@bongos/core 1.19.348 → 1.19.349

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.348",
-  "core_contract": "1.19.348",
-  "source_commit": "d42db56154d01be276f13e04e364e7ced8d8c400",
+  "core_version": "1.19.349",
+  "core_contract": "1.19.349",
+  "source_commit": "e54f95adb8fcdf1913b4594cffacffd27ad8589b",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T02:48:07.802Z",
+  "built_at": "2026-08-25T02:56:45.668Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 328,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1849,
-  "tree_sha256": "3004531bfb70cd33dbca752e2d945c4687d6ea1148f54548b6fcf921f953681f",
+  "tree_sha256": "8c67ac08217f3c2062ec02b6f17c7db9d813a2ac3aafb642fefca9ca3830f579",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3997,7 +3997,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "127b6666bfbc4b85baebe85b0bf5501ad73b517faf4dafbc1a76a5535ac04ebc"
+      "sha256": "d50b04376a9725bae0f8fe9c81166224eb47242655fec49f33f89b0f87b555f0"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -4132,7 +4132,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "07a56f93428baf4d8cbf7a69a76c052e706ec7759134fcf3db153a37c9ab575c"
+      "sha256": "b29d9bffce9c81e0f5e02ea2da387e15dc6f0bf8d96820931c29275861eeaf66"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -4762,12 +4762,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6745e4e181b20731968d02f8e4dac7cb864acbf3fbbd6ec6054c799a41487618"
+      "sha256": "e4dcce1602dec36614f7978f6140d1022f23cb4d52f043d4fe4c1b065641dc39"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "65ce6bcba41342833cd48800e028fd1e3420a4d9d7fb82c1250cfca724baa0ad"
+      "sha256": "74a97d3caf479ffc429b577c4f96cdc33bf45e71f66c0748ac0a4ef22cdb3e60"
     },
     {
       "path": "public-docs/index.html",
@@ -6102,7 +6102,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "c3224ab05621b1e1e523b926c7a3d0e09b36c7de3fc6d984ee6c588dfcdd1e38"
+      "sha256": "e091557b4cc29c081cb82f9cd650b4c110f1dede4e72b704893f8397cd7bbaf2"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -6622,7 +6622,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7eca632fc6880711d60fad718a743301e62e99ca990a8a4cf07767726f86f0cf"
+      "sha256": "2509fad9871925f5c6233c9b85e7e31bad63f764892bddd6cc52295442dbc1f9"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8977,7 +8977,7 @@
     {
       "path": "tests/ship_publish_error.mjs",
       "mode": "0000644",
-      "sha256": "b6ca6ac4802b035c02be382a8aa7f63f5381b02524343d5fe002336c1aadc512"
+      "sha256": "5c0d5961408ac202eb53fe648c4c8b00e5552b231b35f39a39e006b705cb34f1"
     },
     {
       "path": "tests/ship_resume.mjs",

package/modules/lifecycle/github-push.js

@@ -130,6 +130,23 @@ function scrubCredential(s) {
     .replace(/(ghs_|ghp_|github_pat_)[A-Za-z0-9_]+/g, '$1***');
 }
 
