@bongos/core 1.21.103 → 1.21.104

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.103",
-  "core_contract": "1.21.103",
-  "source_commit": "56f5f9df610b5d9079d28702989bf24a9a462db9",
+  "core_version": "1.21.104",
+  "core_contract": "1.21.104",
+  "source_commit": "cfc8c3651ea3f442385e6d0ba405c6a578b4d83a",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T13:27:17.718Z",
+  "built_at": "2026-10-09T13:49:17.283Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 592,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3020,
+    "functional_verbatim": 3021,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3641,
-  "tree_sha256": "3e52cfca3b8385e564d956ceaae717fbedb093d4db368a3c960d3f6db8c6139a",
+  "file_count": 3642,
+  "tree_sha256": "b23d12f504071337f2882e99100b69132448daa2e65560c851411b6a667c5f67",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2872,7 +2872,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "53e81515be4483fdb9a4d361335cbe9bac0efb82bd28946cf6b70d0ca28b0b3e"
+      "sha256": "6e7ad3fddfaca1cfb1dfe79cbdb4a5588007b30eedd458df7212a971da96e324"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10137,12 +10137,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bc23786ce9a171a96d049bc9568d8a73e513c0aa66783cedae0e51d4b16b6d93"
+      "sha256": "7f4d097ca5d827a3fad698b3e3fbbedc38f7469e29b565cfed34489f4eaab008"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "923e849fd1ededbb5563d4c81dc9013c308a99a53f9d8595724fa8b35e831914"
+      "sha256": "a0fb2f62847ad58e78ec122f44bb7e97281f124bdfd0324c767a50bfe26b5a9e"
     },
     {
       "path": "public-docs/index.html",
@@ -10162,7 +10162,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "5f152e713ca6f702119fe887e076a370e72ad380cd3c880ef56683202f3b573f"
+      "sha256": "f65d5a86053502037145a87a3e996ce4ff32c84651d4a8f8afe62c486172ef2d"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11642,7 +11642,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "d114ae690d86270db76770fc3531a5530d1ab64a031a2528368864f4b330ac56"
+      "sha256": "ad768320095b1d6693e6da5cee1f8e857ac69cbbfbea0a64dfeaa7092c432de2"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -11722,7 +11722,7 @@
     {
       "path": "scripts/gds/ship-visual.js",
       "mode": "0000644",
-      "sha256": "21ce15f1e49388bb3f8a46b9cfd8b05b23b77efbe93228ca04d9b13740e6d901"
+      "sha256": "a97c5628609b622ad8972e93af13ff32a85138c350756f4895bea24d469bc2fc"
     },
     {
       "path": "scripts/gds/ship.js",
@@ -12437,7 +12437,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0228b28afc1fe4d1cd2a3e59ceeb9411a5ac0477bbdf95baf8a8de2100c2863a"
+      "sha256": "a00e2f13c266f639d3052f84844f2f38634759e57cfd81830667a9bf1e3e7be7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -17444,6 +17444,11 @@
       "mode": "0000644",
       "sha256": "75aa59accad12d197202457ed36281e5d3eca1040762a5045972c4b10cf09006"
     },
+    {
+      "path": "tests/ship_visual_regrade.mjs",
+      "mode": "0000644",
+      "sha256": "4e469f6f5801032dff196a57a84eeb3603e7a53760144a7ed4d582699c9747f9"
+    },
     {
       "path": "tests/ship_zero_commit.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -3043,5 +3043,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.101 with no explicit bump. run 37935415352. (task 1002620)
   1.21.103 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.102 with no explicit bump. run 37936846665. (task 1002620)
+  1.21.104 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.103 with no explicit bump. run 37939497390. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.103",
+  "version": "1.21.104",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.103",
+      "version": "1.21.104",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.103",
+  "version": "1.21.104",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9464,5 +9464,11 @@
       "id": "1004684",
       "text": "New house rule, Slop Bongo: when an AI realises it was wrong about something, it now says 'Bongo Slop Detected, Filing Bug' in chat and files a bug against the doc or message that misled it, so the same mistake stops repeating"
     }
+  ],
+  "1.21.104": [
+    {
+      "id": "1004665",
+      "text": "When a builder re-runs a review and attaches a screenshot, the screenshot now actually gets attached to the task. Before, it was quietly thrown away, so reviewers asking for a picture never saw one unless someone added it by h"
+    }
   ]
 }

