@bongos/core 1.19.218 → 1.19.219

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.218",
-  "core_contract": "1.19.218",
-  "source_commit": "a00e409d98973f59f934543251e819a2b9deabd5",
+  "core_version": "1.19.219",
+  "core_contract": "1.19.219",
+  "source_commit": "c74ac31eedb3ec3676f8517b51302df625298931",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T01:00:37.333Z",
+  "built_at": "2026-08-18T03:06:20.562Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 311,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1634,
-  "tree_sha256": "fe7773c1c51b74af666fd1bd0db3495ae383d717ca65af9a4ef310f9e252efb0",
+  "tree_sha256": "4da1158ccf79b2a7a5253dad319cc74192493be9bda2e6a8874df8c60f581cc5",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2697,7 +2697,7 @@
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
-      "sha256": "9357b423836c4e8d2cd3c9144d294c3cd3b498ac30755a9e6f62b5bbaa2add5e"
+      "sha256": "870976966de7c48be4172390dc8e4f7d2eb6ac53e20dfb3fd5d40b08cfcd7850"
     },
     {
       "path": "modules/dev-box/box-credential.js",
@@ -4287,12 +4287,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "199faf243475315d256fab355abdc1bfa2547a1d42d0ac623080b44be144de26"
+      "sha256": "ac23681c5493a57f1faca551e4896e4a7a4e2dabb6246bf2a84c39ae6e571257"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "81b98db9ae28ac2606efa211fe791632c1857e796c4d7e00cddbcf26daf76362"
+      "sha256": "7122e5cca352a5abc317d25267eba6c0bab955febf2179bf362a896be424d0bc"
     },
     {
       "path": "public-docs/index.html",
@@ -5907,7 +5907,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "559f382c12c7f37bc85227630cd5670d9f4b7749e9994036d85c221a5d3d3b43"
+      "sha256": "d509a7e4f16027ccef999e8aadf1a2cef5368bce5cd0c3bda3b7eb61cbceaa5f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6202,7 +6202,7 @@
     {
       "path": "tests/box_access.mjs",
       "mode": "0000644",
-      "sha256": "694153e377a78d4325aa4ff9b947f691d71362f843da25815b9740821903802c"
+      "sha256": "1e4db680c5925e473fff9ad6247e797bd9089fdf3696c3ffb161903bda41dcda"
     },
     {
       "path": "tests/box_auth_check.mjs",

