@bongos/core 1.19.1072 → 1.19.1074

package/tests/session_rename_fallback.mjs

@@ -263,23 +263,6 @@ test('the browser logout clears every session-cookie name', () => {
   }
 });
 
-// ── 6. the box scripts read both names ──────────────────────────────────────────────────────
-
-test('the baked box scripts scan BOTH session filenames', () => {
-  // These run on live dev boxes and are baked at provision time, so they cannot import anything.
-  // A box provisioned AFTER the rename writes only the new name; one provisioned before has only
-  // the old. Missing either silently breaks heartbeat/reporting on half the fleet.
-  for (const rel of ['infra/box-heartbeat.sh', 'infra/box-report-host-keys.sh',
-    'infra/box-report-terminal.sh', 'infra/box-report-version.sh']) {
-    const src = read(rel);
-    const glob = src.split('\n').find((l) => l.includes('for _sess in'));
-    assert.ok(glob, `${rel}: session glob not found`);
-    for (const name of [NEW_FILE, 'gds-session.json']) {
-      assert.ok(glob.includes(name), `${rel}: glob must scan ${name} — got: ${glob.trim()}`);
-    }
-  }
-});
-
 // ── 8. the credential detector follows the rename ───────────────────────────────────────────
 
 test('the artifact-scan credential detector flags a read of EVERY session filename', () => {
@@ -295,7 +278,3 @@ test('the artifact-scan credential detector flags a read of EVERY session filena
     assert.ok(rule.includes(stem), `the detector must still match ${name} — got: ${rule.trim()}`);
   }
 });
-// The box resolver is EXECUTED — a post-rename box and a migrated one — in
-// tests/lib_sh_resolution.mjs, which already owns the extraction harness for that shell
-// block. Deliberately not duplicated here: two harnesses on one block is two things to
-// fix when the names next move (task 1003704).

package/tests/ship_error_shape.mjs

@@ -11,7 +11,7 @@
 //   * interpolating `data.error` into a template string stringifies the
 //     envelope OBJECT — that is the literal "[object Object]";
 //   * `data.error === 'some_code'` never matches, so the graceful branch
-//     behind it (box_scope re-auth, verify-attestation remedy, the
+//     behind it (the re-auth hint, verify-attestation remedy, the
 //     CLAIM_SESSION_MISMATCH explanation) is DEAD CODE against a live server;
 //   * `data.<field>` reads a top-level field that MOVED into `error.details`.
 //

package/tests/task_visual_slots.mjs

@@ -157,5 +157,36 @@ await test('attach uploads every slot file in the directory to its NAMED slot, a
   assert.equal(code, 0, 'all eight attached');
 });
 
+// task 1004358: every test above drives the bare module router, which is why a
+// real render 413'd live — buildGdsRouter's global 64 KB express.json runs FIRST
+// and rejected any slot body over 64 KB before the route's own 8 MB parser saw
+// it. So this case puts the REAL gate from buildGdsRouter (its first layer)
+// in front of the same router, and sends a body the size of a real render.
+await test('a slot render over 64 KB gets past buildGdsRouter\'s global body cap and attaches (task 1004358)', async () => {
+  const { buildGdsRouter } = require('../src/bongos/routes.js');
+  const gate = buildGdsRouter().stack[0].handle;
+  const whole = express();
+  whole.use(gate);
+  whole.use((req, res, next) => { res.fail = (code, status, extra) => res.status(typeof status === 'number' ? status : (status && status.status) || 500).json({ error: code, ...(extra || {}) }); next(); });
+  whole.use(require('../modules/lifecycle/routes/visuals.js')());
+  whole.use((err, req, res, next) => res.status(err.status || 500).json({ error: err.type || 'error' }));
+  const srv = http.createServer(whole);
+  await new Promise((r) => srv.listen(0, '127.0.0.1', r));
+  const at = `http://127.0.0.1:${srv.address().port}`;
+  // A real PNG padded past the cap: ~120 KB, the size of the renders that failed live.
+  const big = Buffer.concat([PNG, Buffer.alloc(120 * 1024)]);
+  const body = JSON.stringify({ image_b64: big.toString('base64'), content_type: 'image/png' });
+  assert.ok(body.length > 64 * 1024, 'the body is over the global cap');
+  try {
+    const post = (url) => fetch(at + url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body });
+    const control = await post('/tasks/5002/not-a-bypassed-path');
+    assert.equal(control.status, 413, 'the gate under test really is the 64 KB cap');
+    const r = await post('/tasks/5002/visuals/before-desktop-light');
+    const j = await r.json();
+    assert.equal(r.status, 201, `the render attaches, not 413: ${JSON.stringify(j)}`);
+    assert.equal(j.slot, 'before-desktop-light');
+  } finally { await new Promise((r) => srv.close(r)); }
+});
+
 fs.rmSync(TMP, { recursive: true, force: true });
 summary();

