@bongos/core 1.19.312 → 1.19.314

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.312",
-  "core_contract": "1.19.312",
-  "source_commit": "1115918f0f231eb592993c52535bccf7459ba201",
+  "core_version": "1.19.314",
+  "core_contract": "1.19.314",
+  "source_commit": "7d49e680ed9b88bc3fd32760e275bc2f52348673",
   "source_ref": "HEAD",
-  "built_at": "2026-08-23T20:51:36.647Z",
+  "built_at": "2026-08-23T21:48:01.343Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 323,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1766,
-  "tree_sha256": "8fa5a70e1592609c53386120743ab236e02cd64aaf8c3911891bd79d6a8da6ea",
+  "tree_sha256": "59daa4e8041f110026fee1110197d244eb74cd075b36da6d4fc0d18f4bac0b18",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1672,7 +1672,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "b42d8b4620355bef0e27480b2ddfaa07140e322de988839f0e102f1a1545ac47"
+      "sha256": "15517dbf462ce85e7d161b4e173c90376a19ecad3d0cf57a728f066533697bb2"
     },
     {
       "path": "docs/recipes/devbox-app-release.md",
@@ -4582,12 +4582,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "57b834edcb83e8b41bb7535bbacc1740537b0f3551726295884ea35615a88686"
+      "sha256": "e2b6abac7133ee151991f267ba79cb55ed677547ebc8adaf573288a959aecc01"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7e8d9420573b8eabbe2ad7f96f0317d4b454fcf5788b68bfc6afdf6fb45b3cb4"
+      "sha256": "47771a7e9c28952af15efa1c8f64fb44cae34698bc385484d1250878145dfc18"
     },
     {
       "path": "public-docs/index.html",
@@ -5317,7 +5317,7 @@
     {
       "path": "scripts/gds/go-live.js",
       "mode": "0000644",
-      "sha256": "05734e21763cc0b0614275efa76b7b68afabee8be93f3f2d797400d6a97e86c1"
+      "sha256": "fa7803b178d64eda47d4f05032353582f7000359b13caea7d018112f03c9906a"
     },
     {
       "path": "scripts/gds/goal.js",
@@ -6257,7 +6257,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a35a7a2ca59f77d06b12aaaec28b4d82bbe5a4713289c072d4e9cc45d0d467e5"
+      "sha256": "eac68b3c94db0a8eb79241d515a0df3d19d96f6fb41165c32ea4a963753bd5b1"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6422,7 +6422,7 @@
     {
       "path": "tests/audit_gate.mjs",
       "mode": "0000644",
-      "sha256": "af91c6018f572d9cb0a213b40ec7953f9f81cc20a33634fb5a66615a1649fee8"
+      "sha256": "ee9dc18e86ac819235d7215f0cee14ff7bfc8d07c46eba6895c23f99c7d0ae0e"
     },
     {
       "path": "tests/audit_middleware.mjs",
@@ -7182,7 +7182,7 @@
     {
       "path": "tests/go_live.mjs",
       "mode": "0000644",
-      "sha256": "90c8cbfd8bf0b446261f9fd837b9b08b1035210f1cbf1f7ff81998ec535c32f1"
+      "sha256": "360712fee43b00b410e4b3b8ca27e801ae41966ac0c5ce0a4679fa7943aa554b"
     },
     {
       "path": "tests/goal_abuse_matrix.mjs",

package/docs/recipes/core-release-pipeline.md

@@ -188,6 +188,11 @@ The permission classifier blocks the agent from running a mutating `sudo -u lars
 What each piece is for — each guards a failure that actually happened:
 
