@bongos/core 1.19.810 → 1.19.811

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.810",
-  "core_contract": "1.19.810",
-  "source_commit": "a3d5dcdde5918a6ce46742502351896701a5a312",
+  "core_version": "1.19.811",
+  "core_contract": "1.19.811",
+  "source_commit": "8dc3b188ab249c84103920e82ce8021dc55487ed",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T06:04:48.341Z",
+  "built_at": "2026-09-17T06:20:04.579Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 487,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2710,
-  "tree_sha256": "43e8bede11fa1d3c211405b457b91c73433af719f13cf34869cd9894607688b7",
+  "tree_sha256": "7f3e8838baaa79070aa7705d761e9613297767dc1391cbf4f2ba0492339cd9b1",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2532,7 +2532,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "559a5a32d7f2bbdfc6059b033898244d10bba1abc6881cc9d42388d135c1a164"
+      "sha256": "bb4fbb214534d6224c13b6c6aa283ca18d762fc46482842169505bb7c58d6308"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7727,12 +7727,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "85db67c033657807d558c218faa46b3a94719479ca312e38fee928ea8e845d2a"
+      "sha256": "d922e9276bdb8d89f5998de6f4b29dbc98d897e5a7acfc11d0ceeb2b11e89178"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1ea12b0f66807661d162a59b47b20a2e166b5d356f88a766240c8a573cf95859"
+      "sha256": "98f193e8dfee8bab41773622a373d2c19efafa8fb7bdeaf6e2c43f2032651d24"
     },
     {
       "path": "public-docs/index.html",
@@ -9622,7 +9622,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a73a30f63258ab08abe959da6d8f31f8428c30c5d49772350beecb72e9131b2f"
+      "sha256": "7cbce9c1f2bed1a8fe7a8cff1cfee09c702ee66fa719829ff347087bf86fb7bc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10327,7 +10327,7 @@
     {
       "path": "tests/cli_exit_no_abort.mjs",
       "mode": "0000644",
-      "sha256": "9772748fe60b831b26c41eab5b12e228d89fb7231065dfbdc527e47207104e36"
+      "sha256": "39b63a76b153426f486240e4c57d4fafb2b5b130fb9853c800d20d9f4e5acdde"
     },
     {
       "path": "tests/cli_lib_formatters.mjs",
@@ -12857,7 +12857,7 @@
     {
       "path": "tests/session_caps.mjs",
       "mode": "0000644",
-      "sha256": "72acabf6ffa1721f9b4ec7d2c8f7b1def31b7af4f7b40ac918045201a2b88b61"
+      "sha256": "b08260c077dca811eec663b0f32618ef1a5e28c78a427b907f0c451ee68fc196"
     },
     {
       "path": "tests/session_cost.mjs",

package/docs/module-api-changelog.md

@@ -2094,5 +2094,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.808 with no explicit bump. run 35187322516. (task 1002620)
   1.19.810 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.809 with no explicit bump. run 35188253911. (task 1002620)
+  1.19.811 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.810 with no explicit bump. run 35189324772. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.810",
+  "version": "1.19.811",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.810",
+      "version": "1.19.811",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.810",
+  "version": "1.19.811",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.810'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.811'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cli_exit_no_abort.mjs

