@bongos/core 1.19.1039 → 1.19.1040

package/modules/npm-release/work.js

@@ -0,0 +1,252 @@
+'use strict';
+
+// modules/npm-release/work.js — "where is my work?", answered for the deploy page (task 1002622).
+//
+// THE COMPLAINT THIS EXISTS FOR. The owner, 2026-09-26, over a /deploy that read "Serving
+// 1.19.1033 … Core 1.19.1039 is published": "I did so many tasks and changes yesterday and
+// it's not showing anything that's been done." Fifteen tasks marked shipped sat between those
+// two numbers, and the page named none of them. A version number is the least useful thing a
+// deploy page can show; the work is the thing its reader did.
+//
+// SO EVERY RECENT TASK IS PLACED IN THE STAGE IT HAS ACTUALLY REACHED, in the order work
+// travels:
+//   not_merged       the ledger says done (completed / confirmed), the code is not on main
+//   unversioned      merged after the newest version the notes reach was published
+//   not_live         in a version newer than the one this hall runs
+//   live_unreleased  running here, but not yet what other projects are offered
+//   released         running here and offered to other projects
+//   no_version       shipped, but no version names it — a ledger-only ship (a scope edit, a
+//                    verify task) or a merge whose note could not be tied to a task
+//
+// THE JOIN. A version's work comes from the release notes the package was packed with, where
+// each merge that carried `task <id>: <summary>` is `{ id, text }`. A hand-landed merge names
+// no id, so an entry without one is matched on its text against the task's own ship summary —
+// the same sentence ship.js wrote into the merge. Nothing is inferred from the changelog,
+// whose CI lines ("carrier for merges landed since …") name no work at all.
+//
+// THE PAGE KNOWS NOTHING (deploy.js's rule, kept). Every version and verdict here is a reading
+// with its source and time; a reading that failed is reported as failed, never as empty.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const api = require('../../src/module-api');
+const { readRegistry, compareVersions } = require('./registry');
+
+// The package this server runs — the one whose "live" version is this process's own core.
+// Any other package has no "live on this hall" stage: nothing here runs it.
+const CORE_PACKAGE = '@bongos/core';
+const VERSION_RE = /^\d+\.\d+\.\d+$/;
+const TEXT_MAX = 400;
+const DEFAULT_DAYS = 14;
+const MAX_DAYS = 60;
+const DEFAULT_LIMIT = 30;
+const MAX_LIMIT = 100;
+// The core carries its notes at its package root: <root>/release-notes.json, beside
+// package.json. From modules/npm-release/ that is two levels up.
+const INSTALLED_NOTES = path.join(__dirname, '..', '..', 'release-notes.json');
+
+/** The package this project publishes. Config, not code: another project names its own. */
+function configuredPackage(env = process.env) {
+  const v = String(env.NPM_RELEASE_PACKAGE || '').trim();
+  return v || CORE_PACKAGE;
+}
+
+function readInstalledNotes() {
+  try { return JSON.parse(fs.readFileSync(INSTALLED_NOTES, 'utf8')); }
+  catch { return null; }
+}
+
+function boundText(text) {
+  const t = String(text || '').trim();
+  return t.length > TEXT_MAX ? `${t.slice(0, TEXT_MAX - 1)}…` : t;
+}
+
+/** A notes file's versions, oldest first, each entry re-checked (it may have come off the network). */
+function versionsIn(notes) {
+  if (!notes || typeof notes !== 'object' || Array.isArray(notes)) return [];
+  return Object.keys(notes)
+    .filter((v) => VERSION_RE.test(v) && Array.isArray(notes[v]))
+    .sort(compareVersions)
+    .map((v) => ({
+      version: v,
+      entries: notes[v]
+        .filter((e) => e && typeof e.text === 'string' && e.text.trim())
+        .map((e) => (/^\d+$/.test(String(e.id || '')) ? { id: String(e.id), text: boundText(e.text) } : { text: boundText(e.text) })),
+    }));
+}
+
+/**
