@bongos/core 1.19.960 → 1.19.961

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.960",
-  "core_contract": "1.19.960",
-  "source_commit": "07224a002beb8673193550edb973a83f63733ac9",
+  "core_version": "1.19.961",
+  "core_contract": "1.19.961",
+  "source_commit": "3fcce81c02ff8f86ac82136adfd4cce03348276e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T16:38:38.841Z",
+  "built_at": "2026-09-22T17:02:03.530Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 514,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2898,
-  "tree_sha256": "de8dc0908595fb0f613026497e94dc03c3a50bb631a2adc952bdaefedcb96199",
+  "tree_sha256": "4ee911e95dcbcebf819995be154e75e71792e254146dc985f87a7169436dc991",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2692,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "4cc28a5f552998a430d1d1ecb6ec1882607ccd555f5d2e01c7a2197b6414b67a"
+      "sha256": "5bf8c52a9f98a70921b5ffd5bf0f1ea5f23b47f1811878dfe0cfb14087f933f2"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8082,12 +8082,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f1832d9a38929a6d0cd0a93720088edcba0cc7952bbe2df7d57ec0986c1dea49"
+      "sha256": "38f8cbf244904b0708737b90371360be13c0bb5d02f5a9d003185ac2126d1dd9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "98d101c939c100960c78ea1887fd429720d643c3931840ac847df15544312e72"
+      "sha256": "4712ed033588d5a735c335f7be7832974aa8bdfb2a7af12e52ac97eee58aca84"
     },
     {
       "path": "public-docs/index.html",
@@ -8432,7 +8432,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "717de4da1c2e966aff2cb8dff997a4cedcf5d92eea85a9ceeb75118bef1f6859"
+      "sha256": "1bee053fafde559fad140069438ef41a3b5f8055cdc6330f159b7f9b4e9994c6"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -10092,7 +10092,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "23025d957268d4f44b0a2a8a552f1371a9c50af1220239de8ca3fd9b0bd605f3"
+      "sha256": "ef293afa22d4735a665fa78a6aa13f251fd121f40b55fafa0e651c20aea5132f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10872,7 +10872,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "0f0d53e5c63f9b776aa5ea9c2e0408e350e54230ee0c214af26faf34eaa7bb5f"
+      "sha256": "256b4192e1ef8fb43539313c569b21435926ef9d149b04cd4903e342fcf14d45"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",

package/docs/module-api-changelog.md

@@ -2394,5 +2394,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.958 with no explicit bump. run 35740227000. (task 1002620)
   1.19.960 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.959 with no explicit bump. run 35755397900. (task 1002620)
+  1.19.961 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.960 with no explicit bump. run 35757951835. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.960",
+  "version": "1.19.961",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.960",
+      "version": "1.19.961",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.960",
+  "version": "1.19.961",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -392,6 +392,15 @@ const STARTER_DENY_SECRETS = [
   'Read(.env.*.local)', 'Read(**/.env.*.local)',
   'Read(**/*.pem)', 'Read(**/id_rsa*)', 'Read(**/id_ed25519*)',
 ];
+const SESSION_STORE_DENY = `Read(~/.config/${ic.FALLBACK_DIR}/instances/**)`;
+
+// A checkout's settings.json takes the identity rebrand like every copied file, and the store's
+// dir is one of the core's `.config/<dir>` literals it rewrites. The store does not move with the
+// brand (task 1003741), so its rule is put back where the CLI reads it (task 1004155).
+function rebrandSettings(text, rebrand) {
+  const moved = rebrand(SESSION_STORE_DENY);
+  return rebrand(text).split(JSON.stringify(moved)).join(JSON.stringify(SESSION_STORE_DENY));
+}
 
