@bongos/core 1.19.666 → 1.19.668

package/scripts/gds/setup.js

@@ -14,7 +14,7 @@
 //
 // Prints the user_code and verification_uri, then polls until the user
 // completes auth (or expires/denies). On success, writes
-// ~/.config/otb/gds-session.json (resolved from os.homedir(), so this works for
+// ~/.config/otb/bongos-session.json (resolved from os.homedir(), so this works for
 // any user on any machine; no path is hardcoded to a particular developer's
 // home directory) and prints the builder profile.
 
@@ -49,7 +49,7 @@ function dryRunStep(msg) {
 // pixel-art pipeline (gen_api.py). V3.R11 (#91): each builder pays their own
 // Gemini bill, so spend is attributable per-builder on the public dashboard.
 //
-// Stored as gemini_api_key in ~/.config/otb/gds-session.json (mode 600, same
+// Stored as gemini_api_key in ~/.config/otb/bongos-session.json (mode 600, same
 // file as the GitHub session token). gen_api.py reads this location before
 // falling back to ~/.config/otb/env or .env.local.
 //
@@ -476,7 +476,7 @@ async function main() {
 
       // A valid session already exists on this machine. Don't silently adopt
       // it. The session file is a single global path
-      // (~/.config/otb/gds-session.json), so a second person setting up on a
+      // (~/.config/otb/bongos-session.json), so a second person setting up on a
       // shared device — or the same person onboarding a different account,
       // e.g. for testing — would otherwise be invisibly bound to whoever set
       // up first. On an interactive shell, confirm before continuing; the gate
@@ -513,7 +513,7 @@ async function main() {
         console.log('');
         console.log('Setting up as a different builder — the saved session will be replaced once you finish signing in...');
         // Fall through to the Device Flow below, which calls saveSession() and
-        // overwrites ~/.config/otb/gds-session.json with the new identity.
+        // overwrites ~/.config/otb/bongos-session.json with the new identity.
       } else {
         console.log(`Continuing as ${who}.`);
         process.exit(0);

package/scripts/gds/smoke-write.sh

@@ -2,7 +2,8 @@
 # GDS write-path smoke test (production). Renamed from PMS in V3.R01.
 #
 # Exercises the full claim → ship round-trip against the live API:
-#   1. Read session token from ~/.config/otb/gds-session.json (or legacy pms-session.json)
+#   1. Read session token from ~/.config/otb/bongos-session.json (or the legacy
+#      gds-session.json / pms-session.json names, all still accepted on read)
 #   2. POST /api/gds/tasks → create a synthetic task titled '__smoke__ <ts>'
 #   3. POST /api/gds/claims → claim it
 #   4. POST /api/gds/claims/:id/resolve outcome=shipped

package/scripts/hall-preview/refresh-fixtures.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // scripts/hall-preview/refresh-fixtures.js — snapshot real API responses into
 // the preview harness's fixtures/ (task 2167). Run with a valid GDS CLI session
-// (~/.config/otb/gds-session.json) whenever the fixtures drift from the live
+// (~/.config/otb/bongos-session.json) whenever the fixtures drift from the live
 // API shapes:  node scripts/hall-preview/refresh-fixtures.js
 //
 // Read-only: GETs only. Endpoints that 403/404 for the caller's rank are

package/src/bongos/auth.js

@@ -62,6 +62,15 @@ const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, di
 
 const MAX_AUTH_TOKEN_CANDIDATES = 6;
 
