@bongos/core 1.18.0 → 1.18.18

package/scripts/gds/box-sync.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+// scripts/gds/box-sync.js — BV1.R96 (goal 1000051): "sync now".
+//
+// Re-run the box's source-fetch ON DEMAND so a freshly-claimed task's code
+// materializes within seconds, instead of waiting for the ~10-min cron (which
+// stays the backstop). Because the box's fetch calls GET /box/source-access —
+// which since BV1.R94 returns the sparse set for the builder's ACTIVE CLAIM
+// (task/module scope, ADR 0148) — re-running it RE-SCOPES the box to whatever the
+// builder just claimed. So `/builder-claim N` then `box-sync` = the box holds
+// exactly task N's module code, seconds later.
+//
+// Runs ON THE BOX, where infra/box-source-fetch.sh lives (it is in the box's BASE
+// sparse set). OFF a box there is no fetch script — the source IS the local
+// checkout — so it says so plainly and exits non-zero rather than failing opaquely.
+//
+// Usage:  node scripts/gds/box-sync.js            # re-fetch now
+//         node scripts/gds/box-sync.js --dry-run  # print what it WOULD run
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+// Reuse box.js's instance-root-first infra resolver (ADR 0150 / R98) so this
+// locates infra/ the SAME way provisioning does — the box's fetch script lives
+// beside the cloud-init template it validates on.
+const { resolveBoxInfraDir } = require('./box.js');
+
+const FETCH_SCRIPT = 'box-source-fetch.sh';
+
+// Absolute path to the box source-fetch script, or null when it can't be found
+// (i.e. not on a box). Pure: opts thread through to resolveBoxInfraDir for tests.
+function resolveFetchScript(opts = {}) {
+  const infraDir = resolveBoxInfraDir(opts);
+  if (!infraDir) return null;
+  const p = path.join(infraDir, FETCH_SCRIPT);
+  try { return fs.existsSync(p) ? p : null; } catch { return null; }
+}
+
+function main(argv = process.argv.slice(2)) {
+  const dryRun = argv.includes('--dry-run') || argv.includes('-n');
+  const script = resolveFetchScript();
+  if (!script) {
+    console.error(
+      `sync: no infra/${FETCH_SCRIPT} found. This runs ON a dev box (where the box `
+      + `source-fetch lives). Off a box your source IS your local checkout — nothing to sync.`,
+    );
+    process.exit(1);
+  }
+  if (dryRun) {
+    console.log(`sync [dry-run]: would run  bash ${script}`);
+    console.log('  → re-fetches the sparse checkout for your ACTIVE claim (re-scopes in place).');
+    process.exit(0);
+  }
+  console.log(`sync: re-running ${script} — re-scoping the box to your active claim…`);
+  const r = spawnSync('bash', [script], { stdio: 'inherit' });
+  if (r.error) {
+    console.error(`sync: could not run the fetch (${r.error.message})`);
+    process.exit(1);
+  }
+  if (r.status === 0) console.log('sync: done — your box now holds the code for your active claim.');
+  process.exit(r.status == null ? 1 : r.status);
+}
+
+if (require.main === module) main();
+
+module.exports = { resolveFetchScript, FETCH_SCRIPT };

package/scripts/gds/box.js

@@ -46,6 +46,55 @@ const MAX_USERDATA_BYTES = 64 * 1024;
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
+// The box cloud-init (infra/builder-box-cloud-init.yaml + its ~9 gz+b64-inlined
+// scripts) is INSTANCE content, deliberately NOT shipped in @bongos/core (the R89
+// packaging split). On a VENDORED instance box.js runs from
+// node_modules/@bongos/core, so REPO_ROOT/infra does not exist — and the box then
+// boots BARE (no clone, no toolchain, no terminal). So resolve infra/ from the
+// INSTANCE root, riding ADR 0108's resolvers, instead of assuming it sits beside
+// box.js. ADR 0150 (BV1.R97/R98).
+const instanceConfig = require(path.join(REPO_ROOT, 'src/instance-config'));
+const BOX_INFRA_TEMPLATE = 'builder-box-cloud-init.yaml';
+
+// Ordered candidate infra/ dirs — first that actually holds the cloud-init
+// template wins. Pure (env + repoRoot injected) so it is unit-testable without
+// touching the real filesystem layout.
