@bongos/core 1.19.726 → 1.19.728

package/tests/cf_tunnel.mjs

@@ -77,9 +77,9 @@ await ta('live requests pass the IPv4 dispatcher through (token is IP-locked, #7
 await ta('dry-run never touches the network and returns synthetic results', async () => {
   let hit = false;
   const cf = new CfTunnelApi({ accountId: ACCT, fetchImpl: () => { hit = true; throw new Error('should not fetch'); } });
-  const r = await cf.ensureNamedTunnel({ login: 'alice', zone: 'amazonprimea.com', terminalZone: 'dev.amazonprimea.com' });
+  const r = await cf.ensureNamedTunnel({ login: 'alice', zone: 'example.com', terminalZone: 'dev.example.com' });
   assert.equal(hit, false, 'fetch must not be called in dry-run');
-  assert.equal(r.hostname, 'term-alice.dev.amazonprimea.com');
+  assert.equal(r.hostname, 'term-alice.dev.example.com');
   assert.ok(String(r.token).startsWith('dryrun-token-'));
   assert.ok(String(r.tunnelId).startsWith('dryrun-tunnel-'));
 });
@@ -117,8 +117,8 @@ await ta('putConfiguration sends ttyd ingress + 404 catch-all', async () => {
     'PUT /accounts/acct123/cfd_tunnel/tun1/configurations': ({ body }) => { seen = body; return { config: body.config }; },
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.putConfiguration('tun1', { hostname: 'term-alice.dev.amazonprimea.com' });
-  assert.deepEqual(seen.config.ingress[0], { hostname: 'term-alice.dev.amazonprimea.com', service: 'http://127.0.0.1:7681' });
+  await cf.putConfiguration('tun1', { hostname: 'term-alice.dev.example.com' });
+  assert.deepEqual(seen.config.ingress[0], { hostname: 'term-alice.dev.example.com', service: 'http://127.0.0.1:7681' });
   assert.deepEqual(seen.config.ingress[1], { service: 'http_status:404' });
 });
 
@@ -139,7 +139,7 @@ await ta('upsertDnsRoute POSTs a proxied CNAME to cfargotunnel when absent', asy
     'POST /zones/zone1/dns_records': ({ body }) => { posted = body; return { id: 'rec1', ...body }; },
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.upsertDnsRoute({ zoneId: 'zone1', name: 'term-alice.dev.amazonprimea.com', tunnelId: 'tun1' });
+  await cf.upsertDnsRoute({ zoneId: 'zone1', name: 'term-alice.dev.example.com', tunnelId: 'tun1' });
   assert.equal(posted.type, 'CNAME');
   assert.equal(posted.content, 'tun1.cfargotunnel.com');
   assert.equal(posted.proxied, true);
@@ -148,11 +148,11 @@ await ta('upsertDnsRoute POSTs a proxied CNAME to cfargotunnel when absent', asy
 await ta('upsertDnsRoute PUTs (updates) when the record already exists', async () => {
   let method = null;
   const { fetchImpl } = makeFetch({
-    'GET /zones/zone1/dns_records': () => [{ id: 'rec-existing', name: 'term-alice.dev.amazonprimea.com' }],
+    'GET /zones/zone1/dns_records': () => [{ id: 'rec-existing', name: 'term-alice.dev.example.com' }],
     'PUT /zones/zone1/dns_records/rec-existing': ({ body }) => { method = 'PUT'; return { id: 'rec-existing', ...body }; },
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.upsertDnsRoute({ zoneId: 'zone1', name: 'term-alice.dev.amazonprimea.com', tunnelId: 'tun1' });
+  await cf.upsertDnsRoute({ zoneId: 'zone1', name: 'term-alice.dev.example.com', tunnelId: 'tun1' });
   assert.equal(method, 'PUT');
 });
 