package/tests/terms_acceptance.mjs

@@ -495,7 +495,7 @@ await ta('no hub session, no acceptance — the unauthenticated caller is bounce
   assert.equal(pool.accounts.size, 0, 'an account (and an acceptance) was created for a caller with no session');
 });
 
-await ta('a dev-box session cannot mint an acceptance either (ADR 0016 trust boundary)', async () => {
+await ta('a session of an undeclared source (a leftover dev-box token) cannot mint an acceptance either', async () => {
   SESSION = { ...HUB_SESSION, source: 'box' };
   pool.accounts.clear();
   const res = await authorize();

package/tests/upgrade.mjs

@@ -1055,7 +1055,7 @@ function moduleLibStub(verdict) {
 t('preflightModules: a DISABLED incompatible module is returned as a warning, not dropped', () => {
   const dir = scratchConsumer();
   mkdirSync(join(dir, 'modules'), { recursive: true });
-  const warned = { key: 'stale-catalog-entry', coreVersion: '^1.0.0', enabled: false, satisfied: false, maintainer: 'Ada <ada@example.com>', maintenance: { status: 'maintained' } };
+  const warned = { key: 'stale-catalog-entry', version: '1.0.0', coreVersion: '^1.0.0', enabled: false, satisfied: false, maintainer: 'Ada <ada@example.com>', maintenance: { status: 'maintained' } };
   const res = u.preflightModules({ instanceDir: dir, targetVersion: '2.0.0' }, {
     moduleLib: moduleLibStub({ ok: true, blocking: [], warnings: [warned], deprecations: [], expired: [], core: '2.0.0' }),
   });
@@ -1084,7 +1084,7 @@ t('preflightModules: no modules/ dir returns every collection empty (a vanilla c
 t('reportModulePreflight: prints the rotted-but-disabled module WITH its maintainer named', () => {
   const out = [];
   const mods = {
-    warnings: [{ key: 'stale-catalog-entry', coreVersion: '^1.0.0', maintainer: 'Ada <ada@example.com>', maintenance: { status: 'maintained' } }],
+    warnings: [{ key: 'stale-catalog-entry', version: '1.0.0', coreVersion: '^1.0.0', maintainer: 'Ada <ada@example.com>', maintenance: { status: 'maintained' } }],
     deprecations: [], expired: [],
   };
   u.reportModulePreflight(mods, '2.0.0', { log: (s) => out.push(s), err: (s) => out.push(s) });
@@ -1122,8 +1122,8 @@ t('runUpgrade: a REFUSED bump still reports the non-blocking module findings', a
     err: (s) => out.push(String(s)),
     moduleLib: moduleLibStub({
       ok: false,
-      blocking: [{ key: 'enabled-breaker', coreVersion: '^1.0.0', enabled: true, satisfied: false }],
-      warnings: [{ key: 'stale-catalog-entry', coreVersion: '^1.0.0', maintenance: { status: 'orphaned', note: 'author unreachable' } }],
+      blocking: [{ key: 'enabled-breaker', version: '1.0.0', coreVersion: '^1.0.0', enabled: true, satisfied: false }],
+      warnings: [{ key: 'stale-catalog-entry', version: '1.0.0', coreVersion: '^1.0.0', maintenance: { status: 'orphaned', note: 'author unreachable' } }],
       deprecations: [], expired: [], core: '2.0.0',
     }),
   });

