@bongos/core 1.19.79 → 1.19.81

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.79",
-  "core_contract": "1.19.79",
-  "source_commit": "ba59ac00319af3e83900b468e2feac5038806c60",
+  "core_version": "1.19.81",
+  "core_contract": "1.19.81",
+  "source_commit": "c19697303b3961520ebb175928cde6beddf00896",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T22:56:44.247Z",
+  "built_at": "2026-08-12T23:08:05.391Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 295,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1225,
+    "functional_verbatim": 1227,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1541,
-  "tree_sha256": "351a95bc990504fb425ec46898380ecd98b6518301c81afc6046244459dd15e0",
+  "file_count": 1543,
+  "tree_sha256": "799b7337a46edabc3eb3adca6a29fb43c274e1ab27a9b130d09a986d4177cd9b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -37,7 +37,7 @@
     {
       "path": ".claude/skills/builder-box/SKILL.md",
       "mode": "0000644",
-      "sha256": "a24e22a6e7102654d71a255210b260d2c2c0dd9047a5bab128fa3e44c6b511c9"
+      "sha256": "e131788fccfd87e882ef4e03798513cf7ff41047a2908fca8cf6314ff12e0524"
     },
     {
       "path": ".claude/skills/builder-claim/SKILL.md",
@@ -2982,7 +2982,7 @@
     {
       "path": "modules/hall-ui/public/box-panel.js",
       "mode": "0000644",
-      "sha256": "d4b32aa4382100a7e60cc83e83ef23ba34dac0ff759143286b2deaebb8f56cb1"
+      "sha256": "3834d4aac8cb7ebc604973e145f396d0893b4cf62abc530f2027c491b31c625d"
     },
     {
       "path": "modules/hall-ui/public/brand-apply.js",
@@ -4057,12 +4057,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c96137763abb2061735f0a815401ead7047d116c5eb6dd538178e9e23c9ca0bd"
+      "sha256": "845771b9d06a05dcb4eb8b90a0002b26d1fc105c2d27d24f870f89640fb09769"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "97227cfa1c95b171af85bd2f248f894ebe6f8795cd9364b6dc87180fc00e445e"
+      "sha256": "04febc37475484098b13f52462cda84d2a120c5ef64b7c2edf733e14ac6b3e1f"
     },
     {
       "path": "public-docs/index.html",
@@ -4467,7 +4467,7 @@
     {
       "path": "scripts/gds/api.js",
       "mode": "0000644",
-      "sha256": "e2df5d6f4436595aee60d338198c0c577c82490856ba4f5cd051ca48dc6a710d"
+      "sha256": "8f7332da44883801fb4674747c9e9a60e485353b36df6bebe1db8fc1ebd3558f"
     },
     {
       "path": "scripts/gds/api.ps1",
@@ -4552,7 +4552,7 @@
     {
       "path": "scripts/gds/box-sync.js",
       "mode": "0000644",
-      "sha256": "8169a34dcef766360d10c7d27c7404a776aeb0b8a43f8b91fc9bc12af35a8b1b"
+      "sha256": "981544bfd56d486c2017edd744c86089659771a74399b4780455821c45e3b3a9"
     },
     {
       "path": "scripts/gds/box.js",
@@ -4617,7 +4617,7 @@
     {
       "path": "scripts/gds/cli-lib.js",
       "mode": "0000644",
-      "sha256": "6c42a8ee151ba5e12475e50b0d113d306fd01c5c95100f131713fb3abeaa4e62"
+      "sha256": "e86444334085b00ff4256fcb6bf15e5f443dc75bdcbf8ca6eb87f0b41fcd3230"
     },
     {
       "path": "scripts/gds/code.js",
@@ -5687,7 +5687,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ff17cf82d49bb2e21188381d9621bbf4f5cf61ac3e49b10ea5ea32685d170c14"
+      "sha256": "3e4f5f5d1cb49b46416308dc7a4fa145b8260ca8dd0c63ed1a16ba499b622bc2"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6029,6 +6029,11 @@
       "mode": "0000644",
       "sha256": "93bc891850e77350161214749954ddb257169ae323b7242f35becc4e6a9cabcf"
     },
+    {
+      "path": "tests/box_sync_scope_report.mjs",
+      "mode": "0000644",
+      "sha256": "010525c500aa1d5133f85a1a2ea7c23e9a680b08493a6f3b78c69a5108501468"
+    },
     {
       "path": "tests/box_task_scope.mjs",
       "mode": "0000644",
@@ -6129,6 +6134,11 @@
       "mode": "0000644",
       "sha256": "b9258f690d5dc7c87bcbb12d510b3071a38669777ae9a92a99e683e76ea15e83"
     },
+    {
+      "path": "tests/cli_exit_no_abort.mjs",
+      "mode": "0000644",
+      "sha256": "7bc4d54d29458c70cd545aecac1ca1f7b8cc13d7b1dacaa90a8c2184ef553304"
+    },
     {
       "path": "tests/cli_lib_formatters.mjs",
       "mode": "0000644",

