@bongos/core 1.19.867 → 1.19.869

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.867",
-  "core_contract": "1.19.867",
-  "source_commit": "3aa05b2cc6a4d35e89f51b1d0f8b30f65821c28e",
+  "core_version": "1.19.869",
+  "core_contract": "1.19.869",
+  "source_commit": "1c05e3dc3377bbcf20a40718645967ba72233f33",
   "source_ref": "HEAD",
-  "built_at": "2026-09-18T18:34:21.175Z",
+  "built_at": "2026-09-18T18:53:22.567Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 500,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2812,
-  "tree_sha256": "e71de0cc075fabe7cf7ec76a180926220f46264e5c4a7a00dc81e6c3857fb318",
+  "tree_sha256": "95583ff799fe688c99189403a7dd43769bb9fcd6497b578ff5ddd7704fc3c15e",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2602,7 +2602,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6f8b541208105ca92349cd4af1706a3d9847b2aee2e2fd18a1f4eca67162aedc"
+      "sha256": "76f1f5bc881e852c64c7b486e017ff4d1b12d28b341b1a5de39b652c1cf7f4d0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7927,12 +7927,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "da9e13ca079e6f4c0ff3f52a67503acdd25c85f36f51f9a9776227b504cdbb1b"
+      "sha256": "fae81f32534c62d0ed9a54fdd6a2671f4bcc1b4d16fc3ecb3dbfbb98b23e9fef"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "98ed92aea9cb7b7152b4d24d7b304f3363ae7e2174614ac7ee416a132ea47a77"
+      "sha256": "4bb8ccfe89e010be6ddde0cb7a301dc02d876b953679f175e28d5ca87b3192c1"
     },
     {
       "path": "public-docs/index.html",
@@ -8242,7 +8242,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "488a2a6c55c794625c47480def16c3b3fee81be4bd73d36a21f11a7feab741fc"
+      "sha256": "30fa12a96df4e9eda7e81f5abe3886caa0fb7dd277e37c5f6388c9acc429950e"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -9882,7 +9882,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "54d261c7d782f4214c4d75d777690d43fdcb305c57b8161b018745e6284eb143"
+      "sha256": "c67aa62fe4d84efbcdfd2658102ee5d2d929f9bb479d6e33e1acee5ddb84055e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10617,7 +10617,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "ac4c44006a151190a5ead99c7a32241cf95e21b3eca397ea7c0d4bf26b0b7de9"
+      "sha256": "36c52641c98217d42c38853c5dd78d4d4eb51ee97005380318db5adb2aa71d28"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
@@ -13087,7 +13087,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "f1cb5f34e9ecbd072b56840facdc57ca2b9d2fa6efc48427ce738cc65a72011f"
+      "sha256": "038940af4f863bb3efc096bf522351900fbcd393c0c117f3ac75fe3a0f05ffe7"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",

package/docs/module-api-changelog.md

@@ -2208,5 +2208,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.865 with no explicit bump. run 35355019469. (task 1002620)
   1.19.867 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.866 with no explicit bump. run 35380895321. (task 1002620)
+  1.19.868 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.867 with no explicit bump. run 35381947323. (task 1002620)
+  1.19.869 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.868 with no explicit bump. run 35382740500. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.867",
+  "version": "1.19.869",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.867",
+      "version": "1.19.869",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.867",
+  "version": "1.19.869",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -389,10 +389,37 @@ function renderStarterSettings() {
   }, null, 2)}\n`;
 }
 
