@bongos/core 1.19.199 → 1.19.201

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.199",
-  "core_contract": "1.19.199",
-  "source_commit": "08495813527c1aeffa0428e7234eaf43d9cabe73",
+  "core_version": "1.19.201",
+  "core_contract": "1.19.201",
+  "source_commit": "d12ce65286155db1a4609b647f8b5c6f3b7702c8",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T16:22:20.827Z",
+  "built_at": "2026-08-17T19:08:54.639Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1625,
-  "tree_sha256": "acb3b4c8b4b4e9b69ee04cf812eb630279966cb39dbdde2dab3dd192a30302a4",
+  "tree_sha256": "300276855875716739e395ee304fab665d8e9cc9ee33839e0544ce763fea9a17",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4047,7 +4047,7 @@
     {
       "path": "modules/security/artifact-scan/detectors/npm-lifecycle.js",
       "mode": "0000644",
-      "sha256": "ad38a6c63b2b55c31708a1a1b3e0302f7333ac39deb1a073c47423915cbc476b"
+      "sha256": "97977c34dd71368a980e8eea568ad63c79aeb00a9e33eb93bf85075367f4b3c8"
     },
     {
       "path": "modules/security/artifact-scan/detectors/permissions.js",
@@ -4067,7 +4067,7 @@
     {
       "path": "modules/security/artifact-scan/fetch.js",
       "mode": "0000644",
-      "sha256": "73fecaa98fd69649edf75c8854ffcefa9117412e8604cf5ccfa1ac376ae27fd6"
+      "sha256": "7f6241a971f3a13b2b4e367ed657302a4e1de4db26a47881c20f50f16a9897fc"
     },
     {
       "path": "modules/security/artifact-scan/floor.js",
@@ -4152,12 +4152,12 @@
     {
       "path": "modules/security/tests/artifact_scan.mjs",
       "mode": "0000644",
-      "sha256": "68079f8cc0e8c8466054865032fa03bd23f0a46513cbe997c4390d2e236e9249"
+      "sha256": "dbdc9f017a2a6dff3379c1a0acb08e023278cfb382d91b20a4ec0b5e5f8229b0"
     },
     {
       "path": "modules/security/tests/floor.mjs",
       "mode": "0000644",
-      "sha256": "7fcc6fedf6d087156ba91c6a6935fcf86b4c0cd0d80c31082121669f14b58172"
+      "sha256": "799dca44c7570ef11de2df5b721428de2670343882b6942eb6bac62c1b3b40ca"
     },
     {
       "path": "modules/security/tests/mirror.mjs",
@@ -4272,12 +4272,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b25cf066ce8236ed3fe30f161b673cb3e2e5b6f5c82c623aaa4698008c7cecb3"
+      "sha256": "4cade958ecb05d2f70af056f7316e5e773771f304236d17ceeddc04b1147899b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7e57f9372d4637486d5826db9256a4b75628228907aa56dac60120f0e6ad78bb"
+      "sha256": "7da6bdc2ce6176f9c673bee2f697426ee7a94cc151823d65526c9fe50e646746"
     },
     {
       "path": "public-docs/index.html",
@@ -5887,7 +5887,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "86156bb0d8387b1c0ed62a350d89c966fe23e39ce264680a6838f83a18981afe"
+      "sha256": "ed3ac8884e7e1deaa6ddd27accdc066707203de95a45924c1255b6b28e45527d"
     },
     {
       "path": "src/module-loader/catalog.js",

package/modules/security/artifact-scan/detectors/npm-lifecycle.js

@@ -26,6 +26,20 @@ const AUTO_RUN_SCRIPTS = Object.freeze([
   'dependencies',
 ]);
 