package/.claude/skills/builder-box/SKILL.md

@@ -7,7 +7,7 @@ You are showing a builder the status of **their own** dev box and helping them g
 
 ## Background
 
-The per-builder box lifecycle (ADR 0031 §2) auto-suspends when idle (snapshot-and-park) and recreates on demand, so a builder's box is often `parked` between sessions — that's normal and cheap, not a problem. The read API:
+The per-builder box lifecycle (ADR 0031 §2) auto-suspends when idle (snapshot-and-park) and recreates on demand, so a builder's box is often `parked` between sessions — that's normal and cheap, not a problem. **The idle sweep parks; it does not destroy** (task 1002726 — it *did* destroy droplet and snapshot for a long stretch, so a builder who remembers losing work that way is remembering something real that is now fixed). Full reclaim happens only after `BOX_DORMANT_DAYS` (14) parked, and **only after a warning was actually delivered** — an unwarned box is deferred, not reclaimed (task 1002727). The read API:
 - `GET /api/gds/box/me` → the caller's box: `state`, `scope`, `ip`, `hostname`, cost, activity timestamps.
 - `GET /api/gds/box/ssh-key` → the caller's registered SSH keys (fingerprints + labels).
 - `GET /api/gds/box/terminal` → the caller's active box's browser-terminal `url` + basic-auth `credential` (the Chromebook/browser on-ramp, ADR 0038), once the box has published them.
@@ -16,17 +16,24 @@ The per-builder box lifecycle (ADR 0031 §2) auto-suspends when idle (snapshot-a
 
 ## How to use
 
-1. **Fetch the box + keys** (own-scoped; uses the builder's session token):
+1. **Fetch the box + keys + the resolved scope** (own-scoped; uses the builder's session token):
    ```bash
-   node -e 'const{apiCall}=require("./scripts/gds/cli-lib");(async()=>{for(const p of ["/api/gds/box/me","/api/gds/box/ssh-key"]){const r=await apiCall("GET",p);console.log(p,r.status,JSON.stringify(r.data));}})()'
+   node -e 'const{apiCall}=require("./scripts/gds/cli-lib");(async()=>{for(const p of ["/api/gds/box/me","/api/gds/box/ssh-key","/api/gds/box/scope"]){const r=await apiCall("GET",p);console.log(p,r.status,JSON.stringify(r.data));}})()'
    ```
    (If the script returns "no GDS session", run `/builder-setup` first.)
 
