@bongos/core 1.19.792 → 1.19.793

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.792",
-  "core_contract": "1.19.792",
-  "source_commit": "7d0308f082bb516dafaf779e6e8955df07aac1f0",
+  "core_version": "1.19.793",
+  "core_contract": "1.19.793",
+  "source_commit": "877a1e0befbf245c4ac50b28d0bc72c785dc9d27",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T00:25:50.991Z",
+  "built_at": "2026-09-17T00:41:15.216Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 486,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2690,
-  "tree_sha256": "82a4277b3d647e6c4e975f1a9b4c6316a2177aa583ebaba8a37aab51a552694e",
+  "tree_sha256": "17b680447915370ad9005373e97e6a90d25f03ebdf58f52e2902501c26fe403a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -77,7 +77,7 @@
     {
       "path": ".claude/skills/builder-reauth/SKILL.md",
       "mode": "0000644",
-      "sha256": "41527df350a69c001dd9a1a2d07767338fa216af58bea5a2019c2261d2b69aaa"
+      "sha256": "f54f3355d1f034fe99735a73ce62936d7d1582e751754bbe12023a4bf8a2d17c"
     },
     {
       "path": ".claude/skills/builder-redteam/SKILL.md",
@@ -342,7 +342,7 @@
     {
       "path": "bin/bongos.js",
       "mode": "0000644",
-      "sha256": "d585fc874c0a45f5d02d5753025d4761ca9b817ae9e5c556891b5c5c444cffde"
+      "sha256": "36d11612cace3d69bd2e98c8f7b5b7d737d8bba5fd8fe1a0554a85e3cb1973ca"
     },
     {
       "path": "clients/bongos-client/README.md",
@@ -1972,7 +1972,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "00f6e4757e5337e7f7cf3ae1d0afeccfcabe9ef1896304004b855931f8b9c423"
+      "sha256": "1442772c691bb7447cb13e4e63b062dd41913d8bb06555cee814069434556ae5"
     },
     {
       "path": "docs/architecture.md",
@@ -2527,7 +2527,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a0c0e1aafc81738b39d52423b76ebbc23bfecd478ddee519c341d25a265a1e93"
+      "sha256": "5a46ed6753d0b49d3a65f6f58972a5159a115ac6fa0022d628942cb48b80be95"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7692,12 +7692,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a4f7542d3fd24e6d64fc20658f5339458a3ec0e38cccb5b12959b40babedf580"
+      "sha256": "88ee2ff930be2d84d19733724ddfeee1842cba1b890422713c9012466fa0739a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "fbda0210622f719253cab72cd3ab108ef90efa5d1357c4df20afa076e15add1f"
+      "sha256": "f7f66eb317b78a0b652addc0c31a67500a80ed2109807a89898128d6a15a481b"
     },
     {
       "path": "public-docs/index.html",
@@ -8532,7 +8532,7 @@
     {
       "path": "scripts/gds/paste-token.js",
       "mode": "0000644",
-      "sha256": "7f112d061f459781559778639c0c11b9fbc2a5acc06d87464a40def06c3e4cf7"
+      "sha256": "423b356f7ff60913af72ce2042fb8dd2fcefa26375864dbb428cb4e3b527bb82"
     },
     {
       "path": "scripts/gds/portability-smoke-art.sh",
@@ -8637,7 +8637,7 @@
     {
       "path": "scripts/gds/reauth.js",
       "mode": "0000644",
-      "sha256": "5368ed9a43034b060451e54f21f885c216fab17cf731d7981d2681aeae890507"
+      "sha256": "ce20f84be283f2a97df7d410b56b40d1e0cd14be8349acc418aa645d702f4f45"
     },
     {
       "path": "scripts/gds/recall.js",
@@ -9467,7 +9467,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "4723bdcca92e442d73517df92463f58d16f0773d4167d8661a75fd9a7a61392d"
+      "sha256": "a45868b46ab96fdedab3e7359259527e2d75e65b86a916865e5fff358f88a3b3"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -9577,7 +9577,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "51bcfd1a4eb31a189085c07cdcc46dd1b9d923c9335021ea3dcb54c6c55e01c6"
+      "sha256": "7db202b3ac70a0404e7cc0067828bb9d41eed6bfddf760e325773f629cd09dfc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10012,7 +10012,7 @@
     {
       "path": "tests/bongos_cli.mjs",
       "mode": "0000644",
-      "sha256": "20d7d86da8e03ede2004bdc3dda589670977fca0240d56cd3677fc08fbb2de03"
+      "sha256": "ef01af16d62c55325a3b12cc7968a9d797994d2f46364149668bf4e2839cb0e0"
     },
     {
       "path": "tests/bongos_dispatch.mjs",
@@ -10292,7 +10292,7 @@
     {
       "path": "tests/cli_token_reissue.mjs",
       "mode": "0000644",
-      "sha256": "66717847c1f67d4bedd9a2d9d5ed989e238039118e439eb2a3c67d43079172a4"
+      "sha256": "a82544c109464d884e44731cbdd73e9e141d31d8e18a9241222d6a26223e19c2"
     },
     {
       "path": "tests/client_baseurl_guard.mjs",

