@bongos/core 1.17.0 → 1.17.1

package/src/instance-config.js

@@ -172,7 +172,7 @@ function resolveInstanceRoot({ env = process.env } = {}) {
 // is written/read. A consumer that installs the core as an npm dep points at its
 // own repo (via <PREFIX>_INSTANCE_ROOT / bongos.config.json — e.g. `bongos
 // upgrade` sets it), so the docs+client regenerate INTO the instance, not into
-// node_modules/@cloudbongos/core. In a single checkout no pointer is set, so this
+// node_modules/@bongos/core. In a single checkout no pointer is set, so this
 // is resolveCoreRoot() — BYTE-IDENTICAL to today (ADR 0108). Deliberately NOT the
 // cwd fallback: a generated-doc write must be deterministic.
 function resolveDocsRoot(opts = {}) {

package/src/module-api.js

@@ -176,8 +176,20 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         the same reason validateOrRespond/LIMITS are on the doorway. Additive
 //         (new exports, no export removed or changed) → MINOR; every `^1.x`
 //         module keeps working, and a module using them is satisfied by 1.17.0.
+// 1.17.1 — task 2124 (republish after task 2121): the FIRST PATCH bump on this
+//         surface. No doorway export is added, changed, or removed — the exported
+//         surface is byte-identical to 1.17.0. What changed is the PUBLISHED ARTIFACT's
+//         content: (a) task 2121 taught package-core to replace every CLAUDE.md/AGENTS.md
+//         in the @bongos/core tarball with a tiny brand-free stub, so a consumer instance's
+//         agent no longer auto-loads the platform's own project memory from
+//         node_modules/@bongos/core/ (the 2026-07-08 demo audit leak); (b) the bundled code
+//         carries the task-2126 clearer device_flow_disabled error surfacing. A backwards-
+//         compatible artifact fix with no API change is exactly semver PATCH. The bump is
+//         REQUIRED because 1.17.0 was already published to npm and task 2121 shipped
+//         without one, so `bongos package-core --publish` on 1.17.0 would be rejected as a
+//         re-publish. Every `^1.x` / `^1.17` module pin is satisfied by 1.17.1.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.17.0'; // see the changelog above — R14 adds the shared pagination helpers to the doorway (#2001)
+const CORE_VERSION = '1.17.1'; // see the changelog above — 1.17.1 republishes the artifact with the task-2121 agent-doc stub (no doorway change) (task 2124)
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -144,5 +144,110 @@ t('copyTreeTransformed: overwrite defaults true → greenfield still clobbers (r
   rmSync(dest, { recursive: true, force: true });
 });
 
