@bongos/core 1.19.666 → 1.19.667

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.666",
-  "core_contract": "1.19.666",
-  "source_commit": "3fc1c7e12b4d5fa3451f618fb8a971a5da710db7",
+  "core_version": "1.19.667",
+  "core_contract": "1.19.667",
+  "source_commit": "fde10b200283c5047be40d5fc05a7489f3d5b73c",
   "source_ref": "HEAD",
-  "built_at": "2026-09-11T05:45:20.037Z",
+  "built_at": "2026-09-11T07:58:55.399Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 473,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2116,
+    "functional_verbatim": 2117,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2613,
-  "tree_sha256": "18d8514d20465a8efc1d55968fb7382c7fef86fac6d286475bb414b792238821",
+  "file_count": 2614,
+  "tree_sha256": "cbb2d92ddbc241d615a5a7b105b021310b739c85b8709fd9479d256ceba573e5",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2787,7 +2787,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1a4f6805f1c7cc669b21c253e57d753e5e37c8a4d0b84ea27ad959be2b63c4dc"
+      "sha256": "65505f4ffa0193c1827059d16ce364257fdfdc076f5585544e1d037f2bda40a8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4212,7 +4212,7 @@
     {
       "path": "modules/dev-box/app/src/session-store.js",
       "mode": "0000644",
-      "sha256": "faa5cca9f30740588731b9132ab1681536c90600d7bf86a9e0107785e5b5fed5"
+      "sha256": "9fefb99a647184879d2960eda360b475f5ea14d6f7c78d46c4de67f2b9909baa"
     },
     {
       "path": "modules/dev-box/app/src/ssh-setup.js",
@@ -5402,7 +5402,7 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "09c16d780e9e4027d7b8c9279e1acaae38f01360ed9af67cb7f0b98f0a494766"
+      "sha256": "f0f6462bd7e536b73162c758db37d30ceec6b5e4ec74815df778d85978d7eb5e"
     },
     {
       "path": "modules/hall-ui/public/ship.wav",
@@ -6982,7 +6982,7 @@
     {
       "path": "modules/public-landing/public/index.html",
       "mode": "0000644",
-      "sha256": "c6ad936d8f4340a16f7faea30ec0b97b7a1c526a9a991d1e1c6ff1833ddb57ce"
+      "sha256": "ea0c3be6fcddc0e93414ee3ce247c0aee57d74c285b0ecd2dc13095118447d81"
     },
     {
       "path": "modules/public-landing/public/index.probes.json",
@@ -7012,7 +7012,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "eca7a7b580db8a794f5e0e17c8bfbb106529f14bf43c6e627d8f32e1dc9d6a53"
+      "sha256": "864b6ee7a8b1866196d6595914f614e388a51c2a160fd86f454ab4a32a4740d5"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7082,7 +7082,7 @@
     {
       "path": "modules/security/artifact-scan/detectors/credentials.js",
       "mode": "0000644",
-      "sha256": "ac793c3caa1b047770dc5729777881fa9a9c0e799eb46799fda038ed98338934"
+      "sha256": "6ef164669b8947143ecc7095443ae2500b43ce61dd240d480598850c787920ef"
     },
     {
       "path": "modules/security/artifact-scan/detectors/dependencies.js",
@@ -7757,12 +7757,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "67316339ae447a8943fa26ed89e3974debbd19f41ca5d7082a35a7960632ca75"
+      "sha256": "e6a26c726108246ac30f4250a93e1fd7965dba6bd5dfcd950b849357634ddb02"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b54f7ae81efd2b4d6c154240adce30ba2a0e4b4356050680704276d4fd8f9f8a"