 // Credential files are derived from where the CLI actually reads them, not rebranded from the
 // core's literals: the rebrand would also move the host-keyed store, which sits at a fixed anchor
@@ -403,7 +412,7 @@ function starterDeny(branding = {}) {
   return [
     ...STARTER_DENY_SECRETS,
     ...dirs.flatMap((dir) => credentialFiles.map((file) => `Read(~/.config/${dir}/${file})`)),
-    `Read(~/.config/${ic.FALLBACK_DIR}/instances/**)`,
+    SESSION_STORE_DENY,
     ...STARTER_SHELL_TOOLS.map((tool) => `${tool}(git stash:*)`),
   ];
 }
@@ -684,7 +693,7 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
       const settingsOut = readSettingsTransform(settingsSrc);
       if (!dryRun) {
         fs.mkdirSync(destClaude, { recursive: true });
-        fs.writeFileSync(settingsDest, settingsOut.parsed ? rebrand(settingsOut.text) : settingsOut.text);
+        fs.writeFileSync(settingsDest, settingsOut.parsed ? rebrandSettings(settingsOut.text, rebrand) : settingsOut.text);
       }
       addWritten('.claude/settings.json');
       summary.settings = true;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.960'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.961'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -845,16 +845,46 @@ t('every file the CLI reads a session from is denied, the host-keyed store inclu
 t("every deny rule in the core's own settings.json reaches the starter", () => {
   // The two lists drift the way the allow halves could: a rule added to the core
   // protects the core and silently no instance. A config-dir file is compared by
-  // name, in the instance's dir; everything else must match verbatim.
+  // name, in the instance's dir; everything else — the fixed session store included — must match
+  // verbatim.
   const core = JSON.parse(readFileSync(join(ROOT, '.claude', 'settings.json'), 'utf8')).permissions.deny;
   const deny = starterDenyFor({ configDir: 'acme' });
+  const store = `Read(${homeRel(cliLib.sessionStoreDir())}/**)`;
   for (const rule of core) {
-    const cfg = rule.match(/^Read\(~\/\.config\/[^/]+\/(.+)\)$/);
+    const cfg = rule !== store && rule.match(/^Read\(~\/\.config\/[^/]+\/(.+)\)$/);
     const want = cfg ? `Read(~/.config/acme/${cfg[1]})` : rule;
     assert.ok(deny.includes(want), `core deny ${rule} → starter must carry ${want}`);
   }
 });
 
+// task 1004155 — the core's own list named two legacy session files and missed the active one
+// (bongos-session.json) and the host-keyed store, so the core's agent could read the live token.
+t("the core's OWN deny list covers every file the CLI reads a session from, and the store", () => {
+  const deny = JSON.parse(readFileSync(join(ROOT, '.claude', 'settings.json'), 'utf8')).permissions.deny;
+  // The core carries no branding.json, so its CLI reads the fallback dir plus the legacy ones.
+  const sessionFiles = ic.configReadDirs({}).flatMap((dir) => ic.SESSION_FILENAMES.map((f) => join(dir, f)));
+  for (const p of [...sessionFiles, `${cliLib.sessionStoreDir()}/**`]) {
+    assert.ok(deny.includes(`Read(${homeRel(p)})`), `core deny is missing Read(${homeRel(p)})`);
+  }
+});
+
+t('a checkout-materialized instance keeps the session-store rule at its fixed anchor', () => {
+  // The rebrand rewrites every `.config/<core dir>` literal, and the store's dir is one of them —
+  // but the store does not move with the brand, so a rebranded rule guards a dir nothing reads.
+  const core = mkdtempSync(join(tmpdir(), 'w3-store-core-'));
+  const inst = mkdtempSync(join(tmpdir(), 'w3-store-inst-'));
+  mkdirSync(join(core, '.claude', 'skills'), { recursive: true });
+  const store = `Read(${homeRel(cliLib.sessionStoreDir())}/**)`;
+  writeFileSync(join(core, '.claude', 'settings.json'), JSON.stringify({ permissions: { deny: [store] } }));
+  mkdirSync(join(inst, 'config'), { recursive: true });
+  writeFileSync(join(inst, 'config', 'branding.json'), JSON.stringify({ configDir: 'acme', envPrefix: 'ACME' }));
+  m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  const deny = JSON.parse(readFileSync(join(inst, '.claude', 'settings.json'), 'utf8')).permissions.deny;
+  assert.deepEqual(deny, [store]);
+  rmSync(core, { recursive: true, force: true });
+  rmSync(inst, { recursive: true, force: true });
+});
+
 // task 1004012 — the other source: a CHECKOUT core root does carry a settings.json, and the
 // instance used to receive its allow-list verbatim, naming scripts its skills no longer run.
 t('a checkout-materialized instance gets allow-rules in the bongos form, end to end', () => {