@bongos/core 1.19.959 → 1.19.961

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.959",
-  "core_contract": "1.19.959",
-  "source_commit": "762c63db2672a1dac87eb25a78bd3a93717b6d1a",
+  "core_version": "1.19.961",
+  "core_contract": "1.19.961",
+  "source_commit": "3fcce81c02ff8f86ac82136adfd4cce03348276e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T14:26:09.898Z",
+  "built_at": "2026-09-22T17:02:03.530Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 514,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2898,
-  "tree_sha256": "f587a606503aa60197f7ffbed71f7a3df76cfafda2da9b932090732dfc2cc512",
+  "tree_sha256": "4ee911e95dcbcebf819995be154e75e71792e254146dc985f87a7169436dc991",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2692,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "164da9dadc56356e91897f78786de7c42b32e37534971b6743985abeba81d718"
+      "sha256": "5bf8c52a9f98a70921b5ffd5bf0f1ea5f23b47f1811878dfe0cfb14087f933f2"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8082,12 +8082,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e0d9870134171629f6021c929775456f72729ad7131249f17c5e99cd64d2405f"
+      "sha256": "38f8cbf244904b0708737b90371360be13c0bb5d02f5a9d003185ac2126d1dd9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "830c6340ff774389b6a391c8045116ccabc871a23ba09688e03380892f340a2a"
+      "sha256": "4712ed033588d5a735c335f7be7832974aa8bdfb2a7af12e52ac97eee58aca84"
     },
     {
       "path": "public-docs/index.html",
@@ -8432,7 +8432,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "2209cc2ca1476efc0af464e6e58ae87c5a5dc8d5a70b2ad067867adbfe0aab06"
+      "sha256": "1bee053fafde559fad140069438ef41a3b5f8055cdc6330f159b7f9b4e9994c6"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -10092,7 +10092,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "73781b940ba631e4642209a973a119375f7ff12f23027033030b1c95f0cc45f7"
+      "sha256": "ef293afa22d4735a665fa78a6aa13f251fd121f40b55fafa0e651c20aea5132f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10872,7 +10872,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "60eb54f19f26f3557afd6b12f0f2867208638a2b6547f58abd192b6f07e805c3"
+      "sha256": "256b4192e1ef8fb43539313c569b21435926ef9d149b04cd4903e342fcf14d45"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",

package/docs/module-api-changelog.md

@@ -2392,5 +2392,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.957 with no explicit bump. run 35735231183. (task 1002620)
   1.19.959 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.958 with no explicit bump. run 35740227000. (task 1002620)
+  1.19.960 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.959 with no explicit bump. run 35755397900. (task 1002620)
+  1.19.961 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.960 with no explicit bump. run 35757951835. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.959",
+  "version": "1.19.961",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.959",
+      "version": "1.19.961",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.959",
+  "version": "1.19.961",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -385,12 +385,44 @@ const STARTER_COMMANDS = [
 const STARTER_SHELL_TOOLS = ['Bash', 'PowerShell'];
 const STARTER_ALLOW = STARTER_SHELL_TOOLS.flatMap((tool) => STARTER_COMMANDS.map((command) => `${tool}(${command})`));
 