package/.claude/skills/builder-reauth/SKILL.md

@@ -25,10 +25,10 @@ What actually bounds a leaked token is **revocation**, and it is faster than any
 2. **Relay the click-path verbatim.** The helper prints the exact steps; pass them to the user clearly (don't paraphrase the URL):
    - Open `https://example.com/builders/settings` (the helper tries to open it automatically; if not, give them the link).
    - They are already signed in there via the browser cookie. Under the **"CLI Access"** section, click **"Re-issue CLI token"**.
-   - Click **"Copy"** — it copies a one-line command of the form `node scripts/gds/paste-token.js <token>`.
+   - Click **"Copy"** — it copies a one-line command of the form `bongos paste-token <token>`.
    - Ask them to **paste that one line back into the chat**.
 
-3. **Run the pasted command.** When the user pastes `node scripts/gds/paste-token.js <token>`, run it exactly as given. `paste-token.js` verifies the token against `/api/gds/me` **before** touching the session file (a bad paste leaves the existing session intact) and preserves any `gemini_api_key`. On success it prints the builder login, rank, and confirms the session file was written.
+3. **Run the pasted command.** When the user pastes `bongos paste-token <token>`, run it exactly as given. `paste-token.js` verifies the token against `/api/gds/me` **before** touching the session file (a bad paste leaves the existing session intact) and preserves any `gemini_api_key`. On success it prints the builder login, rank, and confirms the session file was written.
 
 4. **Confirm.** Relay the authenticated identity + rank back to the user, and tell them they can now re-run whatever `/builder-*` command they were trying.
 
@@ -41,13 +41,13 @@ What actually bounds a leaked token is **revocation**, and it is faster than any
 
 ## Constraints
 
-- **The token briefly transits the chat — that's the known cost of guided-paste.** The user pastes `node scripts/gds/paste-token.js <token>` into the conversation, so the bearer appears in the chat (and any log/context that captures it). That's the accepted trade-off Lars chose; the deferred zero-paste loopback flow removes it. So: treat the session log as sensitive, **never echo the token beyond running that one pasted command**, and never write it to any file other than `~/.config/otb/gds-session.json` (`paste-token.js` is the only thing that should write it — let it do the write). The token rotates whenever the builder clicks Re-issue again, so re-running this flow invalidates an exposed paste's usefulness for an attacker who lacks the browser cookie.
+- **The token briefly transits the chat — that's the known cost of guided-paste.** The user pastes `bongos paste-token <token>` into the conversation, so the bearer appears in the chat (and any log/context that captures it). That's the accepted trade-off Lars chose; the deferred zero-paste loopback flow removes it. So: treat the session log as sensitive, **never echo the token beyond running that one pasted command**, and never write it to any file other than `~/.config/otb/gds-session.json` (`paste-token.js` is the only thing that should write it — let it do the write). The token rotates whenever the builder clicks Re-issue again, so re-running this flow invalidates an exposed paste's usefulness for an attacker who lacks the browser cookie.
 - **Don't re-auth a valid session.** If `reauth.js` exits 0, stop.
 - **`GDS_API_BASE`** overrides the endpoint (default `https://example.com`); for local dev `GDS_API_BASE=http://localhost:3000`.
 