+      "sha256": "30fa12bd80546328d075b3d2b251c528c59ec033b486a6084bcca3b3d5c6f703"
     },
     {
       "path": "public-docs/index.html",
@@ -7947,7 +7947,7 @@
     {
       "path": "scripts/gds/box-infra.js",
       "mode": "0000644",
-      "sha256": "811545b6769947c5399f4be52782e90c1a6c2e628e72d7751266d2c7dafb62c3"
+      "sha256": "7890dee972f792b633a86d5ac9e6195bafdfc6c197195b8ac3f00c4a0f80d5c0"
     },
     {
       "path": "scripts/gds/box-sync.js",
@@ -8032,7 +8032,7 @@
     {
       "path": "scripts/gds/cli-lib.js",
       "mode": "0000644",
-      "sha256": "c3f5d95c3e586ea711f4e0cef245da9f8106bf4c803aa4c7b2d0025657562680"
+      "sha256": "24b6e3f2f99f7e584692d58fdd50d94e2b9e58905213307d71e3590858fafd22"
     },
     {
       "path": "scripts/gds/client-baseurl-guard.js",
@@ -8177,7 +8177,7 @@
     {
       "path": "scripts/gds/fetch-art-key.js",
       "mode": "0000644",
-      "sha256": "7fa67e4bcb4d28300db3793993133912d34cd5c0af49f0570c9def445deba1e2"
+      "sha256": "9fb05213e80f27ac02cb40c6ceb95a7c92ca81b0a531d9cd67ba09b497017d6d"
     },
     {
       "path": "scripts/gds/fetch-sound-prefs.js",
@@ -8352,7 +8352,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "0e6f775304038af80d3ca3b060f174ec9fc9e39f4d4eead2bc1c1587845099bd"
+      "sha256": "390df0043001a825bbd4709df767e8ef21089743b799fc9c638a5509e8222ae8"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -8527,7 +8527,7 @@
     {
       "path": "scripts/gds/paste-token.js",
       "mode": "0000644",
-      "sha256": "1a39d097cfe41343303b69cef6f08cfd52b9d9973b1e359a18d5168d14013e89"
+      "sha256": "9036bdd526ed13d1518b0f12289a68d86e0078a093d22607f7f5377b6759969c"
     },
     {
       "path": "scripts/gds/portability-smoke-art.sh",
@@ -8537,7 +8537,7 @@
     {
       "path": "scripts/gds/portability-smoke-memory.sh",
       "mode": "0000644",
-      "sha256": "bec9e23a2b8092c6a2b1bb5edaed48900485e7296a3d7e683cce215ad7ec7ab9"
+      "sha256": "6822594619d66509430fa42f51abb4a53a612274e232ec227502d2b2d51f3417"
     },
     {
       "path": "scripts/gds/preflight.js",
@@ -8872,7 +8872,7 @@
     {
       "path": "scripts/gds/setup.js",
       "mode": "0000644",
-      "sha256": "36b5c59af3cde0398e432db37f1cd645aab08ea70b308a5e53671a4fce06f7fe"
+      "sha256": "15243de5b4bde57313c601bf96bd2a10bb86dedceb18cb0a31495b998d1ca835"
     },
     {
       "path": "scripts/gds/shell.js",
@@ -9022,7 +9022,7 @@
     {
       "path": "scripts/gds/smoke-write.sh",
       "mode": "0000644",
-      "sha256": "5468e6fdf5330fa2a67aa9a027d747efdf09908f9d676c567f2e324fd55a5155"
+      "sha256": "cfa2f05cd72aad3975a683e334e32341c4cc10e34802091e693fe26f2e49781f"
     },
     {
       "path": "scripts/gds/spark.js",
@@ -9137,7 +9137,7 @@
     {
       "path": "scripts/hall-preview/refresh-fixtures.js",
       "mode": "0000644",
-      "sha256": "1f7f42a4c3213a97d6b2844c87fa88afd95c23a7d4897f1e5d0cac375a12fa93"
+      "sha256": "3faeb959f81f32e23b11c9ab623df7899bae647c07837bca54c946e7807ef0f6"
     },
     {
