@bongos/core 1.19.698 → 1.19.699

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.698",
-  "core_contract": "1.19.698",
-  "source_commit": "8fb86a2225d9ed2a99fe253ea3886c7b2e7bcfc9",
+  "core_version": "1.19.699",
+  "core_contract": "1.19.699",
+  "source_commit": "c2fc577575ff838fa4b7c6ef9b487a61834508da",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T02:48:21.644Z",
+  "built_at": "2026-09-13T03:11:31.535Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2627,
-  "tree_sha256": "53de7b22ab854dd4a788f5ce3827fca83328bb1f43e0415eae9528923e68596b",
+  "tree_sha256": "6784a09f48fd3badc907d3157a51dfd66a765084f015b78924eb7229bcb7c757",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5c48de96a5d2d3ed794c4f503a665f0c4defc7d06f384ba4012eeb02cf3036aa"
+      "sha256": "83f3755afa52e27b8dc1c9cacc65fd57eb20ca11463f1408bb7298279bbf3994"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7772,12 +7772,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0faabe7f40491c6ab374488d6ae4a244694e1fbf40c280ad98ef0a249c207b80"
+      "sha256": "7235324939dc1acfb616300365334ebf96e054f83b8083b15cd2f99eeb5a6d71"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f623a28e95671e15f28bc19bc1b29f26f00312c5f0dc5e8761b872dd42e85923"
+      "sha256": "c650680172226a9259dbb3da9cfc459a3c94f3fa5578be520c27d2b71d0a71d9"
     },
     {
       "path": "public-docs/index.html",
@@ -9512,7 +9512,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "5c99fec0061221143be5e22bb51ca690aec883d9eaf094bd25007d3e21b5f96c"
+      "sha256": "61b13299ffdd7f036d5bc3d364135bd8ca4d3470223001b8ff6cc45d858d6107"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9542,7 +9542,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f03b116eece1a5517cda1bf812627f7148aaf2827806d53d70f3b67d343026ab"
+      "sha256": "f6283921aa6c4af4de772e638a58ad28111bb8e6664a4bb67e15bc86ad1083f3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10327,7 +10327,7 @@
     {
       "path": "tests/currency_label.mjs",
       "mode": "0000644",
-      "sha256": "b88f7ab55948f0bfbf0e6982cc96465ff2c34d76b143f40b86f933c323b8ff1d"
+      "sha256": "20994467d64d35647433c320265e360a520391bff974b1a39a918ef66ad7f172"
     },
     {
       "path": "tests/cutover_codemod.mjs",

package/docs/module-api-changelog.md

@@ -1855,5 +1855,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.696 with no explicit bump. run 34733301156. (task 1002620)
   1.19.698 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.697 with no explicit bump. run 34733917938. (task 1002620)
+  1.19.699 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.698 with no explicit bump. run 34734848584. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.698",
+  "version": "1.19.699",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.698",
+      "version": "1.19.699",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.698",
+  "version": "1.19.699",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -107,25 +107,66 @@ function themeMarkup(theme) {
   if (!theme) return '';
   const decls = [];
   for (const [key, cssVar] of Object.entries(COLOR_VARS)) {
-    const v = theme.colors?.[key];
+    const v = cssSafe(theme.colors?.[key]);
     if (v) decls.push(`${cssVar}:${v};`);
   }
-  if (theme.fonts?.display) decls.push(`--font-display:${theme.fonts.display};`);
-  if (theme.fonts?.body) decls.push(`--font-body:${theme.fonts.body};`);
+  const display = cssSafe(theme.fonts?.display);
+  if (display) decls.push(`--font-display:${display};`);
+  const body = cssSafe(theme.fonts?.body);
+  if (body) decls.push(`--font-body:${body};`);
   let out = '';
   for (const href of theme.fonts?.links || []) {
-    out += `<link rel="stylesheet" href="${href}">`;
+    out += `<link rel="stylesheet" href="${esc(href)}">`;
   }
   // `backdrop` paints the page background (e.g. the Cloud Bongos sunrise gradient,
   // ADR 0064 / R74) over the flat var(--bg); omitted packs (OTB) keep --bg.
   const css = [];
   if (decls.length) css.push(`:root{${decls.join('')}}`);
-  if (theme.backdrop) css.push(`body{background:${theme.backdrop};}`);
+  const backdrop = cssSafe(theme.backdrop);
+  if (backdrop) css.push(`body{background:${backdrop};}`);
   if (css.length) out += `<style>${css.join('')}</style>`;
-  if (theme.favicon) out += `<link rel="icon" href="${theme.favicon}">`;
+  // esc() is lossless in an attribute: the HTML parser decodes the entities back
+  // before anything reads the URL, so the neutral pack's inline `data:image/svg+xml,
+  // <svg …>` favicon resolves to exactly the same bytes it does today.
+  if (theme.favicon) out += `<link rel="icon" href="${esc(theme.favicon)}">`;
   return out;
 }
 
