@bongos/core 1.17.0

package/modules/builder-settings/sound-prefs.js

@@ -0,0 +1,178 @@
+// src/bongos/sound-prefs.js — per-builder per-sound on/off preferences (V3.R91
+// / #786). Follow-up to the #781 sound system.
+//
+// One jsonb column on `builders` (sound_prefs, migration 075) stores each
+// builder's mutes as { <sound-name>: false }. A missing key falls back to the
+// system default in SOUND_DEFAULTS below (every sound ON), so the column stays
+// sparse. This module is the single source of truth the API surfaces, the
+// /settings UI reads from, and the local fetch-sound-prefs.js hook resolves
+// against before mirroring to disk for the offline player.
+//
+// Mirrors skill-prefs.js intentionally — same shape, same validate/apply
+// contract — so the two settings surfaces behave identically.
+
+// The complete set of sounds the toggle exposes — must match the .wav files in
+// .claude/sounds/ and the event names play.js is called with. Add a new sound =
+// add one line here + one in SOUND_DEFAULTS + the .wav. Ordered to match the
+// /settings UI grouping (routine first, then the celebratory ones).
+const KNOWN_SOUNDS = Object.freeze([
+  'chime',   // Claude finished a turn (routine)
+  'alert',   // Claude needs user input
+  'ship',    // a task shipped
+  'triumph', // a big ship / celebration
+  'fanfare', // a rank promotion
+]);
+
+// Human-facing labels + descriptions for the UI (so the settings page doesn't
+// mirror this copy from a second source).
+const SOUND_META = Object.freeze({
+  chime:   { label: 'Chime',   desc: 'When Claude finishes a turn' },
+  alert:   { label: 'Alert',   desc: 'When Claude needs your input' },
+  ship:    { label: 'Ship',    desc: 'When a task ships' },
+  triumph: { label: 'Triumph', desc: 'When a big task ships' },
+  fanfare: { label: 'Fanfare', desc: 'When you earn a rank promotion' },
+});
+
+// System default per sound: every sound is ON unless the builder mutes it.
+const SOUND_DEFAULTS = Object.freeze({
+  chime: true,
+  alert: true,
+  ship: true,
+  triumph: true,
+  fanfare: true,
+});
+
+// Master volume (#788). Stored as a reserved key inside the SAME sound_prefs
+// jsonb (not a sound name — KNOWN_SOUNDS never contains it), so no extra column
+// is needed. Integer percent 0-100; 100 = full (default, current behaviour),
+// 0 = silent. The local player (.claude/sounds/play.js) scales the WAV by
+// volume/100 before playing.
+const VOLUME_KEY = 'volume';
+const VOLUME_DEFAULT = 100;
+
+function clampVolume(v) {
+  if (typeof v !== 'number' || !Number.isFinite(v)) return VOLUME_DEFAULT;
+  return Math.max(0, Math.min(100, Math.round(v)));
+}
+
+// Resolve a builder's effective master volume (0-100). Defaults to 100 when
+// unset. `builderPrefs` is the raw jsonb off builders.sound_prefs.
+function getVolume(builderPrefs) {
+  const raw = builderPrefs && builderPrefs[VOLUME_KEY];
+  return typeof raw === 'number' ? clampVolume(raw) : VOLUME_DEFAULT;
+}
+
+// Sanity assertion at module-load: every KNOWN_SOUNDS entry has a default + meta.
+for (const s of KNOWN_SOUNDS) {
+  if (!Object.prototype.hasOwnProperty.call(SOUND_DEFAULTS, s)) {
+    throw new Error(`sound-prefs: KNOWN_SOUNDS lists '${s}' but SOUND_DEFAULTS has no entry`);
+  }
+  if (!Object.prototype.hasOwnProperty.call(SOUND_META, s)) {
+    throw new Error(`sound-prefs: KNOWN_SOUNDS lists '${s}' but SOUND_META has no entry`);
+  }
+}
+
+function isKnownSound(value) {
+  return typeof value === 'string' && KNOWN_SOUNDS.includes(value);
+}
+
+// Resolve a builder's effective enabled-state for one sound: their override if
+// set (a boolean), else the system default (ON). Returns null for unknown sounds.
+// `builderPrefs` is the raw jsonb value off builders.sound_prefs.
