@bongos/core 1.19.624 → 1.19.625

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.624",
-  "core_contract": "1.19.624",
-  "source_commit": "40ba55a6d7d145b717b36a0b316bfb4ed91c0fdd",
+  "core_version": "1.19.625",
+  "core_contract": "1.19.625",
+  "source_commit": "19a2b295b0d1a0755168ec39b249dc1a5f9b961e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-09T07:52:09.912Z",
+  "built_at": "2026-09-09T08:21:23.081Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 464,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2582,
-  "tree_sha256": "19b515bb213f54c2eafb50bebf229ada6ea886fdff0fa68d3ec68e30c3b93cbf",
+  "tree_sha256": "c6d6c5f0e0b67618fd3d94d6beb816506c9d15c480cc0dc0de0768b4b27cce23",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2757,7 +2757,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ddb02e1135abdcdd075c164efb243f1fae2c43d87543cd4466bf24efb7e020e7"
+      "sha256": "6979862e5d574d45a8cf53196775cb2f3c53e601e4f812e3bd69c3b3a9c7cc15"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7682,12 +7682,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b8c2a8fc2e6548e76390b5898057eb845926c9ab89b325670b94a5cc80f61e6f"
+      "sha256": "b1bf1316b6bf58eede860ae199233be76e1beb440d2cf7f4c96171e8f6347f05"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "33c03cfa6c4529cce4cd599ce51b14bf480f4d6f2d5e7e5d9d7a6033e404840e"
+      "sha256": "1e54c8559b66bcda15cbfb24e216bb5d3421a9e0c9d07f240c2414019288fe9a"
     },
     {
       "path": "public-docs/index.html",
@@ -9422,7 +9422,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f324be1b92aa674fa8bc1baff53336ad5ff21137864d9dd237c9ddc85f7ca273"
+      "sha256": "7a6f5a46c866658041e6299fe46188834184f510dd496edef5cb2f7b0c414088"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10032,7 +10032,7 @@
     {
       "path": "tests/cli_sessions.mjs",
       "mode": "0000644",
-      "sha256": "6ec406bf2bcbae261ab37ecaf820cfbe196c11007b0d8d3ee47cf21b6a3919ca"
+      "sha256": "ab1ee394c03eccadee0958ea38595e1f4e221146b593559e3474c9573d81ecf7"
     },
     {
       "path": "tests/cli_surface.mjs",

package/docs/module-api-changelog.md

@@ -1697,5 +1697,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.622 with no explicit bump. run 34323141703. (task 1002620)
   1.19.624 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.623 with no explicit bump. run 34326009063. (task 1002620)
+  1.19.625 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.624 with no explicit bump. run 34328603214. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.624",
+  "version": "1.19.625",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.624",
+      "version": "1.19.625",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.624",
+  "version": "1.19.625",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.624'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.625'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cli_sessions.mjs

@@ -28,16 +28,79 @@ const ic  = require(path.join(REPO_ROOT, 'src', 'instance-config.js'));
 const lib = require(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'));
 
