@bongos/core 1.19.201 → 1.19.203

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.201",
-  "core_contract": "1.19.201",
-  "source_commit": "d12ce65286155db1a4609b647f8b5c6f3b7702c8",
+  "core_version": "1.19.203",
+  "core_contract": "1.19.203",
+  "source_commit": "3596d383ae4955438fc6ab7f9599e680ddafb570",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T19:08:54.639Z",
+  "built_at": "2026-08-17T19:20:16.116Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1294,
+    "functional_verbatim": 1295,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1625,
-  "tree_sha256": "300276855875716739e395ee304fab665d8e9cc9ee33839e0544ce763fea9a17",
+  "file_count": 1626,
+  "tree_sha256": "d4a2fd8d4540f54177859f2312a5a48c6539b34b12e1e61757d0b242f92be615",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4072,7 +4072,7 @@
     {
       "path": "modules/security/artifact-scan/floor.js",
       "mode": "0000644",
-      "sha256": "c3daa70d6a07cb64040f0f0c88b359ef7ff284c66b0282297253d726b25ba93b"
+      "sha256": "27421162e08ed14ba9e26be02e11c936c566ad113b76a90d452474d7e867093b"
     },
     {
       "path": "modules/security/artifact-scan/limits.js",
@@ -4157,7 +4157,7 @@
     {
       "path": "modules/security/tests/floor.mjs",
       "mode": "0000644",
-      "sha256": "799dca44c7570ef11de2df5b721428de2670343882b6942eb6bac62c1b3b40ca"
+      "sha256": "7eaed4b59cce956509ca7ebcb92207d362f191ec9b54be90d3c47d069b8149e7"
     },
     {
       "path": "modules/security/tests/mirror.mjs",
@@ -4272,12 +4272,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4cade958ecb05d2f70af056f7316e5e773771f304236d17ceeddc04b1147899b"
+      "sha256": "30f113e605eea7d404a3393045402c6234a6822724656d0830a5a553a6215fac"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7da6bdc2ce6176f9c673bee2f697426ee7a94cc151823d65526c9fe50e646746"
+      "sha256": "fa8341a0a90d43e710d3f9e04589ce7f055c8f180cf915f28fa074b0b9206977"
     },
     {
       "path": "public-docs/index.html",
@@ -4727,7 +4727,7 @@
     {
       "path": "scripts/gds/capture.js",
       "mode": "0000644",
-      "sha256": "63eb148a4a8ec5c511e1c9d23b0178b357c295227e0c748a5e9e7e3f3959ef93"
+      "sha256": "208bfd6c6a73f4234c06bb26e3319ec43ecf865927333bc810ca99efa9745e90"
     },
     {
       "path": "scripts/gds/cf-tunnel.js",
@@ -5887,7 +5887,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ed3ac8884e7e1deaa6ddd27accdc066707203de95a45924c1255b6b28e45527d"
+      "sha256": "f5b425d9be5b552f40d72f31cd96dbcb901b15478ed7a60a35221aaeb09b4fb7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6289,6 +6289,11 @@
       "mode": "0000644",
       "sha256": "5cd314c415b3e4e0b89a762cd622d9b0eb58e3659df76e78c816ca501368febf"
     },
+    {
+      "path": "tests/capture_error_format.mjs",
+      "mode": "0000644",
+      "sha256": "bf8b5407d5e1234a74399f3a1e80acc44f9fabdfcfbccc3d64ca57d66f8e3085"
+    },
     {
       "path": "tests/cascade-dispatch.mjs",
       "mode": "0000644",