package/modules/dev-box/box-access.js

@@ -171,24 +171,63 @@ const BASE_SPARSE_PATHS = [
 // globs come in two shapes: directory globs (trailing '/', e.g. 'modules/dev-box/')
 // and file-list globs (exact paths, e.g. the kernel key's 'src/bongos/db.js'). We
 // KEEP the directory globs (normalized to no trailing slash, matching the BASE
-// style) and DROP the file globs — every file glob in the map sits under a BASE
-// directory (src/bongos, scripts) or is a top-level/ancestor file cone mode pulls
-// automatically, so base already materializes it. (A future non-cone sparse move
-// could pull individual files; out of scope — cone mode stays.) Deterministic:
-// BASE in declared order, then the module dirs sorted + deduped.
+// style). A FILE glob cannot be emitted as-is, so it contributes its PARENT
+// DIRECTORY instead — unless BASE or another emitted dir already covers it.
+//
+// It used to be dropped outright, on the reasoning that "every file glob in the
+// map sits under a BASE directory (src/bongos, scripts) or is a top-level file
+// cone mode pulls automatically". That was true when written and **silently
+// stopped being true**: ADR 0174 gave the `government` key the file globs
+// `config/government.json` + `config/government.neutral.json`, and `config` is
+// not in BASE. The result was a goal walled to `government` whose box could never
+// see two files inside its own scope wall — which released task 1003018 (R05 of
+// goal 1000069), whose entire deliverable was one of them. Rather than restore an
+// invariant that expires again the next time a module claims a config file, the
+// parent is emitted and the class is covered by construction.
+//
+// TRADE-OFF, stated rather than implied: the parent directory is a SUPERSET of
+// the glob — asking for `config/government.json` materializes all of `config/`.
+// The box's view is already a superset of the wall (BASE hands out `scripts`,
+// `docs` and `tests` wholesale regardless of scope), so this is consistent with
+// the existing posture, not a new concession. The WALL is unchanged: what a
+// builder may author is still decided by goal-scope-check against the globs, not
+// by what happens to be on disk.
+//
+// Top-level file globs (no '/') contribute nothing — cone mode includes root
+// files automatically. Deterministic: BASE in declared order, then the module
+// dirs sorted + deduped.
 function sparsePathsForScopeKeys(scopeKeys, moduleScopeMap) {
   const base = [...BASE_SPARSE_PATHS];
   const seen = new Set(base);
   const extra = [];
+  // Cone mode materializes a directory and everything under it, so a path is
+  // already covered when IT or any ancestor has been emitted. This is what keeps
+  // `scripts/gds/box.js` from adding `scripts/gds` — BASE's `scripts` covers it.
+  const covered = (dir) => {
+    let p = dir;
+    for (;;) {
+      if (seen.has(p)) return true;
+      const cut = p.lastIndexOf('/');
+      if (cut < 0) return false;
+      p = p.slice(0, cut);
+    }
+  };
+  const add = (dir) => {
+    if (!dir || covered(dir)) return;
+    seen.add(dir);
+    extra.push(dir);
+  };
   for (const key of Array.isArray(scopeKeys) ? scopeKeys : []) {
     const entry = moduleScopeMap && typeof moduleScopeMap.scopeForModule === 'function'
       ? moduleScopeMap.scopeForModule(key)
       : null;
     if (!entry || !Array.isArray(entry.globs)) continue;
     for (const glob of entry.globs) {
-      if (typeof glob !== 'string' || !glob.endsWith('/')) continue; // dirs only (cone mode)
-      const dir = glob.replace(/\/+$/, '');
-      if (!seen.has(dir)) { seen.add(dir); extra.push(dir); }
+      if (typeof glob !== 'string' || !glob) continue;
+      if (glob.endsWith('/')) { add(glob.replace(/\/+$/, '')); continue; }
+      const cut = glob.lastIndexOf('/');
+      if (cut < 0) continue; // a root file — cone mode already includes it
+      add(glob.slice(0, cut));
     }
   }
   extra.sort();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.218",
+  "version": "1.19.219",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.218",
+      "version": "1.19.219",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.218",
+  "version": "1.19.219",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -863,8 +863,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.216 with no explicit bump. run 32084927511. (task 1002620)
 //   1.19.218 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.217 with no explicit bump. run 32086598601. (task 1002620)
+//   1.19.219 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.218 with no explicit bump. run 32094215476. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.218'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.219'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_access.mjs