+// The deny half (task 1003966): what the local agent may not READ. Keys are the
+// same exposure on every instance, so those rules ship verbatim.
+const STARTER_DENY_SECRETS = [
+  'Read(.env)', 'Read(**/.env)', 'Read(.env.local)', 'Read(**/.env.local)',
+  'Read(.env.*.local)', 'Read(**/.env.*.local)',
+  'Read(**/*.pem)', 'Read(**/id_rsa*)', 'Read(**/id_ed25519*)',
+];
+const SESSION_STORE_DENY = `Read(~/.config/${ic.FALLBACK_DIR}/instances/**)`;
+
+// A checkout's settings.json takes the identity rebrand like every copied file, and the store's
+// dir is one of the core's `.config/<dir>` literals it rewrites. The store does not move with the
+// brand (task 1003741), so its rule is put back where the CLI reads it (task 1004155).
+function rebrandSettings(text, rebrand) {
+  const moved = rebrand(SESSION_STORE_DENY);
+  return rebrand(text).split(JSON.stringify(moved)).join(JSON.stringify(SESSION_STORE_DENY));
+}
+
+// Credential files are derived from where the CLI actually reads them, not rebranded from the
+// core's literals: the rebrand would also move the host-keyed store, which sits at a fixed anchor
+// whatever the brand (cli-lib sessionStoreDir, task 1003741). The shelf rule is the only layer an
+// instance gets against the repo-global stash stack, since the git-guard hook does not ship.
+function starterDeny(branding = {}) {
+  const dirs = [...new Set([effConfigDir(branding), ...ic.LEGACY_DIRS])];
+  const credentialFiles = ['env', ...ic.SESSION_FILENAMES];
+  return [
+    ...STARTER_DENY_SECRETS,
+    ...dirs.flatMap((dir) => credentialFiles.map((file) => `Read(~/.config/${dir}/${file})`)),
+    SESSION_STORE_DENY,
+    ...STARTER_SHELL_TOOLS.map((tool) => `${tool}(git stash:*)`),
+  ];
+}
+
 // The starter an instance gets when the core root carries no settings.json — a
 // package-only install. Permissions ONLY: no hooks (they are topology), no env.
-function renderStarterSettings() {
+function renderStarterSettings(branding = {}) {
   return `${JSON.stringify({
-    _doc: 'Starter written by scripts/gds/claude-materialize.js (task 1003962). Permissions only — the blessed Bongos commands, mirroring the core repo\'s own allow-list (ADR 0104). An allow-rule lets the local agent RUN a command; it grants no authority, which the server decides per request from your live rank (ADR 0016). Yours to edit: a later materialize never clobbers this file.',
-    permissions: { allow: STARTER_ALLOW },
+    _doc: 'Starter written by scripts/gds/claude-materialize.js (tasks 1003962, 1003966). Permissions only — the blessed Bongos commands, mirroring the core repo\'s own allow-list (ADR 0104), and the deny rules that keep the local agent from reading keys and session tokens. An allow-rule lets the local agent RUN a command; it grants no authority, which the server decides per request from your live rank (ADR 0016). Yours to edit: a later materialize never clobbers this file.',
+    permissions: { allow: STARTER_ALLOW, deny: starterDeny(branding) },
   }, null, 2)}\n`;
 }
 
@@ -661,7 +693,7 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
       const settingsOut = readSettingsTransform(settingsSrc);
       if (!dryRun) {
         fs.mkdirSync(destClaude, { recursive: true });
-        fs.writeFileSync(settingsDest, settingsOut.parsed ? rebrand(settingsOut.text) : settingsOut.text);
+        fs.writeFileSync(settingsDest, settingsOut.parsed ? rebrandSettings(settingsOut.text, rebrand) : settingsOut.text);
       }
       addWritten('.claude/settings.json');
       summary.settings = true;
@@ -685,7 +717,7 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
     } else {
       if (!dryRun) {
         fs.mkdirSync(destClaude, { recursive: true });
-        fs.writeFileSync(settingsDest, renderStarterSettings());
+        fs.writeFileSync(settingsDest, renderStarterSettings(toBranding));
       }
       addWritten('.claude/settings.json');
       summary.settings = true;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.959'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.961'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -18,14 +18,16 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, readdirSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, dirname } from 'node:path';
+import { tmpdir, homedir } from 'node:os';
+import { join, dirname, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const m = require('../scripts/gds/claude-materialize.js');
 const claim = require('../scripts/gds/claim.js');
+const cliLib = require('../scripts/gds/cli-lib.js');
+const ic = require('../src/instance-config.js');
 // The live verb table, so a starter allow-rule naming a verb that does not exist
 // fails here rather than shipping as an inert permission (task 1003962).
 const { VERBS: cliVerbs } = require('../bin/bongos.js');
@@ -804,6 +806,85 @@ t('a package-only install (no settings.json at the core root) GETS the starter',
   rmSync(inst, { recursive: true, force: true });
 });
 