+// Every name the session cookie has ever had, NEWEST FIRST. A rename APPENDS to
+// this list, it never replaces: at the instant the new code deploys, every
+// signed-in browser is still sending the OLD name, so dropping a name signs that
+// builder out mid-session. `pms_session` predates the gds_ rename and is still
+// in the wild, so the list is three long, not two (task 1003704). The server
+// SETS only the head; routes/auth.js clears the tail on the next write. Part 4
+// (task 1003706) retires the tail behind a test of its absence.
+const SESSION_COOKIE_NAMES = Object.freeze(['bongos_session', 'gds_session', 'pms_session']);
+
 function extractTokens(req) {
   const out = [];
   const push = (t) => {
@@ -70,18 +79,30 @@ function extractTokens(req) {
   const auth = req.headers['authorization'] || '';
   const m = /^Bearer\s+([a-zA-Z0-9]+)$/.exec(auth);
   if (m) push(m[1]);
-  // Cookie parsing: minimal, no dep. Prefer new name, fall back to legacy.
+  // Cookie parsing: minimal, no dep. Group by NAME, then emit in
+  // SESSION_COOKIE_NAMES order, so a browser carrying both a fresh
+  // `bongos_session` and a stale `gds_session` tries the fresh name first
+  // instead of depending on header order.
+  //
+  // EVERY value under a name is kept, in header order — never just the first.
+  // One name can legitimately appear TWICE: a stale host-only cookie plus the
+  // current apex-scoped one (#851, #726/#734). Returning only the first let the
+  // stale duplicate shadow the live session and 401 the builder, so the grouping
+  // must be name → LIST. push() dedupes identical values and caps the total.
   const cookieHeader = req.headers['cookie'] || '';
-  const legacy = [];
+  const found = new Map();
   for (const part of cookieHeader.split(';')) {
     const idx = part.indexOf('=');
     if (idx < 0) continue;
     const k = part.slice(0, idx).trim();
     const v = part.slice(idx + 1).trim();
-    if (k === 'gds_session' && v) push(v);
-    else if (k === 'pms_session' && v) legacy.push(v);
+    if (!v || !SESSION_COOKIE_NAMES.includes(k)) continue;
+    if (!found.has(k)) found.set(k, []);
+    found.get(k).push(v);
+  }
+  for (const name of SESSION_COOKIE_NAMES) {
+    for (const v of found.get(name) || []) push(v);
   }
-  for (const v of legacy) push(v);
   return out;
 }
 
@@ -887,6 +908,7 @@ module.exports = {
   completeDeviceExchange,
   membershipKind,
   extractTokens,
+  SESSION_COOKIE_NAMES,
   resolveSession,
   allowBoxScope,
   sessionScope,

package/src/bongos/middleware/rate-limit.js

@@ -122,6 +122,19 @@ function pruneAndCount(bucket, now, windowMs) {
   return bucket.length;
 }
 
+// Every name the session cookie has ever had, newest first, precompiled.
+//
+// One regex PER NAME rather than a single alternation: an alternation matches in
+// COOKIE-HEADER order, not preference order, so a browser mid-rename — carrying
+// both the new and the old name — would key on whichever the browser happened to
+// send first. Precompiled at module load because this runs on every request.
+//
+// Deliberately duplicated from SESSION_COOKIE_NAMES in src/bongos/auth.js rather
+// than imported: this middleware is dependency-free by design. The copy is pinned
+// against the real list by tests/session_rename_fallback.mjs (task 1003704).
+const SESSION_COOKIE_RES = ['bongos_session', 'gds_session', 'pms_session']
+  .map((n) => new RegExp('(?:^|;\\s*)' + n + '=([^;]+)'));
+
 function extractSessionKey(req) {
   // Bearer token first (CLI flow); cookie second (web flow). We use the
   // token AS-IS as the limiter key — it's already opaque + cheap to hash to
@@ -132,8 +145,10 @@ function extractSessionKey(req) {
   }
   const cookie = req.headers && req.headers.cookie;
   if (cookie) {
-    const m = /(?:^|;\s*)(?:gds_session|pms_session)=([^;]+)/.exec(cookie);
-    if (m) return 'c:' + m[1];
+    for (const re of SESSION_COOKIE_RES) {
+      const m = re.exec(cookie);
+      if (m) return 'c:' + m[1];
+    }
   }
   return null;
 }