+   **Always report the scope, not just the state** (task 1002731). `/box/scope` returns `{scope, modules, sparse_paths, task_scope}`, and a too-narrow box is otherwise a *silent* failure — the builder sees a working box that is quietly missing the code they need. Read it out:
+   - `scope: 'task'` → name the modules: *"your box holds dev-box, hall-ui — and nothing else."*
+   - `scope: 'base'` → **say plainly that the box has no `modules/` code at all.** With no active claim that is expected; claiming a task and running `/builder-sync` fixes it.
+   - `scope: 'full'` with `modules: []` → the task-1002729 fallback fired: they hold claims, but those claims' goals declare no `scope_modules`, so the box fell back to their rank. Usable, but task-scoping is not actually doing anything — setting the goal's wall would give a tighter box.
+   - `scope: 'starter'` → the fixed newcomer slice, not scoped to their claim.
+
 2. **Relay it in plain language:**
    - **state = `none`** → they have no box yet. On a Mac/Windows: run `/builder-connect` (registers their SSH key + installs the Desktop file). To actually create the box hands-off, `POST /api/gds/box/ensure` queues the auto-provision (no operator CLI needed). *(The old path — ask an operator to `box.js onboard <login>` — still works but is no longer required.)*
    - **state = `active`** → box is up at `hostname` (`ip`). They can connect from Claude Desktop → Code → Environment → "Example Dev Box". For a browser/Chromebook (ADR 0038), the terminal comes from the web: `GET /api/gds/box/terminal` returns a `url` + a basic-auth `credential` (username `otb`, password = <redacted>; open the url, enter them, then type `claude` in the terminal. No SSH needed.
      - **Live game preview — the sandbox (ADR 0044).** If `/box/terminal` returns a `url` (i.e. the box is on the named tunnel), the builder also has a private live preview of the game running on their own box, at the **same hostname with `term-` swapped for `sandbox-`** — e.g. terminal `https://term-<login>.example.com` → preview `https://sandbox-<login>.example.com`. It serves their working copy of the game (degraded — fully playable, no saved state), so they can review changes in a browser **without shipping to prod**. The loop: edit in the terminal → run **`/builder-stage`** (or `box-preview restart`) → refresh the preview tab. Staging via `/builder-stage` also records the review marker that `/builder-ship`'s sandbox-first gate checks (#927, ADR 0046) — on a dev box, game changes are staged + reviewed on the sandbox before they ship to the main game. `box-preview status` shows whether it's up + the URL; `box-preview logs` tails the server. (No preview on a quick-tunnel box — that path can't carry the game port; it needs the named tunnel.)
-   - **state = `parked`** → idle-suspended (cheap, expected). It wakes on demand: `POST /api/gds/box/ensure` queues the wake and it's back in ~1 min (no operator needed). Reassure them their data is safe in the snapshot.
+   - **state = `parked`** → idle-suspended (cheap, expected). It wakes on demand: `POST /api/gds/box/ensure` queues the wake and it's back in ~1 min (no operator needed). Their data IS safe in the snapshot — say so plainly, and mean it: the idle path preserves the filesystem, and the only thing that deletes the snapshot warns them first with days of lead time.
+   - **state = `destroyed`** → the box is genuinely gone, and so is anything uncommitted on it. This is NOT the idle path — it means they closed it themselves, an operator deprovisioned it, or it sat parked past the dormancy window after being warned. `POST /box/ensure` gives them a **fresh** box, not their old one; don't imply otherwise.
    - **state = `provisioning` / `waking`** → in flight; check back in a minute.
    - **state = `error`** → flag it to an operator (don't try to fix infra from here).
    - **SSH keys** → list the fingerprints + labels. If empty, they haven't connected yet → `/builder-connect`. They can remove a stale key with `DELETE /api/gds/box/ssh-key/:id` (own-scoped).

