@bongos/core 1.19.199 → 1.19.200

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.199",
-  "core_contract": "1.19.199",
-  "source_commit": "08495813527c1aeffa0428e7234eaf43d9cabe73",
+  "core_version": "1.19.200",
+  "core_contract": "1.19.200",
+  "source_commit": "f95300ee8797127d7546332257b67de3d0c62c8e",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T16:22:20.827Z",
+  "built_at": "2026-08-17T19:04:56.256Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1625,
-  "tree_sha256": "acb3b4c8b4b4e9b69ee04cf812eb630279966cb39dbdde2dab3dd192a30302a4",
+  "tree_sha256": "18ad467b81261448ff6a59512b32dcc78650f692fe27804a51b975b2bc6f2ed4",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4067,7 +4067,7 @@
     {
       "path": "modules/security/artifact-scan/fetch.js",
       "mode": "0000644",
-      "sha256": "73fecaa98fd69649edf75c8854ffcefa9117412e8604cf5ccfa1ac376ae27fd6"
+      "sha256": "7f6241a971f3a13b2b4e367ed657302a4e1de4db26a47881c20f50f16a9897fc"
     },
     {
       "path": "modules/security/artifact-scan/floor.js",
@@ -4152,7 +4152,7 @@
     {
       "path": "modules/security/tests/artifact_scan.mjs",
       "mode": "0000644",
-      "sha256": "68079f8cc0e8c8466054865032fa03bd23f0a46513cbe997c4390d2e236e9249"
+      "sha256": "dbdc9f017a2a6dff3379c1a0acb08e023278cfb382d91b20a4ec0b5e5f8229b0"
     },
     {
       "path": "modules/security/tests/floor.mjs",
@@ -4272,12 +4272,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b25cf066ce8236ed3fe30f161b673cb3e2e5b6f5c82c623aaa4698008c7cecb3"
+      "sha256": "0345810b36e05e92a4dd349288037fa382010a5822e31ba100e88b150f0c858a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7e57f9372d4637486d5826db9256a4b75628228907aa56dac60120f0e6ad78bb"
+      "sha256": "f721afc21877f8b17bbd40e02aa4fec05e56ce45a4a2a5f62961c574d34887de"
     },
     {
       "path": "public-docs/index.html",
@@ -5887,7 +5887,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "86156bb0d8387b1c0ed62a350d89c966fe23e39ce264680a6838f83a18981afe"
+      "sha256": "32d0c4075982e755a5fd9af88535bf0af411f490f738b27aaa7c38de62ebaf13"
     },
     {
       "path": "src/module-loader/catalog.js",

package/modules/security/artifact-scan/fetch.js

@@ -115,6 +115,10 @@ function hardeningConfig(q) {
     'filter.lfs.smudge=',             // an LFS smudge filter is a process git runs on checkout
     'filter.lfs.process=',
     'filter.lfs.required=false',
+    // Windows MAX_PATH: pen path + a deeply nested artifact path can exceed 260
+    // chars, and without this the clone dies "Filename too long" (fail-closed,
+    // but the artifact was scannable). Pen-confined writes only; no-op elsewhere.
+    'core.longpaths=true',
     'advice.detachedHead=false',
   ].flatMap((kv) => ['-c', kv]);
 }

package/modules/security/tests/artifact_scan.mjs

@@ -262,6 +262,7 @@ await test('the git hardening contract is present in full', async () => {
     'transfer.fsckObjects=true',
     'credential.helper=',
     'filter.lfs.smudge=',
+    'core.longpaths=true',
   ]) {
     assert.ok(cfg.includes(required), `missing hardening: ${required}`);
   }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.199",
+  "version": "1.19.200",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.199",
+      "version": "1.19.200",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.199",
+  "version": "1.19.200",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -825,8 +825,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.197 with no explicit bump. run 32045034525. (task 1002620)
 //   1.19.199 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.198 with no explicit bump. run 32045249602. (task 1002620)
+//   1.19.200 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.199 with no explicit bump. run 32058296632. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.199'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.200'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');