@bongos/core 1.19.130 → 1.19.131

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.130",
-  "core_contract": "1.19.130",
-  "source_commit": "9cfc165fbc5b116976ad07e249f0ed45287f3bcf",
+  "core_version": "1.19.131",
+  "core_contract": "1.19.131",
+  "source_commit": "7fc91a6722c91cd40c09ce632c2a765377952e49",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T03:15:08.211Z",
+  "built_at": "2026-08-15T03:23:58.787Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1246,
+    "functional_verbatim": 1247,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1570,
-  "tree_sha256": "9c3f424caabdd8755729a2c59370b4ea6c2c0e14f591297b3769f3f18ae3da41",
+  "file_count": 1571,
+  "tree_sha256": "81215c25cbaed99553dba15247df2e2f9daf37245d8144df0a5e32b507b4c0b9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4172,12 +4172,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d530560bb0e2b69c73bba650529a2d45f3bb4c09728c54e012987f4340681c93"
+      "sha256": "ad651e607ce3937ca8522552d21ecfbaa03108734f9c7987c79a2e8ef8a7c7f3"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1c4c6038789240a0e60015e8501ad5aa572b1c630d0754ee65147acb5a10bb5b"
+      "sha256": "178ddf3d5958c428d370e3381cdca505455abe6006b9f920245de0062bc2d5aa"
     },
     {
       "path": "public-docs/index.html",
@@ -5157,7 +5157,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "5ff111416adc80a4513bc91488185f5f47800f16c1fe8b746e0982ee9b4ffeb9"
+      "sha256": "4c3bef6907b4807d93426e754ff20c75e56b498e4302c1cd47e4b3953bd8b4d0"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5322,7 +5322,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "7ae14021dbae94ffc5a70cf05081e645ca2dcf9685ccf135658538cb44e79dde"
+      "sha256": "681de343f8491a2f22165246f21ac371a8f76411b395991c784635e8e9646ed7"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5762,7 +5762,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d7733ec4964e2aff924d904ee73784843f81ea72c3e2eeb6f3c7ea816c62ceb6"
+      "sha256": "fd76c822f4e795248c2c010052dab9cce8cc237a5f501fbf90e66c413c58eac6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7654,6 +7654,11 @@
       "mode": "0000644",
       "sha256": "23731936e26feb6406333f484c86210be2f2eaee1b4060ba34c9e03f8fd09685"
     },
+    {
+      "path": "tests/ship_publish_error.mjs",
+      "mode": "0000644",
+      "sha256": "eb8c52362355479a50c83ba84968d605b93f98e93513cf8436dd096e6514f6e8"
+    },
     {
       "path": "tests/ship_resume.mjs",
       "mode": "0000644",
@@ -7767,7 +7772,7 @@
     {
       "path": "tests/subdomain_auth.mjs",
       "mode": "0000644",
-      "sha256": "e28409f9063a36482482bcb295de5c629430dd28c53a03e1b3c979d5566306dd"
+      "sha256": "24257ca4ad1a7bcefb735ee1b02609469035730e0723645f71e10eb71525bb72"
     },
     {
       "path": "tests/task_classifier_vocab.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.130",
+  "version": "1.19.131",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.130",
+      "version": "1.19.131",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.130",
+  "version": "1.19.131",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -77,7 +77,7 @@ const INTEGRATION = new Set([
   'governance_fold_bench', 'governance_live_proof', 'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'reward_mode_cost_plus_only',
   'session_records', 'setup_smoke',
-  'status-probe', 'subdomain_auth',
+  'status-probe',
 ]);
 
 // Excluded so this gate is trustworthy in a CLEAN checkout (the CI condition):

package/scripts/gds/ship.js

@@ -1213,6 +1213,34 @@ async function ciLand(taskId, branch, valueSummary) {
   return await ciLandLocal(taskId, branch, valueSummary);
 }
 
