@bongos/core 1.19.200 → 1.19.201

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.200",
-  "core_contract": "1.19.200",
-  "source_commit": "f95300ee8797127d7546332257b67de3d0c62c8e",
+  "core_version": "1.19.201",
+  "core_contract": "1.19.201",
+  "source_commit": "d12ce65286155db1a4609b647f8b5c6f3b7702c8",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T19:04:56.256Z",
+  "built_at": "2026-08-17T19:08:54.639Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1625,
-  "tree_sha256": "18ad467b81261448ff6a59512b32dcc78650f692fe27804a51b975b2bc6f2ed4",
+  "tree_sha256": "300276855875716739e395ee304fab665d8e9cc9ee33839e0544ce763fea9a17",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4047,7 +4047,7 @@
     {
       "path": "modules/security/artifact-scan/detectors/npm-lifecycle.js",
       "mode": "0000644",
-      "sha256": "ad38a6c63b2b55c31708a1a1b3e0302f7333ac39deb1a073c47423915cbc476b"
+      "sha256": "97977c34dd71368a980e8eea568ad63c79aeb00a9e33eb93bf85075367f4b3c8"
     },
     {
       "path": "modules/security/artifact-scan/detectors/permissions.js",
@@ -4157,7 +4157,7 @@
     {
       "path": "modules/security/tests/floor.mjs",
       "mode": "0000644",
-      "sha256": "7fcc6fedf6d087156ba91c6a6935fcf86b4c0cd0d80c31082121669f14b58172"
+      "sha256": "799dca44c7570ef11de2df5b721428de2670343882b6942eb6bac62c1b3b40ca"
     },
     {
       "path": "modules/security/tests/mirror.mjs",
@@ -4272,12 +4272,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0345810b36e05e92a4dd349288037fa382010a5822e31ba100e88b150f0c858a"
+      "sha256": "4cade958ecb05d2f70af056f7316e5e773771f304236d17ceeddc04b1147899b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f721afc21877f8b17bbd40e02aa4fec05e56ce45a4a2a5f62961c574d34887de"
+      "sha256": "7da6bdc2ce6176f9c673bee2f697426ee7a94cc151823d65526c9fe50e646746"
     },
     {
       "path": "public-docs/index.html",
@@ -5887,7 +5887,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "32d0c4075982e755a5fd9af88535bf0af411f490f738b27aaa7c38de62ebaf13"
+      "sha256": "ed3ac8884e7e1deaa6ddd27accdc066707203de95a45924c1255b6b28e45527d"
     },
     {
       "path": "src/module-loader/catalog.js",

package/modules/security/artifact-scan/detectors/npm-lifecycle.js

@@ -26,6 +26,20 @@ const AUTO_RUN_SCRIPTS = Object.freeze([
   'dependencies',
 ]);
 
+// When each hook actually fires. All are auto-run (same severity), but calling a
+// publish-time hook "install time" overstates the risk to the INSTALLING user —
+// the message must name the real trigger. `prepare` fires on both (install from
+// git, and publish); the deprecated `prepublish` no longer runs on install in
+// modern npm.
+const SCRIPT_TIMING = Object.freeze({
+  prepublish: 'publish/pack time',
+  prepublishOnly: 'publish/pack time',
+  prepack: 'publish/pack time',
+  postpack: 'publish/pack time',
+  prepare: 'install (git deps) and publish time',
+});
+const timingOf = (name) => SCRIPT_TIMING[name] || 'install time';
+
 function detect(corpus) {
   const findings = [];
   for (const file of corpus.files) {
@@ -43,7 +57,7 @@ function detect(corpus) {
     for (const name of AUTO_RUN_SCRIPTS) {
       if (Object.prototype.hasOwnProperty.call(scripts, name)) {
         findings.push(finding('npm_lifecycle_script', 'high', file.path,
-          `npm auto-runs "${name}" at install time: ${excerpt(scripts[name])}`,
+          `npm auto-runs "${name}" at ${timingOf(name)}: ${excerpt(scripts[name])}`,
           { script: name, command: excerpt(scripts[name]) }));
       }
       const rawCount = rawCounts.get(name) || 0;

package/modules/security/tests/floor.mjs

@@ -68,6 +68,19 @@ await test('npm-lifecycle: quotes a postinstall verbatim as a high finding', ()
   assert.match(hit.message, /node steal\.js/);
 });
 
+await test('npm-lifecycle: the message names when the hook really fires (publish/pack vs install)', () => {
+  const f = npmLifecycle.detect(corpusOf({ 'package.json': JSON.stringify({
+    scripts: { prepublishOnly: 'npm run build', postinstall: 'node setup.js' },
+  }) }));
+  const pub = f.find((x) => x.code === 'npm_lifecycle_script' && x.detail.script === 'prepublishOnly');
+  const inst = f.find((x) => x.code === 'npm_lifecycle_script' && x.detail.script === 'postinstall');
+  assert.ok(pub && inst);
+  // prepublishOnly fires at publish/pack time — calling it install-time overstates.
+  assert.match(pub.message, /publish\/pack time/);
+  assert.doesNotMatch(pub.message, /install time/);
+  assert.match(inst.message, /install time/);
+});
+
 await test('npm-lifecycle: a "test" script (run-by-request) is NOT flagged', () => {
   const f = npmLifecycle.detect(corpusOf({ 'package.json': JSON.stringify({ scripts: { test: 'jest', build: 'tsc' } }) }));
   assert.equal(f.length, 0);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.200",
+  "version": "1.19.201",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.200",
+      "version": "1.19.201",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.200",
+  "version": "1.19.201",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -827,8 +827,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.198 with no explicit bump. run 32045249602. (task 1002620)
 //   1.19.200 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.199 with no explicit bump. run 32058296632. (task 1002620)
+//   1.19.201 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.200 with no explicit bump. run 32058666256. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.200'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.201'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');