+// ---- instance rebrand (task 2103a) -----------------------------------------
+const OTB = { domains: { publicOrigin: 'https://amazonprimea.com', buildersOrigin: 'https://builders.amazonprimea.com', statusOrigin: 'https://status.amazonprimea.com' }, configDir: 'otb', envPrefix: 'OTB' };
+
+t('buildRebrandRules: full target → founder origin/config-dir/prefix all rewritten', () => {
+  const to = { domains: { publicOrigin: 'https://demo.cloudbongos.com', buildersOrigin: 'https://demo.cloudbongos.com', statusOrigin: 'https://demo.cloudbongos.com' }, envPrefix: 'CLOUDBONGOS' };
+  const out = m.rebrandText('b="https://amazonprimea.com" h="builders.amazonprimea.com" ~/.config/otb OTB_API_BASE [otb]', m.buildRebrandRules(OTB, to));
+  assert.ok(!out.includes('amazonprimea'), `no founder host survives: ${out}`);
+  assert.ok(out.includes('https://demo.cloudbongos.com'), 'public origin rewritten');
+  assert.ok(out.includes('~/.config/cloudbongos') && out.includes('CLOUDBONGOS_API_BASE') && out.includes('[cloudbongos]'), 'config-dir + prefix + log tag rewritten');
+});
+
+t('buildRebrandRules: partial target (only publicOrigin) → subdomains fall back to target public host, not builders.<target>', () => {
+  const out = m.rebrandText('builders.amazonprimea.com', m.buildRebrandRules(OTB, { domains: { publicOrigin: 'https://acme.example.org' }, envPrefix: 'ACME' }));
+  assert.equal(out, 'acme.example.org', 'no builders.acme.example.org mangling');
+});
+
+t('buildRebrandRules: source === target is an empty ruleset → rebrandText is a no-op', () => {
+  assert.equal(m.buildRebrandRules(OTB, OTB).length, 0);
+  const s = 'https://amazonprimea.com ~/.config/otb';
+  assert.equal(m.rebrandText(s, m.buildRebrandRules(OTB, OTB)), s);
+});
+
+// ---- skill filtering by disabled module (task 2103b) -----------------------
+t('disabledModuleSkills: only skills of DISABLED modules are collected (default + explicit override)', () => {
+  const core = mkdtempSync(join(tmpdir(), 'rb-core-'));
+  const inst = mkdtempSync(join(tmpdir(), 'rb-inst-'));
+  const mod = (key, def, skills) => { const d = join(core, 'modules', key); mkdirSync(d, { recursive: true }); writeFileSync(join(d, 'module.json'), JSON.stringify({ key, default: def, contributes: { skills } })); };
+  mod('foo', false, ['a']);   // default off, but ENABLED in config → keep
+  mod('bar', true, ['b']);    // default on, not overridden → keep
+  mod('baz', false, ['c']);   // default off, not overridden → SKIP
+  mod('qux', true, ['d']);    // default on, but DISABLED in config → SKIP
+  mkdirSync(join(inst, 'config'), { recursive: true });
+  writeFileSync(join(inst, 'config', 'modules.json'), JSON.stringify({ modules: { foo: true, qux: false } }));
+  const skip = m.disabledModuleSkills({ coreRoot: core, instanceDir: inst });
+  assert.deepEqual([...skip].sort(), ['c', 'd']);
+  rmSync(core, { recursive: true, force: true }); rmSync(inst, { recursive: true, force: true });
+});
+
+// ---- materializeClaude end-to-end: rebrand + skill-exclude (from the REAL repo) --
+t('materializeClaude: copied hooks carry NO founder origin/config-dir; a disabled-module skill is excluded', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'rb-e2e-'));
+  // Target instance: demo-branded, art-pipeline OFF (so its otb-* skills must be dropped).
+  mkdirSync(join(dir, 'config'), { recursive: true });
+  writeFileSync(join(dir, 'config', 'branding.json'), JSON.stringify({ domains: { publicOrigin: 'https://demo.cloudbongos.com', buildersOrigin: 'https://demo.cloudbongos.com', statusOrigin: 'https://demo.cloudbongos.com', oauthOrigin: 'https://demo.cloudbongos.com' }, configDir: 'cloudbongos', envPrefix: 'CLOUDBONGOS' }));
+  writeFileSync(join(dir, 'config', 'modules.json'), JSON.stringify({ modules: { 'art-pipeline': false } }));
+  const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
+  assert.ok(res.rebrandRules > 0, 'rebrand rules were built from the OTB→demo branding delta');
+
+  // (a) no copied hook may still name the founder origin or config dir.
+  const offenders = [];
+  const hooksDir = join(dir, '.claude', 'hooks');
+  if (existsSync(hooksDir)) {
+    const walk = (d) => { for (const n of readdirSync(d, { withFileTypes: true })) { const p = join(d, n.name); if (n.isDirectory()) walk(p); else { const txt = readFileSync(p, 'utf8'); if (txt.includes('amazonprimea.com') || txt.includes('.config/otb') || txt.includes('/etc/otb')) offenders.push(n.name); } } };
+    walk(hooksDir);
+  }
+  assert.deepEqual(offenders, [], `founder origin/config-dir survived in: ${offenders.join(', ')}`);
+
+  // (b) art-pipeline is off → its otb-* skills are excluded; a core skill remains.
+  assert.ok(res.excludedSkills.includes('otb-tile-generate'), `art-pipeline skill excluded (got ${res.excludedSkills.join(',')})`);
+  assert.ok(!existsSync(join(dir, '.claude', 'skills', 'otb-tile-generate')), 'excluded skill not written');
+  assert.ok(existsSync(join(dir, '.claude', 'skills', 'builder-ship')), 'a core skill is still materialized');
+  rmSync(dir, { recursive: true, force: true });
+});
+
+// ---- CLAUDE.md scaffold (task 2104) ----------------------------------------
+const tmpl = require('../scripts/gds/claude-md-template.js');
+
+t('renderInstanceClaudeMd: brand-substituted — names the instance + its hall/currency, no founder literal', () => {
+  const md = tmpl.renderInstanceClaudeMd({ identity: { productName: 'Acme', worldName: 'Acmeland', company: { name: 'Widgets Inc' } }, domains: { publicOrigin: 'https://acme.example.org', buildersOrigin: 'https://builders.acme.example.org', statusOrigin: 'https://status.acme.example.org' }, currency: { label: 'coins' } });
+  assert.ok(md.startsWith('# Acme — Project Memory'), 'titled with the product name');
+  assert.ok(md.includes('the Acmeland world') && md.includes('by Widgets Inc'), 'world + company woven in');
+  assert.ok(md.includes('https://builders.acme.example.org'), 'hall origin present');
+  assert.ok(md.includes('coins'), 'currency label present');
+  assert.ok(!md.toLowerCase().includes('amazonprimea') && !md.includes('~/.config/otb'), 'no founder literal in the starter');
+});
+
+t('renderInstanceClaudeMd: degrades cleanly on a minimal branding (no world dup, defaults currency)', () => {
+  const md = tmpl.renderInstanceClaudeMd({ identity: { productName: 'Solo', worldName: 'Solo' } });
+  assert.ok(md.startsWith('# Solo — Project Memory'));
+  assert.ok(!md.includes('the Solo world'), 'world == product is not duplicated');
+  assert.ok(md.includes('credits'), 'currency defaults to credits');
+});
+
+t('materializeClaude: writes a brand-substituted CLAUDE.md when the instance has none', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'cm-md-'));
+  mkdirSync(join(dir, 'config'), { recursive: true });
+  writeFileSync(join(dir, 'config', 'branding.json'), JSON.stringify({ identity: { productName: 'Freshie' }, domains: { publicOrigin: 'https://freshie.example.com' }, configDir: 'freshie', envPrefix: 'FRESHIE' }));
+  const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
+  assert.equal(res.claudeMd, true, 'reported writing CLAUDE.md');
+  assert.ok(readFileSync(join(dir, 'CLAUDE.md'), 'utf8').startsWith('# Freshie — Project Memory'), 'written + brand-substituted');
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('materializeClaude: NEVER clobbers an existing CLAUDE.md (init / adopt / upgrade safe)', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'cm-md2-'));
+  mkdirSync(join(dir, 'config'), { recursive: true });
+  writeFileSync(join(dir, 'config', 'branding.json'), JSON.stringify({ identity: { productName: 'Freshie' }, domains: { publicOrigin: 'https://freshie.example.com' } }));
+  const owner = '# My own CLAUDE.md — do not touch\n';
+  writeFileSync(join(dir, 'CLAUDE.md'), owner);
+  const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
+  assert.equal(res.claudeMd, false, 'did not (re)write');
+  assert.equal(readFileSync(join(dir, 'CLAUDE.md'), 'utf8'), owner, 'existing CLAUDE.md left byte-untouched');
+  rmSync(dir, { recursive: true, force: true });
+});
+
 console.log(`\nclaude_materialize: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/device_flow_start.mjs

