@bongos/core 1.19.706 → 1.19.708

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.706",
-  "core_contract": "1.19.706",
-  "source_commit": "64c9df530070e324d8e24759cabe9f99b5f72e84",
+  "core_version": "1.19.708",
+  "core_contract": "1.19.708",
+  "source_commit": "42f201a980e11b8b417c2afa527230ed1ab05775",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T05:25:47.946Z",
+  "built_at": "2026-09-13T06:14:54.451Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2135,
+    "functional_verbatim": 2138,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2636,
-  "tree_sha256": "153b7b8ec9f73145d3a44c31dd75daa089b2c94be32c2b91ad61e59270e89c69",
+  "file_count": 2639,
+  "tree_sha256": "369223629e32da5858cc92a00ab2643eaa169ca59d1d89d6ab77ab8c50e3fd57",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "68adee401731b2252b8f8e5c32d1164da7abb13261d0bc9aa1e8b83ead4a2a99"
+      "sha256": "fd622c24f29995f2c8ebdd272cf5784f05285bbafc6c3da490308ed5e1730ba7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3882,7 +3882,7 @@
     {
       "path": "modules/agents/spawn.js",
       "mode": "0000644",
-      "sha256": "657e6a314e9daec8a7a3d17c3eee1ccfc35aaa1390d89fa0dd135d6365c103b1"
+      "sha256": "4e92375cbedf3f782583af007314e46262d5776c4c7dc67dc7ff6abda0884ea3"
     },
     {
       "path": "modules/autonomy/CLAUDE.md",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c22b832366994675cd2cb205017f9d775c35f89cafd4ecbf2ff4a13f5e8e218c"
+      "sha256": "4f9b97401aebd998dd23bf3ec95a333fd6c596c0ea5551dc02dc6e863ad92742"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e85ec6c7db1b0f2ba643ff4178049b28c57c43ba417feff7c54a4184a6da111f"
+      "sha256": "9002e7fc0a70168d56042d71c7905aa045b541dbc36d61e88180a8dfb1e0f559"
     },
     {
       "path": "public-docs/index.html",
@@ -7859,6 +7859,11 @@
       "mode": "0000644",
       "sha256": "9c7ef61b64e41ee5dd6d913883e16dfed6d44bd6eefa4960b8dde566a63b5621"
     },
+    {
+      "path": "scripts/gds/agent-invoke.js",
+      "mode": "0000644",
+      "sha256": "ee5b3a261ff1821d81f8d9c44ec3b319cd1c8c6681e28547b4bddb802a6bda56"
+    },
     {
       "path": "scripts/gds/agents-sync.js",
       "mode": "0000644",
@@ -7977,7 +7982,7 @@
     {
       "path": "scripts/gds/box-infra.js",
       "mode": "0000644",
-      "sha256": "7890dee972f792b633a86d5ac9e6195bafdfc6c197195b8ac3f00c4a0f80d5c0"
+      "sha256": "431691aed02a415c619dc0ba33106ac1e832e539260eff5f526debebe2d8ffff"
     },
     {
       "path": "scripts/gds/box-sync.js",
@@ -9562,7 +9567,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ea041db8186de51e61bdb52281d9d8a57627b10514f94a39e4120d9888c05aa5"
+      "sha256": "98205e89563b71f2e6ddbe44a9639464bdc589c20f3f0a8de12a2b968ac06569"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9664,6 +9669,16 @@
       "mode": "0000644",
       "sha256": "bdc9d3678e12dee3f3252785ca82e06071421762c7146cbc1591d3fc2ec72180"
     },
+    {
+      "path": "tests/agent_invoke.mjs",
+      "mode": "0000644",
+      "sha256": "dfee6b9fd55abd8df182ddfc2a2b30b0168254368e1986b58fc60cb86fcaf2d7"
+    },
+    {
+      "path": "tests/agent_invoke_live.mjs",
+      "mode": "0000644",
+      "sha256": "9b90e0caab614f0751c251c5b5812ee273443a74e684d9156a7bffbb28ac7ee2"
+    },
     {
       "path": "tests/agents_routes.mjs",
       "mode": "0000644",
@@ -9997,7 +10012,7 @@
     {
       "path": "tests/box_infra_resolve.mjs",
       "mode": "0000644",
-      "sha256": "cf261fa549f36d47ee42343bac2a297b132638aedf03beb8f521370b0c45c0e3"
+      "sha256": "fde24a8c273a098c89bbbce6c006fa4400448c9522b93707f5cd3f4fb358c515"
     },
     {
       "path": "tests/box_onboard.mjs",

package/docs/module-api-changelog.md

@@ -1871,5 +1871,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.704 with no explicit bump. run 34739785273. (task 1002620)
   1.19.706 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.705 with no explicit bump. run 34740247460. (task 1002620)
+  1.19.707 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.706 with no explicit bump. run 34741980536. (task 1002620)
+  1.19.708 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.707 with no explicit bump. run 34742245823. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/agents/spawn.js

@@ -74,6 +74,26 @@ function plannedRow({ definition = {}, trigger = {}, gate = {}, model = null, re
   };
 }
 
+// THE PROMPT ONE FIRE SENDS. The persona is WHO the agent is; `input` is what it
+// was asked THIS time.
+//
+// An on-demand definition is meaningless without the second half — the trigger
+// type has existed in the schema since the first migration, but until task
+// 1002491 there was no way to carry the demand, so every fire sent the persona
+// alone and an on-demand agent could only ever answer the empty question. An
+// event fire passes no input and composes to exactly the string it sent before.
+//
+// Composed HERE, in the one function that talks to the runner, rather than by the
+// caller handing over a doctored `definition`. A caller that rewrote `persona` to
+// smuggle the question in would also be the thing `plannedRow` reads the agent's
+// identity from, and the ledger would then describe a definition that never ran.
+function composePrompt(definition, input) {
+  const persona = (definition && typeof definition.persona === 'string') ? definition.persona : '';
+  const text = typeof input === 'string' ? input.trim() : '';
+  if (!text) return persona;
+  return persona ? `${persona}\n\n${text}` : text;
+}
+
 // How a finished run is recorded. Pure for the same reason.
 function completedRow({ ok, errorCode = null, costUsd = null, durationMs = null, outputRef = null } = {}) {
   if (ok) {
@@ -114,7 +134,8 @@ async function finishRun(pool, id, patch) {
 // into whatever triggered it — an event fabric must not be taken down by one
 // agent's bad day.
 async function spawnAgent({
-  definition, trigger = {}, gate = { decision: 'go' }, requestedByBuilderId = null, cache = null,
+  definition, input = null, trigger = {}, gate = { decision: 'go' },
+  requestedByBuilderId = null, cache = null,
 } = {}, deps = {}) {
   const pool = deps.pool || api.pool;
   const now = deps.now || (() => Date.now());
@@ -150,7 +171,7 @@ async function spawnAgent({
   const started = now();
   try {
     const res = await runner({
-      prompt: (definition && definition.persona) || '',
+      prompt: composePrompt(definition, input),
       // model/cwd/timeout are the ONLY knobs the port takes. No tools, no
       // permissions — see constraint 3.
       opts: { model, ...(deps.opts || {}) },
@@ -177,4 +198,4 @@ async function spawnAgent({
   }
 }
 
-module.exports = { spawnAgent, resolveModel, plannedRow, completedRow };
+module.exports = { spawnAgent, resolveModel, plannedRow, completedRow, composePrompt };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.706",
+  "version": "1.19.708",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.706",
+      "version": "1.19.708",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.706",
+  "version": "1.19.708",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",