@bongos/core 1.19.351 → 1.19.352

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.351",
-  "core_contract": "1.19.351",
-  "source_commit": "a1a7446c35da856e17ae920f2d2e2a446320edb6",
+  "core_version": "1.19.352",
+  "core_contract": "1.19.352",
+  "source_commit": "e9a9e6873568180427946951f116e153cdef056f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T12:53:45.200Z",
+  "built_at": "2026-08-25T13:00:42.177Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 329,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1857,
-  "tree_sha256": "fef03d4bf7a70641e028393447ebffd7ca615173e976f25945a0f2846cb9f791",
+  "tree_sha256": "0a7c5bcf1b690464bce9877959778b5f611f54fedb8a6c7b9c51459d47ad7a04",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4787,12 +4787,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "782cf5fe234b13ce532d23dff2d26511364e0671fc4a706e828bb69a1aa747e5"
+      "sha256": "a82b85a09d4f6e7259d1f11a8468e50b82a94a346f7cada1a1c63e09217d4a81"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ffa5d64cebc96b2aa32b1e925ec8d128854b565fde7853b1dd6a1a40ae24f1ff"
+      "sha256": "f371019e624fd7befd3ef764ae4cac6d7f98dc8ba3058a2ed552f361e48c5568"
     },
     {
       "path": "public-docs/index.html",
@@ -6622,7 +6622,7 @@
     {
       "path": "src/bongos/stealth-gate.js",
       "mode": "0000644",
-      "sha256": "6ea72c90380663fac7ece7d97cd628792f3d68a2969a502c59addfcb83c2bcb4"
+      "sha256": "a1b771c103e332b93978e80f16760f80f7ab0260157db31c47d4655d69977344"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -6652,7 +6652,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "227d48d264188e540dda1fb674d6fb282d8eafd3db3d3d876ef075c0690029fa"
+      "sha256": "7433ae86603ef217160393fd3b36bb847092f0c040473a5bba43a21c14444be1"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9112,7 +9112,7 @@
     {
       "path": "tests/stealth_gate.mjs",
       "mode": "0000644",
-      "sha256": "c4deafe658457e9f3c17a99f6ab2435e1b1c4d42d74d77304ba792458562e771"
+      "sha256": "bb264253e2a9c233734cf9273928db203f8f441c4e7a53f5f9ae5ea0477e20e3"
     },
     {
       "path": "tests/stop_refcheck.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.351",
+  "version": "1.19.352",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.351",
+      "version": "1.19.352",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.351",
+  "version": "1.19.352",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/stealth-gate.js

@@ -107,11 +107,30 @@ function isExempt(path) {
   return EXEMPT.some((re) => re.test(path));
 }
 
+// The path the visitor knocked on, carried through the form so the password
+// lands them where they were going instead of on '/' (task 1003241). RELATIVE
+// PATHS ONLY: one leading slash, no '//' (protocol-relative), no backslash
+// (browsers read '/\evil' as '//evil'), no control bytes, not the gate's own
+// path — anything else is null and the redirect falls back to '/'. The same
+// shape as the relative branch of auth.js's safeReturnTo, kept local because
+// the gate mounts ahead of every router and loads nothing it does not need.
+function relativeReturn(raw) {
+  if (typeof raw !== 'string' || !raw.length || raw.length > 512) return null;
+  if (!raw.startsWith('/') || raw.startsWith('//') || raw.includes('\\')) return null;
+  if (/[\x00-\x1f\x7f]/.test(raw)) return null;
+  if (raw === '/' || raw.startsWith(SUBMIT_PATH)) return null;
+  return raw;
+}
+
+function escAttr(s) {
+  return String(s).replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
 // The form. Self-contained and token-free on purpose: it is served BEFORE the
 // visitor is allowed to see anything, so it must not pull the branding bundle,
 // the stylesheet, or any other asset that would leak the design of an
 // unannounced product to whoever knocks.
-function formHtml({ productName, wrong }) {
+function formHtml({ productName, wrong, returnTo }) {
   const name = String(productName || 'This instance').replace(/[<>&"]/g, '');
   return `<!doctype html><html lang="en"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
@@ -144,6 +163,7 @@ button{padding:11px 20px;border:0;border-radius:999px;background:#ce4806;color:#
 <h1>${name}</h1>
 <p>Not open to the world yet. Enter the password to have a look.</p>
 <form method="POST" action="${SUBMIT_PATH}">
+  ${returnTo ? `<input type="hidden" name="return" value="${escAttr(returnTo)}">` : ''}
   <input type="password" name="password" placeholder="Password" aria-label="Password" autofocus required>
   <button type="submit">Enter</button>
 </form>
@@ -175,8 +195,10 @@ function stealthGate() {
         const want = password();
         const ok = given.length === want.length
           && crypto.timingSafeEqual(Buffer.from(given), Buffer.from(want));
+        // re-validated on the way back: the field is visitor-supplied
+        const returnTo = relativeReturn(params.get('return'));
         if (!ok) {
-          return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: true }));
+          return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: true, returnTo }));
         }
         res.cookie(COOKIE, expectedToken(), {
           httpOnly: true,
@@ -186,7 +208,7 @@ function stealthGate() {
           ...domainOpts(req),
           // no maxAge/expires — a SESSION cookie, by the owner's choice
         });
-        res.redirect(303, '/');
+        res.redirect(303, returnTo || '/');
       });
       return undefined;
     }
@@ -195,8 +217,11 @@ function stealthGate() {
     if (tokenMatches(readCookie(req, COOKIE))) return next();
 
