@bongos/core 1.19.785 → 1.19.786

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.785",
-  "core_contract": "1.19.785",
-  "source_commit": "022d941502640ca75c63a0fb7d13ae42233b583f",
+  "core_version": "1.19.786",
+  "core_contract": "1.19.786",
+  "source_commit": "785c921afb48af049814782f27929cc27885667c",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T22:11:28.177Z",
+  "built_at": "2026-09-16T22:20:27.767Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2668,
-  "tree_sha256": "e71aafdc39bbf2b01c233a16c86515be287220faecbb7afaa6f874ffb6dbd9fa",
+  "tree_sha256": "3d454ef4a876f5368603708cbe4f13b53dc57a854dc03e217285b327b6dd0bf9",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "37d573a87561b4c12d3b3d1d416ad720fa4286a57fd2e30f906f0262cb70ad4d"
+      "sha256": "580f9ae0d3677bc11fe335f73027c314edd8633f2397cd71400e07725a8f4a03"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7062,7 +7062,7 @@
     {
       "path": "modules/security/secret-scrub.js",
       "mode": "0000644",
-      "sha256": "26e920133f0ad40de27a0b20e97492d8d42e656561e2e331e8b6ecce3de2ccf3"
+      "sha256": "c28b9a47e3d01d206cb2a13e71844865a95cc2a9dc5e0237e1153ccf8f292286"
     },
     {
       "path": "modules/security/security.js",
@@ -7622,12 +7622,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "39247eaf1ee78994bb9f1be1d50c320bbf7a1184efe408bec6458a8450638036"
+      "sha256": "a08e66b825d352b3b0c128f3b5b71d4665183bf734d69d0e837adf8946a28f19"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6ce05e6b15c23da646d860f0c9d2c5a84cbee1fac61af6c807cefe7e2b743eae"
+      "sha256": "9f9dfe9f5f8cc3d3ebc1cd46909eb73ac9ef03046933478f391cb6c23680cfa6"
     },
     {
       "path": "public-docs/index.html",
@@ -9492,7 +9492,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0f2dbf8705fbe60f6a38db6c2e40c5b671576645a092902706e5251d78758784"
+      "sha256": "0eb65d596ccf4f9af9cb2ec8769e373c18f3148b93e785157895d4dbb94299c7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12557,7 +12557,7 @@
     {
       "path": "tests/scrubber_corpus.mjs",
       "mode": "0000644",
-      "sha256": "cb05f1824487124163f7b8dac0a8c589a1a02cbb1130f06ac716701fea6bf59c"
+      "sha256": "d1f80894bd96f866359d3d1997e36e8843fe3dba141ac621874cdc1d530b9282"
     },
     {
       "path": "tests/seam_wiring_guard.mjs",

package/docs/module-api-changelog.md

@@ -2044,5 +2044,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.783 with no explicit bump. run 35155326585. (task 1002620)
   1.19.785 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.784 with no explicit bump. run 35156349018. (task 1002620)
+  1.19.786 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.785 with no explicit bump. run 35157132070. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/security/secret-scrub.js

@@ -190,12 +190,34 @@ const ENV_SECRET_PREFIX_RE = /^(?:gds_|pms_|mac_|apple|anthropic|stripe|cf_|clou
 // last `cd` (task 2130). Exact-match only, so real password vars (MYSQL_PWD, DB_PWD, …)
 // still match below.
 const ENV_BENIGN_KEY_RE = /^(?:PWD|OLDPWD)$/;
+// CONFIG-IDENTIFIER NAMES under a provider prefix (task 1003512). ENV_SECRET_PREFIX_RE
+// matches ^anthropic, so the Claude Code harness's own ANTHROPIC_DEFAULT_OPUS_MODEL —
+// whose value is a MODEL ID like claude-opus-5, not a credential — was collected as a
+// live secret. package-core's fail-closed leak gate then flagged every functional file
+// containing that string verbatim and refused to build, on ANY machine where Claude
+// Code had set its model vars, i.e. every builder machine. Hit live packaging
+// 1.19.209; the workaround was `env -u ANTHROPIC_DEFAULT_OPUS_MODEL`.
+//
+// AN ALLOWLIST ON THE NAME, NOT A SHAPE TEST ON THE VALUE. The entropy/prefix check on
+// the VALUE is the other obvious fix and this file already records why that direction
+// loses: see the doc-path exemption above, where three shape rules were tried and each
+// one leaked, because a predicate built on what a secret LOOKS like also admits a
+// secret dressed the other way. These literals feed the PUBLIC mirror and session
+// uploads, so a shape hole here is a smuggling channel. That a _MODEL or _BASE_URL var
+// holds a configuration identifier is a fact about the NAME, which cannot be dressed.
+//
+// NARROW BY CONSTRUCTION: this exempts only names matched by the provider PREFIX. A
+// name carrying an actual secret word (ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN) matches
+// ENV_SECRET_KEY_RE first and is still collected, whatever it ends with.
+const ENV_CONFIG_NAME_RE = /(?:_MODEL|_BASE_URL)$/i;
 function collectEnvSecrets(env = process.env) {
   const out = [];
   for (const [k, v] of Object.entries(env || {})) {
     if (typeof v !== 'string' || v.length < 8) continue;
     if (ENV_BENIGN_KEY_RE.test(k)) continue;
-    if (ENV_SECRET_KEY_RE.test(k) || ENV_SECRET_PREFIX_RE.test(k)) out.push(v);
+    // A secret WORD in the name always wins — it is never exempted below.
+    if (ENV_SECRET_KEY_RE.test(k)) { out.push(v); continue; }
+    if (ENV_SECRET_PREFIX_RE.test(k) && !ENV_CONFIG_NAME_RE.test(k)) out.push(v);
   }
   return out;
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.785",
+  "version": "1.19.786",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.785",
+      "version": "1.19.786",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.785",
+  "version": "1.19.786",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.785'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.786'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/scrubber_corpus.mjs