 ## Files this skill touches
 
 - Runs: `node scripts/gds/reauth.js` (detect + open browser + print click-path)
-- Runs: `node scripts/gds/paste-token.js <token>` (verify + write the new session)
+- Runs: `bongos paste-token <token>` (verify + write the new session)
 - Reads/Writes (via paste-token.js): `~/.config/otb/gds-session.json`
 - Calls: `GET /api/gds/me`; the Settings page (CLI Access) calls `POST /api/gds/auth/cli-token/issue`

package/bin/bongos.js

@@ -47,6 +47,10 @@ const BUNDLED_RUNNERS = {
   'login.js': () => require('../scripts/gds/login.js'),
   'setup.js': () => require('../scripts/gds/setup.js'),
   'reauth.js': () => require('../scripts/gds/reauth.js'),
+  // Bundled for the same reason as reauth: they are two halves of one on-ramp
+  // (mint the token, then store it), and a builder recovering a dead session on a
+  // bare laptop has the standalone binary and nothing else (task 1003961).
+  'paste-token.js': () => require('../scripts/gds/paste-token.js'),
   'api.js': () => require('../scripts/gds/api.js'),
   'shell.js': () => require('../scripts/gds/shell.js'),
   'code.js': () => require('../scripts/gds/code.js'),
@@ -84,6 +88,13 @@ const VERBS = {
   login:   { script: 'login.js',  group: 'account', summary: 'Sign in to an instance  (bongos login <url> — browser click, no paste)' },
   setup:   { script: 'setup.js',  group: 'account', summary: 'Full builder setup on this instance (art key, disciplines, consent)' },
   reauth:  { script: 'reauth.js', group: 'account', summary: 'Refresh your session' },
+  // The second half of `reauth`: the hall mints a token, this stores it. A VERB
+  // rather than a path because the string is emitted by the SERVER and pasted on
+  // an INSTANCE, where `scripts/gds/` does not exist — the core is a dependency
+  // there, so the old `node scripts/gds/paste-token.js <token>` named a file the
+  // builder did not have (task 1003961). A verb also makes it allow-listable by
+  // name, the way claim/ship/release already are (ADR 0104).
+  'paste-token': { script: 'paste-token.js', group: 'account', summary: 'Finish re-auth: store the token copied from Settings  (bongos paste-token <token>)' },
   doctor:  { script: 'doctor.js', group: 'account', summary: 'Check your local toolchain + session' },
   box:     { script: 'api.js', prefixArgs: ['POST', '/api/gds/box/ensure'], group: 'account', summary: 'Turn on / wake your cloud dev box' },
   shell:   { script: 'shell.js', group: 'account', summary: 'Open a terminal on your dev box  (--local for a local clone)' },
@@ -239,7 +250,7 @@ function runBundled(verb, def, forwarded) {
         `  bongos code                   open VS Code on your cloud dev box (has everything)\n` +
         `  bongos shell                  open a terminal on your cloud dev box\n` +
         `  bongos init                   scaffold a new instance here\n\n` +
-        `The standalone binary covers the on-ramp: login, box, shell, code, init, reauth.\n`
+        `The standalone binary covers the on-ramp: login, box, shell, code, init, reauth, paste-token.\n`
     );
     return 2;
   }

package/docs/api/openapi.json

@@ -1329,7 +1329,7 @@
           "auth"
         ],
         "summary": "POST /auth/cli-token/issue",
-        "description": "POST /auth/cli-token/issue — V3.R91 / task 401. Issue a fresh CLI bearer for the requesting builder, gated on a WEB COOKIE session (not a bearer). The browser already proves identity via the gds_session cookie; this endpoint mints a separate cli-source session row the builder can paste into ~/.config/otb/gds-session.json via scripts/gds/paste-token.js. Replaces the ~30-60s Device Flow when the CLI bearer has expired. rank: any-builder (own identity only) — no rank gate. auth source restriction: cookie ONLY. A bearer cannot mint a new bearer (a leaked CLI token shouldn't be able to extend its own lifetime; the httpOnly browser cookie is the harder-to-steal credential).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /auth/cli-token/issue — V3.R91 / task 401. Issue a fresh CLI bearer for the requesting builder, gated on a WEB COOKIE session (not a bearer). The browser already proves identity via the gds_session cookie; this endpoint mints a separate cli-source session row the builder can paste into ~/.config/otb/gds-session.json via `bongos paste-token`. Replaces the ~30-60s Device Flow when the CLI bearer has expired. rank: any-builder (own identity only) — no rank gate. auth source restriction: cookie ONLY. A bearer cannot mint a new bearer (a leaked CLI token shouldn't be able to extend its own lifetime; the httpOnly browser cookie is the harder-to-steal credential).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/auth.js",
         "responses": {

package/docs/module-api-changelog.md

@@ -2058,5 +2058,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.790 with no explicit bump. run 35165066743. (task 1002620)
   1.19.792 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.791 with no explicit bump. run 35166486577. (task 1002620)
+  1.19.793 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.792 with no explicit bump. run 35167484049. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.792",
+  "version": "1.19.793",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.792",
+      "version": "1.19.793",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.792",
+  "version": "1.19.793",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/paste-token.js

