@bongos/core 1.19.201 → 1.19.202

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.201",
-  "core_contract": "1.19.201",
-  "source_commit": "d12ce65286155db1a4609b647f8b5c6f3b7702c8",
+  "core_version": "1.19.202",
+  "core_contract": "1.19.202",
+  "source_commit": "241b029c800ce3bdb38f7d581e44d95d27656007",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T19:08:54.639Z",
+  "built_at": "2026-08-17T19:15:32.076Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1625,
-  "tree_sha256": "300276855875716739e395ee304fab665d8e9cc9ee33839e0544ce763fea9a17",
+  "tree_sha256": "d0af1afec31904ff2d8c0ba6a68c5960c6b333ef65c66938843f2a7bd681f4f0",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4072,7 +4072,7 @@
     {
       "path": "modules/security/artifact-scan/floor.js",
       "mode": "0000644",
-      "sha256": "c3daa70d6a07cb64040f0f0c88b359ef7ff284c66b0282297253d726b25ba93b"
+      "sha256": "27421162e08ed14ba9e26be02e11c936c566ad113b76a90d452474d7e867093b"
     },
     {
       "path": "modules/security/artifact-scan/limits.js",
@@ -4157,7 +4157,7 @@
     {
       "path": "modules/security/tests/floor.mjs",
       "mode": "0000644",
-      "sha256": "799dca44c7570ef11de2df5b721428de2670343882b6942eb6bac62c1b3b40ca"
+      "sha256": "7eaed4b59cce956509ca7ebcb92207d362f191ec9b54be90d3c47d069b8149e7"
     },
     {
       "path": "modules/security/tests/mirror.mjs",
@@ -4272,12 +4272,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4cade958ecb05d2f70af056f7316e5e773771f304236d17ceeddc04b1147899b"
+      "sha256": "28f5946694aefef1201397cdb8962d38b2b1d5d0904ef6f76b5b1591f0f6a2e8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7da6bdc2ce6176f9c673bee2f697426ee7a94cc151823d65526c9fe50e646746"
+      "sha256": "cbf3b235c2ed444a8bf84a0719df6fbe81f8ad98dcbbf5eaf3740338af1e53a3"
     },
     {
       "path": "public-docs/index.html",
@@ -5887,7 +5887,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ed3ac8884e7e1deaa6ddd27accdc066707203de95a45924c1255b6b28e45527d"
+      "sha256": "2cd85c33fc8008eec96025eeaaa528590157902642653819bf20b580e1d031a5"
     },
     {
       "path": "src/module-loader/catalog.js",

package/modules/security/artifact-scan/floor.js

@@ -191,6 +191,54 @@ function coverageFindings(corpus) {
   return findings;
 }
 
+// Cap the merged-path list so an artifact vendoring thousands of identical
+// copies cannot balloon the persisted report through its own duplication.
+const MAX_DUPLICATE_PATHS = 20;
+
+// A repo that vendors the same tree N times produces N identical findings from
+// one underlying file (same detector, same evidence, byte-identical content) —
+// which triples counts and buries the real signal. Collapse findings that agree
+// on (code, severity, message) AND whose files are byte-identical per the
+// manifest sha256; the survivor lists the other copies. Keyed on the full
+// message so per-path evidence (differing line numbers, labels) never merges
+// wrongly, and findings without a manifest file entry ('(floor)', '(fetch)',
+// directories, symlinks) pass through untouched. Verdict arithmetic is
+// unaffected: max() over findings is idempotent under duplication.
+function dedupeFindings(findings, entries) {
+  const shaByPath = new Map();
+  for (const e of entries || []) {
+    if (e && e.kind === 'file' && e.sha256) shaByPath.set(scrubUntrusted(String(e.path)), e.sha256);
+  }
+  const groups = new Map();
+  const slots = [];
+  for (const f of findings) {
+    const sha = f && typeof f.file === 'string' ? shaByPath.get(f.file) : null;
+    if (!sha) { slots.push({ finding: f }); continue; }
+    const key = JSON.stringify([f.code, f.severity, f.message, sha]);
+    const group = groups.get(key);
+    if (!group) {
+      groups.set(key, { first: f, dups: [] });
+      slots.push({ key });
+    } else {
+      group.dups.push(f.file);
+    }
+  }
+  return slots.map((slot) => {
+    if (slot.finding) return slot.finding;
+    const { first, dups } = groups.get(slot.key);
+    if (dups.length === 0) return first;
+    const baseDetail = first.detail && typeof first.detail === 'object' && !Array.isArray(first.detail) ? first.detail : {};
+    return {
+      ...first,
+      detail: {
+        ...baseDetail,
+        duplicate_files: dups.slice(0, MAX_DUPLICATE_PATHS),
+        duplicate_count: dups.length,
+      },
+    };
+  });
+}
+
 // Run every detector crash-isolated: a detector that throws yields a finding,
 // never a hole in the report. `detectors` is injectable so the crash-isolation
 // contract is unit-testable with a deliberately-throwing detector.
@@ -273,15 +321,20 @@ async function runFloor({ pristineDir, quarantineRoot, entries, sha = null, cont
       'The floor could not read the artifact tree at all — nothing here was reviewed.', { error: corpusError }));
   }
 
