@bongos/core 1.19.754 → 1.19.755

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.754",
-  "core_contract": "1.19.754",
-  "source_commit": "8fd1dd9b3ddbc313d9e3bb09ba2a339cb9793e7f",
+  "core_version": "1.19.755",
+  "core_contract": "1.19.755",
+  "source_commit": "1cc8ad5ec0be2921b0e5cf12464689c86b5c36a6",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T00:24:38.617Z",
+  "built_at": "2026-09-16T02:11:51.276Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2111,
+    "functional_verbatim": 2112,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2619,
-  "tree_sha256": "a2f5f1ae36d83e33d7e61bab1264bf62287f10d175f2c9e1f3cabd695bc2b757",
+  "file_count": 2620,
+  "tree_sha256": "4960c3809b0d1bd4756c52793ef2167cfc1b70844cd2250f3e35723cd275bc50",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f367478f9031a67c77c1b43521aa215ea65068e9ad1b6b21540c81abd8a22dde"
+      "sha256": "744adc56bff99972f3104823c66db347b9aaef9aee42d06f12bff8da8e559a7d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7567,12 +7567,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0b25947dcf9f2906d39aec4e4ad10e63dc42831cf593c5404ba77dc51c2be946"
+      "sha256": "d2721993cfbc4a656aab1c93434a55dd7a440a3bb63048893ed6b43c2b1bbeec"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f340a8707e0abe69d0e7d1028a0a96675b66099ce87af7932004393e02dc2a19"
+      "sha256": "23815bafaed5c20104d344967253d871d91b0df5524e5fba825119a316a0784a"
     },
     {
       "path": "public-docs/index.html",
@@ -9342,7 +9342,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "61b13299ffdd7f036d5bc3d364135bd8ca4d3470223001b8ff6cc45d858d6107"
+      "sha256": "9edf07966de8d137ba6d987557bb4a9fefeedd19e640f10302dbfd340e0343f9"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9372,7 +9372,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "df078d4bd7a6e0fda01ce242821141c66b6dc0f2d07ebfaf8de1a89ae279499e"
+      "sha256": "690fb3d76f0d06fcc41490f58b4a273c42ecfd65c8e9a2acb7cff0e85885f5a4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11619,6 +11619,11 @@
       "mode": "0000644",
       "sha256": "40c396fda3a618bf9fa2d2ae3d8d30b50e62c4210199d70b5e29cb82a046d037"
     },
+    {
+      "path": "tests/module_asset_subdomain.mjs",
+      "mode": "0000644",
+      "sha256": "420e17095b054f87be386913077966d456ae687b030b476e1bc33b15ae35ed9f"
+    },
     {
       "path": "tests/module_catalog.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1982,5 +1982,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.752 with no explicit bump. run 35036151976. (task 1002620)
   1.19.754 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.753 with no explicit bump. run 35039836268. (task 1002620)
+  1.19.755 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.754 with no explicit bump. run 35047010813. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.754",
+  "version": "1.19.755",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.754",
+      "version": "1.19.755",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.754",
+  "version": "1.19.755",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -826,6 +826,20 @@ function mountInternalSurfaces(app) {
   app.use((req, res, next) => {
     if (!isBuildersHost(req)) return next();
     if (req.path.startsWith('/api/') || req.path === '/healthz') return next();
+    // Module browser assets are addressed at the ROOT on every host — the URL the
+    // loader's hallWidgetScripts projection emits is an absolute /modules/<key>/…
+    // and injectModuleHallWidgets puts that same tag in the hall index on BOTH
+    // hosts (task 1002848). Without this line the shim rewrites it to
+    // /builders/modules/… before the MODULE_ASSET_RE handler below can match, so
+    // the tag is injected on the subdomain and the asset 404s there — injection
+    // works on both hosts, serving works only on the apex. The handler keeps all
+    // its own defences (the isModuleEnabled gate, the traversal check); this only
+    // lets the request reach it.
+    //
+    // The general hazard: ANY apex-rooted route registered BELOW this shim is
+    // eaten the same way. Today that is this one and the /docs family (idea 529
+    // → task 1002861); /downloads/* dodges it by being registered ABOVE instead.
+    if (req.path.startsWith('/modules/')) return next();
     if (req.path === '/builders' || req.path.startsWith('/builders/')) return next();
     // Prefix with /builders so the handlers below match. req.url carries the
     // query string; preserve it. '/' → '/builders/', '/watch' → '/builders/watch'.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.754'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.755'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module_asset_subdomain.mjs

@@ -0,0 +1,155 @@
+// tests/module_asset_subdomain.mjs — module browser assets must route identically
+// on the apex and on builders.<apex> (task 1002848).
+//
+// THE BUG. A module-contributed hall widget's <script src="/modules/<key>/public/
+// hall-widget.js"> is injected into the hall index on BOTH hosts by
+// injectModuleHallWidgets, but only SERVED on the apex. The builders-subdomain
+// rewrite shim in serve-internal.js runs as app.use middleware, ahead of the
+// MODULE_ASSET_RE route, and rewrites every path on that host onto the /builders/*
+// tree — exempting only /api/, /healthz and paths already under /builders. So
+// /modules/demo/public/hall-widget.js became /builders/modules/... , stopped
+// matching ^/modules/, and fell through to a 404.
+//
+// WHY THIS TEST HAS TO EXIST. The seam is a live no-op today: no module ships a
+// hall-widget.js, so nothing on either host currently requests one, and a
+// regression here would be completely invisible until the first module that does
+// ship one — at which point it would look like a bug in that module. The test
+// therefore drives a module asset that DOES exist (hall-ui's own public/ dir) and
+// asserts the two hosts agree, which is the property the fix is really about.