@@ -0,0 +1,73 @@
+// tests/device_flow_start.mjs
+//
+// task 2126 (demo-audit fix C3) — startDeviceFlow() must surface a GitHub OAuth-App
+// misconfig (the HTTP-200-with-{error} body: device_flow_disabled / bad client) as an
+// ACTIONABLE thrown error, not silently drop the missing device_code into a broken flow
+// (which the route then reported as an opaque 500 — the 2026-07-08 demo login failure).
+//
+// Hermetic: stubs globalThis.fetch (no network) + sets creds env so loadGithubCreds()
+// succeeds. auth.js requires pool but never QUERIES it here (startDeviceFlow only fetches),
+// so no DB. Run:  node tests/device_flow_start.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+// Creds must resolve before startDeviceFlow runs loadGithubCreds() — set legacy + prefixed.
+for (const p of ['GDS', 'OTB', 'CLOUDBONGOS']) {
+  process.env[`${p}_GITHUB_CLIENT_ID`] = 'Iv1.testclientid00';
+  process.env[`${p}_GITHUB_CLIENT_SECRET`] = 'testsecret000000000000000000000000000000';
+}
+
+const require = createRequire(import.meta.url);
+const auth = require('../src/bongos/auth.js');
+
+let passed = 0, failed = 0;
+const realFetch = globalThis.fetch;
+function stubFetch(status, jsonBody) {
+  globalThis.fetch = async () => ({
+    ok: status >= 200 && status < 300,
+    status,
+    json: async () => jsonBody,
+    text: async () => JSON.stringify(jsonBody),
+  });
+}
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+  finally { globalThis.fetch = realFetch; }
+}
+
+await t('device_flow_disabled (HTTP 200 + error body) → throws an actionable, named error', async () => {
+  stubFetch(200, { error: 'device_flow_disabled', error_description: 'Device Flow is not enabled for this app.' });
+  await assert.rejects(
+    () => auth.startDeviceFlow(),
+    (err) => /device_flow_disabled/.test(err.message) && /device-flow start/i.test(err.message),
+  );
+});
+
+await t('incorrect_client_credentials (HTTP 200 + error) → throws, names the error', async () => {
+  stubFetch(200, { error: 'incorrect_client_credentials', error_description: 'The client_id is not valid.' });
+  await assert.rejects(() => auth.startDeviceFlow(), (err) => /incorrect_client_credentials/.test(err.message));
+});
+
+await t('happy path (valid device/code body) → returns the flow fields', async () => {
+  stubFetch(200, { device_code: 'dc_abc', user_code: 'WXYZ-1234', verification_uri: 'https://github.com/login/device', expires_in: 900, interval: 5 });
+  const out = await auth.startDeviceFlow();
+  assert.equal(out.device_code, 'dc_abc');
+  assert.equal(out.user_code, 'WXYZ-1234');
+  assert.equal(out.verification_uri, 'https://github.com/login/device');
+  assert.equal(out.interval, 5);
+});
+
+await t('malformed 200 (no device_code, no error) → throws rather than a broken flow', async () => {
+  stubFetch(200, {});
+  await assert.rejects(() => auth.startDeviceFlow(), (err) => /device_code/.test(err.message));
+});
+
+await t('non-2xx from GitHub still throws (pre-existing guard preserved)', async () => {
+  stubFetch(404, { message: 'Not Found' });
+  await assert.rejects(() => auth.startDeviceFlow(), (err) => /device\/code failed \(404\)/.test(err.message));
+});
+
+console.log(`\ndevice-flow start (task 2126) tests: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/first_run_engine_check.mjs