+function getForBuilder(builderPrefs, soundName) {
+  if (!isKnownSound(soundName)) return null;
+  const override = builderPrefs && builderPrefs[soundName];
+  if (typeof override === 'boolean') return override;
+  return SOUND_DEFAULTS[soundName];
+}
+
+// Build the per-builder effective list shown in the UI. Each row carries the
+// sound name, label/desc, the system default, the builder's override (or null
+// if unset), and the effective enabled-state. Ordered to match KNOWN_SOUNDS.
+function listEffective(builderPrefs) {
+  return KNOWN_SOUNDS.map((sound) => ({
+    sound,
+    label: SOUND_META[sound].label,
+    desc: SOUND_META[sound].desc,
+    default_enabled: SOUND_DEFAULTS[sound],
+    override_enabled: typeof builderPrefs?.[sound] === 'boolean' ? builderPrefs[sound] : null,
+    enabled: getForBuilder(builderPrefs, sound),
+  }));
+}
+
+// Collapse a builder's prefs to a flat { <sound>: <bool> } map of EFFECTIVE
+// states for every known sound — the shape the local player file wants. Every
+// known sound gets an explicit boolean (default applied), so the offline player
+// needs no defaults table of its own.
+function effectiveMap(builderPrefs) {
+  const out = {};
+  for (const sound of KNOWN_SOUNDS) out[sound] = getForBuilder(builderPrefs, sound);
+  return out;
+}
+
+// Validate a PATCH body: { <sound>: <bool>, ... } where every sound is in
+// KNOWN_SOUNDS and every value is a boolean OR null (null = clear the override
+// and fall back to the system default). Returns { ok, patch } or { ok, errors }.
+// Empty body is allowed (no-op).
+function validatePatch(body) {
+  if (body == null || typeof body !== 'object' || Array.isArray(body)) {
+    return { ok: false, errors: [{ error: 'body_must_be_object' }] };
+  }
+  const errors = [];
+  const patch = {};
+  for (const [key, value] of Object.entries(body)) {
+    // Reserved 'volume' key: a number 0-100, or null to clear (→ default 100).
+    if (key === VOLUME_KEY) {
+      if (value === null) { patch[VOLUME_KEY] = null; continue; }
+      if (typeof value !== 'number' || !Number.isFinite(value) || value < 0 || value > 100) {
+        errors.push({ key: VOLUME_KEY, error: 'volume_out_of_range', value, range: [0, 100] });
+        continue;
+      }
+      patch[VOLUME_KEY] = clampVolume(value);
+      continue;
+    }
+    if (!isKnownSound(key)) {
+      errors.push({ sound: key, error: 'unknown_sound' });
+      continue;
+    }
+    if (value === null) {
+      patch[key] = null; // sentinel: clear the override
+      continue;
+    }
+    if (typeof value !== 'boolean') {
+      errors.push({ sound: key, error: 'not_a_boolean', value });
+      continue;
+    }
+    patch[key] = value;
+  }
+  if (errors.length > 0) return { ok: false, errors };
+  return { ok: true, patch };
+}
+
+// Apply a validated patch to a builder's existing prefs. Pure — does not touch
+// the DB. Returns a new object suitable for writing back. null values delete
+// keys (fall back to default); booleans overwrite.
+function applyPatch(existing, patch) {
+  const next = { ...(existing || {}) };
+  for (const [sound, value] of Object.entries(patch)) {
+    if (value === null) delete next[sound];
+    else next[sound] = value;
+  }
+  return next;
+}
+
+module.exports = {
+  KNOWN_SOUNDS,
+  SOUND_META,
+  SOUND_DEFAULTS,
+  VOLUME_KEY,
+  VOLUME_DEFAULT,
+  isKnownSound,
+  getForBuilder,
+  listEffective,
+  effectiveMap,
+  getVolume,
+  clampVolume,
+  validatePatch,
+  applyPatch,
+};

package/modules/builder-settings/wandering-prefs.js

@@ -0,0 +1,282 @@
+// src/bongos/wandering-prefs.js — the per-builder "wandering" knob (task 1268).
+//
+// Wandering governs how readily an agent opens a NEW THREAD of work — a
+// tangent, an investigation, an unsolicited suggestion — instead of staying on
+// its claimed task. It does NOT touch in-task initiative: even a locked
+// newcomer still does whatever it takes to finish their claimed task well
+// (chasing a real blocker is in-task, not wandering). The knob suppresses
+// SPAWNING new threads beyond the claim, never the quality of work on the claim.
