@bongos/core 1.19.1074 → 1.19.1076

package/tests/push_path_brief.mjs

@@ -1,11 +1,12 @@
 // tests/push_path_brief.mjs
 //
-// Task 1003259 / idea 1000838 — a dev-box agent, unable to see WHY its git probes were
-// failing, asked the owner to mint a PAT and store it on the box. push-path-brief.js is
-// the SessionStart line that states the credential model natively so that request never
-// gets made again. These tests pin BOTH halves: the line fires on the server-publish
-// path with the load-bearing phrases intact, and it is SILENT everywhere else — the
-// silence is half the design (a line firing on every healthy laptop becomes wallpaper).
+// Task 1003259 / idea 1000838 — an agent on a checkout with no GitHub push credential, unable
+// to see WHY its git probes were failing, asked the owner to mint a PAT and store it on the
+// machine. push-path-brief.js is the SessionStart line that states the credential model
+// natively so that request never gets made again. These tests pin BOTH halves: the line
+// fires on the server-publish path with the load-bearing phrases intact, and it is SILENT
+// everywhere else — the silence is half the design (a line firing on every healthy laptop
+// becomes wallpaper).
 //
 // DB-free + network-free: briefLine is pure, and the CLI cases force the path with
 // OTB_PUSH_VIA_SERVER so pushVia() never spawns gh. Run:  node tests/push_path_brief.mjs
@@ -31,14 +32,14 @@ t('server path gets the brief, with every load-bearing phrase', () => {
   const l = brief.briefLine('server');
   assert.ok(typeof l === 'string' && l.length > 0, 'expected a line on the server path');
   // Each phrase is one of the three facts the 2026-08-24 incident showed an agent
-  // cannot infer from inside a box. Losing any of them re-opens the gap.
+  // cannot infer from inside such a checkout. Losing any of them re-opens the gap.
   for (const must of [
     'NO GitHub push credential',
     'BY DESIGN',
     '/builder-ship',
     'NEVER ask the owner for a PAT',
     'publish-status',
-    // task 1003988: a box that cannot see which test failed re-pushes blind.
+    // task 1003988: a session that cannot see which test failed re-pushes blind.
     'merge_driver.failing_tests',
     'checks_unreadable',
   ]) {
@@ -58,7 +59,7 @@ t('undetermined path stays silent (fail-open, exact vocabulary only)', () => {
 });
 
 t('the line is the exported static constant — nothing is interpolated', () => {
-  // Trust boundary: this string is injected into every box session's context. Pinning
+  // Trust boundary: this string is injected into every server-publish session's context. Pinning
   // it to the constant proves no builder-authored text can ever ride along.
   assert.equal(brief.briefLine('server'), brief.BRIEF);
 });

package/tests/regrade_eligibility.mjs

@@ -202,7 +202,7 @@ test('buildGradePayload confidence defaults to null when signals omit it', () =>
 //
 // The 'confirmed' answer hardcoded "run /merge-mode", which lands by pushing main
 // via push-main.js (SEC #863 / ADR 0043) and needs an authenticated gh plus a main
-// checkout. A server-mediated builder (pushVia()==='server' — every dev box) has
+// checkout. A server-mediated builder (pushVia()==='server' — a checkout with no GitHub push credential) has
 // neither, so the advice was unreachable by construction. It cost a real builder
 // 163 minutes on 2026-08-21. strandNextStep already had the right wording for both
 // modes; these pin that the two modes now diverge and that neither regresses.

package/tests/rename_history_restraint.mjs

@@ -123,7 +123,7 @@ test('the alias mount passes while present and FAILS when dropped', () => {
   assert.equal(check.checkAliasMounts({ mounts: ['/api/bongos/v1', '/api/bongos', '/api/gds'], required }).ok, true);
 
   const r = check.checkAliasMounts({ mounts: ['/api/bongos/v1', '/api/bongos'], required });
-  assert.equal(r.ok, false, 'shipped Dev Box binaries call the alias and cannot be force-updated');
+  assert.equal(r.ok, false, 'shipped binaries and live instances call the alias and cannot be force-updated');
   assert.deepEqual(r.missing, ['/api/gds']);
 });
 

package/tests/repo_map.mjs

@@ -94,14 +94,14 @@ test('extractor parses functions, classes, arrow consts, and module.exports', ()
   assert.ok(apiCall && apiCall.exported && apiCall.kind === 'fn', 'exported arrow/fn const detected with export flag');
 });
 