 - **Token extraction runs as lars** (the whole command is inside `sudo -u lars bash -c`). Reading `/home/lars/.npmrc` as `jaxri` is `Permission denied`, which yields an **empty** `NPM_TOKEN`, which sends npm to the **public** registry, which 404s on the private `@bongos/core` — and the upgrade rolls back cleanly, having taught you nothing. The `[ -n "$NPM_TOKEN" ] || exit` guard aborts instead of half-running.
+- **Never put the token in the command line — `sudo` logs the full argv (task 1003218).** The shape above is safe *because* the token is read INSIDE the quoted script, so only the `grep` reaches argv. The tempting variant is not:
+  ```
+  sudo -u lars -H env NPM_TOKEN="<redacted>" … bongos upgrade …     # ← LEAKS
+  ```
+  The shell expands `$NPM_TOKEN` before `sudo` ever runs, so the real token lands in the system journal — which is persistent on this box. That variant put the live token into 26 journal lines between 2026-08-17 and 2026-08-23. If you need to hand a secret to a privileged child, use `sudo --preserve-env=NPM_TOKEN …`, which passes it through the environment where nothing logs it. Passing "by reference" in the script text is NOT enough; what matters is what argv looks like after expansion.
 - **`--to <VER>` is required** — `bongos upgrade` refuses to guess a target.
 - **`--service` + `--health-url` buy the automatic rollback.** Point the health URL at `http://127.0.0.1:3002/healthz`, **not the public URL** — a pre-launch `basic_auth` on the apex makes a healthy boot look failed and triggers a needless rollback.
 - **`--commit-pin` commits AND pushes the pin.** The instance is a pull-deploy repo: the next sync runs `git reset --hard origin/main`, which reverts an uncommitted pin, and `npm ci` then reinstalls the old core. Nothing errors. This is exactly how live sat 13 releases behind (task 1002712). The same applies to any tracked instance-config edit (`config/branding.json`): commit + push or the next deploy tick undoes it. A commit that fails to *push* saves nothing — deploy.sh resets to the remote.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.312",
+  "version": "1.19.314",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.312",
+      "version": "1.19.314",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",
@@ -48,9 +48,9 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.5",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
-      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+      "version": "1.20.6",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz",
+      "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==",
       "license": "MIT",
       "dependencies": {
         "bytes": "~3.1.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.312",
+  "version": "1.19.314",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",
@@ -29,6 +29,6 @@
     "pino": "^9.14.0"
   },
   "overrides": {
-    "undici": "^6.27.0"
+    "undici": "^6.28.0"
   }
 }

package/scripts/gds/go-live.js

@@ -177,22 +177,36 @@ function remote(target, script, { run = spawnSync, timeoutMs = 900000 } = {}) {
 // `sudo -u <user> -H env K=V … <cmd>` — the shape every runbook entry uses. Returns
 // a string safe to embed because every component was allowlist-validated.
 //
-// `forward` names variables to pass through BY REFERENCE (`K="$K"`), for values that
-// exist in the calling root shell but must not appear in this script's text. That is
-// how NPM_TOKEN reaches the upgrade: sudo's env_reset drops it, and an explicit
-// `env K=V` list that omits it drops it too — so `npm install` 404s the PRIVATE
-// package and the upgrade auto-rolls-back, which reads as "the release is broken"
-// when it is only "the token never arrived". Sourcing the env file in the OUTER shell
-// is necessary and NOT sufficient; this is the second half of that trap.
+// `forward` names variables that exist in the calling root shell and must reach the
+// child — NPM_TOKEN above all. sudo's env_reset drops it, and an explicit `env K=V`
+// list that omits it drops it too, so `npm install` 404s the PRIVATE package and the
+// upgrade auto-rolls-back, which reads as "the release is broken" when it is only
+// "the token never arrived". Sourcing the env file in the OUTER shell is necessary
+// and NOT sufficient.
+//
+// A FORWARDED VARIABLE IS A SECRET, SO IT MUST NOT ENTER argv (task 1003218).
+// `env K="$K"` keeps the value out of the script TEXT, but the shell EXPANDS it
+// before sudo runs — and sudo logs the full argv. That is how 26 lines of
+// `COMMAND=... NPM_TOKEN=npm_<real token> ...` ended up in the droplet's PERSISTENT
+// journal between 2026-08-17 and 2026-08-23. Passing by reference is NOT the same as
+// keeping a secret out of argv; only `--preserve-env` does that, handing the variable
+// over through the environment where nothing logs it. Verified side by side on the
+// box: both forms reach the child, only this one leaves no value in the journal.
+//
+// The plain `env K=V` list is still used for NON-secret values (PGDATABASE, HOME) —
+// those are configuration, and seeing them in a log is useful rather than harmful.
 function asOwner(target, cmd, { forward = [] } = {}) {
   const envPairs = Object.entries(target.env || {}).map(([k, v]) => `${k}=${v}`);
-  for (const k of forward) {
-    if (!SAFE_ENV_KEY_RE.test(k)) continue; // never interpolate an unvetted name
-    envPairs.push(`${k}="$${k}"`);          // by reference — the VALUE is never written here
+  const preserve = forward.filter((k) => SAFE_ENV_KEY_RE.test(k)); // never interpolate an unvetted name
+  if (!target.runAs) {
+    // No privilege drop: the child already inherits our environment, so a forwarded
+    // secret needs no mention at all.
+    const joined = envPairs.join(' ');
+    return `${joined ? `env ${joined} ` : ''}${cmd}`.trim();
   }
-  const joined = envPairs.join(' ');
-  const prefix = target.runAs ? `sudo -u ${target.runAs} -H env ${joined} HOME=/home/${target.runAs}` : (joined ? `env ${joined}` : '');
-  return `${prefix} ${cmd}`.trim();
+  const keep = preserve.length ? `--preserve-env=${preserve.join(',')} ` : '';
+  const joined = [...envPairs, `HOME=/home/${target.runAs}`].join(' ');
+  return `sudo ${keep}-u ${target.runAs} -H env ${joined} ${cmd}`.trim();
 }
 
