@bongos/core 1.19.200 → 1.19.202

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.200",
-  "core_contract": "1.19.200",
-  "source_commit": "f95300ee8797127d7546332257b67de3d0c62c8e",
+  "core_version": "1.19.202",
+  "core_contract": "1.19.202",
+  "source_commit": "241b029c800ce3bdb38f7d581e44d95d27656007",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T19:04:56.256Z",
+  "built_at": "2026-08-17T19:15:32.076Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1625,
-  "tree_sha256": "18ad467b81261448ff6a59512b32dcc78650f692fe27804a51b975b2bc6f2ed4",
+  "tree_sha256": "d0af1afec31904ff2d8c0ba6a68c5960c6b333ef65c66938843f2a7bd681f4f0",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4047,7 +4047,7 @@
     {
       "path": "modules/security/artifact-scan/detectors/npm-lifecycle.js",
       "mode": "0000644",
-      "sha256": "ad38a6c63b2b55c31708a1a1b3e0302f7333ac39deb1a073c47423915cbc476b"
+      "sha256": "97977c34dd71368a980e8eea568ad63c79aeb00a9e33eb93bf85075367f4b3c8"
     },
     {
       "path": "modules/security/artifact-scan/detectors/permissions.js",
@@ -4072,7 +4072,7 @@
     {
       "path": "modules/security/artifact-scan/floor.js",
       "mode": "0000644",
-      "sha256": "c3daa70d6a07cb64040f0f0c88b359ef7ff284c66b0282297253d726b25ba93b"
+      "sha256": "27421162e08ed14ba9e26be02e11c936c566ad113b76a90d452474d7e867093b"
     },
     {
       "path": "modules/security/artifact-scan/limits.js",
@@ -4157,7 +4157,7 @@
     {
       "path": "modules/security/tests/floor.mjs",
       "mode": "0000644",
-      "sha256": "7fcc6fedf6d087156ba91c6a6935fcf86b4c0cd0d80c31082121669f14b58172"
+      "sha256": "7eaed4b59cce956509ca7ebcb92207d362f191ec9b54be90d3c47d069b8149e7"
     },
     {
       "path": "modules/security/tests/mirror.mjs",
@@ -4272,12 +4272,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0345810b36e05e92a4dd349288037fa382010a5822e31ba100e88b150f0c858a"
+      "sha256": "28f5946694aefef1201397cdb8962d38b2b1d5d0904ef6f76b5b1591f0f6a2e8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f721afc21877f8b17bbd40e02aa4fec05e56ce45a4a2a5f62961c574d34887de"
+      "sha256": "cbf3b235c2ed444a8bf84a0719df6fbe81f8ad98dcbbf5eaf3740338af1e53a3"
     },
     {
       "path": "public-docs/index.html",
@@ -5887,7 +5887,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "32d0c4075982e755a5fd9af88535bf0af411f490f738b27aaa7c38de62ebaf13"
+      "sha256": "2cd85c33fc8008eec96025eeaaa528590157902642653819bf20b580e1d031a5"
     },
     {
       "path": "src/module-loader/catalog.js",

package/modules/security/artifact-scan/detectors/npm-lifecycle.js

@@ -26,6 +26,20 @@ const AUTO_RUN_SCRIPTS = Object.freeze([
   'dependencies',
 ]);
 
+// When each hook actually fires. All are auto-run (same severity), but calling a
+// publish-time hook "install time" overstates the risk to the INSTALLING user —
+// the message must name the real trigger. `prepare` fires on both (install from
+// git, and publish); the deprecated `prepublish` no longer runs on install in
+// modern npm.
+const SCRIPT_TIMING = Object.freeze({
+  prepublish: 'publish/pack time',
+  prepublishOnly: 'publish/pack time',
+  prepack: 'publish/pack time',
+  postpack: 'publish/pack time',
+  prepare: 'install (git deps) and publish time',
+});
+const timingOf = (name) => SCRIPT_TIMING[name] || 'install time';
+
 function detect(corpus) {
   const findings = [];
   for (const file of corpus.files) {
@@ -43,7 +57,7 @@ function detect(corpus) {
     for (const name of AUTO_RUN_SCRIPTS) {
       if (Object.prototype.hasOwnProperty.call(scripts, name)) {
         findings.push(finding('npm_lifecycle_script', 'high', file.path,
-          `npm auto-runs "${name}" at install time: ${excerpt(scripts[name])}`,
+          `npm auto-runs "${name}" at ${timingOf(name)}: ${excerpt(scripts[name])}`,
           { script: name, command: excerpt(scripts[name]) }));
       }
       const rawCount = rawCounts.get(name) || 0;