+// How much scrubbed stderr travels with a failure (task 1003222). Sized to hold a
+// real git failure whole — the 'remote:' lines that name the cause arrive LAST, so a
+// short cap deletes precisely the part worth reading. It is a payload bound, nothing
+// more; when it bites, truncateLoudly says so rather than ending mid-word.
+const STDERR_MAX = 8000;
+
+// Truncate in a way the reader can SEE. A silent clip is worse than no message: it
+// looks like the complete text, which is how 'error: failed' got mistaken for the
+// whole story. Keeps the TAIL as well as the head, because git's useful line is last.
+function truncateLoudly(text, max = STDERR_MAX) {
+  const s = String(text || '');
+  if (s.length <= max) return s;
+  const head = Math.floor(max * 0.4);
+  const tail = max - head;
+  return `${s.slice(0, head)}\n\n…[${s.length - max} characters omitted — full text in the server log]…\n\n${s.slice(-tail)}`;
+}
+
 // Default git seam: execFile arg-array, shell:false, stdout captured. On failure
 // throws GIT_FAILED. We never echo the (possibly credentialed) argv, but DO attach
 // the credential-scrubbed stderr + the caller's step label (task 1547) so a real
@@ -149,9 +166,30 @@ async function defaultExec(args, opts = {}) {
     return stdout;
   } catch (e) {
     // Identify the failing step by the caller's label, never by echoing argv.
-    // Surface the scrubbed stderr (truncated) so the cause is loud in the log.
-    const stderr = scrubCredential(e && (e.stderr || e.message)).trim().slice(0, 500);
-    throw err('GIT_FAILED', { git_step: step || (args && args[0]) || null, stderr });
+    //
+    // THE STDERR IS NOT CLIPPED SHORT ANY MORE (task 1003222). It used to be cut at
+    // 500 chars here and again at 200 on the way to the client, so a builder saw
+    // 'error: failed' — clipped mid-word, naming neither cause nor remedy — while the
+    // line that mattered ('remote: fatal error in commit_refs') and the exit code
+    // existed only server-side. That cost hours on the blocker-1000117 outage AND
+    // produced a WRONG first diagnosis, because the real message was never in the
+    // room. git puts the useful line LAST (the 'remote:' lines follow the progress
+    // chatter), which is exactly what a head-truncation throws away.
+    //
+    // The cap is a payload guard, not an editorial decision: generous enough that a
+    // real push failure fits whole, and when it does bite the text SAYS SO instead of
+    // ending mid-word and reading like the whole message.
+    const raw = scrubCredential(e && (e.stderr || e.message)).trim();
+    const stderr = truncateLoudly(raw, STDERR_MAX);
+    throw err('GIT_FAILED', {
+      git_step: step || (args && args[0]) || null,
+      stderr,
+      stderr_bytes: raw.length,
+      // The exit code distinguishes failure SHAPES that read identically in prose —
+      // 128 (git said no) vs 1 (a ref was rejected) vs null (killed by the timeout).
+      exit_code: (e && typeof e.code === 'number') ? e.code : null,
+      timed_out: !!(e && e.killed),
+    });
   }
 }
 
@@ -456,7 +494,14 @@ async function openOrFindPullRequest({ branch, title, body }, deps = {}) {
   });
   if (!createRes.ok) {
     const detail = await createRes.text().catch(() => '');
-    throw err('PR_CREATE_FAILED', { status: createRes.status, detail: detail.slice(0, 300) });
+    // Same reasoning as GIT_FAILED's stderr (task 1003222): GitHub's refusal body
+    // names the actual rule that refused ('No commits between main and X', a
+    // protected-branch rule, a validation error naming the field) and a 300-char
+    // clip regularly cut it off. Scrubbed, because a body can echo a request header.
+    throw err('PR_CREATE_FAILED', {
+      status: createRes.status,
+      detail: truncateLoudly(scrubCredential(detail), STDERR_MAX),
+    });
   }
   const pr = await createRes.json();
   return { number: pr.number, url: pr.html_url, node_id: pr.node_id };
@@ -1360,6 +1405,8 @@ module.exports = {
   prReferencesTask,
   findTaskPullRequest,
   scrubCredential,
+  truncateLoudly,   // task 1003222 — exported so its behaviour is testable, not just its effect
+  STDERR_MAX,
   isAncestorOfDefaultBranch,
   resolveToken,
   getInstallationToken,

package/modules/lifecycle/routes/tasks.js

@@ -979,7 +979,12 @@ module.exports = function buildTasksRouter() {
       if (e.code === 'NO_REPO_INFO') return res.fail('no_repo_info', 500);
       if (e.code === 'PUSH_UNCONFIGURED') return res.fail('push_unconfigured', { status: 503, message: PUSH_UNCONFIGURED_MSG });
       if (e.code === 'APP_NOT_INSTALLED') return res.fail('push_unconfigured', { status: 503, message: appNotInstalledMessage(e) });
-      if (e.code === 'PR_CREATE_FAILED') return res.fail('pr_create_failed', 502, { detail: e.detail });
+      // The GitHub HTTP status travels WITH the body (task 1003222). 422 ('no commits
+      // between'), 403 (a protected-branch rule) and 404 (the App cannot see the repo)
+      // are three different remedies, and the body alone does not always separate them.
+      if (e.code === 'PR_CREATE_FAILED') {
+        return res.fail('pr_create_failed', 502, { detail: e.detail, github_status: e.status ?? null });
+      }
       // task 1547: GIT_FAILED now carries WHICH git step failed + the credential-
       // scrubbed stderr (github-push.defaultExec). Log both so the next push outage
       // is a one-line diagnosis, not a multi-hour opaque-`publish_failed` mystery
@@ -990,7 +995,22 @@ module.exports = function buildTasksRouter() {
         e.git_step ? `step=${e.git_step}` : '',
         e.stderr ? `stderr=${e.stderr}` : ''
       );
-      return res.fail('publish_failed', 500, { ...(e.git_step ? { step: e.git_step } : {}), ...(e.stderr ? { reason: String(e.stderr).slice(0, 200) } : {}) });
+      // NO SECOND TRUNCATION (task 1003222). This line used to clip the already-
+      // shortened stderr to 200 chars, so the builder got 'error: failed' — cut
+      // mid-word, naming neither cause nor remedy — while the real remote message sat
+      // in a log they could not reach. A publish failure must be diagnosable from
+      // where the builder is STANDING; that is the whole point of the task.
+      //
+      // `reason` keeps its name and position so existing readers (ship.js prints it)
+      // keep working; it is simply no longer amputated. Everything here is already
+      // credential-scrubbed at the throw site by github-push.scrubCredential.
+      return res.fail('publish_failed', 500, {
+        ...(e.git_step ? { step: e.git_step } : {}),
+        ...(e.stderr ? { reason: e.stderr } : {}),
+        ...(e.stderr_bytes != null ? { reason_bytes: e.stderr_bytes } : {}),
+        ...(e.exit_code != null ? { git_exit_code: e.exit_code } : {}),
+        ...(e.timed_out ? { timed_out: true } : {}),
+      });
     } finally {
       try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch (_) { /* best-effort */ }
     }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.348",
+  "version": "1.19.349",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.348",
+      "version": "1.19.349",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.348",
+  "version": "1.19.349",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-land.js