+function boxInfraCandidates({ env = process.env, repoRoot = REPO_ROOT } = {}) {
+  const out = [];
+  const seen = new Set();
+  const add = (d) => { if (d && !seen.has(d)) { seen.add(d); out.push(d); } };
+  // 1. explicit override: <PREFIX>_BOX_INFRA_DIR (operator escape hatch).
+  const override = instanceConfig.resolveEnv('BOX_INFRA_DIR', { env });
+  if (override) add(path.resolve(override));
+  // 2. the instance root via an EXPLICIT pointer (<PREFIX>_INSTANCE_ROOT env or a
+  //    bongos.config.json {"instanceRoot":"."}) — where a vendored instance keeps infra/.
+  const inst = instanceConfig.resolveInstanceRootExplicit({ env });
+  if (inst) add(path.join(inst, 'infra'));
+  // 3. REPO_ROOT/infra — the dev single-checkout (and the ADR 0144 node_modules workaround).
+  add(path.join(repoRoot, 'infra'));
+  // 4. walk up out of node_modules from the core root, so a vendored
+  //    …/node_modules/@bongos/core still finds its host instance's infra/ with no pointer set.
+  let dir = repoRoot;
+  for (let i = 0; i < 6; i += 1) {
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+    add(path.join(dir, 'infra'));
+  }
+  return out;
+}
+
+// The resolved infra/ dir (first candidate holding the template), or null when the
+// box cloud-init cannot be located anywhere — the caller MUST fail loud on null
+// rather than provision a box with empty user-data (ADR 0150).
+function resolveBoxInfraDir(opts = {}) {
+  for (const c of boxInfraCandidates(opts)) {
+    try { if (fs.existsSync(path.join(c, BOX_INFRA_TEMPLATE))) return c; }
+    catch { /* unreadable candidate → try the next */ }
+  }
+  return null;
+}
+
 const CONFIG = {
   floor: process.env.BOX_PROVISION_MIN_RANK || 'xenos',
   region: process.env.BOX_REGION || 'nyc3',
@@ -103,6 +152,44 @@ function makeCf(apply) {
   });
 }
 
+// SECURITY PREFLIGHT (task 1002511, ADR 0053 / SR#11). The edge cookie-strip
+// Transform Rule is applied BEST-EFFORT deep inside ensureNamedTunnel, so a
+// CLOUDFLARE_API_TOKEN missing the zone "Transform Rules" edit scope fails as one
+// buried log line — and the apex session cookie keeps reaching the box subdomains.
+// This probe runs BEFORE any DigitalOcean spend (dry-run included; a read-only
+// lookup running for real in a plan is the same precedent as the drift reconcile's
+// live droplet listing) and shouts the exact fix.
+//
+// HONESTY: the probe is a GET, so it can only DISPROVE the scope. A readable phase
+// does NOT mean the rule can be written — only the PUT inside ensureNamedTunnel
+// proves that. Never print this as a confirmed control. Never blocks provisioning:
+// the rule is defense-in-depth and a box without it still works.
+async function preflightCookieStripScope() {
+  const { cfTunnel } = loadDeps();
+  let scope;
+  try {
+    scope = await cfTunnel.checkRulesetScope({
+      zone: CF.zone, phase: cfTunnel.COOKIE_STRIP_PHASE, token: CF.apiToken,
+    });
+  } catch (e) {
+    scope = { readable: false, reason: `ruleset preflight crashed: ${e.message}`, guidance: '' };
+  }
+  if (scope.readable) {
+    console.log(`  cookie-strip ruleset is readable on ${CF.zone} — edit scope stays UNPROVEN until the rule is applied (ADR 0053)`);
+    return scope;
+  }
+  console.log('');
+  console.log('  ⚠⚠ SECURITY (ADR 0053 / SR#11) — the edge cookie-strip rule cannot be confirmed');
+  console.log(`     ${scope.reason}`);
+  console.log(`     IMPACT: the apex session cookie (Domain=.${CF.zone}) is sent by the browser to`);
+  console.log(`             term-*.${CF.terminalZone} and sandbox-*.${CF.terminalZone} — hosts OUTSIDE the`);
+  console.log('             ADR 0016 trust boundary — until that Transform Rule is actually in place.');
+  if (scope.guidance) console.log(`     FIX: ${scope.guidance}`);
+  console.log('     Provisioning CONTINUES — this is defense-in-depth, never a provisioning gate.');
+  console.log('');
+  return scope;
+}
+
 function numEnv(name, dflt) {
   const v = process.env[name];
   if (v == null || v === '') return dflt;
@@ -130,8 +217,8 @@ function loadDeps() {
   // eslint-disable-next-line global-require
   const { DoApi } = require(path.join(REPO_ROOT, 'scripts/gds/do-api'));
   // eslint-disable-next-line global-require
-  const { CfTunnelApi } = require(path.join(REPO_ROOT, 'scripts/gds/cf-tunnel'));
-  _deps = { pool, boxes, boxAccess, boxOnboard, DoApi, CfTunnelApi };
+  const cfTunnel = require(path.join(REPO_ROOT, 'scripts/gds/cf-tunnel'));
+  _deps = { pool, boxes, boxAccess, boxOnboard, DoApi, CfTunnelApi: cfTunnel.CfTunnelApi, cfTunnel };
   return _deps;
 }
 
@@ -254,8 +341,18 @@ function runDnsHookBlackhole(hostname, hook = CONFIG.dnsHook) {
 // for the builder being provisioned (#685) — base64'd here and baked in so the
 // FIRST SSH login works before the box has a GDS token. An empty/absent block
 // renders an empty managed block (a keyless box; the operator is warned upstream).
