@bongos/core 1.19.694 → 1.19.695

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.694",
-  "core_contract": "1.19.694",
-  "source_commit": "7cd0b705f047458dfa2038bd842adee75333a643",
+  "core_version": "1.19.695",
+  "core_contract": "1.19.695",
+  "source_commit": "178cdaa548f0ea45deb347104acd63d6aeb20cc7",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T01:54:36.629Z",
+  "built_at": "2026-09-13T02:08:24.203Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2628,
-  "tree_sha256": "0ab80bfe776899e5734f702ca69263e38455dae234ba01b3d422d6ef131e6c49",
+  "tree_sha256": "2b4685b0549d24df433e75ac5aa8719b418ddfee7e86c70726b5bb5c994586a0",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "578d0d708917e956889cfbd990258b1cda804052474f07087d9af589f387425e"
+      "sha256": "e9a7dcf5d697f1051d5c54199c9b30b21b2e76f332c87bc7e8d9503318f842f5"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "929bc69d15f44bc6648df7b2f3a9e22d72501486ae2abb9b0491cfcfabbd6683"
+      "sha256": "5d78acccc55e18e1a0eb5b1c9345dede369578daff1162114ffc35f11c209999"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cc0356495a5cf8f4822c0e6efff4b17ef7a1dcd69da2f724a5089b99be71aea7"
+      "sha256": "952678094d2f65405c5195d793f8754b78113e2b489fc9171bff02dee8c9bd76"
     },
     {
       "path": "public-docs/index.html",
@@ -9147,7 +9147,7 @@
     {
       "path": "scripts/gds/worktree.js",
       "mode": "0000644",
-      "sha256": "849cd462b9c50866ca1582ed2156fb68ac76699c8270796d1daf6942c09713dc"
+      "sha256": "af95d7ae434d587dae654e24640163c44ac293edb11d2c0deb979b855701ac85"
     },
     {
       "path": "scripts/hall-preview/README.md",
@@ -9552,7 +9552,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "60f2d47936df6dee6b06ea525d1a6d397d563ed6ee3e052b566936b6e5515af8"
+      "sha256": "309fdfdb42698f3cdb53b167cffa0fbab10ae61904d6f331035edf35ef547047"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13147,7 +13147,7 @@
     {
       "path": "tests/worktree_helper.mjs",
       "mode": "0000644",
-      "sha256": "367e4c9a63bc8752b94d0fc7af171d34390034adc2a75c8ec15f00b335c077ca"
+      "sha256": "9d511e7cf21cea05cc565e9e5022c7c86cd3cf0d67053125ec27aeae3348e30a"
     },
     {
       "path": "tests/world_tokens.mjs",

package/docs/module-api-changelog.md

@@ -1847,5 +1847,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.692 with no explicit bump. run 34731402927. (task 1002620)
   1.19.694 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.693 with no explicit bump. run 34731674808. (task 1002620)
+  1.19.695 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.694 with no explicit bump. run 34732266878. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.694",
+  "version": "1.19.695",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.694",
+      "version": "1.19.695",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.694",
+  "version": "1.19.695",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/worktree.js

@@ -62,6 +62,45 @@ function needsJunction({ wtPath, repoRoot, platform }) {
   return isOutsideRepo({ wtPath, repoRoot });
 }
 
+// A node_modules directory sitting BETWEEN an inside-repo worktree and the repo
+// root — e.g. `.claude/worktrees/node_modules` — shadowing the main checkout's.
+// Returns its path, or null. Pure: `existsFn` is injected so this is testable
+// without building a directory tree.
+//
+// WHY THIS IS WORTH DETECTING (task 1003627). An inside-repo worktree deliberately
+// gets NO junction: node's resolution walks up to the main checkout, which is the
+// documented design. But walk-up stops at the FIRST node_modules it meets, so a
+// stray one on the way up silently wins for EVERY inside-repo worktree at once.
+//
+// Measured, not assumed: with the same package present at both levels, a probe in
+// `<root>/worktrees/wt` resolved to the main checkout's copy with no stray, and to
+// the stray the moment one existed one level up.
+//
+// The failure is quiet in the worst way — `require('pino')` still SUCCEEDS, just
+// from somewhere nobody installed on purpose, so a partial or stale stray reads as
+// a mysterious version skew rather than as a path problem. Two agents hit this on
+// 2026-09-04 (tasks 1002331, 1003577) and both concluded `worktree.js add` had
+// failed to create a junction. It had not: for an inside-repo worktree there is no
+// junction to create, and needsJunction — a pure win32-and-outside-root string
+// compare, unchanged since task 1002809 — never consulted a directory at all. The
+// missing piece was never a junction; it was anyone SAYING that the stray was there.
+function shadowingNodeModules({ wtPath, repoRoot, existsFn }) {
+  const exists = existsFn || ((p) => fs.existsSync(p));
+  if (isOutsideRepo({ wtPath, repoRoot })) return null; // outside gets a junction instead
+  let dir = path.dirname(path.resolve(wtPath));
+  const root = path.resolve(repoRoot);
+  // Walk from the worktree's PARENT up to (but not including) the repo root: a
+  // node_modules AT the root is the one we want resolution to reach.
+  while (dir !== root && dir.length > root.length) {
+    const candidate = path.join(dir, 'node_modules');
+    if (exists(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) break; // hit the filesystem root without meeting repoRoot
+    dir = parent;
+  }
+  return null;
+}
+
 // Ordered removal steps. The junction MUST go before git worktree remove (git
 // follows it into the shared node_modules); a REAL node_modules dir is left for
 // git to refuse — this tool never deletes real directories.
@@ -182,6 +221,18 @@ function cmdAdd(root, argv) {
     // Explicit --path outside the repo on posix: no junction is created here,
     // so say plainly that node_modules won't resolve rather than fail later.
     console.log('  ⚠ this worktree is outside the repo — node_modules will NOT resolve from here on this platform.');
+  } else {
+    // Inside the repo: no junction by design, node walks up to the main checkout.
+    // But walk-up stops at the FIRST node_modules, so name a stray one in between
+    // — it silently captures every inside-repo worktree and `require` still
+    // succeeds, which is what makes it so hard to spot (task 1003627).
+    const shadow = shadowingNodeModules({ wtPath, repoRoot: root });
+    if (shadow) {
+      console.log(`  ⚠ a stray node_modules sits between this worktree and the repo root: ${shadow}`);
+      console.log("     node's walk-up stops THERE, not at the main checkout — so this worktree (and every other");
+      console.log('     one beside it) resolves dependencies from a directory nobody installed on purpose.');
+      console.log('     Delete it, then re-run: dependencies belong in the MAIN checkout only.');
+    }
   }
   console.log('');
   console.log('Next:');
@@ -280,4 +331,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { worktreeNameFor, needsJunction, removalPlan, nodeModulesState };
+module.exports = { worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.694'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.695'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/worktree_helper.mjs

