@bongos/core 1.20.1 → 1.20.2

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.1",
-  "core_contract": "1.20.1",
-  "source_commit": "538c76c7fe358561c386a9201b0b9fb4f0d06a43",
+  "core_version": "1.20.2",
+  "core_contract": "1.20.2",
+  "source_commit": "ca998b1dee6c7e614139ebfb51001b16ca27c701",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T02:04:12.975Z",
+  "built_at": "2026-09-30T02:38:33.497Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 554,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3188,
-  "tree_sha256": "6066cfbf6807327395dfb780b2ea38ae26e7f33e2ae4f612f2230f81c8b096b6",
+  "tree_sha256": "a9967d147c252f5ba88721a5da572d6fdc732e28da2ab83987a682697d72b44f",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2762,7 +2762,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "cd5697a04adc8d9214f94c8ec9734dd17859a8dc429bb197258baff84358db55"
+      "sha256": "dd50f2deee7bba7bf96fbd437f2029e6ae0152cfef4e2a9a20d0175d7a285309"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2852,7 +2852,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "b16b11c591defc50b0738ef0df220d5879f0f1b2f5adf9a85bbc2d5b69d6e1a1"
+      "sha256": "423073f523746f511d06bca198350db7dd8b84f36fd0a737f1117ec6fb0a3054"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5127,7 +5127,7 @@
     {
       "path": "modules/hall-ui/public/goal-inbox.js",
       "mode": "0000644",
-      "sha256": "77c6653d8c18097f31dc84958cf688c96bf32888a7ecdc99fce049d8cdc1cb95"
+      "sha256": "70d448aec17ff903e6bed16410f969925e1cc57e3bc40b465ef2f06eb67b4638"
     },
     {
       "path": "modules/hall-ui/public/goal-map.html",
@@ -8822,12 +8822,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8dd3c0f14900fb242e7b38bebe2e50d566150f53970f2f148c7a503d6725d405"
+      "sha256": "d6b52dacf9c31b799c163d77e05228bc3e5ba33aa8010ec5068624c625dbda6a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c323f14e5965da3e2b585b841d6caf80e36c0186d2d53373bd5c73849002aa70"
+      "sha256": "0e422814840dfdfc9f6d1c7bebc4bf238dbc752a4161e2bd77a41ddc13b91404"
     },
     {
       "path": "public-docs/index.html",
@@ -8847,7 +8847,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "eadbb2046a348fb8ac4a7787e45755ec7b9652de21e21b5a4f434ac5570d4f9d"
+      "sha256": "0f3d3decd7772ae5456206afdfb57e4a84bff73537ba566ee976e2c374fc1788"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10942,7 +10942,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "35a2ae08614ac9d86186c4bab8f68a38c4a717c1677da75eb7b586e098f15247"
+      "sha256": "0f8bf5e352578ee3747750dbd3e4646481c338f118ff63dc4a9e45276064ac1c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14847,7 +14847,7 @@
     {
       "path": "tests/rot_inbox.mjs",
       "mode": "0000644",
-      "sha256": "7611e8595f5ea2b314d92d756c15ba8dfc6843daf32c0130e00ed13a24fe38b8"
+      "sha256": "d32e3adca10d2701816c9cb039cc6d7a51c807c6ebe9c942738fddfe330054ef"
     },
     {
       "path": "tests/route_permission_check.mjs",