-test('--whole-only never writes a TRACKED nested block (the sparse-box deadlock guard, task 1002962)', () => {
-  // A dev box is a SPARSE checkout — box-access.js materializes only the claim's
-  // module cone. The block ordering is `b.refs - a.refs || name` and `refs` counts
-  // references across the VISIBLE corpus, so a box with 7 of 20 modules emits a
-  // legitimately different block. box-source-fetch.sh used to write it, dirtying
-  // tracked files, and the NEXT `git pull` aborted on "local changes would be
-  // overwritten" — a silent permanent sync deadlock (one box sat 257 commits behind
-  // for three days). A box CONSUMES these blocks; only a full checkout may write them.
+test('--whole-only never writes a TRACKED nested block (the sparse-checkout deadlock guard, task 1002962)', () => {
+  // A SPARSE checkout holds only part of the module tree. The block ordering is
+  // `b.refs - a.refs || name` and `refs` counts references across the VISIBLE
+  // corpus, so a checkout with 7 of 20 modules emits a legitimately different block.
+  // A fetch script used to write it, dirtying tracked files, and the NEXT `git pull`
+  // aborted on "local changes would be overwritten" — a silent permanent sync
+  // deadlock (one checkout sat 257 commits behind for three days). A sparse checkout
+  // CONSUMES these blocks; only a full checkout may write them.
   //
   // Asserted on CONTENT, not on the log line: dirty a tracked block, run --whole-only,
   // and require the block to come back byte-identical. A regression that re-enabled the
@@ -116,7 +116,7 @@ test('--whole-only never writes a TRACKED nested block (the sparse-box deadlock
     assert.equal(
       readFileSync(tracked, 'utf8'),
       drifted,
-      '--whole-only rewrote a tracked nested block — this is the deadlock that stranded a box 257 commits behind',
+      '--whole-only rewrote a tracked nested block — this is the deadlock that stranded a checkout 257 commits behind',
     );
     assert.ok(!r.stdout.includes('CLAUDE.md'), `--whole-only must not report a nested-doc write; got: ${r.stdout.trim()}`);
   } finally {

package/tests/seam_wiring_guard.mjs

@@ -46,12 +46,12 @@ const nothingExists = () => false;
 // ---------------------------------------------------------------------------
 
 test('reports a declared poller whose file was never shipped, naming module + seam', () => {
-  const r = scanSeamWiring([mod('dev-box', { pollers: ['ghost'] })], { exists: nothingExists });
+  const r = scanSeamWiring([mod('discord', { pollers: ['ghost'] })], { exists: nothingExists });
   assert.equal(r.ok, false);
   assert.equal(r.findings.length, 1);
-  assert.match(r.findings[0], /module "dev-box"/);
+  assert.match(r.findings[0], /module "discord"/);
   assert.match(r.findings[0], /contributes\.pollers: "ghost"/);
-  assert.match(r.findings[0], /modules\/dev-box\/pollers\/ghost\.js does not exist/);
+  assert.match(r.findings[0], /modules\/discord\/pollers\/ghost\.js does not exist/);
   // and it says what to do about it — the three legitimate resolutions
   assert.match(r.findings[0], /Ship the artifact, drop the declaration, or record it in declarativeSeams\.pollers/);
 });
@@ -100,39 +100,39 @@ test('a disciplines entry absent from the registry is reported', () => {
 
 test('a declarative-only entry is recorded, not reported — the load-bearing nuance', () => {
   const r = scanSeamWiring(
-    [mod('dev-box', { pollers: ['box-lifecycle'] }, { pollers: ['box-lifecycle'] })],
+    [mod('discord', { pollers: ['discord-bot'] }, { pollers: ['discord-bot'] })],
     { exists: nothingExists },
   );
   assert.equal(r.ok, true, r.findings.join('; '));
-  assert.deepEqual(r.declarative, [{ key: 'dev-box', seam: 'pollers', entry: 'box-lifecycle' }]);
+  assert.deepEqual(r.declarative, [{ key: 'discord', seam: 'pollers', entry: 'discord-bot' }]);
   assert.deepEqual(r.wired, []);
 });
 