@@ -0,0 +1,79 @@
+// tests/first_run_engine_check.mjs
+//
+// The SessionStart first-run engine check (task 2105): a freshly-cloned standalone
+// instance that hasn't run `npm install` has no `bongos`/tools, so a session used
+// to improvise against the wrong instance (the 2026-07-08 demo-session failure).
+// firstRunEngineCheck() detects that state and prints the two first-run commands.
+// It reads package.json + config/branding.json directly (never requires the missing
+// core), is inert on a source/monorepo checkout and once installed, and is injectable
+// (projectDir + log) so it unit-tests standalone. Run: node tests/first_run_engine_check.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { firstRunEngineCheck } = require('../.claude/hooks/session-start.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL ${name}\n     ${e.message}`); }
+}
+
+// Build a temp instance dir; deps + whether node_modules/<dep> exists + branding are configurable.
+function mkInstance({ dep, installed = false, branding } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), 'fre-'));
+  writeFileSync(join(dir, 'package.json'), JSON.stringify({ name: 'x', dependencies: dep ? { [dep]: 'file:vendor/x.tgz' } : { express: '^4' } }));
+  if (installed && dep) mkdirSync(join(dir, 'node_modules', dep), { recursive: true });
+  if (branding) { mkdirSync(join(dir, 'config'), { recursive: true }); writeFileSync(join(dir, 'config', 'branding.json'), JSON.stringify(branding)); }
+  return dir;
+}
+const run = (dir) => { const lines = []; const fired = firstRunEngineCheck(dir, { log: (s) => lines.push(s) }); return { fired, out: lines.join('\n') }; };
+
+t('consumer instance, engine NOT installed → prints the two first-run commands + the login origin', () => {
+  const dir = mkInstance({ dep: '@cloudbongos/core', installed: false, branding: { envPrefix: 'CLOUDBONGOS', domains: { publicOrigin: 'https://demo.cloudbongos.com' } } });
+  const { fired, out } = run(dir);
+  assert.equal(fired, true);
+  assert.ok(out.includes("engine isn't installed"), 'names the problem');
+  assert.ok(out.includes('npm install'), 'step 1');
+  assert.ok(out.includes('npx bongos login https://demo.cloudbongos.com'), 'step 2 with the instance origin');
+  assert.ok(out.includes('[cloudbongos]'), 'tag from branding envPrefix');
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('source / monorepo checkout (no core dependency) → INERT (no output)', () => {
+  const dir = mkInstance({ dep: null });
+  const { fired, out } = run(dir);
+  assert.equal(fired, false);
+  assert.equal(out, '');
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('consumer instance, engine INSTALLED → INERT (nothing to say)', () => {
+  const dir = mkInstance({ dep: '@cloudbongos/core', installed: true, branding: { domains: { publicOrigin: 'https://demo.cloudbongos.com' } } });
+  const { fired } = run(dir);
+  assert.equal(fired, false);
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('accepts the @bongos/core and cloudbongos dependency names too', () => {
+  for (const dep of ['@bongos/core', 'cloudbongos']) {
+    const dir = mkInstance({ dep, installed: false, branding: { domains: { publicOrigin: 'https://x.example.com' } } });
+    assert.equal(run(dir).fired, true, `${dep} recognized as the core dep`);
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+t('missing config/branding.json → still fires, with a placeholder login target (never crashes)', () => {
+  const dir = mkInstance({ dep: '@cloudbongos/core', installed: false });
+  const { fired, out } = run(dir);
+  assert.equal(fired, true);
+  assert.ok(out.includes('npx bongos login <this-instance-url>'), 'placeholder when origin unknown');
+  rmSync(dir, { recursive: true, force: true });
+});
+
+console.log(`\nfirst-run engine check (task 2105): ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/goal_membership_requests.mjs