+//
+// Motivating failure: a newcomer session finished an ideator chore, then
+// invented a phantom "credit discrepancy" (a running balance grows every ship —
+// nothing was wrong) and invited the user to investigate, derailing a focused
+// newcomer. The knob targets the escalation, not the noticing.
+//
+// Storage. One reserved key ('wandering') inside the `behavior_prefs` jsonb
+// column on `builders` (migration 119) — the same single-jsonb-column pattern
+// as skill_model_prefs (037) and sound_prefs (075). behavior_prefs is the
+// blob; future behavior knobs add their own reserved keys. A missing key falls
+// back to the rank-derived default below, so the column stays sparse.
+//
+// Resolution = default-by-rank, capped-by-rank, server-enforced.
+//   - DEFAULT level rides the trust ladder (Xenos→Locked … Archon→Exploratory).
+//   - MAX (ceiling) per rank: Xenos and Thetes are capped at their default (they
+//     may dial DOWN for more focus, never UP); Metic and Archon may set any
+//     level (their rank is a starting default, not a ceiling). Owner decision
+//     2026-06-19: "Thetes is gated; Metic is just a starting default."
+//   - effectiveLevel = clamp(override ?? default, 0, maxForRank). So a Xenos who
+//     stores Exploratory is still resolved to Locked — opening the setting up
+//     for self-service later stays safe because the clamp is the enforcement,
+//     not the UI.
+//
+// Prior art: OpenAI's GPT-5 guide ships this exact knob as "agentic eagerness"
+// (low = stay focused / minimize tangents; high = explore broadly). The
+// per-level contracts below are phrased POSITIVELY ("when the task is done, stop
+// and report") — negative framing ("don't suggest tangents") measurably
+// backfires with LLMs.
+//
+// This module is the single source of truth: the /me API surfaces it, the
+// /settings UI reads it, and the Conductor hook resolves the contract against
+// it before injecting focus guidance into the session.
+
+// Ordered low→high; the array index IS the level number (0..3).
+const LEVELS = Object.freeze(['locked', 'focused', 'balanced', 'exploratory']);
+
+// Human-facing copy + the behavior contract injected into the agent. `inject`
+// marks the levels whose contract actively CONSTRAINS behavior and is worth
+// spending session context on (the Conductor emits only these — see
+// shouldInject). The permissive top levels read as "do what you'd naturally
+// do", so injecting them would be noise.
+const LEVEL_META = Object.freeze({
+  locked: {
+    n: 0,
+    label: 'Locked',
+    blurb: 'Strictly the claimed task. Off-task notes are filed silently, never raised.',
+    inject: true,
+  },
+  focused: {
+    n: 1,
+    label: 'Focused',
+    blurb: 'On task, full in-task initiative; at most one captured follow-up at the end.',
+    inject: true,
+  },
+  balanced: {
+    n: 2,
+    label: 'Balanced',
+    blurb: 'May surface a high-value tangent mid-task as "capture or pursue?" — your call.',
+    inject: false,
+  },
+  exploratory: {
+    n: 3,
+    label: 'Exploratory',
+    blurb: 'A thinking partner — actively surfaces adjacent work and investigations.',
+    inject: false,
+  },
+});
+
+// The positive-framed behavior contract per level. Injected verbatim by the
+// Conductor + surfaced on /me. Kept here so there is exactly one copy.
+const LEVEL_CONTRACT = Object.freeze({
+  locked:
+    'Focus mode (wandering: Locked — the newcomer floor). Work only your claimed task. '
+    + 'The instant its done-when is met, report what you did and stop; your only forward '
+    + 'pointer is `/builder-start` for the next task. If you notice anything beyond the claim '
+    + '(a bug, an oddity, a number that looks off, an improvement), file it in one line with '
+    + '`node scripts/gds/capture.js "…"` and move on — do not raise it, explain it, or offer to '
+    + 'investigate. In-task work is unaffected: do whatever it takes to finish the claim well.',
+  focused:
+    'Focus mode (wandering: Focused). Stay on your claimed task; in-task initiative is full. '
+    + 'At a natural stopping point you may note at most ONE adjacent, in-version follow-up — as a '
+    + 'single line, captured with `capture.js`, not pursued now. Don\'t open investigations into '
+    + 'anomalies; file them and move on.',
+  balanced:
+    'Wandering: Balanced. Stay anchored to your claim, but if you hit a genuinely high-value or '
+    + 'blocking tangent you may surface it briefly and ask "capture or pursue?" — leave the call to '
+    + 'the user. Note anomalies as observations; don\'t rabbit-hole.',
+  exploratory:
+    'Wandering: Exploratory. Act as a thinking partner — surface adjacent improvements and '
+    + 'investigations worth the user\'s attention as you go, while still landing the claimed task.',
+});
+
+// Default level per rank (the array index in LEVELS). Rides the live rank
+// ladder (xenos<thetes<metic<archon — db.RANKS / boxes.RANK_ORDER). A rank not
+// listed (e.g. a reserved/penalty rank, or an unknown string) falls back to the
+// safest floor: Locked.
