@bongos/core 1.19.436 → 1.19.437

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.436",
-  "core_contract": "1.19.436",
-  "source_commit": "a1241e98d95626ad0f0e4fb92e0bf5570ebd1d19",
+  "core_version": "1.19.437",
+  "core_contract": "1.19.437",
+  "source_commit": "a19cfca1c4490ec543603d83defdefb98de8da80",
   "source_ref": "HEAD",
-  "built_at": "2026-08-30T02:36:42.560Z",
+  "built_at": "2026-08-30T03:08:23.716Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 369,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2135,
-  "tree_sha256": "fb1407f644a9e1ce28d901f454bb38108b7de3165d3aca0ae74533bf44192727",
+  "tree_sha256": "a3d39a99e32c492d5ae17ae906d89add5544bc902225fa056e0c6c8f9f4110ca",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1997,7 +1997,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8261227744e98ae0628e0f819b9df602e3f7417ccc23b1753f6314a74ac3b9ce"
+      "sha256": "eb14f5a0f47e80dfc687ef5193e73de5da6d937a90e88ad71bb4e2e6d70c2ad3"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5607,12 +5607,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6a868844044c8ad9bb4914949f7787e746f9e88fc03c2517a10a3aa3c31f0962"
+      "sha256": "38ae27226a931dea4012fd645931624e0592a047c14350cfd0c5252b2230c0d6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "185654794f0cbca9357dd5804fb45bf89fed4d8c358b2e6b0ffab14f1c2806f7"
+      "sha256": "54a547f0c6490348fe2695d83d7a0639fd9c583a0472bc3974db590ee23e1434"
     },
     {
       "path": "public-docs/index.html",
@@ -7747,7 +7747,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "61dda9cd35bcb286dd5573c96baded0e1c651945c7249113131f9b50e7f767f0"
+      "sha256": "0537028fe74fccf01b238c487a133a416cedfcdceba1d212c4259f50101c6014"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10472,7 +10472,7 @@
     {
       "path": "tests/stop_refcheck.mjs",
       "mode": "0000644",
-      "sha256": "2ddc5ada648e7eabb41d3ae0afd39f885f3840c8ec14483f83330e8eade11330"
+      "sha256": "a95e75e1cd3fe6cb6d48a8a082a8d2339eaae8589e5091fe83d88e6f106cc717"
     },
     {
       "path": "tests/strand_watch.mjs",

package/docs/module-api-changelog.md

@@ -1309,5 +1309,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.434 with no explicit bump. run 33286790214. (task 1002620)
   1.19.436 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.435 with no explicit bump. run 33288364716. (task 1002620)
+  1.19.437 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.436 with no explicit bump. run 33289560561. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.436",
+  "version": "1.19.437",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.436",
+      "version": "1.19.437",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.436",
+  "version": "1.19.437",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.436'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.437'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/stop_refcheck.mjs

@@ -141,5 +141,61 @@ t('lastAssistantText returns the final assistant text, skipping tool_use blocks'
   }
 });
 
+// ---- the process contract, spawned like the harness does (task 1003432) ----
+// The hook used to abort on Windows at turn end (libuv UV_HANDLE_CLOSING) because
+// process.exit() raced fetch()'s socket teardown. These run the real file: exit
+// code + stdout are the interface, and each case also proves the process ended on
+// its own (no signal / no timeout) — a hang or an abort is the regression.
+// Offline: OTB_REFIDS supplies the allow-list, so no network, no cache.
+import { spawnSync } from 'node:child_process';
+const HOOK = require.resolve('../.claude/hooks/stop-refcheck.js'); // same file the guard above required
+const SPAWN_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'refcheck-spawn-'));
+function spawnTranscript(text) {
+  const p = path.join(SPAWN_DIR, `t-${Math.random().toString(36).slice(2)}.jsonl`);
+  fs.writeFileSync(p, JSON.stringify({ type: 'assistant', message: { content: [{ type: 'text', text }] } }) + '\n');
+  return p;
+}
+function spawnHook(payload) {
+  const r = spawnSync(process.execPath, [HOOK], {
+    input: typeof payload === 'string' ? payload : JSON.stringify(payload),
+    encoding: 'utf8',
+    timeout: 8000,
+    env: { ...process.env, OTB_REFIDS: '1,2,3' },
+  });
+  assert.equal(r.signal, null, `hook must exit on its own, not be killed: ${r.stderr}`);
+  assert.ok(!/Assertion failed/.test(r.stderr || ''), `no libuv abort on teardown: ${r.stderr}`);
+  return r;
+}
+
+t('spawned: no bare ref → exit 0, no output, clean teardown', () => {
+  const r = spawnHook({ transcript_path: spawnTranscript('shipped task 1003365 cleanly'), stop_hook_active: false });
+  assert.equal(r.status, 0);
+  assert.equal(r.stdout.trim(), '');
+});
+
+t('spawned: an allow-listed bare ref → the block decision on stdout, exit 0', () => {
+  const r = spawnHook({ transcript_path: spawnTranscript('see #2 for details'), stop_hook_active: false });
+  assert.equal(r.status, 0);
+  const out = JSON.parse(r.stdout);
+  assert.equal(out.decision, 'block');
+  assert.ok(out.reason.includes('#2'));
+});
+
+t('spawned: stop_hook_active → exit 0 (never loops the re-emit)', () => {
+  const r = spawnHook({ transcript_path: spawnTranscript('see #2'), stop_hook_active: true });
+  assert.equal(r.status, 0);
+  assert.equal(r.stdout.trim(), '');
+});
+
+t('spawned: malformed / empty stdin or a missing transcript → exit 0 (fail open)', () => {
+  for (const payload of ['', '{not json', JSON.stringify({ transcript_path: path.join(SPAWN_DIR, 'nope.jsonl') })]) {
+    const r = spawnHook(payload);
+    assert.equal(r.status, 0, `payload ${JSON.stringify(payload)}`);
+    assert.equal(r.stdout.trim(), '');
+  }
+});
+
+fs.rmSync(SPAWN_DIR, { recursive: true, force: true });
+
 console.log(`\nstop_refcheck: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);