 // SESSION_PATH is frozen at module load from os.homedir(), so anything touching the real save path
-// runs in a child with its own HOME.
+// runs in a child with its own home directory.
+//
+// SETTING `HOME` ALONE IS NOT ISOLATION, AND THE MISS COST REAL CREDENTIALS (task 1003760).
+// On Windows os.homedir() reads USERPROFILE and never consults HOME, so the original
+// `env: { ...process.env, HOME: home }` isolated nothing there: every child below wrote
+// its fixtures into the developer's ACTUAL ~/.config/<instance>/, overwriting the live
+// CLI session with `token:'TOKEN-A', api_base:'https://a.example.com'` and leaving
+// a.example.com.json / b.example.com.json / broken.json in the real session store. The
+// owner had to re-issue a CLI token to recover, and because a claim is bound to the
+// session that created it, the re-auth then orphaned an in-flight claim too.
+//
+// CI is Linux, where HOME *is* honoured — so this can never go red there. Two layers,
+// because the platform list is not knowable in advance:
+//   1. Override every variable a platform might read (USERPROFILE is the Windows one;
+//      HOMEDRIVE/HOMEPATH are the legacy fallback os.homedir() tries next).
+//   2. FAIL CLOSED IN THE CHILD: prove os.homedir() actually landed in the sandbox
+//      BEFORE running any body, and abort if it did not. A future platform that reads
+//      some third variable then fails this test loudly instead of silently eating the
+//      developer's credentials — which is the only outcome that is acceptable for a
+//      test whose whole job is writing to a session store.
+// THE AUDIT THIS FIX OWED, RECORDED HERE RATHER THAN IN A SHIP NOTE. `grep -rn "HOME:"
+// tests/ scripts/` at the time of the fix (task 1003760) found the pattern in ten files.
+// Three already override the Windows variable and are correct: tests/memory_pull.mjs:438,
+// tests/redteam_patrol.mjs:123, tests/setup_device_flow_fallback.mjs:130 — so the
+// convention existed and THIS file simply missed it. Two still set HOME alone and can go
+// FALSE-GREEN on Windows, tracked as task 1003763: tests/cli_package.mjs:140+149 (whose own
+// comment says the temp HOME exists "so a real session file on this machine cannot make a
+// verb look healthier than it is" — on Windows it can) and tests/cli_surface.mjs:174 (which
+// points HOME at a nonexistent dir to simulate "no session", and on Windows sees the real
+// one). Neither DESTROYS anything — this file was the only one writing a session store — so
+// they were filed rather than folded in. Two uses are legitimately HOME-only and must stay:
+// tests/scrubber_corpus.mjs:228 uses HOME:'/root' as corpus DATA, and
+// tests/lib_sh_resolution.mjs exercises POSIX shell resolution where HOME is the subject.
+// They are why closing this class needs an allowlist, not a blanket rule (1003763).
+//
+// Also done off-repo when this landed, and unverifiable from a diff, so stated plainly: the
+// three fixture files this bug left in the REAL session store — a.example.com.json,
+// b.example.com.json, broken.json under ~/.config/<instance>/instances/ — were deleted, and
+// the live session + auth were re-verified afterwards.
+//
+// KNOWN GAP, deliberately left: on Windows this suite now asserts no permission-tightness
+// property at all (see the owner-only test below). NTFS has no POSIX triad, so the real
+// property is the per-user profile ACL; an icacls-style assertion would restore the signal
+// and does not exist here.
+function sandboxEnv(home) {
+  const { root } = path.parse(home);
+  return {
+    ...process.env,
+    HOME: home,
+    USERPROFILE: home,                          // Windows: what os.homedir() actually reads
+    HOMEDRIVE: root.replace(/[\\/]+$/, ''),     // legacy Windows fallback pair
+    HOMEPATH: home.slice(root.length - 1) || '\\',
+  };
+}
+
 function inSandbox(body) {
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-sess-'));
   try {
     const code = `const R=${JSON.stringify(REPO_ROOT)};
+      const SANDBOX=${JSON.stringify(home)};
+      const os=require('node:os');
+      // Layer 2: refuse to touch a session store outside the sandbox. Runs before the
+      // requires below so not even a module-load side effect can reach the real home.
+      if (os.homedir() !== SANDBOX) {
+        console.error('ERR sandbox-escape: os.homedir()=' + os.homedir() + ' but the sandbox is ' + SANDBOX
+          + ' — this platform does not take the home override, and writing here would clobber the real session store.');
+        process.exit(2);
+      }
       const lib=require(R+'/scripts/gds/cli-lib.js');
       const ic=require(R+'/src/instance-config.js');
       const fs=require('node:fs'), path=require('node:path');
       (async()=>{ ${body} })().catch((e)=>{ console.error('ERR '+e.message); process.exit(1); });`;
-    const r = spawnSync(process.execPath, ['-e', code], { encoding: 'utf8', env: { ...process.env, HOME: home } });
+    const r = spawnSync(process.execPath, ['-e', code], { encoding: 'utf8', env: sandboxEnv(home) });
     return { home, out: `${r.stdout || ''}${r.stderr || ''}`, status: r.status };
   } finally {
     fs.rmSync(home, { recursive: true, force: true });
@@ -78,6 +141,36 @@ test('the store anchor is FIXED, not brand-derived — that is the whole fix', (
   assert.ok(!/configHome|configDirName|safeBrand/.test(fn), `sessionStoreDir must not read the brand:\n${fn}`);
 });
 