+// A pack-supplied value on its way into <style> TEXT. esc() is the wrong tool
+// here and would corrupt the output: CSS is not entity-decoded, so a font stack
+// like `"Cinzel", serif` would reach the browser as `&quot;Cinzel&quot;, serif`
+// and simply not parse. There is no encoding that both survives CSS and
+// neutralizes markup, so this fails closed instead. The only way out of a <style>
+// element is a literal `</style`, every route to it begins with `<`, and no
+// colour, font stack, or backdrop has a legitimate use for one — so a value
+// carrying `<` is dropped whole rather than emitted half-escaped. Dropping one
+// declaration loses that pack's colour and falls back to style.css's default;
+// emitting it loses the page.
+function cssSafe(v) {
+  const s = String(v == null ? '' : v);
+  return s.includes('<') ? '' : s;
+}
+
+// Serialize a pack value for injection INSIDE a <script> element. JSON.stringify
+// alone is not enough: its output is valid JSON, but the browser reads a script
+// body as raw text FIRST, so a `</script>` anywhere in the pack ends the element
+// early and everything after it lands in the document as markup (the latent
+// self-XSS from an operator-authored pack — idea 348, Hacker dispatch on task
+// 1374). Escaping `<` alone closes it: `</script`, `<script`, and `<!--` all need
+// one. `>` and `&` need no escaping here precisely because a classic script body
+// is NOT entity-decoded — there is nothing for them to start. U+2028/U+2029 are
+// escaped as well: legal in string literals since ES2019, so not a break-out on
+// any browser we serve, but free to escape and still fatal to an older parser.
+// `\u003c` is the same character to the JS parser and never one to the HTML
+// parser, so the value the page actually reads is unchanged. Same fix, same
+// reasoning as modules/provisioning/routes/callback-page.js.
+function jsonForScript(value) {
+  return JSON.stringify(value)
+    .replace(/</g, '\\u003c')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029');
+}
+
 // Inject the client-safe branding pack into a served HTML document (R56 task 1195
 // + R57 task 1196, ADR 0062 §3):
 //   * `window.__BRANDING__` — a synchronous global so every hall/status script
@@ -145,7 +186,7 @@ function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModul
   // UI sections for off modules synchronously (no fetch, no race). R60 wires the
   // actual section-hiding; this exposes the data.
   const stamped = applyBrandTokens(html, brand);
-  const tag = `${clientBundleScriptTag()}<script>window.__BRANDING__=${JSON.stringify(brand)};window.__MODULES__=${JSON.stringify(mods)};</script>${themeMarkup(brand.theme)}`;
+  const tag = `${clientBundleScriptTag()}<script>window.__BRANDING__=${jsonForScript(brand)};window.__MODULES__=${jsonForScript(mods)};</script>${themeMarkup(brand.theme)}`;
   return stamped.includes('</head>') ? stamped.replace('</head>', `${tag}</head>`) : tag + stamped;
 }
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.698'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.699'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/currency_label.mjs

@@ -121,6 +121,89 @@ test('injectBrandingGlobal degrades safely when there is no </head>', () => {
   assert.ok(out.includes('<div>no head</div>'));
 });
 