package/scripts/gds/ship-flow.js

@@ -139,7 +139,7 @@ async function shipMain() {
     const action = evaluateResumeAction({ task, lastClaim, builder: me.data.builder });
     if (action.action === 'resume-grade') {
       console.log(`Task #${taskId} is at 'completed' (grade stalled) and ${action.via === 'owner' ? 'you last held the claim' : 'you are an Archon'} — resuming the grade (no re-claim needed).`);
-      return regradeMain();
+      return regradeMain({ visual });
     }
     if (action.action === 'resume-merge') {
       console.log(`Task #${taskId} is at 'confirmed' (merge/deploy stalled) and ${action.via === 'owner' ? 'you last held the claim' : 'you are an Archon'} — resuming the merge + deploy (no re-claim needed).`);
@@ -822,12 +822,12 @@ async function persistRegradeSummary({ taskId, summaryArg, task }) {
 //     promotes completed→confirmed + awards credits on pass, idempotent)
 //   - on pass: the normal confirmed→shipped merge + sync tail runs.
 
-async function regradeMain() {
+async function regradeMain(opts = {}) {
   await requireSession();
   const args = process.argv.slice(2);
   const taskId = Number(args[0]);
   if (!Number.isFinite(taskId)) {
-    console.error('usage: node scripts/gds/ship.js <task-id> --regrade [--summary-file <path|-> | --summary "..."] [--response-file <path|-> | --response "..."] [--no-merge] [--force] [--verified] [--base <ref>]');
+    console.error('usage: node scripts/gds/ship.js <task-id> --regrade [--summary-file <path|-> | --summary "..."] [--response-file <path|-> | --response "..."] [--visual <image>] [--visual-alt "caption"] [--no-merge] [--force] [--verified] [--base <ref>]');
     process.exit(2);
   }
   // task 1003702: refuse --notes rather than swallowing it. The reasoning — why
@@ -840,6 +840,16 @@ async function regradeMain() {
     for (const line of regradeNotesRefusal(taskId)) console.error(line);
     process.exit(2);
   }
+  // task 1004665: --visual used to be screened by shipMain and then dropped here
+  // without a word — this path returned before shipMain's upload, so visual_url
+  // stayed null (task 1004351). Screen it at the same early position as the
+  // --notes refusal (bad input costs no grade spend), and attach it on every
+  // path below that goes on to grade or land. shipMain's resume-grade dispatch
+  // hands over the visual it already screened rather than reading the file twice.
+  const visual = opts.visual !== undefined ? opts.visual : shipVisual.fromArgs(args, { regrade: true });
+  const attachVisual = async () => (visual
+    ? shipVisual.upload({ taskId, visual, client: await cliClient(), errorLine: apiErrorLine })
+    : false);
   const regradeProse = resolveProse(args, ['summary', 'response']);
   const summaryArg = regradeProse.summary;
   // task 1002662: the builder's response to the prior round's findings — how
@@ -908,6 +918,7 @@ async function regradeMain() {
   // only re-publishes the branch (the recovery for a publish that failed).
   if (tweakHold.isHeldForArtist(task, tRes.data.grade ? tRes.data.grade.passed : null)) {
     console.log(`Task #${taskId} already passed its grade and is waiting for the artist: re-publishing its branch, not re-grading.`);
+    await attachVisual();
     await finishShip({
       taskId, summary: summaryArg || task.value_summary || '', held: true, postGradeStatus: 'completed', doneLine: 'Done.',
       card: { title: task.title, valueSummary: summaryArg || task.value_summary || '', notes: '' },
@@ -989,6 +1000,7 @@ async function regradeMain() {
       console.log('');
       console.log(`Nothing to grade (the committed diff vs ${graderBaseline || 'baseline'} is empty) and this ship`);
       console.log('declares itself artifact-free — manual-confirming via POST /tasks/:id/confirm.');
+      await attachVisual();
       // A kind='verify' task cannot reach here without --verified: the gate above
       // exits first, so the server's verify_attestation_required can't fire below.
       const confirm = await (await cliClient()).tasks.postTasksIdConfirm({ id: taskId, body: { verified } });
@@ -1060,6 +1072,9 @@ async function regradeMain() {
   // the panel runs afterwards. The row, the grader prompt, the merge commit and
   // the PR then all carry the same sentence.
   await persistRegradeSummary({ taskId, summaryArg, task });
+  // task 1004665: the picture goes up at the same point and for the same reason
+  // as the summary — after every guard that can still refuse, before the panel.
+  await attachVisual();
 