       "path": "scripts/hall-preview/server.js",
@@ -9257,7 +9257,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "88e734e42d8fd15ba24d75cafcc611de90e16362200e198e9a9bc4ee825bfbaf"
+      "sha256": "4ba2511e982a50e82cc7e600ad16905dc1765b89a6b11eedcec2a67cd86a19da"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -9327,7 +9327,7 @@
     {
       "path": "src/bongos/middleware/rate-limit.js",
       "mode": "0000644",
-      "sha256": "7a4a49df59dd3754fec468f1833514982b6e57c460dc531d5f6605cfe68d196f"
+      "sha256": "16a4ec3664e0ae3ff2c38e75a04dacd1011d19b7a53631739ac39147578e5534"
     },
     {
       "path": "src/bongos/module-scope-map.js",
@@ -9412,7 +9412,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "cfed94a4ce1c1c6ef20d33cc12149d3b669e822e1b4affb06a22de576c8f7f12"
+      "sha256": "511383c09afd0a89b568b071303a41f57dc20c5bd6284624230bf9e23056b8f5"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -9517,12 +9517,12 @@
     {
       "path": "src/instance-config.js",
       "mode": "0000644",
-      "sha256": "08b655540d7297e827abcdfb576c37089c188d88b64a3b8a731e61c99d3c78d1"
+      "sha256": "9338dde4ceeae35c208f2d434422642ce6851b3a2196c420463b85a3b23d2dc7"
     },
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ae4d5ac8a868e23e7f9a456173658719bdbd44e4ed231d60fcd3fe9646c81d47"
+      "sha256": "c0e7feb5829d3c421b86a6a9a6465b05f495e66679c91688a41d0eb23d1c3207"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10142,7 +10142,7 @@
     {
       "path": "tests/cli_sessions.mjs",
       "mode": "0000644",
-      "sha256": "ab1ee394c03eccadee0958ea38595e1f4e221146b593559e3474c9573d81ecf7"
+      "sha256": "060821b27429a98d7120525efd8b40cdeb2f845c579db0f01b4b5f604b0122ca"
     },
     {
       "path": "tests/cli_surface.mjs",
@@ -11452,12 +11452,12 @@
     {
       "path": "tests/landing_page.mjs",
       "mode": "0000644",
-      "sha256": "c526200d83ab8a2a5c3b571012827ccf793c46be4dda4e974fee9af6262935db"
+      "sha256": "1e37768b7408632f83f0e118da0226d09324999909e7962fc7f27268d4290f20"
     },
     {
       "path": "tests/lib_sh_resolution.mjs",
       "mode": "0000644",
-      "sha256": "97630ec5029469ec99c6a87160822f319833857f12a79e42b4a465e362836ef0"
+      "sha256": "fdefb4971d75dcf6ab1000323211a9fbe732508ae1a0a28c36b8087383ae797e"
     },
     {
       "path": "tests/lifecycle-card.mjs",
@@ -12499,6 +12499,11 @@
       "mode": "0000644",
       "sha256": "1beb0554d1e29b853d54d17e4345ca7c62f1cd34c72fe6a20b9e2d712e7f2dce"
     },
+    {
+      "path": "tests/session_rename_fallback.mjs",
+      "mode": "0000644",
+      "sha256": "02a61cc6a9949276e88e25d65e75a752cea36fccc1f0e7cec8bf7e44c1dfc93f"
+    },
     {
       "path": "tests/session_reward_on_land.mjs",
       "mode": "0000644",
@@ -12527,7 +12532,7 @@
     {
       "path": "tests/setup_device_flow_fallback.mjs",
       "mode": "0000644",
-      "sha256": "0a7c2f4a0ee050573040a88c6a246c773e7b13074115df4b4d715ab99c903a9c"
+      "sha256": "f047b209ec3b0ea2fcffbee7c3b36d8cf01bb18e19cfcfa9d32267db672d834d"
     },
     {
       "path": "tests/setup_smoke.mjs",