package/src/bongos/platform-visibility-gate.js

@@ -70,6 +70,18 @@ const API = `(?:${ALL_API_PREFIXES.map(escRe).join('|')})`;
 //   /__prelaunch         the pre-launch gate's own submit, when both gates are on.
 //                        /__stealth is its pre-rename alias (task 1003152) and is
 //                        exempt for as long as the gate still accepts it.
+//   <api>/access-requests  POST ONLY — a stranger's application to a project that is
+//                        BOTH gated and "apply to join" (task 1003624). The owner
+//                        turned that door on deliberately; without this exemption the
+//                        member door answers 401 first and the two settings compose
+//                        into "nobody can apply", which nobody chose. The write is
+//                        public on every other project and carries its own per-IP and
+//                        per-login limits, and it GRANTS nothing — an application is a
+//                        row in a queue the owner still reviews (ADR 0201). The bare
+//                        GET on the same path is the owner's QUEUE (requireBuilder +
+//                        access_request.review), so the exemption is scoped to the
+//                        VERB and the queue keeps the member door ahead of its own
+//                        rank check.
 const EXEMPT = [
   new RegExp(`^${API}/auth(/|$)`),
   new RegExp(`^${API}/instance$`),
@@ -81,6 +93,7 @@ const EXEMPT = [
   /^\/__prelaunch$/,
   /^\/__stealth$/,
   /^\/downloads\//,
+  { re: new RegExp(`^${API}/access-requests$`), methods: ['POST'] },
 ];
 
 // The policy, read through the memoized pack. A pack that cannot be read at all
@@ -106,9 +119,16 @@ function normalizePath(p) {
   return s;
 }
 
-function isExempt(path) {
+// `method` is OPTIONAL, and each entry decides whether it matters: a bare RegExp
+// exempts the path whatever the verb, while a method-scoped entry matches only the
+// verbs it names. A caller that passes no method therefore gets the fail-CLOSED
+// answer for the scoped entries (the static path checks in tests/version_literals.mjs
+// and tests/prelaunch_gate.mjs call it that way) — never an accidental exemption of a
+// sibling route that shares a path with an exempt one.
+function isExempt(path, method) {
   const p = normalizePath(path);
-  return EXEMPT.some((re) => re.test(p));
+  const m = String(method || '').toUpperCase();
+  return EXEMPT.some((e) => (e instanceof RegExp ? e.test(p) : e.re.test(p) && e.methods.includes(m)));
 }
 
 function isApiPath(path) { return /^\/api\//i.test(String(path || '')); }
@@ -233,7 +253,7 @@ function platformVisibilityGate(deps = {}) {
   return function platformVisibility(req, res, next) {
     if (!gated()) return next();
     if (req.method === 'OPTIONS') return next();     // a CORS preflight carries no identity
-    if (isExempt(req.path)) return next();
+    if (isExempt(req.path, req.method)) return next();
     // Async middleware must own its rejection (Express 4 drops the promise) —
     // and it FAILS CLOSED: if the session cannot be resolved, the caller's
     // identity is unknown, and admitting is never an option (auth.js's rule).

package/src/bongos/routes/auth.js

@@ -204,12 +204,41 @@ function renderAccessPendingPage(login, startHref) {
 </body></html>`;
 }
 
