@bongos/core 1.19.204 → 1.19.205

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.204",
-  "core_contract": "1.19.204",
-  "source_commit": "1b831b99695f793cf8d6e7fdf248e20ea2486c77",
+  "core_version": "1.19.205",
+  "core_contract": "1.19.205",
+  "source_commit": "d0acea23dc9611622e44ceb27f2632f3691451c7",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T19:29:56.265Z",
+  "built_at": "2026-08-17T19:35:41.400Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1627,
-  "tree_sha256": "a44dd13817d43a88eb9a226b742a2c039888e0390bf5a5cb428c312e95db4aaf",
+  "tree_sha256": "17c1dd5861c35d9e42508f3ad241714488c6cd8fa4e81597c214e2e3c022e647",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4277,12 +4277,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "45a21ec8d9e8ffae13d85a59beb598f381a10fb85746c42888f0b8c3be098e0f"
+      "sha256": "7354ee51c98271c15bb6f173f19c151ce6386a4e837b3534432376d743ed76cc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "07c27a2b49959b9022ad8465bc02abe9fbce3bceb9068385a457d01c32423f0f"
+      "sha256": "88bc02329b19b8b55b8f19a63fa8e56d582da98dd40179e5dda1766d9d2ce296"
     },
     {
       "path": "public-docs/index.html",
@@ -5892,7 +5892,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "acfdae5a37ae7fa878a752cb566ec930dec8a7703cb86ef9d16609f6ec8c1bab"
+      "sha256": "3796fb722590f24c98f87a4d5467cb91c047a7dba8f544158b4495b3537a84d6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8077,7 +8077,7 @@
     {
       "path": "tests/tool_scan_engine.mjs",
       "mode": "0000644",
-      "sha256": "c8ae5ea8c8a78d0d2a9a55d7d94b3fd4d40ad36e71510f7d804db5645cc86bec"
+      "sha256": "10a6a41cafcba32406be1aa79e0be1ace1cde2c4163bf0b1a0efd1e5e8f8c403"
     },
     {
       "path": "tests/touches_overlap.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.204",
+  "version": "1.19.205",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.204",
+      "version": "1.19.205",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.204",
+  "version": "1.19.205",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -835,8 +835,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.202 with no explicit bump. run 32059705946. (task 1002620)
 //   1.19.204 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.203 with no explicit bump. run 32060607072. (task 1002620)
+//   1.19.205 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.204 with no explicit bump. run 32061149280. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.204'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.205'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/tool_scan_engine.mjs

@@ -60,8 +60,10 @@ async function test(name, fn) {
 
 const pens = [];
 const outsideDirs = [];
+const tmpDirs = [];
 function tmp(prefix) {
   const d = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), prefix)));
+  tmpDirs.push(d);
   return d;
 }
 
@@ -327,6 +329,17 @@ await test('fixture B: a clean scan normalizes into a persistable row', async ()
 
 for (const q of pens) { try { q.cleanup(); } catch { /* best effort */ } }
 for (const d of outsideDirs) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } }
+// tmpDirs are the OUTER wrappers (pen tmpRoots + victim homes) — pen.cleanup()
+// removes only the pen root inside, so these must be swept explicitly.
+for (const d of tmpDirs) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } }
+
+// The wrapper dirs tmp() creates OUTLIVE pen.cleanup() (which removes only the
+// pen root inside them) — 24 empty bongos-scan-host-* leftovers piled up in
+// Temp before this was verified (task 1003058). Prove the teardown is total.
+await test('teardown leaves none of this run\'s temp dirs behind', () => {
+  const leaked = tmpDirs.filter((d) => fs.existsSync(d));
+  assert.deepEqual(leaked, [], `leaked temp dirs: ${leaked.join(', ')}`);
+});
 
 console.log('');
 console.log(`tool_scan_engine: ${passed} passed, ${failed} failed`);