@@ -183,10 +183,10 @@ await ta('ensureNamedTunnel composes create→configure→token→zone→dns and
     'POST /zones/zoneZ/dns_records': ({ body }) => ({ id: 'recZ', ...body }),
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'amazonprimea.com', terminalZone: 'dev.amazonprimea.com' });
+  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'example.com', terminalZone: 'dev.example.com' });
   assert.equal(r.tunnelId, 'tunZ');
   assert.equal(r.token, 'tokZ');
-  assert.equal(r.hostname, 'term-carol.dev.amazonprimea.com');
+  assert.equal(r.hostname, 'term-carol.dev.example.com');
   // the create used the deterministic per-builder name
   assert.ok(calls.some((c) => c.method === 'POST' && c.path.endsWith('/cfd_tunnel') && c.body.name === 'otb-term-carol'));
 });
@@ -194,14 +194,14 @@ await ta('ensureNamedTunnel composes create→configure→token→zone→dns and
 await ta('teardownNamedTunnel deletes DNS + tunnel and never throws', async () => {
   const { fetchImpl, calls } = makeFetch({
     'GET /zones': () => [{ id: 'zoneZ' }],
-    'GET /zones/zoneZ/dns_records': () => [{ id: 'recZ', name: 'term-dan.dev.amazonprimea.com' }],
+    'GET /zones/zoneZ/dns_records': () => [{ id: 'recZ', name: 'term-dan.dev.example.com' }],
     'DELETE /zones/zoneZ/dns_records/recZ': () => ({ id: 'recZ' }),
     'GET /accounts/acct123/cfd_tunnel': () => [{ id: 'tunZ', name: 'otb-term-dan' }],
     'DELETE /accounts/acct123/cfd_tunnel/tunZ/connections': () => ({}),
     'DELETE /accounts/acct123/cfd_tunnel/tunZ': () => ({ id: 'tunZ' }),
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const out = await cf.teardownNamedTunnel({ login: 'dan', zone: 'amazonprimea.com', terminalZone: 'dev.amazonprimea.com' });
+  const out = await cf.teardownNamedTunnel({ login: 'dan', zone: 'example.com', terminalZone: 'dev.example.com' });
   assert.equal(out.dnsDeleted, true);
   assert.equal(out.tunnelDeleted, true);
   assert.deepEqual(out.errors, []);
@@ -215,7 +215,7 @@ await ta('teardownNamedTunnel on a missing tunnel/record is graceful (no throw,
     'GET /accounts/acct123/cfd_tunnel': () => [],
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const out = await cf.teardownNamedTunnel({ login: 'ghost', zone: 'amazonprimea.com', terminalZone: 'dev.amazonprimea.com' });
+  const out = await cf.teardownNamedTunnel({ login: 'ghost', zone: 'example.com', terminalZone: 'dev.example.com' });
   assert.equal(out.dnsDeleted, false);
   assert.equal(out.tunnelDeleted, false);
   assert.deepEqual(out.errors, []);
@@ -227,7 +227,7 @@ await ta('teardown collects errors per-leg without throwing', async () => {
     'GET /accounts/acct123/cfd_tunnel': () => [{ id: 'tunZ', name: 'otb-term- err' }],
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const out = await cf.teardownNamedTunnel({ login: 'err', zone: 'amazonprimea.com', terminalZone: 'dev.amazonprimea.com' });
+  const out = await cf.teardownNamedTunnel({ login: 'err', zone: 'example.com', terminalZone: 'dev.example.com' });
   assert.ok(out.errors.some((e) => /dns/.test(e)), 'dns failure recorded');
 });
 
@@ -240,12 +240,12 @@ await ta('putConfiguration inserts extraRoutes between the primary host and the
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
   await cf.putConfiguration('tun1', {
-    hostname: 'term-alice.dev.amazonprimea.com',
-    extraRoutes: [{ hostname: 'sandbox-alice.dev.amazonprimea.com', service: GAME_SERVICE }],
+    hostname: 'term-alice.dev.example.com',
+    extraRoutes: [{ hostname: 'sandbox-alice.dev.example.com', service: GAME_SERVICE }],
   });
   assert.equal(seen.config.ingress.length, 3, 'ttyd + game + catch-all');
-  assert.deepEqual(seen.config.ingress[0], { hostname: 'term-alice.dev.amazonprimea.com', service: 'http://127.0.0.1:7681' });
-  assert.deepEqual(seen.config.ingress[1], { hostname: 'sandbox-alice.dev.amazonprimea.com', service: 'http://127.0.0.1:3000' });
+  assert.deepEqual(seen.config.ingress[0], { hostname: 'term-alice.dev.example.com', service: 'http://127.0.0.1:7681' });
+  assert.deepEqual(seen.config.ingress[1], { hostname: 'sandbox-alice.dev.example.com', service: 'http://127.0.0.1:3000' });
   assert.deepEqual(seen.config.ingress[2], { service: 'http_status:404' }, 'catch-all stays last');
 });
 
@@ -262,15 +262,15 @@ await ta('ensureNamedTunnel adds the game preview route + its own CNAME and retu
     'POST /zones/zoneZ/dns_records': ({ body }) => { dnsPosts.push(body.name); return { id: `rec-${body.name}`, ...body }; },
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'amazonprimea.com', terminalZone: 'dev.amazonprimea.com' });
+  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'example.com', terminalZone: 'dev.example.com' });
   // returns the deterministic preview host alongside the terminal host
-  assert.equal(r.previewHostname, 'sandbox-carol.dev.amazonprimea.com');
-  assert.equal(r.hostname, 'term-carol.dev.amazonprimea.com');
+  assert.equal(r.previewHostname, 'sandbox-carol.dev.example.com');
+  assert.equal(r.hostname, 'term-carol.dev.example.com');
   // the ingress now carries the game route at 127.0.0.1:3000
-  assert.deepEqual(putBody.config.ingress[1], { hostname: 'sandbox-carol.dev.amazonprimea.com', service: GAME_SERVICE });
+  assert.deepEqual(putBody.config.ingress[1], { hostname: 'sandbox-carol.dev.example.com', service: GAME_SERVICE });
   // BOTH hostnames get a proxied CNAME
-  assert.ok(dnsPosts.includes('term-carol.dev.amazonprimea.com'), 'terminal CNAME upserted');
-  assert.ok(dnsPosts.includes('sandbox-carol.dev.amazonprimea.com'), 'preview CNAME upserted');
+  assert.ok(dnsPosts.includes('term-carol.dev.example.com'), 'terminal CNAME upserted');
+  assert.ok(dnsPosts.includes('sandbox-carol.dev.example.com'), 'preview CNAME upserted');
 });
 
