@bongos/core 1.19.1073 → 1.19.1075

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1073",
+  "version": "1.19.1075",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1073",
+      "version": "1.19.1075",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1073",
+  "version": "1.19.1075",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7743,5 +7743,89 @@
       "id": "1004313",
       "text": "Tweak Mode is live on cloudbongos.com, and the artist gate is off. Artists can now open the lofi studio, take a whole page, rewrite it (in the studio or in Word), and approve the finished page before it ships. The seven old pe"
     }
+  ],
+  "1.19.1074": [
+    {
+      "id": "1004361",
+      "text": "Fixed the test that had been blocking every new release of the platform since last evening. A test's sample module was missing the version number that modules now need, so the release step refused to run. With it fixed, the wa"
+    },
+    {
+      "id": "1003895",
+      "text": "The dev box's stored data is removed from the database: its four tables and the leftover dev-box login tokens. A fresh backup was taken first. Nothing else changes for builders."
+    },
+    {
+      "id": "1004351",
+      "text": "New projects now get a step that says we host their Builders Hall and asks where their app should run. Render is shown as coming soon; for now they can decide later."
+    },
+    {
+      "id": "1003894",
+      "text": "The leftover dev-box login tokens can no longer reach anything, and the three dev-box permissions are gone from every rank. Nobody's other permissions change. Sign-in and the rank and permission screens work as before."
+    },
+    {
+      "id": "1004358",
+      "text": "Tweak Mode's before-and-after screenshots can now be attached to a tweak. Every upload was being refused as too large, even though each picture was only about 100 KB, because a general size limit checked the upload before the"
+    },
+    {
+      "id": "1004359",
+      "text": "The Contact, Privacy and Terms pages had a scrap of behind-the-scenes note showing at the very top, above the menu. It came from a hidden note that accidentally closed itself too early. The note is reworded so it stays hidden,"
+    },
+    {
+      "id": "1004311",
+      "text": "The builders' hall no longer mentions dev boxes. Settings loses its Dev box section, the quick-jump menu loses its Dev box entry, and the architecture diagram now shows work running on your own machine. It also fixes a bug on"
+    },
+    {
+      "id": "1004241",
+      "text": "Area 5's task list is now honest: one stale task dropped, 14 rewritten to match the settled decisions, and the two waiting on the credit-economy area put back in backlog."
+    },
+    {
+      "id": "1004354",
+      "text": "A page you download as a Word file, edit in Google Docs and upload back now lands in your draft. Google Docs throws away the hidden details that said which page the file was, so the site used to refuse it as the wrong page. No"
+    },
+    {
+      "id": "1004349",
+      "text": "Decided: we host every project's Builders Hall, and owners choose where their app deploys, starting with Render. Also found and filed a sign-in cookie risk for halls on our addresses."
+    },
+    {
+      "id": "1004356",
+      "text": "The /feedback command works again: Claude Code can load your latest recorded walkthrough and its screenshots."
+    },
+    {
+      "id": "1004142",
+      "text": "A Bongos project now runs on Render, on its owner's own account: it starts, signs in, sets up its database and is backed up by Render, which clears the way to move projects off our server."
+    },
+    {
+      "id": "1003459",
+      "text": "You can now claim a task straight from its own page and from the \"Next up\" list on Home — both used to only tell you to claim it elsewhere. Every claim refusal (rank too low, someone else got there first, etc.) shows the same"
+    },
+    {
+      "id": "1004310",
+      "text": "New builders' setup checklist no longer asks them to connect a cloud dev box, and the sign-in path built for the retired dev box desktop app is gone. The builder guide now describes the one setup that exists: working from a co"
+    },
+    {
+      "id": "1003892",
+      "text": "Removed the dev box feature itself from the platform. Sites that still had it switched on in their settings keep starting normally — they now log a one-line note instead of failing to boot."
+    },
+    {
+      "id": "1004271",
+      "text": "Module authors can now publish a new version of their module to the Bongos module store with one command; the store checks it and keeps it ready for installs."
+    },
+    {
+      "id": "1003893",
+      "text": "Removed the machinery that created, parked and woke builders' cloud dev boxes, plus the scripts that ran on those boxes and the two background jobs that swept them. Nothing a builder uses today changes; the local preview and i"
+    },
+    {
+      "id": "1003812",
+      "text": "The module store now has somewhere to keep its list of modules, each published version, and what each one costs (free included)."
+    },
+    {
+      "id": "1003781",
+      "text": "Every module now has its own version number, shown in the module list and the hall's Modules tab — the first step toward publishing and updating modules through the store."
+    }
+  ],
+  "1.19.1075": [
+    {
+      "id": "1003897",
+      "text": "Cleanup: the code, tests and settings no longer describe the dev box as if it still existed, and seven code-quality limits are tightened to today's better numbers. Nothing changes for builders."
+    }
   ]
 }