package/modules/security/artifact-scan/floor.js

@@ -191,6 +191,54 @@ function coverageFindings(corpus) {
   return findings;
 }
 
+// Cap the merged-path list so an artifact vendoring thousands of identical
+// copies cannot balloon the persisted report through its own duplication.
+const MAX_DUPLICATE_PATHS = 20;
+
+// A repo that vendors the same tree N times produces N identical findings from
+// one underlying file (same detector, same evidence, byte-identical content) —
+// which triples counts and buries the real signal. Collapse findings that agree
+// on (code, severity, message) AND whose files are byte-identical per the
+// manifest sha256; the survivor lists the other copies. Keyed on the full
+// message so per-path evidence (differing line numbers, labels) never merges
+// wrongly, and findings without a manifest file entry ('(floor)', '(fetch)',
+// directories, symlinks) pass through untouched. Verdict arithmetic is
+// unaffected: max() over findings is idempotent under duplication.
+function dedupeFindings(findings, entries) {
+  const shaByPath = new Map();
+  for (const e of entries || []) {
+    if (e && e.kind === 'file' && e.sha256) shaByPath.set(scrubUntrusted(String(e.path)), e.sha256);
+  }
+  const groups = new Map();
+  const slots = [];
+  for (const f of findings) {
+    const sha = f && typeof f.file === 'string' ? shaByPath.get(f.file) : null;
+    if (!sha) { slots.push({ finding: f }); continue; }
+    const key = JSON.stringify([f.code, f.severity, f.message, sha]);
+    const group = groups.get(key);
+    if (!group) {
+      groups.set(key, { first: f, dups: [] });
+      slots.push({ key });
+    } else {
+      group.dups.push(f.file);
+    }
+  }
+  return slots.map((slot) => {
+    if (slot.finding) return slot.finding;
+    const { first, dups } = groups.get(slot.key);
+    if (dups.length === 0) return first;
+    const baseDetail = first.detail && typeof first.detail === 'object' && !Array.isArray(first.detail) ? first.detail : {};
+    return {
+      ...first,
+      detail: {
+        ...baseDetail,
+        duplicate_files: dups.slice(0, MAX_DUPLICATE_PATHS),
+        duplicate_count: dups.length,
+      },
+    };
+  });
+}
+
 // Run every detector crash-isolated: a detector that throws yields a finding,
 // never a hole in the report. `detectors` is injectable so the crash-isolation
 // contract is unit-testable with a deliberately-throwing detector.
@@ -273,15 +321,20 @@ async function runFloor({ pristineDir, quarantineRoot, entries, sha = null, cont
       'The floor could not read the artifact tree at all — nothing here was reviewed.', { error: corpusError }));
   }
 
+  // Collapse vendored-copy duplicates LAST, so every producing step above is
+  // covered; crash-isolated with the raw list as fallback (a broken dedupe must
+  // degrade to duplicate noise, never to lost findings).
+  const finalFindings = isolate('dedupe', () => dedupeFindings(findings, entries)) || findings;
+
   const report = {
     floor_version: FLOOR_VERSION,
     detectors_run: DETECTORS.map(([name]) => name),
     detector_errors: errors,
     generated_at: new Date().toISOString(),
     target: { sha, content_hash: contentHash },
-    findings,
-    counts: countBySeverity(findings),
-    floor_verdict: computeFloorVerdict(findings),
+    findings: finalFindings,
+    counts: countBySeverity(finalFindings),
+    floor_verdict: computeFloorVerdict(finalFindings),
     // Printed, never scored — the reader's power budget for the artifact.
     capabilities: capabilityInventory,
     coverage: {
@@ -314,6 +367,7 @@ module.exports = {
   countBySeverity,
   coOccurrence,
   coverageFindings,
+  dedupeFindings,
   runDetectors,
   runFloor,
 };

package/modules/security/tests/floor.mjs

@@ -58,6 +58,43 @@ function corpusOf(fileMap) {
 const codesOf = (findings) => findings.map((f) => f.code);
 const hasCode = (findings, code) => findings.some((f) => f.code === code);
 