 test('the exemption is per-ENTRY, not a blanket skip of the seam', () => {
   const r = scanSeamWiring(
-    [mod('dev-box', { pollers: ['box-lifecycle', 'ghost'] }, { pollers: ['box-lifecycle'] })],
+    [mod('discord', { pollers: ['discord-bot', 'ghost'] }, { pollers: ['discord-bot'] })],
     { exists: nothingExists },
   );
   assert.equal(r.ok, false);
   assert.equal(r.findings.length, 1);
   assert.match(r.findings[0], /"ghost"/);
-  assert.deepEqual(r.declarative.map((d) => d.entry), ['box-lifecycle']);
+  assert.deepEqual(r.declarative.map((d) => d.entry), ['discord-bot']);
 });
 
 test('a STALE exemption — the artifact exists now — is itself reported', () => {
   const r = scanSeamWiring(
-    [mod('dev-box', { pollers: ['box-lifecycle'] }, { pollers: ['box-lifecycle'] })],
-    { exists: only('modules/dev-box/pollers/box-lifecycle.js') },
+    [mod('discord', { pollers: ['discord-bot'] }, { pollers: ['discord-bot'] })],
+    { exists: only('modules/discord/pollers/discord-bot.js') },
   );
   assert.equal(r.ok, false);
-  assert.match(r.findings[0], /exempts pollers "box-lifecycle" as declarative-only, but modules\/dev-box\/pollers\/box-lifecycle\.js exists/);
+  assert.match(r.findings[0], /exempts pollers "discord-bot" as declarative-only, but modules\/discord\/pollers\/discord-bot\.js exists/);
   assert.match(r.findings[0], /drop the stale declarativeSeams\.pollers entry/);
   assert.deepEqual(r.declarative, [], 'a stale exemption must not also count as declarative-only');
 });
 
 test('an exemption on one seam does not leak to another seam of the same module', () => {
   const r = scanSeamWiring(
-    [mod('dev-box', { pollers: ['x'], uiSections: ['x'] }, { pollers: ['x'] })],
+    [mod('discord', { pollers: ['x'], uiSections: ['x'] }, { pollers: ['x'] })],
     { exists: nothingExists },
   );
   assert.equal(r.findings.length, 1);

package/tests/search_isolation.mjs

@@ -21,8 +21,8 @@
 //      DB in a rolled-back transaction at ship time (the authoritative evidence).
 //
 // Run:  node tests/search_isolation.mjs
-//   (Layer C runs only where a Postgres is reachable — the integration gate / a
-//    dev box; it skips cleanly otherwise so the DB-free unit gate stays green.)
+//   (Layer C runs only where a Postgres is reachable — the integration gate / any
+//    machine with one; it skips cleanly otherwise so the DB-free unit gate stays green.)
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -159,7 +159,7 @@ async function dbReachable() {
 
 const client = await dbReachable();
 if (!client) {
-  console.log('  SKIP  no reachable Postgres — Layer C runs in the integration gate / on a dev box.');
+  console.log('  SKIP  no reachable Postgres — Layer C runs in the integration gate / wherever a Postgres is reachable.');
   console.log('        (The same scoping cases were proven on the prod DB in a rolled-back transaction at ship time.)');
   // END THE POOL ON THE SKIP PATH TOO (task 1003848). Only the else-branch below
   // ended it, so when Postgres was unreachable the Pool survived with libuv handles

package/tests/session_records.mjs

@@ -397,7 +397,7 @@ test('buildSessionDigest accumulates per-model usage (model_usage), skipping syn
 });
 
 test('buildSessionDigest (task 1676): folds unlabeled token-bearing turns into a priceable model bucket', () => {
-  // The dev-box/CI symptom: a token-bearing turn with no model id (or '<synthetic>')
+  // The CI symptom: a token-bearing turn with no model id (or '<synthetic>')
   // contributes to total_tokens but was DROPPED from model_usage — so the digest
   // stored total_tokens>0 yet priced to $0 (ADR 0097). The fix attributes the
   // unaccounted remainder to a real, priceable family bucket so cost-plus pays.