+const RANK_DEFAULT = Object.freeze({ xenos: 0, thetes: 1, metic: 2, archon: 3 });
+
+// Ceiling per rank. Below Metic the default IS the ceiling (dial down only);
+// Metic+ may pick any level. Unknown rank → floor (0).
+const RANK_MAX = Object.freeze({ xenos: 0, thetes: 1, metic: 3, archon: 3 });
+
+const TOP_LEVEL = LEVELS.length - 1; // 3
+const RESERVED_KEY = 'wandering';
+
+// ---- load-time self-assertions (catch drift at deploy, not runtime) ----
+if (LEVELS.length !== 4) throw new Error('wandering-prefs: LEVELS must have exactly 4 entries');
+for (const key of LEVELS) {
+  if (!LEVEL_META[key]) throw new Error(`wandering-prefs: LEVELS has '${key}' but LEVEL_META has no entry`);
+  if (typeof LEVEL_CONTRACT[key] !== 'string') throw new Error(`wandering-prefs: no contract for level '${key}'`);
+}
+for (let i = 0; i < LEVELS.length; i++) {
+  if (LEVEL_META[LEVELS[i]].n !== i) throw new Error(`wandering-prefs: LEVEL_META.${LEVELS[i]}.n must equal its index ${i}`);
+}
+for (const rank of Object.keys(RANK_DEFAULT)) {
+  if (!(rank in RANK_MAX)) throw new Error(`wandering-prefs: RANK_DEFAULT has '${rank}' but RANK_MAX does not`);
+  if (RANK_DEFAULT[rank] > RANK_MAX[rank]) throw new Error(`wandering-prefs: default > max for rank '${rank}'`);
+}
+
+// ---- pure helpers ----
+
+function isLevelInt(n) {
+  return Number.isInteger(n) && n >= 0 && n <= TOP_LEVEL;
+}
+
+function levelKey(n) {
+  return isLevelInt(n) ? LEVELS[n] : null;
+}
+
+function levelIndex(key) {
+  const i = LEVELS.indexOf(key);
+  return i === -1 ? null : i;
+}
+
+function defaultLevelForRank(rank) {
+  return Object.prototype.hasOwnProperty.call(RANK_DEFAULT, rank) ? RANK_DEFAULT[rank] : 0;
+}
+
+function maxLevelForRank(rank) {
+  return Object.prototype.hasOwnProperty.call(RANK_MAX, rank) ? RANK_MAX[rank] : 0;
+}
+
+// The override a builder has stored (the raw 'wandering' key off behavior_prefs),
+// or null when unset/invalid. Kept separate from the effective level so the UI
+// can show "you chose X" vs "resolved to Y (capped by rank)".
+function overrideLevel(behaviorPrefs) {
+  const raw = behaviorPrefs && behaviorPrefs[RESERVED_KEY];
+  return isLevelInt(raw) ? raw : null;
+}
+
+// The resolved level for a builder: their override if set, else the rank
+// default — then clamped to [0, maxForRank]. This is the enforcement point.
+function effectiveLevel(behaviorPrefs, rank) {
+  const base = overrideLevel(behaviorPrefs);
+  const want = base === null ? defaultLevelForRank(rank) : base;
+  const max = maxLevelForRank(rank);
+  return Math.max(0, Math.min(want, max));
+}
+
+// The behavior-contract text for a level (by int or key). Used by the Conductor
+// + surfaced on /me. Returns '' for an out-of-range level.
+function contractFor(level) {
+  const key = typeof level === 'string' ? level : levelKey(level);
+  return key && LEVEL_CONTRACT[key] ? LEVEL_CONTRACT[key] : '';
+}
+
+// Should the Conductor spend session context injecting this level's contract?
+// Only the constraining (low) levels — the permissive ones already match the
+// agent's default behavior, so emitting them would be noise.