   // ---- Delta-aware prior-round context (task 1002662) ----
   // The prior grade's findings + the builder's response + the interim fix diff

package/scripts/gds/ship-visual.js

@@ -28,17 +28,24 @@ const taskVisuals = require('../../modules/lifecycle/task-visuals');
 // EXITS (code 2) on bad input: this runs before any heavy work, so a wrong path
 // costs the builder a retyped command, not a claim. Pure enough to reason about;
 // the exit is the deliberate CLI edge.
-function fromArgs(args) {
+//
+// `regrade: true` is the `ship.js <id> --regrade` caller (task 1004665). There is
+// no claim left to resolve on that path, so the wording names what IS true there:
+// the task stays at completed, and the picture goes up before the grade runs.
+function fromArgs(args, { regrade = false } = {}) {
   const file = arg('--visual', args) || '';
   if (!file) return null;
   const read = taskVisuals.readImageFile(file);
   if (!read.ok) {
-    console.error(`Ship aborted: --visual ${file} — ${read.message}`);
-    console.error('Fix the path (or drop --visual: a visual is always optional). No claim resolved, no credits awarded.');
+    console.error(`${regrade ? 'Re-grade' : 'Ship'} aborted: --visual ${file} — ${read.message}`);
+    console.error(regrade
+      ? 'Fix the path (or drop --visual: a visual is always optional). Nothing was graded; the task stays at completed.'
+      : 'Fix the path (or drop --visual: a visual is always optional). No claim resolved, no credits awarded.');
     process.exit(2);
   }
   const visual = { ...read, alt: arg('--visual-alt', args) || '', name: path.basename(file) };
-  console.log(`--visual: ${visual.name} (${visual.contentType}, ${Math.round(visual.buf.length / 1024)} KB) — uploaded after the claim resolves.`);
+  const when = regrade ? 'uploaded before the re-grade runs' : 'uploaded after the claim resolves';
+  console.log(`--visual: ${visual.name} (${visual.contentType}, ${Math.round(visual.buf.length / 1024)} KB) — ${when}.`);
   return visual;
 }
 

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.103'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.104'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/ship_visual_regrade.mjs