@@ -40,6 +40,7 @@ const {
   authorizeCreateJoinRequest,
   authorizeInvitationResponse,
   authorizeJoinRequestResponse,
+  authorizeWithdrawJoinRequest,
 } = require('../modules/lifecycle/routes/goals.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
 
@@ -310,12 +311,39 @@ await test('authorizeJoinRequestResponse: an Archon (non-member) resolves → AL
   assert.deepEqual(authorizeJoinRequestResponse({ goal: OWNER_GOAL, actorId: 42, actorRank: 'archon', actorMembership: null, request: REQUEST, goalId: 5 }), { ok: true });
 });
 
+// authorizeWithdrawJoinRequest — only the requester withdraws their own pending
+// join-request (task 1953), a symmetric mirror of authorizeInvitationResponse.
+const REQUEST_FOR_WITHDRAW = { id: 11, goal_id: '5', builder_id: '2', kind: 'request', status: 'pending' };
+await test('authorizeWithdrawJoinRequest: unknown request → 404', () => {
+  const d = authorizeWithdrawJoinRequest({ request: null, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 404); assert.equal(d.body.error, 'request_not_found');
+});
+await test('authorizeWithdrawJoinRequest: request on a different goal → 404 (containment)', () => {
+  const d = authorizeWithdrawJoinRequest({ request: { ...REQUEST_FOR_WITHDRAW, goal_id: '99' }, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 404);
+});
+await test('authorizeWithdrawJoinRequest: row is an invitation, not a request → 400', () => {
+  const d = authorizeWithdrawJoinRequest({ request: { ...REQUEST_FOR_WITHDRAW, kind: 'invite' }, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 400); assert.equal(d.body.error, 'not_a_join_request');
+});
+await test('authorizeWithdrawJoinRequest: already resolved → 409 not_pending', () => {
+  const d = authorizeWithdrawJoinRequest({ request: { ...REQUEST_FOR_WITHDRAW, status: 'accepted' }, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 409); assert.equal(d.body.error, 'not_pending');
+});
+await test('authorizeWithdrawJoinRequest: someone else withdrawing my request → 403 not_your_request', () => {
+  const d = authorizeWithdrawJoinRequest({ request: REQUEST_FOR_WITHDRAW, goalId: 5, actorId: 7 });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'not_your_request');
+});
+await test('authorizeWithdrawJoinRequest: the requester (string vs number id) → ALLOW', () => {
+  assert.deepEqual(authorizeWithdrawJoinRequest({ request: REQUEST_FOR_WITHDRAW, goalId: '5', actorId: 2 }), { ok: true });
+});
+
 // =========================================================================
-// route-rank pins (task 1952) — the walls are in-handler, so the routes stay
-// 'any-builder'; an accidental requireRank re-gate must be a red build.
+// route-rank pins (task 1952/1953) — the walls are in-handler, so the routes
+// stay 'any-builder'; an accidental requireRank re-gate must be a red build.
 // =========================================================================
 
-await test('route-rank pins: the six new routes are pinned any-builder', () => {
+await test('route-rank pins: the eight private-goal routes are pinned any-builder', () => {
   const pins = MODULE_EXPECTED_RANKS.lifecycle;
   for (const r of [
     'GET /goals/inbox',
@@ -324,6 +352,8 @@ await test('route-rank pins: the six new routes are pinned any-builder', () => {
     'POST /goals/:id/requests/:reqId/respond',
     'POST /goals/:id/invitations',
     'POST /goals/:id/invitations/:reqId/respond',
+    'GET /goals/:id/requests',
+    'POST /goals/:id/requests/:reqId/withdraw',
   ]) {
     assert.equal(pins[r], 'any-builder', `${r} must be pinned any-builder (wall is in-handler)`);
   }