package/scripts/gds/artifact-format.js

@@ -0,0 +1,203 @@
+// scripts/gds/artifact-format.js — the ONE packaging format Bongos ships code in:
+// a deterministic ustar+gzip tarball plus a compression-independent tree pin
+// (per-file sha256 + tree_sha256). Split out of package-core.js (task 1004271) so the
+// module store (ADR 0338 D1: "no second packaging format") builds and VERIFIES module
+// versions with the exact functions the core release uses — and so the always-on
+// server can read a tarball without loading package-core.js's release machinery.
+// Pure: no I/O beyond zlib/crypto, no git, no network.
+
+const zlib = require('node:zlib');
+const crypto = require('node:crypto');
+
+function sha256hex(buf) {
+  return crypto.createHash('sha256').update(buf).digest('hex');
+}
+
+// The PIN. A canonical, compression-independent digest of a packaged tree: one
+// "path\0mode\0filesha256\n" line per file, byte-sorted by path. A consumer
+// recomputes this from the unpacked tree to prove an install matches the pin.
+// `files` = [{ path, mode, sha256 }]. Modes are normalized so the pin is stable
+// regardless of the checkout's umask.
+function canonicalTreeHash(files) {
+  const lines = (files || [])
+    .map((f) => `${f.path}\u0000${normalizeMode(f.mode)}\u0000${f.sha256}`)
+    .sort();
+  return sha256hex(Buffer.from(lines.join('\n') + '\n', 'utf8'));
+}
+
+// Collapse ANY mode form — git's 100644/100755, our canonical 0000644/0000755, or a
+// raw filesystem octal string like "755" — to two canonical tar modes, keyed only on
+// the executable bit. IDEMPOTENT (normalizeMode(normalizeMode(x)) === normalizeMode(x))
+// AND exec-aware, so the tree pin reproduces byte-identically whether a consumer
+// recomputes it from the manifest's files[] (already-canonical modes) or from the
+// unpacked tree's stat() modes. Expects a STRING (git mode / canonical mode / octal).
+function normalizeMode(mode) {
+  const s = String(mode);
+  if (s === '100755' || s === '0000755' || s === '755') return '0000755';
+  const n = parseInt(s, 8);
+  if (Number.isFinite(n) && (n & 0o111)) return '0000755';
+  return '0000644';
+}
+
+// ---- a minimal, correct, DETERMINISTIC ustar+gzip writer (node-only, #686) ----
+// Deterministic (fixed mtime/uid/gid, normalized mode, sorted entries) so the same
+// source yields byte-identical bytes — a bonus over the tree_sha256 pin. Long paths
+// use the ustar name/prefix split, falling back to a GNU 'L' longname entry (read
+// by GNU tar, bsdtar/macOS, and node-tar) for the rare path that won't split.
+
+function octal(n, width) {
+  // width-1 octal digits, zero-padded, then a NUL — the classic numeric field.
+  return Buffer.from(n.toString(8).padStart(width - 1, '0').slice(-(width - 1)) + '\0', 'ascii');
+}
+
+function tarChecksum(block) {
+  let sum = 0;
+  for (let i = 0; i < 512; i++) sum += (i >= 148 && i < 156) ? 0x20 : block[i];
+  return sum;
+}
+
+// Build one 512-byte ustar header. `name`/`prefix` must already fit (<=100 / <=155).
+function ustarHeader({ name, prefix = '', mode, size, typeflag }) {
+  const h = Buffer.alloc(512, 0);
+  h.write(name, 0, 100, 'utf8');
+  octal(mode, 8).copy(h, 100);
+  octal(0, 8).copy(h, 108);   // uid