 // POSIX single-quote a value for embedding in a shell command.

package/src/module-api.js

@@ -1051,8 +1051,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.310 with no explicit bump. run 32665535518. (task 1002620)
 //   1.19.312 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.311 with no explicit bump. run 32665664699. (task 1002620)
+//   1.19.313 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.312 with no explicit bump. run 32668457836. (task 1002620)
+//   1.19.314 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.313 with no explicit bump. run 32668599111. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.312'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.314'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/audit_gate.mjs

@@ -79,9 +79,14 @@ test('empty/missing baseline means every high gates (the fresh-repo case)', () =
   assert.equal(v.newAdvisory.length, 2, 'the two undici moderates advise');
 });
 
+// task 1003201 (goal 1000079) drove the baseline to ZERO — every advisory it
+// recorded is fixed, not tolerated. An empty findings[] is therefore the goal
+// state, not a broken file; the shape assertions below still hold if debt ever
+// reappears. (It must stay an array — a missing/!array findings would make the
+// gate silently treat every new high as pre-existing.)
 test('the committed baseline file parses and only carries known severities', () => {
   const b = require(path.join(ROOT, 'config', 'audit-baseline.json'));
-  assert.ok(Array.isArray(b.findings) && b.findings.length > 0);
+  assert.ok(Array.isArray(b.findings), 'findings must be an array (empty = no tolerated debt)');
   for (const f of b.findings) {
     assert.ok(['low', 'moderate', 'high', 'critical', 'info', 'unknown'].includes(f.severity), `odd severity ${f.severity}`);
     assert.ok(f.id && f.name, 'baseline entries carry advisory id + package');

package/tests/go_live.mjs

@@ -296,11 +296,17 @@ test("'could not check' is a distinct halt from 'absent'", () => {
 // `env K=V` list that omits it drops it too. This cost a real failed go-live.
 // ---------------------------------------------------------------------------
 
-test('a forwarded var is passed BY REFERENCE, never by value', () => {
+test('a forwarded secret NEVER enters argv — it is handed over via --preserve-env', () => {
   const cmd = G.asOwner({ runAs: 'lars', env: { PGDATABASE: 'cb' } }, 'npm install', { forward: ['NPM_TOKEN'] });
-  assert.match(cmd, /NPM_TOKEN="\$NPM_TOKEN"/);
-  // The point of by-reference: the secret's VALUE must never appear in the script text.
-  assert.ok(!cmd.includes('npm_'), 'a token value must never be interpolated here');
+  assert.match(cmd, /--preserve-env=NPM_TOKEN/);
+  // THE REGRESSION (task 1003218). `env K="$K"` kept the value out of the script TEXT,
+  // but the shell expands it before sudo runs and sudo LOGS THE FULL argv — which put
+  // the real token into the droplet's persistent journal 26 times. So the command must
+  // not mention the variable as an assignment at all, by reference or otherwise.
+  assert.ok(!/NPM_TOKEN=/.test(cmd.replace('--preserve-env=NPM_TOKEN', '')),
+    'a secret must never appear as an argv assignment — sudo logs argv');
+  // Non-secret config is still passed plainly; seeing PGDATABASE in a log is useful.
+  assert.match(cmd, /PGDATABASE=cb/);
 });
 
 test('forwarding is only wired when the target names an env file to source from', () => {
@@ -310,12 +316,24 @@ test('forwarding is only wired when the target names an env file to source from'
   assert.deepEqual(G.npmForward({}), []);
 });
 
-test('an unvetted variable name is never interpolated', () => {
+test('an unvetted variable name never reaches the command', () => {
   const cmd = G.asOwner({ runAs: 'me' }, 'x', { forward: ['GOOD', 'bad name', '$(id)', '1BAD'] });
-  assert.match(cmd, /GOOD="\$GOOD"/);
+  assert.match(cmd, /--preserve-env=GOOD/);
   assert.ok(!cmd.includes('bad name') && !cmd.includes('$(id)') && !cmd.includes('1BAD'));
 });
 
+test('with no privilege drop a secret needs no mention at all', () => {
+  // The child already inherits our environment, so naming it would be pure exposure.
+  const cmd = G.asOwner({ env: { A: 'b' } }, 'x', { forward: ['NPM_TOKEN'] });
+  assert.equal(cmd, 'env A=b x');
+  assert.ok(!cmd.includes('NPM_TOKEN'));
+});
+
+test('no forwarding leaves the documented sudo shape untouched', () => {
+  assert.equal(G.asOwner({ runAs: 'me', env: { PGDATABASE: 'mydb' } }, 'echo hi'),
+    'sudo -u me -H env PGDATABASE=mydb HOME=/home/me echo hi');
+});
+
 // ---------------------------------------------------------------------------
 // A failed run must say what the tool said
 // ---------------------------------------------------------------------------