 await ta('teardownNamedTunnel also deletes the preview CNAME', async () => {
@@ -279,8 +279,8 @@ await ta('teardownNamedTunnel also deletes the preview CNAME', async () => {
     'GET /zones': () => [{ id: 'zoneZ' }],
     'GET /zones/zoneZ/dns_records': ({ query }) => {
       const n = query.name;
-      if (n === 'term-dan.dev.amazonprimea.com') return [{ id: 'recTerm', name: n }];
-      if (n === 'sandbox-dan.dev.amazonprimea.com') return [{ id: 'recGame', name: n }];
+      if (n === 'term-dan.dev.example.com') return [{ id: 'recTerm', name: n }];
+      if (n === 'sandbox-dan.dev.example.com') return [{ id: 'recGame', name: n }];
       return [];
     },
     'DELETE /zones/zoneZ/dns_records/recTerm': () => { deletedDns.push('term'); return { id: 'recTerm' }; },
@@ -290,7 +290,7 @@ await ta('teardownNamedTunnel also deletes the preview CNAME', async () => {
     'DELETE /accounts/acct123/cfd_tunnel/tunZ': () => ({ id: 'tunZ' }),
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const out = await cf.teardownNamedTunnel({ login: 'dan', zone: 'amazonprimea.com', terminalZone: 'dev.amazonprimea.com' });
+  const out = await cf.teardownNamedTunnel({ login: 'dan', zone: 'example.com', terminalZone: 'dev.example.com' });
   assert.equal(out.dnsDeleted, true);
   assert.equal(out.previewDnsDeleted, true, 'preview CNAME removed');
   assert.equal(out.tunnelDeleted, true);
@@ -310,7 +310,7 @@ await ta('ensureCookieStripRule PUTs a remove-Cookie rule scoped to term-*/sandb
     [`PUT ${RULESET_PATH}`]: ({ body }) => { put = body; return { id: 'rs1', rules: body.rules }; },
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCookieStripRule({ zone: 'amazonprimea.com' });
+  await cf.ensureCookieStripRule({ zone: 'example.com' });
   assert.equal(put.rules.length, 1, 'one rule on a previously-empty phase');
   const rule = put.rules[0];
   assert.equal(rule.action, 'rewrite');
@@ -330,7 +330,7 @@ await ta('ensureCookieStripRule preserves OTHER transform rules and is idempoten
     [`PUT ${RULESET_PATH}`]: ({ body }) => { put = body; return { id: 'rs1', rules: body.rules }; },
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCookieStripRule({ zone: 'amazonprimea.com' });
+  await cf.ensureCookieStripRule({ zone: 'example.com' });
   // exactly two rules: the foreign one (kept) + ONE fresh copy of ours (no dupes)
   assert.equal(put.rules.length, 2);
   const ours = put.rules.filter((r) => /otb-919/.test(r.description));
@@ -351,7 +351,7 @@ await ta('ensureCookieStripRule creates the phase entrypoint when none exists (4
     [`PUT ${RULESET_PATH}`]: ({ body }) => { put = body; return { id: 'rs-new', rules: body.rules }; },
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCookieStripRule({ zone: 'amazonprimea.com' });
+  await cf.ensureCookieStripRule({ zone: 'example.com' });
   assert.equal(put.rules.length, 1, 'a 404 entrypoint is treated as empty, our rule is created');
 });
 
@@ -370,9 +370,9 @@ await ta('ensureCookieStripRule failure does NOT block ensureNamedTunnel (best-e
     // ensureNamedTunnel's try/catch and is logged, not thrown.
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'amazonprimea.com', terminalZone: 'amazonprimea.com' });
+  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'example.com', terminalZone: 'example.com' });
   assert.equal(r.token, 'tokZ', 'provisioning completes despite the cookie-strip rule failing');
-  assert.equal(r.hostname, 'term-carol.amazonprimea.com');
+  assert.equal(r.hostname, 'term-carol.example.com');
   // task 1002511: the failure is reported STRUCTURALLY, not only logged, so box.js
   // can surface it in the provision summary instead of burying it mid-run.
   assert.equal(r.edgeRules.cookieStrip.applied, false, 'a failed cookie-strip PUT must never report applied');
@@ -391,7 +391,7 @@ await ta('ensureCacheBypassRule PUTs a cache:false rule scoped to sandbox-* (not
     [`PUT ${CACHE_PATH}`]: ({ body }) => { put = body; return { id: 'rs1', rules: body.rules }; },
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCacheBypassRule({ zone: 'amazonprimea.com' });
+  await cf.ensureCacheBypassRule({ zone: 'example.com' });
   assert.equal(put.rules.length, 1);
   const rule = put.rules[0];
   assert.equal(rule.action, 'set_cache_settings');
@@ -399,7 +399,7 @@ await ta('ensureCacheBypassRule PUTs a cache:false rule scoped to sandbox-* (not
   assert.match(rule.expression, /sandbox-/);
   assert.doesNotMatch(rule.expression, /term-/, 'ttyd hosts are not cache-ruled');
   // prod-safety: the apex must NOT satisfy the expression
-  assert.ok(!'amazonprimea.com'.startsWith('sandbox-'), 'apex never matches sandbox-*');
+  assert.ok(!'example.com'.startsWith('sandbox-'), 'apex never matches sandbox-*');
   assert.equal(rule.enabled, true);
 });
 