+  octal(0, 8).copy(h, 116);   // gid
+  octal(size, 12).copy(h, 124);
+  octal(0, 12).copy(h, 136);  // mtime = 0 (determinism)
+  h.write(typeflag, 156, 1, 'ascii');
+  h.write('ustar\0', 257, 6, 'ascii');
+  h.write('00', 263, 2, 'ascii');
+  if (prefix) h.write(prefix, 345, 155, 'utf8');
+  // checksum field: 6 octal digits + NUL + space, computed with the field = spaces.
+  const cksum = tarChecksum(h);
+  h.write(cksum.toString(8).padStart(6, '0').slice(-6) + '\0 ', 148, 8, 'ascii');
+  return h;
+}
+
+// Split a >100-byte path into { name<=100, prefix<=155 } at a '/' boundary, or
+// return null if no split fits (→ caller uses the GNU longname fallback).
+function splitUstarName(fullPath) {
+  const bytes = Buffer.byteLength(fullPath, 'utf8');
+  if (bytes <= 100) return { name: fullPath, prefix: '' };
+  // Find the LAST '/' such that the tail (after it) is <=100 and the head <=155.
+  for (let i = fullPath.length - 1; i > 0; i--) {
+    if (fullPath[i] !== '/') continue;
+    const prefix = fullPath.slice(0, i);
+    const name = fullPath.slice(i + 1);
+    if (Buffer.byteLength(name, 'utf8') <= 100 && Buffer.byteLength(prefix, 'utf8') <= 155) {
+      return { name, prefix };
+    }
+  }
+  return null;
+}
+
+function padTo512(buf) {
+  const rem = buf.length % 512;
+  return rem === 0 ? buf : Buffer.concat([buf, Buffer.alloc(512 - rem, 0)]);
+}
+
+// GNU longname pseudo-entry: a header (typeflag 'L', name '././@LongLink') whose
+// BODY is the full path (incl. trailing NUL), immediately followed by the real
+// file entry. Read by GNU tar, bsdtar/macOS, and node-tar.
+function gnuLongName(fullPath) {
+  const payload = Buffer.from(fullPath + '\0', 'utf8');
+  const hdr = ustarHeader({ name: '././@LongLink', mode: 0o644, size: payload.length, typeflag: 'L' });
+  return Buffer.concat([hdr, padTo512(payload)]);
+}
+
+// entries: [{ name, mode, buf }] — `name` includes the TAR_ROOT prefix. Returns a
+// gzip'd tar Buffer. Pure + deterministic given sorted entries.
+function buildTar(entries) {
+  const sorted = [...entries].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+  const chunks = [];
+  for (const e of sorted) {
+    const mode = e.mode & 0o7777;
+    const split = splitUstarName(e.name);
+    if (split) {
+      chunks.push(ustarHeader({ name: split.name, prefix: split.prefix, mode, size: e.buf.length, typeflag: '0' }));
+    } else {
+      chunks.push(gnuLongName(e.name));
+      chunks.push(ustarHeader({ name: e.name.slice(0, 100), mode, size: e.buf.length, typeflag: '0' }));
+    }
+    chunks.push(padTo512(e.buf));
+  }
+  // two zero blocks terminate the archive
+  chunks.push(Buffer.alloc(1024, 0));
+  const tar = Buffer.concat(chunks);
+  return zlib.gzipSync(tar, { level: 9 });
+}
+
+
+
+// ---- the matching READER (task 1004271) -------------------------------------
+// Reads back exactly what buildTar writes — plain ustar file entries (name/prefix
+// split) and GNU 'L' longname entries — into [{ name, mode, buf }]. It is the store's
+// side of the format, so it is strict rather than permissive: any other entry type
+// (a directory, a symlink, a pax header), a size or count over the caps, a truncated
+// archive or a bad header checksum is a THROWN error, never a skipped entry. A server
