@bongos/core 1.19.215 → 1.19.217

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.215",
-  "core_contract": "1.19.215",
-  "source_commit": "697713806bfbd222ba0423c021aee84f56218f10",
+  "core_version": "1.19.217",
+  "core_contract": "1.19.217",
+  "source_commit": "2a474dc7f283910befbca2879f13d342c4d5f0b4",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T00:22:11.691Z",
+  "built_at": "2026-08-18T00:33:32.467Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1633,
-  "tree_sha256": "61d4b6bf40452f45053fe94cf02b44d682b2aed0e9684b0799a0d33eda1f675d",
+  "tree_sha256": "a3212b990024b1a28961deb9e9d93d52eeca950d4be79f84b3bddd2fe928583f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -167,7 +167,7 @@
     {
       "path": ".claude/skills/grader-health/SKILL.md",
       "mode": "0000644",
-      "sha256": "3186b6ead583632966031b9bcf57f40a98eeecfe4ab7e40435e4874a5e37eb20"
+      "sha256": "3268e1138e02245ddf16d11b072133168cf0f59ca0ea4656631babba5df7158c"
     },
     {
       "path": ".claude/skills/idea-triage/SKILL.md",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5a687e1b2df8e52068aaa27dfa92dd50ed65164905c74f9fe121750d023e95d9"
+      "sha256": "09501ec03bde658dfcbc651c0603d0c45f5d38914aafb73ff685ccec7c76d69e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6b2203d8fa449d80e6ff225fd5f8dbe4969b4a72ca94ff61e478635fb754d445"
+      "sha256": "c6882c7a5bf88c3cdd811dd9b957aeffe46b5ffbdc9c42e45a49c5e5caff1edf"
     },
     {
       "path": "public-docs/index.html",
@@ -5197,7 +5197,7 @@
     {
       "path": "scripts/gds/preflight.js",
       "mode": "0000644",
-      "sha256": "b56478bfcec12f59370cd019ee5e89f33300f50556327d389789446f17782f04"
+      "sha256": "bd57bb676f0ed6c426129a912727c4ecd363a1197373588fe24f4d48727a75dc"
     },
     {
       "path": "scripts/gds/provision.js",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e2884e30e53fd3fe3c121df94ce9738bde706f3ddb414c023e6fd546ec1777ab"
+      "sha256": "6123bf63d65e4e5327c05a413117015e2198293f2a1a2191f10cb1ecbb397fbf"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7497,7 +7497,7 @@
     {
       "path": "tests/preflight_checks.mjs",
       "mode": "0000644",
-      "sha256": "dcf007165fa70a3ad4ebc3109fda78495af2482e7b5fb1ebfa713cf9f0cb4413"
+      "sha256": "9f16091a8feeaef9e4350104dbc9671fab6f2b53f99fd82f798c77800e780b61"
     },
     {
       "path": "tests/preview_server.mjs",

package/.claude/skills/grader-health/SKILL.md

@@ -31,7 +31,16 @@ Baselines: the 14-agent evaluation window measured a **90.6%** pass rate, alread
 
 ### 3 — Cost anomalies
 
-Benchmark: mean panel cost **$2.14** per grade, and ~90% of it is **fixed** re-exploration cost, independent of diff size. Read grader spend: `node scripts/gds/api.js GET "/api/gds/public/cost-summary?source=grader&days=30"` and divide by the grade count from axis 2's window.
+Benchmark: mean panel cost **$2.14** per grade, and ~90% of it is **fixed** re-exploration cost, independent of diff size. Read grader spend and divide by the grade count from axis 2's window:
+
+```
+node scripts/gds/api.js GET "/api/gds/public/cost-summary?source=grader&days=30" --quiet \
+  | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>{const j=JSON.parse(s);
+      if(j.applied_filters?.source!=='grader'){console.error('FILTER DROPPED — do not divide');process.exit(1)}
+      console.log('grader 30d:', j.filtered_total_usd)})"
+```
+
+**Read `filtered_total_usd`, never `total_usd`.** The filters drill into the breakdown; they deliberately do *not* rescope the headline, so `total_usd` stays instance-wide (the treasury chart depends on that) and is off by more than an order of magnitude here. `by_category` / `by_builder` / `by_source` *are* filtered — under `?source=grader`, `by_builder` attributes each panel to the builder whose ship triggered it, which is why human logins appear. The `applied_filters` guard above makes a silently-dropped filter fail loudly instead of yielding a wrong mean.
 