-function transformSettings(srcPath) {
+// readSettingsTransform — the transform, as a result rather than a string:
+// { text, parsed, reason }. transformSettings below is the string face of it,
+// kept because that is what the tests and the historical callers use.
+//
+// WHY A PARSE FAILURE IS COPIED THROUGH UNTOUCHED (task 1004023). The old
+// fallback was `bongosify(raw)` — a best-effort regex rewrite over the whole
+// file. The script-invocation regex ends in an optional quote so it can swallow the
+// closing quote of a QUOTED PATH inside a command; run over raw JSON text it
+// swallows the JSON string's own closing quote instead:
+//
+//     bongosify('{"command": "node scripts/gds/strand-watch.js", }')
+//     -> {"command": "bongos exec scripts/gds/strand-watch.js, }
+//
+// So a file that was one trailing comma from valid was written to the instance
+// MORE broken than it arrived, with its strings running into each other. A
+// rewrite of text we could not parse is not worth a worse file: the raw bytes
+// are copied through unchanged and the caller is handed a reason to report. The
+// operator fixes one comma instead of unpicking mangled strings.
+//
+// The parse failure is NOT made fatal: the core's own settings.json is valid
+// JSON (pinned by a test), so reaching this means the operator has edited
+// theirs, and refusing the whole materialize over one file would be a worse
+// trade than copying it and saying so.
+function readSettingsTransform(srcPath) {
   const raw = fs.readFileSync(srcPath, 'utf8');
   let json;
-  try { json = JSON.parse(raw); } catch { return bongosify(raw); } // malformed → best-effort text rewrite
+  try {
+    json = JSON.parse(raw);
+  } catch (err) {
+    return { text: raw, parsed: false, reason: (err && err.message) || 'not valid JSON' };
+  }
   const hooks = json && json.hooks;
   if (hooks && typeof hooks === 'object') {
     for (const event of Object.values(hooks)) {
@@ -416,7 +443,14 @@ function transformSettings(srcPath) {
       perms[key] = [...new Set(rules.flatMap((r) => (typeof r === 'string' ? spellings(r) : [r])))];
     }
   }
-  return JSON.stringify(json, null, 2) + '\n';
+  return { text: JSON.stringify(json, null, 2) + '\n', parsed: true, reason: null };
+}
+
+// transformSettings — the string face of readSettingsTransform. A caller that
+// only wants the bytes keeps working; one that needs to know the file could not
+// be parsed calls readSettingsTransform and reads `parsed`.
+function transformSettings(srcPath) {
+  return readSettingsTransform(srcPath).text;
 }
 
 // Materialize the .claude/ surface from `coreRoot` into `instanceDir`. Returns a summary.
@@ -426,7 +460,7 @@ function transformSettings(srcPath) {
 const HOOK_TEXT_EXT = new Set(['.js', '.mjs', '.cjs', '.json', '.sh', '.md', '.txt']); // hooks are .js — rebrand them too
 
 function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite = true, log = () => {} }) {
-  const summary = { skipped: false, skills: 0, moduleSkills: 0, settings: false, hooks: 0, scheduledTasks: 0, skippedFiles: [], excludedSkills: [], withdrawnSkills: [], rebrandRules: 0, claudeMd: false, writtenPaths: [], notes: [] };
+  const summary = { skipped: false, skills: 0, moduleSkills: 0, settings: false, settingsUnparsed: false, hooks: 0, scheduledTasks: 0, skippedFiles: [], excludedSkills: [], withdrawnSkills: [], rebrandRules: 0, claudeMd: false, writtenPaths: [], notes: [] };
   // Every instance-relative path this run WROTE or REMOVED (task 1003957). `bongos upgrade`
   // hands these to persistPin as artifactPaths, exactly as task 1003926 already does for
   // regenerateApiArtifacts' output: committing only the pin left the materialized files dirty,
@@ -607,13 +641,22 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
       summary.skippedFiles.push('settings.json');
       log('  • .claude/settings.json already present — left untouched (adopt merges nothing here yet).');
     } else {
+      // task 1004023: an unparseable settings.json is copied through BYTE FOR
+      // BYTE — no bongosify, no rebrand. Both are regex passes written for the
+      // strings inside a parsed file, and over raw JSON text they damage it.
+      // The instance gets what the core had, plus a note naming the parse error.
+      const settingsOut = readSettingsTransform(settingsSrc);
       if (!dryRun) {
         fs.mkdirSync(destClaude, { recursive: true });
-        fs.writeFileSync(settingsDest, rebrand(transformSettings(settingsSrc)));
+        fs.writeFileSync(settingsDest, settingsOut.parsed ? rebrand(settingsOut.text) : settingsOut.text);
       }
       addWritten('.claude/settings.json');
       summary.settings = true;
-      log(`  ${dryRun ? '[dry-run] would write' : '✓ wrote'} .claude/settings.json (hook commands + permission rules→bongos, identity rebranded)`);
+      if (!settingsOut.parsed) {
+        summary.settingsUnparsed = true;
+        summary.notes.push(`.claude/settings.json is not valid JSON (${settingsOut.reason}) — copied through UNCHANGED: no hook-command or permission-rule rewrite to bongos, and no identity rebrand. Fix the JSON at the core root and materialize again, or edit the instance copy by hand.`);
+      }
+      log(`  ${dryRun ? '[dry-run] would write' : '✓ wrote'} .claude/settings.json ${settingsOut.parsed ? '(hook commands + permission rules→bongos, identity rebranded)' : '(UNCHANGED — not valid JSON, nothing rewritten)'}`);
     }
   } else {
     // Package-only install: the core root carries no settings.json to copy, so
@@ -802,4 +845,4 @@ if (require.main === module) {
   process.exit(s.refused.length ? 1 : 0);
 }
 
