@bongos/core 1.19.334 → 1.19.335

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.334",
-  "core_contract": "1.19.334",
-  "source_commit": "17d7b23f872fb3f64737ae5ffe270b91ace779a0",
+  "core_version": "1.19.335",
+  "core_contract": "1.19.335",
+  "source_commit": "b5f2b884a9011be30bffe5bbd62c272a7497314a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T00:36:48.394Z",
+  "built_at": "2026-08-25T00:51:04.860Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 325,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1837,
-  "tree_sha256": "15089adb0fd9a51245746cbd141dd57dceadee53a5e640beb0d7059c7f219610",
+  "tree_sha256": "9792847e3608bc598acfe751efe68d1e8cbb5b0ab10a19490cf2f325db36a44c",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4722,12 +4722,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "27cc593724db16a7e292e6f8287d3fadfbda3a6eaff49c1c97a08fe5bf175ce5"
+      "sha256": "c3a2cfd45a78396f4f7186492cf625a2351f4dfd78c0d82dbffc4217db97a68d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5d2f06a29143a871ca7dd2f20d46ba2b05389a57aafddc6891147baa2a00e124"
+      "sha256": "9896b1417474da8bf8b09e8dd188455d6d75b5e95602c7409a81ea17ee6e4cc3"
     },
     {
       "path": "public-docs/index.html",
@@ -6577,7 +6577,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "717fc58e2725b43ec1bc0a0e995172992ed0b42cba603c68482292b70da67c57"
+      "sha256": "490504c9d10309b811026a035d5999360cbe00b8eb912bb8c4d0873c8271cff2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8072,7 +8072,7 @@
     {
       "path": "tests/lib_sh_resolution.mjs",
       "mode": "0000644",
-      "sha256": "4ec5ac626d9f8a72fe0e0066b266feb1f87b38c0dd8ac52f107c23e37a6a2e97"
+      "sha256": "97630ec5029469ec99c6a87160822f319833857f12a79e42b4a465e362836ef0"
     },
     {
       "path": "tests/lifecycle-card.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.334",
+  "version": "1.19.335",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.334",
+      "version": "1.19.335",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.334",
+  "version": "1.19.335",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1095,8 +1095,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.332 with no explicit bump. run 32793666555. (task 1002620)
 //   1.19.334 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.333 with no explicit bump. run 32794305277. (task 1002620)
+//   1.19.335 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.334 with no explicit bump. run 32795232997. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.334'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.335'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/lib_sh_resolution.mjs

@@ -26,6 +26,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { fitnessSource } from './helpers.mjs';
@@ -152,3 +153,144 @@ test('the whole host-identity check is green on this tree', () => {
   const r = fitness.checkKernelPromptsNoHardcodedIdentity();
   assert.equal(r.ok, true, `violations:\n${r.violations.join('\n')}`);
 });
+
+// ---- 4. the SAME rule applies to the baked box scripts (task 1003252) ------
+//
+// THE SECOND BUG, same class, different file group. The sweep above fixed
+// scripts/gds/*.sh but never looked at infra/box-*.sh — the scripts baked onto a
+// dev box. Those kept reading a hardcoded ~/.config/otb/gds-session.json while
+// paste-token.js writes to ~/.config/<branding.configDir>/. On this instance
+// (configDir "cloudbongos") that meant every /builder-reauth silently stranded the
+// box: the 5-min heartbeat, the terminal/host-key/version reporters and the
+// GDS-backed git credential helper all kept presenting a DEAD token and failing
+// with a misleading "session expired — re-auth on the box", which is exactly what
+// the builder had just done. Observed live: four reporters 401ing every tick and a
+// checkout 311 commits behind origin/main.
+//
+// The fix mirrors instance-config.js's read-side fallback in bash: prefer the most
+// recently written gds-session.json across ~/.config/*/, since branding is not
+// readable from a script that must also run before any clone exists.
+
+const BOX_SCRIPTS = [
+  'box-heartbeat.sh',
+  'box-report-terminal.sh',
+  'box-report-host-keys.sh',
+  'box-report-version.sh',
+];
+
+const INFRA = path.join(ROOT, 'infra');
+const boxCode = (f) => fitness.stripCommentsForIdentity(fs.readFileSync(path.join(INFRA, f), 'utf8'), '.sh');
+
+test('every baked box script resolves the session across config dirs, not just the legacy one', () => {
+  for (const f of BOX_SCRIPTS) {
+    const src = boxCode(f);
+    assert.match(src, /\.config\/\*\/gds-session\.json/,
+      `${f} must fall back across ~/.config/*/ — without it a /builder-reauth into a `
+      + 'non-"otb" configDir strands the box on a dead token');
+    // The legacy literal may survive ONLY as the last-resort default, never as the
+    // sole source — i.e. it must be preceded by the glob scan.
+    // The scan widens what these scripts will read, so each candidate must be owned
+    // by the box user -- otherwise a file dropped by another local account could win
+    // simply by being newest.