@@ -27,7 +27,7 @@ import os from 'node:os';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const { worktreeNameFor, needsJunction, removalPlan, nodeModulesState } = require('../scripts/gds/worktree.js');
+const { worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules } = require('../scripts/gds/worktree.js');
 
 let passed = 0;
 let failed = 0;
@@ -140,6 +140,55 @@ test('a REAL node_modules dir is left for git to refuse — we never rm it', ()
   eqArr(removalPlan({ nodeModulesState: 'real-dir' }), ['git-worktree-remove']);
 });
 
+// ---- shadowingNodeModules (task 1003627) ----------------------------------
+// An inside-repo worktree gets NO junction by design — node walks up to the main
+// checkout. But walk-up stops at the FIRST node_modules, so a stray one in
+// between captures every inside-repo worktree at once, and `require` still
+// SUCCEEDS from the wrong place. Two agents read that as "worktree.js add failed
+// to make a junction" on 2026-09-04; there was no junction to make.
+const R = 'C:/repo';
+const WT = 'C:/repo/.claude/worktrees/task-1';
+const at = (...present) => {
+  const set = new Set(present.map((p) => path.resolve(p)));
+  return (p) => set.has(path.resolve(p));
+};
+
+test('names a stray node_modules one level above the worktree', () => {
+  const hit = shadowingNodeModules({
+    wtPath: WT, repoRoot: R, existsFn: at('C:/repo/.claude/worktrees/node_modules'),
+  });
+  eq(path.resolve(hit), path.resolve('C:/repo/.claude/worktrees/node_modules'));
+});
+
+test('names a stray further up too (any level BELOW the repo root shadows it)', () => {
+  const hit = shadowingNodeModules({ wtPath: WT, repoRoot: R, existsFn: at('C:/repo/.claude/node_modules') });
+  eq(path.resolve(hit), path.resolve('C:/repo/.claude/node_modules'));
+});
+
+test('the repo root\'s OWN node_modules is not a stray — that is the target', () => {
+  // The whole point of walk-up is to reach this one; flagging it would make the
+  // warning fire on every healthy worktree, which is how a warning becomes noise.
+  eq(shadowingNodeModules({ wtPath: WT, repoRoot: R, existsFn: at('C:/repo/node_modules') }), null);
+});
+
+test('no stray anywhere → null', () => {
+  eq(shadowingNodeModules({ wtPath: WT, repoRoot: R, existsFn: () => false }), null);
+});
+
+test('an OUTSIDE-repo worktree is not checked — it gets a junction instead', () => {
+  eq(shadowingNodeModules({ wtPath: 'C:/tmp/wt-9', repoRoot: R, existsFn: () => true }), null);
+});
+
+test('the nearest stray wins, matching node\'s own resolution order', () => {
+  const hit = shadowingNodeModules({
+    wtPath: WT,
+    repoRoot: R,
+    existsFn: at('C:/repo/.claude/worktrees/node_modules', 'C:/repo/.claude/node_modules'),
+  });
+  eq(path.resolve(hit), path.resolve('C:/repo/.claude/worktrees/node_modules'),
+    'node stops at the first node_modules it meets walking up');
+});
+
 console.log('');
 console.log(`worktree_helper: ${passed} passed, ${failed} failed`);
 process.exit(failed > 0 ? 1 : 0);