package/docs/module-api-changelog.md

@@ -1791,5 +1791,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.664 with no explicit bump. run 34560552542. (task 1002620)
   1.19.666 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.665 with no explicit bump. run 34567142386. (task 1002620)
+  1.19.667 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.666 with no explicit bump. run 34576878372. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/dev-box/app/src/session-store.js

@@ -1,6 +1,6 @@
 // devbox-app/src/session-store.js — the app shares the GDS CLI's session file.
 //
-// ~/.config/<instance>/gds-session.json is the same file scripts/gds/cli-lib.js and
+// ~/.config/<instance>/bongos-session.json is the same file scripts/gds/cli-lib.js and
 // paste-token.js read/write: { token, builder, api_base, ... }. Sharing it is
 // a deliberate UX decision (ADR 0045): pairing the app also signs in every
 // /builder-* skill on this machine, and a builder who already ran
@@ -16,12 +16,21 @@ const brand = require('./brand');
 // The instance's CLI config dir (branding configDir) — so the app shares the
 // exact session file the /builder-* CLI uses on this machine.
 const DIR = path.join(os.homedir(), '.config', brand.CONFIG_DIR);
-const FILE = path.join(DIR, 'gds-session.json');
-// Read-side legacy name only (pre-GDS rename) — never written.
-const FILE_LEGACY = path.join(DIR, 'pms-session.json');
+const FILE = path.join(DIR, 'bongos-session.json');
+// Read-side legacy names only — accepted on read, never written to, so the app
+// keeps working on a machine whose CLI has not yet re-authenticated. Newest
+// first, mirroring SESSION_FILENAMES in src/instance-config.js; this app ships as
+// its own bundle (own brand module, no core imports), so the list is duplicated
+// rather than imported, and pinned against the real one by
+// tests/session_rename_fallback.mjs (task 1003704).
+const FILES_LEGACY = [
+  path.join(DIR, 'gds-session.json'),
+  path.join(DIR, 'pms-session.json'),
+];
+const FILES_READ = [FILE, ...FILES_LEGACY];
 
 function read() {
-  for (const f of [FILE, FILE_LEGACY]) {
+  for (const f of FILES_READ) {
     try {
       const data = JSON.parse(fs.readFileSync(f, 'utf8'));
       if (data && typeof data.token === 'string' && data.token) return data;
@@ -48,11 +57,26 @@ function write({ token, builder, apiBase }) {
 
 // Sign-out: drop ONLY our credential fields; preserve everything else
 // (gemini_api_key etc.) so the app never destroys CLI-adjacent config.
+//
+// Strips EVERY accepted filename, not just the current one. read() falls through
+// to an older name when the current file carries no token, so clearing FILE alone
+// would leave a live token in a superseded file and the very next read would sign
+// the builder straight back in. That was survivable while the only legacy name was
+// the long-dead `pms-session.json`; with `gds-session.json` now on the read list
+// it is the common case on every machine that has not re-authenticated yet
+// (task 1003704).
 function clear() {
-  const existing = read();
-  if (!existing) return;
-  const { token: _t, builder: _b, ...rest } = existing;
-  fs.writeFileSync(FILE, `${JSON.stringify(rest, null, 2)}\n`, { mode: 0o600 });
+  for (const target of FILES_READ) {
+    let existing = null;
+    try {
+      existing = JSON.parse(fs.readFileSync(target, 'utf8'));
+    } catch {
+      continue; // missing or unparsable → nothing to strip
+    }
+    if (!existing || typeof existing !== 'object') continue;
+    const { token: _t, builder: _b, ...rest } = existing;
+    fs.writeFileSync(target, `${JSON.stringify(rest, null, 2)}\n`, { mode: 0o600 });
+  }
 }
 
 module.exports = { read, write, clear, FILE };

package/modules/hall-ui/public/shell.js

@@ -867,7 +867,7 @@
       // subdomains; a Max-Age=0 only matches the cookie whose Domain attribute
       // it names, so the host-only expire alone leaves the apex cookie live).
       var apex = location.hostname.split('.').slice(-2).join('.');
-      ['gds_session', 'pms_session'].forEach(function (name) {
+      ['bongos_session', 'gds_session', 'pms_session'].forEach(function (name) {
         document.cookie = name + '=; Max-Age=0; path=/';
         document.cookie = name + '=; Max-Age=0; path=/; Domain=.' + apex;
       });