-// Cookie names. The web flow writes the new `gds_session` (+ `gds_oauth_state`)
-// names; both flows accept either the new or the legacy `pms_session` /
-// `pms_oauth_state` cookies on read so a builder mid-flow doesn't have to
-// re-auth at the rename rollout.
-const SESSION_COOKIE = 'gds_session';
-const SESSION_COOKIE_LEGACY = 'pms_session';
+// Cookie names. The web flow writes the new `bongos_session` (+ `gds_oauth_state`)
+// names; both flows accept every older session name on read so a builder
+// mid-flow doesn't have to re-auth at the rename rollout.
+//
+// The session read-list is NOT declared here. It lives in ../auth.js as
+// SESSION_COOKIE_NAMES, because the request-level token extractor there has to
+// accept exactly the names this router sets and clears: two lists would drift,
+// and the only symptom of the drift is a builder being silently signed out.
+// Head = the one name we SET. Tail = the names we accept and clear on write.
+const SESSION_COOKIE = auth.SESSION_COOKIE_NAMES[0];
+const SESSION_COOKIE_OLD = auth.SESSION_COOKIE_NAMES.slice(1);
+
+// The session token off a request's cookies, trying each accepted name newest
+// first. Replaces the hand-written `parseCookie(new) || parseCookie(legacy)`
+// pairs, which accepted only two of the three live names.
+function sessionCookieToken(req) {
+  for (const name of auth.SESSION_COOKIE_NAMES) {
+    const v = parseCookie(req, name);
+    if (v) return v;
+  }
+  return null;
+}
+
+// Clear every SUPERSEDED session cookie, in both the host-only and apex-scoped
+// forms (a clearCookie only matches the cookie whose domain attribute it names).
+// Called wherever we set the current cookie, so a browser that arrived with a
+// `gds_session` leaves holding only `bongos_session` — otherwise the stale name
+// lingers until its own expiry and every later request carries two tokens.
+function clearSupersededSessionCookies(req, res) {
+  const domainOpts = sessionCookieDomainOpts(req);
+  for (const name of SESSION_COOKIE_OLD) {
+    res.clearCookie(name);
+    if (domainOpts.domain) res.clearCookie(name, domainOpts);
+  }
+}
 const STATE_COOKIE = 'gds_oauth_state';
 const STATE_COOKIE_LEGACY = 'pms_oauth_state';
 const DISCORD_STATE_COOKIE = 'gds_discord_state';
@@ -650,6 +679,10 @@ module.exports = function buildAuthRouter() {
         // amazonprimea.com + builders. + status. (#726); host-only elsewhere.
         ...sessionCookieDomainOpts(req),
       });
+      // A browser arriving with an older session name must not keep it: two
+      // session cookies means every later request carries two candidate tokens,
+      // and the stale one outlives this sign-in.
+      clearSupersededSessionCookies(req, res);
       // Persist the wizard's repo token (task 1002099 / ADR 0143): encrypted at rest,
       // short-TTL, keyed to the builder — the repo picker/creator reads it back over
       // the next few minutes. Gated on secret-box being configured (upsertGithubToken
@@ -916,19 +949,17 @@ module.exports = function buildAuthRouter() {
   // rank: any-builder — own session, no rank gate (a Xenos can log themselves out).
   router.post('/auth/logout', auth.requireBuilder, async (req, res) => {
     const token = (req.headers['authorization'] || '').replace(/^Bearer\s+/, '')
-      || parseCookie(req, SESSION_COOKIE)
-      || parseCookie(req, SESSION_COOKIE_LEGACY);
+      || sessionCookieToken(req);
     if (token) await db.revokeSession(token);
     // Clear BOTH the host-only form (older sessions) and the apex-scoped form
     // (#726) — a clearCookie only matches the cookie whose domain attribute it
     // names, so sign-out on a production host must target the apex domain too.
     res.clearCookie(SESSION_COOKIE);
-    res.clearCookie(SESSION_COOKIE_LEGACY);
     const domainOpts = sessionCookieDomainOpts(req);
-    if (domainOpts.domain) {
-      res.clearCookie(SESSION_COOKIE, domainOpts);
-      res.clearCookie(SESSION_COOKIE_LEGACY, domainOpts);
-    }
+    if (domainOpts.domain) res.clearCookie(SESSION_COOKIE, domainOpts);
+    // …and every superseded name, or a sign-out leaves the older cookie behind
+    // and the next request re-authenticates on it.
+    clearSupersededSessionCookies(req, res);
     // Federated single-logout (ADR 0144, task 1002238): announce the logout so the
     // hub (platform-identity, enabled only on cloudbongos.com) can fan a signed
     // back-channel logout out to every federated project this builder entered. A
@@ -1002,7 +1033,7 @@ module.exports = function buildAuthRouter() {
   // (a leaked CLI token shouldn't be able to extend its own lifetime; the
   // httpOnly browser cookie is the harder-to-steal credential).
   router.post('/auth/cli-token/issue', auth.requireBuilder, async (req, res) => {
-    const cookieToken = parseCookie(req, SESSION_COOKIE) || parseCookie(req, SESSION_COOKIE_LEGACY);
+    const cookieToken = sessionCookieToken(req);
     if (!cookieToken) {
       // Name the instance's own sign-in host (from the branding pack), not a
       // hardcoded "amazonprimea.com" (ADR 0062 §3/§5).
@@ -1144,7 +1175,7 @@ module.exports = function buildAuthRouter() {
   // CLI bearer must not be able to approve pairings and mint itself siblings;
   // only the httpOnly browser cookie — the click in the hall — can.
   router.post('/auth/app-pair/approve', auth.requireBuilder, async (req, res) => {
-    const cookieToken = parseCookie(req, SESSION_COOKIE) || parseCookie(req, SESSION_COOKIE_LEGACY);
+    const cookieToken = sessionCookieToken(req);
     if (!cookieToken) {
       return res.fail('cookie_required', { status: 403, message: 'Pairings are approved from an authenticated browser session in the builders’ hall, not from a bearer token.' });
     }