+// task 1001916: render a FAILED POST /tasks/:id/publish-branch for the builder.
+// The server has carried { step, reason } — which git step failed + the
+// credential-scrubbed stderr — since task 1547, but the bail site printed only
+// `data.message || data.error`: "[object Object]" on the ADR 0116 envelope, a
+// bare `publish_failed` on the legacy flat shape. That hid a non-fast-forward
+// rejection (the server had already freshened the branch itself) across several
+// blind retry laps, so that case also gets its specific remedy. Pure + exported
+// for tests/ship_publish_error.mjs (no git, no network).
+const NON_FAST_FORWARD_RE = /fetch first|non-fast-forward/i;
+
+function formatPublishFailure(data, status, branch) {
+  const { code, message } = normalizeApiError(data);
+  const envelopeDetails = (data && data.error && typeof data.error === 'object' && data.error.details) || null;
+  const details = envelopeDetails || data || {};
+  const label = message || code || (data && data.message) || `HTTP ${status}`;
+  // git stderr is multi-line; this is embedded mid-sentence in one log line.
+  const reason = details.reason ? String(details.reason).replace(/\s+/g, ' ').trim() : '';
+  const parts = [];
+  if (details.step) parts.push(`step: ${details.step}`);
+  if (reason) parts.push(`reason: ${reason}`);
+  let out = parts.length ? `${label} (${parts.join('; ')})` : label;
+  if (NON_FAST_FORWARD_RE.test(reason)) {
+    out += ` — the server already moved ${branch}: fetch origin, reset onto origin/${branch}, `
+      + 're-run the generators, and re-ship so the push fast-forwards.';
+  }
+  return out;
+}
+
 // ciLandServer — the dev-box path: no GitHub push credential on this machine, so
 // hand the branch to the GDS, which pushes it + opens the PR + auto-merges with
 // the server-side credential. Requires a RE-AUTHED (non-box) cli session — a
@@ -1249,7 +1277,7 @@ async function ciLandServer(taskId, branch, valueSummary) {
       return landBailed('server-mediated push is not configured (operator action)', strandCommand(taskId, 'server'));
     }
     if (!r.ok) {
-      const e = (r.data && (r.data.message || r.data.error)) || `HTTP ${r.status}`;
+      const e = formatPublishFailure(r.data, r.status, branch);
       console.log(`  ci-land: server publish failed — ${e}. Task stays at confirmed. ${strandNextStep(taskId, 'server')}`);
       return landBailed(`server publish failed — ${e}`, strandCommand(taskId, 'server'));
     }
@@ -4472,6 +4500,10 @@ module.exports = {
   // object, so a consumer MUST test `.ok`; the old `if (!merged)` would sail past
   // a bail. Also pins pending (a poll timeout) as distinct from bailed.
   landed, landPending, landBailed, strandCommand,
+  // task 1001916: the publish-branch failure formatter — exported pure so both
+  // wire shapes (envelope + legacy flat), the step/reason surfacing, and the
+  // non-fast-forward remedy hint are pinned without a server.
+  formatPublishFailure,
   // task 1719: pure post-land status reconciler — a task that reached 'shipped'
   // in-session shows the SHIPPED banner + writes no breadcrumb; otherwise keep the
   // pre-merge status (confirmed → next-turn breadcrumb fallback). Exported for tests.

package/src/module-api.js

@@ -687,8 +687,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.128 with no explicit bump. run 31858158416. (task 1002620)
 //   1.19.130 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.129 with no explicit bump. run 31861289412. (task 1002620)
+//   1.19.131 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.130 with no explicit bump. run 31861682626. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.130'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.131'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/ship_publish_error.mjs