@@ -7,7 +7,8 @@
 // paste never silently un-registers a builder's Gemini key.
 //
 // Usage:
-//   node scripts/gds/paste-token.js <token>
+//   bongos paste-token <token>          # what the hall hands you (task 1003961)
+//   node scripts/gds/paste-token.js <token>   # equivalent, inside a core checkout
 //
 // The portal returns the exact invocation as the "paste_command" field, so a
 // builder can copy + paste a single line.
@@ -42,7 +43,8 @@ const API_BASE = ic.resolveApiBase();
 function usage(extra) {
   if (extra) console.error(extra);
   console.error('');
-  console.error('Usage: node scripts/gds/paste-token.js <token>');
+  console.error('Usage: bongos paste-token <token>');
+  console.error('   (inside a core checkout: node scripts/gds/paste-token.js <token>)');
   console.error('');
   console.error('Get a token on your Settings page: ' + API_BASE + '/builders/settings');
   console.error('— under "CLI Access" click "Re-issue CLI token" (you must be signed in).');

package/scripts/gds/reauth.js

@@ -17,7 +17,7 @@
 //   2. Guide — open the builder's Settings page in the default browser (where
 //      the builder is already signed in via the httpOnly cookie) and print the
 //      exact click-path: Settings → CLI Access → Re-issue CLI token → Copy.
-//      The page hands back a one-liner: `node scripts/gds/paste-token.js
+//      The page hands back a one-liner: `bongos paste-token
 //      <token>`. The builder pastes that one line back into Claude; the
 //      /builder-reauth skill runs it (paste-token.js verifies + writes safely).
 //
@@ -96,7 +96,7 @@ function printGuidance({ opened }) {
   console.log("        you're already signed in there via your browser cookie)");
   console.log('  2. Under the "CLI Access" section, click "Re-issue CLI token".');
   console.log('  3. Click "Copy" — it copies a one-line command that looks like:');
-  console.log('       node scripts/gds/paste-token.js <token>');
+  console.log('       bongos paste-token <token>');
   console.log('  4. Paste that one line back to Claude. It will run it for you,');
   console.log('     verify the token, and write your new session.');
   console.log('');

package/src/bongos/routes/auth.js

@@ -1025,7 +1025,7 @@ module.exports = function buildAuthRouter() {
   // the requesting builder, gated on a WEB COOKIE session (not a bearer). The
   // browser already proves identity via the gds_session cookie; this endpoint
   // mints a separate cli-source session row the builder can paste into
-  // ~/.config/otb/gds-session.json via scripts/gds/paste-token.js. Replaces
+  // ~/.config/otb/gds-session.json via `bongos paste-token`. Replaces
   // the ~30-60s Device Flow when the CLI bearer has expired.
   //
   // rank: any-builder (own identity only) — no rank gate.
@@ -1058,7 +1058,15 @@ module.exports = function buildAuthRouter() {
         token,
         expires_at: row.expires_at,
         builder_login: req.builder.github_login,
-        paste_command: `node scripts/gds/paste-token.js ${token}`,
+        // A VERB, never a path (task 1003961). This string is composed HERE and run
+        // THERE — on an instance, where the core is an installed dependency and
+        // `scripts/gds/` does not exist, so the previous
+        // `node scripts/gds/paste-token.js <token>` named a file the builder did not
+        // have and the copy button handed out a command that could not run. `bongos`
+        // is on PATH in any installed instance, so the verb form is layout- and
+        // directory-independent. Same discipline as configuredOAuthOrigin() above:
+        // nothing about the RECIPIENT's filesystem may be assumed here.
+        paste_command: `bongos paste-token ${token}`,
       });
     } catch (err) {
       log.error('[gds] POST /auth/cli-token/issue', err);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.792'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.793'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bongos_cli.mjs

@@ -13,6 +13,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
@@ -43,6 +44,33 @@ test('verbHelpText: names the verb, its summary, and the full-help pointer', ()
   assert.match(out, /bongos help/);
 });
 
