@bongos/core 1.19.752 → 1.19.753

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.752",
-  "core_contract": "1.19.752",
-  "source_commit": "579246be74968f1b0ac143467ff0dd000c0db6d3",
+  "core_version": "1.19.753",
+  "core_contract": "1.19.753",
+  "source_commit": "80dc32c8218722e226e51da2ebb020cec6d9d0c2",
   "source_ref": "HEAD",
-  "built_at": "2026-09-15T23:12:05.100Z",
+  "built_at": "2026-09-15T23:33:23.711Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 482,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2617,
-  "tree_sha256": "45de4196d4c067e90b1267e93dea4420bbaa87784156a3c48412f9db9f06e12a",
+  "tree_sha256": "878000807a14e178ce864325e1330e8c14b05bd4799fab37d3cecde128cde500",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2507,7 +2507,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "64c80e364b970b0da6d391873f6d80ee47a1f370b355588165c0050f837f6e49"
+      "sha256": "ccb51e74c6ede2d1dc04f3877491a2b2a8c266494c9624b710fd3af463ac49b8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7562,12 +7562,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5ac8fa7cd6f19e26e2cc023909a62d27a008dd9f9affb5260fc0faed61374b3b"
+      "sha256": "cf5907822b5a511411433a626f4f1651d58505115c4a5ba39a391195e120e2ad"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "247f473ed0739975c6ba20694c49d14d8f7b21bd10b596fd66969349077ad2af"
+      "sha256": "159c9db7924dccba4d3a83a4139e958190bc1eab91e974b696846d5418ad0c20"
     },
     {
       "path": "public-docs/index.html",
@@ -9367,7 +9367,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "951a6fd6ee9539693914e36609e4078793753c13e71965d9d154dfd09c6c3718"
+      "sha256": "a15e5c285579017bee5b7b08b63efc00124fa10e2e562dafadf6b2b456f0820c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12417,7 +12417,7 @@
     {
       "path": "tests/session-cards.mjs",
       "mode": "0000644",
-      "sha256": "3b9ca3392533ade9dc8fecd33c705e844a3c3c692fd7ffb33a0d582bf8da6ca6"
+      "sha256": "9035468dcf1b6ef0bc0aaf5a665196a0eab321563ab84aa1133b1446ff1ce9cd"
     },
     {
       "path": "tests/session_506_regression.mjs",

package/docs/module-api-changelog.md

@@ -1978,5 +1978,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.750 with no explicit bump. run 35033016299. (task 1002620)
   1.19.752 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.751 with no explicit bump. run 35034524356. (task 1002620)
+  1.19.753 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.752 with no explicit bump. run 35036151976. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.752",
+  "version": "1.19.753",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.752",
+      "version": "1.19.753",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.752",
+  "version": "1.19.753",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.752'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.753'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/session-cards.mjs

@@ -136,6 +136,58 @@ test('empty / malformed envelope or missing title → empty string', () => {
   assert.equal(hook.buildAdditionalContext(onEnv, null), '', 'no title → nothing');
 });
 
+// ---------- buildAdditionalContext: delivery mode (task 1003933) ----------
+//
+// A prompt-MATCHED card is the whole answer — the builder typed /builder-start,
+// so rendering it and nothing else is right. A card delivered by the
+// prompt-INDEPENDENT land-watch hook is not: it rides whatever the builder
+// happened to say next, and the "verbatim as your reply" directive made it
+// displace a real question twice on 2026-09-15.
+
+test("default mode claims the reply; 'append' yields to the builder's message", () => {
+  const reply = hook.buildAdditionalContext(onEnv, 'status_card');
+  assert.ok(/as your reply/i.test(reply), 'default still says the card IS the reply');
+  const append = hook.buildAdditionalContext(onEnv, 'task_card', 'append');
+  assert.ok(/answer[\s\S]{0,40}first/i.test(append), "append tells the model to answer the builder first");
+  assert.ok(/after (?:you )?answer|end of your reply/i.test(append), 'and to place the card after that answer');
+  assert.ok(!/verbatim as your reply/i.test(append), 'append never claims the whole reply');
+});
+
+test("'append' still embeds both payloads verbatim, each fence exactly twice", () => {
+  const ctx = hook.buildAdditionalContext(onEnv, 'task_card', 'append');
+  assert.ok(ctx.includes('<div class="st-card">WIDGET-BODY</div>'), 'HTML verbatim');
+  assert.ok(ctx.includes('MARKDOWN-BODY'), 'markdown verbatim');
+  assert.equal(count(ctx, '<<<WIDGET_HTML>>>'), 2);
+  assert.equal(count(ctx, '<<<MARKDOWN_CARD>>>'), 2);
+  assert.ok(/do NOT run the script yourself/i.test(ctx), 'still forbids re-running the script');
+});
+
+test("'append' holds with widgets OFF (the markdown-only branch)", () => {
+  const ctx = hook.buildAdditionalContext(
+    { widgets_enabled: false, html: null, markdown: 'MD-ONLY', warnings: [] }, 'task_card', 'append');
+  assert.ok(ctx.includes('MD-ONLY'));
+  assert.ok(/answer[\s\S]{0,40}first/i.test(ctx), 'append wording reaches the widgets-off branch too');
+  assert.equal(count(ctx, '<<<WIDGET_HTML>>>'), 0);
+  assert.equal(count(ctx, '<<<MARKDOWN_CARD>>>'), 2);
+});
+
+test('an unknown mode falls back to the reply directive (fail-safe)', () => {
+  const ctx = hook.buildAdditionalContext(onEnv, 'status_card', 'nonsense');
+  assert.ok(/as your reply/i.test(ctx), 'unknown mode must not silently drop the directive');
+});
+
+test('land-watch-card.js requests the append mode', () => {
+  // The prompt-independent hook is the whole reason 'append' exists; a call
+  // without it would reintroduce the hijack. Source-level because the hook
+  // requires its sibling inside main() at runtime. CRLF-normalised: this
+  // checkout reads back \r\n and an anchored match would silently pass.
+  const src = require('node:fs')
+    .readFileSync(new URL('../.claude/hooks/land-watch-card.js', import.meta.url), 'utf8')
+    .replace(/\r\n/g, '\n');
+  assert.match(src, /buildAdditionalContext\(\s*envelope\s*,[^)]*,\s*'append'\s*\)/,
+    "land-watch-card must pass 'append' when building its directive");
+});
+
 // ---------- Summary ----------
 
 console.log('');