@bongos/core 1.19.706 → 1.19.707

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.706",
-  "core_contract": "1.19.706",
-  "source_commit": "64c9df530070e324d8e24759cabe9f99b5f72e84",
+  "core_version": "1.19.707",
+  "core_contract": "1.19.707",
+  "source_commit": "81f4406107cc23fffd1cd396faeba854cfab702e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T05:25:47.946Z",
+  "built_at": "2026-09-13T06:08:10.442Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2135,
+    "functional_verbatim": 2138,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2636,
-  "tree_sha256": "153b7b8ec9f73145d3a44c31dd75daa089b2c94be32c2b91ad61e59270e89c69",
+  "file_count": 2639,
+  "tree_sha256": "b1f44a9ac5209bb3aef35739af94352c50892f50161818d2e805cdcb9fb92687",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "68adee401731b2252b8f8e5c32d1164da7abb13261d0bc9aa1e8b83ead4a2a99"
+      "sha256": "59033d82daa55e0e2bb8f357d076e5e0c36b6d708ec764ed28946248da86a1c6"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3882,7 +3882,7 @@
     {
       "path": "modules/agents/spawn.js",
       "mode": "0000644",
-      "sha256": "657e6a314e9daec8a7a3d17c3eee1ccfc35aaa1390d89fa0dd135d6365c103b1"
+      "sha256": "4e92375cbedf3f782583af007314e46262d5776c4c7dc67dc7ff6abda0884ea3"
     },
     {
       "path": "modules/autonomy/CLAUDE.md",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c22b832366994675cd2cb205017f9d775c35f89cafd4ecbf2ff4a13f5e8e218c"
+      "sha256": "0beecf6840022e259986573a8a0b444f9d4848dc0758f009b83e346f54769a1f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e85ec6c7db1b0f2ba643ff4178049b28c57c43ba417feff7c54a4184a6da111f"
+      "sha256": "bed665bc57c56a76e572401a1baed5fd08bfcca74a1a32e2dc744b6af2f79399"
     },
     {
       "path": "public-docs/index.html",
@@ -7859,6 +7859,11 @@
       "mode": "0000644",
       "sha256": "9c7ef61b64e41ee5dd6d913883e16dfed6d44bd6eefa4960b8dde566a63b5621"
     },
+    {
+      "path": "scripts/gds/agent-invoke.js",
+      "mode": "0000644",
+      "sha256": "ee5b3a261ff1821d81f8d9c44ec3b319cd1c8c6681e28547b4bddb802a6bda56"
+    },
     {
       "path": "scripts/gds/agents-sync.js",
       "mode": "0000644",
@@ -9562,7 +9567,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ea041db8186de51e61bdb52281d9d8a57627b10514f94a39e4120d9888c05aa5"
+      "sha256": "6bf49d3b72dbd08d6ede9514f8381efcb22d45602ed5f5de84893c1181b38dce"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9664,6 +9669,16 @@
       "mode": "0000644",
       "sha256": "bdc9d3678e12dee3f3252785ca82e06071421762c7146cbc1591d3fc2ec72180"
     },
+    {
+      "path": "tests/agent_invoke.mjs",
+      "mode": "0000644",
+      "sha256": "dfee6b9fd55abd8df182ddfc2a2b30b0168254368e1986b58fc60cb86fcaf2d7"
+    },
+    {
+      "path": "tests/agent_invoke_live.mjs",
+      "mode": "0000644",
+      "sha256": "9b90e0caab614f0751c251c5b5812ee273443a74e684d9156a7bffbb28ac7ee2"
+    },
     {
       "path": "tests/agents_routes.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1871,5 +1871,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.704 with no explicit bump. run 34739785273. (task 1002620)
   1.19.706 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.705 with no explicit bump. run 34740247460. (task 1002620)
+  1.19.707 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.706 with no explicit bump. run 34741980536. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/agents/spawn.js

@@ -74,6 +74,26 @@ function plannedRow({ definition = {}, trigger = {}, gate = {}, model = null, re
   };
 }
 
+// THE PROMPT ONE FIRE SENDS. The persona is WHO the agent is; `input` is what it
+// was asked THIS time.
+//
+// An on-demand definition is meaningless without the second half — the trigger
+// type has existed in the schema since the first migration, but until task
+// 1002491 there was no way to carry the demand, so every fire sent the persona
+// alone and an on-demand agent could only ever answer the empty question. An
+// event fire passes no input and composes to exactly the string it sent before.
+//
+// Composed HERE, in the one function that talks to the runner, rather than by the
+// caller handing over a doctored `definition`. A caller that rewrote `persona` to
+// smuggle the question in would also be the thing `plannedRow` reads the agent's
+// identity from, and the ledger would then describe a definition that never ran.
+function composePrompt(definition, input) {
+  const persona = (definition && typeof definition.persona === 'string') ? definition.persona : '';
+  const text = typeof input === 'string' ? input.trim() : '';
+  if (!text) return persona;
+  return persona ? `${persona}\n\n${text}` : text;
+}
+
 // How a finished run is recorded. Pure for the same reason.
 function completedRow({ ok, errorCode = null, costUsd = null, durationMs = null, outputRef = null } = {}) {
   if (ok) {
@@ -114,7 +134,8 @@ async function finishRun(pool, id, patch) {
 // into whatever triggered it — an event fabric must not be taken down by one
 // agent's bad day.
 async function spawnAgent({
-  definition, trigger = {}, gate = { decision: 'go' }, requestedByBuilderId = null, cache = null,
+  definition, input = null, trigger = {}, gate = { decision: 'go' },
+  requestedByBuilderId = null, cache = null,
 } = {}, deps = {}) {
   const pool = deps.pool || api.pool;
   const now = deps.now || (() => Date.now());
@@ -150,7 +171,7 @@ async function spawnAgent({
   const started = now();
   try {
     const res = await runner({
-      prompt: (definition && definition.persona) || '',
+      prompt: composePrompt(definition, input),
       // model/cwd/timeout are the ONLY knobs the port takes. No tools, no
       // permissions — see constraint 3.
       opts: { model, ...(deps.opts || {}) },
@@ -177,4 +198,4 @@ async function spawnAgent({
   }
 }
 
-module.exports = { spawnAgent, resolveModel, plannedRow, completedRow };
+module.exports = { spawnAgent, resolveModel, plannedRow, completedRow, composePrompt };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.706",
+  "version": "1.19.707",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.706",
+      "version": "1.19.707",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.706",
+  "version": "1.19.707",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",