@bongos/core 1.19.138 → 1.19.139

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.138",
-  "core_contract": "1.19.138",
-  "source_commit": "c881ff7b166e960c529748049090f53ad17276c8",
+  "core_version": "1.19.139",
+  "core_contract": "1.19.139",
+  "source_commit": "f5c30a288b3d2e438db66a6c80a845c6d389c3b7",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T14:53:14.334Z",
+  "built_at": "2026-08-15T15:00:38.021Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1574,
-  "tree_sha256": "09b573285811157440bc46ef823f8ae2adf4735d9a0d559e656a7a68793a0bdf",
+  "tree_sha256": "a3c1891b3b817e057662118da1da9b7952ea9c428344f02c4fbc87cf15fb468f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4177,12 +4177,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b3bd34c7f961631c76f810499e202ecf7ff7b28beb3933da63fd89be5b684e6b"
+      "sha256": "82837d1851e437e93bd6027ad59f49e9b1cff5fe4cbc0ba6d1bb8685b243308d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "470274822238a12b1ad33021c5c9fc233f69beefdb30730fc7208257e01a11ef"
+      "sha256": "eddbbbd8e503347796b3df0c99c4891a15815c91d86223cc19384bde1e1abec1"
     },
     {
       "path": "public-docs/index.html",
@@ -4437,7 +4437,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "060cfd1249c09576e634c7c84c8470207cf55b93cb0719cc89821c8c59aa2a17"
+      "sha256": "1cc492c8b781bd67f284d3fbcb3d2d46a7159dc6de8af3fb92e2b5589e4f7b10"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5767,7 +5767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b5bbd063bab04b41b5fa8769f2c8de1e0919c28be09bcdf45345ff9440558205"
+      "sha256": "599d420de3284de8a307b0ab87a3506faa8f3e3c9f0014d5bdd36bdeaa1a7317"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7312,7 +7312,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "ee5c944f9e3bd3d618c977e76d4e2ba3e663ce59bf7833f9427a0191717ba57d"
+      "sha256": "5a3f724b4e84324d7560254517612b45fd4e4e31e57ebbb0b35a4021d712df6b"
     },
     {
       "path": "tests/provision.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.138",
+  "version": "1.19.139",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.138",
+      "version": "1.19.139",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.138",
+  "version": "1.19.139",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -1438,9 +1438,16 @@ h1[tabindex="-1"]:focus{outline:none;}
     setView('mine');
     tryAnchor();   /* the list may already be rendered from an earlier visit */
   }
+  /* Card-shell lookup by instance id. CSS.escape, not esc(): the data-inst
+     attribute holds the DECODED value, so an HTML-escaped id would never match
+     — and raw interpolation is selector injection. esc() stays correct for
+     RENDERING data-inst into markup; this is the only selector path. */
+  function liFor(id) {
+    return document.querySelector('li[data-inst="' + CSS.escape(String(id == null ? '' : id)) + '"]');
+  }
   function tryAnchor() {
     if (!pendingAnchor) return;
-    var li = document.querySelector('li[data-inst="' + pendingAnchor + '"]');
+    var li = liFor(pendingAnchor);
     if (!li) return;
     pendingAnchor = null;
     /* a search or state filter that hides the target would turn the anchor
@@ -3112,7 +3119,7 @@ h1[tabindex="-1"]:focus{outline:none;}
     var shown = 0;
     Object.keys(byId).forEach(function (id) {
       var inst = byId[id];
-      var li = document.querySelector('[data-inst="' + esc(String(id)) + '"]');
+      var li = liFor(id);
       if (!li) return;
       var keep = (mineFilter === 'all' || groupFor(inst) === mineFilter) &&
                  (!q || findText(inst).indexOf(q) !== -1);
@@ -3379,10 +3386,11 @@ h1[tabindex="-1"]:focus{outline:none;}
   }
 
   function renderCard(inst) {
-    /* ids are server-generated, but escape anyway — every interpolated field in
-       this file goes through esc(), no exceptions (the grader's rule is right) */
+    /* iid is for MARKUP interpolation only (esc() = HTML escape); the DOM
+       lookup goes through liFor(), which CSS-escapes — the two escapes are
+       not interchangeable */
     var iid = esc(String(inst.id));
-    var li = document.querySelector('[data-inst="' + iid + '"]');
+    var li = liFor(inst.id);
     if (!li) return;
     var gone = inst.status === 'torn_down';
     li.className = 'proj' + (gone ? ' gone' : '');

package/src/module-api.js

@@ -703,8 +703,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.136 with no explicit bump. run 31890033301. (task 1002620)
 //   1.19.138 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.137 with no explicit bump. run 31891128524. (task 1002620)
+//   1.19.139 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.138 with no explicit bump. run 31891461224. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.138'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.139'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -765,6 +765,23 @@ test('an owned orb\'s job is manage, not the public site', () => {
     'the orb route key must not collide with the manage list\'s card identity');
 });
 
+test('the card-shell lookup CSS-escapes the id — HTML-escape never reaches a selector (task 1002893)', () => {
+  const fn = (SCRIPT.match(/function liFor\(([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'liFor() must be extractable');
+  assert.match(fn, /CSS\.escape\(/, 'the selector path escapes with CSS.escape, not esc()');
+  // liFor is the ONLY data-inst selector site — esc() belongs to markup
+  // rendering, where it stays; a second selector site could quietly restore
+  // the esc()-in-selector (or no-escape) shape this test exists to kill
+  const sel = SCRIPT.match(/\[data-inst="' \+/g) || [];
+  assert.equal(sel.length, 1, 'exactly one data-inst selector concatenation (inside liFor)');
+  assert.match(SCRIPT, /\[data-inst="' \+ CSS\.escape\(/, 'and that one site CSS-escapes');
+  // the two prior wrong shapes, by name
+  assert.doesNotMatch(SCRIPT, /\[data-inst="' \+ esc\(/,
+    'an HTML-escaped id must never be interpolated into a selector');
+  assert.doesNotMatch(SCRIPT, /\[data-inst="' \+ pendingAnchor/,
+    'raw interpolation into a selector is the injection-shaped site');
+});
+
 test('the orb chip is the manage list\'s truth, never a second story (C6)', () => {
   const orbs = (SCRIPT.match(/function renderOrbs\(([\s\S]*?)\n  \}/) || [, ''])[1];
   // exactly ONE chip site, and it defers to chipFor() — a second site could