@bongos/core 1.19.1040 → 1.19.1041

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1040",
-  "core_contract": "1.19.1040",
-  "source_commit": "a256763721159dea620730a17c310ed3822eeacc",
+  "core_version": "1.19.1041",
+  "core_contract": "1.19.1041",
+  "source_commit": "781aa748b3e03ade6ce8a871f235a3c9b2807f0a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-26T15:14:19.754Z",
+  "built_at": "2026-09-26T16:00:35.772Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 542,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2505,
+    "functional_verbatim": 2506,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3074,
-  "tree_sha256": "4e0126a091e5b21480bcca26c7d5619daa813b1aa63a1d2e3cf82012025e18ef",
+  "file_count": 3075,
+  "tree_sha256": "ecbc8d868250fced6eeba4366b6b3f8dcd1a71502be7e3ec23650aa23f615da7",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2767,7 +2767,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8d485d36bc3666b90612951d770aafd501c99685b47037fe1266067e2e25ee6e"
+      "sha256": "54fe0dfc62e378fa8e590fbdce05a0094885cccae13b665007d96e7797f66d6e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4692,7 +4692,7 @@
     {
       "path": "modules/grading/grader-subagent.js",
       "mode": "0000644",
-      "sha256": "a7e7c0cd702ff1a6b83d12ce0310de72ed601c6a4b8e886f1a873eeaeaaecadd"
+      "sha256": "ab47b186029c899a4e6ab43b3b5850dece658737ad08bdeec25a2653b6af62c0"
     },
     {
       "path": "modules/grading/grader-workers/efficiency.js",
@@ -8487,12 +8487,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d83c4076ed5e94de9befd99c7ff4800562337eb0f3d9fc9f0c62d1ae3b3e6dad"
+      "sha256": "c414fedc98910e53cb9b9e41f6f5bbf1d0c446e112bc79bbedb0417ca21f3d7d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4425872eb0b34a10053885be882b6f7e44a332c7c01c18f1d3c9d919b0303f5c"
+      "sha256": "f7f732d65454317018b4df384ee3623df53b288846eff4bb5eecb251c2c8f50e"
     },
     {
       "path": "public-docs/index.html",
@@ -8512,7 +8512,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "2d5fb0f342a3fa42c5edad00a107bf216de3983d04d0e7a458d43176fcaca9f8"
+      "sha256": "2299f29e67b632093950b98bbe95449c68f020a202b46c3b2de3e722373005fe"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10572,7 +10572,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fea845918024c63fe58a76857f8cc0ab2dadb385e6258d6298f8c5dbead05a0a"
+      "sha256": "111153edb1c12f70dc1803c615be20ed3364ffb7971ff08cfc7b34a3eefee224"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12492,7 +12492,7 @@
     {
       "path": "tests/grade_model_provider.mjs",
       "mode": "0000644",
-      "sha256": "11cfa2deade2db1f88f643d9aa310d34bdd0f37423944db4a68fa0ea2b2eba77"
+      "sha256": "ecc16c3daa0d5d8e47af493433f39a62882571949686d20e1b3bde9eef9e1ff7"
     },
     {
       "path": "tests/grade_server_authoritative.mjs",
@@ -12554,6 +12554,11 @@
       "mode": "0000644",
       "sha256": "50a785eb6e2c71d5a043c2ec2c37a835777da6397dac3ffc2542acdde14b57a8"
     },
+    {
+      "path": "tests/grader_reviewer_isolation.mjs",
+      "mode": "0000644",
+      "sha256": "ee95ed46c2593541105e9fc42a21fe7e4a6a19f8ba54156856df1d8e8c06021f"
+    },
     {
       "path": "tests/grader_root_outage.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2559,5 +2559,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1038 with no explicit bump. run 36229255566. (task 1002620)
   1.19.1040 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1039 with no explicit bump. run 36251192410. (task 1002620)
+  1.19.1041 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1040 with no explicit bump. run 36253865251. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/grading/grader-subagent.js

@@ -47,12 +47,19 @@ function runClaudeCli({ prompt, opts = {} }) {
     const isRoot = typeof process.getuid === 'function' && process.getuid() === 0;
     const permissionMode = isRoot ? 'acceptEdits' : 'bypassPermissions';
 
+    // NO MCP SERVERS (task 1000380). `--tools Read` limits the BUILT-IN tools only;
+    // MCP servers are a separate list, so without `--strict-mcp-config` every worker
+    // inherited the host's configured servers and claude.ai connectors — measured at
+    // 21 extra tools on the owner's Mac, a docs connector that can delete documents
+    // among them — inside a session with no permission prompts, reading a diff
+    // someone else wrote. Strict mode with no `--mcp-config` loads zero servers.
     const args = [
       '-p',
       '--print',
       '--model', model,
       '--output-format', 'json',
       '--tools', 'Read',
+      '--strict-mcp-config',
       '--disable-slash-commands',
       '--permission-mode', permissionMode,
     ];