package/modules/public-landing/public/index.html

@@ -946,7 +946,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
   function doLogout() {
     var finish = function () {
       var apex = location.hostname.split('.').slice(-2).join('.');
-      ['gds_session', 'pms_session'].forEach(function (name) {
+      ['bongos_session', 'gds_session', 'pms_session'].forEach(function (name) {
         document.cookie = name + '=; Max-Age=0; path=/';
         document.cookie = name + '=; Max-Age=0; path=/; Domain=.' + apex;
       });

package/modules/public-landing/public/projects.html

@@ -7215,7 +7215,7 @@ summary{min-height:24px;padding:3px 0;}
   function doLogout() {
     var finish = function () {
       var apex = location.hostname.split('.').slice(-2).join('.');
-      ['gds_session', 'pms_session'].forEach(function (name) {
+      ['bongos_session', 'gds_session', 'pms_session'].forEach(function (name) {
         document.cookie = name + '=; Max-Age=0; path=/';
         document.cookie = name + '=; Max-Age=0; path=/; Domain=.' + apex;
       });

package/modules/security/artifact-scan/detectors/credentials.js

@@ -2,7 +2,7 @@
 // credential stores (task 1002544).
 //
 // The pattern list is CURATED AND NAMED, not clever: each entry is a specific
-// place secrets live — including our own ~/.config/otb/gds-session.json and
+// place secrets live — including our own ~/.config/otb/bongos-session.json and
 // the Windows stores — spelled the way code spells it. A hit means "this
 // artifact's text names a credential store", nothing more; whether it READS it
 // is runtime behavior a static floor cannot see, and the finding says so.
@@ -10,7 +10,7 @@
 // Patterns are tiered by SIGNAL, because the co-occurrence critical (floor.js)
 // must not cry wolf:
 //   FILE  — a concrete on-disk secret store path (.aws/credentials, id_rsa,
-//           gds-session.json). Co-located with a network sink this is the
+//           bongos-session.json). Co-located with a network sink this is the
 //           strong read-then-send shape, so ONLY file-class hits arm the
 //           co-occurrence critical.
 //   ENV   — an environment-variable NAME (GITHUB_TOKEN, NPM_TOKEN). Ordinary
@@ -29,7 +29,12 @@ const SEP = String.raw`[\\/]+`;
 // line (ReDoS) and would hang the floor before any report is persisted; a
 // bounded `[^\\/\n]*` cannot.
 const CREDENTIAL_PATTERNS = Object.freeze([
-  ['our own GDS CLI session token', new RegExp(String.raw`gds-session\.json|\.config${SEP}otb`, 'i'), 'file'],
+  // EVERY session filename, not just the current one: the file is renamed forward
+  // (task 1003704) while the old names stay readable, so an artifact reading ANY of
+  // them is reaching for a live credential. Matching only the newest name would have
+  // let a reader of gds-session.json through; matching only the oldest, a reader of
+  // bongos-session.json. Keep this list in step with SESSION_FILENAMES.
+  ['our own Bongos CLI session token', new RegExp(String.raw`(?:bongos|gds|pms)-session\.json|\.config${SEP}otb`, 'i'), 'file'],
   ['SSH private key', new RegExp(String.raw`\.ssh${SEP}[^\\/\n]*(?:_rsa|_ed25519|_ecdsa)|\bid_rsa\b|\bid_ed25519\b|\bid_ecdsa\b`, 'i'), 'file'],
   ['AWS credentials file', new RegExp(String.raw`\.aws${SEP}credentials`, 'i'), 'file'],
   ['netrc', new RegExp(String.raw`(?:^|[^\w.])\.?_?netrc\b`, 'i'), 'file'],

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.666",
+  "version": "1.19.667",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.666",
+      "version": "1.19.667",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.666",
+  "version": "1.19.667",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box-infra.js