+// ---------- dedupe across byte-identical files ----------
+
+await test('dedupe: identical findings on byte-identical files collapse to one, listing the copies', () => {
+  const entries = [
+    { path: 'a/data.csv', kind: 'file', size: 10, sha256: 'aaa' },
+    { path: 'b/data.csv', kind: 'file', size: 10, sha256: 'aaa' },
+    { path: 'c/data.csv', kind: 'file', size: 10, sha256: 'aaa' },
+    { path: 'd/other.csv', kind: 'file', size: 10, sha256: 'bbb' },
+  ];
+  const mk = (file) => ({ code: 'x_hit', severity: 'critical', file, message: 'same claim', detail: { k: 1 } });
+  const input = [mk('a/data.csv'), mk('b/data.csv'), mk('c/data.csv'), mk('d/other.csv'),
+    { code: 'detector_error', severity: 'high', file: '(floor)', message: 'crashed', detail: null }];
+  const out = floor.dedupeFindings(input, entries);
+  // vendored copies collapse; different bytes (d/) and non-file findings survive
+  assert.equal(out.length, 3);
+  const merged = out.find((f) => f.file === 'a/data.csv');
+  assert.deepEqual(merged.detail.duplicate_files, ['b/data.csv', 'c/data.csv']);
+  assert.equal(merged.detail.duplicate_count, 2);
+  assert.equal(merged.detail.k, 1, 'original detail keys survive the merge');
+  assert.ok(out.some((f) => f.file === 'd/other.csv'));
+  assert.ok(out.some((f) => f.file === '(floor)'));
+  // input findings were not mutated (the merged copy is a new object)
+  assert.equal(input[0].detail.duplicate_count, undefined);
+});
+
+await test('dedupe: same file bytes but different messages stay separate findings', () => {
+  const entries = [
+    { path: 'a.js', kind: 'file', size: 5, sha256: 'ccc' },
+    { path: 'b.js', kind: 'file', size: 5, sha256: 'ccc' },
+  ];
+  const out = floor.dedupeFindings([
+    { code: 'y', severity: 'medium', file: 'a.js', message: 'claim at line 3', detail: null },
+    { code: 'y', severity: 'medium', file: 'b.js', message: 'claim at line 9', detail: null },
+  ], entries);
+  assert.equal(out.length, 2);
+});
+
 // ---------- npm lifecycle ----------
 
 await test('npm-lifecycle: quotes a postinstall verbatim as a high finding', () => {
@@ -68,6 +105,19 @@ await test('npm-lifecycle: quotes a postinstall verbatim as a high finding', ()
   assert.match(hit.message, /node steal\.js/);
 });
 
+await test('npm-lifecycle: the message names when the hook really fires (publish/pack vs install)', () => {
+  const f = npmLifecycle.detect(corpusOf({ 'package.json': JSON.stringify({
+    scripts: { prepublishOnly: 'npm run build', postinstall: 'node setup.js' },
+  }) }));
+  const pub = f.find((x) => x.code === 'npm_lifecycle_script' && x.detail.script === 'prepublishOnly');
+  const inst = f.find((x) => x.code === 'npm_lifecycle_script' && x.detail.script === 'postinstall');
+  assert.ok(pub && inst);
+  // prepublishOnly fires at publish/pack time — calling it install-time overstates.
+  assert.match(pub.message, /publish\/pack time/);
+  assert.doesNotMatch(pub.message, /install time/);
+  assert.match(inst.message, /install time/);
+});
+
 await test('npm-lifecycle: a "test" script (run-by-request) is NOT flagged', () => {
   const f = npmLifecycle.detect(corpusOf({ 'package.json': JSON.stringify({ scripts: { test: 'jest', build: 'tsc' } }) }));
   assert.equal(f.length, 0);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.200",
+  "version": "1.19.202",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.200",
+      "version": "1.19.202",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.200",
+  "version": "1.19.202",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -827,8 +827,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.198 with no explicit bump. run 32045249602. (task 1002620)
 //   1.19.200 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.199 with no explicit bump. run 32058296632. (task 1002620)
+//   1.19.201 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.200 with no explicit bump. run 32058666256. (task 1002620)
+//   1.19.202 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.201 with no explicit bump. run 32059276345. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.200'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.202'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');