+ * Where each task stands. PURE — every input injected.
+ *
+ * `tasks`: ledger rows `{ id, title, status, at, builder, summary }`.
+ * `versions`: `versionsIn` output. `live` / `released`: versions or null. `coveredAt`: when
+ * the newest version the notes reach was published (ISO) or null when unknown.
+ */
+function placeTasks({ tasks, versions, live, released, coveredAt }) {
+  const byId = new Map();
+  const byText = new Map();
+  for (const { version, entries } of versions) {
+    for (const e of entries) {
+      if (e.id && !byId.has(e.id)) byId.set(e.id, version);
+      if (!e.id && !byText.has(e.text)) byText.set(e.text, version);
+    }
+  }
+  const covered = coveredAt ? Date.parse(coveredAt) : NaN;
+  const stages = { not_merged: [], unversioned: [], not_live: [], live_unreleased: [], released: [], no_version: [] };
+  for (const t of tasks) {
+    const row = { id: String(t.id), title: t.title, status: t.status, builder: t.builder || null, at: t.at };
+    if (t.status !== 'shipped') { stages.not_merged.push(row); continue; }
+    const version = byId.get(row.id) || (t.summary ? byText.get(boundText(t.summary)) : undefined);
+    if (!version) {
+      // Merged after the notes' newest version went out: it is waiting for the next one.
+      // Before it (or with no way to tell): no version names it.
+      const at = Date.parse(t.at);
+      if (Number.isFinite(covered) && Number.isFinite(at) && at > covered) stages.unversioned.push(row);
+      else stages.no_version.push(row);
+      continue;
+    }
+    row.version = version;
+    const offered = released ? compareVersions(version, released) <= 0 : null;
+    if (live && compareVersions(version, live) > 0) {
+      // Offered to other projects before this hall ran it — the order the Release step
+      // exists to prevent. Said, not hidden.
+      if (offered) row.offered = true;
+      stages.not_live.push(row);
+    } else if (offered === false) stages.live_unreleased.push(row);
+    else stages.released.push(row);
+  }
+  return stages;
+}
+
+/** The version history, newest first, from `before` (exclusive) down, `limit` long. PURE. */
+function history({ versions, published, live, released, newest, before, limit, titles }) {
+  const known = new Map(versions.map((v) => [v.version, v.entries]));
+  // Versions the registry lists but the notes do not reach are shown as unread, never
+  // dropped: a history with a silent hole in it reads as "nothing happened there".
+  const all = new Set(versions.map((v) => v.version));
+  for (const v of Object.keys(published || {})) if (!newest || compareVersions(v, newest) <= 0) all.add(v);
+  let list = [...all].sort(compareVersions).reverse();
+  if (before && VERSION_RE.test(before)) list = list.filter((v) => compareVersions(v, before) < 0);
+  const page = list.slice(0, limit);
+  return {
+    more: list.length > page.length,
+    versions: page.map((v) => ({
+      version: v,
+      published_at: (published && published[v]) || null,
+      live: live === v,
+      released: released === v,
+      entries: known.has(v)
+        ? known.get(v).map((e) => (e.id ? { id: e.id, title: titles.get(e.id) || null, text: e.text } : { text: e.text }))
+        : null,
+    })),
+  };
+}
+
+async function recentTasks(pool, days) {
+  // Who did it: the shipper once shipped, the last claimant before that.
+  const { rows } = await pool.query(
+    `SELECT t.id, t.title, t.status, t.value_summary,
+            COALESCE(t.shipped_at, t.updated_at) AS at,
+            COALESCE(sb.display_name, sb.github_login, cb.display_name, cb.github_login) AS builder
+       FROM tasks t
+       LEFT JOIN builders sb ON sb.id = t.shipped_by
+       LEFT JOIN LATERAL (
+         SELECT c.builder_id FROM claims c WHERE c.task_id = t.id ORDER BY c.claimed_at DESC LIMIT 1
+       ) lc ON true
+       LEFT JOIN builders cb ON cb.id = lc.builder_id