package/tests/session_rename_fallback.mjs

@@ -3,7 +3,7 @@
 // Two artefacts get renamed here, and the whole risk is in the fallback, not the rename:
 //
 //   1. ~/.config/<instance>/gds-session.json → bongos-session.json. This file is on disk on every
-//      builder machine and every live dev box. Renaming it with no fallback signs all of them out
+//      builder machine. Renaming it with no fallback signs all of them out
 //      at once and every /builder-* command dies with 'no Bongos session'.
 //   2. The `gds_session` browser cookie → `bongos_session`. Renaming it logs out every signed-in
 //      session, the owner's included. The read-list is THREE names, because `pms_session` predates

package/tests/session_start_freshness.mjs

@@ -66,7 +66,7 @@ test('clean main full clone, strictly behind → pull', () => {
 
 // ---------- pull: a clean, strictly-behind checkout self-heals (task 1284) ----------
 // FF is now safe on ANY branch and ANY clone type when ahead===0 and the tree is
-// clean — that's what lets a dev-box worktree (feature branch off a partial clone)
+// clean — that's what lets a worktree (feature branch off a partial clone)
 // stop silently running stale code.
 
 test('feature branch, clean, ahead 0 → pull (self-heal, not warn)', () => {
@@ -75,13 +75,13 @@ test('feature branch, clean, ahead 0 → pull (self-heal, not warn)', () => {
   assert.equal(d.reason, 'safe-fast-forward');
 });
 
-test('partial/blobless clone, clean, ahead 0 → pull (boxes self-heal)', () => {
+test('partial/blobless clone, clean, ahead 0 → pull (partial clones self-heal)', () => {
   const d = decideFreshness({ ...SAFE, isPartialClone: true });
   assert.equal(d.action, 'pull');
   assert.equal(d.reason, 'safe-fast-forward');
 });
 
-test('the dev-box case: feature branch + partial clone + clean + ahead 0 → pull', () => {
+test('the partial-clone worktree case: feature branch + partial clone + clean + ahead 0 → pull', () => {
   const d = decideFreshness({ behind: 12, ahead: 0, branch: 'claude/poincare', hasTrackedChanges: false, isPartialClone: true });
   assert.equal(d.action, 'pull');
   assert.equal(d.reason, 'safe-fast-forward');

package/tests/session_token_hash_db.mjs

@@ -12,7 +12,7 @@
 // (2) is the one worth a real database. It is the whole reason the migration
 // backfills instead of letting sessions re-mint, and it can only be proved by
 // running the actual SQL against rows in the actual old shape. A mistake here
-// does not fail loudly in review — it signs out every builder and every dev box
+// does not fail loudly in review — it signs out every builder
 // on deploy day, including whoever would have to log in to fix it.
 //
 // The sibling `session_token_hash.mjs` is DB-free and pins the hash itself plus

package/tests/ship_card.mjs

@@ -127,7 +127,7 @@ test('confirmed + bailed land: says NOT landed, names the reason, warns', () =>
 });
 
 test('confirmed + bailed land: the bail reaches the printed monospace card', () => {
-  // The monospace card is the ALWAYS-printed fallback (headless, cron, dev box).
+  // The monospace card is the ALWAYS-printed fallback (headless, cron).
   // If the reason stops at the model, the builder still never sees it.
   const out = card.renderMonospaceCard(card.buildCardModel(bailed));
   assert.match(out, /NOT landed/);

package/tests/ship_ci_deploy.mjs

@@ -298,8 +298,8 @@ test('pending is NOT a bail: no reason, so the card keeps "landing automatically
   assert.equal(o.reason, null);
 });
 
-test('strandCommand: a box gets the resume, a laptop gets /merge-mode', () => {
-  // /merge-mode needs gh + a main checkout a dev box doesn't have (task 1052).
+test('strandCommand: a server-publish checkout gets the resume, a laptop gets /merge-mode', () => {
+  // /merge-mode needs gh + a main checkout a credential-less checkout doesn't have (task 1052).
   assert.equal(strandCommand(77, 'server'), 'node scripts/gds/ship.js 77');
   assert.equal(strandCommand(77, 'local'), '/merge-mode');
 });
@@ -352,11 +352,11 @@ test('config/deploy.json — when present ships as ci; absent is fine on the neu
     'To roll back to operator-laptop deploys, set mode "laptop" AND disarm the PROD_DEPLOY_VIA_CI repo var.');
 });
 