@@ -413,7 +413,7 @@ await ta('ensureCacheBypassRule preserves OTHER cache rules and is idempotent on
     [`PUT ${CACHE_PATH}`]: ({ body }) => { put = body; return { id: 'rs1', rules: body.rules }; },
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCacheBypassRule({ zone: 'amazonprimea.com' });
+  await cf.ensureCacheBypassRule({ zone: 'example.com' });
   assert.equal(put.rules.length, 2);
   assert.equal(put.rules.filter((r) => r.description === CACHE_BYPASS_RULE_DESC).length, 1, 'our rule de-duplicated');
   const kept = put.rules.find((r) => r.description === 'someone-elses-cache-rule');
@@ -431,7 +431,7 @@ await ta('ensureCacheBypassRule creates the cache phase entrypoint when none exi
     [`PUT ${CACHE_PATH}`]: ({ body }) => { put = body; return { id: 'rs-new', rules: body.rules }; },
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCacheBypassRule({ zone: 'amazonprimea.com' });
+  await cf.ensureCacheBypassRule({ zone: 'example.com' });
   assert.equal(put.rules.length, 1);
 });
 
@@ -448,7 +448,7 @@ await ta('ensureCacheBypassRule failure does NOT block ensureNamedTunnel (best-e
     'POST /zones/zoneZ/dns_records': ({ body }) => ({ id: `rec-${body.name}`, ...body }),
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'amazonprimea.com', terminalZone: 'amazonprimea.com' });
+  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'example.com', terminalZone: 'example.com' });
   assert.equal(r.token, 'tokZ', 'provisioning completes despite the cache rule failing');
   assert.equal(r.edgeRules.cacheBypass.applied, false);
   assert.ok(r.edgeRules.cacheBypass.error, 'the cache-rule failure reason is captured');
@@ -471,7 +471,7 @@ await ta('ensureNamedTunnel reports edgeRules.applied on the success path (both
     [`PUT ${CS}`]: ({ body }) => ({ id: 'rs2', rules: body.rules }),
   });
   const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'amazonprimea.com', terminalZone: 'amazonprimea.com' });
+  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'example.com', terminalZone: 'example.com' });
   assert.equal(r.edgeRules.cookieStrip.applied, true);
   assert.equal(r.edgeRules.cookieStrip.error, null);
   assert.equal(r.edgeRules.cacheBypass.applied, true);
@@ -480,7 +480,7 @@ await ta('ensureNamedTunnel reports edgeRules.applied on the success path (both
 
 await ta('ensureNamedTunnel in DRY-RUN reports applied:false (a plan never applied anything)', async () => {
   const cf = new CfTunnelApi({ accountId: ACCT, fetchImpl: () => { throw new Error('should not fetch'); } });
-  const r = await cf.ensureNamedTunnel({ login: 'alice', zone: 'amazonprimea.com', terminalZone: 'amazonprimea.com' });
+  const r = await cf.ensureNamedTunnel({ login: 'alice', zone: 'example.com', terminalZone: 'example.com' });
   assert.equal(r.edgeRules.cookieStrip.applied, false, 'dry-run must not read as "the security rule is in place"');
   assert.equal(r.edgeRules.cacheBypass.applied, false);
 });
@@ -488,8 +488,8 @@ await ta('ensureNamedTunnel in DRY-RUN reports applied:false (a plan never appli
 console.log('name helpers:');
 t('tunnelName / terminalHostname / previewHostname are deterministic', () => {
   assert.equal(tunnelName('alice'), 'otb-term-alice');
-  assert.equal(terminalHostname('alice', 'dev.amazonprimea.com'), 'term-alice.dev.amazonprimea.com');
-  assert.equal(previewHostname('alice', 'amazonprimea.com'), 'sandbox-alice.amazonprimea.com');
+  assert.equal(terminalHostname('alice', 'dev.example.com'), 'term-alice.dev.example.com');
+  assert.equal(previewHostname('alice', 'example.com'), 'sandbox-alice.example.com');
 });
 
 console.log(`\ncf-tunnel: ${passed} passed, ${failed} failed`);

package/tests/cli_package.mjs

@@ -185,7 +185,13 @@ test('the packed tarball installs and every verb runs with no repo present', (t)
   // base or on missing arguments. Failing that way is fine; failing to find a file is not.
   const LOAD_ARGS = {
     login:   ['login'],
-    reauth:  ['reauth'],
+    // `--no-open` is load-bearing, not cosmetic (task 1003909). HOME is a throwaway here, so
+    // there is no session and reauth takes its no-session path — which launches the builder's
+    // default browser at the dead API base (`rundll32 url.dll,FileProtocolHandler` on Windows).
+    // Without the flag, every run of this suite pops a connection-refused tab on the machine
+    // under test. The flag skips only the spawn: the script still loads, still prints its
+    // guidance, still exits 10, so every assertion below is unchanged.
+    reauth:  ['reauth', '--no-open'],
     setup:   ['setup'],
     box:     ['box'],
     shell:   ['shell'],
@@ -203,9 +209,42 @@ test('the packed tarball installs and every verb runs with no repo present', (t)
     'every advertised verb needs an entry here, or it goes unexercised',
   );
 
