@bongos/core 1.25.26 → 1.25.27

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.25.26",
-  "core_contract": "1.25.26",
-  "source_commit": "333272867d71e2400d7ed05f8ebb2fd7fe522ed6",
+  "core_version": "1.25.27",
+  "core_contract": "1.25.27",
+  "source_commit": "b321f053c5b89fb964e23d3501fb95204d4bfe83",
   "source_ref": "HEAD",
-  "built_at": "2026-11-14T12:08:53.368Z",
+  "built_at": "2026-11-14T12:30:46.728Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 658,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 4781,
-  "tree_sha256": "b92f75ed02e59a4b90c41c591c58928e9301ba2e5c90686d4bb1864f931073df",
+  "tree_sha256": "1a404673caec4bc1439d64975360a33e6b364ab2d3305053c0e024b9c044b40d",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -3102,7 +3102,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8faf34734c00080a73a11b33921860c3976f8b732f82135d47e665dc5668ba57"
+      "sha256": "982cd09fb469c00defeab1c14286f4754015379bae3cfdc2bd0b61b2554f570a"
     },
     {
       "path": "docs/modules-contract.md",
@@ -12397,7 +12397,7 @@
     {
       "path": "modules/ui-design/scripts/gen-design-reference.js",
       "mode": "0000644",
-      "sha256": "d59b046a2aabda513d2d580a574c74ae43b04e97c847315c16eaa2ab50144ffb"
+      "sha256": "44ff275872e8e507cb5eb01e776d9b36397af2a6cf6eb2b05651e3202201202d"
     },
     {
       "path": "modules/ui-design/scripts/gen-design-tokens.js",
@@ -12517,12 +12517,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "fae7574993d6498dcb88ab2fb6c096377e3f0c1dc6f0c7f269983c8a2adcede2"
+      "sha256": "0b23626017f0c3887b6d928ef51bdc1d6526ada92d9a192bd4133e4afcefa442"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "31c7a80481f182612abb3c939c0ac183ca8c0bd73bc483dfa02da185b4fee6c8"
+      "sha256": "e501947d6ce6cb236c3ad900e54e9cf56ceda5cc436e6c67d5a17227a870c225"
     },
     {
       "path": "public-docs/index.html",
@@ -12542,7 +12542,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "99b7a75257ba26c793f17beccdf179602f0f8170e0460b523919a8003dc226fa"
+      "sha256": "939ee4a2830217d56ff5497f54e725473fb27070e191b80c0a14855a97d0a9b5"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -13162,7 +13162,7 @@
     {
       "path": "scripts/bongos/gen-brand.js",
       "mode": "0000644",
-      "sha256": "bc3ce6eebc646e7f2359ef2495a99878e060d7b41c27673833d824d428a379bd"
+      "sha256": "a275ed2efd592a718b2a9ed0475f7f735bb414be8daf37a4c76e607d56b6f6d7"
     },
     {
       "path": "scripts/bongos/gen-diagrams.js",
@@ -16622,7 +16622,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "56af6386047adbdea50e906ae27716d3b32d4ae5e362dbda28c04bcb751fbb81"
+      "sha256": "12ea79d0c2153b6c8641dee679ed5c9afa30fe03d141f44bf82304db083dc714"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -17447,7 +17447,7 @@
     {
       "path": "tests/brand_mark.mjs",
       "mode": "0000644",
-      "sha256": "68ff85560c05b7426139527cea3832429e17da4b64c96bbc26ba46c02305d97e"
+      "sha256": "466efb92e78175fe4a5c95bbae20fe060b568566fc5e7a24e639383fea136866"
     },
     {
       "path": "tests/brand_surfaces.mjs",
@@ -18217,12 +18217,12 @@
     {
       "path": "tests/design_counts_ratchet.mjs",
       "mode": "0000644",
-      "sha256": "3e7457685c915d01d11ba4dd1481e726f82c83a3ce481f5190893e4b0636b7bc"
+      "sha256": "07ea7fe6b707753d8abc96e54bb75caa6fb3f0ed9127242c1f6f65e57053107d"
     },
     {
       "path": "tests/design_reference.mjs",
       "mode": "0000644",
-      "sha256": "56594abdea98132ba15a7c7c4e207934a429a0bd746de54055f567a8c193fd1d"
+      "sha256": "f1b4bdecc8b33b9d7cb3c6e97a724381e99537f2ec0d2cfbdf80a8ab68bd5c55"
     },
     {
       "path": "tests/design_tokens_generated.mjs",
@@ -19662,7 +19662,7 @@
     {
       "path": "tests/hall_dialog.mjs",
       "mode": "0000644",
-      "sha256": "62d44b70c822b7e99d5e732a8321eb6d2f9c88d6168ceec83bd6ca38b07f97a4"
+      "sha256": "e68494039638141179b82f79dc24bc0eaef031a3969dd74e63b5f4a04b0daa76"
     },
     {
       "path": "tests/hall_error_envelope.mjs",