@@ -0,0 +1,167 @@
+// tests/ship_visual_regrade.mjs — `ship.js <id> --regrade --visual <image>`
+// attaches the picture (task 1004665).
+//
+// It used to be dropped without a word: shipMain screened --visual and then
+// returned into regradeMain() before its own upload, and regradeMain never
+// looked at the flag, so visual_url stayed null (hit on task 1004351, where a
+// grader blocker asked for screenshots). These cases pin the screening wording
+// on the re-grade path, the best-effort upload, and the wiring — every path
+// regradeMain takes to grade or land attaches the visual first.
+//
+// Run:  node tests/ship_visual_regrade.mjs
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const shipVisual = require('../scripts/gds/ship-visual.js');
+
+const PNG = Buffer.concat([Buffer.from('89504e470d0a1a0a0000000d49484452', 'hex'), Buffer.alloc(64)]);
+const TMP = mkdtempSync(path.join(os.tmpdir(), 'ship-visual-regrade-'));
+const good = path.join(TMP, 'after.png');
+writeFileSync(good, PNG);
+process.on('exit', () => rmSync(TMP, { recursive: true, force: true }));
+
+// Capture console output and turn process.exit into a throw, so the CLI edge of
+// fromArgs can be asserted without ending the test process.
+function capture(fn) {
+  const out = []; const err = []; const warn = [];
+  const saved = { log: console.log, error: console.error, warn: console.warn, exit: process.exit };
+  console.log = (...a) => out.push(a.join(' '));
+  console.error = (...a) => err.push(a.join(' '));
+  console.warn = (...a) => warn.push(a.join(' '));
+  process.exit = (code) => { const e = new Error(`exit ${code}`); e.exitCode = code; throw e; };
+  let result; let exitCode = null;
+  try {
+    result = fn();
+  } catch (e) {
+    if (e.exitCode === undefined) throw e;
+    exitCode = e.exitCode;
+  } finally {
+    Object.assign(console, { log: saved.log, error: saved.error, warn: saved.warn });
+    process.exit = saved.exit;
+  }
+  return { result, exitCode, out: out.join('\n'), err: err.join('\n'), warn: warn.join('\n') };
+}
+
+// ---- screening ------------------------------------------------------------
+
+test('no --visual means null on both paths, and nothing printed', () => {
+  for (const opts of [undefined, { regrade: true }]) {
+    const r = capture(() => shipVisual.fromArgs(['1', '--regrade'], opts));
+    assert.equal(r.result, null);
+    assert.equal(r.out + r.err, '');
+  }
+});
+
+test('on --regrade a good image is screened and says it goes up BEFORE the grade', () => {
+  const r = capture(() => shipVisual.fromArgs(['1', '--regrade', '--visual', good, '--visual-alt', 'the after'], { regrade: true }));
+  assert.equal(r.exitCode, null);
+  assert.equal(r.result.contentType, 'image/png');
+  assert.equal(r.result.alt, 'the after');
+  assert.match(r.out, /uploaded before the re-grade runs/);
+  assert.doesNotMatch(r.out, /claim resolves/, 'a re-grade has no claim left to resolve');
+});
+
+test('a normal ship keeps its own wording', () => {
+  const r = capture(() => shipVisual.fromArgs(['1', '--visual', good]));
+  assert.match(r.out, /uploaded after the claim resolves/);
+});
+
+test('on --regrade a bad path aborts BEFORE any grade, with re-grade wording', () => {
+  const r = capture(() => shipVisual.fromArgs(['1', '--regrade', '--visual', path.join(TMP, 'missing.png')], { regrade: true }));
+  assert.equal(r.exitCode, 2);
+  assert.match(r.err, /^Re-grade aborted: --visual/);
+  assert.match(r.err, /Nothing was graded; the task stays at completed/);
+  assert.doesNotMatch(r.err, /No claim resolved/);
+});
+
+// ---- upload ---------------------------------------------------------------
+
+function fakeClient(response) {
+  const calls = [];
+  return {
+    calls,
+    tasks: { postTasksIdVisual: async (req) => { calls.push(req); return response; } },
+  };
+}
+
+test('upload posts the image to the task and reports it stuck', async () => {
+  const client = fakeClient({ ok: true, status: 201, data: {} });
+  const visual = { buf: PNG, contentType: 'image/png', alt: 'cap', name: 'after.png' };