package/tests/watch_sealed_floor.mjs

@@ -19,7 +19,6 @@
 //   builder.roster.read     → metic    (ADR 0157, was archon)
 //   session.search          → metic    (ADR 0157, was archon)
 //   audit_log.read          → metic    (ADR 0157, was archon)
-//   box.fleet.manage        → metic    (ADR 0157, was archon)
 //
 // A hardcoded 'metic' is the same defect one ADR later, which is why the fix reads
 // the floor off the DENIAL: requirePermission already rides `details.floors` on

package/tests/wizard_draft_resume.mjs

@@ -90,9 +90,9 @@ test('post-auth: the real step is rendered', () => {
 
 test('a draft already at step 1 is unchanged, and an out-of-range step is not resurrected', () => {
   assert.equal(runStep({ authKnown: false, draftStep: 1 }).persisted.step, 1);
-  // 8 is the done panel, reached by its own branch above this slice; 0 is the gate. Neither
+  // 9 is the done panel (8 before task 1004351), reached by its own branch above this slice; 0 is the gate. Neither
   // is a resumable wizard position, so the placeholder is allowed to stand.
-  for (const bad of [0, 8, 99]) {
+  for (const bad of [0, 9, 99]) {
     assert.equal(runStep({ authKnown: false, draftStep: bad }).persisted.step, 1, `step ${bad} is not resumed`);
   }
 });

package/tests/wizard_intent_resume.mjs

@@ -15,12 +15,12 @@
 // ruled out the task's other option (drop the record at a terminal state).
 //
 // The reset fires only when there is a SECOND DRAFT to lose, and the draft's own step is
-// what says so. A landed create clears DRAFT_KEY — but show(8) then persists the done
+// what says so. A landed create clears DRAFT_KEY — but show(9) then persists the done
 // panel's position straight back into it, so a plain "is there a draft?" test is always
 // yes and would skip the reset forever, leaving the finished project's name sitting in
 // the fresh form. (That is exactly what the first cut of this change shipped into a
 // render: "still watching Mercury" above a name field still reading "Mercury".) Only
-// steps 1-7 are wizard steps; anything else is the done panel's own bookkeeping.
+// steps 1-8 are wizard steps; anything else is the done panel's own bookkeeping.
 //
 // Harness: there is no jsdom in this repo, so this follows tests/wizard_draft_resume.mjs
 // and tests/project_door_ui.mjs — slice the real region out of the page's INLINE script
@@ -57,8 +57,8 @@ test('both slices are still findable (a rename must fail loudly, not silently pa
   assert.ok(offerSlice, 'paintResumeOffer() was not found in projects.html');
   assert.match(enterSlice, /if \(focus && !resumeIntent\) \{/, 'the intent branch is part of the slice');
   assert.match(enterSlice, /startProgress\(created\.id\);/, 'so is the resume branch it guards');
-  assert.match(enterSlice, /draft\.step >= 1 && draft\.step <= 7/,
-    'the STORED draft\'s step decides, not state.step — state.step is 8 for the whole life of a finished standup');
+  assert.match(enterSlice, /draft\.step >= 1 && draft\.step <= 8/,
+    'the STORED draft\'s step decides, not state.step — state.step is 9 for the whole life of a finished standup');
   assert.match(SCRIPT, /if \(created && created\.id\) \{ enterCreated\(created, !!focus\); return; \}/,
     'enter() still hands the created record straight to it');
 });
@@ -72,7 +72,7 @@ function runEnter({ focus, resumeIntent = false, draft = null, record }) {
   const calls = { show: [], resets: 0, offer: [], done: 0, progress: [], polls: 0, focused: 0 };
   // state.step is the DONE step for the whole life of a finished standup — the value
   // a draft-blind reading would have trusted
-  const state = { step: draft ? draft.step : 8, name: 'Mercury', slug: 'mercury', domain: '', mode: 'greenfield', noAddress: false, modules: null };
+  const state = { step: draft ? draft.step : 9, name: 'Mercury', slug: 'mercury', domain: '', mode: 'greenfield', noAddress: false, modules: null };
   const sandbox = {
     record, focus, resumeIntent, state,
     DRAFT_KEY: 'draft',
@@ -98,7 +98,7 @@ const REC = { id: 'inst-1', name: 'Acme', slug: 'acme', domain: 'acme.example',
 