+// --- task 1001434 (idea 348): everything the pack contributes is escaped for the
+// context it lands in. The pack is operator-authored, so this is not a defence
+// against a hostile visitor — it is a defence against one stray character in a
+// config file silently turning every served page's <head> into markup.
+
+// A pack string carrying `</script>` is the whole bug: the browser finds the end
+// of the script element by scanning raw text, before any JS parsing happens.
+const HOSTILE = {
+  identity: { productName: '</script><img src=x onerror=alert(1)>', worldName: 'w' },
+  copy: { tagline: 'a < b && c > d' },
+};
+
+function brandingJson(out) {
+  const m = /window\.__BRANDING__=(.*?);window\.__MODULES__=/s.exec(out);
+  assert.ok(m, 'the injected branding assignment must be findable');
+  return m[1];
+}
+
+test('1001434: a `</script>` in the pack cannot close the injected script element', () => {
+  const out = injectBrandingGlobal('<head></head>', clientBranding(HOSTILE), {});
+  assert.ok(/<script>window\.__BRANDING__=(.*?)<\/script>/s.exec(out), 'the injected block is well-formed');
+  // Two closers are correct and expected: the client-bundle <script src=…></script>
+  // that leads the tag, and our own terminator. A third would BE the bug — the
+  // pack's `</script>` ending the element early. Unfixed, this counts 3.
+  assert.equal(out.split('</script>').length - 1, 2, 'no early close');
+  assert.ok(!out.includes('<img src=x'), 'the payload never reaches the document as a tag');
+});
+
+test('1001434: every `<` in the injected JSON is \\u003c, and the VALUE is unchanged', () => {
+  const out = injectBrandingGlobal('<head></head>', clientBranding(HOSTILE), {});
+  const json = brandingJson(out);
+  assert.ok(!json.includes('<'), 'no raw < survives into the script body');
+  assert.ok(json.includes('\\u003c'), 'it is escaped, not stripped');
+  // Escaping must be lossless: < is the same character to the JSON parser,
+  // so the page reads exactly what the operator configured.
+  const parsed = JSON.parse(json);
+  assert.equal(parsed.identity.productName, '</script><img src=x onerror=alert(1)>');
+  assert.equal(parsed.copy.tagline, 'a < b && c > d', '> and & are left alone — a script body is not entity-decoded');
+});
+
+test('1001434: __MODULES__ is escaped too — it rides the same script tag', () => {
+  const out = injectBrandingGlobal('<head></head>', clientBranding({}), { enabled: { '</script>': true } });
+  assert.equal(out.split('</script>').length - 1, 2, 'the bundle tag and our terminator, and nothing else');
+  const m = /window\.__MODULES__=(.*?);<\/script>/s.exec(out);
+  assert.ok(m && !m[1].includes('<'));
+  assert.deepEqual(JSON.parse(m[1]), { enabled: { '</script>': true } });
+});
+
+test('1001434: a theme value carrying `<` is DROPPED rather than breaking out of <style>', () => {
+  const m = themeMarkup({
+    colors: { bg: '#fff', ink: '</style><script>alert(1)</script>' },
+    backdrop: '</style>x',
+    fonts: { display: '"Cinzel", serif' },
+  });
+  assert.ok(!m.includes('<script>'), 'no escape from the style element');
+  assert.equal(m.split('</style>').length - 1, 1, 'exactly one style terminator — our own');
+  assert.ok(m.includes('--bg:#fff;'), 'the clean declarations still ship');
+  assert.ok(!m.includes('--ink:'), 'the poisoned one is dropped whole, not half-escaped');
+  assert.ok(!m.includes('body{background:'), 'a poisoned backdrop is dropped too');
+  // CSS is not entity-decoded, so esc() here would be a bug of its own: the font
+  // stack has to keep its real quotes.
+  assert.ok(m.includes('--font-display:"Cinzel", serif;'), 'quotes in a font stack survive intact');
+});
+
+test('1001434: a pack cannot break out of the favicon or font-link href attribute', () => {
+  const m = themeMarkup({ favicon: 'x"><script>alert(1)</script>', fonts: { links: ['y"><script>alert(2)</script>'] } });
+  assert.ok(!m.includes('<script>'), 'neither href can escape its attribute');
+  assert.ok(m.includes('&quot;'), 'the quote is entity-escaped, which the parser undoes on read');
+});
+
+test('1001434: escaping the favicon is lossless — the neutral inline-SVG data URI still resolves', () => {
+  const favicon = "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg'><circle r='8'/></svg>";
+  const m = themeMarkup({ favicon });
+  const href = /<link rel="icon" href="([^"]*)">/.exec(m);
+  assert.ok(href, 'the attribute is still well-formed');
+  // Decode the way an HTML parser does; the operator's bytes must come back.
+  const decoded = href[1]
+    .replace(/&lt;/g, '<').replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"').replace(/&#39;/g, "'")
+    .replace(/&amp;/g, '&');
+  assert.equal(decoded, favicon, 'the browser reads exactly the URI the pack configured');
+});
+
 // --- BV1.R75: module hall-widget script injection (ADR 0062 §4) ---
 
 const HALL = '<body><script src="/builders/builders.js?v=2026-06-27-r75" defer></script></body>';