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1040",
+  "version": "1.19.1041",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1040",
+      "version": "1.19.1041",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1040",
+  "version": "1.19.1041",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7537,5 +7537,11 @@
       "id": "1003368",
       "text": "Closed a security hole where a builder's branch could choose the program the server runs while auto-resolving merge conflicts; the server now always uses its own trusted copy."
     }
+  ],
+  "1.19.1041": [
+    {
+      "id": "1000380",
+      "text": "The grader's reviewers now see only the file-reading tool they need. Before, they could also reach every service connected on the machine running them, such as documents and email, with no approval prompts, while reading code"
+    }
   ]
 }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1040'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1041'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grade_model_provider.mjs

@@ -74,7 +74,7 @@ test('the Claude spawn is the default provider, with the identical argv', { skip
     const r = await subagent.runSubagent({ prompt: 'hi', opts: { claudeBin: bin, model: 'claude-sonnet-5', cwd: dir } });
     const argv = JSON.parse(subagent.extractAssistantResult(r.stdout));
     const perm = typeof process.getuid === 'function' && process.getuid() === 0 ? 'acceptEdits' : 'bypassPermissions';
-    assert.deepEqual(argv, ['-p', '--print', '--model', 'claude-sonnet-5', '--output-format', 'json', '--tools', 'Read', '--disable-slash-commands', '--permission-mode', perm]);
+    assert.deepEqual(argv, ['-p', '--print', '--model', 'claude-sonnet-5', '--output-format', 'json', '--tools', 'Read', '--strict-mcp-config', '--disable-slash-commands', '--permission-mode', perm]);
     assert.equal(r.cost_usd, 0.5);
     const d = await subagent.runSubagent({ prompt: 'hi', opts: { claudeBin: bin, cwd: dir } });
     assert.equal(JSON.parse(subagent.extractAssistantResult(d.stdout))[3], 'claude-sonnet-5', 'no model → the default grader model, as before');

package/tests/grader_reviewer_isolation.mjs

@@ -0,0 +1,68 @@
+// tests/grader_reviewer_isolation.mjs — a grader reviewer sees the Read tool and
+// NOTHING the host happens to have connected (task 1000380, re-scoped 2026-09-26).
+//
+// THE GAP THIS PINS. Every panel worker is a `claude -p` session reading a diff that
+// someone else wrote, launched with permission prompts off (bypassPermissions, or
+// acceptEdits as root — task 1003574). `--tools Read` limits the BUILT-IN tools only.
+// It says nothing about MCP servers, so without `--strict-mcp-config` a reviewer
+// inherits every server the host has configured — the user's settings, the project's
+// .mcp.json, and the claude.ai connectors. Measured on the owner's Mac on 2026-09-26
+// with the reviewer's exact flags: 22 tools (Read + 21 MCP tools, among them a docs
+// connector that can create and delete documents); with `--strict-mcp-config`, 1.
+// A diff that smuggles instructions to its reviewer had those 21 tools to reach for,
+// with nothing to prompt for approval.
+//
+// `--strict-mcp-config` with no `--mcp-config` beside it loads zero servers, which is
+// the whole intent: a reviewer needs no MCP server to read files.
+//
+// Run:  node --test tests/grader_reviewer_isolation.mjs
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const subagent = require('../modules/grading/grader-subagent.js');
+
+// A stand-in `claude` that answers with the argv it was launched with, in the
+// result envelope the real CLI uses — so the test reads what was ACTUALLY passed
+// to the spawn, not what the source text looks like.
+async function spawnArgv(opts = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grader-isolation-'));
+  const bin = path.join(dir, 'claude');
+  fs.writeFileSync(bin, '#!/usr/bin/env node\nprocess.stdin.resume(); process.stdin.on("end", () => process.stdout.write(JSON.stringify({ type: "result", result: JSON.stringify(process.argv.slice(2)) })));\n');
+  fs.chmodSync(bin, 0o755);
+  try {
+    const r = await subagent.runSubagent({ prompt: 'review this', opts: { claudeBin: bin, cwd: dir, ...opts } });
+    return JSON.parse(subagent.extractAssistantResult(r.stdout));
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+const skip = process.platform === 'win32' && 'the stand-in CLI is a shebang script';
+
+test('a reviewer is launched with --strict-mcp-config, so no host MCP server loads', { skip }, async () => {
+  const argv = await spawnArgv();
+  assert.ok(argv.includes('--strict-mcp-config'),
+    `every reviewer spawn must ignore the host's MCP configuration; argv was ${JSON.stringify(argv)}`);
+  // Strict mode with no config file is what makes the server list EMPTY. Handing it
+  // a config would re-open exactly the door the flag closes.
+  assert.ok(!argv.includes('--mcp-config'), 'no MCP config is supplied to a reviewer');
+});
+
+test('the flag holds for every model the panel runs, not only the default', { skip }, async () => {
+  for (const model of ['claude-sonnet-5', 'claude-opus-5-5', 'claude-haiku-4-5-20251001']) {
+    const argv = await spawnArgv({ model });
+    assert.ok(argv.includes('--strict-mcp-config'), `missing for ${model}`);
+  }
+});
+
+test('the built-in tool list is still Read alone — the two limits work together', { skip }, async () => {
+  const argv = await spawnArgv();
+  const i = argv.indexOf('--tools');
+  assert.ok(i >= 0, '--tools is passed');
+  assert.equal(argv[i + 1], 'Read', 'the only built-in tool is Read');
+});