package/docs/module-api-changelog.md

@@ -3490,5 +3490,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.25.24 with no explicit bump. run 43537450687. (task 1002620)
   1.25.26 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.25.25 with no explicit bump. run 43593222072. (task 1002620)
+  1.25.27 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.25.26 with no explicit bump. run 43595061258. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ui-design/scripts/gen-design-reference.js

@@ -339,7 +339,9 @@ module.exports = { build, blockVars };
 
 if (require.main === module) {
   const next = build();
-  const current = fs.existsSync(OUT) ? fs.readFileSync(OUT, 'utf8') : '';
+  // task 1005296: compare content, not line endings. A `core.autocrlf=true` checkout reads
+  // brand.html back as CRLF while build() is LF, which read as stale forever.
+  const current = fs.existsSync(OUT) ? fs.readFileSync(OUT, 'utf8').replace(/\r\n/g, '\n') : '';
   if (process.argv.includes('--check')) {
     if (current === next) process.stdout.write('brand.html: current\n');
     else {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.26",
+  "version": "1.25.27",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.26",
+      "version": "1.25.27",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.26",
+  "version": "1.25.27",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11924,5 +11924,15 @@
       "id": "1005266",
       "text": "In game mode the visor now steps out of the way while you look around and fades back in, slimmer than before, when you reach for a command."
     }
+  ],
+  "1.25.27": [
+    {
+      "id": "1005296",
+      "text": "The pre-ship health check no longer wrongly says the brand page and logo files are out of date on Windows computers."
+    },
+    {
+      "id": "1005197",
+      "text": "A hall check that always failed on Windows computers now works there, so it can again spot a page loading its scripts in the wrong order."
+    }
   ]
 }

package/scripts/bongos/gen-brand.js

@@ -35,6 +35,7 @@ const path = require('node:path');
 const crypto = require('node:crypto');
 const { readMarkSource, markParts, markFile, faviconSvg } = require('../../src/brand-mark');
 const { escapeHtml } = require('../../src/html-escape');
+const { sameContent } = require('./gen-freshness'); // eol-insensitive freshness (CRLF checkouts, task 1005296)
 
 const ROOT = path.resolve(__dirname, '..', '..');
 
@@ -158,7 +159,7 @@ async function main() {
   for (const [name, text] of Object.entries(files)) {
     const file = path.join(dir, name);
     const cur = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null;
-    if (cur === text) continue;
+    if (cur !== null && sameContent(cur, text)) continue;
     stale.push(name);
     if (!args.includes('--check')) fs.writeFileSync(file, text);
   }

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.26'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.27'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/brand_mark.mjs

@@ -95,7 +95,8 @@ test('the brand folder holds exactly what gen-brand.js writes from the source (l
   const { brandFiles, packColors } = require('../scripts/bongos/gen-brand.js');
   const files = brandFiles(read(BRAND_DIR, 'mark.svg'), packColors());
   for (const [name, text] of Object.entries(files)) {
-    assert.equal(read(BRAND_DIR, name), text, `${name} is stale — run node scripts/bongos/gen-brand.js`);
+    assert.equal(read(BRAND_DIR, name).replace(/\r\n/g, '\n'), text, // CRLF checkouts (task 1005296)
+`${name} is stale — run node scripts/bongos/gen-brand.js`);
   }
   const c = packColors();
   assert.match(files['mark-light.svg'], new RegExp(c.ink));

package/tests/design_counts_ratchet.mjs

@@ -99,6 +99,7 @@ const GENERATOR_SOURCES = [
   'modules/hall-ui/public/controls.css',
   'modules/hall-ui/public/dom-utils.js',
   'scripts/bongos/gen-brand.js',
+  'scripts/bongos/gen-freshness.js',
   'src/brand-mark.js',
   'src/html-escape.js',
   'DESIGN.md',
@@ -135,6 +136,26 @@ test('the freshness gate passes on a fresh tree and fails when the token sheet c
   }
 });
 