 test('a reload / Back / identity settle (focus false) still resumes the done panel, watch and all', () => {
   const { calls, state } = runEnter({ focus: false, record: REC });
-  assert.deepEqual(calls.show, [[8, false]], 'the done panel, and no focus steal on a non-deliberate arrival');
+  assert.deepEqual(calls.show, [[9, false]], 'the done panel, and no focus steal on a non-deliberate arrival');
   assert.equal(calls.resets, 0, 'nothing is reset — this is the same standup continuing');
   assert.equal(calls.done, 1, 'the checklist is re-rendered');
   assert.deepEqual(calls.progress, ['inst-1'], 'the progress watch is restarted from the record');
@@ -126,7 +126,7 @@ test('…and the standup stays one click away, named, on the resume link', () =>
 
 test('the resume link gets the done panel back — the record was never cleared', () => {
   const { calls, sandbox } = runEnter({ focus: true, resumeIntent: true, record: REC });
-  assert.deepEqual(calls.show, [[8, true]], 'a deliberate resume moves focus to the done panel');
+  assert.deepEqual(calls.show, [[9, true]], 'a deliberate resume moves focus to the done panel');
   assert.deepEqual(calls.progress, ['inst-1'], 'the watch comes back with it');
   assert.equal(sandbox.resumeIntent, false, 'the flag is ONE-SHOT — the next plain nav click must mean "new" again');
   assert.deepEqual(calls.offer, [null], 'and the offer comes down behind it');
@@ -144,17 +144,28 @@ test('a second draft already under way is NOT wiped by navigating back to the wi
 });
 
 test('the done panel\'s own saved step is NOT a second draft — it must not block the reset', () => {
-  // Caught in a render, not in a unit test: show(8) calls saveDraft(), so DRAFT_KEY is
+  // Caught in a render, not in a unit test: show(9) calls saveDraft(), so DRAFT_KEY is
   // non-empty again the moment a create lands. Reading "is there a draft?" left the
   // finished project's name in the fresh form, under a line offering to resume it.
-  const { calls, state } = runEnter({ focus: true, record: REC, draft: { step: 8, name: 'Mercury' } });
+  const { calls, state } = runEnter({ focus: true, record: REC, draft: { step: 9, name: 'Mercury' } });
   assert.equal(calls.resets, 1, 'the done step is bookkeeping, not a project being typed');
   assert.deepEqual(calls.show, [[1, false]], 'out-of-range steps land on the name step');
   assert.equal(state.name, '', 'and the finished project\'s name does not survive into it');
   assert.equal(calls.done, 0, 'never back onto the done panel');
 });
 
-test('a draft whose step is missing or junk resets too — only 1-7 preserves anything', () => {
+test('a draft on the app step or the review is live too — the last two numbered steps (task 1004351)', () => {
+  // The app step moved the review from 7 to 8. A guard left at 7 would reset a second
+  // project sitting on its review, silently wiping it.
+  for (const step of [7, 8]) {
+    const { calls, state } = runEnter({ focus: true, record: REC, draft: { step } });
+    assert.equal(calls.resets, 0, `step ${step} is a live draft`);
+    assert.deepEqual(calls.show, [[step, true]]);
+    assert.equal(state.step, step);
+  }
+});
+
+test('a draft whose step is missing or junk resets too — only 1-8 preserves anything', () => {
   for (const draft of [{ step: 0 }, { step: 9 }, { name: 'half-typed' }]) {
     const { calls } = runEnter({ focus: true, record: REC, draft });
     assert.equal(calls.resets, 1, `step ${JSON.stringify(draft.step)} is not a wizard step`);