+// that verifies uploads must not quietly accept a shape it did not check.
+//
+// Two entry points over one parser: readTar (sync — the CLI and tests) and
+// readTarAsync, which inflates on libuv's thread pool so a server verifying an upload
+// does not hold the event loop for the decompression. The parse itself is a single
+// linear pass over the inflated bytes.
+const DEFAULT_READ_LIMITS = { maxUnpackedBytes: 64 * 1024 * 1024, maxFiles: 5000 };
+const gunzipAsync = require('node:util').promisify(zlib.gunzip);
+
+const unreadable = (maxUnpackedBytes, e) =>
+  new Error(`not a readable gzip tarball within ${maxUnpackedBytes} bytes (${e.code || e.message})`);
+
+function readTar(tgz, { maxUnpackedBytes = DEFAULT_READ_LIMITS.maxUnpackedBytes, maxFiles = DEFAULT_READ_LIMITS.maxFiles } = {}) {
+  let tar;
+  try { tar = zlib.gunzipSync(tgz, { maxOutputLength: maxUnpackedBytes }); }
+  catch (e) { throw unreadable(maxUnpackedBytes, e); }
+  return parseTar(tar, { maxFiles });
+}
+
+async function readTarAsync(tgz, { maxUnpackedBytes = DEFAULT_READ_LIMITS.maxUnpackedBytes, maxFiles = DEFAULT_READ_LIMITS.maxFiles } = {}) {
+  let tar;
+  try { tar = await gunzipAsync(tgz, { maxOutputLength: maxUnpackedBytes }); }
+  catch (e) { throw unreadable(maxUnpackedBytes, e); }
+  return parseTar(tar, { maxFiles });
+}
+
+function parseTar(tar, { maxFiles }) {
+  const cstr = (b, from, len) => {
+    const s = b.subarray(from, from + len);
+    const z = s.indexOf(0);
+    return (z < 0 ? s : s.subarray(0, z)).toString('utf8');
+  };
+  const out = [];
+  let off = 0;
+  let longName = null;
+  while (true) {
+    if (off + 512 > tar.length) throw new Error('tarball is truncated (no end-of-archive marker)');
+    const h = tar.subarray(off, off + 512);
+    if (h.every((x) => x === 0)) break;
+    const stored = parseInt(cstr(h, 148, 8).trim(), 8);
+    if (stored !== tarChecksum(h)) throw new Error(`tar header checksum mismatch at byte ${off}`);
+    const size = parseInt(cstr(h, 124, 12).trim() || '0', 8);
+    if (!Number.isFinite(size) || size < 0) throw new Error(`bad entry size at byte ${off}`);
+    const type = String.fromCharCode(h[156] || 48);
+    const bodyStart = off + 512;
+    const bodyEnd = bodyStart + size;
+    if (bodyEnd > tar.length) throw new Error('tarball is truncated mid-entry');
+    const body = tar.subarray(bodyStart, bodyEnd);
+    off = bodyStart + size + ((512 - (size % 512)) % 512);
+    if (type === 'L') { longName = cstr(body, 0, body.length); continue; }
+    if (type !== '0' && type !== '\u0000') throw new Error(`unsupported tar entry type "${type}" — only regular files are allowed`);
+    const prefix = cstr(h, 345, 155);
+    const name = longName || (prefix ? `${prefix}/${cstr(h, 0, 100)}` : cstr(h, 0, 100));
+    longName = null;
+    out.push({ name, mode: parseInt(cstr(h, 100, 8).trim() || '0', 8), buf: Buffer.from(body) });
+    if (out.length > maxFiles) throw new Error(`tarball has more than ${maxFiles} files`);
+  }
+  return out;
+}
+
+module.exports = {
+  sha256hex, canonicalTreeHash, normalizeMode,
+  octal, tarChecksum, ustarHeader, splitUstarName, padTo512, gnuLongName, buildTar,
+  readTar, readTarAsync,
+};