+// task 1003961 — the hall's re-auth copy button emits `bongos paste-token <token>`.
+// That string is composed by the SERVER and run on an INSTANCE, so the verb has to
+// exist here or the one-click path dead-ends on "unknown command". Pinned against
+// the routes file so the two halves cannot drift apart.
+test('paste-token is a registered verb wired to paste-token.js', () => {
+  const def = cli.VERBS['paste-token'];
+  assert.ok(def, 'bongos paste-token must be a registered verb');
+  assert.equal(def.script, 'paste-token.js');
+  assert.equal(def.group, 'account', 'it belongs with the other session verbs');
+});
+
+test('paste-token is bundled into the standalone binary, like reauth', () => {
+  // Two halves of one on-ramp: reauth mints the token, paste-token stores it.
+  // A builder recovering a dead session on a bare laptop has only the binary.
+  assert.ok(cli.BUNDLED_RUNNERS['paste-token.js'],
+    'paste-token.js must be in BUNDLED_RUNNERS or the compiled binary refuses the verb');
+  assert.ok(cli.BUNDLED_RUNNERS['reauth.js'], 'reauth is the sibling this mirrors');
+});
+
+test('the server emits exactly the verb the CLI registers', () => {
+  const routes = readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'bongos', 'routes', 'auth.js'), 'utf8');
+  const m = routes.match(/paste_command:\s*`([^`]+)`/);
+  assert.ok(m, 'auth.js should emit a paste_command template literal');
+  const verb = m[1].split(' ')[1];
+  assert.ok(cli.VERBS[verb], `server emits "bongos ${verb}" but the CLI has no such verb`);
+});
+
 test('VERBS: selfHelp is only claimed by scripts that really print their own usage', () => {
   // Verified by reading each script (they all branch on --help/-h to a usage()
   // printer). If a verb is added here, verify its script first — a wrong

package/tests/cli_token_reissue.mjs

@@ -119,16 +119,23 @@ const issueBlock = (() => {
   return routeSrc.slice(start, start + 3000);
 })();
 
-t("the issue handler reads SESSION_COOKIE (not just Authorization)", () => {
-  assert.ok(issueBlock.includes('parseCookie(req, SESSION_COOKIE)'),
-    'handler must use parseCookie(req, SESSION_COOKIE)');
+// Refreshed for the current handler (task 1003961). These two assertions named
+// `parseCookie(req, SESSION_COOKIE)` and `res.status(403)`, the shape BEFORE the
+// handler moved to the `sessionCookieToken` helper and the `res.fail` envelope.
+// They had been red on main ever since — invisible, because this file is in the
+// runner's INTEGRATION set and self-skips in CI's DB-free lane. Left alone they
+// would have masked the new assertions below: a file that is already red cannot
+// tell you whether the test you just added passes.
+t("the issue handler reads the session COOKIE (not just Authorization)", () => {
+  assert.ok(issueBlock.includes('sessionCookieToken(req)'),
+    'handler must resolve the browser cookie via sessionCookieToken(req)');
 });
 
 t('the issue handler rejects bearer-only callers with cookie_required', () => {
   assert.ok(issueBlock.includes("cookie_required"),
     "error code 'cookie_required' missing");
-  assert.ok(/status\(403\)/.test(issueBlock),
-    'must respond with 403 when cookie is missing');
+  assert.ok(/status:\s*403/.test(issueBlock),
+    'must respond 403 when the cookie is missing (res.fail envelope carries `status: 403`)');
 });
 
 t("mints a session with source='cli' (CHECK constraint compliant)", () => {
@@ -141,6 +148,23 @@ t('returns a paste_command field the portal can show verbatim', () => {
     'response should include paste_command for one-click UX');
 });
 
+// The regression this pins (task 1003961): paste_command is composed on the SERVER
+// and run on an INSTANCE, where the core is an installed dependency and there is no
+// `scripts/gds/` directory. Emitting a repo-relative script path handed every
+// instance builder a command naming a file they did not have. A verb has no such
+// coupling — `bongos` is on PATH wherever the core is installed.
+t('paste_command names a CLI VERB, never a filesystem path', () => {
+  const m = issueBlock.match(/paste_command:\s*`([^`]+)`/);
+  assert.ok(m, 'paste_command should be a template literal the test can read');
+  const cmd = m[1];
+  assert.ok(/^bongos paste-token /.test(cmd),
+    `paste_command must start with the verb form, got: ${cmd}`);
+  assert.ok(!cmd.includes('/'),
+    `paste_command must contain no path separator — it runs where the layout differs. Got: ${cmd}`);
+  assert.ok(!/\bnode\b/.test(cmd),
+    `paste_command must not invoke node directly (that assumes a script on disk). Got: ${cmd}`);
+});
+
 // ---------------------------------------------------------------------------
 
 console.log(`\n${passed} passed, ${failed} failed`);