+  // No verb may launch a GUI on the machine running the suite (task 1003909). A script that can
+  // spawn a browser has two ways to be safe here, and it must pick one:
+  //   * it offers an opt-out flag   → the LOAD_ARGS entry above passes it, or
+  //   * it stops short of the launch → STOPS_SHORT_OF_LAUNCH names a marker that must stay absent.
+  // Proving it, rather than assuming it, is the point: a verb that starts reaching its launcher
+  // fails here instead of on someone's desktop.
+  const LAUNCHES_BROWSER = /FileProtocolHandler|xdg-open/;
+  const OPT_OUT = '--no-open';
+  const STOPS_SHORT_OF_LAUNCH = {
+    // `bongos login` opens a browser from inside the device flow, several network steps past the
+    // instance-URL prompt — and with empty stdin that prompt is never answered, so the process
+    // ends right there. `▸ Connecting to` is the first thing printed once a URL is accepted, so
+    // its ABSENCE is the proof this run stopped well short of the launch.
+    login: /Connecting to/,
+  };
+  const mustStopShort = {};
+  for (const [verb, args] of Object.entries(LOAD_ARGS)) {
+    const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', VERBS[verb].script), 'utf8');
+    if (!LAUNCHES_BROWSER.test(src)) continue;
+    if (src.includes(OPT_OUT)) {
+      assert.ok(args.includes(OPT_OUT),
+        `bongos ${verb} can spawn a browser and accepts ${OPT_OUT} — pass it in LOAD_ARGS, or this suite opens a window on the builder's machine`);
+      continue;
+    }
+    assert.ok(STOPS_SHORT_OF_LAUNCH[verb],
+      `bongos ${verb} can spawn a browser and has no ${OPT_OUT} — give it one, or add a STOPS_SHORT_OF_LAUNCH entry proving this run never reaches the launch`);
+    mustStopShort[verb] = STOPS_SHORT_OF_LAUNCH[verb];
+  }
+
   for (const [verb, args] of Object.entries(LOAD_ARGS)) {
     const res = runVerb(args);
     const all = `${res.stdout}\n${res.stderr}`;
+    if (mustStopShort[verb]) {
+      assert.doesNotMatch(all, mustStopShort[verb],
+        `bongos ${verb} got past the point where it can spawn a browser on this machine:\n${all}`);
+    }
     assert.ok(!/Cannot find module|MODULE_NOT_FOUND|ERR_MODULE_NOT_FOUND/.test(all),
       `bongos ${verb} hit a missing file — the manifest is incomplete:\n${all}`);
     assert.ok(!/ERR_REQUIRE_ESM|SyntaxError|ReferenceError/.test(all),

package/tests/cli_token_reissue.mjs

@@ -53,10 +53,10 @@ t('preserves gemini_api_key across token rotation', () => {
   const existing = {
     token: 'old-token',
     builder: { id: '1', github_login: 'a' },
-    api_base: 'https://amazonprimea.com',
+    api_base: 'https://example.com',
     gemini_api_key: 'AIzaSy_TEST_KEY',
   };
-  const merged = mergeSession(existing, { builder: { id: '1', github_login: 'a', rank: 'archon' } }, 'new-token-1234', 'https://amazonprimea.com');
+  const merged = mergeSession(existing, { builder: { id: '1', github_login: 'a', rank: 'archon' } }, 'new-token-1234', 'https://example.com');
   assert.equal(merged.gemini_api_key, 'AIzaSy_TEST_KEY');
   assert.equal(merged.token, 'new-token-1234');
   assert.equal(merged.builder.rank, 'archon', 'fresh builder rank must overwrite stale rank');
@@ -66,15 +66,15 @@ t('writes token even when existing has no gemini_api_key', () => {
   const existing = {
     token: 'old',
     builder: { id: '1', github_login: 'a' },
-    api_base: 'https://amazonprimea.com',
+    api_base: 'https://example.com',
   };
-  const merged = mergeSession(existing, { builder: { id: '1', github_login: 'a' } }, 'fresh', 'https://amazonprimea.com');
+  const merged = mergeSession(existing, { builder: { id: '1', github_login: 'a' } }, 'fresh', 'https://example.com');
   assert.equal(merged.token, 'fresh');
   assert.equal(merged.gemini_api_key, undefined);
 });
 
 t('handles a completely empty existing session (first-time paste)', () => {
-  const merged = mergeSession({}, { builder: { id: '7', github_login: 'newbie' } }, 'first-token', 'https://amazonprimea.com');
+  const merged = mergeSession({}, { builder: { id: '7', github_login: 'newbie' } }, 'first-token', 'https://example.com');
   assert.equal(merged.token, 'first-token');
   assert.equal(merged.builder.id, '7');
 });
@@ -85,11 +85,11 @@ t('forward-compatible: an unknown field (future-proofing) survives the merge', (
   const existing = {
     token: 'old',
     builder: { id: '1' },
-    api_base: 'https://amazonprimea.com',
+    api_base: 'https://example.com',
     gemini_api_key: 'k',
     model_preference: 'opus-only', // hypothetical future field
   };
-  const merged = mergeSession(existing, { builder: { id: '1' } }, 'new', 'https://amazonprimea.com');
+  const merged = mergeSession(existing, { builder: { id: '1' } }, 'new', 'https://example.com');
   assert.equal(merged.model_preference, 'opus-only');
 });
 

package/tests/cloud_bongos_pack.mjs

@@ -95,7 +95,7 @@ test('customer-0: GDS_BRANDING_FILE selects the cloudbongos.com instance pack (t
   assert.equal(b.domains.statusOrigin, 'https://status.cloudbongos.com');
   assert.equal(b.domains.cookieDomain, '.cloudbongos.com');
   assert.equal(b.db.database, 'cloudbongos');
-  assert.equal(b.firstAdmin, 'lars589');
+  assert.equal(b.firstAdmin, 'example-owner');
 });
 
 test('customer-0: no GDS_BRANDING_FILE still resolves the instance pack (default unchanged)', (t) => {