+//
+// serve-internal is DB-free (the pg pool connects lazily), so we mount it on a
+// throwaway express app and hit it over loopback — same pattern as
+// tests/docs_openapi_route.mjs.
+//
+// USE node:http, NOT fetch. `Host` is a forbidden header name in the fetch spec,
+// so `fetch(url, { headers: { host } })` SILENTLY drops the override and sends the
+// real one (127.0.0.1:<port>). A host-routing test written with fetch therefore
+// compares the apex against itself, passes, and keeps passing with the fix
+// reverted — which is exactly what the first draft of this file did until the
+// mutation probe caught it. node:http honours an explicit Host in options.headers.
+//
+// Run:  node --test tests/module_asset_subdomain.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+
+// Any host starting with "builders." is the subdomain; anything else is the apex.
+const APEX = 'example.com';
+const SUBDOMAIN = 'builders.example.com';
+
+// A file the hall-ui module really ships, so a 200 proves the request reached the
+// MODULE_ASSET_RE handler AND the handler found bytes — not merely that it matched.
+const REAL_ASSET = '/modules/hall-ui/public/atlas.css';
+
+async function withServer(fn) {
+  const express = require('express');
+  const { mountInternalSurfaces } = require('../src/bongos/serve-internal.js');
+  const app = express();
+  mountInternalSurfaces(app);
+  const server = await new Promise((resolve) => {
+    const s = app.listen(0, () => resolve(s));
+  });
+  try {
+    await fn(server.address().port);
+  } finally {
+    await new Promise((r) => server.close(r));
+  }
+}
+
+// One loopback request with a REAL Host header. Never follows redirects — a 301 is
+// itself a routing decision we want to see.
+function get(port, path, host) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body, headers: res.headers }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+// The harness is only meaningful if the Host header actually reaches the app, and
+// the fetch trap above proves that is not self-evident. Assert it directly, so a
+// future change that breaks host propagation fails HERE with a clear reason rather
+// than turning every test below into a silent apex-vs-apex tautology.
+test('the harness really varies the Host — without this the rest is vacuous', async () => {
+  await withServer(async (port) => {
+    const { isBuildersHost } = require('../src/bongos/serve-internal.js');
+    assert.equal(isBuildersHost({ headers: { host: SUBDOMAIN } }), true);
+    assert.equal(isBuildersHost({ headers: { host: APEX } }), false);
+    // and end-to-end: both hosts 301 /builders/, but to DIFFERENT places — the apex
+    // sends you to the subdomain, the subdomain strips the redundant prefix. Equal
+    // targets would mean the Host never reached the app.
+    const sub = await get(port, '/builders/', SUBDOMAIN);
+    const apex = await get(port, '/builders/', APEX);
+    assert.notEqual(sub.headers.location, apex.headers.location,
+      'the two hosts must route differently, or the Host header is being dropped');
+  });
+});
+
+test('a real module asset serves on the apex AND on builders.<apex>', async () => {
+  await withServer(async (port) => {
+    const apex = await get(port, REAL_ASSET, APEX);
+    const sub = await get(port, REAL_ASSET, SUBDOMAIN);
+    assert.equal(apex.status, 200, 'precondition: the asset serves on the apex');
+    assert.equal(sub.status, 200,
+      'the subdomain must serve it too — the rewrite shim used to turn this into /builders/modules/... and 404');
+  });
+});
+
+test('the two hosts return the same body, not just the same status', async () => {
+  await withServer(async (port) => {
+    const apex = await get(port, REAL_ASSET, APEX);
+    const sub = await get(port, REAL_ASSET, SUBDOMAIN);
+    assert.ok(apex.body.length > 0, 'precondition: the asset is not empty');
+    assert.equal(sub.body, apex.body, 'the subdomain must serve the same bytes, not a rewritten page');
+  });
+});
+
+test('an unknown module 404s on BOTH hosts — the exemption grants no new reach', async () => {
+  await withServer(async (port) => {
+    const p = '/modules/no-such-module/public/x.css';
+    assert.equal((await get(port, p, APEX)).status, 404);
+    assert.equal((await get(port, p, SUBDOMAIN)).status, 404,
+      'the shim exemption must not turn an unknown module into anything but a 404');
+  });
+});
+
+test('a missing file inside a REAL module 404s on both hosts', async () => {
+  await withServer(async (port) => {
+    const p = '/modules/hall-ui/public/definitely-not-here.css';
+    assert.equal((await get(port, p, APEX)).status, 404);
+    assert.equal((await get(port, p, SUBDOMAIN)).status, 404);
+  });
+});
+
+test('path traversal out of the module dir is refused on the subdomain too', async () => {
+  await withServer(async (port) => {
+    // The handler normalizes and rejects a rel path escaping modules/<key>/public.
+    // Worth pinning on the SUBDOMAIN specifically: that request now reaches the
+    // handler where it previously never did, so this is newly-exercised ground.
+    for (const p of ['/modules/hall-ui/public/../../../package.json',
+                     '/modules/hall-ui/public/..%2f..%2f..%2fpackage.json']) {
+      const r = await get(port, p, SUBDOMAIN);
+      assert.notEqual(r.status, 200, `traversal must not serve a file outside the module dir (${p})`);
+      assert.ok(!/"name":\s*"@bongos/.test(r.body), 'package.json bytes must never appear in the body');
+    }
+  });
+});
+
+test('the exemption is scoped to /modules/ — a lookalike path is still rewritten', async () => {
+  await withServer(async (port) => {
+    // If the exemption had been written as a bare `includes('modules')` or without
+    // the trailing slash, this path would escape the shim too.
+    const r = await get(port, '/moduleslike', SUBDOMAIN);
+    assert.notEqual(r.status, 200,
+      'a path merely starting with "modules" but outside /modules/ is not a module asset');
+  });
+});