@bongos/core 1.19.62 → 1.19.63

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.62",
-  "core_contract": "1.19.62",
-  "source_commit": "81537ad6976770dfa5d0e9ff4aae44c6cc00be9f",
+  "core_version": "1.19.63",
+  "core_contract": "1.19.63",
+  "source_commit": "aecb337d2bcfb665111227e9aebaffa93f867699",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T01:12:59.066Z",
+  "built_at": "2026-08-12T01:29:46.616Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1532,
-  "tree_sha256": "d7adb6b51e99575f2dbed8932206114b763bc19d3d4b880f41b091710892920b",
+  "tree_sha256": "165231bc8a6ec61199f57070fc8267562e283cff9b5804d340d4f3b57cc98de2",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1377,7 +1377,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "01f8ff6aaa583d333b466f4d5cff849c09327653c33dcb3d82d60cc46f913cb8"
+      "sha256": "4b3ee1ce8445659a2660263cbbd9e2a903d010410b8ff8f89e2ed61ed54c6eab"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2557,7 +2557,7 @@
     {
       "path": "modules/dev-box/app/test/unit.mjs",
       "mode": "0000644",
-      "sha256": "6c209f446990af95d16995720a4746d4890ed77c77ebc13f22293404ea0d3eea"
+      "sha256": "104360917db40f8c6de633ed692b50417e5cf55f316d97fc4d29285046ff2324"
     },
     {
       "path": "modules/dev-box/box-access.js",
@@ -4037,12 +4037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "66f2a964b8eb493c69abb582b5f9be8dec20d49f31919abf3b55b8c11ffee2ed"
+      "sha256": "ec06847fa5cf675d4847afeed5612e44a0fd336694a1187d342a9f60ef957b09"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c49444a432fa927ad7487c52180f23cda72e18055cfbfbf22565d4cdca2825de"
+      "sha256": "612d7a22ac1c386d80c1c99b9aa52d70363c8a7a4f8ffb0598624c995578f060"
     },
     {
       "path": "public-docs/index.html",
@@ -5662,7 +5662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f2df366234508aa746d344fd4c28b3e09f4354c3510f585283518a0fde03b89c"
+      "sha256": "dfd274bc93670afa2368e0abea4d79ab5bd415996ed11c56a14cbafb449aafc6"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6742,7 +6742,7 @@
     {
       "path": "tests/infra_exec_paths.mjs",
       "mode": "0000644",
-      "sha256": "0437795b927bf68baa1e08ba2e52ca5b1799d41938402159ffb01f2f5bff01b2"
+      "sha256": "2b905b00f873e082340af0fb6b460a31053d8b6cb77db121c97ed73383088973"
     },
     {
       "path": "tests/init.mjs",

package/docs/file-map.md

@@ -226,6 +226,7 @@
 │   (public-status/ moved to modules/status-ui/public/ in BV1.R84 — see the modules/ block above)
 │   (public-builders/ moved to modules/hall-ui/public/ in BV1.R85 — the authenticated builders' hall; see the modules/ block above. It keeps its DEDICATED serving block in src/bongos/serve-internal.js: the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection — partitioned out of the generic web-surface loop. index.html=the hall dashboard; work/board/roadmap/goals/watch/harbor/gate/pair/settings/ranks/sessions/primer/diagrams/atlas pages; profile.html/profile.js=the public, shareable builder profile page (/profile?id=N — rank, works, credits, karma, achievements; task 1467); task.html/task.js=the task-detail page (/task/:id, task 751 — replaced the old #/task/N overlay); builders.js=the controller; dom-utils.js/hall-widgets.js=the widget+settings-panel registries.)
 │
+├── infra/                          ← ON-BOX scripts (task 1002699): the four reporter/heartbeat crons every dev box runs from its /workspace clone — box-heartbeat.sh (idle-sweep activity signal), box-report-version.sh (HEAD → POST /box/version), box-report-host-keys.sh (SSH host keys → POST /box/host-keys), box-report-terminal.sh (ttyd URL+credential → POST /box/terminal). Delivered by the workspace clone itself (modules/dev-box/box-access.js sparse scope includes infra/); crons self-installed by box-source-fetch.sh's per-tick bring-up. API base resolves GDS_BASE env → session-file api_base → skip (no hardcoded host in the neutral core).
 ├── devbox-app/                     ← OTB Dev Box — Electron menu-bar/tray switch for the builder's box (#904, ADR 0045; internal). SELF-CONTAINED: own package.json (never feeds the droplet's npm ci); built by .github/workflows/build-devbox-app.yml; published to the public releases repo per config/devbox-app.json; release recipe docs/recipes/devbox-app-release.md
 │   ├── src/                        ← main process: main.js (tray/window/IPC), brand.js (ADR 0004 — the ONE civ-name string), pairing.js, box-controller.js, gds-client.js, session-store.js (shares ~/.config/otb/gds-session.json with the CLI), ssh-setup.js (key 600 + known_hosts replace + managed-settings install w/ elevation), tray.js, preload.js
 │   ├── renderer/                   ← the panel UI (sandboxed; parchment theme)