+// task 1003966 — the starter shipped the allow half alone: the convenience with none of the
+// hardening. The deny half is what stops the agent reading a key or a session token.
+const starterDenyFor = (branding) => JSON.parse(m.renderStarterSettings(branding)).permissions.deny;
+const homeRel = (abs) => `~/${relative(homedir(), abs).split(sep).join('/')}`;
+
+t("a package-only install gets the deny rules, pointed at THAT instance's config dir", () => {
+  const core = mkdtempSync(join(tmpdir(), 'w3-deny-core-'));
+  const inst = mkdtempSync(join(tmpdir(), 'w3-deny-inst-'));
+  mkdirSync(join(core, '.claude', 'skills'), { recursive: true });
+  mkdirSync(join(inst, 'config'), { recursive: true });
+  writeFileSync(join(inst, 'config', 'branding.json'), JSON.stringify({ configDir: 'acme', envPrefix: 'ACME' }));
+  m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  const deny = JSON.parse(readFileSync(join(inst, '.claude', 'settings.json'), 'utf8')).permissions.deny;
+  assert.ok(Array.isArray(deny), 'the starter must carry permissions.deny');
+  for (const secret of ['Read(**/.env)', 'Read(**/.env.*.local)', 'Read(**/*.pem)', 'Read(**/id_rsa*)']) {
+    assert.ok(deny.includes(secret), `missing ${secret}`);
+  }
+  assert.ok(deny.includes('Read(~/.config/acme/bongos-session.json)'), "the instance's OWN session file");
+  assert.deepEqual(deny.filter((r) => /\.config\/(?!acme\/)/.test(r) && !r.startsWith(`Read(${homeRel(cliLib.sessionStoreDir())}`)
+    && !ic.LEGACY_DIRS.some((d) => r.includes(`.config/${d}/`))), [],
+    "a session rule naming another brand's dir guards the wrong path and leaves this one open");
+  for (const tool of ['Bash', 'PowerShell']) assert.ok(deny.includes(`${tool}(git stash:*)`), `${tool}(git stash:*)`);
+  rmSync(core, { recursive: true, force: true });
+  rmSync(inst, { recursive: true, force: true });
+});
+
+t('every file the CLI reads a session from is denied, the host-keyed store included', () => {
+  // Pinned to cli-lib's own read list, so a new session filename or dir fails HERE.
+  let brand = {};
+  try { brand = require('../src/branding').branding(); } catch { /* unbranded checkout */ }
+  const deny = starterDenyFor(brand);
+  for (const p of cliLib.SESSION_READ_PATHS) assert.ok(deny.includes(`Read(${homeRel(p)})`), `Read(${homeRel(p)})`);
+  assert.ok(deny.includes(`Read(${homeRel(cliLib.sessionStoreDir())}/**)`),
+    'the store sits at a fixed anchor whatever the brand (task 1003741), so it is never rebranded');
+});
+
+t("every deny rule in the core's own settings.json reaches the starter", () => {
+  // The two lists drift the way the allow halves could: a rule added to the core
+  // protects the core and silently no instance. A config-dir file is compared by
+  // name, in the instance's dir; everything else — the fixed session store included — must match
+  // verbatim.
+  const core = JSON.parse(readFileSync(join(ROOT, '.claude', 'settings.json'), 'utf8')).permissions.deny;
+  const deny = starterDenyFor({ configDir: 'acme' });
+  const store = `Read(${homeRel(cliLib.sessionStoreDir())}/**)`;
+  for (const rule of core) {
+    const cfg = rule !== store && rule.match(/^Read\(~\/\.config\/[^/]+\/(.+)\)$/);
+    const want = cfg ? `Read(~/.config/acme/${cfg[1]})` : rule;
+    assert.ok(deny.includes(want), `core deny ${rule} → starter must carry ${want}`);
+  }
+});
+
+// task 1004155 — the core's own list named two legacy session files and missed the active one
+// (bongos-session.json) and the host-keyed store, so the core's agent could read the live token.
+t("the core's OWN deny list covers every file the CLI reads a session from, and the store", () => {
+  const deny = JSON.parse(readFileSync(join(ROOT, '.claude', 'settings.json'), 'utf8')).permissions.deny;
+  // The core carries no branding.json, so its CLI reads the fallback dir plus the legacy ones.
+  const sessionFiles = ic.configReadDirs({}).flatMap((dir) => ic.SESSION_FILENAMES.map((f) => join(dir, f)));
+  for (const p of [...sessionFiles, `${cliLib.sessionStoreDir()}/**`]) {
+    assert.ok(deny.includes(`Read(${homeRel(p)})`), `core deny is missing Read(${homeRel(p)})`);
+  }
+});
+
+t('a checkout-materialized instance keeps the session-store rule at its fixed anchor', () => {
+  // The rebrand rewrites every `.config/<core dir>` literal, and the store's dir is one of them —
+  // but the store does not move with the brand, so a rebranded rule guards a dir nothing reads.
+  const core = mkdtempSync(join(tmpdir(), 'w3-store-core-'));
+  const inst = mkdtempSync(join(tmpdir(), 'w3-store-inst-'));
+  mkdirSync(join(core, '.claude', 'skills'), { recursive: true });
+  const store = `Read(${homeRel(cliLib.sessionStoreDir())}/**)`;
+  writeFileSync(join(core, '.claude', 'settings.json'), JSON.stringify({ permissions: { deny: [store] } }));
+  mkdirSync(join(inst, 'config'), { recursive: true });
+  writeFileSync(join(inst, 'config', 'branding.json'), JSON.stringify({ configDir: 'acme', envPrefix: 'ACME' }));
+  m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  const deny = JSON.parse(readFileSync(join(inst, '.claude', 'settings.json'), 'utf8')).permissions.deny;
+  assert.deepEqual(deny, [store]);
+  rmSync(core, { recursive: true, force: true });
+  rmSync(inst, { recursive: true, force: true });
+});
+
 // task 1004012 — the other source: a CHECKOUT core root does carry a settings.json, and the
 // instance used to receive its allow-list verbatim, naming scripts its skills no longer run.
 t('a checkout-materialized instance gets allow-rules in the bongos form, end to end', () => {