@bongos/core 1.19.437 → 1.19.438

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.437",
-  "core_contract": "1.19.437",
-  "source_commit": "a19cfca1c4490ec543603d83defdefb98de8da80",
+  "core_version": "1.19.438",
+  "core_contract": "1.19.438",
+  "source_commit": "c2a43c1cb58424038a4b4f8876d0d50640ffbb45",
   "source_ref": "HEAD",
-  "built_at": "2026-08-30T03:08:23.716Z",
+  "built_at": "2026-08-30T03:25:35.542Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 369,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1743,
+    "functional_verbatim": 1744,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2135,
-  "tree_sha256": "a3d39a99e32c492d5ae17ae906d89add5544bc902225fa056e0c6c8f9f4110ca",
+  "file_count": 2136,
+  "tree_sha256": "4a2e873477ef29bc7b68f35a86b59e85043e8b397c87b84e2a486930919d3d10",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1997,7 +1997,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "eb14f5a0f47e80dfc687ef5193e73de5da6d937a90e88ad71bb4e2e6d70c2ad3"
+      "sha256": "5eeb368487db6157e3ff6e729c0a0d193081e62934e5c2c2d69c7c56d901380b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5607,12 +5607,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "38ae27226a931dea4012fd645931624e0592a047c14350cfd0c5252b2230c0d6"
+      "sha256": "9825b36c3afc725b8d8b25b3b3cd5ddd882905327cac8741de44fbd249df4eef"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "54a547f0c6490348fe2695d83d7a0639fd9c583a0472bc3974db590ee23e1434"
+      "sha256": "f784ade5e8fe1d320fe0cec64c9913530c173dd78c9f2b3d7672620862c8cc50"
     },
     {
       "path": "public-docs/index.html",
@@ -7747,7 +7747,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0537028fe74fccf01b238c487a133a416cedfcdceba1d212c4259f50101c6014"
+      "sha256": "858a06eaac3220a29515fe2b6d1ffd3f457e55916517c203b677378b17db4ce0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9164,6 +9164,11 @@
       "mode": "0000644",
       "sha256": "ed1e14050ba219a52736c2cd70f4d4333a345fb0018211c85293a995c7f0aac7"
     },
+    {
+      "path": "tests/hooks_drain.mjs",
+      "mode": "0000644",
+      "sha256": "d616a075d7e48e2123c08a60b023aad2d2c1cc1bb4a73caa9b6e8189dda30e6f"
+    },
     {
       "path": "tests/host_topology_skips.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1311,5 +1311,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.435 with no explicit bump. run 33288364716. (task 1002620)
   1.19.437 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.436 with no explicit bump. run 33289560561. (task 1002620)
+  1.19.438 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.437 with no explicit bump. run 33290212472. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.437",
+  "version": "1.19.438",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.437",
+      "version": "1.19.438",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.437",
+  "version": "1.19.438",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.437'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.438'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hooks_drain.mjs

@@ -0,0 +1,58 @@
+// tests/hooks_drain.mjs — the hooks that talk to the API must exit by DRAINING, never
+// process.exit() (task 1003433; task 1003432 for the Stop hook). On Windows, exiting
+// while a pooled socket is mid-close aborts Node with libuv's UV_HANDLE_CLOSING
+// assertion — a red "hook error" line on every prompt. Each hook is spawned the way
+// the harness spawns it; the contract is: exits on its own, exit 0, no abort on stderr.
+//
+// Offline by construction: no session token in the env and a throwaway HOME, so every
+// hook takes its "not signed in" no-op path — the exit mechanics are what's under test.
+//
+// .claude/hooks/ is instance-materialized and package-excluded (PROTECTED_TOPOLOGY_EXCLUDE
+// in scripts/gds/publish-manifest.js), so a clean core checkout has no hooks: skip cleanly.
+//
+// Run:  node tests/hooks_drain.mjs
+
+import { strict as assert } from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HOOKS = ['recall-hints', 'rank-change-greeting', 'conductor'].map((n) => path.join(ROOT, '.claude', 'hooks', `${n}.js`));
+
+if (!HOOKS.every((p) => fs.existsSync(p))) {
+  console.log('hooks_drain: SKIP — .claude/hooks/ is not materialized in this checkout (package-excluded).');
+  process.exit(0);
+}
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const HOME = fs.mkdtempSync(path.join(os.tmpdir(), 'hooks-drain-'));
+const transcript = path.join(HOME, 't.jsonl');
+fs.writeFileSync(transcript, JSON.stringify({ type: 'assistant', message: { content: [{ type: 'text', text: 'hello' }] } }) + '\n');
+const payload = JSON.stringify({ session_id: 's1', transcript_path: transcript, cwd: ROOT, hook_event_name: 'UserPromptSubmit', prompt: 'status?' });
+
+const env = { ...process.env, HOME, USERPROFILE: HOME, CLAUDE_PROJECT_DIR: ROOT };
+for (const k of Object.keys(env)) if (/_API_BASE$|^OTB_|^CLOUDBONGOS_|^GDS_|^PMS_/.test(k)) delete env[k];
+
+for (const hook of HOOKS) {
+  t(`${path.basename(hook)} exits on its own with 0 and no libuv abort (x3)`, () => {
+    for (let i = 0; i < 3; i++) {
+      const r = spawnSync(process.execPath, [hook], { input: payload, encoding: 'utf8', timeout: 15000, env });
+      assert.equal(r.signal, null, `run ${i}: killed by ${r.signal} — did not drain`);
+      assert.equal(r.status, 0, `run ${i}: exit ${r.status}\n${r.stderr}`);
+      assert.ok(!/Assertion failed/.test(r.stderr || ''), `run ${i}: libuv abort on stderr:\n${r.stderr}`);
+    }
+  });
+}
+
+fs.rmSync(HOME, { recursive: true, force: true });
+console.log(`\nhooks_drain: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);