@bongos/core 1.19.385 → 1.19.386

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.385",
-  "core_contract": "1.19.385",
-  "source_commit": "3ed24b93e1f32dddb11c2a7a8bfaa9dda77a6f31",
+  "core_version": "1.19.386",
+  "core_contract": "1.19.386",
+  "source_commit": "c4899bbdaafe758d4521d6cb7944ad0117886573",
   "source_ref": "HEAD",
-  "built_at": "2026-08-27T21:33:52.536Z",
+  "built_at": "2026-08-27T21:58:01.005Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 338,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1963,
-  "tree_sha256": "405834d1bb0740aa2af5d7666798ac5219e895d514d397afb2c9c53953a431c8",
+  "tree_sha256": "856370a346d104a96b56e2fe9a3fefd50a50298a18e82c9afa13ef04387f6b7a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -5117,12 +5117,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "44a05f902a0d9063f2642c03a377c0c850dc4871e65c8b680c1190ca905bb3ec"
+      "sha256": "34407c6061bf61f8ec416b91f30da5ae1140c1e584e6721af64fbadadb60c9b0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "da469f97be509ad2739415aa339e06765bb4b3ea0c828620fb72391e76bb8862"
+      "sha256": "e49313249eef5acc6d3a2926aeb5725f0773d8d4300393a8ed57a3016a25a995"
     },
     {
       "path": "public-docs/index.html",
@@ -5782,7 +5782,7 @@
     {
       "path": "scripts/gds/docs-entropy.js",
       "mode": "0000644",
-      "sha256": "1a7cbe47158e4de63c1b788d6bb4f682584723a45c1824ab2ae3fbf92a54fbce"
+      "sha256": "e052ddf4d44c0d67512cb14e150cd309a9ab09414c557db8319a57fd8f0d6961"
     },
     {
       "path": "scripts/gds/doctor.js",
@@ -7032,7 +7032,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "63478a33b8d134113541ea814481eedb00ad89ac0b6777e87a1a6053b5718d72"
+      "sha256": "28a5f25668bc0297f421e200dbb658a5365db71874af4f8fd29c37016b4dcd29"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7862,7 +7862,7 @@
     {
       "path": "tests/docs_entropy.mjs",
       "mode": "0000644",
-      "sha256": "4d64164d45d6b81d706074b8394da4f3d0f7f8c5263a37a287a163d6a746a96b"
+      "sha256": "c3ef388bb7baacd4da4319fed82ceb5687e0d444cacce2ee84f9061dccbd1018"
     },
     {
       "path": "tests/docs_openapi_route.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.385",
+  "version": "1.19.386",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.385",
+      "version": "1.19.386",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.385",
+  "version": "1.19.386",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/docs-entropy.js

@@ -89,7 +89,17 @@ function parseFile(absPath) {
     return { headings: [], links: [], paragraphs: [] };
   }
 
-  const lines = raw.split('\n');
+  // Split on CRLF **or** LF, and drop a leading BOM (task 1003314). A Windows
+  // checkout gets CRLF from git, and splitting on a bare newline then leaves a
+  // trailing carriage return on every line — which the heading regex below
+  // cannot match, because `.` excludes line terminators and `$` is not in
+  // multiline mode. The file parsed as having ZERO headings, so every
+  // [text](file.md#anchor) pointing into it was reported as a broken anchor:
+  // doc_broken_anchors read 21 on Windows and 6 in CI, and the quality ratchet
+  // a Windows builder ran was pure noise. Same failure family as task 1002526's
+  // `git ls-files` quoting bug, one layer in — a gate that reports confidently
+  // and wrongly on one platform.
+  const lines = raw.replace(/^\uFEFF/, '').split(/\r?\n/);
   const headings = [];
   const links = [];
   const paragraphs = [];

package/src/module-api.js

@@ -1210,8 +1210,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.383 with no explicit bump. run 33116184189. (task 1002620)
 //   1.19.385 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.384 with no explicit bump. run 33118682829. (task 1002620)
+//   1.19.386 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.385 with no explicit bump. run 33120468176. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.385'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.386'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/docs_entropy.mjs