package/tests/wizard_preselect_why.mjs

@@ -1,12 +1,12 @@
 // tests/wizard_preselect_why.mjs — the module picker always says WHY the preselect is on
 // (task 1003684).
 //
-// The bug as filed said the starter-bundle "why" sentence was being dropped for
-// Game + small-team. It was not: `adjustments` is a DELTA, and a rule that fires without
-// changing anything claims nothing (ADR 0243). The game bundle is already
-// ['dev-box','discord'] and the small-team rule ADDS dev-box, so the rule fires, moves
-// nothing, and correctly reports []. Verified against live core 1.19.580:
-//   byTeamShape['small-team'] => {"bundle":["dev-box","discord"],"adjustments":[]}
+// The bug as filed said the starter-bundle "why" sentence was being dropped for one
+// type + team-shape pair. It was not: `adjustments` is a DELTA, and a rule that fires
+// without changing anything claims nothing (ADR 0243). When a type's bundle already holds
+// the module a rule adds — today the game bundle is ['discord'] and the community rule
+// ADDS discord — the rule fires, moves nothing, and correctly reports []:
+//   byTeamShape.community => {"bundle":["discord"],"adjustments":[]}
 //
 // The real defect is what the owner then saw: two extras pre-switched-on with no reason
 // beside them — precisely the state the paint site's own comment calls out, "a preselect an
@@ -46,13 +46,13 @@ const BUNDLES = {
       type: 'game',
       label: 'Game starter',
       summary: 'Somewhere for players to gather, and a place to walk a change through before anyone plays it.',
-      bundle: ['dev-box', 'discord'],
+      bundle: ['discord'],
       byTeamShape: {
         // the live case: the rule fires, moves nothing, reports nothing
-        'small-team': { bundle: ['dev-box', 'discord'], adjustments: [] },
+        community: { bundle: ['discord'], adjustments: [] },
         solo: {
-          bundle: ['discord'],
-          adjustments: [{ reason: 'You are building this alone, so the shared cloud environment is off — your own machine is the setup.' }],
+          bundle: [],
+          adjustments: [{ reason: 'You are building this alone, so the community space is off.' }],
         },
       },
     },
@@ -62,9 +62,9 @@ const BUNDLES = {
       summary: 'Extra agents to run the reading and the experiments the question needs.',
       bundle: ['agents'],
       byTeamShape: {
-        'small-team': {
-          bundle: ['agents', 'dev-box'],
-          adjustments: [{ reason: 'A small team gets one shared environment to build in, so nobody is debugging their own laptop.' }],
+        community: {
+          bundle: ['agents', 'discord'],
+          adjustments: [{ reason: 'You said an open community is building this, so somewhere for it to gather is switched on.' }],
         },
       },
     },
@@ -83,16 +83,16 @@ function why({ projType, teamShape, modules = null, bundles = BUNDLES }) {
   return Array.from(sandbox.__out);
 }
 
-test('game + small-team: no delta, so the type\'s own summary is the reason', () => {
+test('game + community: no delta, so the type\'s own summary is the reason', () => {
   // This is the exact combination from the live walk that surfaced the bug.
-  const out = why({ projType: 'game', teamShape: 'small-team' });
+  const out = why({ projType: 'game', teamShape: 'community' });
   assert.deepEqual(out, ['Somewhere for players to gather, and a place to walk a change through before anyone plays it.']);
 });
 
 test('a REAL adjustment still speaks for itself — the summary does not displace it', () => {
-  const out = why({ projType: 'research', teamShape: 'small-team' });
+  const out = why({ projType: 'research', teamShape: 'community' });
   assert.equal(out.length, 1);
-  assert.match(out[0], /shared environment/);
+  assert.match(out[0], /somewhere for it to gather/);
   assert.doesNotMatch(out[0], /reading and the experiments/, 'the rule\'s sentence wins, not the summary');
 });
 
@@ -128,7 +128,7 @@ test('before the bundles read lands, nothing is claimed', () => {
 
 test('every sentence returned is a plain string, so the paint site can escape it directly', () => {
   for (const t of ['game', 'research']) {
-    for (const s of ['small-team', 'solo', null]) {
+    for (const s of ['community', 'solo', null]) {
       for (const line of why({ projType: t, teamShape: s })) {
         assert.equal(typeof line, 'string', `${t}/${s} yielded a non-string`);
       }