+  const r = await (async () => {
+    const saved = console.log; const out = [];
+    console.log = (...a) => out.push(a.join(' '));
+    try { return { ok: await shipVisual.upload({ taskId: 7, visual, client, errorLine: () => '' }), out }; } finally { console.log = saved; }
+  })();
+  assert.equal(r.ok, true);
+  assert.equal(client.calls.length, 1);
+  assert.equal(client.calls[0].id, 7);
+  assert.equal(client.calls[0].body.image_b64, PNG.toString('base64'));
+  assert.equal(client.calls[0].body.alt, 'cap');
+});
+
+test('a failed upload is a warning naming the manual re-attach, never a failure', async () => {
+  const client = fakeClient({ ok: false, status: 403, data: { error: 'nope' } });
+  const visual = { buf: PNG, contentType: 'image/png', alt: '', name: 'after.png' };
+  const saved = console.warn; const warn = [];
+  console.warn = (...a) => warn.push(a.join(' '));
+  let ok;
+  try { ok = await shipVisual.upload({ taskId: 7, visual, client, errorLine: (d, s) => `HTTP ${s}` }); } finally { console.warn = saved; }
+  assert.equal(ok, false);
+  assert.match(warn.join('\n'), /node scripts\/gds\/task\.js visual 7 <image>/);
+});
+
+test('no visual uploads nothing', async () => {
+  const client = fakeClient({ ok: true });
+  assert.equal(await shipVisual.upload({ taskId: 7, visual: null, client, errorLine: () => '' }), false);
+  assert.equal(client.calls.length, 0);
+});
+
+// ---- wiring ---------------------------------------------------------------
+
+const src = readFileSync(new URL('../scripts/gds/ship-flow.js', import.meta.url), 'utf8');
+const stripComments = (s) => s.replace(/^\s*\/\/[^\n]*$/gm, '');
+const regrade = stripComments(src.slice(src.indexOf('async function regradeMain'), src.indexOf('module.exports')));
+const ship = stripComments(src.slice(src.indexOf('async function shipMain'), src.indexOf('async function regradeMain')));
+
+test('regradeMain screens --visual early, before the preflight and the panel', () => {
+  const screen = regrade.indexOf('shipVisual.fromArgs(args, { regrade: true })');
+  assert.ok(screen !== -1, 'regradeMain screens the flag itself');
+  assert.ok(screen < regrade.indexOf('preflight(claimLike'), 'before the preflight');
+  assert.ok(screen < regrade.indexOf('gradeAndRecord('), 'before any grade spend');
+});
+
+test('every path regradeMain takes to grade or land attaches the visual first', () => {
+  // Three ways out that do real work: the held re-publish, the artifact-free
+  // confirm, and the graded path. Each finishShip must be preceded by an attach
+  // that sits AFTER the previous finishShip — i.e. one attach per path.
+  const finishes = [...regrade.matchAll(/await finishShip\(/g)].map((m) => m.index);
+  const attaches = [...regrade.matchAll(/await attachVisual\(\)/g)].map((m) => m.index);
+  assert.equal(finishes.length, 3, 'three landing paths (update this pin if one is added)');
+  assert.equal(attaches.length, 3, 'one attach per landing path');
+  let prev = -1;
+  finishes.forEach((f, i) => {
+    assert.ok(attaches[i] > prev && attaches[i] < f, `landing path ${i + 1} attaches before it lands`);
+    prev = f;
+  });
+  // The graded path attaches before the panel runs, after the summary persists.
+  const graded = attaches[2];
+  assert.ok(regrade.indexOf('await persistRegradeSummary(') < graded, 'after every guard that can refuse');
+  assert.ok(graded < regrade.indexOf('gradeAndRecord('), 'before the grade');
+  // The artifact-free path attaches before the confirm call lands it.
+  assert.ok(attaches[1] < regrade.indexOf('postTasksIdConfirm('), 'before the manual confirm');
+});
+
+test('a plain re-ship that resumes the grade hands over the visual it screened', () => {
+  assert.match(ship, /return regradeMain\(\{ visual \}\)/);
+  assert.match(regrade, /opts\.visual !== undefined \? opts\.visual : shipVisual\.fromArgs/);
+});
+
+test('the re-grade usage line advertises --visual', () => {
+  const usage = regrade.slice(0, regrade.indexOf('process.exit(2)'));
+  assert.match(usage, /--regrade [^\n]*--visual <image>/);
+});