@@ -238,7 +238,7 @@ function readCloudInit({ authorizedKeysBlock = '', boxEnv = '', gdsSession = '',
     // /etc/otb/box.env — empty by default (quick tunnel); the named-tunnel
     // connector token + stable hostname when BOX_NAMED_TUNNEL is on (#771).
     .replace(/__BOX_ENV_B64__/g, Buffer.from(boxEnv || '', 'utf8').toString('base64'))
-    // /root/.config/otb/gds-session.json — the builder's GDS session, minted at
+    // /root/.config/otb/bongos-session.json — the builder's Bongos session, minted at
     // provision so box-source-fetch (#600) can authenticate on FIRST boot and
     // clone the rank-scoped repo. Without it the box never clones (the #818
     // chicken-and-egg: the session normally comes from /builder-setup, which

package/scripts/gds/cli-lib.js

@@ -17,17 +17,32 @@ const os = require('node:os');
 const { execSync } = require('node:child_process');
 const ic = require('../../src/instance-config');
 
-// Session token path — the WRITE target is the configured instance dir
-// (~/.config/<configDir>/gds-session.json; OTB → ~/.config/otb, unchanged). On
-// READ we try that file across every config read dir (configured + legacy otb),
-// then the legacy `pms-session.json` filename across the same dirs — so a
-// pre-rename session, or one written by a differently-namespaced instance, still
-// resolves (R61 / task 1200). os.homedir() keeps it per-user on any machine.
-const SESSION_PATH = ic.configPath('gds-session.json');
-const SESSION_READ_PATHS = [
-  ...ic.configReadPaths('gds-session.json'),
-  ...ic.configReadPaths('pms-session.json'),
-];
+// Session token filenames, NEWEST FIRST. The WRITE target is the configured
+// instance dir (~/.config/<configDir>/bongos-session.json; OTB → ~/.config/otb,
+// unchanged). On READ we try each name across every config read dir (configured +
+// legacy otb) — so a pre-rename session, or one written by a differently-
+// namespaced instance, still resolves (R61 / task 1200). os.homedir() keeps it
+// per-user on any machine.
+//
+// WHY THE OLD NAMES STAY READABLE. This file is on disk on every builder machine
+// and every live dev box. Renaming it with no fallback signs all of them out at
+// once and every /builder-* command dies with 'no Bongos session'. So a read that
+// resolves through a superseded name MIGRATES forward (see loadSession), and the
+// old file is deliberately LEFT IN PLACE — a builder may roll back to an older
+// CLI, which can only see the old name. Part 4 (task 1003706) deletes it behind a
+// test of its absence. (task 1003704)
+//
+// Order is FILENAME-major, not directory-major: the newest name found in ANY read
+// dir beats an older name in the configured dir. That is the precedence a rename
+// wants, and it is the order the two-name version of this list already used.
+// The list itself lives in instance-config (the lowest module that reads the
+// file, and the only one cli-lib and paste-token.js can both import).
+// Destructured, not read off `ic` as a member: knip cannot trace a namespace-only
+// property access on this module and reports the export dead (the same blind spot
+// task 1003703 closed for two other instance-config exports).
+const { SESSION_FILENAMES } = require('../../src/instance-config');
+const SESSION_PATH = ic.configPath(SESSION_FILENAMES[0]);
+const SESSION_READ_PATHS = SESSION_FILENAMES.flatMap((n) => ic.configReadPaths(n));
 // The API base every CLI call targets, resolved ONCE through the single source of
 // truth in instance-config: <PREFIX>_API_BASE (then legacy GDS_/OTB_/PMS_) → the
 // persisted session's api_base → THIS instance's publicOrigin from the branding
@@ -218,14 +233,36 @@ async function readSessionFile(p) {
   }
 }
 