package/modules/hall-ui/public/box-panel.js

@@ -299,23 +299,43 @@
         schedulePoll(5000);
         return;
       }
-      // No open intent and not active/provisioning/waking. Two cases:
-      //   • destroyed → the builder HAD a box that is now gone — they closed it, or
-      //     it was auto-stopped after ~10 min idle, which tears down the tunnel + its
-      //     DNS. Opening the old terminal/sandbox URL then fails with a raw browser
-      //     "can't find the server" error and no explanation (idea #295). Don't leave
-      //     them staring at a bare button: say what happened + offer to turn it back on.
+      // No open intent and not active/provisioning/waking. Three cases:
+      //   • parked → asleep after the idle sweep, filesystem preserved (task 1002726).
+      //     Reachable again as of that task; offer a wake, and say the files are safe.
+      //   • destroyed → the builder HAD a box that is now gone — they closed it, an
+      //     operator deprovisioned it, or it passed the dormancy window after being
+      //     warned. Either way the tunnel + DNS are torn down, so opening the old
+      //     terminal/sandbox URL fails with a raw browser "can't find the server" and
+      //     no explanation (idea #295). Don't leave them staring at a bare button.
       //   • none → never had a box (first run). Keep the clean first-run button.
       closeTermWindow();
       stopPoll();
       enableOpenBtn(null);
+      // task 1002728 — PARKED is a real, reachable state again since task 1002726
+      // made the idle sweep park instead of destroy. Before that it could never
+      // happen, so there was no branch for it and a parked box fell through to
+      // the first-run "Request dev box" screen — which reads as "your box is
+      // gone" at the exact moment the box and its files are safe.
+      if (state === 'parked') {
+        setRequestBtn(true, 'Wake my box');
+        setOut('<p class="setup__box-msg">Your dev box is asleep — wake it below.</p>'
+          + '<p class="setup__box-close-hint">It was put to sleep after a couple of hours idle so it stops '
+          + 'costing money. <strong>Your files are kept</strong>, including anything you had not committed — '
+          + 'waking it brings the box back as you left it, in about a minute. A sleeping box has no terminal '
+          + 'or live-preview URL, so an old link will fail to load until it is awake.</p>'
+          + '<p class="setup__box-close-hint">If it stays asleep for a couple of weeks we clean it up to save '
+          + 'cost, but you will get a warning first with several days to wake it.</p>');
+        return;
+      }
       if (state === 'destroyed') {
         setRequestBtn(true, 'Turn box back on');
         setOut('<p class="setup__box-msg">Your dev box is stopped — turn it back on below.</p>'
-          + '<p class="setup__box-close-hint">Boxes auto-stop after about 10 minutes idle to save cost '
-          + '(or when you close one). A stopped box has no terminal or live-preview URL, so an old '
-          + 'link will fail to load. Turning it back on takes about a minute. '
-          + '<strong>Anything not committed or shipped on the old box is gone</strong> — commit early next time.</p>'
+          + '<p class="setup__box-close-hint">This happens when you close a box yourself, or after it has been '
+          + 'asleep long enough to be cleaned up (you are warned first). A stopped box has no terminal or '
+          + 'live-preview URL, so an old link will fail to load. Turning it back on takes about a minute, and '
+          + 'gives you a <strong>fresh</strong> box — <strong>anything not committed or shipped on the old one '
+          + 'is gone</strong>. (Going idle no longer does this: an idle box is put to sleep with your files '
+          + 'intact.)</p>'
           + '<p class="setup__box-close-hint">The box you turn on has a <strong>new identity</strong>. If Claude '
           + 'Desktop says <strong>&ldquo;Host denied&rdquo;</strong> or asks for a password when reconnecting, fully quit '
           + 'and reopen Desktop (it re-pins your box automatically) or press <strong>Repair</strong> — do not keep turning '

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.79",
+  "version": "1.19.81",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.79",
+      "version": "1.19.81",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.79",
+  "version": "1.19.81",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/api.js

@@ -18,7 +18,7 @@
 // on a 2xx, 1 on any non-2xx or transport error, 2 on bad invocation.
 
 const fs = require('node:fs');
-const { cliClient, arg, stripBom, resolveQuiet, isBoxScope, printBoxScopeGuidanceAndExit } = require('./cli-lib');
+const { cliClient, arg, stripBom, resolveQuiet, isBoxScope, printBoxScopeGuidanceAndExit, cliExit } = require('./cli-lib');
 
 
 (async () => {
@@ -62,7 +62,7 @@ const { cliClient, arg, stripBom, resolveQuiet, isBoxScope, printBoxScopeGuidanc
     res = await api.request(method, relPath, body != null ? { body } : {});
   } catch (e) {
     console.error(`api: request failed: ${e.message}`);
-    process.exit(1);
+    return cliExit(1); // task 1002734: never process.exit() after a request
   }
   if (!quiet) console.error(`${method} ${urlPath} → ${res.status}`);
   // task 1501: on a dev box the baked session is box-scoped (ADR 0053) and every
@@ -79,5 +79,9 @@ const { cliClient, arg, stripBom, resolveQuiet, isBoxScope, printBoxScopeGuidanc
   if (res.data !== undefined && res.data !== null) {
     console.log(JSON.stringify(res.data, null, 2));
   }
-  process.exit(res.ok ? 0 : 1);
+  // task 1002734: process.exit() here aborted node 5/5 on Windows —
+  // "Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c"
+  // — AFTER the JSON had already printed, so every caller that checks the exit code
+  // read a successful command as a failure. Set the code and let the loop drain.
+  cliExit(res.ok ? 0 : 1);
 })();

