@bongos/core 1.20.14 → 1.20.15

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.14",
-  "core_contract": "1.20.14",
-  "source_commit": "791ad29beab00019cab69c01896dbb132b40b5ad",
+  "core_version": "1.20.15",
+  "core_contract": "1.20.15",
+  "source_commit": "139b563191ef97af7e538f783d3fb256baa6c075",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T12:05:40.305Z",
+  "built_at": "2026-09-30T12:16:56.172Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 556,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3210,
-  "tree_sha256": "521479f97c392987b24cca51bd5ca57048b353ae978e89f748a15793d8e80990",
+  "tree_sha256": "814cbc7e5df7346b441a3ac6faa4217852105b51708505d98b9e090d68bd8b6a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b3abd2f21a34a8547f169368ddcaa19364e2fcb5f5ddeb4f296bcfaf67acf3b5"
+      "sha256": "05833e301ee659bde426bdae2d327183b03a6e40b08230a07ce99ba8ccef9705"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2882,7 +2882,7 @@
     {
       "path": "docs/recipes/autobongos-windows-host.md",
       "mode": "0000644",
-      "sha256": "e8c45b5b1ab16fc5ae7bbfaef677672f338195dde885e734d53d752c5113deeb"
+      "sha256": "e70faa969725827307388ccb0620bde203500333ed299d860ca7a001cc8577a1"
     },
     {
       "path": "docs/recipes/bongos-cli-release.md",
@@ -8862,12 +8862,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "908c96be621ea531a175e213836861eddf3bd3b652f793aaefd6fd098d7e5543"
+      "sha256": "cc8381c4866cb96ae92e56199b4666a515f8c4fb6aa0214fe332a2c960f5c9df"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "88ae8247e31afb3b9e49258788fe2f01132af4779ba70f3377ca6b8af3756adf"
+      "sha256": "5125b2ece4cbf29c1c89b0eec97b4bce224fa0b25c8b3351e0b6253ade41c8e5"
     },
     {
       "path": "public-docs/index.html",
@@ -8887,7 +8887,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "4d06b7011b86e611f4ae20cd9f925c3a27715663139ceb06d4b3f841a8c764f0"
+      "sha256": "d12e72f6946fb8c0884d7b014d8673e58314ad5ff4d01593d397f5d96d8c8a6e"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9057,7 +9057,7 @@
     {
       "path": "scripts/gds/autobongos-service.ps1",
       "mode": "0000644",
-      "sha256": "2dcf13abd58dfaf6cce56285dc1f156efe06be9e2307acc0d9e2bc7912c9f424"
+      "sha256": "b1e038bb70ace1652b85a4d29f5a68761c6b432fd50fbfdafb5e1e38d93627de"
     },
     {
       "path": "scripts/gds/autobongos-verify.js",
@@ -11002,7 +11002,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "111c9b37716e607675072df7499f9040e048c7b6f5e4c006890d4b898dc6c9d3"
+      "sha256": "d97c483c3599928877210a4ceea2c9a384cf61dc86d1fec156de8a95dce743e5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11457,7 +11457,7 @@
     {
       "path": "tests/autobongos_service_ps1.mjs",
       "mode": "0000644",
-      "sha256": "541a3030ed91fe74b98b837e4d45b59e6a337b9f45c99f848a9df53a20b781a1"
+      "sha256": "34ca7d75bc83d9c4a77706dd06ecc170011ef52b7ee77eea5c3b77ac514389d0"
     },
     {
       "path": "tests/autobongos_verify.mjs",

package/docs/module-api-changelog.md

@@ -2685,5 +2685,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.12 with no explicit bump. run 36710762884. (task 1002620)
   1.20.14 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.13 with no explicit bump. run 36712510525. (task 1002620)
+  1.20.15 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.14 with no explicit bump. run 36713710510. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/autobongos-windows-host.md

@@ -18,7 +18,7 @@ Task [1003905](https://cloudbongos.com/builders#/task/1003905).
 
