@bongos/core 1.20.12 → 1.20.13

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.12",
-  "core_contract": "1.20.12",
-  "source_commit": "157de30a7a166f1941ba54aaa8f57964f7f73362",
+  "core_version": "1.20.13",
+  "core_contract": "1.20.13",
+  "source_commit": "1e8134c4bbd7d8623139bfd31ba2701c5bf120ac",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T11:33:34.437Z",
+  "built_at": "2026-09-30T11:48:47.948Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 556,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3208,
-  "tree_sha256": "0da694c2943c85befcb0d6d52c1d9ae4480c66b425a0393140773878b4483763",
+  "tree_sha256": "ae284b5e2f56e08cb0b29b13e77a015dc35db8f5be3a99a96a731704c7da0053",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "86429e308db13d625c1255ae509c712448f405ada592fc1ea1c2fe6fe8866d46"
+      "sha256": "a0725bf013ddc823d06b866f5008497dddf1bf63e2e22852cd6eb79525ce5052"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8862,12 +8862,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "464fd91cbcd4c95177dde0d4e40720505686cfd677a575c0f7d7a8415f9a957b"
+      "sha256": "09eb2f9f11cdcb5cb24ccddee43c9d09d5e1135a452e0827542ea96d70b2e85f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2f825d119f8d7b46e1f4ffab61515532848aa2634b53b6b66adbf1581bffc3b3"
+      "sha256": "c80938c396a4982970d0850791d002ea2f5c49b93c8e75f6066c33c77bc7ae78"
     },
     {
       "path": "public-docs/index.html",
@@ -8887,7 +8887,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "fdb871eaf32d4f1b1525a225cc5b28207359df70e1714f735eb060fac12743aa"
+      "sha256": "a3de1adc96eea0bd98814403baf635fc2523506d45ca0df0ae263c917b324757"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9047,7 +9047,7 @@
     {
       "path": "scripts/gds/autobongos-run.js",
       "mode": "0000644",
-      "sha256": "daa234935da267393e61dd24e0ace8b0e23a8bd06a0814c6a25e9d00f4a56736"
+      "sha256": "5467681b59e569c4d7fccd4ed6ea93cd598a26ddd2fd42c384375f37ae0243ea"
     },
     {
       "path": "scripts/gds/autobongos-service.cmd",
@@ -9062,7 +9062,7 @@
     {
       "path": "scripts/gds/autobongos-verify.js",
       "mode": "0000644",
-      "sha256": "3e8da5c85aded9368171612fc5ba7beabecc8ef60b7c7d12c3c5bd58af222e12"
+      "sha256": "0be5358189145464d2893cebd53057b9fb35be94c2b56bb1b09f386c1f5a6252"
     },
     {
       "path": "scripts/gds/autonomy-gate.js",
@@ -11002,7 +11002,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "159b8f961396d15ce8bf1a5589ec100b0b9b1d0bc02ccb8b1c37a8ce82512dd7"
+      "sha256": "20017aec62763445738eeed4b8c1d23cbe6789a77223992022cb4c9e7747111c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11447,12 +11447,12 @@
     {
       "path": "tests/autobongos_loop.mjs",
       "mode": "0000644",
-      "sha256": "9debac618f88be1bb87220c66924c441cffcc5f403867de66622a9a2fc3a98e3"
+      "sha256": "e14d2c211c28ebada8e915d0d336989e74410afb68924d9b89dc8efd666457c8"
     },
     {
       "path": "tests/autobongos_verify.mjs",
       "mode": "0000644",
-      "sha256": "aeec5016fbdbe11d4067ba76e97e5f0a3b4e33bf2a1fafe050cd456ac76b1a66"
+      "sha256": "8b0958dba2589ca94671843a30d317da35b76df6eff9ab75660a0a253f98b7d3"
     },
     {
       "path": "tests/autonomous_fit_protected_paths.mjs",

package/docs/module-api-changelog.md

@@ -2681,5 +2681,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.10 with no explicit bump. run 36672606449. (task 1002620)
   1.20.12 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.11 with no explicit bump. run 36709211337. (task 1002620)
+  1.20.13 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.12 with no explicit bump. run 36710762884. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.12",
+  "version": "1.20.13",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.12",
+      "version": "1.20.13",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.12",
+  "version": "1.20.13",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8124,5 +8124,11 @@
       "id": "1004190",
       "text": "The task list no longer offers you work the system will refuse: a job waiting on another job that hasn't finished yet is now hidden until it's actually ready to start."
     }
+  ],
+  "1.20.13": [
+    {
+      "id": "1004180",
+      "text": "When the unattended runner fails to pick up a task, its log now always says why, starting with the sentence that explains it, instead of an empty line or a fragment cut off mid-word."
+    }
   ]
 }