package/src/instance-config.js

@@ -104,7 +104,7 @@ function resolveApiBase({ session, env = process.env, b = safeBrand() } = {}) {
   let s = session;
   if (s === undefined) {
     try {
-      const raw = readConfigFileSync('gds-session.json', { b });
+      const raw = readSessionConfigSync({ b });
       s = raw ? JSON.parse(raw) : null;
     } catch (_) {
       s = null; // unreadable/corrupt session must never break base resolution
@@ -135,8 +135,32 @@ function configPath(name, b = safeBrand()) {
   return path.join(configHome(b), name);
 }
 
+// Every name the CLI session file has ever had, NEWEST FIRST.
+//
+// Lives here, not in cli-lib.js which owns the session STORE, because this module
+// is the lowest one that has to read the file (resolveApiBase below) and cli-lib
+// imports this — so this is the only place both can share. A rename APPENDS a
+// name; dropping one signs out every builder machine and every live dev box at
+// once. Part 4 (task 1003706) retires the tail. (task 1003704)
+const SESSION_FILENAMES = Object.freeze([
+  'bongos-session.json',
+  'gds-session.json',
+  'pms-session.json',
+]);
+
+// The first readable session file across every config dir and every accepted
+// name, or null. FILENAME-major: the newest name in ANY read dir beats an older
+// name in the configured dir, which is the precedence a rename wants.
+function readSessionConfigSync({ b = safeBrand() } = {}) {
+  for (const name of SESSION_FILENAMES) {
+    const raw = readConfigFileSync(name, { b });
+    if (raw) return raw;
+  }
+  return null;
+}
+
 // Every candidate path for a named config file, configured dir first then legacy
-// dirs — for read-with-fallback (the gds-session.json / cost_ledger pattern).
+// dirs — for read-with-fallback (the session-file / cost_ledger pattern).
 function configReadPaths(name, b = safeBrand()) {
   return configReadDirs(b).map((d) => path.join(d, name));
 }
@@ -298,6 +322,8 @@ module.exports = {
   configPath,
   configReadPaths,
   readConfigFileSync,
+  SESSION_FILENAMES,
+  readSessionConfigSync,
   resolveEnv,
   resolveCoreRoot,
   resolveInstanceRoot,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.666'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.668'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cli_sessions.mjs

@@ -10,7 +10,8 @@
 //   • in-repo the session landed in ~/.config/<slug>/ where the standalone CLI could never find it.
 //
 // The store is keyed by instance host at a FIXED anchor, so the same instance resolves to the same
-// file from either direction. The per-brand gds-session.json stays the ACTIVE pointer, untouched,
+// file from either direction. The per-brand session file (SESSION_FILENAMES[0]) stays the ACTIVE
+// pointer, untouched,
 // so every existing reader behaves identically — that back-compat is asserted here too.
 
 import test from 'node:test';
@@ -157,7 +158,7 @@ test('the sandbox actually relocates os.homedir() — on THIS platform', () => {
 });
 
 test('a session store path resolved inside the sandbox stays inside it', () => {
-  const { out, status, home } = inSandbox(`console.log(JSON.stringify({ p: ic.configPath('gds-session.json'), d: lib.sessionStoreDir() }));`);
+  const { out, status, home } = inSandbox(`console.log(JSON.stringify({ p: ic.configPath(ic.SESSION_FILENAMES[0]), d: lib.sessionStoreDir() }));`);
   assert.equal(status, 0, `sandbox child failed: ${out}`);
   const { p, d } = JSON.parse(out.trim().split('\n').pop());
   assert.ok(p.startsWith(home), `the active session pointer resolved OUTSIDE the sandbox: ${p}`);
@@ -176,7 +177,7 @@ test('sandboxEnv overrides every home variable a platform might read', () => {
 test('signing into a second instance PRESERVES the first — including one written before the store existed', () => {
   const { out } = inSandbox(`
     // A session from before this feature: an active pointer, nothing in the store.
-    const active = ic.configPath('gds-session.json');
+    const active = ic.configPath(ic.SESSION_FILENAMES[0]);
     fs.mkdirSync(path.dirname(active), { recursive: true });
     fs.writeFileSync(active, JSON.stringify({ token:'TOKEN-A', api_base:'https://a.example.com',
       builder:{github_login:'someone'} }), { mode: 0o600 });
@@ -200,11 +201,11 @@ test('signing into a second instance PRESERVES the first — including one writt
 });
 
