@bongos/core 1.19.51 → 1.19.52

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.51",
-  "core_contract": "1.19.51",
-  "source_commit": "fe0b1449ce7c972b972778e74945261c35565c48",
+  "core_version": "1.19.52",
+  "core_contract": "1.19.52",
+  "source_commit": "ce8e0d15694aed30b1640891c4256c96322a2a6f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T18:53:46.990Z",
+  "built_at": "2026-08-11T19:06:37.776Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1217,
+    "functional_verbatim": 1218,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1529,
-  "tree_sha256": "c3aec243f4a401c529edd9c426192e56b1264abfa615e29045ac5cf054e33d57",
+  "file_count": 1530,
+  "tree_sha256": "72953759b072de03029b81979095699aeb2d45b2363ba7047d8503457761956f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2502,7 +2502,7 @@
     {
       "path": "modules/dev-box/app/src/gds-client.js",
       "mode": "0000644",
-      "sha256": "845f51622803363dbc1229c325c4d6148087c756812e7e8e049ced7aa479f168"
+      "sha256": "323f5e71b7836dd1fb6c7710e1b2159dec6382df89a7c5d001b7e7cccd5aa46d"
     },
     {
       "path": "modules/dev-box/app/src/main.js",
@@ -4037,12 +4037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "43bd308850fdf28f3fa803c778af55a4a86e72edb62ccd8dc2d3297da95efbe2"
+      "sha256": "37bb9183f916ffafd19c5c88408f5f776bdb091afc46b1bfbad64669d642102f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a402f396d0bfd5b10f24685a15ac36f9022c182db018787fbdd96b296e26c5db"
+      "sha256": "80465cb4506affe5fc47c835df7a0f4f1634a0743c2de6d14f843f342d487c45"
     },
     {
       "path": "public-docs/index.html",
@@ -5632,7 +5632,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "25c52c06c03af400c94f04f2cda1aaab0c5e5486a084005b9a4e224f345a4871"
+      "sha256": "2f88796346b1c3a6dc49e25766b223fbf2d99e34b38b9a0f1e64a6fb9a59856d"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -5662,7 +5662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3c2f62e446506de3fa855989e8606aad486566e37eed47b61c3a18b835a404f4"
+      "sha256": "fc779475caf64dd09a7a3f952b4dadfcf2f123ca1a3d0ea9af20762b3de5e6c8"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6247,7 +6247,7 @@
     {
       "path": "tests/devbox_downloads.mjs",
       "mode": "0000644",
-      "sha256": "91950e7477f9fff30e361bc32def211e1cb3792fa098e9c839d5db1e1ba21d6a"
+      "sha256": "897fe6b114c612e132e6fa0b3c68f43b865c684c7653e73cf42db894a7e4dc94"
     },
     {
       "path": "tests/devbox_icons.mjs",
@@ -6264,6 +6264,11 @@
       "mode": "0000644",
       "sha256": "ac0a024d96ef40af52af8b94570447ad5f1556467b68380c1b45fd3419139ad6"
     },
+    {
+      "path": "tests/devbox_update_path.mjs",
+      "mode": "0000644",
+      "sha256": "b58e87eeca17053709a8e2bdcefd032060358cc85314d28bf816a92d465fdae8"
+    },
     {
       "path": "tests/device_flow_start.mjs",
       "mode": "0000644",