package/tests/hook_user_agents.mjs

@@ -0,0 +1,62 @@
+// tests/hook_user_agents.mjs
+//
+// task 2122 (demo-audit fix B) — the scaffolded .claude/hooks must NOT hardcode a
+// founder-instance brand in their outbound HTTP User-Agent. Those hooks are copied
+// into a consumer instance by claude-materialize, whose rebrand maps domain HOSTS
+// (amazonprimea.com), config dirs, and env prefixes — but NOT a bare brand token
+// like `amazonprimea-gds-cli` (no TLD). So a branded UA there leaks the founder's
+// host-brand into every scaffolded instance (criterion gcarry-prod-vanilla).
+//
+// Invariant: every `'User-Agent': '<value>'` literal in .claude/hooks/*.js uses the
+// platform-neutral `cloud-bongos-` prefix (matching src/branding.js userAgent()'s
+// neutral fallback), never an instance brand. Hermetic: reads files only, no DB/net.
+//
+// Run:  node tests/hook_user_agents.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const HOOKS_DIR = path.join(HERE, '..', '.claude', 'hooks');
+
+// Every User-Agent request-header literal, single- or double-quoted.
+const UA_RE = /['"]User-Agent['"]\s*:\s*['"]([^'"]+)['"]/g;
+const NEUTRAL_PREFIX = 'cloud-bongos-';
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const hookFiles = fs.existsSync(HOOKS_DIR)
+  ? fs.readdirSync(HOOKS_DIR).filter((f) => f.endsWith('.js')).sort()
+  : [];
+
+t('.claude/hooks exists and has hook files to check', () => {
+  assert.ok(hookFiles.length > 0, `no hook .js files found under ${HOOKS_DIR}`);
+});
+
+t('every hook User-Agent uses the neutral cloud-bongos- prefix (no founder-brand leak)', () => {
+  const offenders = [];
+  let uaCount = 0;
+  for (const f of hookFiles) {
+    const src = fs.readFileSync(path.join(HOOKS_DIR, f), 'utf8');
+    for (const m of src.matchAll(UA_RE)) {
+      uaCount++;
+      const ua = m[1];
+      if (!ua.startsWith(NEUTRAL_PREFIX)) offenders.push(`${f}: '${ua}'`);
+    }
+  }
+  assert.ok(uaCount > 0, 'expected at least one User-Agent literal across the hooks (regex drift?)');
+  assert.equal(
+    offenders.length, 0,
+    `hook User-Agent(s) not neutral (must start with "${NEUTRAL_PREFIX}"):\n  ${offenders.join('\n  ')}`
+  );
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/init.mjs

@@ -336,12 +336,12 @@ test('buildInstancePackageJson: no package.json → mints a private one with the
   assert.equal(pkg.scripts.start, init.INSTANCE_START_SCRIPT);
   assert.equal(pkg.scripts.migrate, init.INSTANCE_MIGRATE_SCRIPT);
   // the start/migrate scripts must target the installed core package so `npm ci` output is runnable
-  assert.match(pkg.scripts.start, /node_modules\/@cloudbongos\/core\/src\/platform-server\.js$/);
-  assert.match(pkg.scripts.migrate, /node_modules\/@cloudbongos\/core\/scripts\/migrate\.sh$/);
+  assert.match(pkg.scripts.start, /node_modules\/@bongos\/core\/src\/platform-server\.js$/);
+  assert.match(pkg.scripts.migrate, /node_modules\/@bongos\/core\/scripts\/migrate\.sh$/);
 });
 
 test('buildInstancePackageJson: coreDep (file: tarball pin) → the dep is the file: pin, not the caret', () => {
-  const pin = 'file:vendor/cloudbongos-core-1.17.0.tgz';
+  const pin = 'file:vendor/bongos-core-1.17.0.tgz';
   const pkg = init.buildInstancePackageJson(null, { name: 'demo', coreDep: pin });
   assert.equal(pkg.dependencies[init.CORE_PKG], pin);
   assert.notEqual(pkg.dependencies[init.CORE_PKG], init.coreDepRange());
@@ -349,13 +349,13 @@ test('buildInstancePackageJson: coreDep (file: tarball pin) → the dep is the f
 
 test('buildInstancePackageJson: preserves existing fields + never clobbers a custom start/migrate', () => {
   const existing = { name: 'keep-me', version: '2.0.0', scripts: { start: 'node server.js' }, keywords: ['x'] };
-  const pkg = init.buildInstancePackageJson(existing, { name: 'ignored', coreDep: 'file:vendor/cloudbongos-core-1.17.0.tgz' });
+  const pkg = init.buildInstancePackageJson(existing, { name: 'ignored', coreDep: 'file:vendor/bongos-core-1.17.0.tgz' });
   assert.equal(pkg.name, 'keep-me');                         // existing name wins
   assert.equal(pkg.version, '2.0.0');                        // untouched field preserved
   assert.deepEqual(pkg.keywords, ['x']);
   assert.equal(pkg.scripts.start, 'node server.js');         // custom start NOT clobbered
   assert.equal(pkg.scripts.migrate, init.INSTANCE_MIGRATE_SCRIPT); // missing one is filled
-  assert.equal(pkg.dependencies[init.CORE_PKG], 'file:vendor/cloudbongos-core-1.17.0.tgz'); // dep (re)pinned
+  assert.equal(pkg.dependencies[init.CORE_PKG], 'file:vendor/bongos-core-1.17.0.tgz'); // dep (re)pinned
 });
 