 ## What you need on the box first
 
-Open PowerShell as your normal user (not Administrator) and check all three:
+Open PowerShell as your own user and check all three:
 
 ```powershell
 node --version ; git --version ; claude --version
@@ -28,7 +28,7 @@ All three must print a version. The installer refuses to proceed otherwise —
 a runner that starts without `claude` on its PATH fails every worker and looks
 like a mysterious outage in the log rather than a missing program.
 
-You also need, as **your own user** (not an administrator account):
+You also need, as **your own user** (not a separate administrator account):
 
 - a `git` credential that can fetch the repo,
 - a signed-in Claude Code session,
@@ -53,13 +53,29 @@ machine can write, the worker running on it can write too.
 
 ## 2. Install the scheduled task
 
-From the checkout:
+**This step, and only this step, needs an Administrator shell.** Right-click
+PowerShell, choose **Run as administrator**, and sign in to the prompt as the
+**same user** you checked the prerequisites with — then, from the checkout:
 
 ```powershell
 powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 install
 powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 start
 ```
 
+Why admin, when the runner deliberately is not: two different things happen
+here. **Registering** the task needs admin, because it uses the S4U logon type
+(run whether or not anyone is signed in), and Windows only lets an elevated
+shell register one — from a normal shell `install` stops and says so, rather
+than failing with a bare *Access is denied*. **Running** the task does not: it
+runs as you, unelevated (`-RunLevel Limited`), which is what lets it use your
+git credential and Claude session. Elevating the same account keeps your
+username, so the task is still registered to run as you.
+
+Do **not** install it as SYSTEM, or from a different administrator account:
+the task would run as that account, which has none of your credentials. If
+your own account is not an administrator on this PC, make it one for the
+install rather than elevating as someone else.
+
 That registers a task called `Autobongos` that starts **at boot** (not at sign-in
 — nobody should have to log in), restarts if it crashes, and never times out.
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.14",
+  "version": "1.20.15",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.14",
+      "version": "1.20.15",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.14",
+  "version": "1.20.15",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8140,5 +8140,11 @@
       "id": "1004397",
       "text": "The unattended runner now records which version of the code it is running from its very first check-in, instead of leaving that blank for its first minute, which is exactly when someone is trying to find out."
     }
+  ],
+  "1.20.15": [
+    {
+      "id": "1004177",
+      "text": "Installing the Windows runner now tells you up front that it needs an administrator window, and why, instead of failing with a bare \"access denied\"; the setup guide no longer says the opposite."
+    }
   ]
 }

package/scripts/gds/autobongos-service.ps1

@@ -25,7 +25,8 @@
 # UNPRIVILEGED ON PURPOSE. It runs as the logged-in user, not SYSTEM: the runner
 # needs that user's git credential, npm config and Claude session, and SYSTEM has
 # none of them. It is also the smaller blast radius for a process that spawns
-# workers with blanket bypassPermissions.
+# workers with blanket bypassPermissions. (INSTALLING it is the one step that
+# needs an elevated shell of that same user -- see Assert-Prereqs, task 1004177.)
 
 [CmdletBinding()]
 param(
@@ -49,10 +50,32 @@ $LogDir = Join-Path $env:LOCALAPPDATA 'cloudbongos'
 $LogFile = Join-Path $LogDir 'autobongos.log'
 $Wrapper = Join-Path $RepoRoot 'scripts\gds\autobongos-service.cmd'
 
+# Is this shell elevated (Run as administrator)? Its own function so the tests
+# can stand it in: the check is Windows-only, and CI runs on Linux.
+function Test-Elevated {
+  $id = [Security.Principal.WindowsIdentity]::GetCurrent()
+  return ([Security.Principal.WindowsPrincipal]$id).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+}
+
+# REGISTERING vs RUNNING (task 1004177). The task RUNS as this user, unelevated
+# (-RunLevel Limited): that is what reaches the user's git credential and Claude
+# session, and it is load-bearing. But REGISTERING a task with an S4U principal
+# needs an elevated shell -- unelevated, Register-ScheduledTask fails with a bare
+# "Access is denied" (0x80070005) that says nothing about why. Elevating the SAME
+# account keeps $env:USERNAME, so the principal below is still this user. So