@@ -89,12 +89,23 @@ function formatPublishFailure(data, status, branch, opts = {}) {
   const envelopeDetails = (data && data.error && typeof data.error === 'object' && data.error.details) || null;
   const details = envelopeDetails || data || {};
   const label = message || code || (data && data.message) || `HTTP ${status}`;
-  // git stderr is multi-line; this is embedded mid-sentence in one log line.
+  // Flattened ONLY for the matchers below and the one-line summary. The readable
+  // copy is printed verbatim underneath (task 1003222): the server no longer clips
+  // stderr, and git's useful line is the LAST one, so collapsing a 20-line push
+  // failure into a single run-on sentence hides the very thing that was un-hidden.
   const reason = details.reason ? String(details.reason).replace(/\s+/g, ' ').trim() : '';
   const parts = [];
   if (details.step) parts.push(`step: ${details.step}`);
-  if (reason) parts.push(`reason: ${reason}`);
+  if (details.git_exit_code != null) parts.push(`git exit ${details.git_exit_code}`);
+  if (details.github_status != null) parts.push(`GitHub HTTP ${details.github_status}`);
+  if (details.timed_out) parts.push('TIMED OUT');
+  // The one-line summary stays short and scannable; the full text follows it.
+  if (reason) parts.push(`reason: ${reason.length > 200 ? `${reason.slice(0, 200)}…` : reason}`);
   let out = parts.length ? `${label} (${parts.join('; ')})` : label;
+
+  // ORDER MATTERS: summary, then the REMEDY, then the verbatim block last. The
+  // remedy is the actionable sentence and must not end up stranded below twenty
+  // lines of git chatter where it reads as a footnote to the quote.
   if (NON_FAST_FORWARD_RE.test(reason)) {
     out += opts.localHistoryRewritten === true
       ? ` — your LOCAL history was rewritten (a rebase or amend), so ${branch} is no longer a `
@@ -104,6 +115,17 @@ function formatPublishFailure(data, status, branch, opts = {}) {
       : ` — the server already moved ${branch}: fetch origin, reset onto origin/${branch}, `
         + 're-run the generators, and re-ship so the push fast-forwards.';
   }
+
+  // The untruncated remote message, verbatim and indented so it reads as a quotation
+  // rather than as more ship output. Only when it is multi-line — a single-line
+  // stderr is already fully present in the summary above, and repeating it is noise.
+  const full = details.reason ? String(details.reason).trimEnd() : '';
+  if (full && /\n/.test(full)) {
+    out += `\n\n  --- what the remote actually said ---\n${full.split('\n').map((l) => `  ${l}`).join('\n')}\n  --- end ---`;
+    if (details.reason_bytes != null && details.reason_bytes > full.length) {
+      out += `\n  (${details.reason_bytes} bytes at the server; the middle was omitted here)`;
+    }
+  }
   return out;
 }
 

package/src/module-api.js

@@ -1126,8 +1126,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.346 with no explicit bump. run 32802265337. (task 1002620)
 //   1.19.348 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.347 with no explicit bump. run 32802746363. (task 1002620)
+//   1.19.349 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.348 with no explicit bump. run 32803276871. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.348'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.349'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/ship_publish_error.mjs