package/scripts/gds/box-sync.js

@@ -57,10 +57,77 @@ function main(argv = process.argv.slice(2)) {
     console.error(`sync: could not run the fetch (${r.error.message})`);
     process.exit(1);
   }
-  if (r.status === 0) console.log('sync: done — your box now holds the code for your active claim.');
-  process.exit(r.status == null ? 1 : r.status);
+  if (r.status !== 0) process.exit(r.status == null ? 1 : r.status);
+  console.log('sync: done — your box now holds the code for your active claim.');
+  // Then say WHAT it holds, so a base-only box is visible instead of silent.
+  reportScope().then(() => process.exit(0), () => process.exit(0));
+}
+
+// ---------------------------------------------------------------------------
+// task 1002731 — say what scope the box ACTUALLY got
+// ---------------------------------------------------------------------------
+
+// The failure this exists for is a SILENT one: a box comes up holding only the
+// base slice (no modules/ at all) and nothing anywhere says so. Live, that was
+// 247 of 248 source grants — including an Archon with 7 active claims — and the
+// only way to see it was reading box_events on the control plane. GET /box/scope
+// already returns the resolved decision; nothing ever showed it to a human.
+//
+// PURE so it is unit-testable without a box or a network: takes the /box/scope
+// body, returns the lines to print. null/garbage in → one honest line rather
+// than a crash, because this is diagnostic output on an already-degraded path
+// and must never be the thing that fails.
+function formatScopeReport(scope) {
+  if (!scope || typeof scope !== 'object' || Array.isArray(scope)) {
+    return ['scope: could not read your box scope (GET /box/scope did not answer).'];
+  }
+  const modules = Array.isArray(scope.modules) ? scope.modules : null;
+  const paths = Array.isArray(scope.sparse_paths) ? scope.sparse_paths : [];
+  const out = [];
+
+  if (scope.scope === 'task' && modules && modules.length) {
+    out.push(`scope: task — your box holds ${modules.length} module(s): ${modules.join(', ')}`);
+  } else if (scope.scope === 'base') {
+    out.push('scope: BASE ONLY — your box holds no modules/ code at all.');
+    out.push(scope.task_scope
+      ? '  Why: you hold no active claim, so there is no work to scope the box to.'
+      : '  Why: this instance resolved no claim scope.');
+    out.push('  Fix: claim a task (/builder-claim N), then re-run this sync.');
+  } else if (scope.scope === 'full') {
+    out.push('scope: full — your box holds the whole repo (your rank allows it).');
+    if (modules && modules.length === 0) {
+      // The task-1002729 fallback fired: claims held, but their goals declare no
+      // wall. Worth naming — the box is usable, but task-scoping is doing nothing.
+      out.push('  Note: your claimed work declares no module scope, so this fell back to');
+      out.push("  your rank rather than scoping to the task. Setting the goal's");
+      out.push('  scope_modules would give you a tighter box.');
+    }
+  } else if (scope.scope === 'starter') {
+    out.push('scope: starter — a fixed slice for newcomers, not scoped to your claim.');
+  } else {
+    out.push(`scope: ${String(scope.scope || 'unknown')}`);
+  }
+  if (paths.length) out.push(`  paths: ${paths.length} sparse entr${paths.length === 1 ? 'y' : 'ies'}`);
+  return out;
+}
+
+// Read the resolved scope and print it. Never throws and never changes the exit
+// status — a diagnostic that could fail the sync it reports on would be worse
+// than no diagnostic.
+async function reportScope() {
+  try {
+    const { apiCall } = require('./cli-lib');
+    const r = await apiCall('GET', '/api/gds/box/scope');
+    if (!r || r.status !== 200) {
+      console.log('scope: could not read your box scope right now (that does not affect the sync above).');
+      return;
+    }
+    for (const line of formatScopeReport(r.data)) console.log(line);
+  } catch (_) {
+    console.log('scope: could not read your box scope right now (that does not affect the sync above).');
+  }
 }
 
 if (require.main === module) main();
 