@@ -327,6 +327,65 @@ test('collectEnvSecrets: benign shell PWD/OLDPWD are skipped, real *_PWD passwor
   assert.ok(got.includes(env.MYSQL_PWD), 'MYSQL_PWD (a real password var) must still be collected');
 });
 
+test('collectEnvSecrets: Claude Code harness config vars are skipped, real anthropic credentials still collected (task 1003512)', () => {
+  // Regression: ENV_SECRET_PREFIX_RE matches ^anthropic, so the harness's own
+  // ANTHROPIC_DEFAULT_OPUS_MODEL — value = a MODEL ID, not a credential — was collected
+  // as a live secret. package-core's fail-closed leak gate then flagged every functional
+  // file containing that string verbatim (the grader, llm-pricing and their tests) and
+  // refused to build on ANY machine where Claude Code had set its model vars. Hit live
+  // packaging 1.19.209; the workaround was `env -u ANTHROPIC_DEFAULT_OPUS_MODEL`.
+  const env = {
+    ANTHROPIC_DEFAULT_OPUS_MODEL: 'claude-opus-5',
+    ANTHROPIC_DEFAULT_SONNET_MODEL: 'claude-sonnet-5',
+    ANTHROPIC_DEFAULT_HAIKU_MODEL: 'claude-haiku-4-5-20251001',
+    ANTHROPIC_MODEL: 'claude-opus-5-20260101',
+    ANTHROPIC_SMALL_FAST_MODEL: 'claude-haiku-4-5-20251001',
+    ANTHROPIC_BASE_URL: 'https://api.anthropic.com',
+    // ...and the ones that really are credentials, under the SAME provider prefix.
+    ANTHROPIC_API_KEY: 'sk-' + 'ant-' + randStr(31, 30, B64URL),
+    ANTHROPIC_AUTH_TOKEN: randStr(32, 40, B64URL),
+  };
+  const got = collectEnvSecrets(env);
+
+  for (const k of ['ANTHROPIC_DEFAULT_OPUS_MODEL', 'ANTHROPIC_DEFAULT_SONNET_MODEL',
+    'ANTHROPIC_DEFAULT_HAIKU_MODEL', 'ANTHROPIC_MODEL', 'ANTHROPIC_SMALL_FAST_MODEL',
+    'ANTHROPIC_BASE_URL']) {
+    assert.ok(!got.includes(env[k]), `${k} is a config identifier and must not be collected`);
+  }
+  // The exemption is on the NAME and must never reach a name carrying a secret word.
+  assert.ok(got.includes(env.ANTHROPIC_API_KEY), 'ANTHROPIC_API_KEY must still be collected');
+  assert.ok(got.includes(env.ANTHROPIC_AUTH_TOKEN), 'ANTHROPIC_AUTH_TOKEN must still be collected');
+  assert.equal(got.length, 2, 'exactly the two real credentials, nothing else');
+});
+
+test('the *_MODEL exemption cannot be used to smuggle a credential (task 1003512)', () => {
+  // A name that carries a secret WORD is collected whatever it ends with — the
+  // exemption applies only to names matched by the provider PREFIX alone. Without this,
+  // the fix would be a hole: these literals feed the PUBLIC mirror and session uploads.
+  const env = {
+    ANTHROPIC_SECRET_MODEL: randStr(33, 40, B64URL),
+    ANTHROPIC_API_KEY_MODEL: randStr(34, 40, B64URL),
+    OPENAI_TOKEN_BASE_URL: randStr(35, 40, B64URL),
+  };
+  const got = collectEnvSecrets(env);
+  for (const k of Object.keys(env)) {
+    assert.ok(got.includes(env[k]), `${k} carries a secret word and must still be collected`);
+  }
+});
+
+test('a model id survives a transcript scrub while a real key does not (task 1003512)', () => {
+  // The end-to-end shape of the bug: the model id is what package-core found verbatim
+  // in modules/grading and failed the build on. RECALL IS UNCHANGED for the credential.
+  const env = {
+    ANTHROPIC_DEFAULT_OPUS_MODEL: 'claude-opus-5',
+    ANTHROPIC_API_KEY: 'sk-' + 'ant-' + randStr(36, 30, B64URL),
+  };
+  const text = `the grader ran on ${env.ANTHROPIC_DEFAULT_OPUS_MODEL} using ${env.ANTHROPIC_API_KEY}`;
+  const out = scrubSecrets(text, collectEnvSecrets(env));
+  assert.ok(out.includes('claude-opus-5'), 'a model id is not a secret and must survive');
+  assert.ok(!out.includes(env.ANTHROPIC_API_KEY), 'the key must still be scrubbed');
+});
+
 test('self-reference `key = key` (SQL SET col = col) survives — zero recall loss', () => {
   // task 1688: the core packager redacts live SQL, so a `_token` COLUMN self-increment
   // must NOT be corrupted — while a real `key = <secret>` assignment is STILL redacted.