package/modules/dev-box/app/test/unit.mjs

@@ -447,7 +447,7 @@ const ENDPOINTS = [
   ['claimableTasks', [], 'GET', '/api/gds/tasks/claimable', undefined],
   ['claimTask', ['1002388'], 'POST', '/api/gds/claims', { task_id: '1002388' }],
   ['boxScope', [], 'GET', '/api/gds/box/scope', undefined],
-  ['latestRelease', [], 'GET', '/downloads/devbox/latest.json', undefined],
+  ['latestRelease', [], 'GET', '/downloads/devbox/version', undefined],
 ];
 
 for (const [name, args, method, urlPath, body] of ENDPOINTS) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.62",
+  "version": "1.19.63",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.62",
+      "version": "1.19.63",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.62",
+  "version": "1.19.63",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -551,8 +551,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.60 with no explicit bump. run 31550061440. (task 1002620)
 //   1.19.62 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.61 with no explicit bump. run 31552833331. (task 1002620)
+//   1.19.63 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.62 with no explicit bump. run 31553743979. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.62'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.63'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/infra_exec_paths.mjs

@@ -31,18 +31,22 @@ function test(name, fn) {
   catch (err) { console.error(`  FAIL ${name}`); console.error('    ', err.message); failed++; }
 }
 
-// infra/ is HOST topology (publish-manifest.js PROTECTED_TOPOLOGY_EXCLUDE) — the neutral
-// core carries no units and no launcher (task 1002470). The checks that read the REAL tree
-// only mean something where that tree exists; the synthetic counterfactuals below always run.
-const HAS_INFRA = fs.existsSync(path.join(REPO, 'infra'));
+// Host topology means systemd UNITS, not the bare infra/ directory: the neutral core
+// carries no units and no launcher (task 1002470), but it DOES ship the four ON-BOX
+// reporter scripts in infra/ (task 1002699 — dev boxes clone this repo and wire them
+// as crons). So the real-tree unit lint is gated on *.service files being present,
+// and the launcher checks on core-node.sh — the synthetic counterfactuals always run.
+const INFRA_DIR = path.join(REPO, 'infra');
+const HAS_UNITS = fs.existsSync(INFRA_DIR) &&
+  fs.readdirSync(INFRA_DIR).some((f) => f.endsWith('.service'));
 const HAS_LAUNCHER = fs.existsSync(LAUNCHER);
 function hostTest(name, present, fn) {
-  if (!present) { console.log(`  skip ${name} — infra/ is absent in this checkout (host topology)`); return; }
+  if (!present) { console.log(`  skip ${name} — host topology (units/launcher) absent in this checkout`); return; }
   test(name, fn);
 }
 
 // ---- A. the lint is green on the real tree, and covers all 11 core-script units ----------------
-hostTest('lint-infra-exec: every core-script unit resolves in a consumer layout (publishable + present)', HAS_INFRA, () => {
+hostTest('lint-infra-exec: every core-script unit resolves in a consumer layout (publishable + present)', HAS_UNITS, () => {
   const r = lintInfraExec({ instanceRoot: REPO, coreRoot: REPO });
   assert.deepEqual(r.violations, [], `expected no violations, got: ${JSON.stringify(r.violations)}`);
   assert.ok(r.ok, 'lint should pass');