+      WHERE t.status IN ('completed', 'confirmed', 'shipped')
+        AND COALESCE(t.shipped_at, t.updated_at) >= now() - make_interval(days => $1::int)
+      ORDER BY COALESCE(t.shipped_at, t.updated_at) DESC
+      LIMIT 500`,
+    [days],
+  );
+  return rows.map((r) => ({
+    id: String(r.id),
+    title: r.title,
+    status: r.status,
+    summary: r.value_summary || null,
+    builder: r.builder || null,
+    at: r.at instanceof Date ? r.at.toISOString() : r.at,
+  }));
+}
+
+async function taskTitles(pool, ids) {
+  if (!ids.length) return new Map();
+  const { rows } = await pool.query('SELECT id, title FROM tasks WHERE id = ANY($1::bigint[])', [ids]);
+  return new Map(rows.map((r) => [String(r.id), r.title]));
+}
+
+function clampInt(v, dflt, max) {
+  const n = Number.parseInt(v, 10);
+  return Number.isInteger(n) && n > 0 ? Math.min(n, max) : dflt;
+}
+
+/**
+ * The deploy page's whole reading, in one call — the route's only dependency.
+ *
+ * `days` bounds the ledger window, `before` + `limit` page the version history. `get`,
+ * `now`, `store` and `installedNotes` are the seams tests drive; `live` defaults to this
+ * process's own core version when the package is the core.
+ */
+async function readWork({
+  pool, pkg = configuredPackage(), live, days, before, limit,
+  installedNotes = readInstalledNotes, get, now, store,
+} = {}) {
+  const windowDays = clampInt(days, DEFAULT_DAYS, MAX_DAYS);
+  const pageLimit = clampInt(limit, DEFAULT_LIMIT, MAX_LIMIT);
+  const running = live !== undefined ? live : (pkg === CORE_PACKAGE ? api.CORE_VERSION : null);
+  const liveVersion = VERSION_RE.test(String(running || '')) ? running : null;
+
+  const local = pkg === CORE_PACKAGE ? installedNotes() : null;
+  const localVersions = versionsIn(local);
+  const localTop = localVersions.length ? localVersions[localVersions.length - 1].version : null;
+
+  const { registry, notes } = await readRegistry({
+    pkg, get, now, store,
+    haveNotesFor: (v) => !!localTop && compareVersions(localTop, v) >= 0,
+  });
+
+  // The newest notes win; the installed copy stands in when they could not be read.
+  let versions = localVersions;
+  let source = localTop ? { from: 'installed', version: localTop } : null;
+  let notesError = null;
+  if (notes.ok) {
+    versions = versionsIn(notes.notes);
+    source = { from: 'package', version: notes.version };
+  } else if (!notes.skipped) {
+    notesError = notes.error || 'the release notes could not be read';
+  }
+  const coversTo = versions.length ? versions[versions.length - 1].version : null;
+  const published = registry.ok ? registry.published : {};
+  const released = registry.ok ? registry.latest : null;
+
+  const tasks = await recentTasks(pool, windowDays);
+  const stages = placeTasks({ tasks, versions, live: liveVersion, released, coveredAt: coversTo ? published[coversTo] || null : null });
+
+  const known = new Map(tasks.map((t) => [t.id, t.title]));
+  const hist = history({
+    versions, published, live: liveVersion, released,
+    newest: registry.ok ? registry.newest : coversTo,
+    before, limit: pageLimit, titles: known,
+  });
+  const missing = [...new Set(hist.versions.flatMap((v) => (v.entries || []).filter((e) => e.id && !e.title).map((e) => e.id)))];
+  if (missing.length) {
+    const more = await taskTitles(pool, missing);
+    for (const v of hist.versions) for (const e of v.entries || []) if (e.id && !e.title) e.title = more.get(e.id) || null;
+  }
+
+  return {
+    package: pkg,
+    checked_at: new Date(now ? now() : Date.now()).toISOString(),
+    live: liveVersion,
+    released,
+    newest: registry.ok ? registry.newest : null,
+    registry: registry.ok ? { ok: true } : { ok: false, error: registry.error },
+    notes: { source, covers_to: coversTo, error: notesError },
+    window_days: windowDays,
+    stages,
+    history: hist,
+  };
+}
+
+module.exports = { readWork };