 - Mean drifting well above the benchmark → panel re-rolls/retries or timeout-and-retry loops (not "big diffs" — the fixed-cost share means diff size barely moves the mean).
 - Near-zero spend with grades still recording → the trivial path or grade reuse dominating; spot-check that gating lenses are actually running.
@@ -56,6 +65,6 @@ End with a compact findings list, most severe first: axis, evidence (the numbers
 
 ## Files this skill touches
 
-- Reads: `GET /api/gds/public/grades`, `GET /api/gds/grades/by-builder` (Archon), `GET /api/gds/public/cost-summary?source=grader`, `GET /api/gds/tasks/:id?include=grade`, `modules/grading/grader.js`, `modules/grading/grader-rubric.json`.
+- Reads: `GET /api/gds/public/grades`, `GET /api/gds/grades/by-builder` (Archon), `GET /api/gds/public/cost-summary?source=grader` (the `filtered_total_usd` key), `GET /api/gds/tasks/:id?include=grade`, `modules/grading/grader.js`, `modules/grading/grader-rubric.json`.
 - Runs (read-only): `node scripts/gds/doctor.js`; with `--probe` only: `node scripts/gds/grade-smoke.js`.
 - Writes: nothing.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.215",
+  "version": "1.19.217",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.215",
+      "version": "1.19.217",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.215",
+  "version": "1.19.217",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/preflight.js

@@ -8,8 +8,9 @@
 //                          on a bare machine it died with `node: command not found`.
 //   2. deps installed    — a missing node_modules is why a ship later blew up with
 //                          `Cannot find module 'pg'`.
-//   3. `claude` launchable — the grader spawns it per worker; without it every ship
-//                          failed grading with SUBAGENT_SPAWN_FAILED.
+//   3. `claude` usable    — the grader spawns it per worker. Not launchable ⇒ every
+//                          ship failed grading with SUBAGENT_SPAWN_FAILED; launchable
+//                          but LOGGED OUT ⇒ SUBAGENT_NONZERO_EXIT (task 1003080).
 // Each finding carries a copy-paste fix.
 //
 // Before this, those checks lived only inside `bongos doctor` (doctor.js) and were
@@ -31,6 +32,10 @@ const { spawnSync } = require('node:child_process');
 const REPO_ROOT = nodePath.resolve(__dirname, '..', '..');
 const MIN_NODE_MAJOR = 22;
 
+// Env that authenticates the CLI with no interactive login — a headless box or a
+// CI runner. ci-grade.js reads the same two to decide whether it can grade at all.
+const HEADLESS_AUTH_ENV = ['CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY'];
+
 // The node_modules-present check, factored out (task 1002403) so a HOT-PATH
 // caller — /builder-start runs on every session open — can reuse THIS exact
 // finding without paying for the `claude --version` spawn the full
@@ -49,6 +54,55 @@ function depsFinding({ repoRoot = REPO_ROOT, fs = nodeFs } = {}) {
   };
 }
 