-module.exports = { resolveFetchScript, FETCH_SCRIPT };
+module.exports = { resolveFetchScript, FETCH_SCRIPT, formatScopeReport };

package/scripts/gds/cli-lib.js

@@ -115,6 +115,20 @@ function hallBase(base = API_BASE) {
 // buys these one-shot processes nothing, so route requests through a dispatcher
 // with keep-alive effectively disabled (mirrors cf-tunnel.js's dispatcher
 // pattern). Degrades to the default dispatcher if undici can't be required.
+//
+// task 1002734 — THIS ALONE IS NOT ENOUGH, and the measurements say so: with the
+// dispatcher wired in and undici resolving fine, `node scripts/gds/api.js GET
+// /tasks/<id>` still aborted 5/5 on Windows 11 / Node 24. The dispatcher removes
+// one contributing handle; the actual trigger is calling process.exit() at all
+// while the request machinery is still tearing down. A minimal synthetic
+// fetch-then-exit does NOT reproduce, so it takes the real stack (the dynamic ESM
+// client import + the Agent + any child spawn / consumed stdin) to line up — which
+// is exactly why hunting the single guilty handle is a dead end.
+//
+// The rule for every CLI here: after a request, DO NOT call process.exit().
+// Set process.exitCode and return, and let the loop drain — see cliExit below.
+// Verified: the pre-push gate went 8/8 aborting to 0/8 on that change alone
+// (task 1002725), and api.js 5/5 to 0/5 (this task).
 let _noKeepAliveDispatcher;
 let _noKeepAliveTried = false;
 function noKeepAliveDispatcher() {
@@ -127,6 +141,19 @@ function noKeepAliveDispatcher() {
   return _noKeepAliveDispatcher;
 }
 
+// cliExit(code) — the post-request replacement for process.exit(code). Records the
+// exit status and lets node exit naturally once the loop drains, which is what
+// keeps the UV_HANDLE_CLOSING abort above from firing. Callers must `return` after
+// calling it: unlike process.exit() it does NOT stop execution.
+//
+// Gotcha (learned in task 1002725): a hard exit MASKS leaked timers/handles. Once a
+// CLI exits naturally, anything still armed — an uncleared setTimeout, an open
+// interval — keeps the process alive. Clear them, or the CLI hangs instead of
+// crashing.
+function cliExit(code = 0) {
+  process.exitCode = code;
+}
+
 async function readSessionFile(p) {
   try {
     const raw = await fsp.readFile(p, 'utf8');
@@ -760,6 +787,7 @@ module.exports = {
   resolveQuiet,
   readSessionToken,
   apiCall,
+  cliExit,
   cliClient,
   requireSession,
   printUnauthGuidanceAndExit,

package/src/module-api.js

@@ -585,8 +585,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.77 with no explicit bump. run 31648127800. (task 1002620)
 //   1.19.79 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.78 with no explicit bump. run 31648954641. (task 1002620)
+//   1.19.80 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.79 with no explicit bump. run 31649366675. (task 1002620)
+//   1.19.81 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.80 with no explicit bump. run 31649705242. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.79'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.81'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_sync_scope_report.mjs