 test('the ACTIVE pointer still lands exactly where every existing reader looks', () => {
-  // In-repo skills, hooks and the dev box all read gds-session.json in the configured dir. The
+  // In-repo skills, hooks and the dev box all read the active session file in the configured dir. The
   // store is additive; if this moved, every one of them would silently stop finding a session.
   const { out } = inSandbox(`
     await lib.saveSession({ token:'T', api_base:'https://a.example.com', builder:{github_login:'x'} });
-    console.log(JSON.stringify({ wroteActive: fs.existsSync(ic.configPath('gds-session.json')) }));`);
+    console.log(JSON.stringify({ wroteActive: fs.existsSync(ic.configPath(ic.SESSION_FILENAMES[0])) }));`);
   assert.equal(JSON.parse(out.trim().split('\n').pop()).wroteActive, true);
 });
 

package/tests/landing_page.mjs

@@ -45,6 +45,7 @@ const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const HTML = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8');
 const WORLD = fs.readFileSync(path.join(LANDING, 'assets', 'world.css'), 'utf8');
 
+const { SESSION_COOKIE_NAMES } = require('../src/bongos/auth.js');
 const { stripApexOnly } = require('../src/platform-server.js');
 const { applyBrandTokens } = require('../src/bongos/serve-internal.js');
 
@@ -484,7 +485,10 @@ test('sign out POSTs, and expires both cookies in both Domain forms', () => {
   // only matches the cookie whose Domain attribute it names, so the host-only
   // and apex-scoped forms must BOTH be expired (#726).
   assert.match(CODE, /fetch\(API \+ '\/auth\/logout', \{ method: 'POST', credentials: 'same-origin' \}\)/);
-  assert.match(CODE, /\['gds_session', 'pms_session'\]/);
+  // Every accepted cookie name must be expired, not just the newest: a browser arriving with an
+  // older name would otherwise keep a live cookie through "sign out". Derived from the canonical
+  // list so this follows the rename chain (task 1003704, and again at 1003706).
+  assert.match(CODE, new RegExp('\\[' + SESSION_COOKIE_NAMES.map((n) => `'${n}'`).join(', ') + '\\]'));
   assert.match(CODE, /name \+ '=; Max-Age=0; path=\/';/);
   assert.match(CODE, /name \+ '=; Max-Age=0; path=\/; Domain=\.' \+ apex/);
   // it runs whether the POST lands or not

package/tests/lib_sh_resolution.mjs

@@ -35,6 +35,12 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const GDS = path.join(ROOT, 'scripts', 'gds');
 const fitness = require(path.join(GDS, 'fitness.js'));
+// The CURRENT session filename, so the expectations below follow the rename chain
+// (task 1003704 renamed the file; 1003706 retires the old names) instead of being
+// re-edited at each step. SESSION_FILENAMES[0] is what the CLI WRITES; the tail is
+// what it still accepts on read.
+const ic = require(path.join(ROOT, 'src', 'instance-config.js'));
+const SESSION_FILE = ic.SESSION_FILENAMES[0];
 