package/scripts/gds/artifact-staleness.js

@@ -32,8 +32,8 @@
 //
 // ── WHERE THIS MAY RUN — read before scheduling it anywhere new ───────────────
 //
-// ONLY where the artifacts are SUPPOSED to already exist: a deployed instance, or a
-// dev box after its source-fetch regen. NEVER in CI. A fresh `git clone` legitimately
+// ONLY where the artifacts are SUPPOSED to already exist: a deployed instance after its
+// source-fetch regen. NEVER in CI. A fresh `git clone` legitimately
 // has no `docs/repo-map.md` — it is gitignored, so it is not in the repository at all
 // — and this check would report it absent on every single run. A monitor that is red
 // every run teaches its reader to ignore it, which is the exact failure ADR 0110's

package/scripts/gds/audit-authorship.sh

@@ -151,13 +151,6 @@ ALLOWLIST=(
   # hardcoded in code.
   'CODEOWNERS'
 
-  # Dev Box app distribution (#904, ADR 0044): the PUBLIC releases repo lives
-  # under the same GitHub account that owns the main repo — repo-hosting
-  # identity (same nature as provision-staging.sh above), not a builder
-  # identity. The test pins the committed config's repo string.
-  'config/devbox-app.json'
-  'tests/devbox_downloads.mjs'
-
   # This audit script's own self-reference (it documents what it's looking for).
   'scripts/gds/audit-authorship.sh'
 
@@ -173,21 +166,18 @@ ALLOWLIST=(
 
   # Test DATA that pins a real contract (task 1002640) — identity in an
   # assertion IS the contract, not a mis-attribution: owner approval RECORDS
-  # the Archon's login (gate_approvals), the terminal-URL SSRF guard validates
-  # term-<login> hostnames (box_terminal_ssrf), packaging/provisioning tests
+  # the Archon's login (gate_approvals), packaging/provisioning tests
   # exercise the real repo owner + the mirror-redaction floor. Listed per file
   # (never a blanket tests/ exclusion) so a NEW test file is still scanned.
   'tests/provision.mjs'
   'tests/package_core.mjs'
   'tests/init.mjs'
-  'tests/box_terminal_ssrf.mjs'
   'tests/gate_approvals.mjs'
   'tests/publish_reconciler.mjs'
   'tests/dev_lib.mjs'
   'tests/ship_card.mjs'
   'tests/scrubber_corpus.mjs'
   'tests/module_submissions.mjs'
-  'tests/boxes.mjs'
   'tests/provisioning_onboard_mode.mjs'
   'tests/instance_manifest.mjs'
   'tests/bongos_downloads.mjs'
@@ -199,10 +189,8 @@ ALLOWLIST=(
   'tests/currency_label.mjs'
   'tests/cloud_bongos_pack.mjs'
   'tests/bump_version.mjs'
-  'tests/box_scope_session.mjs'
   'tests/auth_inactive_builder.mjs'
   'tests/auth_anthropic_identity.mjs'
-  'modules/dev-box/app/test/unit.mjs'
 
   # The mirror-redaction floor: PRIOR_INSTANCE_FLOOR carries the prior
   # instance's owner literal precisely so packaging can SCRUB it from every

package/scripts/gds/backfill-task-rewards.js

@@ -4,12 +4,12 @@
 // scripts/gds/backfill-task-rewards.js — retroactive drachmae backfill for
 // shipped tasks that paid 0 reward (task 1672, ADR 0097).
 //
-// THE GAP. A task's `credits_reward` defaults to 0; many early/dev-box/CI ships
+// THE GAP. A task's `credits_reward` defaults to 0; many early and CI ships
 // never had an author-estimated reward set, so the kind-multiplied task-confirm
 // credit (modules/economy/credits.js insertMultipliedConfirmCredit) computed
 // `0 × multiplier = 0` and minted nothing. The cost-plus *session* reward
 // (reason='session.token_reward', ADR 0054) was supposed to backstop those, but
-// it pays ~0 for dev-box/CI agent ships (no priced model usage uploaded), so
+// it pays ~0 for CI agent ships (no priced model usage uploaded), so
 // those builders earned nothing for real shipped work. This script lets an
 // Archon retroactively pay a *fair, reviewed* per-task amount — once, safely.
 //
@@ -133,7 +133,7 @@ function planForBuilder(builderId, taskRewards, costPlusAlreadyPaid, alreadyBack
 // =========================================================================
 
 function loadPool() {
-  // Lazy + guarded: a builder box has no DATABASE_URL / no peer-auth Postgres,
+  // Lazy + guarded: a builder machine has no DATABASE_URL / no peer-auth Postgres,
   // so --help and --dry-run must not crash here. We only reach for the pool when
   // we actually need to read/write the DB, and we report a clean message if the
   // connection is unavailable rather than throwing a raw stack.
@@ -230,7 +230,7 @@ async function buildPlan(pool, mapping, defaultRaw) {
   //    session-level (task_id NULL), so we net at the BUILDER level — the audit
   //    question is "did the cost-plus stream already compensate this builder for
   //    the work these tasks represent". The dry-run surfaces this number so the
-  //    Archon can see whether it actually fired (it pays ~0 for dev-box/CI ships).
+  //    Archon can see whether it actually fired (it pays ~0 for CI ships).
   const { rows: costPlusRows } = await pool.query(
     `SELECT builder_id, COALESCE(SUM(delta), 0)::int AS paid
        FROM credit_log
@@ -334,7 +334,7 @@ async function main() {
   try {
     pool = loadPool();
   } catch (err) {
-    console.error('No DB connection available (expected on a builder box with no prod credentials).');
+    console.error('No DB connection available (expected on a builder machine with no prod credentials).');
     console.error('This script is inert here — run --help for usage. Detail:', err.message);
     process.exit(2);
   }

package/scripts/gds/claim.js

@@ -7,21 +7,6 @@
 // On success: prints the claim id, the task title, and the touches[] so the
 // builder knows the parallel-safety boundary they're working within.
 