-// ---- 6. shouldBailOnFetchFailure: the task-1037 dev-box publish fix ----
+// ---- 6. shouldBailOnFetchFailure: the task-1037 server-publish fix ----
 //
 // autoMerge() ran `git fetch origin main` as a HARD precondition before
-// dispatching to the land path. A credential-less dev box (private origin,
-// scrubbed clone token — ADR 0053) can't fetch, so it bailed here and stranded
+// dispatching to the land path. A credential-less checkout (private origin,
+// no clone token) can't fetch, so it bailed here and stranded
 // every ship at confirmed — never reaching the ADR-0055 server-mediated publish
 // built precisely for it (the bug task 1027 surfaced). The fix makes a fetch
 // failure fatal ONLY off the server path. Truth table, proven without git:
@@ -367,8 +367,8 @@ test('shouldBailOnFetchFailure: fetch OK never bails (regardless of path)', () =
   assert.equal(shouldBailOnFetchFailure(true, 'laptop', 'local'), false);
 });
 
-test('shouldBailOnFetchFailure: fetch FAILED on the dev-box server path does NOT bail', () => {
-  // The fix: ci + server (a credential-less box) proceeds to ciLandServer, which
+test('shouldBailOnFetchFailure: fetch FAILED on the server-publish path does NOT bail', () => {
+  // The fix: ci + server (a credential-less checkout) proceeds to ciLandServer, which
   // bundles against the local origin/main while the server tops up main.
   assert.equal(shouldBailOnFetchFailure(false, 'ci', 'server'), false);
 });
@@ -424,15 +424,15 @@ test('classifyLandOutcome: NOT merged + deploy unconfigured → pending, never s
   assert.equal(classifyLandOutcome({ pr_state: 'closed', merged: false, deploy_status: 'unconfigured' }), 'failed');
 });
 
-// ---- 8. strandNextStep: box-aware recovery guidance, never gh-only /merge-mode on a box (task 1052) ----
-// The #1027 retrospective: a confirmed-strand on a dev box pointed the builder at
-// /merge-mode, which needs gh + a main checkout a box lacks — a dead end.
+// ---- 8. strandNextStep: recovery guidance that fits the push path, never gh-only /merge-mode on the server path (task 1052) ----
+// The #1027 retrospective: a confirmed-strand on a server-publish checkout pointed the builder at
+// /merge-mode, which needs gh + a main checkout that checkout lacks — a dead end.
 
-test('strandNextStep: a dev box (via "server") is pointed at resume, NOT /merge-mode', () => {
+test('strandNextStep: a server-publish checkout (via "server") is pointed at resume, NOT /merge-mode', () => {
   const s = strandNextStep(1027, 'server');
   assert.match(s, /ship\.js 1027/, 'names the resume command with the task id');
   assert.match(s, /resume|resumes/i);
-  assert.match(s, /NOT available/, 'explicitly says /merge-mode is not available on a box');
+  assert.match(s, /NOT available/, 'explicitly says /merge-mode is not available there');
 });
 
 test('strandNextStep: a laptop (via "local") keeps /merge-mode, with resume as the alternative', () => {
@@ -441,25 +441,25 @@ test('strandNextStep: a laptop (via "local") keeps /merge-mode, with resume as t
   assert.match(s, /ship\.js 1027/, 'and resume is offered as the alternative');
 });
 