 // Every bash script that resolves a GDS token or API base.
 const SMOKES = [
@@ -184,9 +190,13 @@ const boxCode = (f) => fitness.stripCommentsForIdentity(fs.readFileSync(path.joi
 test('every baked box script resolves the session across config dirs, not just the legacy one', () => {
   for (const f of BOX_SCRIPTS) {
     const src = boxCode(f);
-    assert.match(src, /\.config\/\*\/gds-session\.json/,
-      `${f} must fall back across ~/.config/*/ — without it a /builder-reauth into a `
-      + 'non-"otb" configDir strands the box on a dead token');
+    for (const name of ic.SESSION_FILENAMES.slice(0, 2)) {
+      assert.ok(src.includes(`.config/*/${name}`),
+        `${f} must scan ~/.config/*/${name} — without the glob a /builder-reauth into a `
+        + 'non-"otb" configDir strands the box on a dead token, and without BOTH names '
+        + 'half the fleet is unreadable: a box provisioned before the rename has only the '
+        + 'old name, one provisioned after has only the new (task 1003704)');
+    }
     // The legacy literal may survive ONLY as the last-resort default, never as the
     // sole source — i.e. it must be preceded by the glob scan.
     // The scan widens what these scripts will read, so each candidate must be owned
@@ -194,8 +204,8 @@ test('every baked box script resolves the session across config dirs, not just t
     // simply by being newest.
     assert.match(src, /\[ -O "\$_sess" \]/,
       `${f} must require candidate session files to be owned by the current user`);
-    const globAt = src.indexOf('.config/*/gds-session.json');
-    const legacyAt = src.indexOf('.config/otb/gds-session.json');
+    const globAt = src.indexOf('.config/*/');
+    const legacyAt = src.indexOf(`.config/otb/${SESSION_FILE}`);
     if (legacyAt !== -1) {
       assert.ok(globAt < legacyAt,
         `${f} reaches the legacy path before scanning ~/.config/*/ — the fallback must come first`);
@@ -217,10 +227,17 @@ test('every baked box script passes bash -n', (t) => {
 function resolverBlock(f) {
   const src = fs.readFileSync(path.join(INFRA, f), 'utf8');
   const start = src.indexOf('if [ -z "${GDS_SESSION:-}" ]; then');
-  const endMark = 'GDS_SESSION="${GDS_SESSION:-$HOME/.config/otb/gds-session.json}"';
-  const end = src.indexOf(endMark, start);
-  assert.ok(start !== -1 && end !== -1, `could not locate the resolver block in ${f}`);
-  return src.slice(start, end + endMark.length);
+  // Matched by PREFIX, up to the closing quote — never by the full line including the
+  // filename. The filename is the one thing a rename changes, so spelling it here made
+  // this test fail with "could not locate the resolver block" on a perfectly good
+  // rename, and on Windows (where it already failed for its own reason) that looked
+  // like no new failure at all (task 1003704).
+  const endPrefix = 'GDS_SESSION="${GDS_SESSION:-$HOME/.config/otb/';
+  const at = src.indexOf(endPrefix, start);
+  const close = at === -1 ? -1 : src.indexOf('"', at + endPrefix.length);
+  assert.ok(start !== -1 && at !== -1 && close !== -1,
+    `could not locate the resolver block in ${f}`);
+  return src.slice(start, close + 1);
 }
 
 test('the resolver prefers the most recently written session across config dirs', (t) => {
@@ -253,7 +270,7 @@ test('the resolver prefers the most recently written session across config dirs'
   const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'boxsess-empty-'));
   const r3 = spawnSync('bash', ['-c', `set -uo pipefail\n${block}\nprintf '%s' "$GDS_SESSION"`],
     { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: empty } });
-  assert.equal(r3.stdout, path.join(empty, '.config', 'otb', 'gds-session.json'));
+  assert.equal(r3.stdout, path.join(empty, '.config', 'otb', SESSION_FILE));
 
   fs.rmSync(home, { recursive: true, force: true });
   fs.rmSync(empty, { recursive: true, force: true });
@@ -264,16 +281,25 @@ test('the resolver prefers the most recently written session across config dirs'
 // override but assigned to SF, so a caller that SET the override had it silently
 // dropped and fell through to the legacy default — the exact bug being fixed,
 // reintroduced through the back door. Pin all three branches.
+// box-heartbeat.sh's resolver, pulled straight out of the committed file. Shared by the
+// two tests below so there is a single extraction to fix when the names next move.
+function heartbeatSfBlock() {
+  const src = fs.readFileSync(path.join(INFRA, 'box-heartbeat.sh'), 'utf8');
+  const start = src.indexOf('SF="${OTB_GDS_SESSION:-}"');
+  // Prefix, not the whole line — see resolverBlock above.
+  const endPrefix = 'SF="${SF:-$HOME/.config/otb/';
+  const at = src.indexOf(endPrefix, start);
+  const close = at === -1 ? -1 : src.indexOf('"', at + endPrefix.length);
+  assert.ok(start !== -1 && at !== -1 && close !== -1,
+    'could not locate the SF resolver in box-heartbeat.sh');
+  return src.slice(start, close + 1);
+}
+
 test('box-heartbeat.sh honors OTB_GDS_SESSION, scans, then falls back', (t) => {
   const probe = bash(['-n', 'infra/box-heartbeat.sh']);
   if (!probe) return t.skip('bash not available on this machine');
 