package/scripts/gds/autobongos-run.js

@@ -42,7 +42,7 @@ const gauge = require('./autonomy-gauge.js');
 const {
   buildWorkerArgs, buildWorkerPrompt, classifyRun, DEFAULT_MODEL, DEFAULT_WORKER_TIMEOUT_MS,
 } = require('./autobongos-loop.js');
-const { verifyShip } = require('./autobongos-verify.js');
+const { verifyShip, failureReason } = require('./autobongos-verify.js');
 const fence = require('../../modules/autonomy/fence.js');
 // The ADR 0043 protected-path registry, reused rather than re-derived. scripts/
 // sits outside the kernel boundary, so this direct core require is allowed here
@@ -466,7 +466,7 @@ async function iteration(opts, deps = {}) {
   const wtName = deps.worktreeName ? deps.worktreeName(task.id) : worktreeName(task.id);
   const made = await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'add', wtName, '--base', 'origin/main']);
   if (!made.ok) {
-    return log({ event: 'worktree_failed', task_id: task.id, worktree: wtName, reason: (made.stderr || made.stdout).slice(-400) });
+    return log({ event: 'worktree_failed', task_id: task.id, worktree: wtName, reason: failureReason(made, 'worktree.js') });
   }
   const wtPath = path.join(REPO_ROOT, '.claude', 'worktrees', wtName);
 
@@ -475,7 +475,7 @@ async function iteration(opts, deps = {}) {
   const claimed = await runCmd(process.execPath, [path.join(REPO_ROOT, 'scripts', 'gds', 'claim.js'), String(task.id)], { cwd: wtPath });
   if (!claimed.ok) {
     await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'remove', wtName]);
-    return log({ event: 'claim_failed', task_id: task.id, worktree: wtName, reason: (claimed.stderr || claimed.stdout).slice(-400) });
+    return log({ event: 'claim_failed', task_id: task.id, worktree: wtName, reason: failureReason(claimed, 'claim.js') });
   }
 
   // 5. Work, in that tree.
@@ -966,5 +966,5 @@ module.exports = {
   readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, resolveWorkerBin,
   worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, countWorkedSince, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
-  isRunnerTree, RUNNER_TREE_RE, postHeartbeat, RUNNER_STARTED_AT,
+  isRunnerTree, RUNNER_TREE_RE, postHeartbeat, RUNNER_STARTED_AT, failureReason,
 };

package/scripts/gds/autobongos-verify.js

@@ -40,6 +40,31 @@ const { execFile } = require('node:child_process');
 
 const { classifyStrand, WATCHED } = require('./strand-watch.js');
 
+// failureReason — what a failed child process said, fit for one run-log field
+// (task 1004180).
+//
+// Two defects this replaces, both seen live. `(stderr || stdout).slice(-400)`
+// logged reason:"" when a child failed with nothing on either stream — which
+// reads as "the cause was captured and it was nothing". And it kept only the
+// TAIL, so a long refusal card lost its first line, the one that says WHY, and
+// the log began mid-word ("ot look for a way round it."). So: prefer stderr,
+// else stdout; collapse whitespace so a multi-line card reads as one line; keep
+// the HEAD plus a short tail with a marked cut; and when there is no text at all,
+// say which program exited with which code rather than saying nothing.
+function failureReason(res, what, max = 400) {
+  const flat = (s) => String(s || '').replace(/\s+/g, ' ').trim();
+  const text = flat(res && res.stderr) || flat(res && res.stdout);
+  if (!text) {
+    const code = res && res.code !== undefined && res.code !== null ? res.code : '?';
+    return `${what} exited ${code} with no output`;
+  }
+  if (text.length <= max) return text;
+  const cut = ' … ';
+  const tail = Math.floor((max - cut.length) / 3);
+  const head = max - cut.length - tail;
+  return text.slice(0, head) + cut + text.slice(text.length - tail);
+}
+
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
 // Statuses a claim can still be sitting in when the worker is already gone.
@@ -318,7 +343,7 @@ async function verifyShip({ taskId, taskTitle = null, worker = null }, deps = {}
     else {
       const r = await release(taskId, `autobongos: ${v.shape} — ${String(v.reason || '').slice(0, 180)}`);
       out.released = !!(r && r.ok);
-      if (!out.released) out.release_error = (r && (r.stderr || r.stdout) ? String(r.stderr || r.stdout).slice(-300) : 'release failed');
+      if (!out.released) out.release_error = failureReason(r, 'release.js', 300);
     }
   }
 
@@ -374,4 +399,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { classifyLedger, blockerFor, probeArtifact, fileBlocker, verifyShip };
+module.exports = { classifyLedger, blockerFor, probeArtifact, fileBlocker, verifyShip, failureReason };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.12'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.13'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autobongos_loop.mjs

