@bongos/core 1.19.839 → 1.19.840

package/scripts/gds/paste-token.js

@@ -32,27 +32,71 @@ const { SESSION_FILENAMES, readSessionConfigSync } = require('../../src/instance
 // WRITE the session to the configured instance dir (OTB → ~/.config/otb,
 // unchanged; a fresh instance → its neutral dir). R61 / task 1200.
 const SESSION_PATH = ic.configPath(SESSION_FILENAMES[0]);
-// env → the EXISTING session's api_base → this instance's branding default.
-// On a RE-auth a session file already exists, and its api_base is the best signal
-// of which instance the builder is on — this file used to hardcode the founder
-// host here (a straggler the task 1002201 sweep missed), so a token minted by
-// another instance was verified against example.com and rejected 401 with a
-// perfectly valid token (task 1002427).
-const API_BASE = ic.resolveApiBase();
+
+// `--api-base <url>` / `--api-base=<url>`, plus the positional token. Hand-rolled
+// because this script has no arg parser and one flag does not earn a dependency.
+function parseArgs(argv) {
+  const out = { token: null, apiBase: null };
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = String(argv[i]);
+    if (a === '--api-base') { out.apiBase = argv[i + 1] === undefined ? '' : String(argv[i + 1]); i += 1; continue; }
+    if (a.startsWith('--api-base=')) { out.apiBase = a.slice('--api-base='.length); continue; }
+    if (out.token === null && !a.startsWith('-')) out.token = a;
+  }
+  return out;
+}
+
+// WHICH INSTANCE IS THIS TOKEN FOR? (task 1003722)
+//
+// The old order was env → the EXISTING session's api_base → branding default, on the
+// reasoning that a re-auth already knows which instance the builder is on. That holds
+// right up until the builder uses a SECOND instance: the stale api_base then wins over
+// the instance that actually minted the token, so the paste is verified against — and
+// written as — the wrong host. The reported symptom was a token from this instance
+// landing as a token for an unrelated one, after which every /builder-* command
+// authenticated somewhere unintended.
+//
+// A token is minted BY an instance, so the issuer is a property of the token, not of
+// the machine. The hall now stamps it into the paste command, and an explicit flag
+// outranks every inferred source: it is per-invocation, it came from the minting
+// instance, and it is the only source that is right by construction.
+//
+// Below the flag the old order is untouched, so an older instance whose paste command
+// carries no flag behaves exactly as before — and so does the founder-host regression
+// this file already guards (task 1002427: hardcoding a host here rejected a valid
+// token with a 401).
+function resolveBaseForPaste({ flag, resolve = () => ic.resolveApiBase() } = {}) {
+  const f = typeof flag === 'string' ? flag.trim() : '';
+  if (!f) return { base: resolve(), source: 'resolved' };
+  if (!/^https?:\/\/[^\s/]+/i.test(f)) return { base: null, source: 'invalid' };
+  return { base: f.replace(/\/+$/, ''), source: 'flag' };
+}
+
+const ARGS = parseArgs(process.argv.slice(2));
+const RESOLVED = resolveBaseForPaste({ flag: ARGS.apiBase });
+const API_BASE = RESOLVED.base;
 
 function usage(extra) {
   if (extra) console.error(extra);
   console.error('');
-  console.error('Usage: bongos paste-token <token>');
+  console.error('Usage: bongos paste-token <token> [--api-base <url>]');
   console.error('   (inside a core checkout: node scripts/gds/paste-token.js <token>)');
   console.error('');
-  console.error('Get a token on your Settings page: ' + API_BASE + '/builders/settings');
+  // Fall back to the inferred base for this hint when --api-base was the thing that
+  // was malformed — otherwise the error message that explains the bad flag would
+  // itself print "null/builders/settings".
+  const hintBase = API_BASE || ic.resolveApiBase();
+  console.error('Get a token on your Settings page: ' + hintBase + '/builders/settings');
   console.error('— under "CLI Access" click "Re-issue CLI token" (you must be signed in).');
   console.error('The page prints the exact paste-command — just run that line.');
 }
 
 async function main() {
-  const token = process.argv[2];
+  if (RESOLVED.source === 'invalid') {
+    usage(`--api-base must be an http(s) URL, got: ${ARGS.apiBase}`);
+    process.exit(2);
+  }
+  const token = ARGS.token;
   if (!token) {
     usage('No token argument provided.');
     process.exit(2);
@@ -138,7 +182,14 @@ async function main() {
   }
 }
 