package/modules/dev-box/app/src/gds-client.js

@@ -82,8 +82,12 @@ function createClient({ getToken, getApiBase, fetchImpl } = {}) {
     claimableTasks: () => unwrap(gen('').request('GET', '/api/gds/tasks/claimable')),
     claimTask: (taskId) => unwrap(gen('').request('POST', '/api/gds/claims', { body: { task_id: taskId } })),
     boxScope: () => unwrap(gen('').request('GET', '/api/gds/box/scope')),
-    // update check (public static asset at the origin root, not under /api/gds)
-    latestRelease: () => unwrap(gen('').request('GET', '/downloads/devbox/latest.json')),
+    // update check (public route at the origin root, not under /api/gds).
+    // task 1002649: polls the EXTENSIONLESS /version twin, NOT latest.json — a
+    // front proxy with a file-matcher can eat *.json paths before Node (the
+    // live instance's pre-ADR-0152 vhost 404'd latest.json empty while this
+    // endpoint worked), and the updater only needs { version, assets } anyway.
+    latestRelease: () => unwrap(gen('').request('GET', '/downloads/devbox/version')),
   };
 }
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.51",
+  "version": "1.19.52",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.51",
+      "version": "1.19.52",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.51",
+  "version": "1.19.52",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -359,6 +359,38 @@ function isBuildersHost(req) {
 // Call this ONCE, right after app setup (trust proxy etc.) and BEFORE any
 // entrypoint-specific tail (the game static + themed 404 in server.js; the plain
 // 404 in platform-server.js).
+// The Dev Box download/manifest mini-router (#904, ADR 0045), extracted so the
+// ACTUAL route handlers are hermetically testable (tests/devbox_update_path.mjs
+// mounts them on a throwaway app — the docs_openapi_route pattern) instead of
+// only their pure builder. task 1002649: the manifest is served under BOTH
+// /latest.json and an extensionless /latest twin — a front proxy with a
+// file-matcher can eat *.json paths before Node (the live pre-ADR-0152 vhost
+// 404'd latest.json empty while extensionless siblings worked), so every
+// manifest consumer has a path that survives that class. Registration order
+// matters: the literal routes must precede the `:target` catch-all.
+function mountDevboxDownloads(app, devboxDownloads) {
+  const manifest = (_req, res) => {
+    // Short TTL: a release bump (config change + deploy) is visible within a
+    // minute, same posture as the hall's HTML.
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json(devboxDownloads.latestJson());
+  };
+  app.get('/downloads/devbox/latest.json', manifest);
+  app.get('/downloads/devbox/latest', manifest);
+  // #924: the lightweight update-check endpoint the Dev Box app polls + the hall
+  // /settings courtesy line reads.
+  app.get('/downloads/devbox/version', (_req, res) => {
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json(devboxDownloads.versionJson());
+  });
+  app.get('/downloads/devbox/:target', (req, res) => {
+    const url = devboxDownloads.redirectFor(req.params.target);
+    if (!url) return res.fail('unknown_target', 404, { targets: Object.keys(devboxDownloads.latestJson().assets) });
+    res.set('Cache-Control', 'public, max-age=60');
+    res.redirect(302, url);
+  });
+}
+
 function mountInternalSurfaces(app) {
   // Prometheus instrumentation (task #1680, V4.R28a). The counting middleware
   // mounts FIRST so it wraps every surface registered below (and, since
@@ -477,26 +509,7 @@ function mountInternalSurfaces(app) {
   // /builders/downloads/* and 404).
   const devboxCfg = tryLoadInstanceConfig('devbox-app.json');
   if (devboxCfg) {
-    const devboxDownloads = buildDevboxDownloads(devboxCfg);
-    app.get('/downloads/devbox/latest.json', (_req, res) => {
-      // Short TTL: a release bump (config change + deploy) is visible within a
-      // minute, same posture as the hall's HTML.
-      res.set('Cache-Control', 'public, max-age=60');
-      res.json(devboxDownloads.latestJson());
-    });
-    // #924: the lightweight update-check endpoint the Dev Box app polls + the hall
-    // /settings courtesy line reads. MUST be registered before the `:target` route
-    // below, or Express would treat "version" as a download target and 404 it.
-    app.get('/downloads/devbox/version', (_req, res) => {
-      res.set('Cache-Control', 'public, max-age=60');
-      res.json(devboxDownloads.versionJson());
-    });
-    app.get('/downloads/devbox/:target', (req, res) => {
-      const url = devboxDownloads.redirectFor(req.params.target);
-      if (!url) return res.fail('unknown_target', 404, { targets: Object.keys(devboxDownloads.latestJson().assets) });
-      res.set('Cache-Control', 'public, max-age=60');
-      res.redirect(302, url);
-    });
+    mountDevboxDownloads(app, buildDevboxDownloads(devboxCfg));
   }
 
   // Standalone `bongos` CLI downloads + the one-line installer (task 1248,
@@ -979,4 +992,4 @@ function mountInternalSurfaces(app) {
   return app;
 }
 
-module.exports = { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };
+module.exports = { mountInternalSurfaces, mountDevboxDownloads, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };

package/src/module-api.js

@@ -529,8 +529,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.49 with no explicit bump. run 31524280584. (task 1002620)
 //   1.19.51 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.50 with no explicit bump. run 31525032273. (task 1002620)
+//   1.19.52 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.51 with no explicit bump. run 31526131183. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.51'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.52'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/devbox_downloads.mjs

@@ -119,5 +119,22 @@ t('config/devbox-app.json parses, resolves every target, and aliases point at re
   }
 });
 
+console.log('update manifest (task 1002649 — the payload the devbox-app updater reads):');
+
+t('committed config yields a NON-EMPTY manifest — version + at least one asset in both shapes', () => {
+  // The live symptom behind task 1002649 was latest.json arriving as an empty
+  // body. The route is a pure function of this committed config, so pin here
+  // that the manifest can never be empty at the source.
+  const d = buildDevboxDownloads(committedConfig);
+  for (const shape of [d.latestJson(), d.versionJson()]) {
+    assert.match(shape.version, /^\d+\.\d+\.\d+$/, 'manifest carries a semver version');
+    assert.ok(Object.keys(shape.assets).length >= 1, 'manifest carries at least one asset');
+  }
+});
+
+// The client-path pin (extensionless /version, never .json) lives in
+// tests/devbox_update_path.mjs — NOT here — so it still runs on the neutral
+// core checkout where this file topology-skips (task 1002649).
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/devbox_update_path.mjs