package/modules/provisioning/starter-bundles.js

@@ -68,8 +68,12 @@ const ALWAYS_ON_CORE = Object.freeze([
 // provider ("enabled ONLY on the hub instance") and `provisioning` is the surface
 // that stands other instances up — a project created THROUGH the hub is a
 // consumer of both, never a second copy of them. Named so the integrity test can
-// refuse them by construction rather than by anyone remembering.
-const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning']);
+// refuse them by construction rather than by anyone remembering. `npm-release` is the
+// deploy page of the one project that PUBLISHES the core (task 1002622): every project
+// the hub creates receives those releases, so none is offered the publisher's page. It
+// is package-agnostic by construction, so offering it to a project that publishes its
+// own npm package is a later, deliberate removal from this list — with picker copy.
+const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release']);
 
 // Modules that were once offered and are being WITHDRAWN. A retired key is still
 // a module on disk — its manifest, routes and tables are deleted by later tasks —

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1039",
+  "version": "1.19.1040",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1039",
+      "version": "1.19.1040",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1039",
+  "version": "1.19.1040",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7523,5 +7523,19 @@
       "id": "1004290",
       "text": "A new release of the core is now published only after the check that it can set up a brand-new empty database has passed, so a release that cannot install cleanly can no longer reach projects."
     }
+  ],
+  "1.19.1040": [
+    {
+      "id": "1002622",
+      "text": "The Deploy page now lists every recently finished task by name and shows how far each one has got — not merged yet, published, running on Bongos, or released — plus what each version carried."
+    },
+    {
+      "id": "1004282",
+      "text": "Wrote up tonight's work on accounts and community: 12 changes finished, the site upgraded, and your page-placement decisions turned into tasks. New code is paused until the GitHub build budget resets next month."
+    },
+    {
+      "id": "1003368",
+      "text": "Closed a security hole where a builder's branch could choose the program the server runs while auto-resolving merge conflicts; the server now always uses its own trusted copy."
+    }
   ]
 }

package/scripts/gds/exec-path-guard.js

@@ -64,7 +64,7 @@ const STATIC_ROOTS = new Set([
 // brittle — a line shift re-opens the review rather than carrying a stale approval.
 const EXEMPTIONS = [
   {
-    at: 'modules/lifecycle/conflict-resolve.js:382',
+    at: 'modules/lifecycle/conflict-resolve.js:390',
     why: 'THE site this check was written for (audit ref B1), and the one place a runtime path is '
        + 'REQUIRED rather than tolerated. Each generator derives its repo root from its own '
        + '__dirname, so running the SERVER\'s copy would regenerate the deploy tree instead of the '

package/scripts/gds/install-git-hooks.js

@@ -49,14 +49,30 @@ const MERGE_DRIVER_NAME = 'otb-regen';
 //   - `.name` alone is the fatal state above.
 // So writing `.driver` FIRST makes the intermediate state safe, and removing the whole
 // section on failure makes even a mid-write abort leave no trace.
-function registerMergeDriver(root, { run = execFileSync } = {}) {
+//
+// `driverScript` (task 1003368, audit B2) pins the command to an ABSOLUTE path. The default
+// is the RELATIVE `scripts/gds/git-merge-regen.js`, which git resolves against the merge's
+// cwd — the checked-out tree — so on a clone of a builder's branch it names the BRANCH's copy
+// of the script. The server's conflict resolver passes its own checkout's copy so the command
+// git runs is never one the branch could have written. Only the server-side caller may pass
+// it; a builder's own clone keeps the relative form, which is what they want to run.
+function mergeDriverCommand(driverScript) {
+  if (!driverScript) return 'node scripts/gds/git-merge-regen.js %O %A %B %P';
+  // Forward slashes + double quotes: git hands this to `sh -c`, and a path with spaces or a
+  // Windows backslash would otherwise split or be eaten as an escape.
+  const abs = path.resolve(driverScript).replace(/\\/g, '/');
+  if (/["$`]/.test(abs)) throw new Error(`unsafe merge driver path: ${abs}`);
+  return `node "${abs}" %O %A %B %P`;
+}
+
+function registerMergeDriver(root, { run = execFileSync, driverScript } = {}) {
   // execFileSync (arg array, no shell) so the literal %O/%A/%B/%P placeholders and
   // the spaces in the command survive verbatim on every platform (a shell would
   // mangle %VARS on Windows cmd).
   try {
     // .driver FIRST — a section carrying only .driver is valid and works.
     run('git', ['config', `merge.${MERGE_DRIVER_NAME}.driver`,
-      'node scripts/gds/git-merge-regen.js %O %A %B %P'], { cwd: root, stdio: 'ignore' });
+      mergeDriverCommand(driverScript)], { cwd: root, stdio: 'ignore' });
     // .name SECOND — cosmetic (it is what `git config --list` shows); if this throws,
     // the section left behind is the safe driver-only one.
     run('git', ['config', `merge.${MERGE_DRIVER_NAME}.name`,