     // 401 rather than 200: this is an unauthenticated request being refused, and
-    // a crawler that ignores the noindex should still be told so.
-    return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: false }));
+    // a crawler that ignores the noindex should still be told so. A GET's own
+    // path rides the form so the password lands the visitor back on it; any
+    // other method has nothing safe to replay as a GET.
+    const returnTo = (req.method === 'GET' || req.method === 'HEAD') ? relativeReturn(req.originalUrl) : null;
+    return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: false, returnTo }));
   };
 }
 

package/src/module-api.js

@@ -1132,8 +1132,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.349 with no explicit bump. run 32810944115. (task 1002620)
 //   1.19.351 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.350 with no explicit bump. run 32850120472. (task 1002620)
+//   1.19.352 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.351 with no explicit bump. run 32850767673. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.351'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.352'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/stealth_gate.mjs

@@ -135,6 +135,71 @@ test('a wrong password is refused and says so', async () => {
   assert.ok(!String(res.headers['set-cookie'] || '').includes(gate.COOKIE), 'no cookie on failure');
 });
 
+/* ── the deep link survives the password (task 1003241) ── */
+const unlock = (fields) => request(gate.SUBMIT_PATH, {
+  method: 'POST',
+  body: new URLSearchParams({ password: PASSWORD, ...fields }).toString(),
+});
+
+test('the form carries the path the visitor knocked on, and the password lands them there', async () => {
+  // the pre-UAT walk found a stranger who typed /create landing on the front
+  // door after the password — the deep link rides the form, attribute-escaped
+  const knock = await request('/projects?view=new&repos=1');
+  assert.equal(knock.status, 401);
+  assert.match(knock.body, /<input type="hidden" name="return" value="\/projects\?view=new&amp;repos=1">/);
+  const res = await unlock({ return: '/projects?view=new&repos=1' });
+  assert.equal(res.status, 303);
+  assert.equal(res.headers.location, '/projects?view=new&repos=1');
+  assert.match(String(res.headers['set-cookie'] || ''), new RegExp(gate.COOKIE), 'the cookie still lands');
+});
+
+test('the front door carries no return field, and a bare password still lands on /', async () => {
+  const knock = await request('/');
+  assert.doesNotMatch(knock.body, /name="return"/);
+  const res = await unlock({});
+  assert.equal(res.status, 303);
+  assert.equal(res.headers.location, '/');
+});
+
+test('a wrong password keeps the deep link for the next try', async () => {
+  const res = await request(gate.SUBMIT_PATH, {
+    method: 'POST',
+    body: new URLSearchParams({ password: 'not-it', return: '/create' }).toString(),
+  });
+  assert.equal(res.status, 401);
+  assert.match(res.body, /name="return" value="\/create"/);
+});
+
+test('the return target is relative-path-only — never an absolute or off-site redirect', async () => {
+  const bad = [
+    'https://evil.example/',            // absolute, even https
+    '//evil.example',                   // protocol-relative
+    '/\\evil.example',                  // browsers read the backslash as a slash
+    'javascript:alert(1)',
+    '/ok\r\nSet-Cookie: x=1',           // header injection
+    '/' + 'a'.repeat(600),              // oversize
+    gate.SUBMIT_PATH + '?again',        // the gate's own path would loop
+  ];
+  for (const r of bad) {
+    const res = await unlock({ return: r });
+    assert.equal(res.status, 303, `${JSON.stringify(r)} still opens the gate`);
+    assert.equal(res.headers.location, '/', `${JSON.stringify(r)} must fall back to /`);
+  }
+});
+
+test('a knock that is not a GET is not carried back', async () => {
+  const res = await request('/projects', { method: 'POST', body: 'x=1' });
+  assert.equal(res.status, 401);
+  assert.doesNotMatch(res.body, /name="return"/);
+});
+
+test('a hostile path is escaped in the form, never echoed raw', async () => {
+  const res = await request('/x?q="><script>alert(1)</script>');
+  assert.equal(res.status, 401);
+  assert.doesNotMatch(res.body, /<script/);
+  assert.match(res.body, /value="\/x\?q=&quot;&gt;&lt;script&gt;/);
+});
+
 test('a forged or stale cookie does not open it', async () => {
   for (const bad of ['x', 'deadbeef', gate.expectedToken().slice(0, -1) + '0']) {
     const res = await request('/', { cookie: `${gate.COOKIE}=${bad}` });