@@ -221,14 +221,69 @@ t('cone-filter: dev-box keeps its DIRS, DROPS its file globs (scripts/gds/box.js
   assert.ok(out.includes('devbox-app'), 'the app dir is kept');
   assert.ok(!out.some((p) => p.endsWith('.js') || p.endsWith('.sh')), 'no file globs survive the cone filter');
   assert.ok(!out.includes('scripts/gds/box.js'), 'the box CLI file is dropped (BASE scripts covers it)');
+  // …and its PARENT is not added either: BASE's `scripts` already covers it, so
+  // the ancestor check must stop `scripts/gds` from appearing. This is the half
+  // that keeps the file-glob rescue below from over-sharing.
+  assert.ok(!out.includes('scripts/gds'), 'a covered parent is not re-emitted');
+});
+
+// A file glob whose parent is NOT already covered must contribute that parent.
+// Regression for the live failure that released task 1003018 (R05 of goal
+// 1000069): the `government` key's config/government*.json globs were dropped on
+// the reasoning that every file glob sits under a BASE directory — true when
+// written, false once ADR 0174 added them, since `config` is not in BASE. The box
+// could not see two files inside its own scope wall.
+t('file-glob rescue: government contributes `config` for its config/*.json globs', () => {
+  const out = access.sparsePathsForScopeKeys(['government'], scopeMap);
+  assert.ok(out.includes('modules/government'), 'the module dir is kept');
+  assert.ok(out.includes('config'), 'config/government.neutral.json must reach the box via its parent');
+  assert.ok(!out.some((p) => p.endsWith('.json')), 'still no file paths — cone mode would reject one');
+});
+
+t('file-glob rescue holds for EVERY key in the map — no module can silently lose one', () => {
+  // Enumerated, never sampled: a module that gains a file glob under a new parent
+  // is covered the day it lands, which is exactly how this bug escaped before.
+  for (const key of scopeMap.moduleKeys()) {
+    const out = access.sparsePathsForScopeKeys([key], scopeMap);
+    for (const glob of scopeMap.scopeForModule(key).globs) {
+      if (glob.endsWith('/')) continue;
+      const cut = glob.lastIndexOf('/');
+      if (cut < 0) continue; // a root file — cone mode includes it automatically
+      const parent = glob.slice(0, cut);
+      const reachable = out.some((p) => parent === p || parent.startsWith(`${p}/`));
+      assert.ok(reachable, `${key}: no cone path materializes ${glob} (parent ${parent})`);
+    }
+  }
+});
+
+t('the emitted set stays directories only, for every key', () => {
+  // A leading dot is a DIRECTORY here ('.devcontainer', '.claude'), so the
+  // extension test must require a non-dot character before the dot — otherwise
+  // every BASE dotfile-dir reads as a file and this assertion fires on healthy
+  // input. (It did, on first write.)
+  const looksLikeFile = (seg) => /[^.]\.[a-z0-9]+$/i.test(seg);
+  for (const key of scopeMap.moduleKeys()) {
+    for (const p of access.sparsePathsForScopeKeys([key], scopeMap)) {
+      assert.ok(!looksLikeFile(p.split('/').pop()),
+        `${key}: ${p} looks like a file — git sparse-checkout set would abort on it`);
+    }
+  }
 });
 
-t('cone-filter: the kernel key contributes only its real DIR globs (config, src/module-loader)', () => {
+t('cone-filter: the kernel key materializes its real DIR globs (config, src/module-loader)', () => {
   const out = access.sparsePathsForScopeKeys(['kernel'], scopeMap);
   // kernel is mostly individual src/bongos/*.js FILES (dropped — BASE src/bongos
   // covers them via cone ancestor-inclusion) + a few genuine DIR globs.
   assert.ok(out.includes('config'), 'config/ is a real dir the task needs, not in BASE');
-  assert.ok(out.includes('src/module-loader'), 'src/module-loader/ is a real dir not in BASE');
+  // src/module-loader/ is a real dir not in BASE, but it is NOT emitted verbatim:
+  // kernel also carries the file globs src/instance-config.js, src/branding.js,
+  // src/modules.js and src/module-api.js, whose rescued parent is `src` — and once
+  // `src` is emitted the ancestor check absorbs every path beneath it, this one
+  // included. Asserting literal membership would be asserting emission ORDER, not
+  // reachability. What the box must actually get is the DIRECTORY's contents, so
+  // assert that, using the same idiom as the enumerated rescue test above.
+  const reaches = (dir) => out.some((p) => dir === p || dir.startsWith(`${p}/`));
+  assert.ok(reaches('src/module-loader'), 'src/module-loader must be materialized (here via the rescued `src`)');
   assert.ok(!out.includes('src/bongos/db.js'), 'the kernel FILE globs are dropped');
   assert.ok(!out.includes('server.js'), 'top-level files never enter the sparse set (cone auto-includes them)');
 });