+    assert.match(src, /\[ -O "\$_sess" \]/,
+      `${f} must require candidate session files to be owned by the current user`);
+    const globAt = src.indexOf('.config/*/gds-session.json');
+    const legacyAt = src.indexOf('.config/otb/gds-session.json');
+    if (legacyAt !== -1) {
+      assert.ok(globAt < legacyAt,
+        `${f} reaches the legacy path before scanning ~/.config/*/ — the fallback must come first`);
+    }
+  }
+});
+
+test('every baked box script passes bash -n', (t) => {
+  const probe = bash(['-n', 'infra/box-heartbeat.sh']);
+  if (!probe) return t.skip('bash not available on this machine');
+  for (const f of BOX_SCRIPTS) {
+    const r = bash(['-n', `infra/${f}`]);
+    assert.equal(r.status, 0, `bash -n infra/${f} failed:\n${r.stderr}`);
+  }
+});
+
+// Pull the resolver straight out of the committed file so this exercises the real
+// code, not a copy that could drift away from it.
+function resolverBlock(f) {
+  const src = fs.readFileSync(path.join(INFRA, f), 'utf8');
+  const start = src.indexOf('if [ -z "${GDS_SESSION:-}" ]; then');
+  const endMark = 'GDS_SESSION="${GDS_SESSION:-$HOME/.config/otb/gds-session.json}"';
+  const end = src.indexOf(endMark, start);
+  assert.ok(start !== -1 && end !== -1, `could not locate the resolver block in ${f}`);
+  return src.slice(start, end + endMark.length);
+}
+
+test('the resolver prefers the most recently written session across config dirs', (t) => {
+  const probe = bash(['-n', 'infra/box-report-version.sh']);
+  if (!probe) return t.skip('bash not available on this machine');
+
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'boxsess-'));
+  const legacy = path.join(home, '.config', 'otb');
+  const configured = path.join(home, '.config', 'cloudbongos');
+  fs.mkdirSync(legacy, { recursive: true });
+  fs.mkdirSync(configured, { recursive: true });
+  fs.writeFileSync(path.join(legacy, 'gds-session.json'), '{"token":"stale"}');
+  fs.writeFileSync(path.join(configured, 'gds-session.json'), '{"token":"fresh"}');
+  // Make the legacy copy unambiguously older than the freshly re-authed one.
+  const old = new Date(Date.now() - 60_000);
+  fs.utimesSync(path.join(legacy, 'gds-session.json'), old, old);
+
+  const block = resolverBlock('box-report-version.sh');
+  const run = (env) => spawnSync('bash', ['-c', `set -uo pipefail\n${block}\nprintf '%s' "$GDS_SESSION"`],
+    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: home, ...env } });
+
+  // 1. the freshly written session wins over the stale legacy one
+  assert.equal(run({}).stdout, path.join(configured, 'gds-session.json'));
+
+  // 2. an explicit override still beats the scan
+  assert.equal(run({ GDS_SESSION: '/explicit/path.json' }).stdout, '/explicit/path.json');
+
+  // 3. with nothing on disk it falls back to the historical path, so the caller's
+  //    "no session at ..." message still names somewhere sensible
+  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'boxsess-empty-'));
+  const r3 = spawnSync('bash', ['-c', `set -uo pipefail\n${block}\nprintf '%s' "$GDS_SESSION"`],
+    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: empty } });
+  assert.equal(r3.stdout, path.join(empty, '.config', 'otb', 'gds-session.json'));
+
+  fs.rmSync(home, { recursive: true, force: true });
+  fs.rmSync(empty, { recursive: true, force: true });
+});
+
+// box-heartbeat.sh is the odd one out: its override variable (OTB_GDS_SESSION) is
+// NOT the variable it resolves into (SF). A first cut of the fix guarded on the
+// override but assigned to SF, so a caller that SET the override had it silently
+// dropped and fell through to the legacy default — the exact bug being fixed,
+// reintroduced through the back door. Pin all three branches.
+test('box-heartbeat.sh honors OTB_GDS_SESSION, scans, then falls back', (t) => {
+  const probe = bash(['-n', 'infra/box-heartbeat.sh']);
+  if (!probe) return t.skip('bash not available on this machine');
+
+  const src = fs.readFileSync(path.join(INFRA, 'box-heartbeat.sh'), 'utf8');
+  const start = src.indexOf('SF="${OTB_GDS_SESSION:-}"');
+  const endMark = 'SF="${SF:-$HOME/.config/otb/gds-session.json}"';
+  const end = src.indexOf(endMark, start);
+  assert.ok(start !== -1 && end !== -1, 'could not locate the SF resolver in box-heartbeat.sh');
+  const block = src.slice(start, end + endMark.length);
+
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-'));
+  const configured = path.join(home, '.config', 'cloudbongos');
+  fs.mkdirSync(configured, { recursive: true });
+  fs.writeFileSync(path.join(configured, 'gds-session.json'), '{"token":"fresh"}');
+
+  const run = (env, h = home) => spawnSync('bash',
+    ['-c', `set -euo pipefail\n${block}\nprintf '%s' "$SF"`],
+    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: h, ...env } }).stdout;
+
+  assert.equal(run({ OTB_GDS_SESSION: '/explicit/override.json' }), '/explicit/override.json',
+    'the OTB_GDS_SESSION override must win — guarding on it but assigning elsewhere drops it');
+  assert.equal(run({}), path.join(configured, 'gds-session.json'));
+
+  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-empty-'));
+  assert.equal(run({}, empty), path.join(empty, '.config', 'otb', 'gds-session.json'));
+
+  fs.rmSync(home, { recursive: true, force: true });
+  fs.rmSync(empty, { recursive: true, force: true });
+});