@@ -381,6 +381,47 @@ test('a refused claim tears the tree down again and never spawns a worker', asyn
   assert.match(row.reason, /ALREADY_CLAIMED/);
 });
 
+// task 1004180 — observed live: reason:"" when claim.js failed with nothing on
+// either stream, and reasons that began mid-word ("ot look for a way round it.")
+// because `.slice(-400)` kept only the TAIL of a long refusal card.
+test('a claim that fails SILENTLY still says what happened, never an empty reason', async () => {
+  const h = harness({ run: async (bin, args) => {
+    const script = String(args[0]).split(/[\\/]/).pop();
+    return script === 'claim.js' ? { ok: false, code: 3, stdout: '', stderr: '  ' } : { ok: true, code: 0, stdout: '', stderr: '' };
+  } });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.event, 'claim_failed');
+  assert.equal(row.reason, 'claim.js exited 3 with no output');
+});
+
+test('a worktree that cannot be made says so even with no output', async () => {
+  const h = harness({ run: async () => ({ ok: false, code: 128, stdout: '', stderr: '' }) });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.event, 'worktree_failed');
+  assert.equal(row.reason, 'worktree.js exited 128 with no output');
+});
+
+test('a long refusal keeps its HEAD — the part that says why — not just the tail', async () => {
+  const why = 'Your work changes the tools that would be used to update it, so the automatic update was refused on purpose.';
+  const long = why + ' ' + 'x'.repeat(2000) + ' By design: Yes. Do not look for a way round it.';
+  const h = harness({ run: async (bin, args) => {
+    const script = String(args[0]).split(/[\\/]/).pop();
+    return script === 'claim.js' ? { ok: false, code: 1, stdout: '', stderr: long } : { ok: true, code: 0, stdout: '', stderr: '' };
+  } });
+  const row = await runner.iteration(opts, h.deps);
+  assert.ok(row.reason.startsWith(why), 'the reason must start where the message starts');
+  assert.ok(row.reason.endsWith('Do not look for a way round it.'), 'and still carry the tail');
+  assert.ok(row.reason.includes('…'), 'the cut is marked');
+  assert.ok(row.reason.length <= 400, `bounded, got ${row.reason.length}`);
+});
+
+test('failureReason: stdout is used when stderr is empty, whitespace is collapsed, short text is untouched', () => {
+  assert.equal(runner.failureReason({ code: 1, stdout: 'line one' + String.fromCharCode(10) + '  line two', stderr: '' }, 'claim.js'), 'line one line two');
+  assert.equal(runner.failureReason({ code: 1, stdout: 'ignored', stderr: 'wins' }, 'claim.js'), 'wins');
+  assert.equal(runner.failureReason(null, 'claim.js'), 'claim.js exited ? with no output');
+  assert.equal(runner.failureReason({ code: 1, stderr: 'a'.repeat(400) }, 'x').length, 400);
+});
+
 test('a worker that cannot finish frees the claim; one that really shipped does not', async () => {
   // Which of these happens is now decided by the LEDGER, not by the worker's own
   // verdict: a stuck worker leaves the task still `active`, a finished one leaves

package/tests/autobongos_verify.mjs

@@ -265,6 +265,28 @@ test('a release that fails does not get reported as a release', async () => {
   assert.equal(out.blocker.linked, false);
 });
 
+// task 1004180 — the release error used to keep only the last 300 characters,
+// cutting off the start of the message, which is the part that says why.
+test('a long release error keeps its head, and an empty one still names the exit', async () => {
+  const why = 'Only the original session can release it.';
+  const long = await verifyShip({ taskId: 42 }, {
+    api: fakeApi(),
+    task: task({ id: '42', status: 'active' }),
+    release: async () => ({ ok: false, code: 1, stderr: why + ' ' + 'y'.repeat(1000) }),
+    fileBlocker: async (_a, _r, opts) => ({ filed: true, blockerId: 7, linked: opts.link }),
+  });
+  assert.ok(long.release_error.startsWith(why), long.release_error.slice(0, 60));
+  assert.ok(long.release_error.length <= 300);
+
+  const silent = await verifyShip({ taskId: 42 }, {
+    api: fakeApi(),
+    task: task({ id: '42', status: 'active' }),
+    release: async () => ({ ok: false, code: 2, stdout: '', stderr: '' }),
+    fileBlocker: async (_a, _r, opts) => ({ filed: true, blockerId: 7, linked: opts.link }),
+  });
+  assert.equal(silent.release_error, 'release.js exited 2 with no output');
+});
+
 test('the artifact probe only runs when the ledger claims success', async () => {
   let probes = 0;
   const probeArtifactSpy = async () => { probes += 1; return notOnMain; };