+// The AUTH half of the `claude CLI` row (task 1003080). Split out to keep
+// preflightChecks readable — the depsFinding precedent. Pure: spawn/env injected.
+//
+// WHY IT EXISTS. `claude --version` exits 0 while the CLI is LOGGED OUT, so the
+// launchable probe alone reported "the grader can spawn its workers" on a box
+// where every worker died on spawn. The grader runs one `claude -p` per panel
+// worker; logged out, each exits 1 in ~5s, so all four record
+// SUBAGENT_NONZERO_EXIT, the panel reports `unavailable`, and the builder gets a
+// 0/10 "grade failed" card with an empty issues[] — while doctor, the one tool
+// they're told to run, printed a green row. (Observed on task 1002459: two
+// consecutive outage rounds, cost_usd null on every worker, while the rest of the
+// fleet graded 21/21 the same day.)
+//
+// `claude auth status --json` answers `{ loggedIn: bool }` from local credentials
+// — no token spend, no model call. An unverifiable answer (an older CLI with no
+// `auth` subcommand, or any unparseable output) deliberately stays OK with the
+// caveat named: a working older box must never be turned red by a probe it can't
+// answer.
+function claudeAuthFinding({ bin, via, ver, env, spawn, platform }) {
+  const envVar = HEADLESS_AUTH_ENV.find((k) => env[k]);
+  if (envVar) {
+    return { level: 'ok', title: 'claude CLI', detail: `launches${via}: ${ver}; authenticated via ${envVar} — the grader can spawn its workers.` };
+  }
+
+  let a;
+  try {
+    a = spawn(bin, ['auth', 'status', '--json'], { encoding: 'utf8', shell: platform === 'win32', windowsHide: true, timeout: 15000 });
+  } catch (err) { a = { error: err }; }
+
+  let loggedIn = null; // null ⇒ the CLI didn't answer in a shape we understand
+  try {
+    const parsed = JSON.parse(String((a && a.stdout) || '').trim());
+    if (typeof parsed.loggedIn === 'boolean') loggedIn = parsed.loggedIn;
+  } catch (_) { /* older CLI without `auth status`, or non-JSON output */ }
+
+  if (loggedIn === false) {
+    return {
+      level: 'fail',
+      title: 'claude CLI',
+      detail: `launches${via} (${ver}) but is not logged in — the grader spawns one \`claude -p\` per panel worker and each exits 1 immediately, so every ship fails grading with SUBAGENT_NONZERO_EXIT and a 0/10 card carrying no findings.`,
+      fix: `Run \`${bin} auth login\` (or \`${bin}\`, then /login). On a headless box, set ${HEADLESS_AUTH_ENV.join(' or ')} instead.`,
+    };
+  }
+  if (loggedIn === true) {
+    return { level: 'ok', title: 'claude CLI', detail: `launches${via}: ${ver}, logged in — the grader can spawn its workers.` };
+  }
+  return { level: 'ok', title: 'claude CLI', detail: `launches${via}: ${ver} — the grader can spawn its workers (login state not verified: this CLI has no \`auth status\`).` };
+}
+
 // preflightChecks(deps) → [{ level:'ok'|'warn'|'fail', title, detail, fix? }]
 // No printing, no process.exit — callers (setup, doctor, the test) format it.
 function preflightChecks({
@@ -87,7 +141,10 @@ function preflightChecks({
   } catch (err) { r = { error: err }; }
   if (r && !r.error && r.status === 0) {
     const ver = String(r.stdout || '').trim().split('\n')[0] || 'present';
-    out.push({ level: 'ok', title: 'claude CLI', detail: `launches${via}: ${ver} — the grader can spawn its workers.` });
+    // task 1003080: launchable is only HALF this leg — `--version` exits 0 while
+    // the CLI is logged out, so this row used to go green at the exact moment
+    // the thing it checks is broken. claudeAuthFinding proves auth too.
+    out.push(claudeAuthFinding({ bin, via, ver, env, spawn, platform }));
   } else {
     const why = r && r.error ? (r.error.code || r.error.message) : `exited ${r ? r.status : '?'}`;
     out.push({
@@ -116,7 +173,7 @@ function formatPreflight(results, { color = false, heading = false } = {}) {
   return lines.join('\n');
 }
 
-module.exports = { preflightChecks, depsFinding, formatPreflight, REPO_ROOT, MIN_NODE_MAJOR };
+module.exports = { preflightChecks, depsFinding, claudeAuthFinding, formatPreflight, REPO_ROOT, MIN_NODE_MAJOR, HEADLESS_AUTH_ENV };
 
 // Standalone: `node scripts/gds/preflight.js` — exit 1 if any hard fail.
 if (require.main === module) {

package/src/module-api.js

@@ -857,8 +857,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.213 with no explicit bump. run 32081917908. (task 1002620)
 //   1.19.215 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.214 with no explicit bump. run 32084187695. (task 1002620)
+//   1.19.216 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.215 with no explicit bump. run 32084584347. (task 1002620)
+//   1.19.217 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.216 with no explicit bump. run 32084927511. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.215'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.217'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/preflight_checks.mjs