package/scripts/gds/publish-manifest.js

@@ -72,6 +72,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/discord/',
   'modules/provisioning/',   // instance-hosting control plane — CORE like its sibling dev-box (same do-api/cf-tunnel toolchain, all core). Reclassified IN so the core CLI scripts/gds/provision.js resolves it from the core package post-split, not a MODULE_NOT_FOUND (task 2135). default:false — shipped ≠ enabled.
   'modules/agents/',         // the declarative agent registry + spawn seam (goal 1000038) — CORE: its own manifest declares maintenance.status 'core-maintained', and it consumes the core `grade` port, so a released core without it cannot run the MAS machinery the methodology describes. default:false — shipped is not enabled (ADR 0083), exactly like provisioning + platform-identity below. Omitted at module-creation time (tasks 1002485/1002486): the omission was invisible until tests/agents_spawn.mjs became the first PUBLISHABLE file to import it and the R89 boundary guard caught it (task 1002489).
+  'modules/npm-release/',    // the deploy page's "where is the work" + version history (task 1002622). default:false — on only in the hall that publishes the core. MUST be here: modules/hall-ui/ ships as one subtree, so a released core without this carries deploy.js's loader and the #nr-work mounts with no routes behind them — the copy-desk asymmetry above.
   'modules/platform-identity/', // hub identity provider (ADR 0141) — ships in core, enabled ONLY on the hub (cloudbongos.com). MUST be here or the hub's enabledModules() throws "unknown module" and provision.js's federation load MODULE_NOT_FOUNDs (task 1002235, same rationale as provisioning above). default:false — shipped ≠ enabled; a vanilla/self-hosted instance never turns it on.
   // --- neutral (customer-0) config starters + their schemas (the filled-in *.json twins are denied) ---
   'config/branding.neutral.json',

package/src/bongos/module-scope-map.js

@@ -335,6 +335,11 @@ const MODULE_GLOBS = {
   //     The instance-side CLIENT half of federation is woven into core auth.js and is
   //     kernel territory (ADR 0141 §Packaging), NOT this key.
   'platform-identity': ['modules/platform-identity/'],
+  // --- the npm-release module (task 1002622): the deploy page's "where the work is" +
+  //     version history, and later its Release step. Its tests live at the repo root
+  //     (tests/npm_release_*.mjs) because a default-off module's own tests/ is skipped
+  //     by the unit runner. The /deploy page shell stays hall-ui's (one key per surface).
+  'npm-release': ['modules/npm-release/', 'tests/npm_release_*.mjs'],
   // --- instance provisioning: the web-tier REQUEST + STATE surface (module home)
   //     plus the control-plane runner CLI — a command travels with its domain (the
   //     lifecycle/dev-box precedent). Covers the projects-surface work (goal

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1039'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1040'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/conflict_resolve.mjs