package/docs/module-api-changelog.md

@@ -2659,5 +2659,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         Additive, so MINOR.
   1.20.1 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.0 with no explicit bump. run 36658043092. (task 1002620)
+  1.20.2 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.1 with no explicit bump. run 36660725673. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -1238,8 +1238,8 @@
       "surface": "builders",
       "title": "Builders' Hall",
       "states_read": ["home","standing","standing-karma","out"],
-      "files_hash": "b2789b434f5781ee",
-      "reading_hash": "b53244abff3b4a9c",
+      "files_hash": "d5ce0c85eaaee75b",
+      "reading_hash": "1debe0f979ce3b59",
       "counts": {"lines":204,"placed":68,"shared":7,"unplaced":129},
       "omitted": {"data":182},
       "notes": [],
@@ -1250,23 +1250,23 @@
         {"key":"L0004","section":"top bar","text":"Welcome back, {…}.","placement":"shared","file":"modules/hall-ui/public/hall-render.js","line":596,"string_id":"0658f0358ffd"},
         {"key":"L0005","section":"top bar","text":"Jump to…","placement":"shared","file":"modules/hall-ui/public/shell.js","line":487,"string_id":"eba610d25523"},
         {"key":"L0006","section":"top bar","text":"Ctrl K","placement":"shared"},
-        {"key":"L0007","section":"Good afternoon, {…}","text":"Good afternoon, {…}","placement":"unplaced"},
-        {"key":"L0008","section":"Good afternoon, {…}","text":"{…} is 76 percent {…}. 63 tasks are claimable right now.","placement":"unplaced"},
-        {"key":"L0009","section":"Good afternoon, {…}","text":"Work","placement":"unplaced","state":"standing"},
-        {"key":"L0010","section":"Good afternoon, {…}","text":"Credits","placement":"unplaced"},
-        {"key":"L0011","section":"Good afternoon, {…}","text":"Shipped","placement":"placed","file":"modules/hall-ui/public/task.js","line":705,"string_id":"0c0a50ba1666"},
-        {"key":"L0012","section":"Good afternoon, {…}","text":"Karma","placement":"unplaced"},
-        {"key":"L0013","section":"Good afternoon, {…}","text":"Progress","placement":"unplaced","state":"standing"},
-        {"key":"L0014","section":"Good afternoon, {…}","text":"Achievements","placement":"unplaced","state":"standing"},
-        {"key":"L0015","section":"Good afternoon, {…}","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","state":"standing"},
-        {"key":"L0016","section":"Good afternoon, {…}","text":"+1 in 30d","placement":"unplaced"},
-        {"key":"L0017","section":"Good afternoon, {…}","text":"Rank","placement":"unplaced"},
-        {"key":"L0018","section":"Good afternoon, {…}","text":"Member since {…}","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":563,"string_id":"df335a1224ae","state":"standing"},
-        {"key":"L0019","section":"Good afternoon, {…}","text":"+1 karma in 30d","placement":"unplaced","state":"standing"},
-        {"key":"L0020","section":"Good afternoon, {…}","text":"#2 on the leaderboard","placement":"unplaced"},
-        {"key":"L0021","section":"Good afternoon, {…}","text":"Preferred work:","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":577,"string_id":"ed8edd684547","state":"standing"},
-        {"key":"L0022","section":"Good afternoon, {…}","text":"Change in Settings →","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":577,"string_id":"0279db21e29a","state":"standing"},
-        {"key":"L0023","section":"Good afternoon, {…}","text":"karma","placement":"unplaced","state":"standing"},
+        {"key":"L0007","section":"Good morning, {…}","text":"Good morning, {…}","placement":"unplaced"},
+        {"key":"L0008","section":"Good morning, {…}","text":"{…} is 76 percent {…}. 63 tasks are claimable right now.","placement":"unplaced"},
+        {"key":"L0009","section":"Good morning, {…}","text":"Work","placement":"unplaced","state":"standing"},
+        {"key":"L0010","section":"Good morning, {…}","text":"Credits","placement":"unplaced"},
+        {"key":"L0011","section":"Good morning, {…}","text":"Shipped","placement":"placed","file":"modules/hall-ui/public/task.js","line":705,"string_id":"0c0a50ba1666"},
+        {"key":"L0012","section":"Good morning, {…}","text":"Karma","placement":"unplaced"},
+        {"key":"L0013","section":"Good morning, {…}","text":"Progress","placement":"unplaced","state":"standing"},
+        {"key":"L0014","section":"Good morning, {…}","text":"Achievements","placement":"unplaced","state":"standing"},
+        {"key":"L0015","section":"Good morning, {…}","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","state":"standing"},
+        {"key":"L0016","section":"Good morning, {…}","text":"+1 in 30d","placement":"unplaced"},
+        {"key":"L0017","section":"Good morning, {…}","text":"Rank","placement":"unplaced"},
+        {"key":"L0018","section":"Good morning, {…}","text":"Member since {…}","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":563,"string_id":"df335a1224ae","state":"standing"},
+        {"key":"L0019","section":"Good morning, {…}","text":"+1 karma in 30d","placement":"unplaced","state":"standing"},
+        {"key":"L0020","section":"Good morning, {…}","text":"#2 on the leaderboard","placement":"unplaced"},
+        {"key":"L0021","section":"Good morning, {…}","text":"Preferred work:","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":577,"string_id":"ed8edd684547","state":"standing"},
+        {"key":"L0022","section":"Good morning, {…}","text":"Change in Settings →","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":577,"string_id":"0279db21e29a","state":"standing"},
+        {"key":"L0023","section":"Good morning, {…}","text":"karma","placement":"unplaced","state":"standing"},
         {"key":"L0024","section":"Standing","text":"Standing","placement":"unplaced"},
         {"key":"L0025","section":"Standing","text":"Credits","placement":"unplaced"},
         {"key":"L0026","section":"Standing","text":"On the board","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":626,"string_id":"11a1905c76b2"},