@@ -0,0 +1,119 @@
+// tests/ship_publish_error.mjs
+//
+// Unit tests for formatPublishFailure (scripts/gds/ship.js, task 1001916) — the
+// display string ciLandServer prints when POST /tasks/:id/publish-branch fails.
+//
+// Why this exists: the server has carried { step, reason } (the credential-
+// scrubbed git stderr) since task 1547, but ciLandServer printed only
+// `r.data.message || r.data.error`. On the ADR 0116 envelope that renders
+// "[object Object]", and on the legacy flat shape a bare "publish_failed" — so a
+// non-fast-forward rejection (the server had already freshened the branch) was
+// invisible and the builder retried blind for several laps. What we prove here:
+//   1. Both wire shapes resolve to the CODE, never "[object Object]".
+//   2. step + reason appear when the server sent them.
+//   3. A non-fast-forward reason carries the specific remedy hint (reset onto
+//      origin/<branch>, re-run the generators, re-ship) — and only then.
+// Pure: no network, no git, no fs.
+//
+// Run:  node tests/ship_publish_error.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+const BRANCH = 'claude/task-1001916';
+const fmt = (data, status = 500, branch = BRANCH) => ship.formatPublishFailure(data, status, branch);
+
+// ---------- 1. bare error, no step/reason ----------
+
+test('legacy flat { error: code } with no details reads as the bare code', () => {
+  const out = fmt({ error: 'publish_failed' });
+  assert.match(out, /publish_failed/);
+  assert.ok(!/step:/.test(out), 'no step was sent, so none is invented');
+  assert.ok(!/reason:/.test(out), 'no reason was sent, so none is invented');
+});
+
+test('ADR 0116 envelope with no details resolves to the code, never [object Object]', () => {
+  const out = fmt({ error: { code: 'publish_failed', message: 'publish_failed' } });
+  assert.match(out, /publish_failed/);
+  assert.ok(!/\[object Object\]/.test(out), 'the envelope object must never be stringified raw');
+});
+
+test('no body at all falls back to the HTTP status', () => {
+  assert.match(fmt(null, 502), /HTTP 502/);
+});
+
+// ---------- 2. error + step + reason ----------
+
+test('envelope details carry step + reason into the message', () => {
+  const out = fmt({
+    error: {
+      code: 'publish_failed',
+      message: 'publish_failed',
+      details: { step: 'push', reason: 'remote: Permission to org/repo.git denied' },
+    },
+  });
+  assert.match(out, /publish_failed/);
+  assert.match(out, /step: push/);
+  assert.match(out, /Permission to org\/repo\.git denied/);
+});
+
+test('legacy flat top-level step + reason are surfaced the same way', () => {
+  const out = fmt({ error: 'publish_failed', step: 'fetch', reason: 'could not read Username' });
+  assert.match(out, /step: fetch/);
+  assert.match(out, /could not read Username/);
+});
+
+test('a non-git failure reason gets NO fast-forward remedy hint', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: 'Permission denied (publickey)' });
+  assert.ok(!/fast-forward/i.test(out), 'the remedy hint is for a stale-branch push only');
+  assert.ok(!/reset/i.test(out), 'nor the reset instruction');
+});
+
+// ---------- 3. the non-fast-forward remedy hint ----------
+
+const NON_FF_STDERR =
+  '! [rejected] claude/task-1001916 -> claude/task-1001916 (fetch first)\n' +
+  "error: failed to push some refs to 'github.com/org/repo.git'";
+
+test('a "fetch first" rejection names the branch and the reset-onto-origin remedy', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: NON_FF_STDERR });
+  assert.match(out, /step: push/);
+  assert.match(out, new RegExp(`origin/${BRANCH}`), 'points at the ref the server already moved');
+  assert.match(out, /reset/i, 'names the reset');
+  assert.match(out, /generator/i, 'and the regenerate step before re-shipping');
+  assert.match(out, /re-ship|fast-forward/i, 'and why: so the push fast-forwards');
+  assert.ok(!/\n/.test(out), 'multi-line git stderr is collapsed — this goes mid-sentence into one log line');
+});
+
+test('the "non-fast-forward" wording triggers the same hint through the envelope', () => {
+  const out = fmt({
+    error: {
+      code: 'publish_failed',
+      message: 'publish_failed',
+      details: { step: 'push', reason: 'Updates were rejected: non-fast-forward' },
+    },
+  });
+  assert.match(out, new RegExp(`origin/${BRANCH}`));
+  assert.match(out, /reset/i);
+});
+
+console.log('');
+console.log(`ship_publish_error: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/subdomain_auth.mjs

@@ -1,14 +1,46 @@
 // tests/subdomain_auth.mjs — the builders-subdomain auth helpers (#726).
 //
 // Locks down the two security-sensitive pure helpers added for the dedicated
-// builders.amazonprimea.com subdomain:
+// builders.<apex> subdomain:
 //   - safeReturnTo: the open-redirect guard on the post-sign-in return target.
 //   - sessionCookieDomainOpts: which hosts get an apex-scoped session cookie
 //     (so one sign-in spans the subdomains) vs a host-only one (localhost,
 //     staging — which must NOT bleed a token across environments).
 // Pure functions, no DB — requiring the route module does not open a pool.
+//
+// Both helpers derive their allowed hosts from the instance branding pack's
+// domains.cookieDomain, so the fixtures inject a SYNTHETIC pack (the
+// GDS_BRANDING_FILE seam, as tests/single_host_hall.mjs does) instead of
+// reading whatever config/branding.json happens to be on disk. That keeps the
+// assertions identical on every instance — the neutral core (cookieDomain "")
+// and a branded host alike. envPrefix is overridden too so an ambient
+// <PREFIX>_COOKIE_DOMAIN in the shell cannot reach the resolver.
+//
+// Run:  node tests/subdomain_auth.mjs
 
 import { createRequire } from 'node:module';
+import { writeFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// The apex every fixture below is built from. RFC 2606 reserved TLD — clearly
+// synthetic, never routable, and no host brand is baked into this file.
+const APEX = 'bongos-test.example';
+
+const brandDir = mkdtempSync(join(tmpdir(), 'cb-subdomain-auth-'));
+const brandFile = join(brandDir, 'branding.json');
+writeFileSync(brandFile, JSON.stringify({
+  envPrefix: 'SUBDOMAIN_AUTH_FIXTURE',
+  // Leading dot mirrors the real packs; configuredCookieApex() strips it.
+  domains: { cookieDomain: `.${APEX}`, publicOrigin: `https://${APEX}` },
+}));
+process.env.GDS_BRANDING_FILE = brandFile;
+// The pack is only read once (auth.js resolves COOKIE_APEX at module load);
+// remove the temp dir on every exit path so runs don't accumulate in tmpdir.
+process.on('exit', () => { try { rmSync(brandDir, { recursive: true, force: true }); } catch { /* best-effort */ } });
+
+// Required AFTER the pack is in place — auth.js resolves COOKIE_APEX at module
+// load, and branding() memoizes on its first call.
 const require = createRequire(import.meta.url);
 const authRoute = require('../src/bongos/routes/auth.js');
 