-function readCloudInit({ authorizedKeysBlock = '', boxEnv = '', gdsSession = '' } = {}) {
-  const p = path.join(REPO_ROOT, 'infra', 'builder-box-cloud-init.yaml');
+function readCloudInit({ authorizedKeysBlock = '', boxEnv = '', gdsSession = '', infraDir = resolveBoxInfraDir() } = {}) {
+  // Fail loud, never provision a BARE box (ADR 0150). No infra/ located → there is
+  // no cloud-init to render, so THROW here rather than the old silent `return null`
+  // that let cmdProvision ship empty user-data (a box that boots as bare Ubuntu).
+  if (!infraDir) {
+    throw new Error(
+      `box cloud-init not found: no infra/${BOX_INFRA_TEMPLATE} in any candidate location `
+      + `(set <PREFIX>_BOX_INFRA_DIR or <PREFIX>_INSTANCE_ROOT, or ship infra/). A box must `
+      + `never be provisioned without user-data — it would boot bare (ADR 0150).`,
+    );
+  }
+  const p = path.join(infraDir, BOX_INFRA_TEMPLATE);
   // gzip+base64 a repo file into the cloud-init write_files (`encoding: gz+b64`).
   // EVERY inlined infra file goes through this: cloud-init gunzips it back to the
   // exact bytes on the box, so it is byte-identical to plain b64 but ~2-3x smaller,
@@ -263,54 +360,61 @@ function readCloudInit({ authorizedKeysBlock = '', boxEnv = '', gdsSession = ''
   // -fetch growth in task 1314 had pushed the all-b64-but-source-fetch render to
   // 67 KB — gz+b64-ing the rest brings it back to ~51 KB, task 1321). Only the
   // dynamic runtime values (authorized_keys, box.env, gds-session) stay plain b64
-  // below — they are minted per-provision, not read from infra/. Warn loudly (not
-  // throw) if a file is unreadable so a half-wired box surfaces, not boots silent.
+  // below — they are minted per-provision, not read from infra/. A missing inlined
+  // file is COLLECTED and fails loud after the render (ADR 0150) — a half-wired box
+  // (that component silently never boots) is a bug, not something to warn past.
+  const missingInfra = [];
   const fileGzB64 = (name) => {
     try {
-      return zlib.gzipSync(fs.readFileSync(path.join(REPO_ROOT, 'infra', name))).toString('base64');
-    } catch (e) {
-      console.error(`⚠ ${name} not readable (${e.message}) — the box will boot WITHOUT it; fix infra/${name} before provisioning`);
+      return zlib.gzipSync(fs.readFileSync(path.join(infraDir, name))).toString('base64');
+    } catch {
+      missingInfra.push(name);
       return '';
     }
   };
-  try {
-    const raw = fs.readFileSync(p, 'utf8');
-    // Inject the rank-gated source-fetch (#600) + authorized-keys-fetch (#685)
-    // scripts as gz+b64 (a single YAML-safe token — no indentation/escaping
-    // pitfalls; cloud-init gunzips encoding: gz+b64 back to the exact file), plus
-    // the baked authorized_keys block. ONE canonical copy of each lives in infra/.