-// TREE PREFLIGHT (task 1003098). A task-scoped dev box carries scripts/ and
-// src/bongos/ but not every modules/ directory, so the requires below can fail —
-// and Node's loader names only the FIRST missing one, which turned recovery into
-// guess-read-fix-repeat. This enumerates every missing requirement in one message
-// and exits before the first such require runs. It must stay ABOVE them.
-//
-// A PRE-REQUEST hard exit, like the usage banner and worktree guard: nothing has
-// been sent yet, so there is no in-flight request for cliExit to drain.
-const { action: _surfaceAction } = require('./surface.js');
-const { checkTree: _checkTree } = require('./tree-preflight.js');
-{
-  const _fault = _checkTree(__filename, { command: _surfaceAction("claim") });
-  if (_fault) { console.error(_fault); process.exit(1); }
-}
-
 const { execSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');

package/scripts/gds/claude-materialize.js

@@ -352,7 +352,7 @@ const STARTER_COMMANDS = [
   // `git diff|log|show` rule, also on purpose: the harness already runs their
   // read-only forms unprompted, and a prefix rule would switch off its flag check
   // (`--output=<file>` writes anywhere, `diff --no-index` reads any file).
-  // tests/box_ship_permissions.mjs pins this list to the core's, rule for rule.
+  // tests/cli_allowlist_permissions.mjs pins this list to the core's, rule for rule.
   'bongos start:*',
   'bongos status:*',
   'bongos recall:*',
@@ -381,7 +381,7 @@ const STARTER_COMMANDS = [
 ];
 // One rule per command PER SHELL TOOL (task 1004014): the shell tool is `PowerShell` on a Windows
 // laptop, and a `Bash(...)` rule says nothing about its commands. The tools are the ones the guards
-// see (`.claude/hooks/shell-tools.js`) — held equal by tests/box_ship_permissions.mjs, not a require.
+// see (`.claude/hooks/shell-tools.js`) — held equal by tests/cli_allowlist_permissions.mjs, not a require.
 const STARTER_SHELL_TOOLS = ['Bash', 'PowerShell'];
 const STARTER_ALLOW = STARTER_SHELL_TOOLS.flatMap((tool) => STARTER_COMMANDS.map((command) => `${tool}(${command})`));
 