@@ -24,15 +56,15 @@ console.log('\nsafeReturnTo — accepts safe same-city targets:');
 ok(safeReturnTo('/builders') === '/builders', 'relative /builders');
 ok(safeReturnTo('/watch') === '/watch', 'relative /watch');
 ok(safeReturnTo('/builders/settings?x=1') === '/builders/settings?x=1', 'relative path with query');
-ok(safeReturnTo('https://builders.amazonprimea.com/watch') === 'https://builders.amazonprimea.com/watch', 'absolute builders subdomain');
-ok(safeReturnTo('https://amazonprimea.com/builders') === 'https://amazonprimea.com/builders', 'absolute apex');
-ok(safeReturnTo('https://status.amazonprimea.com/') === 'https://status.amazonprimea.com/', 'absolute status subdomain');
+ok(safeReturnTo(`https://builders.${APEX}/watch`) === `https://builders.${APEX}/watch`, 'absolute builders subdomain');
+ok(safeReturnTo(`https://${APEX}/builders`) === `https://${APEX}/builders`, 'absolute apex');
+ok(safeReturnTo(`https://status.${APEX}/`) === `https://status.${APEX}/`, 'absolute status subdomain');
 
 console.log('\nsafeReturnTo — rejects everything else (→ null, caller falls back):');
 ok(safeReturnTo('//evil.com') === null, 'protocol-relative //evil.com');
 ok(safeReturnTo('https://evil.com/builders') === null, 'foreign https origin');
-ok(safeReturnTo('https://amazonprimea.com.evil.com/') === null, 'lookalike suffix host');
-ok(safeReturnTo('http://amazonprimea.com/builders') === null, 'http (non-https) apex');
+ok(safeReturnTo(`https://${APEX}.evil.com/`) === null, 'lookalike suffix host');
+ok(safeReturnTo(`http://${APEX}/builders`) === null, 'http (non-https) apex');
 ok(safeReturnTo('javascript:alert(1)') === null, 'javascript: scheme');
 ok(safeReturnTo('/path\\with\\backslash') === null, 'backslash path');
 ok(safeReturnTo('') === null, 'empty');
@@ -43,15 +75,15 @@ ok(safeReturnTo('builders') === null, 'bare word (no leading slash, not a URL)')
 // ---- sessionCookieDomainOpts: cross-subdomain scoping ----------------------
 const reqWith = (host) => ({ headers: { host } });
 console.log('\nsessionCookieDomainOpts — apex-scoped on production hosts:');
-ok(sessionCookieDomainOpts(reqWith('amazonprimea.com')).domain === '.amazonprimea.com', 'apex → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('www.amazonprimea.com')).domain === '.amazonprimea.com', 'www → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('builders.amazonprimea.com')).domain === '.amazonprimea.com', 'builders → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('status.amazonprimea.com')).domain === '.amazonprimea.com', 'status → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('amazonprimea.com:3000')).domain === '.amazonprimea.com', 'apex with port');
+ok(sessionCookieDomainOpts(reqWith(APEX)).domain === `.${APEX}`, `apex → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`www.${APEX}`)).domain === `.${APEX}`, `www → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`builders.${APEX}`)).domain === `.${APEX}`, `builders → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`status.${APEX}`)).domain === `.${APEX}`, `status → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`${APEX}:3000`)).domain === `.${APEX}`, 'apex with port');
 
 console.log('\nsessionCookieDomainOpts — host-only elsewhere (no domain key):');
 ok(sessionCookieDomainOpts(reqWith('localhost:3000')).domain === undefined, 'localhost → host-only');
-ok(sessionCookieDomainOpts(reqWith('staging.amazonprimea.com')).domain === undefined, 'staging → host-only (no cross-env bleed)');
+ok(sessionCookieDomainOpts(reqWith(`staging.${APEX}`)).domain === undefined, 'staging → host-only (no cross-env bleed)');
 ok(sessionCookieDomainOpts(reqWith('127.0.0.1')).domain === undefined, 'raw IP → host-only');
 
 console.log(`\nSubdomain-auth tests: ${pass} passed, ${fail} failed`);