-    return raw
-      .replace(/__REPO_URL__/g, process.env.BOX_REPO_URL || '')
-      .replace(/__BOX_SOURCE_FETCH_B64__/g, fileGzB64('box-source-fetch.sh'))
-      .replace(/__BOX_AUTHKEYS_FETCH_B64__/g, fileGzB64('box-authorized-keys-fetch.sh'))
-      .replace(/__BUILDER_AUTHORIZED_KEYS_B64__/g, Buffer.from(authorizedKeysBlock || '', 'utf8').toString('base64'))
-      // /etc/otb/box.env — empty by default (quick tunnel); the named-tunnel
-      // connector token + stable hostname when BOX_NAMED_TUNNEL is on (#771).
-      .replace(/__BOX_ENV_B64__/g, Buffer.from(boxEnv || '', 'utf8').toString('base64'))
-      // /root/.config/otb/gds-session.json — the builder's GDS session, minted at
-      // provision so box-source-fetch (#600) can authenticate on FIRST boot and
-      // clone the rank-scoped repo. Without it the box never clones (the #818
-      // chicken-and-egg: the session normally comes from /builder-setup, which
-      // lives in the un-cloned repo).
-      .replace(/__GDS_SESSION_B64__/g, Buffer.from(gdsSession || '', 'utf8').toString('base64'))
-      // #774: the browser-terminal units, inlined so they start at FIRST BOOT
-      // (independent of the repo clone). ONE canonical copy lives in infra/.
-      .replace(/__BOX_TERMINAL_SERVICE_B64__/g, fileGzB64('box-terminal.service'))
-      // #917: credential-drift watcher pair — restarts ttyd when the credential
-      // file lands/changes after the service started (the wake/first-boot race).
-      .replace(/__BOX_TERMINAL_CREDSYNC_SERVICE_B64__/g, fileGzB64('box-terminal-credsync.service'))
-      .replace(/__BOX_TERMINAL_CREDENTIAL_PATH_B64__/g, fileGzB64('box-terminal-credential.path'))
-      .replace(/__CLOUDFLARED_SERVICE_B64__/g, fileGzB64('cloudflared.service'))
-      .replace(/__CLOUDFLARED_RUN_B64__/g, fileGzB64('cloudflared-run.sh'))
-      // #893: the `close-box` teardown command, present at first boot so a bare
-      // browser-only box has it before any repo clone (box-source-fetch refreshes
-      // it on existing boxes). ONE canonical copy lives in infra/close-box.sh.
-      .replace(/__CLOSE_BOX_B64__/g, fileGzB64('close-box.sh'))
-      // task 986: the browser-terminal auto-launcher — runs `claude` on first
-      // connect so the builder skips the "type claude" step. box-source-fetch
-      // refreshes it on existing boxes. ONE canonical copy in infra/otb-box-launch.sh.
-      .replace(/__OTB_BOX_LAUNCH_B64__/g, fileGzB64('otb-box-launch.sh'));
-  } catch { return null; }
+  const raw = fs.readFileSync(p, 'utf8');
+  // Inject the rank-gated source-fetch (#600) + authorized-keys-fetch (#685)
+  // scripts as gz+b64 (a single YAML-safe token — no indentation/escaping
+  // pitfalls; cloud-init gunzips encoding: gz+b64 back to the exact file), plus
+  // the baked authorized_keys block. ONE canonical copy of each lives in infra/.
+  const rendered = raw
+    .replace(/__REPO_URL__/g, process.env.BOX_REPO_URL || '')
+    .replace(/__BOX_SOURCE_FETCH_B64__/g, fileGzB64('box-source-fetch.sh'))
+    .replace(/__BOX_AUTHKEYS_FETCH_B64__/g, fileGzB64('box-authorized-keys-fetch.sh'))
+    .replace(/__BUILDER_AUTHORIZED_KEYS_B64__/g, Buffer.from(authorizedKeysBlock || '', 'utf8').toString('base64'))
+    // /etc/otb/box.env — empty by default (quick tunnel); the named-tunnel
+    // connector token + stable hostname when BOX_NAMED_TUNNEL is on (#771).
+    .replace(/__BOX_ENV_B64__/g, Buffer.from(boxEnv || '', 'utf8').toString('base64'))
+    // /root/.config/otb/gds-session.json — the builder's GDS session, minted at
+    // provision so box-source-fetch (#600) can authenticate on FIRST boot and
+    // clone the rank-scoped repo. Without it the box never clones (the #818
+    // chicken-and-egg: the session normally comes from /builder-setup, which
+    // lives in the un-cloned repo).
