmd shim on Windows
+        shell: workerShell,
         windowsHide: true,
         env: workerEnv(),
       });
@@ -749,7 +797,7 @@ if (require.main === module) {
 }
 
 module.exports = {
-  readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW,
+  readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, resolveWorkerBin,
   worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
   isRunnerTree, RUNNER_TREE_RE, postHeartbeat, RUNNER_STARTED_AT,

package/scripts/gds/autobongos-service.ps1

@@ -89,7 +89,12 @@ switch ($Action) {
     Assert-Prereqs
     New-Item -ItemType Directory -Force -Path $LogDir | Out-Null
 
-    $action = New-ScheduledTaskAction -Execute $Wrapper -WorkingDirectory $RepoRoot
+    # NOT $action: PowerShell variable names are CASE-INSENSITIVE, so $action IS the
+    # $Action parameter above, and its [ValidateSet]/[string] attributes stay attached
+    # to the variable. Assigning a task-action object to it throws "the value
+    # MSFT_TaskExecAction is not a valid value for the Action variable" and install
+    # fails every time, on every machine. Same trap as the `run` shadow in task 1003908.
+    $taskAction = New-ScheduledTaskAction -Execute $Wrapper -WorkingDirectory $RepoRoot
     # AtStartup covers the cold reboot the done-when actually names. AtLogOn is
     # NOT used: it would wait for someone to sign in, which is the one thing that
     # must not be required.
@@ -107,7 +112,7 @@ switch ($Action) {
     # MultipleInstances IgnoreNew = the scheduler will not start a second copy
     # over a live one; the heartbeat file is the second guard, inside the runner.
 
-    Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $trigger `
+    Register-ScheduledTask -TaskName $TaskName -Action $taskAction -Trigger $trigger `
       -Principal $principal -Settings $settings -Force | Out-Null
 
     Write-Host "installed '$TaskName' -- starts at boot, restarts on crash, logs to $LogFile"

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1030'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1031'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/autobongos_loop.mjs

@@ -563,3 +563,94 @@ test('the module-level exec helper is reachable from inside iteration()', async
   assert.equal(picked, true, 'iteration must reach the picker without touching an un-injected binding');
   assert.equal(row.event, 'nothing_claimable');
 });
+
+// --- resolveWorkerBin: the Windows spawn that corrupted every worker ---------
+//
+// Found by task 1003907 running the thing rather than testing it. `shell: true`
+// does not pass argv through on Windows: it CONCATENATES it into one command
+// line that cmd.exe re-parses, destroying the quotes in --json-schema. claude
+// then exited in ~2s with "--json-schema is not valid JSON" on EVERY worker, and
+// cadence.js classes that outcome as `quiet`, which neither trips nor forgives
+// the failure count — so a totally broken runner never escalated and looked
+// healthy in the hall. The invariant: on win32, never ask for a shell when a
+// real executable is available.
+//
+// Paths here use forward slashes deliberately. The resolver only string-matches
+// the extension on an override, and backslash-heavy literals are their own
+// source of bugs in a test that exists because of quoting.
+
+test('resolveWorkerBin: a .cmd override still gets its shell', () => {
+  const got = runner.resolveWorkerBin({ CLAUDE_BIN: 'C:/x/claude.cmd' }, 'win32');
+  assert.equal(got.bin, 'C:/x/claude.cmd');
+  assert.equal(got.shell, true, 'Node cannot spawn a .cmd without a shell (CVE-2024-27980)');
+});
+
+test('resolveWorkerBin: a real .exe override is never re-parsed by cmd.exe', () => {
+  const got = runner.resolveWorkerBin({ OTB_CLAUDE_BIN: 'C:/x/claude.exe' }, 'win32');
+  assert.equal(got.shell, false);
+});
+
+test('resolveWorkerBin: win32 with nothing on PATH falls back rather than refusing', () => {
+  const got = runner.resolveWorkerBin({ PATH: 'C:/nowhere-at-all' }, 'win32');
+  assert.deepEqual(got, { bin: 'claude', shell: true },
+    'a differently-laid-out install must still start; a mangled schema surfaces as a failed worker');
+});
+
+test('resolveWorkerBin: non-windows never asks for a shell', () => {
+  assert.deepEqual(runner.resolveWorkerBin({ PATH: '/usr/bin' }, 'linux'), { bin: 'claude', shell: false });
+});
+
+test('the schema argument is the one that cannot survive concatenation', () => {
+  const args = buildWorkerArgs({ sessionId: 'abc' });
+  const schema = args[args.indexOf('--json-schema') + 1];
+  assert.ok(schema.includes('"'), 'the regression only bites because the schema carries quotes');
+  assert.ok(schema.length > 50, 'and because it must arrive as one intact argv slot');
+});
+
+// The test that would actually have caught the shipped bug: the resolver's
+// answer has to REACH the spawn options. Testing resolveWorkerBin alone leaves
+// `shell: process.platform === 'win32'` free to reappear at the call site.
+test('spawnWorker passes the resolver’s shell verdict straight to spawn', async () => {
+  const { EventEmitter } = require('node:events');
+  let opts = null; let binSeen = null; let argvSeen = null;
+  const fakeSpawn = (bin, args, o) => {
+    binSeen = bin; argvSeen = args; opts = o;
+    const child = new EventEmitter();
+    child.stdout = new EventEmitter();
+    child.stderr = new EventEmitter();
+    child.stdin = { end: () => setImmediate(() => child.emit('close', 0)) };
+    child.kill = () => {};
+    return child;
+  };
+  await runner.spawnWorker({
+    task: { id: 7, title: 't', description: 'd' },
+    timeoutMs: 1000,
+    cwd: '.',
+    deps: { spawn: fakeSpawn, resolveBin: () => ({ bin: 'C:/x/claude.exe', shell: false }) },
+  });
+  assert.equal(opts.shell, false, 'a resolved .exe must spawn WITHOUT a shell — this is the whole fix');
+  assert.equal(binSeen, 'C:/x/claude.exe');
+  const schema = argvSeen[argvSeen.indexOf('--json-schema') + 1];
+  assert.equal(schema, JSON.stringify(WORKER_VERDICT_SCHEMA), 'the schema must arrive as one intact argv slot');
+});
+
+// The worker's own credential must survive the env allowlist (task 1003907).
+// Stripping it meant every worker on a headless host started unauthenticated and
+// exited in ~2s with no usable output — while the supervisor recorded only
+// "worker output was not JSON" and the cadence called that quiet.
+test('workerEnv passes Claude auth through, and still refuses the rest', () => {
+  const src = {
+    PATH: '/usr/bin',
+    CLAUDE_CODE_OAUTH_TOKEN: 'tok',
+    ANTHROPIC_API_KEY: 'key',
+    DATABASE_URL: 'postgres://nope',
+    GITHUB_TOKEN: 'ghp_nope',
+    NPM_TOKEN: 'npm_nope',
+  };
+  const env = runner.workerEnv(src);
+  assert.equal(env.CLAUDE_CODE_OAUTH_TOKEN, 'tok', 'a worker that cannot authenticate cannot work');
+  assert.equal(env.ANTHROPIC_API_KEY, 'key');
+  for (const leak of ['DATABASE_URL', 'GITHUB_TOKEN', 'NPM_TOKEN']) {
+    assert.equal(env[leak], undefined, `${leak} must never reach a bypassPermissions worker`);
+  }
+});