@@ -16,6 +16,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 const cr = require('../modules/lifecycle/conflict-resolve.js');
@@ -90,6 +91,7 @@ function mkExec(scn = {}) {
 
 function mkDeps(scn = {}, over = {}) {
   const reg = [];
+  const regOpts = [];
   const exec = mkExec(scn);
   const genCalls = [];
   return {
@@ -105,12 +107,13 @@ function mkDeps(scn = {}, over = {}) {
       buildAuthUrl: () => 'https://x-access-token:REDACTED@github.com/o/r.git',
     },
     repoInfo: over.repoInfo === undefined ? { owner: 'o', repo: 'r' } : over.repoInfo,
-    registerMergeDriver: (root) => { reg.push(root); },
+    registerMergeDriver: (root, opts) => { reg.push(root); regOpts.push(opts); },
     repoRoot: '/srv/repo',
     mkdtemp: () => '/tmp/otb-resolve-test',
     rmtmp: () => {},
     _exec: exec,
     _reg: reg,
+    _regOpts: regOpts,
     _gen: genCalls,
   };
 }
@@ -129,6 +132,17 @@ test('clean generated/index merge → resolved + pushed; driver registered in th
   assert.ok(ran(deps._exec, 'push'), 'the resolved branch is pushed');
 });
 
+// Task 1003368 (audit B2): the driver command must name the SERVER's copy of the script,
+// never the clone's (which is the builder's branch).
+test('the otb-regen driver is pinned to the server checkout, not the clone', async () => {
+  const deps = mkDeps({ merge: 'clean', before: 'oldsha1', after: 'newsha2' });
+  await cr.resolveBranchConflicts({ branch: 'claude/wt-1' }, deps);
+  const script = deps._regOpts[0] && deps._regOpts[0].driverScript;
+  assert.ok(script, 'registration must pass a driverScript');
+  assert.equal(path.resolve(script), path.resolve('/srv/repo', 'scripts', 'gds', 'git-merge-regen.js'));
+  assert.ok(!path.resolve(script).startsWith(path.resolve('/tmp/otb-resolve-test')), 'never inside the clone');
+});
+
 test('genuine hand-written conflict → NOT resolved, merge aborted, never pushed', async () => {
   const deps = mkDeps({ merge: 'conflict', conflicted: ['src/bongos/db.js'] });
   const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-2' }, deps);

package/tests/merge_driver_register.mjs

@@ -99,6 +99,34 @@ test('registerMergeDriver writes .driver BEFORE .name', () => {
     'order is the fix: the intermediate state after write #1 must be the SAFE one');
 });
 
+// Task 1003368 (audit B2): the default command is RELATIVE, which git resolves against the
+// checked-out tree. The server passes an absolute driverScript so the command never names a
+// file the branch could have written.
+test('registerMergeDriver: default command stays relative, driverScript pins an absolute path', () => {
+  const commands = [];
+  const run = (_bin, args) => { if (args[1] === `merge.${MERGE_DRIVER_NAME}.driver`) commands.push(args[2]); };
+  registerMergeDriver('/nowhere', { run });
+  assert.equal(commands[0], 'node scripts/gds/git-merge-regen.js %O %A %B %P');
+
+  const script = path.join(REPO_ROOT, 'scripts', 'gds', 'git-merge-regen.js');
+  registerMergeDriver('/nowhere', { run, driverScript: script });
+  const pinned = commands[1];
+  const m = pinned.match(/^node "([^"]+)" %O %A %B %P$/);
+  assert.ok(m, `pinned command has the quoted-absolute shape, got: ${pinned}`);
+  assert.ok(path.isAbsolute(m[1]), 'the pinned path must be absolute');
+  assert.ok(!m[1].includes('\\'), 'backslashes would be eaten by sh -c');
+  assert.equal(path.resolve(m[1]), script);
+});
+
+test('registerMergeDriver: a path that could break out of the quotes is refused, leaving no trace', () => {
+  const calls = [];
+  const run = (_bin, args) => { calls.push(args); };
+  const res = registerMergeDriver('/nowhere', { run, driverScript: '/srv/x"; touch pwned; "/a.js' });
+  assert.equal(res.ok, false);
+  assert.match(res.error, /unsafe merge driver path/);
+  assert.ok(!calls.some((a) => a[1] === `merge.${MERGE_DRIVER_NAME}.driver`), 'nothing may be written');
+});
+
 test('a failure mid-registration removes the whole section, leaving no trace', () => {
   const calls = [];
   const run = (_bin, args) => {

package/tests/module_loader.mjs

@@ -276,7 +276,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'public-landing', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'npm-release', 'onboarding', 'platform-identity', 'provisioning', 'public-landing', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();