@@ -70,3 +70,77 @@ test('formatPreflight renders glyphs + fixes and stays plain (no ANSI) by defaul
   assert.match(s, /→ .*npm ci/);
   assert.doesNotMatch(s, /\x1b\[/); // color:false ⇒ no ANSI escapes
 });
+
+// --------------------------------------------------------------------------
+// claude CLI AUTHENTICATION (task 1003080)
+// --------------------------------------------------------------------------
+// `--version` exits 0 while the CLI is logged out, so the launchable probe
+// alone false-greened the exact failure it exists to catch: every grader worker
+// exits 1 on spawn (SUBAGENT_NONZERO_EXIT) and the builder gets a 0/10 card with
+// no findings. These cover the four auth shapes.
+
+// A spawn stub that answers `--version` and `auth status --json` differently.
+// authJson === null ⇒ the CLI has no `auth` subcommand (older build): non-JSON
+// on stdout, non-zero exit.
+const spawnWithAuth = (authJson) => (_bin, args) => {
+  if (args && args[0] === 'auth') {
+    return authJson === null
+      ? { status: 1, stdout: '', stderr: "error: unknown command 'auth'\n" }
+      : { status: 0, stdout: `${JSON.stringify(authJson)}\n` };
+  }
+  return { status: 0, stdout: '2.1.234 (Claude Code)\n' };
+};
+
+test('claude launches but is LOGGED OUT → fail naming SUBAGENT_NONZERO_EXIT + the login fix', () => {
+  const r = preflightChecks({
+    nodeVersion: 'v22.0.0', fs: fsWith(true), env: {},
+    spawn: spawnWithAuth({ loggedIn: false }),
+  });
+  const claude = find(r, 'claude CLI');
+  assert.equal(claude.level, 'fail');
+  assert.match(claude.detail, /not logged in/i);
+  assert.match(claude.detail, /SUBAGENT_NONZERO_EXIT/);
+  assert.match(claude.fix, /auth login/);
+});
+
+test('claude logged in → ok', () => {
+  const r = preflightChecks({
+    nodeVersion: 'v22.0.0', fs: fsWith(true), env: {},
+    spawn: spawnWithAuth({ loggedIn: true, authMethod: 'claude.ai' }),
+  });
+  const claude = find(r, 'claude CLI');
+  assert.equal(claude.level, 'ok');
+  assert.match(claude.detail, /2\.1\.234/);
+});
+
+test('a headless auth token in env → ok, and the auth probe is never spawned', () => {
+  const seen = [];
+  const spy = (_bin, args) => { seen.push((args || []).join(' ')); return { status: 0, stdout: '2.1.234\n' }; };
+  const r = preflightChecks({
+    nodeVersion: 'v22.0.0', fs: fsWith(true), spawn: spy,
+    env: { CLAUDE_CODE_OAUTH_TOKEN: 'sk-ant-oat-xxx' },
+  });
+  const claude = find(r, 'claude CLI');
+  assert.equal(claude.level, 'ok');
+  assert.match(claude.detail, /CLAUDE_CODE_OAUTH_TOKEN/);
+  assert.deepEqual(seen, ['--version']);
+});
+
+test('an older CLI without `auth status` stays ok, but says auth was not verified', () => {
+  const r = preflightChecks({
+    nodeVersion: 'v22.0.0', fs: fsWith(true), env: {},
+    spawn: spawnWithAuth(null),
+  });
+  const claude = find(r, 'claude CLI');
+  assert.equal(claude.level, 'ok');
+  assert.match(claude.detail, /not verif/i);
+});
+
+test('a thrown auth spawn is treated as unverifiable, never crashes', () => {
+  const spawnThrows = (_bin, args) => {
+    if (args && args[0] === 'auth') throw new Error('boom');
+    return { status: 0, stdout: '2.1.234\n' };
+  };
+  const r = preflightChecks({ nodeVersion: 'v22.0.0', fs: fsWith(true), env: {}, spawn: spawnThrows });
+  assert.equal(find(r, 'claude CLI').level, 'ok');
+});