+  // Collapse vendored-copy duplicates LAST, so every producing step above is
+  // covered; crash-isolated with the raw list as fallback (a broken dedupe must
+  // degrade to duplicate noise, never to lost findings).
+  const finalFindings = isolate('dedupe', () => dedupeFindings(findings, entries)) || findings;
+
   const report = {
     floor_version: FLOOR_VERSION,
     detectors_run: DETECTORS.map(([name]) => name),
     detector_errors: errors,
     generated_at: new Date().toISOString(),
     target: { sha, content_hash: contentHash },
-    findings,
-    counts: countBySeverity(findings),
-    floor_verdict: computeFloorVerdict(findings),
+    findings: finalFindings,
+    counts: countBySeverity(finalFindings),
+    floor_verdict: computeFloorVerdict(finalFindings),
     // Printed, never scored — the reader's power budget for the artifact.
     capabilities: capabilityInventory,
     coverage: {
@@ -314,6 +367,7 @@ module.exports = {
   countBySeverity,
   coOccurrence,
   coverageFindings,
+  dedupeFindings,
   runDetectors,
   runFloor,
 };

package/modules/security/tests/floor.mjs

@@ -58,6 +58,43 @@ function corpusOf(fileMap) {
 const codesOf = (findings) => findings.map((f) => f.code);
 const hasCode = (findings, code) => findings.some((f) => f.code === code);
 
+// ---------- dedupe across byte-identical files ----------
+
+await test('dedupe: identical findings on byte-identical files collapse to one, listing the copies', () => {
+  const entries = [
+    { path: 'a/data.csv', kind: 'file', size: 10, sha256: 'aaa' },
+    { path: 'b/data.csv', kind: 'file', size: 10, sha256: 'aaa' },
+    { path: 'c/data.csv', kind: 'file', size: 10, sha256: 'aaa' },
+    { path: 'd/other.csv', kind: 'file', size: 10, sha256: 'bbb' },
+  ];
+  const mk = (file) => ({ code: 'x_hit', severity: 'critical', file, message: 'same claim', detail: { k: 1 } });
+  const input = [mk('a/data.csv'), mk('b/data.csv'), mk('c/data.csv'), mk('d/other.csv'),
+    { code: 'detector_error', severity: 'high', file: '(floor)', message: 'crashed', detail: null }];
+  const out = floor.dedupeFindings(input, entries);
+  // vendored copies collapse; different bytes (d/) and non-file findings survive
+  assert.equal(out.length, 3);
+  const merged = out.find((f) => f.file === 'a/data.csv');
+  assert.deepEqual(merged.detail.duplicate_files, ['b/data.csv', 'c/data.csv']);
+  assert.equal(merged.detail.duplicate_count, 2);
+  assert.equal(merged.detail.k, 1, 'original detail keys survive the merge');
+  assert.ok(out.some((f) => f.file === 'd/other.csv'));
+  assert.ok(out.some((f) => f.file === '(floor)'));
+  // input findings were not mutated (the merged copy is a new object)
+  assert.equal(input[0].detail.duplicate_count, undefined);
+});
+
+await test('dedupe: same file bytes but different messages stay separate findings', () => {
+  const entries = [
+    { path: 'a.js', kind: 'file', size: 5, sha256: 'ccc' },
+    { path: 'b.js', kind: 'file', size: 5, sha256: 'ccc' },
+  ];
+  const out = floor.dedupeFindings([
+    { code: 'y', severity: 'medium', file: 'a.js', message: 'claim at line 3', detail: null },
+    { code: 'y', severity: 'medium', file: 'b.js', message: 'claim at line 9', detail: null },
+  ], entries);
+  assert.equal(out.length, 2);
+});
+
 // ---------- npm lifecycle ----------
 
 await test('npm-lifecycle: quotes a postinstall verbatim as a high finding', () => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.201",
+  "version": "1.19.202",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.201",
+      "version": "1.19.202",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.201",
+  "version": "1.19.202",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -829,8 +829,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.199 with no explicit bump. run 32058296632. (task 1002620)
 //   1.19.201 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.200 with no explicit bump. run 32058666256. (task 1002620)
+//   1.19.202 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.201 with no explicit bump. run 32059276345. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.201'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.202'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');