@@ -99,7 +99,19 @@ test('a "fetch first" rejection names the branch and the reset-onto-origin remed
   assert.match(out, /reset/i, 'names the reset');
   assert.match(out, /generator/i, 'and the regenerate step before re-shipping');
   assert.match(out, /re-ship|fast-forward/i, 'and why: so the push fast-forwards');
-  assert.ok(!/\n/.test(out), 'multi-line git stderr is collapsed — this goes mid-sentence into one log line');
+  // CONTRACT CHANGED, task 1003222. This used to assert the OPPOSITE — that the
+  // whole thing collapsed to one line — which was right while the server clipped
+  // stderr to 200 chars, and wrong once it stopped. The summary line is still
+  // collapsed and scannable; the verbatim text is quoted BELOW it, because git puts
+  // the line that names the cause last and a one-line squash buries it.
+  const [summary] = out.split('\n');
+  assert.ok(!/\n/.test(summary), 'the SUMMARY is still one scannable line');
+  assert.match(summary, /reason:/, 'and still carries a reason inline');
+  assert.match(out, /what the remote actually said/, 'the untruncated stderr is quoted below');
+  assert.ok(
+    out.includes("error: failed to push some refs to 'github.com/org/repo.git'"),
+    'the remote message survives VERBATIM, on its own line — the whole point of the task',
+  );
 });
 
 test('the "non-fast-forward" wording triggers the same hint through the envelope', () => {
@@ -158,5 +170,77 @@ test('1003221 a non-NFF failure gains no hint from either flag', () => {
   }
 });
 
+
+// --- task 1003222: the remote's own words reach the builder ------------------
+//
+// The failure this closes: a builder saw `reason: error: failed` — clipped
+// mid-word by a 200-char slice on top of an earlier 500-char one — while the line
+// that named the cause (`remote: fatal error in commit_refs`) and the HTTP status
+// existed server-side only. That cost hours AND produced a wrong first diagnosis,
+// because the real message was never in the room.
+
+const LONG_STDERR = [
+  'To https://github.com/org/repo.git',
+  ' ! [remote rejected] b -> b (pre-receive hook declined)',
+  'error: failed to push some refs',
+  'remote: fatal error in commit_refs',   // git's useful line is LAST
+].join('\n');
+
+test('1003222 the LAST line survives — a head-truncation would have eaten it', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: LONG_STDERR });
+  assert.ok(
+    out.includes('remote: fatal error in commit_refs'),
+    'the cause git printed last must reach the builder',
+  );
+});
+
+test('1003222 the git exit code is reported — 128 and 1 are different remedies', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: 'boom', git_exit_code: 128 });
+  assert.match(out, /git exit 128/);
+});
+
+test('1003222 a GitHub HTTP status is reported when the API refused', () => {
+  const out = fmt({ error: 'pr_create_failed', github_status: 422, reason: 'No commits between main and b' });
+  assert.match(out, /GitHub HTTP 422/, '422 vs 403 vs 404 are three different fixes');
+});
+
+test('1003222 a timeout says so rather than looking like a rejection', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: 'killed', timed_out: true });
+  assert.match(out, /TIMED OUT/);
+});
+
+test('1003222 a single-line stderr is NOT repeated in a quote block', () => {
+  // It is already fully present in the summary; quoting it again is noise.
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: 'fatal: repository not found' });
+  assert.ok(!out.includes('what the remote actually said'), 'no block for a one-liner');
+  assert.match(out, /fatal: repository not found/);
+});
+
+test('1003222 an omitted middle is DECLARED, never silently clipped', () => {
+  const out = fmt({
+    error: 'publish_failed', step: 'push', reason: LONG_STDERR, reason_bytes: 99999,
+  });
+  assert.match(out, /99999 bytes at the server/, 'the reader is told text is missing');
+  assert.match(out, /omitted/);
+});
+
+test('1003222 the remedy precedes the quote block, not stranded under it', () => {
+  // The remedy is the actionable sentence. Below twenty lines of git chatter it
+  // reads as a footnote to the quotation and gets missed.
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: NON_FF_STDERR });
+  const remedy = out.indexOf('reset onto');
+  const quote = out.indexOf('what the remote actually said');
+  assert.ok(remedy > -1 && quote > -1, 'both present');
+  assert.ok(remedy < quote, 'remedy comes first');
+});
+
+test('1003222 nothing regressed for a failure carrying no stderr at all', () => {
+  const out = fmt({ error: 'publish_failed' });
+  assert.match(out, /publish_failed/);
+  assert.ok(!out.includes('what the remote actually said'));
+  assert.ok(!/undefined|null|\[object/.test(out), 'no placeholder leakage');
+});
+
+
 console.log(`ship_publish_error: ${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);
+process.exit(failed === 0 ? 0 : 1);