+    .replace(/__GDS_SESSION_B64__/g, Buffer.from(gdsSession || '', 'utf8').toString('base64'))
+    // #774: the browser-terminal units, inlined so they start at FIRST BOOT
+    // (independent of the repo clone). ONE canonical copy lives in infra/.
+    .replace(/__BOX_TERMINAL_SERVICE_B64__/g, fileGzB64('box-terminal.service'))
+    // #917: credential-drift watcher pair — restarts ttyd when the credential
+    // file lands/changes after the service started (the wake/first-boot race).
+    .replace(/__BOX_TERMINAL_CREDSYNC_SERVICE_B64__/g, fileGzB64('box-terminal-credsync.service'))
+    .replace(/__BOX_TERMINAL_CREDENTIAL_PATH_B64__/g, fileGzB64('box-terminal-credential.path'))
+    .replace(/__CLOUDFLARED_SERVICE_B64__/g, fileGzB64('cloudflared.service'))
+    .replace(/__CLOUDFLARED_RUN_B64__/g, fileGzB64('cloudflared-run.sh'))
+    // #893: the `close-box` teardown command, present at first boot so a bare
+    // browser-only box has it before any repo clone (box-source-fetch refreshes
+    // it on existing boxes). ONE canonical copy lives in infra/close-box.sh.
+    .replace(/__CLOSE_BOX_B64__/g, fileGzB64('close-box.sh'))
+    // task 986: the browser-terminal auto-launcher — runs `claude` on first
+    // connect so the builder skips the "type claude" step. box-source-fetch
+    // refreshes it on existing boxes. ONE canonical copy in infra/otb-box-launch.sh.
+    .replace(/__OTB_BOX_LAUNCH_B64__/g, fileGzB64('otb-box-launch.sh'));
+  if (missingInfra.length) {
+    throw new Error(
+      `box cloud-init is incomplete under ${infraDir}: missing ${missingInfra.join(', ')} `
+      + `— a box would boot half-wired (ADR 0150). Fix the instance infra/ before provisioning.`,
+    );
+  }
+  return rendered;
 }
 
 // ---- provision -------------------------------------------------------------
@@ -357,6 +461,20 @@ async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {
   console.log(`  region=${CONFIG.region} size=${CONFIG.size} image=${CONFIG.baseImage} host=${hostname}`);
   console.log(`  baked SSH keys: ${sshKeys.length}${sshKeys.length === 0 ? ' (⚠ builder cannot SSH in until a key is registered — see `box.js onboard`)' : ''}`);
 
+  // ADR 0150 — resolve the box cloud-init source up front (dry-run AND apply) and
+  // FAIL LOUD if it can't be located. A missing infra/ means empty user-data, i.e.
+  // a box that boots BARE. Aborting here (before any session/tunnel is minted)
+  // surfaces the packaging bug in the PLAN, not as a silent bare box hours later.
+  const infraDir = resolveBoxInfraDir();
+  if (!infraDir) {
+    return fail(
+      `box cloud-init source not found — no infra/${BOX_INFRA_TEMPLATE} in any candidate location `
+      + `(<PREFIX>_BOX_INFRA_DIR, <PREFIX>_INSTANCE_ROOT / bongos.config.json, ${path.join(REPO_ROOT, 'infra')}, or a node_modules ancestor). `
+      + `A box would boot BARE — refusing to provision. Ship infra/ or point the instance root at it (ADR 0150).`,
+    );
+  }
+  console.log(`  cloud-init source: ${infraDir}`);
+
   // Named-tunnel automation (#771, ADR 0038 Part B). OPT-IN: off → the box uses
   // the tokenless quick tunnel (#760 default) and box.env is left empty. On but
   // misconfigured → fail loud now (an operator who turned it on meant it).
@@ -366,6 +484,9 @@ async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {
   const termHost = namedTunnelEnabled() ? `term-${builder.github_login}.${CF.terminalZone}` : null;
   if (namedTunnelEnabled()) {
     console.log(`  named tunnel: ${termHost} (Cloudflare zone ${CF.zone})`);
+    // Before ANY droplet spend, and on the dry-run path too, so `provision <login>`
+    // with no --apply tells the operator the truth for free (task 1002511).