@@ -0,0 +1,81 @@
+// tests/box_sync_scope_report.mjs
+//
+// Task 1002731 — the scope read-out that makes a too-narrow box VISIBLE.
+//
+// The failure being guarded is a silent one: a box comes up holding only the
+// base slice (no modules/ at all) and nothing tells the builder. Live, that was
+// 247 of 248 source grants on the cloudbongos fleet — including an Archon
+// holding 7 active claims — and the only way to see it was reading box_events
+// on the control plane.
+//
+// formatScopeReport is PURE (takes the GET /box/scope body, returns lines), so
+// this needs no box, no network and no DB.
+//
+// Run:  node tests/box_sync_scope_report.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { formatScopeReport } = require('../scripts/gds/box-sync.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+const joined = (scope) => formatScopeReport(scope).join('\n');
+
+t('base-only is stated in plain words, with a why and a fix', () => {
+  const out = joined({ scope: 'base', mode: 'sparse', modules: [], sparse_paths: ['docs', 'scripts'], task_scope: true });
+  assert.match(out, /BASE ONLY/, 'the degraded state is named, not buried');
+  assert.match(out, /no modules\/ code at all/, 'says what is actually missing');
+  assert.match(out, /Why:/, 'explains the cause');
+  assert.match(out, /builder-claim/, 'gives the builder the actual next step');
+});
+
+t('task scope names the modules the box holds', () => {
+  const out = joined({ scope: 'task', mode: 'sparse', modules: ['dev-box', 'hall-ui'], sparse_paths: ['a', 'b', 'c'], task_scope: true });
+  assert.match(out, /scope: task/);
+  assert.match(out, /dev-box, hall-ui/, 'names them rather than just counting');
+  assert.match(out, /3 sparse entries/);
+});
+
+t('full + EMPTY modules surfaces the 1002729 fallback rather than looking healthy', () => {
+  // The exact live shape: claims held, but their goals declare no scope_modules.
+  // The box works, so nothing complains — but task-scoping is not doing anything,
+  // and that is worth telling someone.
+  const out = joined({ scope: 'full', mode: 'full', modules: [], sparse_paths: null, task_scope: true });
+  assert.match(out, /scope: full/);
+  assert.match(out, /declares no module scope/, 'names why it fell back');
+  assert.match(out, /scope_modules/, 'points at the thing to fix');
+});
+
+t('full with real modules does NOT nag about the fallback', () => {
+  const out = joined({ scope: 'full', mode: 'full', modules: ['kernel'], sparse_paths: null, task_scope: false });
+  assert.match(out, /scope: full/);
+  assert.ok(!/declares no module scope/.test(out), 'no false alarm when nothing is wrong');
+});
+
+t('starter is distinguished from a claim-scoped box', () => {
+  const out = joined({ scope: 'starter', mode: 'sparse', modules: null, sparse_paths: ['x'], task_scope: false });
+  assert.match(out, /starter/);
+  assert.match(out, /not scoped to your claim/);
+});
+
+t('a missing or malformed body degrades to one honest line, never a throw', () => {
+  // This runs on an already-degraded path; it must not be the thing that fails.
+  for (const bad of [null, undefined, 'nope', 42, []]) {
+    const lines = formatScopeReport(bad);
+    assert.ok(Array.isArray(lines) && lines.length >= 1, `handled ${JSON.stringify(bad)}`);
+  }
+  assert.match(joined(null), /could not read/);
+});
+
+t('an unknown scope value is reported verbatim rather than swallowed', () => {
+  assert.match(joined({ scope: 'something-new', sparse_paths: [] }), /something-new/);
+});
+
+console.log(`\nbox_sync_scope_report.mjs: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/cli_exit_no_abort.mjs

