@bongos/core 1.19.87 → 1.19.88

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.87",
-  "core_contract": "1.19.87",
-  "source_commit": "87978cd9aae6450f9a950000264a6ea3290061a9",
+  "core_version": "1.19.88",
+  "core_contract": "1.19.88",
+  "source_commit": "c8c0a186e2cb9d4b138aff7e5b7b8e982140299e",
   "source_ref": "HEAD",
-  "built_at": "2026-08-13T00:58:58.091Z",
+  "built_at": "2026-08-13T01:05:59.928Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 296,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1551,
-  "tree_sha256": "76b44f6926a63b7efc6f1458fa1ddb8be237a801879982bddf6c97628d35762f",
+  "tree_sha256": "97f1e5d8f01e72085d52764e6954b927d3cfe325ec7d0a44d82cab2401ac61af",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2597,7 +2597,7 @@
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
-      "sha256": "8d2dc69a139a5a658866a18527efeb5d9ae989e05883fa6cbd0ea63db0ba9476"
+      "sha256": "9357b423836c4e8d2cd3c9144d294c3cd3b498ac30755a9e6f62b5bbaa2add5e"
     },
     {
       "path": "modules/dev-box/box-credential.js",
@@ -4087,12 +4087,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b3c0559dd15714741dd52b1493e31d0c58b400f29da9b5af0dd410559e890458"
+      "sha256": "ee871b7fe7f5f5b855c766487d04af28b66213cb018fffa9ecf87146b1127f9a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c7433c4d5b1fc188cc1660b3ed0cffd2f9d669fc5974f072af2b2816324efc09"
+      "sha256": "3b60b19b3d6f3ce6601f14cb118d79e6438673feb228a6221c18f94da6032a68"
     },
     {
       "path": "public-docs/index.html",
@@ -5727,7 +5727,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3711343a6ac760f4742b14755a1e40722842fce3f29855804a092fdc72da6bb9"
+      "sha256": "592a0682457594b8192024b85aea705d3ab3e31f318bf6558c9af7a0399aced0"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6007,7 +6007,7 @@
     {
       "path": "tests/box_access.mjs",
       "mode": "0000644",
-      "sha256": "06e8afe871803c92b20c28b918e39804a1616ee3b5773517f5ac804118d2de1d"
+      "sha256": "694153e377a78d4325aa4ff9b947f691d71362f843da25815b9740821903802c"
     },
     {
       "path": "tests/box_auth_check.mjs",

package/modules/dev-box/box-access.js

@@ -151,6 +151,13 @@ const BASE_SPARSE_PATHS = [
   // so a box holding the module source but not tests/ cannot verify a change.
   // A cone-mode directory; it carries no product runtime, only test code.
   'tests',
+  // clients/ — the generated bongos-client (ADR 0118) that cli-lib.js hard-imports
+  // since task 1996 made it the CLI's one HTTP client. Without it EVERY /builder-*
+  // command on the box dies at import, and the builder cannot self-heal: the
+  // workspace is a token-less blob:none clone (sparse-checkout add can't fetch)
+  // and box-source-fetch re-applies this server-computed list every tick
+  // (task 1002745). Generated ESM only, no product runtime.
+  'clients',
 ];
 
 // sparsePathsForScopeKeys — PURE. Given the module KEYS a builder's active claims

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.87",
+  "version": "1.19.88",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.87",
+      "version": "1.19.88",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.87",
+  "version": "1.19.88",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -601,8 +601,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.85 with no explicit bump. run 31655210981. (task 1002620)
 //   1.19.87 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.86 with no explicit bump. run 31656188572. (task 1002620)
+//   1.19.88 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.87 with no explicit bump. run 31656577595. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.87'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.88'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_access.mjs

@@ -194,7 +194,9 @@ const BASE = access.BASE_SPARSE_PATHS;
 console.log('\nBASE_SPARSE_PATHS — the non-product base a task-scoped box layers on:');
 
 t('BASE carries the methodology + tooling, NOT the product/game', () => {
-  for (const p of ['.devcontainer', '.claude', 'scripts', 'src/bongos', 'docs', 'infra', 'tests']) {
+  // clients/ is load-bearing: cli-lib.js hard-imports clients/bongos-client, so a
+  // cone without it has a fully dead builder CLI on the box (task 1002745).
+  for (const p of ['.devcontainer', '.claude', 'scripts', 'src/bongos', 'docs', 'infra', 'tests', 'clients']) {
     assert.ok(BASE.includes(p), `BASE must include ${p}`);
   }
   for (const p of ['src/world', 'src/rooms', 'public', 'art', 'modules/status-ui']) {