+// Copy a session that resolved through a SUPERSEDED path forward to SESSION_PATH,
+// so the next command reads the new name directly instead of walking the fallback
+// list forever. The old file is left in place on purpose (see SESSION_FILENAMES).
+//
+// BEST-EFFORT BY DESIGN: a read-only home, a full disk, or a permissions problem
+// must never turn a working loadSession() into a failing command. The caller
+// already holds a valid session; failing to write the copy changes nothing about
+// this invocation. So every error is swallowed and the session is still returned.
+async function migrateSessionFile(session) {
+  try {
+    await fsp.mkdir(path.dirname(SESSION_PATH), { recursive: true });
+    await fsp.writeFile(SESSION_PATH, JSON.stringify(session, null, 2), { mode: 0o600 });
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
 async function loadSession() {
-  // Try each read path in priority order (configured dir's gds-session.json,
-  // legacy otb dir, then the legacy pms-session.json filename). We do NOT migrate
-  // the file on read — it gets written at SESSION_PATH next time the user re-auths
-  // or saveSession runs.
+  // Try each read path in priority order (configured dir's bongos-session.json,
+  // legacy otb dir, then each superseded filename across the same dirs). A hit on
+  // anything OTHER than SESSION_PATH is migrated forward — SESSION_READ_PATHS[0]
+  // IS SESSION_PATH (configReadDirs puts the configured dir first), so the common
+  // case writes nothing.
   for (const p of SESSION_READ_PATHS) {
     const s = await readSessionFile(p);
-    if (s) return s;
+    if (s) {
+      if (p !== SESSION_PATH) await migrateSessionFile(s);
+      return s;
+    }
   }
   return null;
 }
@@ -1137,6 +1174,8 @@ module.exports = {
   rewardPolicy,
   costPlusOnlyNote,
   SESSION_PATH,
+  SESSION_FILENAMES,
+  SESSION_READ_PATHS,
   loadSession,
   loadSessionSync,
   saveSession,

package/scripts/gds/fetch-art-key.js

@@ -5,7 +5,7 @@
 // The art pipeline (modules/art-pipeline/pipeline/gen_api.py) runs LOCALLY and can't call the API
 // per generation, so SessionStart runs this once: GET /api/gds/me/art-key and,
 // based on the builder's live rank, write or remove the `shared_gemini_api_key`
-// field in ~/.config/otb/gds-session.json. gen_api.py reads that field as a
+// field in ~/.config/otb/bongos-session.json. gen_api.py reads that field as a
 // fallback BELOW the builder's own key — so own key always wins, and a newcomer
 // with no own key falls back to the shared one we pay for.
 //

package/scripts/gds/init.js

@@ -254,7 +254,7 @@ function buildBrandingConfig(spec) {
     // Every instance gets its OWN session/config dir (task 1002626). Without
     // this, instance-config.js falls back to the shared 'cloudbongos' dir, so
     // every un-branded instance on a machine reads/writes the SAME
-    // ~/.config/cloudbongos/gds-session.json — signing in to one silently
+    // ~/.config/cloudbongos/bongos-session.json — signing in to one silently
     // evicts the CLI session of every other, including the hub. Same slug
     // family as the package name + provisioning slug.
     configDir: spec.configDir ? String(spec.configDir).trim() : slugify(productName, 'instance'),

package/scripts/gds/paste-token.js

@@ -2,7 +2,7 @@
 // scripts/gds/paste-token.js — V3.R91 / #401.
 //
 // Accept a CLI bearer minted by the builders' hall (POST /api/gds/auth/cli-token/issue)
-// and write it into ~/.config/otb/gds-session.json. Preserves any existing
+// and write it into ~/.config/otb/bongos-session.json. Preserves any existing
 // fields (notably gemini_api_key registered via /builder-setup) so a token
 // paste never silently un-registers a builder's Gemini key.
 //
@@ -24,10 +24,13 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const ic = require('../../src/instance-config');
+// Destructured for the same reason as cli-lib: a namespace-only `ic.X` read is
+// invisible to knip, which then calls the export dead code.
+const { SESSION_FILENAMES, readSessionConfigSync } = require('../../src/instance-config');
 