-module.exports = { scriptToVerb, bongosify, transformSettings, renderStarterSettings, STARTER_ALLOW, copyTreeTransformed, materializeClaude, materializeModuleSkillsIntoCore, isCoreCheckoutRoot, readModuleSkillsManifest, MODULE_SKILLS_MANIFEST, readInstanceSkillsManifest, INSTANCE_SKILLS_MANIFEST, GDS_INVOCATION_RE, buildRebrandRules, rebrandText, disabledModuleSkills, moduleSkillRoster, moduleSkillSources, vendoredSkillGate, SKILL_NAME_RE, VENDOR_DEFAULT_POLICY };
+module.exports = { scriptToVerb, bongosify, transformSettings, readSettingsTransform, renderStarterSettings, STARTER_ALLOW, copyTreeTransformed, materializeClaude, materializeModuleSkillsIntoCore, isCoreCheckoutRoot, readModuleSkillsManifest, MODULE_SKILLS_MANIFEST, readInstanceSkillsManifest, INSTANCE_SKILLS_MANIFEST, GDS_INVOCATION_RE, buildRebrandRules, rebrandText, disabledModuleSkills, moduleSkillRoster, moduleSkillSources, vendoredSkillGate, SKILL_NAME_RE, VENDOR_DEFAULT_POLICY };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.867'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.869'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -832,5 +832,65 @@ t("an instance's OWN settings.json is never clobbered", () => {
   rmSync(inst, { recursive: true, force: true });
 });
 