+// When each hook actually fires. All are auto-run (same severity), but calling a
+// publish-time hook "install time" overstates the risk to the INSTALLING user —
+// the message must name the real trigger. `prepare` fires on both (install from
+// git, and publish); the deprecated `prepublish` no longer runs on install in
+// modern npm.
+const SCRIPT_TIMING = Object.freeze({
+  prepublish: 'publish/pack time',
+  prepublishOnly: 'publish/pack time',
+  prepack: 'publish/pack time',
+  postpack: 'publish/pack time',
+  prepare: 'install (git deps) and publish time',
+});
+const timingOf = (name) => SCRIPT_TIMING[name] || 'install time';
+
 function detect(corpus) {
   const findings = [];
   for (const file of corpus.files) {
@@ -43,7 +57,7 @@ function detect(corpus) {
     for (const name of AUTO_RUN_SCRIPTS) {
       if (Object.prototype.hasOwnProperty.call(scripts, name)) {
         findings.push(finding('npm_lifecycle_script', 'high', file.path,
-          `npm auto-runs "${name}" at install time: ${excerpt(scripts[name])}`,
+          `npm auto-runs "${name}" at ${timingOf(name)}: ${excerpt(scripts[name])}`,
           { script: name, command: excerpt(scripts[name]) }));
       }
       const rawCount = rawCounts.get(name) || 0;

package/modules/security/artifact-scan/fetch.js

@@ -115,6 +115,10 @@ function hardeningConfig(q) {
     'filter.lfs.smudge=',             // an LFS smudge filter is a process git runs on checkout
     'filter.lfs.process=',
     'filter.lfs.required=false',
+    // Windows MAX_PATH: pen path + a deeply nested artifact path can exceed 260
+    // chars, and without this the clone dies "Filename too long" (fail-closed,
+    // but the artifact was scannable). Pen-confined writes only; no-op elsewhere.
+    'core.longpaths=true',
     'advice.detachedHead=false',
   ].flatMap((kv) => ['-c', kv]);
 }

package/modules/security/tests/artifact_scan.mjs

@@ -262,6 +262,7 @@ await test('the git hardening contract is present in full', async () => {
     'transfer.fsckObjects=true',
     'credential.helper=',
     'filter.lfs.smudge=',
+    'core.longpaths=true',
   ]) {
     assert.ok(cfg.includes(required), `missing hardening: ${required}`);
   }

package/modules/security/tests/floor.mjs

@@ -68,6 +68,19 @@ await test('npm-lifecycle: quotes a postinstall verbatim as a high finding', ()
   assert.match(hit.message, /node steal\.js/);
 });
 
+await test('npm-lifecycle: the message names when the hook really fires (publish/pack vs install)', () => {
+  const f = npmLifecycle.detect(corpusOf({ 'package.json': JSON.stringify({
+    scripts: { prepublishOnly: 'npm run build', postinstall: 'node setup.js' },
+  }) }));
+  const pub = f.find((x) => x.code === 'npm_lifecycle_script' && x.detail.script === 'prepublishOnly');
+  const inst = f.find((x) => x.code === 'npm_lifecycle_script' && x.detail.script === 'postinstall');
+  assert.ok(pub && inst);
+  // prepublishOnly fires at publish/pack time — calling it install-time overstates.
+  assert.match(pub.message, /publish\/pack time/);
+  assert.doesNotMatch(pub.message, /install time/);
+  assert.match(inst.message, /install time/);
+});
+
 await test('npm-lifecycle: a "test" script (run-by-request) is NOT flagged', () => {
   const f = npmLifecycle.detect(corpusOf({ 'package.json': JSON.stringify({ scripts: { test: 'jest', build: 'tsc' } }) }));
   assert.equal(f.length, 0);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.199",
+  "version": "1.19.201",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.199",
+      "version": "1.19.201",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.199",
+  "version": "1.19.201",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -825,8 +825,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.197 with no explicit bump. run 32045034525. (task 1002620)
 //   1.19.199 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.198 with no explicit bump. run 32045249602. (task 1002620)
+//   1.19.200 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.199 with no explicit bump. run 32058296632. (task 1002620)
+//   1.19.201 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.200 with no explicit bump. run 32058666256. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.199'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.201'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');