package/tests/currency_label.mjs

@@ -13,7 +13,7 @@ const { clientBranding } = brandingMod;
 const { injectBrandingGlobal, themeMarkup, injectModuleHallWidgets } = serveInternal;
 
 const OTB_ISH = {
-  identity: { productName: 'Off the Boats', worldName: 'Amazonprimea', company: { name: 'Hermeslines', site: 'x' } },
+  identity: { productName: 'Example World', worldName: 'Example', company: { name: 'Hermeslines', site: 'x' } },
   currency: { label: 'drachmae', symbol: '' },
   theme: { palette: 'art/template/palette.json', mode: 'pixel-greek', ui: {
     colors: { bg: '#ece0c2', ink: '#2a2110', accent: '#4a7d5c' },
@@ -21,7 +21,7 @@ const OTB_ISH = {
     favicon: "data:image/svg+xml;utf8,<svg/>",
   } },
   rankLabels: { xenos: 'Xenos', archon: 'Archon' },
-  copy: { tagline: 'Goods straight off the boats.', hallName: "Builders' Hall", notFound: 'washed ashore' },
+  copy: { tagline: 'Goods straight example world.', hallName: "Builders' Hall", notFound: 'washed ashore' },
 };
 
 test('R56: clientBranding exposes the configurable currency label', () => {
@@ -31,13 +31,13 @@ test('R56: clientBranding exposes the configurable currency label', () => {
 
 test('R57: clientBranding exposes identity + theme + rankLabels', () => {
   const c = clientBranding(OTB_ISH);
-  assert.equal(c.identity.worldName, 'Amazonprimea');
-  assert.equal(c.identity.productName, 'Off the Boats');
+  assert.equal(c.identity.worldName, 'Example');
+  assert.equal(c.identity.productName, 'Example World');
   assert.equal(c.theme.colors.bg, '#ece0c2');
   assert.equal(c.theme.fonts.display, '"Cinzel", serif');
   assert.deepEqual(c.theme.fonts.links, ['https://fonts.example/css']);
   assert.equal(c.rankLabels.archon, 'Archon');
-  assert.equal(c.copy.tagline, 'Goods straight off the boats.');
+  assert.equal(c.copy.tagline, 'Goods straight example world.');
 });
 
 test('R57: clientBranding exposes theme.ui (web), NOT theme.palette (server-only game path)', () => {
@@ -65,9 +65,9 @@ test('clientBranding exposes project policy — the settings read-back (task 100
 test('clientBranding is a SMALL allow-list — no server-only field leaks to the browser', () => {
   const projected = clientBranding({
     ...OTB_ISH,
-    domains: { publicOrigin: 'https://amazonprimea.com', cookieDomain: '.amazonprimea.com' },
-    repo: { owner: 'lars589', name: 'amazonprimea' },
-    db: { database: 'amazonprimea' },
+    domains: { publicOrigin: 'https://example.com', cookieDomain: '.example.com' },
+    repo: { owner: 'example-owner', name: 'example' },
+    db: { database: 'example' },
     envPrefix: 'OTB',
   });
   // `reward` joined the projection in task 1002469 (ADR 0146 follow-up) — the resolved

package/tests/dev_lib.mjs

@@ -70,19 +70,19 @@ t('deriveDbName: override > branding > repo dir > default', () => {
 // ---------- branding facts (instance over neutral) ----------
 t('loadBrandingFacts: instance pack wins, neutral fills gaps', () => {
   const f = fakeFs({
-    'config/branding.json': JSON.stringify({ domains: { publicOrigin: 'http://localhost:3006' }, firstAdmin: 'lars589', envPrefix: 'CLOUDBONGOS' }),
+    'config/branding.json': JSON.stringify({ domains: { publicOrigin: 'http://localhost:3006' }, firstAdmin: 'example-owner', envPrefix: 'CLOUDBONGOS' }),
     'config/branding.neutral.json': NEUTRAL,
   });
   const facts = lib.loadBrandingFacts({ instanceRoot: '/x/test4', coreRoot: '/core', f });
   assert.equal(facts.publicOrigin, 'http://localhost:3006');
-  assert.equal(facts.firstAdmin, 'lars589');
+  assert.equal(facts.firstAdmin, 'example-owner');
   assert.equal(facts.configDir, 'cloudbongos');
 });
 
 // ---------- full run params ----------
 t('resolveRunParams: port from branding, db from repo dir, TCP localhost, gdsOnly', () => {
   const f = fakeFs({
-    'config/branding.json': JSON.stringify({ domains: { publicOrigin: 'http://localhost:3006' }, firstAdmin: 'lars589' }),
+    'config/branding.json': JSON.stringify({ domains: { publicOrigin: 'http://localhost:3006' }, firstAdmin: 'example-owner' }),
     'config/branding.neutral.json': NEUTRAL,
     'config/modules.json': JSON.stringify({ modules: { game: false } }),
   });
@@ -93,7 +93,7 @@ t('resolveRunParams: port from branding, db from repo dir, TCP localhost, gdsOnl
   assert.equal(p.pgUser, 'lars');
   assert.equal(p.gdsOnly, true);         // game off -> skip OTB seeds
   assert.equal(p.publicOrigin, 'http://localhost:3006');
-  assert.equal(p.firstAdmin, 'lars589');
+  assert.equal(p.firstAdmin, 'example-owner');
 });
 
 t('resolveRunParams: game module ON -> not GDS-only; env PGHOST/PGUSER honored', () => {

package/tests/devbox_dmg_backdrop.mjs

@@ -114,7 +114,7 @@ test('a pack filling the documented theme surface leaves NO neutral colour on th
 test('the generator carries no host-brand copy or motif of its own', () => {
   const code = codeOnly(source);
   // The archaic install copy + the world motifs that shipped into the vanilla build.
-  for (const re of [/thine/i, /ashore/i, /amazonprimea/i, /off the boats/i, /meander/i, /greek/i, /marble/i]) {
+  for (const re of [/thine/i, /ashore/i, /example/i, /example world/i, /meander/i, /greek/i, /marble/i]) {
     assert.doesNotMatch(code, re, `host-brand literal ${re} must not appear in the generator's code`);
   }
   // Copy is derived from the pack (or overridden by it), never a fixed sentence.

