@bongos/core 1.19.727 → 1.19.728

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.727",
-  "core_contract": "1.19.727",
-  "source_commit": "8860409e2ae4203c97fdcf95d358324f1a5a6bc7",
+  "core_version": "1.19.728",
+  "core_contract": "1.19.728",
+  "source_commit": "06378fe68686262687d6c0a9220a171349fd08c8",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T14:53:19.653Z",
+  "built_at": "2026-09-13T15:07:36.492Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2602,
-  "tree_sha256": "90088f98c9e09359faf4ac7099d2444ec5c2434976bf00f808739710cfd4588f",
+  "tree_sha256": "92181bc6b8bf6edd84603371fa1dff3a7634795709dca0232d22f40c2d105589",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2482,7 +2482,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0fe647bae4864d656c91c5a89051ba630819dc6a792cea693bd7a0e4cecfa630"
+      "sha256": "aae40418a50dbacd171155a580656c0ff09acdd3ee5a32ff5056dd810f928d92"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7512,12 +7512,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6cda7a3bc2dfd1ee7c15be6da4033a876e7222411c5e13057599d4568f557e01"
+      "sha256": "98647626d77d3752e83cb85506424f53b3bc829592fad02cabd79d7890d62cea"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b7e89ddb86b30e922b78a438509453e72eab5e4d0293c6769f70fa0d3335dcda"
+      "sha256": "d184aeeeed9d18bf8d0d0ea577bdce3c578ed9b2c483413f93ee96341de5f9d7"
     },
     {
       "path": "public-docs/index.html",
@@ -9317,7 +9317,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ee4b22adb7ca8da6d689ac51fff3b65f6dfb4f6319e1685cd1e8d89b760f0903"
+      "sha256": "12f533b8bd9218fb6820687062fc5e6e417ec51dc2dce5bcda46f4d6c55e4454"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9987,7 +9987,7 @@
     {
       "path": "tests/cli_package.mjs",
       "mode": "0000644",
-      "sha256": "b81bf677dc884eef7bd88128d024e3eed1699faa31a680b7d5d4cfdbcd11b09c"
+      "sha256": "334c952eadfdd7d5ee467cfd50a9f178a23389e94288cdb6a431c69c6e8e327c"
     },
     {
       "path": "tests/cli_sessions.mjs",

package/docs/module-api-changelog.md

@@ -1928,5 +1928,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.725 with no explicit bump. run 34763380132. (task 1002620)
   1.19.727 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.726 with no explicit bump. run 34763937238. (task 1002620)
+  1.19.728 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.727 with no explicit bump. run 34764630913. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.727",
+  "version": "1.19.728",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.727",
+      "version": "1.19.728",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.727",
+  "version": "1.19.728",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.727'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.728'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cli_package.mjs

@@ -185,7 +185,13 @@ test('the packed tarball installs and every verb runs with no repo present', (t)
   // base or on missing arguments. Failing that way is fine; failing to find a file is not.
   const LOAD_ARGS = {
     login:   ['login'],
-    reauth:  ['reauth'],
+    // `--no-open` is load-bearing, not cosmetic (task 1003909). HOME is a throwaway here, so
+    // there is no session and reauth takes its no-session path — which launches the builder's
+    // default browser at the dead API base (`rundll32 url.dll,FileProtocolHandler` on Windows).
+    // Without the flag, every run of this suite pops a connection-refused tab on the machine
+    // under test. The flag skips only the spawn: the script still loads, still prints its
+    // guidance, still exits 10, so every assertion below is unchanged.
+    reauth:  ['reauth', '--no-open'],
     setup:   ['setup'],
     box:     ['box'],
     shell:   ['shell'],
@@ -203,9 +209,42 @@ test('the packed tarball installs and every verb runs with no repo present', (t)
     'every advertised verb needs an entry here, or it goes unexercised',
   );
 
+  // No verb may launch a GUI on the machine running the suite (task 1003909). A script that can
+  // spawn a browser has two ways to be safe here, and it must pick one:
+  //   * it offers an opt-out flag   → the LOAD_ARGS entry above passes it, or
+  //   * it stops short of the launch → STOPS_SHORT_OF_LAUNCH names a marker that must stay absent.
+  // Proving it, rather than assuming it, is the point: a verb that starts reaching its launcher
+  // fails here instead of on someone's desktop.
+  const LAUNCHES_BROWSER = /FileProtocolHandler|xdg-open/;
+  const OPT_OUT = '--no-open';
+  const STOPS_SHORT_OF_LAUNCH = {
+    // `bongos login` opens a browser from inside the device flow, several network steps past the
+    // instance-URL prompt — and with empty stdin that prompt is never answered, so the process
+    // ends right there. `▸ Connecting to` is the first thing printed once a URL is accepted, so
+    // its ABSENCE is the proof this run stopped well short of the launch.
+    login: /Connecting to/,
+  };
+  const mustStopShort = {};
+  for (const [verb, args] of Object.entries(LOAD_ARGS)) {
+    const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', VERBS[verb].script), 'utf8');
+    if (!LAUNCHES_BROWSER.test(src)) continue;
+    if (src.includes(OPT_OUT)) {
+      assert.ok(args.includes(OPT_OUT),
+        `bongos ${verb} can spawn a browser and accepts ${OPT_OUT} — pass it in LOAD_ARGS, or this suite opens a window on the builder's machine`);
+      continue;
+    }
+    assert.ok(STOPS_SHORT_OF_LAUNCH[verb],
+      `bongos ${verb} can spawn a browser and has no ${OPT_OUT} — give it one, or add a STOPS_SHORT_OF_LAUNCH entry proving this run never reaches the launch`);
+    mustStopShort[verb] = STOPS_SHORT_OF_LAUNCH[verb];
+  }
+
   for (const [verb, args] of Object.entries(LOAD_ARGS)) {
     const res = runVerb(args);
     const all = `${res.stdout}\n${res.stderr}`;
+    if (mustStopShort[verb]) {
+      assert.doesNotMatch(all, mustStopShort[verb],
+        `bongos ${verb} got past the point where it can spawn a browser on this machine:\n${all}`);
+    }
     assert.ok(!/Cannot find module|MODULE_NOT_FOUND|ERR_MODULE_NOT_FOUND/.test(all),
       `bongos ${verb} hit a missing file — the manifest is incomplete:\n${all}`);
     assert.ok(!/ERR_REQUIRE_ESM|SyntaxError|ReferenceError/.test(all),