package/scripts/gds/cli-lib.js

@@ -24,12 +24,12 @@ const ic = require('../../src/instance-config');
 // namespaced instance, still resolves (R61 / task 1200). os.homedir() keeps it
 // per-user on any machine.
 //
-// WHY THE OLD NAMES STAY READABLE. This file is on disk on every builder machine
-// and every live dev box. Renaming it with no fallback signs all of them out at
-// once and every /builder-* command dies with 'no Bongos session'. So a read that
-// resolves through a superseded name MIGRATES forward (see loadSession), and the
-// old file is deliberately LEFT IN PLACE — a builder may roll back to an older
-// CLI, which can only see the old name. Part 4 (task 1003706) deletes it behind a
+// WHY THE OLD NAMES STAY READABLE. This file is on disk on every builder machine.
+// Renaming it with no fallback signs all of them out at once and every /builder-*
+// command dies with 'no Bongos session'. So a read that resolves through a
+// superseded name MIGRATES forward (see loadSession), and the old file is
+// deliberately LEFT IN PLACE — a builder may roll back to an older CLI, which
+// can only see the old name. Part 4 (task 1003706) deletes it behind a
 // test of its absence. (task 1003704)
 //
 // Order is FILENAME-major, not directory-major: the newest name found in ANY read
@@ -139,8 +139,8 @@ function hallBase(base = API_BASE) {
 // still be mid-close when the caller's process.exit() runs, tripping a
 // UV_HANDLE_CLOSING assertion that corrupts piped JSON stdout. Connection reuse
 // buys these one-shot processes nothing, so route requests through a dispatcher
-// with keep-alive effectively disabled (mirrors cf-tunnel.js's dispatcher
-// pattern). Degrades to the default dispatcher if undici can't be required.
+// with keep-alive effectively disabled. Degrades to the default dispatcher if
+// undici can't be required.
 //
 // task 1002734 — THIS ALONE IS NOT ENOUGH, and the measurements say so: with the
 // dispatcher wired in and undici resolving fine, `node scripts/gds/api.js GET
@@ -330,7 +330,7 @@ async function writeSessionToStore(session) {
 //      upgrading would still lose it.
 //   2. store the incoming one under its own host.
 //   3. write the ACTIVE pointer exactly where it has always gone, so every existing reader —
-//      in-repo skills, hooks, the dev box — behaves identically.
+//      in-repo skills and hooks — behaves identically.
 async function saveSession(session) {
   const dir = path.dirname(SESSION_PATH);
   await fsp.mkdir(dir, { recursive: true });
@@ -1069,12 +1069,11 @@ function detectWorktreeName() {
 // summary — that emitCard consumes directly.
 //
 // WHY THIS READS THE PAYLOAD AND NEVER require()s render-prefs.js. The ladder
-// lives in modules/builder-settings/render-prefs.js, and requiring it from here
-// would work on a full checkout and BREAK on a task-scoped dev box, which
-// carries scripts/ and src/bongos/ but not every modules/ directory (task
-// 1003098 — tree-preflight exists precisely to fail an entry point that reaches
-// for module code, and start.js is one). So the server resolves the rung and
-// ships the answers on `render.flags`; this function only picks them up.
+// lives in modules/builder-settings/render-prefs.js, and a CLI reaches a
+// module's logic through the server, never by require — the module may be
+// disabled on the instance, and a require would couple every CLI to one
+// module's internals. So the server resolves the rung and ships the answers on
+// `render.flags`; this function only picks them up.
 //
 // TWO SERVER SHAPES, deliberately. `render.flags` is the ladder (task 1002518);
 // `render.widgets_enabled` is the boolean that predates it. A CLI newer than the
@@ -1174,6 +1173,7 @@ module.exports = {
   repairMsysMangledPath,
   resolveQuiet,
   readSessionToken,
+  CLI_USER_AGENT,
   apiCall,
   cliExit,
   isDispatcherIncompatError,

package/scripts/gds/codemod-rename-src-gds.js

@@ -12,7 +12,7 @@
 //      never clobbered:
 //         src/gds/...     -> src/bongos/...     (directory refs)
 //         "src/gds"       -> "src/bongos"       (bare, at a boundary)
-//         src/gds-client  -> src/gds-client     (UNCHANGED: devbox-app/src/gds-client.js)
+//         src/gds-client  -> src/gds-client     (UNCHANGED: a look-alike file name)
 //         src/gdsx        -> src/gdsx           (UNCHANGED here: prefix-edge fixture)
 //
 //   Regex: /src\/gds(?![A-Za-z0-9_-])/g  -- trailing guard only. No LEADING guard:

package/scripts/gds/context-pack.js

@@ -31,13 +31,11 @@ const path = require('node:path');
 // so importing it from a CLI is safe — same precedent as next-number.js reading
 // the repo tree directly. This is the "not hand-maintained" guarantee.
 //
-// OPTIONAL, because the file may not be ON DISK (task 1003085). A task-scoped box
-// (ADR 0148) materializes modules/<key> only for the modules the CLAIM puts in
-// scope, so on a box with NO active claim modules/lifecycle is absent and this
-// require threw MODULE_NOT_FOUND at import time. That killed /builder-start AND
-// /builder-claim — the exact two commands needed to escape the state, since the
-// claim is what would fetch the module. A deadlock, escapable only by calling
-// POST /claims with curl. The header's FAIL-OPEN promise ("must NEVER throw or
+// OPTIONAL, because the file may not be ON DISK (task 1003085). A sparse checkout
+// can lack modules/lifecycle, and when it did this require threw
+// MODULE_NOT_FOUND at import time. That killed /builder-start AND /builder-claim
+// — the two commands a builder needs to recover — leaving a deadlock escapable
+// only by calling POST /claims with curl. The header's FAIL-OPEN promise ("must NEVER throw or
 // block a claim") was already the right rule; this require was the line that did
 // not keep it.
 //

package/scripts/gds/diagram-facts.js

@@ -174,18 +174,12 @@ const CONCEPTUAL_TASK_IDS = {
   246: 'R26 — karma surfaced on profile + sortable on leaderboard',
 };
 