+function shouldInject(level) {
+  const key = typeof level === 'string' ? level : levelKey(level);
+  return !!(key && LEVEL_META[key] && LEVEL_META[key].inject);
+}
+
+// The full catalog the UI renders (every level + whether this rank may pick it).
+function levelCatalog(rank) {
+  const max = maxLevelForRank(rank);
+  return LEVELS.map((key, n) => ({
+    n,
+    key,
+    label: LEVEL_META[key].label,
+    blurb: LEVEL_META[key].blurb,
+    allowed: n <= max,
+  }));
+}
+
+// Everything the /me payload + the /settings UI need in one object.
+function describeForApi(behaviorPrefs, rank) {
+  const def = defaultLevelForRank(rank);
+  const max = maxLevelForRank(rank);
+  const override = overrideLevel(behaviorPrefs);
+  const eff = effectiveLevel(behaviorPrefs, rank);
+  return {
+    rank: rank || null,
+    levels: levelCatalog(rank),
+    default_level: def,
+    default_key: levelKey(def),
+    max_level: max,
+    max_key: levelKey(max),
+    override_level: override,
+    effective_level: eff,
+    effective_key: levelKey(eff),
+    effective_label: LEVEL_META[levelKey(eff)].label,
+    contract: contractFor(eff),
+    inject: shouldInject(eff),
+  };
+}
+
+// Validate a PATCH body: { wandering: <0..3> | null }. `null` clears the
+// override (fall back to the rank default). opts.maxLevel (default = top) caps
+// the accepted value — the route passes maxLevelForRank(rank) so a builder
+// can't store a level above their rank ceiling and get a confusing silent
+// clamp. Unknown keys → 422. Returns { ok, patch } or { ok:false, errors }.
+function validatePatch(body, opts = {}) {
+  if (body == null || typeof body !== 'object' || Array.isArray(body)) {
+    return { ok: false, errors: [{ error: 'body_must_be_object' }] };
+  }
+  const cap = isLevelInt(opts.maxLevel) ? opts.maxLevel : TOP_LEVEL;
+  const errors = [];
+  const patch = {};
+  for (const [key, value] of Object.entries(body)) {
+    if (key !== RESERVED_KEY) {
+      errors.push({ key, error: 'unknown_key', allowed: [RESERVED_KEY] });
+      continue;
+    }
+    if (value === null) { patch[RESERVED_KEY] = null; continue; } // clear → default
+    if (!isLevelInt(value)) {
+      errors.push({ key, error: 'invalid_level', value, allowed: `integer 0..${TOP_LEVEL}` });
+      continue;
+    }
+    if (value > cap) {
+      errors.push({ key, error: 'above_rank_cap', value, max: cap });
+      continue;
+    }
+    patch[RESERVED_KEY] = value;
+  }
+  if (errors.length > 0) return { ok: false, errors };
+  return { ok: true, patch };
+}
+
+// Apply a validated patch to a builder's existing behavior_prefs. Pure. null
+// deletes the key (fall back to default); a valid int overwrites. Other keys in
+// the blob (future behavior knobs) are left untouched.
+function applyPatch(existing, patch) {
+  const next = { ...(existing || {}) };
+  for (const [key, value] of Object.entries(patch)) {
+    if (value === null) delete next[key];
+    else next[key] = value;
+  }
+  return next;
+}
+
+module.exports = {
+  LEVELS,
+  LEVEL_META,
+  LEVEL_CONTRACT,
+  RANK_DEFAULT,
+  RANK_MAX,
+  TOP_LEVEL,
+  RESERVED_KEY,
+  isLevelInt,
+  levelKey,
+  levelIndex,
+  defaultLevelForRank,
+  maxLevelForRank,
+  overrideLevel,
+  effectiveLevel,
+  contractFor,
+  shouldInject,
+  levelCatalog,
+  describeForApi,
+  validatePatch,
+  applyPatch,
+};

package/modules/dev-box/CLAUDE.md

@@ -0,0 +1,38 @@
+# `dev-box` module — per-builder cloud dev environments
+
+> The **first** module extracted from core (BV1.R43, [ADR 0083](../../docs/adr/<redacted>.md)). It is the **template** every later module move copies — keep it clean.
+
+Optional feature module: per-builder DigitalOcean droplets + Cloudflare tunnels, the sandbox game preview, and server-mediated branch publish. Gated by `config/modules.json` (`dev-box: true` for the OTB instance; off on a vanilla Cloud Bongos boot). The loader (`src/module-loader/loader.js`) discovers this dir via `module.json` and mounts the route factory.