+# install -- and only install -- checks, and says so in words, before trying.
+$ElevationNeeded = @(
+  'install needs an elevated shell: registering a task that runs whether or not you are signed in (the S4U logon type) requires Administrator.',
+  'Open PowerShell with "Run as administrator" AS THIS SAME USER and run install again. The task still RUNS as you, unelevated (-RunLevel Limited) -- only the registration needs admin.',
+  'Do NOT install it as SYSTEM or another admin account: the runner needs your git credential and Claude session, and SYSTEM has neither.'
+) -join ' '
+
 function Assert-Prereqs {
+  param([switch]$ForInstall)
   if (-not (Test-Path (Join-Path $RepoRoot 'scripts\gds\autobongos-run.js'))) {
     throw "No autobongos-run.js under $RepoRoot -- pass -RepoRoot <path to the checkout>."
   }
+  if ($ForInstall -and -not (Test-Elevated)) { throw $ElevationNeeded }
   foreach ($exe in @('node', 'git', 'claude')) {
     if (-not (Get-Command $exe -ErrorAction SilentlyContinue)) {
       # Named, not guessed at: a runner that starts without `claude` on PATH will
@@ -191,7 +214,7 @@ if ($MyInvocation.InvocationName -eq '.') { return }
 
 switch ($Action) {
   'install' {
-    Assert-Prereqs
+    Assert-Prereqs -ForInstall
     New-Item -ItemType Directory -Force -Path $LogDir | Out-Null
 
     # NOT $action: PowerShell variable names are CASE-INSENSITIVE, so $action IS the

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.14'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.15'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autobongos_service_ps1.mjs

@@ -152,3 +152,55 @@ test('stop honours AUTOBONGOS_HEARTBEAT_FILE exactly as the runner does', { skip
   const r = await ps("'HB=' + (Get-HeartbeatFile)", { AUTOBONGOS_HEARTBEAT_FILE: override });
   assert.equal(path.resolve(r.out.match(/HB=(.*)/)[1].trim()), path.resolve(override), r.out);
 });
+
+// --- install needs an elevated shell, and says why (task 1004177) -------------
+//
+// Registering an S4U task needs Administrator; unelevated, Register-ScheduledTask
+// throws a bare "Access is denied". The recipe used to say the opposite. Test-
+// Elevated is stood in (it is Windows-only), everything else is the real script.
+// The stub runs AFTER the dot-source, so it replaces the script's own definition.
+
+const assertPrereqs = (elevated, args) =>
+  `function Test-Elevated { $${elevated} }; ` +
+  `try { Assert-Prereqs ${args}; 'PASSED' } catch { 'THREW=' + $_.Exception.Message }`;
+
+test('install from an unelevated shell is refused with the reason, not a bare access-denied', { skip }, async () => {
+  const r = await ps(assertPrereqs('false', '-ForInstall'));
+  assert.match(r.out, /THREW=install needs an elevated shell/, r.out);
+  assert.match(r.out, /S4U/);
+  assert.match(r.out, /Run as administrator/);
+  assert.match(r.out, /SAME USER/, 'elevating the same account is what keeps the principal right');
+  assert.match(r.out, /still RUNS as you, unelevated/);
+  assert.match(r.out, /Do NOT install it as SYSTEM/);
+});
+
+test('an elevated shell passes the elevation check', { skip }, async () => {
+  const r = await ps(assertPrereqs('true', '-ForInstall'));
+  // It may still stop on a later prereq (a CI runner has no `claude`), but
+  // never on elevation.
+  assert.doesNotMatch(r.out, /elevated shell/, r.out);
+});
+
+test('only install asks for elevation', { skip }, async () => {
+  const r = await ps(assertPrereqs('false', ''));
+  assert.doesNotMatch(r.out, /elevated shell/, r.out);
+});
+
+test('the install arm runs the install-only check', () => {
+  const live = readFileSync(PS1, 'utf8').split(/\r?\n/).map((l) => l.replace(/#.*$/, '')).join('\n');
+  const installArm = live.slice(live.indexOf("'install' {"), live.indexOf("'uninstall' {"));
+  assert.match(installArm, /Assert-Prereqs -ForInstall/);
+  assert.ok(installArm.indexOf('Assert-Prereqs -ForInstall') < installArm.indexOf('Register-ScheduledTask'),
+    'the check must run before the registration it explains');
+});
+
+test('the recipe says install needs Administrator, and why, and not SYSTEM', () => {
+  const doc = readFileSync(fileURLToPath(new URL('../docs/recipes/autobongos-windows-host.md', import.meta.url)), 'utf8');
+  assert.doesNotMatch(doc, /normal user \(not Administrator\)/, 'the instruction that made install fail');
+  const install = doc.slice(doc.indexOf('## 2. Install the scheduled task'), doc.indexOf('## 3.'));
+  assert.match(install, /Run as administrator/);
+  assert.match(install, /S4U/);
+  assert.match(install, /same (user|account)/i);
+  assert.match(install, /SYSTEM/);
+  assert.match(install, /-RunLevel Limited/);
+});