-// 04-architecture (the DEV BOX + box→prod flow) — where a builder's work runs
-// and how code reaches prod. Same "LIVE iff its backing GDS task is 'shipped'"
-// contract as the memory chain above; these were merged into the single
-// 04-architecture diagram (was the standalone 06-dev-box). Live ids verified
-// 2026-06-14 — the whole chain is now shipped, including 1027 + 1028. Each entry
-// documents the piece it drives in scripts/gds/gen-diagrams.js `architectureMmd`:
-//   904  — the OTB Dev Box desktop app (menu-bar/tray on-off switch)
-//   774  — the browser-only box terminal (ttyd over an outbound tunnel)
-//   897  — the per-builder sandbox live game preview on the box
-//   919  — the scoped dev-box session (box token deny-by-default)
-//   1025 — server-mediated branch publish (box uploads bundle, server pushes)
-//   1027 — hardware-verify of the box→prod flow end-to-end (now SHIPPED)
+// 04-architecture (the ship flow) — how code on a builder's machine reaches
+// prod. Same "LIVE iff its backing GDS task is 'shipped'" contract as the memory
+// chain above. Each entry documents the piece it drives in
+// scripts/gds/gen-diagrams.js `architectureMmd`:
+//   1025 — server-mediated branch publish (a checkout with no GitHub push
+//          credential uploads a bundle, the server pushes it)
 //   1028 — replaced the standing push PAT with a GitHub App (now SHIPPED)
 //
 // Every id here MUST drive a piece of the diagram. An id no consumer reads is
@@ -194,15 +188,10 @@ const CONCEPTUAL_TASK_IDS = {
 // stop 03 + 04 from regenerating at all (the failure shape task 1002667 fixed
 // for the offset case). Do NOT re-add 859 (CI self-deploy): the deploy leg is
 // the standalone AUTO-PULL of ADR 0108/0129, not a task-gated Actions job, so
-// gen-diagrams.js deliberately excludes it — see its comment at `box → prod`.
+// gen-diagrams.js deliberately excludes it — see its comment at `ship flow`.
 // Removed in task 1002674.
-const DEV_BOX_TASK_IDS = {
-  904: 'devbox-app — desktop on-off switch',
-  774: 'browser-only box terminal (ttyd over tunnel)',
-  897: 'per-builder sandbox live preview',
-  919: 'scoped dev-box session (box token deny-by-default)',
-  1025: 'server-mediated branch publish (box uploads bundle, server pushes)',
-  1027: 'hardware-verify the box-to-prod flow end-to-end',
+const SHIP_FLOW_TASK_IDS = {
+  1025: 'server-mediated branch publish (a checkout with no push credential uploads a bundle, the server pushes)',
   1028: 'GitHub App hardening (replace the standing push PAT)',
 };
 
@@ -290,10 +279,10 @@ async function conceptualFacts({ repo, migs, api }) {
     // process via cli-lib's guidance path (see the loop's degrade-to-null below).
     api = await cliClient({ allowUnauthenticated: true });
   }
-  // 03's pieces + 04-architecture's memory chain + its dev-box/ship-flow pieces
+  // 03's pieces + 04-architecture's memory chain + its ship-flow pieces
   // share one fetch + one taskStatus map; any unreachable id degrades the WHOLE
   // conceptual bundle (so 03 + 04 skip together rather than emit partial data).
-  const ALL_TASK_IDS = { ...CONCEPTUAL_TASK_IDS, ...DEV_BOX_TASK_IDS };
+  const ALL_TASK_IDS = { ...CONCEPTUAL_TASK_IDS, ...SHIP_FLOW_TASK_IDS };
   const ids = Object.keys(ALL_TASK_IDS).map(Number);
   const status = {};
   let lockedOffset = null;
@@ -360,7 +349,7 @@ module.exports = {
   repoSlug,
   conceptualFacts,
   CONCEPTUAL_TASK_IDS,
-  DEV_BOX_TASK_IDS,
+  SHIP_FLOW_TASK_IDS,
   IMPORT_ID_OFFSETS,
   gatherFacts,
 };