@@ -12,12 +12,14 @@ import { test } from 'node:test';
 import { execFileSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
+import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SCANNER = path.join(ROOT, 'scripts', 'gds', 'docs-entropy.js');
-const { collectMarkdownFiles } = require(SCANNER); // require.main-guarded → no scan on import
+const { collectMarkdownFiles, parseFile } = require(SCANNER); // require.main-guarded → no scan on import
 
 test('collectMarkdownFiles passes the glob as an argv array, never a shell string', () => {
   let seen = null;
@@ -53,3 +55,86 @@ test('the real scan enumerates the repo (the regression: it reported on 0 files)
   assert.ok(Number.isFinite(result.stale_links));
   assert.ok(Number.isFinite(result.broken_anchors));
 });
+
+// --- CRLF: a Windows checkout must parse exactly like a Linux one (task 1003314) ---
+//
+// The bug: parseFile() split on a bare '\n', so on a Windows checkout (git hands
+// out CRLF) every line kept a trailing '\r'. The heading regex /^(#{1,6})\s+(.+)$/
+// cannot match that — '.' excludes line terminators and '$' is not in multiline
+// mode — so EVERY CRLF file parsed as having zero headings, and every
+// [text](file.md#anchor) pointing into one was reported broken. doc_broken_anchors
+// read 21 on Windows against a baseline of 6, which made the quality ratchet
+// unusable there: a builder could not tell a real regression from platform noise.
+// Same family as the `git ls-files` quoting bug above — a gate that reports
+// confidently and WRONGLY on one platform only.
+
+const DOC_LINES = [
+  '# Title one',
+  '',
+  'Some prose with a [link](other.md#deep-anchor) in it.',
+  '',
+  '## 12. Session Update Protocol',
+  '',
+  'More prose.',
+];
+
+// Write `text` to a temp .md and parse it — parseFile takes a path, not a string.
+function parseString(text) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'docs-entropy-eol-'));
+  try {
+    const file = path.join(dir, 'sample.md');
+    fs.writeFileSync(file, text);
+    return parseFile(file);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+test('parseFile reads CRLF and LF identically — headings, slugs and links', () => {
+  const lf = parseString(DOC_LINES.join('\n'));
+  const crlf = parseString(DOC_LINES.join('\r\n'));
+
+  assert.equal(lf.headings.length, 2, 'fixture sanity: the LF form has two headings');
+  assert.deepEqual(
+    crlf.headings, lf.headings,
+    'a CRLF file must parse to the same headings as the LF one — before this fix it parsed to NONE',
+  );
+  assert.deepEqual(crlf.links.map((l) => l.href), lf.links.map((l) => l.href));
+});
+
+test('parseFile slugs a CRLF heading without a trailing carriage return', () => {
+  const slugs = parseString(DOC_LINES.join('\r\n')).headings.map((h) => h.slug);
+  assert.deepEqual(
+    slugs, ['title-one', '12-session-update-protocol'],
+    'the real anchor CLAUDE.md cites — a stray \\r in the slug is what made it report as "missing"',
+  );
+  assert.ok(!slugs.some((s) => s.includes('\r')), 'no slug carries a carriage return');
+});
+
+test('parseFile ignores a leading BOM, so a BOM file is not one heading short', () => {
+  // Same class, different byte: PowerShell writes UTF-8 WITH BOM by default
+  // (scripts/gds/CLAUDE.md warns about this for JSON bodies) and
+  // readFileSync('utf8') does not strip it — the BOM would sit before the first
+  // '#' and hide that heading.
+  const withBom = parseString('' + DOC_LINES.join('\r\n'));
+  assert.equal(withBom.headings.length, 2, 'the first heading survives a BOM');
+  assert.equal(withBom.headings[0].text, 'Title one');
+});
+
+test('the real scan on THIS checkout matches the CI baselines (the platform-parity proof)', () => {
+  // The point of the fix: the number a Windows builder sees is the number CI
+  // sees. Read the baseline rather than hardcoding it, so this stays honest as
+  // the ratchet legitimately tightens.
+  const stdout = execFileSync(process.execPath, [SCANNER, '--json'], {
+    cwd: ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024,
+  });
+  const result = JSON.parse(stdout);
+  const baselines = JSON.parse(
+    fs.readFileSync(path.join(ROOT, 'config', 'fitness-baselines.json'), 'utf8'),
+  ).metrics;
+  assert.ok(
+    result.broken_anchors <= baselines.doc_broken_anchors,
+    `broken_anchors ${result.broken_anchors} exceeds the baseline ${baselines.doc_broken_anchors} — `
+    + 'on a CRLF checkout this read 21, because every heading in every CRLF file went unparsed',
+  );
+});