@@ -0,0 +1,135 @@
+// tests/cli_exit_no_abort.mjs — the GDS CLIs must not abort natively on exit
+// (task 1002734; the pre-push twin of this is tests/pre_push_hook.mjs, task 1002725).
+//
+// THE BUG. On Windows + Node 24, calling process.exit() after the CLI has made a
+// request aborts the process before it can exit cleanly:
+//
+//   Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c, line 76
+//
+// `node scripts/gds/api.js GET /tasks/<id>` reproduced this 5/5: the JSON printed
+// correctly and THEN the process died with exit 127, so every caller that checks an
+// exit code — CI, shell scripts, the ship pipeline — read a successful command as a
+// failure. Setting process.exitCode and letting the loop drain took it to 0/6.
+//
+// A no-keep-alive undici dispatcher was already wired into cli-lib for this exact
+// assertion and was NOT sufficient on its own; only dropping the hard exit fixed it.
+//
+// NETWORK-FREE, but not server-free. The failure cases point the CLI at a dead
+// localhost port; the success case runs a throwaway stub server in its own process.
+// Both matter: the crash is in the TEARDOWN, and a 200 tears down more machinery than
+// a refused connection — the wild repro was a successful call.
+//
+// Run:  node --test tests/cli_exit_no_abort.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { spawnSync, spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const API = path.join(ROOT, 'scripts', 'gds', 'api.js');
+const CLI_LIB = path.join(ROOT, 'scripts', 'gds', 'cli-lib.js');
+const DEAD_BASE = 'http://127.0.0.1:9'; // discard port — connection refused, instantly
+
+// The native abort prints this and nothing else can be relied on; it is NOT a
+// JS-level error, so it never appears as a caught exception.
+const ABORT_RE = /Assertion failed|UV_HANDLE_CLOSING/i;
+
+function runApi(args, env = {}) {
+  return spawnSync(process.execPath, [API, ...args], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    env: { ...process.env, GDS_API_BASE: DEAD_BASE, ...env },
+  });
+}
+
+test('api.js does not abort natively when a request fails', () => {
+  const r = runApi(['GET', '/api/gds/me', '--quiet']);
+  assert.doesNotMatch(r.stderr || '', ABORT_RE, `native abort on the request-failure path:\n${r.stderr}`);
+  assert.equal(r.status, 1, `a failed request must exit 1, not ${r.status} (127 = the abort)`);
+  assert.match(r.stderr, /request failed/i);
+});
+
+test('api.js reports a usage error without aborting (pre-request path)', () => {
+  const r = runApi(['GET']); // missing path
+  assert.doesNotMatch(r.stderr || '', ABORT_RE);
+  assert.equal(r.status, 2, 'bad invocation is exit 2');
+});
+
+test('api.js exit code survives repeated runs (the abort was intermittent-looking)', () => {
+  // The synthetic minimal case (bare fetch + process.exit) does NOT reproduce, so a
+  // single green run proves little — the real stack has to line up. Run it enough
+  // times that a reintroduced hard exit shows up rather than slipping through.
+  for (let i = 0; i < 5; i++) {
+    const r = runApi(['GET', '/api/gds/me', '--quiet']);
+    assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively`);
+    assert.equal(r.status, 1, `run ${i + 1} exited ${r.status}`);
+  }
+});
+
+// The SUCCESS teardown is the path that actually aborted in the wild: api.js printed
+// its JSON and then died at exit 127. A failed request tears down less machinery, so
+// the failure cases above cannot cover this. Serve a real 200 — still no external
+// network — and assert the clean exit 0.
+//
+// The stub MUST run in its own process. An in-process http.createServer here would
+// deadlock: spawnSync blocks this process's event loop, so the server could never
+// accept the child's connection and the test would hang forever.
+const STUB_SRC = `
+const http = require('node:http');
+const s = http.createServer((q, r) => {
+  r.writeHead(200, { 'Content-Type': 'application/json' });
+  r.end(JSON.stringify({ ok: true, builder: { id: 1, rank: 'archon' } }));
+});
+s.listen(0, '127.0.0.1', () => console.log('PORT=' + s.address().port));
+`;
+
+function startStub() {
+  const proc = spawn(process.execPath, ['-e', STUB_SRC], { stdio: ['ignore', 'pipe', 'ignore'] });
+  return new Promise((resolve, reject) => {
+    let buf = '';
+    const timer = setTimeout(() => { proc.kill(); reject(new Error('stub server did not report a port')); }, 10_000);
+    proc.stdout.on('data', (d) => {
+      buf += d.toString();
+      const m = buf.match(/PORT=(\d+)/);
+      if (m) { clearTimeout(timer); resolve({ proc, port: Number(m[1]) }); }
+    });
+    proc.on('error', (e) => { clearTimeout(timer); reject(e); });
+  });
+}
+
+test('api.js exits 0 after a SUCCESSFUL request — the path that aborted in the wild', async () => {
+  const { proc, port } = await startStub();
+  try {
+    for (let i = 0; i < 3; i++) {
+      const r = runApi(['GET', '/api/gds/me', '--quiet'], { GDS_API_BASE: `http://127.0.0.1:${port}` });
+      assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively after a 200:\n${r.stderr}`);
+      assert.equal(r.status, 0, `a successful request must exit 0, got ${r.status} (127 = the abort); stderr: ${r.stderr}`);
+      assert.match(r.stdout, /"ok"/, 'the JSON body must still reach stdout');
+    }
+  } finally {
+    proc.kill();
+  }
+});
+
+test('cli-lib exports cliExit — the documented replacement for a post-request exit', async () => {
+  const mod = await import(`file://${CLI_LIB.split(path.sep).join('/')}`);
+  const cliExit = mod.default?.cliExit ?? mod.cliExit;
+  assert.equal(typeof cliExit, 'function', 'cliExit must be exported for the CLI sweep to adopt');
+});
+
+test('api.js routes its post-request exits through cliExit, not process.exit', () => {
+  const src = fs.readFileSync(API, 'utf8');
+  // The two surviving process.exit() calls are the pre-request guards (usage + body
+  // parse), which run before any network work and are safe. Everything after the
+  // request must use cliExit.
+  const afterRequest = src.slice(src.indexOf('let res;'));
+  const stripped = afterRequest.replace(/\/\/[^\n]*/g, '');
+  assert.ok(
+    !/process\.exit\s*\(/.test(stripped),
+    'no process.exit() may remain after the request is issued — that is what aborts node on Windows'
+  );
+  assert.match(afterRequest, /cliExit\(/, 'the post-request paths must set the exit code via cliExit');
+});