 // WRITE the session to the configured instance dir (OTB → ~/.config/otb,
 // unchanged; a fresh instance → its neutral dir). R61 / task 1200.
-const SESSION_PATH = ic.configPath('gds-session.json');
+const SESSION_PATH = ic.configPath(SESSION_FILENAMES[0]);
 // env → the EXISTING session's api_base → this instance's branding default.
 // On a RE-auth a session file already exists, and its api_base is the best signal
 // of which instance the builder is on — this file used to hardcode the founder
@@ -91,9 +94,11 @@ async function main() {
   //    way, treat as a fresh write.
   let existing = {};
   try {
-    // Read across config dirs (configured + legacy otb) so a session written the
-    // old way still has its fields preserved on the next paste.
-    const raw = ic.readConfigFileSync('gds-session.json');
+    // Read across config dirs (configured + legacy otb) AND across every accepted
+    // filename, so a session written the old way still has its fields preserved on
+    // the next paste. This is the re-auth path: a miss here does not fail loudly,
+    // it silently drops the builder's gemini_api_key (task 1003704).
+    const raw = readSessionConfigSync();
     if (raw) existing = JSON.parse(raw);
   } catch (_) {
     /* fresh session; nothing to merge */

package/scripts/gds/portability-smoke-memory.sh

@@ -95,7 +95,7 @@ if [ -z "$REMOTE" ]; then bad "could not resolve origin remote for fresh-clone t
     # --- 2. the fresh clone leaks NO secrets / NO builder memory ------------
     LEAKS=0
     CFG_DIR=$(gds_node "process.stdout.write(require('../../src/instance-config').configDirName())" 2>/dev/null) || CFG_DIR=""
-    for p in ".env.local" "spaces.env" ".config/${CFG_DIR:-otb}/gds-session.json" "etc/${CFG_DIR:-otb}"; do
+    for p in ".env.local" "spaces.env" ".config/${CFG_DIR:-otb}/bongos-session.json" ".config/${CFG_DIR:-otb}/gds-session.json" "etc/${CFG_DIR:-otb}"; do
       if [ -e "$TMP/clone/$p" ]; then echo "  leak: $p present in clone"; LEAKS=$((LEAKS+1)); fi
     done
     # builder_memory is server-side only — no memory dir should ship in-repo

package/scripts/gds/setup.js

@@ -14,7 +14,7 @@
 //
 // Prints the user_code and verification_uri, then polls until the user
 // completes auth (or expires/denies). On success, writes
-// ~/.config/otb/gds-session.json (resolved from os.homedir(), so this works for
+// ~/.config/otb/bongos-session.json (resolved from os.homedir(), so this works for
 // any user on any machine; no path is hardcoded to a particular developer's
 // home directory) and prints the builder profile.
 
@@ -49,7 +49,7 @@ function dryRunStep(msg) {
 // pixel-art pipeline (gen_api.py). V3.R11 (#91): each builder pays their own
 // Gemini bill, so spend is attributable per-builder on the public dashboard.
 //
-// Stored as gemini_api_key in ~/.config/otb/gds-session.json (mode 600, same
+// Stored as gemini_api_key in ~/.config/otb/bongos-session.json (mode 600, same
 // file as the GitHub session token). gen_api.py reads this location before
 // falling back to ~/.config/otb/env or .env.local.
 //
@@ -476,7 +476,7 @@ async function main() {
 
       // A valid session already exists on this machine. Don't silently adopt
       // it. The session file is a single global path
-      // (~/.config/otb/gds-session.json), so a second person setting up on a
+      // (~/.config/otb/bongos-session.json), so a second person setting up on a
       // shared device — or the same person onboarding a different account,
       // e.g. for testing — would otherwise be invisibly bound to whoever set
       // up first. On an interactive shell, confirm before continuing; the gate
@@ -513,7 +513,7 @@ async function main() {
         console.log('');
         console.log('Setting up as a different builder — the saved session will be replaced once you finish signing in...');
         // Fall through to the Device Flow below, which calls saveSession() and
-        // overwrites ~/.config/otb/gds-session.json with the new identity.
+        // overwrites ~/.config/otb/bongos-session.json with the new identity.
       } else {
         console.log(`Continuing as ${who}.`);
         process.exit(0);