+// task 1005296: a `core.autocrlf=true` checkout (every default Windows clone) hands the
+// generators CRLF copies of brand.html and the logo SVGs, while they build LF. Freshness is
+// about content, so line endings alone must not read as stale — but a real edit still must.
+test('the freshness gate ignores CRLF line endings on the brand page and the logo set', () => {
+  const dir = copiedTree();
+  const toCrlf = (f) => fs.writeFileSync(f, fs.readFileSync(f, 'utf8').replace(/\r\n/g, '\n').replace(/\n/g, '\r\n'));
+  try {
+    const page = path.join(dir, 'modules/ui-design/public/brand.html');
+    const brand = path.join(dir, 'modules/ui-design/public/brand');
+    toCrlf(page);
+    for (const f of fs.readdirSync(brand).filter((n) => n.endsWith('.svg'))) toCrlf(path.join(brand, f));
+    assert.ok(fs.readFileSync(page, 'utf8').includes('\r\n'), 'the brand page should now carry CRLF');
+    assert.deepEqual(checkDesignGeneratorsFresh(dir), [], 'CRLF alone must not read as stale');
+    fs.appendFileSync(page, '<!-- hand edit -->\r\n');
+    assert.ok(checkDesignGeneratorsFresh(dir).some((x) => x.startsWith('modules/ui-design/public/brand.html')), 'a real edit must still read as stale');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 // task 1005133: the logo set joins the gate. Editing the one source (mark.svg) without
 // running gen-brand.js fails it; so does a PNG whose source page moved (the pack's ground)
 // or a PNG swapped by hand — the PNGs are checked by hash, not just their pixel size.

package/tests/design_reference.mjs

@@ -48,7 +48,7 @@ function sources() {
 // ── 1. generated ─────────────────────────────────────────────────────────────
 
 test('the committed page is exactly what the generator writes', () => {
-  assert.equal(PAGE, gen.build(),
+  assert.equal(PAGE.replace(/\r\n/g, '\n'), gen.build(), // CRLF checkouts (task 1005296)
     'modules/ui-design/public/brand.html is stale or hand-edited: run node modules/ui-design/scripts/gen-design-reference.js');
 });
 

package/tests/hall_dialog.mjs

@@ -290,10 +290,29 @@ test('the guard catches a browser box when one comes back, and leaves the shared
   }
 });
 
+// shell.js's tag, then hall-dialog.js's on the very next line. Either line ending: git's
+// core.autocrlf checks every page out with CRLF on Windows, and an LF-only `\n` here failed every
+// page there, so a real misordering (task 1005148's visor.js between the two) read as noise.
+// Task 1005197.
+function shellThenDialog(html) {
+  return html.match(/<script src="\/builders\/shell\.js[^"]*"( defer)?><\/script>\r?\n<script src="\/builders\/hall-dialog\.js"( defer)?><\/script>/);
+}
+
+test('the shell-then-dialog order check reads LF and CRLF pages alike, and still catches a misorder', () => {
+  const pair = ['<script src="/builders/shell.js?v=1" defer></script>', '<script src="/builders/hall-dialog.js" defer></script>'];
+  for (const eol of ['\n', '\r\n']) {
+    const m = shellThenDialog(pair.join(eol));
+    assert.ok(m, `matched with ${JSON.stringify(eol)} line endings`);
+    assert.equal(m[1], m[2]);
+    const between = [pair[0], '<script src="/builders/visor.js" defer></script>', pair[1]].join(eol);
+    assert.equal(shellThenDialog(between), null, `a script between them is caught with ${JSON.stringify(eol)}`);
+  }
+});
+
 test('every hall page loads the shared dialog right after the shell, deferred alike', () => {
   for (const f of fs.readdirSync(PUB).filter((n) => n.endsWith('.html'))) {
     const html = read(f);
-    const shell = html.match(/<script src="\/builders\/shell\.js[^"]*"( defer)?><\/script>\n<script src="\/builders\/hall-dialog\.js"( defer)?><\/script>/);
+    const shell = shellThenDialog(html);
     if (!/\/builders\/shell\.js/.test(html)) continue;
     assert.ok(shell, `${f} loads hall-dialog.js right after shell.js`);
     assert.equal(shell[1], shell[2], `${f}: deferred alike`);