 test('writeConfigs (greenfield): mints package.json with the caret core dep + start/migrate scripts', () => {
@@ -377,7 +377,7 @@ test('writeConfigs (greenfield): mints package.json with the caret core dep + st
 test('writeConfigs (greenfield, --vendor-core): package.json pins the file: tarball instead of the caret', () => {
   const dir = mkdtempSync(join(tmpdir(), 'greenfield-'));
   try {
-    const pin = 'file:vendor/cloudbongos-core-1.17.0.tgz';
+    const pin = 'file:vendor/bongos-core-1.17.0.tgz';
     const res = init.writeConfigs(fullSpec(), { dir, force: false, dryRun: false, coreDep: pin, log: () => {} });
     const pkg = JSON.parse(readFileSync(res.pkgPath, 'utf8'));
     assert.equal(pkg.dependencies[init.CORE_PKG], pin);
@@ -456,7 +456,60 @@ async function runSeedTests() {
   });
 }
 
+// ---- greenfield registry-install path (ADR 0134, task 2090) ----------------
+// main() with --registry-core --dry-run only LOGS (no fs, no network), so we capture
+// console output and assert the plan. The real write+install path is proven by the
+// CLI scratch run in the session log; the pure gates live in tests/npmrc.mjs.
+async function runRegistryCoreTests() {
+  const at = async (name, fn) => {
+    try { await fn(); passed++; console.log(`  ok  ${name}`); }
+    catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+  };
+  const specFile = () => {
+    const dir = mkdtempSync(join(tmpdir(), 'init-reg-'));
+    const p = join(dir, 'spec.json');
+    writeFileSync(p, JSON.stringify({
+      identity: { productName: 'Reg Test' }, repo: { owner: 'acme', name: 'reg-test' }, firstAdmin: 'acme',
+      currency: { label: 'credits' }, domains: { publicOrigin: 'http://localhost:3000' }, modules: [],
+      version: { id: 'V1', name: 'V1', done_when: 'loop works' },
+    }));
+    return { dir, p };
+  };
+  // Run init.main() with console captured; returns { code, out }.
+  const capture = async (argv) => {
+    const lines = [];
+    const origLog = console.log, origErr = console.error;
+    console.log = (...a) => lines.push(a.join(' '));
+    console.error = (...a) => lines.push(a.join(' '));
+    let code;
+    try { code = await init.main(['node', 'init', ...argv]); }
+    finally { console.log = origLog; console.error = origErr; }
+    return { code, out: lines.join('\n') };
+  };
+
+  await at('main --registry-core --dry-run: plans the env-fed .npmrc; does NOT vendor a tarball', async () => {
+    const { dir, p } = specFile();
+    try {
+      const { code, out } = await capture(['--from', p, '--dir', join(dir, 'out'), '--no-seed', '--registry-core', '--dry-run']);
+      assert.equal(code, 0);
+      assert.match(out, /would write \.npmrc \(env-fed @bongos auth\)/);
+      assert.ok(!/vendor/i.test(out), 'no vendored-tarball step on the registry path');
+      assert.equal(existsSync(join(dir, 'out', '.npmrc')), false, 'dry-run writes nothing');
+    } finally { rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  await at('main: --vendor-core + --registry-core is refused (mutually exclusive) → exit 1', async () => {
+    const { dir, p } = specFile();
+    try {
+      const { code, out } = await capture(['--from', p, '--dir', join(dir, 'out'), '--no-seed', '--vendor-core', '/tmp/x.tgz', '--registry-core', '--dry-run']);
+      assert.equal(code, 1);
+      assert.match(out, /mutually exclusive/);
+    } finally { rmSync(dir, { recursive: true, force: true }); }
+  });
+}
+
 await runSeedTests();
+await runRegistryCoreTests();
 
 console.log('');
 console.log(`init tests: ${passed} passed, ${failed} failed`);