+
+## The boundary (the one rule)
+
+This module reaches core **only** through the published doorway `../../src/module-api.js` (the semver'd contract; this module needs `coreVersion ^1.2.0`). It must **never** `require()` a core internal (`../../src/bongos/auth`, `../../src/bongos/db`, …) directly, and never another module. Core, in turn, must never `require()` a file in here — that's the forbidden core→module edge this extraction removed. (The fitness check that *enforces* this is BV1.R44/R45; until then it's WARN-mode, but the template models the right pattern.)
+
+## Files
+
+| File | What |
+|---|---|
+| `routes/box.js` | the HTTP surface — `/box/*` (own box; some `allowBoxScope`) + `/boxes/*` (Archon roster). The loader mounts this; its factory also **registers this module's seams** (idempotent). |
+| `boxes.js` | box lifecycle logic + cost ledger. Pure-ish: `pool` is passed in (DI), so it has no core require. |
+| `box-access.js` | source-access clawback (`flagBoxReconcileForBuilder`, `decideSourceAccess`). |
+| `box-credential.js` | per-box credential provider. |
+| `box-onboard.js` | SSH-key validation + connect/settings renderers. |
+| `db.js` | the module's data slice — owns `setBuilderBoxBlocked` (the box-blocked write), reached through the doorway `pool`. Lifted out of core `db.js` in BV1.R68 ([ADR 0091](../../docs/adr/<redacted>.md)); box-blocked is cleanly dev-box-owned (this module is its only writer + reader). |
+
+## Seams (how core and this module talk without importing each other)
+
+- **Provides — port `box.hasEverConnected`** `(builderId) → Promise<bool>`. Core (`routes/me.js`, `routes/builders.js`) reads it via `resolveOptional('box.hasEverConnected', async () => false)` so onboarding's `box_connect` step auto-clears when a box is on, and degrades to `false` on a box-less instance.
+- **Listens — event `builder.box-reconcile-needed`** `{ builderId, rank, status, actor }`. Core `db.js` emits it (via `emitAsync`) after a rank change / deactivate / auto-graduation; this module flags the droplet reconcile. Replaces the old `db.js → box-access` direct call.
+
+Registration happens in `routes/box.js`'s factory (the loader runs it at boot, already module-gated), guarded by `hasProvider` so re-instantiation in tests can't double-register.
+
+## NOT in this module
+
+- **The network clients** — `scripts/gds/do-api.js` (DigitalOcean), `scripts/gds/cf-tunnel.js` (Cloudflare tunnel), and their shared `scripts/gds/http-api-client.js`. They were operator-CLI-only (never the web process), so they moved OUT to the control-plane tier in BV1 task [#1943](https://example.com/builders#/task/1943) ([ADR 0111](../../docs/adr/<redacted>.md) §2) — the DO client is now shared by `box.js` AND the instance-provisioning runner `provision.js`, which a module→module import could never allow.
+- **`scripts/gds/box.js`** — the operator control-plane CLI (sole holder of `DO_API_TOKEN`/`CF_API_TOKEN`, ADR 0031 §9.4). It *requires* this module's `boxes`/`box-access`/`box-onboard` (module data/logic) plus the shared `scripts/gds/do-api`/`cf-tunnel` clients, but it is core ops tooling and stays in `scripts/gds/`.
+- **The hall UI** (`modules/hall-ui/public/`: `box-panel.js`, `harbor.js`, the `watch.js` cost section, gated mounts in `builders.js`/`settings.js`). Per-module UI sections are design **phase 6**, not this move; they stay in the hall-ui module (carved in BV1.R85), already gated by `window.__MODULES__.enabled['dev-box']`.
+- **`secret-box.js`** — unrelated per-builder secrets crypto; stays in core despite the name.
+
+## Tests
+
+`scripts/gds/smoke-box.sh` + `tests/box*.mjs` (boxes, box_access, box_onboard, box_host_keys, box_cost, box_code_staleness, box_terminal_ssrf, box_connect_e2e, cf_tunnel). They import from `modules/dev-box/…` — except the moved network clients (`tests/boxes.mjs`'s `do-api` import + `tests/cf_tunnel.mjs`) now import from `scripts/gds/…` ([#1943](https://example.com/builders#/task/1943)).