-  const src = fs.readFileSync(path.join(INFRA, 'box-heartbeat.sh'), 'utf8');
-  const start = src.indexOf('SF="${OTB_GDS_SESSION:-}"');
-  const endMark = 'SF="${SF:-$HOME/.config/otb/gds-session.json}"';
-  const end = src.indexOf(endMark, start);
-  assert.ok(start !== -1 && end !== -1, 'could not locate the SF resolver in box-heartbeat.sh');
-  const block = src.slice(start, end + endMark.length);
+  const block = heartbeatSfBlock();
 
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-'));
   const configured = path.join(home, '.config', 'cloudbongos');
@@ -289,8 +315,49 @@ test('box-heartbeat.sh honors OTB_GDS_SESSION, scans, then falls back', (t) => {
   assert.equal(run({}), path.join(configured, 'gds-session.json'));
 
   const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-empty-'));
-  assert.equal(run({}, empty), path.join(empty, '.config', 'otb', 'gds-session.json'));
+  assert.equal(run({}, empty), path.join(empty, '.config', 'otb', SESSION_FILE));
 
   fs.rmSync(home, { recursive: true, force: true });
   fs.rmSync(empty, { recursive: true, force: true });
 });
+
+// The rename leaves the fleet in FOUR states at once, and the two tests above only cover
+// the pre-rename half (their fixtures write the old name). These are the other two, and
+// they are the ones a rename actually breaks (task 1003704). Same extracted resolver — one
+// harness for this block, deliberately, so part 4 (task 1003706) has one place to change.
+test('the box resolver handles a post-rename box and a migrated one', (t) => {
+  const probe = bash(['-n', 'infra/box-heartbeat.sh']);
+  if (!probe) return t.skip('bash not available on this machine');
+
+  const block = heartbeatSfBlock();
+  const run = (h) => spawnSync('bash', ['-c', `set -euo pipefail\n${block}\nprintf '%s' "$SF"`],
+    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: h } }).stdout;
+
+  // A box provisioned AFTER the rename has ONLY the new name. Before the glob was widened
+  // this fell through to the historical default, which does not exist, so every heartbeat
+  // tick failed with a misleading "no session".
+  const fresh = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-new-'));
+  const freshCfg = path.join(fresh, '.config', 'cloudbongos');
+  fs.mkdirSync(freshCfg, { recursive: true });
+  fs.writeFileSync(path.join(freshCfg, SESSION_FILE), '{"token":"fresh"}');
+  const tail = (p) => p.replace(/\\/g, '/').split('/').slice(-2).join('/');
+  assert.equal(tail(run(fresh)), `cloudbongos/${SESSION_FILE}`,
+    'a box provisioned after the rename must resolve the new name');
+
+  // A MIGRATED box carries both, the new one written later by the CLI's migrate-on-read.
+  // Newest-wins must take the new one; taking the older would read a stale token and report
+  // the misleading "session expired" of task 1003252.
+  const both = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-both-'));
+  const bothCfg = path.join(both, '.config', 'cloudbongos');
+  fs.mkdirSync(bothCfg, { recursive: true });
+  const legacyName = ic.SESSION_FILENAMES[1];
+  fs.writeFileSync(path.join(bothCfg, legacyName), '{"token":"stale"}');
+  fs.writeFileSync(path.join(bothCfg, SESSION_FILE), '{"token":"fresh"}');
+  const older = new Date(Date.now() - 60_000);
+  fs.utimesSync(path.join(bothCfg, legacyName), older, older);
+  assert.equal(tail(run(both)), `cloudbongos/${SESSION_FILE}`,
+    'a migrated box must prefer the newly written file, not the superseded one');
+
+  fs.rmSync(fresh, { recursive: true, force: true });
+  fs.rmSync(both, { recursive: true, force: true });
+});