@@ -0,0 +1,84 @@
+// tests/devbox_update_path.mjs — the devbox-app update-check path pin (task 1002649).
+//
+// Deliberately SEPARATE from tests/devbox_downloads.mjs: that file topology-
+// skips wherever config/devbox-app.json is absent (this neutral core checkout),
+// but this pin reads only the app client's SOURCE, so it must run everywhere —
+// including this repo's `unit` lane.
+//
+// Why the pin exists: a front proxy with a file-matcher can eat *.json paths
+// before they reach Node — the live pre-ADR-0152 vhost 404'd
+// /downloads/devbox/latest.json with an empty body while the extensionless
+// /downloads/devbox/version twin worked, silently breaking the app's update
+// check. The updater only needs { version, assets }, which /version carries.
+//
+// Run:  node --test tests/devbox_update_path.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const src = readFileSync(new URL('../modules/dev-box/app/src/gds-client.js', import.meta.url), 'utf8');
+
+test('latestRelease polls the extensionless /downloads/devbox/version, never a .json path', () => {
+  const line = src.split('\n').find((l) => l.includes('latestRelease:'));
+  assert.ok(line, 'gds-client exposes latestRelease');
+  assert.ok(line.includes("'/downloads/devbox/version'"), 'latestRelease polls /downloads/devbox/version');
+  assert.ok(!line.includes('latest.json'), 'latestRelease must not poll a .json-suffixed path');
+});
+
+// ---- The ACTUAL route handlers, over loopback (the docs_openapi_route ----
+// pattern). This is the layer the repo owns: the Express routes must serve a
+// NON-EMPTY manifest on all three paths and redirect targets. (The infra layer
+// above Node — the host's front proxy — cannot be pinned from a unit test;
+// that is blocker 1000105. These pins guarantee that when a request reaches
+// Node, the manifest is never empty.)
+const CFG = {
+  releases_repo: 'owner/devbox-releases',
+  version: '9.9.9',
+  assets: { 'win-x64': 'Setup-9.9.9-x64.exe', 'mac-arm64': 'App-9.9.9-arm64.dmg' },
+  aliases: { windows: 'win-x64', mac: 'mac-arm64' },
+};
+
+async function withDevboxServer(fn) {
+  const express = require('express');
+  const { mountDevboxDownloads } = require('../src/bongos/serve-internal.js');
+  const { buildDevboxDownloads } = require('../src/devbox-downloads.js');
+  const app = express();
+  mountDevboxDownloads(app, buildDevboxDownloads(CFG));
+  const server = await new Promise((resolve) => { const s = app.listen(0, () => resolve(s)); });
+  try {
+    await fn(`http://127.0.0.1:${server.address().port}`);
+  } finally {
+    await new Promise((r) => server.close(r));
+  }
+}
+
+test('latest.json and the extensionless /latest twin both serve the full non-empty manifest', async () => {
+  await withDevboxServer(async (base) => {
+    for (const p of ['/downloads/devbox/latest.json', '/downloads/devbox/latest']) {
+      const r = await fetch(base + p);
+      assert.equal(r.status, 200, `${p} must 200`);
+      assert.match(r.headers.get('content-type') || '', /application\/json/, `${p} content-type`);
+      const j = await r.json();
+      assert.equal(j.version, '9.9.9');
+      assert.ok(Object.keys(j.assets).length >= 1, `${p} manifest must carry assets — the task-1002649 empty-body class`);
+      assert.equal(j.assets['win-x64'].file, 'Setup-9.9.9-x64.exe');
+      assert.match(j.assets['win-x64'].url, /\/releases\/download\/v9\.9\.9\//);
+    }
+  });
+});
+
+test('/version serves the flat update-check payload; a target redirects 302', async () => {
+  await withDevboxServer(async (base) => {
+    const v = await fetch(base + '/downloads/devbox/version');
+    assert.equal(v.status, 200);
+    const j = await v.json();
+    assert.equal(j.version, '9.9.9');
+    assert.equal(typeof j.assets['win-x64'], 'string', 'flat {target: url} shape');
+    const r = await fetch(base + '/downloads/devbox/windows', { redirect: 'manual' });
+    assert.equal(r.status, 302);
+    assert.match(r.headers.get('location') || '', /Setup-9\.9\.9-x64\.exe$/);
+  });
+});