@@ -493,3 +493,48 @@ test('main-audit.js exits 0 after a SUCCESSFUL roster request — the teardown t
     proc.kill();
   }
 });
+
+// ---- tests/session_caps.mjs (task 1003827) ----
+//
+// Not a CLI, but the same abort and the same cure. It printed "9 passed, 0
+// failed" and then died 127 in 4 of 6 runs on Windows + Node 24. run-unit-tests.js
+// reads the exit code, so a suite that fully passed was reported FAILED in most
+// local baselines — which is worse than a plain red, because it teaches builders
+// that a failing name is environmental noise.
+const SESSION_CAPS = path.join(ROOT, 'tests', 'session_caps.mjs');
+
+test('session_caps.mjs exits 0 after its server teardown, repeatedly (task 1003827)', () => {
+  // Three runs, because the abort was NONDETERMINISTIC — a single clean run
+  // proved nothing before the fix and would prove nothing after a regression.
+  for (let i = 0; i < 3; i++) {
+    const r = spawnSync(process.execPath, [SESSION_CAPS], { encoding: 'utf8', timeout: 60000 });
+    assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — a leaked handle, which is what removing the hard exit risks`);
+    assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively:\n${r.stderr}`);
+    assert.equal(r.status, 0, `run ${i + 1} exited ${r.status} (127 = the abort); stderr: ${r.stderr}`);
+    assert.match(r.stdout || '', /0 failed/, `run ${i + 1} did not report a passing suite`);
+  }
+});
+
+test('session_caps.mjs sets exitCode rather than calling process.exit (task 1003827)', () => {
+  // The deterministic half: the behavioural test above can pass by luck on a
+  // platform where the race does not fire, so the shape is pinned directly.
+  const src = fs.readFileSync(SESSION_CAPS, 'utf8');
+  // Comments stripped first: the fix's own comment explains what it does NOT do
+  // and names the call, so a raw scan matches the prose and reds a correct file.
+  // (Caught by this test on its first run — the guard found its own false positive.)
+  const code = src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+  // Anti-vacuity: prove the pattern MATCHES something before trusting that it
+  // matches nothing here. A scanner that silently finds nothing looks identical
+  // to a scanner that works — and stripping comments is exactly the kind of step
+  // that can blank the haystack.
+  const HARD_EXIT = /process\.exit\s*\(/;
+  assert.match('process.exit(1)', HARD_EXIT, 'control: the pattern must detect a hard exit');
+  assert.ok(src.length > 1000, 'control: the suite was actually read');
+  assert.ok(code.length > src.length / 2, 'control: stripping comments did not blank the source');
+  assert.match(code, /server\.listen/, 'control: real code survived the strip');
+  assert.doesNotMatch(code, HARD_EXIT, 'session_caps.mjs must set process.exitCode and let the loop drain');
+  assert.match(code, /process\.exitCode\s*=/, 'and it must still report failure through the exit code');
+  // The other half of the cure: a hard exit MASKS leaked handles, so dropping it
+  // without releasing the keep-alive sockets trades the crash for a hang.
+  assert.match(code, /closeAllConnections/, 'sockets must be released before server.close()');
+});

package/tests/session_caps.mjs

@@ -221,6 +221,10 @@ try {
     assert.equal(fixture.upserts.length, 0);
   });
 } finally {
+  // Drop keep-alive sockets BEFORE close(). fetch()'s global agent holds them
+  // open, and server.close() only stops new connections — it waits on the live
+  // ones, so without this the process would linger instead of exiting.
+  if (typeof server.closeAllConnections === 'function') server.closeAllConnections();
   await new Promise((resolve) => server.close(resolve));
   auth.requireBuilder = orig.requireBuilder;
   db.filterTaskIdsClaimedBy = orig.filterTaskIdsClaimedBy;
@@ -235,4 +239,15 @@ await t('the audit body cap constant is exported and sane', () => {
 });
 
 console.log(`\n${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);
+// NOT process.exit(). On Windows this suite aborted in roughly two runs of three
+// — "Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c"
+// — exiting 127 AFTER printing "9 passed, 0 failed", because the hard exit tore
+// the loop down while fetch's handles were still closing. run-unit-tests.js reads
+// the exit code, so a fully-passing suite reported FAILED in every Windows
+// baseline, which trains builders to wave off real failures as environmental.
+// Setting the code and letting the loop drain is the same cure scripts/gds/
+// CLAUDE.md documents for the CLI scripts (cliExit) and tests/cli_exit_no_abort.mjs
+// guards for api.js. The closeAllConnections() above is the other half: a hard
+// exit MASKS a leaked handle, so removing it without releasing the sockets would
+// have traded a crash for a hang.
+process.exitCode = failed === 0 ? 0 : 1;