package/tests/devbox_downloads.mjs

@@ -23,7 +23,7 @@ function t(name, fn) {
 }
 
 const CFG = {
-  releases_repo: 'lars589/amazonprimea-devbox',
+  releases_repo: 'example-owner/example-devbox',
   version: '1.2.3',
   assets: {
     'mac-arm64': 'OTB-Dev-Box-1.2.3-arm64.dmg',
@@ -38,7 +38,7 @@ t('maps a known target to the versioned release-asset URL', () => {
   const d = buildDevboxDownloads(CFG);
   assert.equal(
     d.redirectFor('mac-arm64'),
-    'https://github.com/lars589/amazonprimea-devbox/releases/download/v1.2.3/OTB-Dev-Box-1.2.3-arm64.dmg'
+    'https://github.com/example-owner/example-devbox/releases/download/v1.2.3/OTB-Dev-Box-1.2.3-arm64.dmg'
   );
 });
 

package/tests/devbox_icons.mjs

@@ -226,7 +226,7 @@ test('a pack filling the documented theme surface leaves NO neutral colour on th
 });
 
 test('the generator carries no host-brand motif of its own', () => {
-  for (const re of [/off the boats/i, /amazonprimea/i, /shipping[- ]container/i, /greek/i, /meander/i, /parchment/i]) {
+  for (const re of [/example world/i, /example/i, /shipping[- ]container/i, /greek/i, /meander/i, /parchment/i]) {
     assert.doesNotMatch(code, re, `host-brand literal ${re} must not appear in the generator's code`);
   }
 });

package/tests/discord_approvals.mjs

@@ -74,7 +74,7 @@ await t('memberApprovalLine round-trips through parseApprovalMarker', () => {
 
 // ---- recordApprovalReaction (orchestration via fakes) ----------------------
 const GOOD_ID = '123456789012345678';
-const archon = { id: 1, rank: 'archon', github_login: 'lars589' };
+const archon = { id: 1, rank: 'archon', github_login: 'example-owner' };
 
 function makeDeps(over = {}) {
   const calls = { member: [], audit: [] };

package/tests/discord_oauth.mjs

@@ -27,7 +27,7 @@ function t(name, fn) {
 console.log('Discord OAuth helpers (Phase 3 F2):');
 
 await t('discordAuthorizeUrl carries client_id, identify+guilds.join scope, code response, state, redirect', () => {
-  const url = auth.discordAuthorizeUrl('123456789012345678', 'abc123state', 'https://amazonprimea.com/api/gds/auth/discord/callback');
+  const url = auth.discordAuthorizeUrl('123456789012345678', 'abc123state', 'https://example.com/api/gds/auth/discord/callback');
   const u = new URL(url);
   assert.equal(u.origin + u.pathname, 'https://discord.com/api/oauth2/authorize');
   assert.equal(u.searchParams.get('client_id'), '123456789012345678');
@@ -36,7 +36,7 @@ await t('discordAuthorizeUrl carries client_id, identify+guilds.join scope, code
   assert.equal(u.searchParams.get('scope'), 'identify guilds.join');
   assert.equal(u.searchParams.get('response_type'), 'code');
   assert.equal(u.searchParams.get('state'), 'abc123state');
-  assert.equal(u.searchParams.get('redirect_uri'), 'https://amazonprimea.com/api/gds/auth/discord/callback');
+  assert.equal(u.searchParams.get('redirect_uri'), 'https://example.com/api/gds/auth/discord/callback');
 });
 
 await t('isValidDiscordUserId accepts a 17–20 digit snowflake', () => {

package/tests/executed_closure.mjs

@@ -90,7 +90,12 @@ test('every computed require inside the closure is one we have accounted for', (
   const ACCOUNTED = new Map([
     ['src/module-loader/loader.js', 2],   // routes/<key>.js + pollerPath, from loadModules()
     ['scripts/gds/onboard.js', 3],        // provision/oauth-secret/onboardPlan, inside the verb
-    ['scripts/gds/package-core.js', 5],   // publish-manifest/mirror-redact/secret-scrub/…
+    // 6th added by task 1003869: leak-scan-allowlist.js. Unlike the others this one IS
+    // top-level, so it resolves whenever package-core is required — but it does not widen
+    // the closure: the module is pure data plus three predicates, does no I/O, dispatches
+    // nothing dynamically, and its single require (back to package-core, for the literal
+    // floor) is lazy and inside a function.
+    ['scripts/gds/package-core.js', 6],   // publish-manifest/mirror-redact/secret-scrub/leak-scan-allowlist/…
     ['scripts/gds/upgrade.js', 1],        // a `node -e` child, not a require in this process
     ['scripts/gds/gen-api-docs.js', 1],   // require(path.join(CORE_ROOT,'package.json')) — JSON
   ]);