+// ── 1b. The sandbox is really a sandbox ─────────────────────────────────────────────────────
+//
+// These guard the guard (task 1003760). Every test below writes to a session store, so if
+// the isolation is a no-op they write to the DEVELOPER'S store — which is exactly what
+// happened on Windows, where os.homedir() reads USERPROFILE and the original helper set
+// only HOME. A test suite that can delete credentials must prove it cannot before it runs.
+
+test('the sandbox actually relocates os.homedir() — on THIS platform', () => {
+  const { out, status, home } = inSandbox(`console.log(JSON.stringify({ h: require('node:os').homedir() }));`);
+  assert.equal(status, 0, `sandbox child failed: ${out}`);
+  const { h } = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(h, home,
+    'os.homedir() inside the sandbox must BE the sandbox — otherwise every test here writes to the real session store');
+});
+
+test('a session store path resolved inside the sandbox stays inside it', () => {
+  const { out, status, home } = inSandbox(`console.log(JSON.stringify({ p: ic.configPath('gds-session.json'), d: lib.sessionStoreDir() }));`);
+  assert.equal(status, 0, `sandbox child failed: ${out}`);
+  const { p, d } = JSON.parse(out.trim().split('\n').pop());
+  assert.ok(p.startsWith(home), `the active session pointer resolved OUTSIDE the sandbox: ${p}`);
+  assert.ok(d.startsWith(home), `the session store dir resolved OUTSIDE the sandbox: ${d}`);
+});
+
+test('sandboxEnv overrides every home variable a platform might read', () => {
+  const env = sandboxEnv(path.join(os.tmpdir(), 'probe-home'));
+  assert.equal(env.HOME, path.join(os.tmpdir(), 'probe-home'));
+  assert.equal(env.USERPROFILE, env.HOME, 'USERPROFILE is the one Windows reads — the original miss');
+  assert.ok('HOMEDRIVE' in env && 'HOMEPATH' in env, 'the legacy Windows fallback pair must be set too');
+});
+
 // ── 2. A login never destroys another instance's session ────────────────────────────────────
 
 test('signing into a second instance PRESERVES the first — including one written before the store existed', () => {
@@ -127,13 +220,25 @@ test('re-saving the SAME instance is idempotent and files nothing extra', () =>
   assert.equal(r.token, 'T2');
 });
 
+// POSIX MODE BITS DO NOT EXIST ON WINDOWS, so this assertion could never pass there
+// (task 1003760). NTFS has no owner/group/other triad: Node reports 0666 for any
+// writable file and 0444 for a read-only one, and chmod(0o600) is silently a no-op —
+// measured on win32, both before and after an explicit chmod. Asserting '600' there
+// made the unit suite permanently red on every Windows checkout, which is the exact
+// harm task 1003754 names: a test that always fails is how a genuinely failing suite
+// stops being read. So the mode claim is asserted where the platform can express it,
+// and on Windows the file's EXISTENCE is still asserted — the security property has
+// to be met by NTFS ACLs (the per-user profile directory), not by a mode integer.
 test('session files are owner-only', () => {
   const { out } = inSandbox(`
     await lib.saveSession({ token:'T', api_base:'https://a.example.com', builder:{github_login:'x'} });
-    const f = fs.statSync(lib.sessionStorePath('https://a.example.com')).mode & 0o777;
+    const p = lib.sessionStorePath('https://a.example.com');
+    const f = fs.statSync(p).mode & 0o777;
     const d = fs.statSync(lib.sessionStoreDir()).mode & 0o777;
-    console.log(JSON.stringify({ file: f.toString(8), dir: d.toString(8) }));`);
+    console.log(JSON.stringify({ file: f.toString(8), dir: d.toString(8), exists: fs.existsSync(p) }));`);
   const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.exists, true, 'the session file must be written wherever we run');
+  if (process.platform === 'win32') return; // no POSIX triad to assert — see above
   assert.equal(r.file, '600', 'a session file holds a bearer token');
   assert.equal(r.dir, '700');
 });