package/modules/security/artifact-scan/floor.js

@@ -191,6 +191,54 @@ function coverageFindings(corpus) {
   return findings;
 }
 
+// Cap the merged-path list so an artifact vendoring thousands of identical
+// copies cannot balloon the persisted report through its own duplication.
+const MAX_DUPLICATE_PATHS = 20;
+
+// A repo that vendors the same tree N times produces N identical findings from
+// one underlying file (same detector, same evidence, byte-identical content) —
+// which triples counts and buries the real signal. Collapse findings that agree
+// on (code, severity, message) AND whose files are byte-identical per the
+// manifest sha256; the survivor lists the other copies. Keyed on the full
+// message so per-path evidence (differing line numbers, labels) never merges
+// wrongly, and findings without a manifest file entry ('(floor)', '(fetch)',
+// directories, symlinks) pass through untouched. Verdict arithmetic is
+// unaffected: max() over findings is idempotent under duplication.
+function dedupeFindings(findings, entries) {
+  const shaByPath = new Map();
+  for (const e of entries || []) {
+    if (e && e.kind === 'file' && e.sha256) shaByPath.set(scrubUntrusted(String(e.path)), e.sha256);
+  }
+  const groups = new Map();
+  const slots = [];
+  for (const f of findings) {
+    const sha = f && typeof f.file === 'string' ? shaByPath.get(f.file) : null;
+    if (!sha) { slots.push({ finding: f }); continue; }
+    const key = JSON.stringify([f.code, f.severity, f.message, sha]);
+    const group = groups.get(key);
+    if (!group) {
+      groups.set(key, { first: f, dups: [] });
+      slots.push({ key });
+    } else {
+      group.dups.push(f.file);
+    }
+  }
+  return slots.map((slot) => {
+    if (slot.finding) return slot.finding;
+    const { first, dups } = groups.get(slot.key);
+    if (dups.length === 0) return first;
+    const baseDetail = first.detail && typeof first.detail === 'object' && !Array.isArray(first.detail) ? first.detail : {};
+    return {
+      ...first,
+      detail: {
+        ...baseDetail,
+        duplicate_files: dups.slice(0, MAX_DUPLICATE_PATHS),
+        duplicate_count: dups.length,
+      },
+    };
+  });
+}
+
 // Run every detector crash-isolated: a detector that throws yields a finding,
 // never a hole in the report. `detectors` is injectable so the crash-isolation
 // contract is unit-testable with a deliberately-throwing detector.
@@ -273,15 +321,20 @@ async function runFloor({ pristineDir, quarantineRoot, entries, sha = null, cont
       'The floor could not read the artifact tree at all — nothing here was reviewed.', { error: corpusError }));
   }
 
+  // Collapse vendored-copy duplicates LAST, so every producing step above is
+  // covered; crash-isolated with the raw list as fallback (a broken dedupe must
+  // degrade to duplicate noise, never to lost findings).
+  const finalFindings = isolate('dedupe', () => dedupeFindings(findings, entries)) || findings;
+
   const report = {
     floor_version: FLOOR_VERSION,
     detectors_run: DETECTORS.map(([name]) => name),
     detector_errors: errors,
     generated_at: new Date().toISOString(),
     target: { sha, content_hash: contentHash },
-    findings,
-    counts: countBySeverity(findings),
-    floor_verdict: computeFloorVerdict(findings),
+    findings: finalFindings,
+    counts: countBySeverity(finalFindings),
+    floor_verdict: computeFloorVerdict(finalFindings),
     // Printed, never scored — the reader's power budget for the artifact.
     capabilities: capabilityInventory,
     coverage: {
@@ -314,6 +367,7 @@ module.exports = {
   countBySeverity,
   coOccurrence,
   coverageFindings,
+  dedupeFindings,
   runDetectors,
   runFloor,
 };

package/modules/security/tests/floor.mjs

@@ -58,6 +58,43 @@ function corpusOf(fileMap) {
 const codesOf = (findings) => findings.map((f) => f.code);
 const hasCode = (findings, code) => findings.some((f) => f.code === code);
 