-test('task 1046: regenerateDiagrams SKIPS on the dev-box (server-publish) path and leaves the tree untouched', () => {
+test('task 1046: regenerateDiagrams SKIPS on the server-publish path and leaves the tree untouched', () => {
   const { execSync } = require('node:child_process');
   const ROOT = path.resolve(__dirname, '..');
   const status = () => execSync('git status --porcelain docs/onboarding/diagrams', { cwd: ROOT }).toString();
   const before = status();
   const prev = process.env.OTB_PUSH_VIA_SERVER;
-  process.env.OTB_PUSH_VIA_SERVER = '1'; // force pushVia()==='server' (a credential-less dev box)
+  process.env.OTB_PUSH_VIA_SERVER = '1'; // force pushVia()==='server' (a credential-less checkout)
   try {
-    // On a box there is no headless browser; attempting the render strands the
+    // On the server-publish path there is no headless browser; attempting the render strands the
     // regenerated .mmd + assertions.json UNCOMMITTED in the tree (#1046). The
     // guard must return early BEFORE any regen/render, so the call is a pure no-op.
     assert.equal(ship.regenerateDiagrams(), 'skipped-server',
-      'on a dev box the diagram regen must skip entirely (no render attempt)');
+      'on the server-publish path the diagram regen must skip entirely (no render attempt)');
   } finally {
     if (prev === undefined) delete process.env.OTB_PUSH_VIA_SERVER;
     else process.env.OTB_PUSH_VIA_SERVER = prev;
   }
   assert.equal(status(), before,
-    '#1046: the dev-box skip must not write or stage any diagram artifact (no uncommitted .mmd/assertions left behind)');
+    '#1046: the server-publish skip must not write or stage any diagram artifact (no uncommitted .mmd/assertions left behind)');
 });
 
 // ---- 9. pickStaleGateReviewRun: the gate-author-trust re-run nudge (task 1169) ----

package/tests/ship_premerge.mjs

@@ -43,7 +43,7 @@ t('decidePreMerge: single commit behind still merges', () => {
   assert.equal(ship.decidePreMerge({ branch: 'claude/feat', behind: 1 }).action, 'merge');
 });
 
-// idea #364: a credential-less partial-clone dev box (pushVia 'server') cannot run
+// idea #364: a credential-less partial-clone checkout (pushVia 'server') cannot run
 // the local `git merge origin/main` (no creds to lazily fetch main's blobs) and
 // does not need to — the server reconciles with main at publish time (ADR 0055).
 // So the server path SKIPS the pre-merge regardless of how far behind it is, while

package/tests/ship_resume.mjs

@@ -8,7 +8,7 @@
 // strands the task with no claim:
 //   - grade fail   → task stuck at `completed`  → re-run should RE-GRADE
 //   - merge/deploy fail → task stuck at `confirmed` → re-run should RE-MERGE
-//     (the exact task-1027 dev-box nightmare)
+//     (the exact task-1027 nightmare)
 // evaluateResumeAction is the pure decision behind that routing. We prove the
 // full truth table here — no git, no network.
 //

package/tests/skill_preflight.mjs

@@ -2,8 +2,8 @@
 // guards-skill-declares-machine.
 //
 // THE INCIDENT. /merge-mode states in its own prose that it assumes the Archon's
-// Mac or the droplet. It was run on a dev box anyway — and ship.js ALREADY knew,
-// because strandNextStep() tells a box "/merge-mode is NOT available here". The
+// Mac or the droplet. It was run on a checkout with no gh and no main checkout anyway — and ship.js
+// ALREADY knew, because strandNextStep() tells such a checkout "/merge-mode is NOT available here". The
 // knowledge existed in two places and neither stopped the run: prose cannot
 // refuse, and the one executable copy sat on a different code path.
 //

package/tests/skip_is_not_pass.mjs

@@ -4,7 +4,7 @@
 //
 // modules/security/tests/sanitize_rebuild.mjs gated its two physical-confinement symlink
 // cases behind canSymlink() and, in the else-branch, printed `ok` and did `passed += 2`.
-// So on any machine that cannot create symlinks — the Windows dev box, a container without
+// So on any machine that cannot create symlinks — a Windows machine, a container without
 // CAP_SYMLINK, a non-admin account — the suite reported two passes for two cases that never
 // ran, and those two are the ONLY coverage of physical confinement.
 //

package/tests/terms_acceptance.mjs

@@ -500,7 +500,7 @@ await ta('a session of an undeclared source (a leftover dev-box token) cannot mi
   pool.accounts.clear();
   const res = await authorize();
   assert.equal(res.status, 403);
-  assert.equal(pool.accounts.size, 0, 'a box-scoped session recorded a platform T&C acceptance');
+  assert.equal(pool.accounts.size, 0, 'a session of an undeclared source recorded a platform T&C acceptance');
 });
 
 // ===========================================================================