package/tests/instance_mismatch_guard.mjs

@@ -0,0 +1,101 @@
+// tests/instance_mismatch_guard.mjs
+//
+// Unit test for the PURE fail-closed instance guard exported from
+// scripts/gds/cli-lib.js (task 2102):
+//   - instanceOriginHost(origin) → host string, or null if unparseable
+//   - detectInstanceMismatch({ session, brand, env }) → { mismatch, expected, actual }
+//
+// The guard stops the CLI from silently borrowing a DIFFERENT instance's session
+// (the 2026-07-08 demo-session failure, where a fresh demo clone used the
+// founder's amazonprimea.com session and offered to write into the wrong live
+// backlog). Both helpers are deterministic with no DB/network/fs, so they
+// unit-test standalone. Run: node tests/instance_mismatch_guard.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const cli = require('../scripts/gds/cli-lib.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+const DEMO = { domains: { publicOrigin: 'https://demo.cloudbongos.com' } };
+const OTB = { domains: { publicOrigin: 'https://amazonprimea.com' } };
+const noEnv = {}; // no <PREFIX>_API_BASE override in scope
+
+test('instanceOriginHost: extracts host, tolerates trailing slash', () => {
+  assert.equal(cli.instanceOriginHost('https://amazonprimea.com'), 'amazonprimea.com');
+  assert.equal(cli.instanceOriginHost('https://amazonprimea.com/'), 'amazonprimea.com');
+  assert.equal(cli.instanceOriginHost('https://demo.cloudbongos.com/api/gds'), 'demo.cloudbongos.com');
+});
+
+test('instanceOriginHost: unparseable input → null (edge)', () => {
+  assert.equal(cli.instanceOriginHost('not a url'), null);
+  assert.equal(cli.instanceOriginHost(''), null);
+  assert.equal(cli.instanceOriginHost(null), null);
+});
+
+test('match: same-host session + branding → no mismatch (the OTB/normal case)', () => {
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: OTB, env: noEnv });
+  assert.equal(r.mismatch, false);
+});
+
+test('match: scheme/trailing-slash differences still match on host', () => {
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com/' }, brand: OTB, env: noEnv });
+  assert.equal(r.mismatch, false);
+});
+
+test('mismatch: demo repo + founder amazonprimea session → REFUSE (the reported failure)', () => {
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: DEMO, env: noEnv });
+  assert.equal(r.mismatch, true);
+  assert.equal(r.expected, 'https://demo.cloudbongos.com');
+  assert.equal(r.actual, 'https://amazonprimea.com');
+});
+
+test('mismatch: demo repo + cloudbongos.com session (sibling instance) → REFUSE', () => {
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://cloudbongos.com' }, brand: DEMO, env: noEnv });
+  assert.equal(r.mismatch, true);
+});
+
+test('env-override: an explicit *_API_BASE override wins (dev/staging) → no mismatch', () => {
+  const r = cli.detectInstanceMismatch({
+    session: { api_base: 'https://amazonprimea.com' }, brand: DEMO,
+    env: { GDS_API_BASE: 'http://localhost:3000' },
+  });
+  assert.equal(r.mismatch, false);
+});
+
+test('no-branding: repo declares no publicOrigin → cannot assert a mismatch → no mismatch', () => {
+  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: {}, env: noEnv }).mismatch, false);
+  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: { domains: {} }, env: noEnv }).mismatch, false);
+});
+
+test('no-session: nothing to borrow → no mismatch (the no-session/401 path handles it)', () => {
+  assert.equal(cli.detectInstanceMismatch({ session: null, brand: DEMO, env: noEnv }).mismatch, false);
+  assert.equal(cli.detectInstanceMismatch({ session: {}, brand: DEMO, env: noEnv }).mismatch, false);
+});
+
+// task 2124 / demo-audit C2 — assertInstanceMatch is the exit-wrapper that RAW-fetch read
+// commands (status.js) call so they honor the same guard apiCall/cliClient already enforce.
+// Its decision reuses detectInstanceMismatch (covered above); here we lock the wrapper's
+// contract + its deterministic opt-out branch (the exiting branch would process.exit).
+test('assertInstanceMatch is exported (the guard raw-fetch reads must call)', () => {
+  assert.equal(typeof cli.assertInstanceMatch, 'function');
+});
+
+// Async opt-out branch — the sync test() helper can't await, so run it at top level.
+// { allowInstanceMismatch: true } returns BEFORE loadSession/detect (no fs, no exit).
+try {
+  await cli.assertInstanceMatch({ allowInstanceMismatch: true });
+  passed++; console.log('  ok  assertInstanceMatch({allowInstanceMismatch:true}) resolves without exiting');
+} catch (err) {
+  failed++; console.log('  FAIL assertInstanceMatch opt-out resolves without exiting'); console.log(`     ${err.message}`);
+}
+
+console.log(`\ninstance-mismatch guard (task 2102 + C2 raw-read wrapper) tests: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);