+// ---------- dedupe across byte-identical files ----------
+
+await test('dedupe: identical findings on byte-identical files collapse to one, listing the copies', () => {
+  const entries = [
+    { path: 'a/data.csv', kind: 'file', size: 10, sha256: 'aaa' },
+    { path: 'b/data.csv', kind: 'file', size: 10, sha256: 'aaa' },
+    { path: 'c/data.csv', kind: 'file', size: 10, sha256: 'aaa' },
+    { path: 'd/other.csv', kind: 'file', size: 10, sha256: 'bbb' },
+  ];
+  const mk = (file) => ({ code: 'x_hit', severity: 'critical', file, message: 'same claim', detail: { k: 1 } });
+  const input = [mk('a/data.csv'), mk('b/data.csv'), mk('c/data.csv'), mk('d/other.csv'),
+    { code: 'detector_error', severity: 'high', file: '(floor)', message: 'crashed', detail: null }];
+  const out = floor.dedupeFindings(input, entries);
+  // vendored copies collapse; different bytes (d/) and non-file findings survive
+  assert.equal(out.length, 3);
+  const merged = out.find((f) => f.file === 'a/data.csv');
+  assert.deepEqual(merged.detail.duplicate_files, ['b/data.csv', 'c/data.csv']);
+  assert.equal(merged.detail.duplicate_count, 2);
+  assert.equal(merged.detail.k, 1, 'original detail keys survive the merge');
+  assert.ok(out.some((f) => f.file === 'd/other.csv'));
+  assert.ok(out.some((f) => f.file === '(floor)'));
+  // input findings were not mutated (the merged copy is a new object)
+  assert.equal(input[0].detail.duplicate_count, undefined);
+});
+
+await test('dedupe: same file bytes but different messages stay separate findings', () => {
+  const entries = [
+    { path: 'a.js', kind: 'file', size: 5, sha256: 'ccc' },
+    { path: 'b.js', kind: 'file', size: 5, sha256: 'ccc' },
+  ];
+  const out = floor.dedupeFindings([
+    { code: 'y', severity: 'medium', file: 'a.js', message: 'claim at line 3', detail: null },
+    { code: 'y', severity: 'medium', file: 'b.js', message: 'claim at line 9', detail: null },
+  ], entries);
+  assert.equal(out.length, 2);
+});
+
 // ---------- npm lifecycle ----------
 
 await test('npm-lifecycle: quotes a postinstall verbatim as a high finding', () => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.201",
+  "version": "1.19.203",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.201",
+      "version": "1.19.203",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.201",
+  "version": "1.19.203",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/capture.js

@@ -47,6 +47,18 @@ async function resolveDefaultVersion() {
   return building[0].id;
 }
 
+// Full JSON, not console.error's depth-2 inspect — a validation 400's nested
+// details otherwise print as "[ [Object] ]" and hide which field failed.
+function formatCaptureFailure(status, data) {
+  let rendered;
+  try {
+    rendered = JSON.stringify(data, null, 2);
+  } catch {
+    rendered = String(data);
+  }
+  return `capture failed (${status}): ${rendered}`;
+}
+
 async function main() {
   await requireSession();
   const args = process.argv.slice(2);
@@ -94,7 +106,7 @@ async function main() {
   const api = await cliClient();
   const r = await api.inbox.postInbox({ body: payload });
   if (!r.ok) {
-    console.error(`capture failed (${r.status}):`, r.data);
+    console.error(formatCaptureFailure(r.status, r.data));
     process.exit(1);
   }
 
@@ -115,6 +127,8 @@ async function main() {
   // referred to; promotion to a task re-runs the detection automatically.
 }
 
+module.exports = { resolveDefaultVersion, formatCaptureFailure };
+
 if (require.main === module) {
   main().catch((err) => {
     console.error('fatal:', err);

package/src/module-api.js

@@ -829,8 +829,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.199 with no explicit bump. run 32058296632. (task 1002620)
 //   1.19.201 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.200 with no explicit bump. run 32058666256. (task 1002620)
+//   1.19.202 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.201 with no explicit bump. run 32059276345. (task 1002620)
+//   1.19.203 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.202 with no explicit bump. run 32059705946. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.201'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.203'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/capture_error_format.mjs

@@ -0,0 +1,40 @@
+// capture.js error formatting (task 1003056, idea 1000780): a 400 from POST
+// /inbox must print the nested validation details, not util.inspect's
+// depth-clipped "[ [Object] ]" — the caller needs to see WHICH field failed.
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { formatCaptureFailure } = require('../scripts/gds/capture.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+await test('nested validation details are fully rendered, never [Object]', () => {
+  const out = formatCaptureFailure(400, {
+    error: {
+      code: 'validation_failed',
+      message: 'validation_failed',
+      details: [{ field: 'title', reason: 'exceeds max length 200' }],
+    },
+  });
+  assert.match(out, /capture failed \(400\)/);
+  assert.match(out, /exceeds max length 200/);
+  assert.match(out, /"field": "title"/);
+  assert.doesNotMatch(out, /\[Object\]/);
+});
+
+await test('non-JSON-serializable data still produces a printable line', () => {
+  const circular = {};
+  circular.self = circular;
+  const out = formatCaptureFailure(500, circular);
+  assert.match(out, /capture failed \(500\)/);
+  assert.equal(typeof out, 'string');
+});
+
+console.log(`\ncapture_error_format: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);