package/modules/hall-ui/public/goal-inbox.js

@@ -455,7 +455,7 @@
     }).join('');
     return `<li class="ginbox__item" data-rot-tier="${escapeHtml(String(r.tier))}">
         <div class="ginbox__body">
-          <a class="ginbox__goal" href="${href}">${escapeHtml(r.title || `${r.tier} #${r.id}`)}</a>
+          <a class="ginbox__goal" href="${escapeHtml(href)}">${escapeHtml(r.title || `${r.tier} #${r.id}`)}</a>
           <span class="ginbox__sub">${escapeHtml(String(r.status || ''))} · ${where} · ${escapeHtml(untouchedFor(r.last_touched_at))}${again}</span>
         </div>
         <div class="ginbox__actions">${buttons}</div>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.1",
+  "version": "1.20.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.1",
+      "version": "1.20.2",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.1",
+  "version": "1.20.2",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8046,5 +8046,11 @@
       "id": "1004368",
       "text": "CI checks were failing on every change because of a newly published security flaw in a networking library; updating it made the checks pass again so approved work can land."
     }
+  ],
+  "1.20.2": [
+    {
+      "id": "1003631",
+      "text": "Closed a small consistency gap in the hall's needs-attention inbox: one link is now escaped like all the others. No visible change."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.1'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.2'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/rot_inbox.mjs

@@ -630,3 +630,11 @@ test('acting on a rot line refreshes the ROT slice, not the goals list', () => {
   assert.match(GOAL_INBOX_SRC, /ROT_TOASTS\[verb\] \|\| 'Done\.', loadRot\)/,
     'refreshing the wrong slice leaves the acted-on row sitting there — the task-1003066 lesson');
 });
+
+test('rotRowHtml escapes the row href like every sibling field (task 1003631)', () => {
+  const start = GOAL_INBOX_SRC.indexOf('function rotRowHtml');
+  const body = GOAL_INBOX_SRC.slice(start, GOAL_INBOX_SRC.indexOf('\n  }\n', start));
+  assert.ok(start > 0, 'rotRowHtml exists');
+  assert.match(body, /href="\$\{escapeHtml\(href\)\}"/, 'href goes through escapeHtml');
+  assert.doesNotMatch(body, /href="\$\{href\}"/, 'no raw href interpolation');
+});