+    await preflightCookieStripScope();
   } else {
     console.log('  browser terminal: quick tunnel (tokenless trycloudflare.com — set BOX_NAMED_TUNNEL=1 for a stable hostname)');
   }
@@ -399,7 +520,7 @@ async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {
   let terminalCredential = null;
   if (namedTunnelEnabled()) {
     try {
-      const { token, hostname: th, previewHostname: ph } = await makeCf(true).ensureNamedTunnel({
+      const { token, hostname: th, previewHostname: ph, edgeRules } = await makeCf(true).ensureNamedTunnel({
         login: builder.github_login, zone: CF.zone, terminalZone: CF.terminalZone,
       });
       terminalHostname = th;
@@ -411,6 +532,18 @@ async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {
       boxEnv = `# /etc/otb/box.env — baked by box.js provision (#771/#774, ADR 0038 named tunnel)\nBOX_TUNNEL_TOKEN=${token}\nBOX_TERMINAL_HOSTNAME=${th}\nBOX_TERMINAL_CREDENTIAL=${terminalCredential}\nBOX_PREVIEW_HOSTNAME=${ph}\n`;
       console.log(`  ✓ named tunnel ready — ${th}`);
       console.log(`  ✓ live game preview — https://${ph} (ADR 0044)`);
+      // The rule PUT is the ONLY thing that proves edit scope. Report its real
+      // outcome next to the ✓ lines so a silent miss lands in the summary rather
+      // than mid-log (task 1002511).
+      if (edgeRules && !edgeRules.cookieStrip.applied) {
+        console.log(`  ⚠⚠ SECURITY (ADR 0053 / SR#11): the edge cookie-strip Transform Rule was NOT applied${edgeRules.cookieStrip.error ? ` — ${edgeRules.cookieStrip.error}` : ''}`);
+        console.log(`     Platform cookies for .${CF.zone} can reach ${th} and ${ph} until it is.`);
+        console.log('     Widen CLOUDFLARE_API_TOKEN with zone "Transform Rules → Edit", or apply the rule');
+        console.log('     once by hand — see docs/recipes/builder-box-lifecycle.md.');
+      }
+      if (edgeRules && !edgeRules.cacheBypass.applied) {
+        console.log(`  ⚠ the sandbox cache-bypass Cache Rule was NOT applied${edgeRules.cacheBypass.error ? ` — ${edgeRules.cacheBypass.error}` : ''} (stale preview risk, #1065)`);
+      }
     } catch (e) {
       await boxes.setBoxState(pool, builder.id, 'error', { error_note: `named tunnel: ${e.message}` });
       return fail(`named tunnel setup failed: ${e.message}`);
@@ -443,15 +576,29 @@ async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {
   const gdsSession = JSON.stringify({
     token: sessionToken,
     builder: { id: builder.id, github_login: builder.github_login, rank: builder.rank },
-    api_base: process.env.GDS_PUBLIC_ORIGIN || 'https://amazonprimea.com',
+    // The instance's OWN public origin (task 1002428) — a hardcoded founder host
+    // here would point every newly provisioned box at the wrong instance.
+    api_base: process.env.GDS_PUBLIC_ORIGIN || instanceConfig.defaultApiBase(),
   }, null, 2);
 
   const doApi = makeDo(apply);
   // Render + size-check the cloud-init BEFORE touching DO (#903). DO rejects
   // user-data over 64 KiB with an opaque error; fail fast with an actionable one
   // so an over-budget cloud-init is caught here, not as a cryptic API 4xx.
-  const userData = readCloudInit({ authorizedKeysBlock, boxEnv, gdsSession });
+  let userData;
+  try {
+    userData = readCloudInit({ authorizedKeysBlock, boxEnv, gdsSession, infraDir });
+  } catch (e) {
+    await boxes.setBoxState(pool, builder.id, 'error', { error_note: `cloud-init: ${e.message}`.slice(0, 480) });
+    return fail(e.message);
+  }
   const userDataBytes = userData ? Buffer.byteLength(userData, 'utf8') : 0;
+  // Belt-and-braces (ADR 0150): readCloudInit throws above, but NEVER hand DO empty
+  // user-data — that IS the bare-box failure this fix closes.