package/docs/onboarding/browser-terminal-guide.md

@@ -1,73 +0,0 @@
-# Building from a Chromebook, iPad, or phone (the browser terminal)
-
-*Plain-language how-to for builders on a device that can't run the Claude Code desktop app.*
-
-Most builders run Claude Code in the **desktop app** (Mac or Windows). But you don't need it. If all you have is a **Chromebook, iPad, or phone** — anything with a web browser — you can still build, because your dev box serves its own **terminal in a browser tab**, and from there you switch to driving the box from the Claude app. This is the **Remote Control** path.
-
-You never install anything and you never touch SSH. It's two things: open a link, then sign in.
-
-> **On a Mac or Windows laptop?** You don't need this page — use the desktop app instead ([claude.com/download](https://claude.com/download)); it's the smoother path. This guide is only for browser-only devices.
-
-## What you'll do, at a glance
-
-1. Ask for your box and its terminal link (**`/builder-box`**).
-2. Open the link and sign in.
-3. Start Claude in the terminal and sign in once.
-4. Switch to **Remote Control** so you can work from the Claude app.
-
-That's it. Steps 1–3 are a one-time launchpad; after that you live in the Claude app.
-
-## Step 1 — Get your box and the terminal link
-
-In a Claude session, run **`/builder-box`**. It's your box's control panel — it will:
-
-- **wake or create your box** hands-off if it isn't already running (you never wait on an operator), and
-- give you your **terminal link** and a **one-time password** once the box is up.
-
-If the box was asleep, give it about a minute to come up, then run `/builder-box` again to read the link. (Under the hood `/builder-box` uses the box's own web terminal, published to the hall — you don't need any of that detail; just run the command.)
-
-## Step 2 — Open the link and sign in
-
-1. Open the **terminal link** in any browser tab.
-2. A small sign-in box appears. Enter:
-   - **Username:** `otb`
-   - **Password:** the one-time password `/builder-box` gave you.
-3. You're now looking at a terminal running on your box, already in your project folder.
-
-## Step 3 — Start Claude in the terminal
-
-In that terminal, type:
-
-```
-claude
-```
-
-and press Enter. The first time, it walks you through a normal browser sign-in (and may ask you to trust the folder once — say yes). When it finishes, you're in a real, interactive Claude Code session on your box. This first sign-in is the whole reason the browser terminal exists: a real person at a real browser can complete the login that a headless setup never could.
-
-## Step 4 — Switch to Remote Control (the daily surface)
-
-The terminal is a **launchpad, not where you'll live.** Once Claude is running in the terminal, run this **inside that session**:
-
-```
-/remote-control
-```
-
-It prints a **pairing link**. Open that link and you can now drive your box straight from the **Claude web or mobile app** — a much nicer surface than the terminal tab. From here on, that's where you work; the terminal was just where you logged in.
-
-> ⚠️ **Use the `/remote-control` slash command from inside a running Claude session — not a standalone `claude rc` command in the shell.** The standalone version mis-reads folder trust and fails; starting Remote Control from within an already-signed-in session is the path that works.
-
-## Good to know
-
-- **Closing the terminal tab ends the session and closes the box.** That's expected — it's how the session cleans up. Your work that's committed/shipped is safe; the box itself just shuts down.
-- **The box sleeps when idle and wakes on demand.** Next time, start again at Step 1 — `/builder-box` wakes it and hands you a fresh link.
-- **You also get a live game preview.** If your box is on the stable-hostname setup, your terminal link looks like `https://term-<you>.example.com`; your private game preview (the **sandbox**) is the same address with `term-` swapped for `sandbox-` — `https://sandbox-<you>.example.com`. Run **`/builder-stage`** to push your current edits there and review a change in a browser before you ship it. (See "Your own dev box" in the [primer](primer.md).)
-
-## If something isn't working
-
-- **No link yet?** The box may still be waking. Wait ~1 minute after `/builder-box` says it's starting, then run `/builder-box` again.
-- **Password rejected?** Re-run `/builder-box` to get a fresh link + password — the box republishes them when it restarts.
-- **Brand-new to the project on a browser-only device?** Getting the very first box onto a pure browser-only device can need a one-time assist (there's a known first-boot gap for a device with no terminal at all). If `/builder-box` can't hand you a link, ask an Archon to help seed your box once; after that the browser flow works on its own.
-
----
-
-*Deeper detail (the systemd units, the Cloudflare tunnel, operator setup, and end-to-end verification) lives in the operator recipe [`docs/recipes/managed-settings-remote-control.md`](../recipes/managed-settings-remote-control.md) (Part 2) and [ADR 0038](../adr/0038-chromebook-ttyd-cloudflare-tunnel.md) / [ADR 0040](../adr/0040-remote-control-default-browser-onramp.md). This page is the builder-facing summary of that flow.*