+// ---- an unparseable settings.json is copied through, not mangled (task 1004023) ----
+// THE DEFECT. The fallback was `bongosify(raw)` — the command-string rewrite run over
+// the whole FILE. The script-invocation regex ends in an optional quote so it can swallow the
+// closing quote of a quoted PATH; over raw JSON text it swallows the JSON string's own
+// closing quote, and a file one trailing comma from valid was written to the instance
+// with its strings running into each other. The load-bearing assertion is therefore the
+// BYTE-EQUALITY one: the fix is not "rewrite it better", it is "do not rewrite what you
+// could not parse".
+const BROKEN_SETTINGS = '{"command": "node scripts/gds/strand-watch.js", }'; // one trailing comma from valid
+
+t('readSettingsTransform: malformed JSON is reported, not rewritten', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'w3-bad-'));
+  const p = join(dir, 'settings.json');
+  writeFileSync(p, BROKEN_SETTINGS);
+  const out = m.readSettingsTransform(p);
+  assert.equal(out.parsed, false, 'a trailing comma must be reported as unparseable');
+  assert.equal(out.text, BROKEN_SETTINGS, 'the bytes must come through untouched');
+  assert.ok(out.reason && out.reason.length > 0, 'the caller needs something to print');
+  // The specific corruption from the bug report must not be reachable any more.
+  assert.ok(!out.text.includes('bongos exec'), 'the command rewrite ran over text it could not parse');
+  assert.equal((out.text.match(/"/g) || []).length, (BROKEN_SETTINGS.match(/"/g) || []).length,
+    'a quote was eaten — this is the exact shape of the original defect');
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('readSettingsTransform: valid JSON still gets the full rewrite', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'w3-good-'));
+  const p = join(dir, 'settings.json');
+  writeFileSync(p, JSON.stringify({ permissions: { allow: ['Bash(node scripts/gds/ship.js:*)'] } }, null, 2));
+  const out = m.readSettingsTransform(p);
+  assert.equal(out.parsed, true);
+  assert.ok(out.text.includes('bongos'), 'the parseable path must still rewrite to the bongos bin');
+  assert.equal(out.reason, null);
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('transformSettings keeps its string contract for existing callers', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'w3-str-'));
+  const p = join(dir, 'settings.json');
+  writeFileSync(p, BROKEN_SETTINGS);
+  assert.equal(typeof m.transformSettings(p), 'string');
+  assert.equal(m.transformSettings(p), BROKEN_SETTINGS);
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('materializeClaude: a broken core settings.json reaches the instance unchanged, with a note', () => {
+  const core = mkdtempSync(join(tmpdir(), 'bad-core-'));
+  const inst = mkdtempSync(join(tmpdir(), 'bad-inst-'));
+  mkdirSync(join(core, '.claude'), { recursive: true });
+  writeFileSync(join(core, '.claude', 'settings.json'), BROKEN_SETTINGS);
+  const summary = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.equal(readFileSync(join(inst, '.claude', 'settings.json'), 'utf8'), BROKEN_SETTINGS,
+    'the instance must receive exactly what the core had, not a worse file');
+  assert.equal(summary.settingsUnparsed, true, 'the summary must record that nothing was rewritten');
+  assert.ok(summary.notes.some((n) => n.includes('not valid JSON')),
+    'a silent copy-through is how an operator never learns their hooks were not rewritten');
+  rmSync(core, { recursive: true, force: true });
+  rmSync(inst, { recursive: true, force: true });
+});
+
 console.log(`\nclaude_materialize: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/reward_gate.mjs

@@ -261,8 +261,16 @@ t('createTask logs a [creation] audit line on auto-assign', () => {
   // rather than depending on a magic window size. A fixed 4800-char window
   // silently broke when task 1763 added the goal_id fallback before the INSERT,
   // sliding the [creation] audit line past its end.
+  // The `end > start ? end : <bytes>` ternary this used to carry defeated its own
+  // purpose: a renamed or reordered boundary symbol did not fail, it quietly
+  // reverted to exactly the magic window the anchor was introduced to remove,
+  // while the comment above still told the next reader the slice was anchored
+  // (task 1004016). Assert the boundary instead.
   const end = dbSrc.indexOf('async function findTaskBySourceRef', start);
-  const body = dbSrc.slice(start, end > start ? end : start + 6000);
+  assert.ok(start >= 0, 'createTask not found in the lifecycle data layer');
+  assert.ok(end > start,
+    'findTaskBySourceRef boundary not found — re-anchor this slice to whatever function now follows createTask');
+  const body = dbSrc.slice(start, end);
   assert.match(body, /suggestCreditsReward/, 'createTask must reuse the capped helper');
   assert.match(body, /\[reward-gate\] AUTO-ASSIGN.*\[creation\]/s, 'createTask must log a [creation] audit line');
 });
@@ -277,8 +285,12 @@ t('POST /tasks surfaces the assigned credits_reward in the 201 response', () =>
   // `credits_reward: task.credits_reward` response line to offset 11027, 27 chars
   // past the window — failing on main and reddening every PR's `unit` check
   // (task 2026; supersedes the never-pushed task 1967, same brittleness).
+  // Same defect as the createTask sibling above, same fix (task 1004016): the
+  // fallback window made a lost boundary invisible.
   const end = tasksRouteSrc.indexOf('router.', start + 'router.post'.length);
-  const body = tasksRouteSrc.slice(start, end > start ? end : start + 13000);
+  assert.ok(end > start,
+    'next router registration not found — re-anchor this slice to whatever follows the POST /tasks handler');
+  const body = tasksRouteSrc.slice(start, end);
   assert.match(body, /credits_reward: task\.credits_reward/, 'response must surface the born-with reward');
 });