@bongos/core 1.19.741 → 1.19.743

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.741",
-  "core_contract": "1.19.741",
-  "source_commit": "a0740b9264fc6faf13a8488b80491838c382799a",
+  "core_version": "1.19.743",
+  "core_contract": "1.19.743",
+  "source_commit": "ab27f1b16b14260ffd2f5ae8342504053928aa40",
   "source_ref": "HEAD",
-  "built_at": "2026-09-15T13:46:02.283Z",
+  "built_at": "2026-09-15T14:55:42.206Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 479,
-    "agent_docs_stubbed": 24,
+    "agent_docs_stubbed": 25,
     "functional_verbatim": 2107,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2610,
-  "tree_sha256": "bacc410908735ec99a98749440c0e17978019d453f20b2d5f440b74a40581cd3",
+  "file_count": 2611,
+  "tree_sha256": "7eed1fd142643158bd9ddbb2f69beff6924a75e10c6b3ac121eb4c029787d4e5",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2492,7 +2492,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "21ae186d9c95a621e6613640eaa23dad5a88af2178216e72fbfde459f4214a71"
+      "sha256": "97ecbfdf15f6707e5f4a0d46ce1597667e0fd592e1adf2d36f3cf006adf5d2ce"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3564,6 +3564,11 @@
       "mode": "0000644",
       "sha256": "e8faead6772089c8e47f3f81433c65038bfbb60bb509dff6c2a7b5572124316d"
     },
+    {
+      "path": "modules/agents/CLAUDE.md",
+      "mode": "0000644",
+      "sha256": "7cb9dac9cb87b679e1ae50e4112b3a7928a38ebb9902c8947a74d17bec4d9009"
+    },
     {
       "path": "modules/agents/lib/answer-hold.js",
       "mode": "0000644",
@@ -6127,7 +6132,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "a0ed65254f629cc29f4f1093c54d5e78a148d5bc7f072fb98819562a96f7dd37"
+      "sha256": "b843ece3cd9bcb280ba103e1db653f6fef9b1b0d6394960deba7ed57fe71acc2"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -7537,12 +7542,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b68064d43f327cde4e1c0b197af22d1f5ee870f35d754fbe1c25940bb0eeeaa2"
+      "sha256": "9b9d8bc2b152c80ee2cbe2c9ee8e235f0130fbc317e67b7b8cfedbfa806129c2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "01060bf98fb7fabd92a0b0ba3bb889cff28342300dc6737476f5a8edfd802941"
+      "sha256": "b954e60f7093cbdd715857d5fed0f33c91e1f84fc4844714a59e9ab38669284d"
     },
     {
       "path": "public-docs/index.html",
@@ -9342,7 +9347,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4650f83e7d5708d8ace0509081902c22b8336dc0503e46ca4230469e28ceaa0d"
+      "sha256": "ff5ab852aa0fe991ee391e3ede0b07bf25316d90525e2c40ea9863ada99834e0"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -1956,5 +1956,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.739 with no explicit bump. run 34839732962. (task 1002620)
   1.19.741 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.740 with no explicit bump. run 34977074381. (task 1002620)
+  1.19.742 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.741 with no explicit bump. run 34983109625. (task 1002620)
+  1.19.743 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.742 with no explicit bump. run 34984876076. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/agents/CLAUDE.md

@@ -0,0 +1,15 @@
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
+
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
+
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
+
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
+
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/platform-identity/tests/platform-identity.mjs

@@ -18,6 +18,7 @@ import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const P = require('../platform-identity.js');
+const terms = require('../terms-acceptance.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -130,15 +131,27 @@ t('a service principal (system_role set) may NOT federate', () => {
 console.log('\naccounts:');
 
 await ta('upsertAccount upserts on github_id and returns the row (default: NOT activating)', async () => {
-  const row = { id: '1', github_id: '42', github_login: 'octocat', display_name: 'Octo', avatar_url: 'a', profile_state: 'provisional' };
+  const avatar = 'https://avatars.example/octocat.png';
+  const row = { id: '1', github_id: '42', github_login: 'octocat', display_name: 'Octo', avatar_url: avatar, profile_state: 'provisional' };
   const pool = mockPool([{ rows: [row] }]);
   const out = await P.upsertAccount(
-    { githubId: 42, githubLogin: 'octocat', displayName: 'Octo', avatarUrl: 'a' }, { pool });
+    { githubId: 42, githubLogin: 'octocat', displayName: 'Octo', avatarUrl: avatar }, { pool });
   assert.deepEqual(out, row);
   const c = pool.calls[0];
   assert.match(c.text, /INSERT INTO platform_identity_accounts/);
   assert.match(c.text, /ON CONFLICT \(github_id\) DO UPDATE/);
-  assert.deepEqual(c.params, [42, 'octocat', 'Octo', 'a', false]);
+  // $6 is the terms version, carried since acceptanceInsertValues('$5', '$6') landed.
+  // Asserted against the module's own constant and NEVER the literal date: hardcoding
+  // it is precisely what let this assertion rot when terms acceptance shipped.
+  assert.deepEqual(c.params, [42, 'octocat', 'Octo', avatar, false, terms.TERMS_VERSION]);
+
+  // safeAvatarUrl is https-only — anything else is stored as null rather than passed
+  // through. This is the suite's only assertion of that guard, so it stays explicit
+  // instead of riding on a placeholder fixture.
+  const poolBad = mockPool([{ rows: [row] }]);
+  await P.upsertAccount(
+    { githubId: 42, githubLogin: 'octocat', displayName: 'Octo', avatarUrl: 'a' }, { pool: poolBad });
+  assert.equal(poolBad.calls[0].params[3], null, 'a non-https avatar is nullified, not stored');
 });
 
 await ta('upsertAccount consent upgrade is one-way (ADR 0171 D3): activate flips to active, default preserves the stored state', async () => {
@@ -689,7 +702,9 @@ await ta('getPublicProfileExtras is fail-closed: null for missing / provisional
 
 await ta('getPublicProfileExtras returns the rollup for an active, visible account', async () => {
   const pool = mockPool([
-    { rows: [{ profile_state: 'active', hide_stats: false }] },
+    // isRollupVisible composes isAccountActive, so the row must carry consent
+    // (terms_accepted_at) AND account_visibility, not just profile_state.
+    { rows: [{ profile_state: 'active', terms_accepted_at: 'T', account_visibility: 'public', hide_stats: false }] },
     { rows: [{ projects: 1, credits: 10, works_shipped: 1, karma: 0, last_active: 'T', disciplines: null }] },
     { rows: [] },
   ]);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.741",
+  "version": "1.19.743",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.741",
+      "version": "1.19.743",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.741",
+  "version": "1.19.743",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.741'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.743'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');