+  if (!userDataBytes) {
+    await boxes.setBoxState(pool, builder.id, 'error', { error_note: 'cloud-init render produced empty user-data' });
+    return fail('cloud-init render produced EMPTY user-data — a box would boot bare (ADR 0150); refusing to provision.');
+  }
   if (userDataBytes > MAX_USERDATA_BYTES) {
     await boxes.setBoxState(pool, builder.id, 'error', {
       error_note: `cloud-init ${userDataBytes}B > ${MAX_USERDATA_BYTES}B`,
@@ -461,6 +608,14 @@ async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {
   await boxes.setBoxState(pool, builder.id, 'provisioning', {
     scope, provisioned_rank: builder.rank, region: CONFIG.region, size_slug: CONFIG.size,
     droplet_name: name, hostname, error_note: null,
+    // The droplet about to boot mints FRESH host keys, so anything the row still
+    // carries describes a box that is gone. deprovisionOne clears these on teardown
+    // (idea 310), but a provision over a row that never went through teardown — an
+    // errored/parked box, a re-provision after a manual DO delete — kept serving the
+    // predecessor's identity via GET /box/me, and the connect path pinned it: "Host
+    // denied (verification failed)". Clear here too; the new box re-reports via
+    // POST /box/host-keys, and until then the client falls back to a live keyscan.
+    host_keys: null, host_keys_at: null,
   });
   try {
     const { droplet } = await doApi.createDroplet({
@@ -522,8 +677,21 @@ async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {
 // box can't fetch its own authorized_keys until the builder has a token ON the
 // box (chicken-and-egg), onboard REQUIRES at least one registered key by default;
 // --allow-no-keys overrides for an operator who knows they'll re-provision later.
+// The instance's product name, for the Claude Desktop environment label the
+// connect instructions name (task 1002428). Neutral fallback, never a foreign brand.
+function boxEnvLabel() {
+  try {
+    const id = require(path.join(REPO_ROOT, 'src/branding')).branding().identity || {};
+    if (id.productName) return id.productName;
+  } catch (_) { /* fall through */ }
+  return 'Cloud Bongos';
+}
+
 function gdsBase() {
-  return (process.env.GDS_API_BASE || 'https://amazonprimea.com').replace(/\/+$/, '');
+  // Session-aware, via the single source of truth (task 1002427/1002428) — the
+  // operator's signed-in instance, not a hardcoded founder host. <PREFIX>_API_BASE
+  // (incl. legacy GDS_API_BASE) still wins, so existing overrides are unchanged.
+  return String(instanceConfig.resolveApiBase()).replace(/\/+$/, '');
 }
 
 function printWelcomePacket(login, scope) {
@@ -540,7 +708,7 @@ function printWelcomePacket(login, scope) {
   console.log(`  Windows:      irm ${base}/api/gds/box/connect.ps1 | iex`);
   console.log(`  (guide:       ${base}/api/gds/box/connect )`);
   console.log('');
-  console.log('Then: restart Claude Desktop → Code → Environment → "Amazonprimea Dev Box".');
+  console.log(`Then: restart Claude Desktop → Code → Environment → "${boxEnvLabel()} Dev Box".`);
   console.log('');
   console.log('On a Chromebook / browser-only device (no Claude Desktop)? Skip the above —');
   console.log('your box serves its own terminal in a browser tab (ADR 0038). Once it is');
@@ -1204,6 +1372,10 @@ Named browser-terminal tunnel (#771, ADR 0038 — OPT-IN, default OFF):
                             connector token; deprovision tears it down). Off → the
                             zero-secret quick tunnel (trycloudflare.com).
   CLOUDFLARE_API_TOKEN      token with Account:Cloudflare Tunnel:Edit + Zone:DNS:Edit
+                            + Zone:Transform Rules:Edit (the ADR 0053 cookie-strip —
+                            without it platform cookies reach the box subdomains)
+                            + Zone:Cache Rules:Edit (the sandbox cache bypass, #1065).
+                            provision read-probes the ruleset scope before spending.
   CLOUDFLARE_ACCOUNT_ID     the Cloudflare account the tunnels live in
   CLOUDFLARE_ZONE           DNS zone (default ${CF.zone})
   BOX_TERMINAL_ZONE         hostname suffix (default ${CF.terminalZone})`);
@@ -1255,4 +1427,4 @@ async function main() {
 
 if (require.main === module) main();
 
-module.exports = { cmdProvision, deprovisionOne, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed };
+module.exports = { cmdProvision, deprovisionOne, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed, resolveBoxInfraDir, boxInfraCandidates, readCloudInit, BOX_INFRA_TEMPLATE };