package/tests/first_admin_bootstrap.mjs

@@ -35,7 +35,7 @@ test('firstAdminLogin: env override wins over branding (configured prefix)', ()
 
 test('maybeSeatFirstAdmin: no-op when the builder is already an Archon (no DB call)', async () => {
   clearEnv();
-  const b = { id: 1, github_login: 'lars589', rank: 'archon' };
+  const b = { id: 1, github_login: 'example-owner', rank: 'archon' };
   const out = await maybeSeatFirstAdmin(b);
   assert.equal(out.rank, 'archon');
 });

package/tests/gate_approvals.mjs

@@ -56,7 +56,7 @@ function fakeRes() {
   attachFail({}, res, () => {}); // install res.fail() as the router does (task 1991)
   return res;
 }
-const ARCHON = { id: 1, rank: 'archon', github_login: 'lars589' };
+const ARCHON = { id: 1, rank: 'archon', github_login: 'example-owner' };
 
 // Snapshot/restore the github-push functions a route test stubs, so layers don't bleed.
 function withStubs(stubs, fn) {
@@ -180,13 +180,13 @@ await t('getPullRequestFiles: rejects a non-positive PR number before any fetch'
 await t('setGateOwnerApproved: POSTs a gate-owner-approved success status on the sha', async () => {
   let captured = null;
   const fetchImpl = async (url, opts) => { captured = { url, body: JSON.parse(opts.body) }; return { ok: true }; };
-  const ok = await gp.setGateOwnerApproved({ sha: SHA, login: 'lars589' }, { token: 'T', repoInfo: REPO, fetchImpl });
+  const ok = await gp.setGateOwnerApproved({ sha: SHA, login: 'example-owner' }, { token: 'T', repoInfo: REPO, fetchImpl });
   assert.equal(ok, true);
   assert.ok(captured.url.endsWith(`/statuses/${SHA}`), captured.url);
   assert.equal(captured.body.context, gp.GATE_OWNER_APPROVED_CONTEXT);
   assert.equal(captured.body.context, 'gate-owner-approved');
   assert.equal(captured.body.state, 'success');
-  assert.ok(/lars589/.test(captured.body.description), 'records who approved');
+  assert.ok(/example-owner/.test(captured.body.description), 'records who approved');
 });
 
 await t('recheckPullRequest: PATCHes state=closed then state=open, then re-arms auto-merge', async () => {
@@ -332,7 +332,7 @@ await t('POST approve: sets the owner-approval status on the head sha + re-runs
     assert.equal(res.statusCode, 200);
     assert.equal(res.body.ok, true);
     assert.equal(res.body.status_set, true);
-    assert.deepEqual(approved, { sha: SHA, login: 'lars589' }, 'approval is sha-pinned to head + records the Archon');
+    assert.deepEqual(approved, { sha: SHA, login: 'example-owner' }, 'approval is sha-pinned to head + records the Archon');
     assert.equal(rechecked, 201, 'the gate check is re-run for the PR');
   });
 });
@@ -353,7 +353,7 @@ await t('POST approve: still works when checks are unreadable (no gate-review ch
     await handler({ builder: ARCHON, params: { pr: '167' }, body: {} }, res);
     assert.equal(res.statusCode, 200);
     assert.equal(res.body.status_set, true);
-    assert.deepEqual(approved, { sha: SHA, login: 'lars589' });
+    assert.deepEqual(approved, { sha: SHA, login: 'example-owner' });
     assert.equal(rechecked, 167);
   });
 });

package/tests/grade_aggregates_unavailable.mjs

@@ -76,7 +76,7 @@ await test('gradeByBuilder: quality-filtered, and pass_rate is NULL (not 0.000)
   const sql = (await captureSql(() => db.gradeByBuilder(30)))[0];
   assertQualityFiltered(sql, 'gradeByBuilder');
   // The old shape ROUND(COALESCE(AVG(...),0),3) fabricated a 0.000 fail-streak
-  // for an all-outage window — the lars589 symptom. COALESCE must be gone from
+  // for an all-outage window — the example-owner symptom. COALESCE must be gone from
   // the pass_rate expression so it reads NULL ("no graded work") instead.
   assert.ok(!sql.includes('ROUND(COALESCE(AVG'), 'pass_rate must not coalesce an empty window to 0');
   assert.ok(/AVG\(CASE WHEN g\.passed THEN 1 ELSE 0 END\) FILTER/.test(sql), 'pass_rate must average quality rows only');

package/tests/hook_user_agents.mjs

@@ -3,8 +3,8 @@
 // task 2122 (demo-audit fix B) — the scaffolded .claude/hooks must NOT hardcode a
 // founder-instance brand in their outbound HTTP User-Agent. Those hooks are copied
 // into a consumer instance by claude-materialize, whose rebrand maps domain HOSTS
-// (amazonprimea.com), config dirs, and env prefixes — but NOT a bare brand token
-// like `amazonprimea-gds-cli` (no TLD). So a branded UA there leaks the founder's
+// (example.com), config dirs, and env prefixes — but NOT a bare brand token
+// like `example-gds-cli` (no TLD). So a branded UA there leaks the founder's
 // host-brand into every scaffolded instance (criterion gcarry-prod-vanilla).
 //
 // Invariant: every `'User-Agent': '<value>'` literal in .claude/hooks/*.js uses the