-main().catch((err) => {
-  console.error('paste-token failed:', err && err.message ? err.message : err);
-  process.exit(1);
-});
+// Run only as a script. Exporting the two pure helpers lets the decision that caused
+// task 1003722 — WHICH instance a pasted token belongs to — be tested directly, rather
+// than inferred from a text scan of this file.
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('paste-token failed:', err && err.message ? err.message : err);
+    process.exit(1);
+  });
+}
+
+module.exports = { parseArgs, resolveBaseForPaste };

package/scripts/gds/provision-config.js

@@ -55,6 +55,9 @@ const CONFIG = {
   // <slug>.caddy file (idempotent overwrite, no fragile append to a shared file);
   // the main Caddyfile carries a one-time `import <dir>/*.caddy` (operator setup).
   caddySnippetDir: process.env.PROVISION_CADDY_SNIPPET_DIR || '/etc/caddy/sites',
+  // The base Caddyfile the running Caddy loads — read (never written) to prove it imports
+  // the snippets and carries the on-demand TLS ask (task 1002860, ADR 0303).
+  caddyfile: process.env.PROVISION_CADDYFILE || '/etc/caddy/Caddyfile',
   // Where nightly pg_dump backups land (db-backup-nightly.sh's GDS_BACKUP_DIR
   // default). Shared across co-tenant instances on one box — dumps are named
   // `<db>-<ts>.sql.gz`, so each instance's files + retention prune stay scoped to

package/scripts/gds/provision-net.js

@@ -240,6 +240,36 @@ function caddyBlock(inst) {
 function caddySnippetPath(inst, { snippetDir = CONFIG.caddySnippetDir } = {}) {
   return path.posix.join(snippetDir, `${inst.slug}.caddy`);
 }
+// Does the base Caddyfile carry what a provisioned domain needs (task 1002860, ADR 0303)?
+// Read from Caddy's RESOLVED config, not the file's text, so the answer holds whatever form
+// the operator wrote it in: an `ask` (2.7) or a `permission` module (2.8+), an absolute or
+// relative import, directives split across imported files. `requireHost` asks whether the
+// domain is served, which only a written snippet can make true. Returns the operator
+// instruction, or null when wired.
+function caddyWiringGap(adaptedJson, { domain, requireHost = false, caddyfile = CONFIG.caddyfile, snippetDir = CONFIG.caddySnippetDir } = {}) {
+  let apps;
+  try { apps = JSON.parse(adaptedJson).apps || {}; } catch (_) {
+    return `could not read Caddy's resolved config ('caddy adapt --config ${caddyfile}' printed no JSON)`;
+  }
+  const onDemand = apps.tls && apps.tls.automation && apps.tls.automation.on_demand;
+  if (!JSON.stringify(onDemand || {}).includes('/provisioning/tls-check')) {
+    return `${caddyfile} has no on_demand_tls ask for the provisioning tls-check, so no provisioned domain can get a certificate — add 'on_demand_tls { ask <platform origin>/api/bongos/provisioning/tls-check }' to its global options block and reload Caddy`;
+  }
+  if (requireHost && !JSON.stringify(apps.http || {}).includes(JSON.stringify(domain))) {
+    return `${caddyfile} does not import ${snippetDir}/*.caddy, so Caddy will never serve ${domain} — add 'import ${snippetDir}/*.caddy' at the top level of ${caddyfile} and reload Caddy`;
+  }
+  return null;
+}
+// `caddy adapt` reads config files only: no privilege, no certificate keys, no running server.
+function checkCaddyWiring(exec, opts = {}) {
+  const caddyfile = opts.caddyfile || CONFIG.caddyfile;
+  let res;
+  try { res = exec(`caddy adapt --config ${caddyfile} --adapter caddyfile`); } catch (e) {
+    const why = String((e && (e.stderr || e.message)) || e).trim().slice(0, 200);
+    return `'caddy adapt --config ${caddyfile}' failed (${why}) — the base Caddyfile must load before a site is added to it`;
+  }
+  return caddyWiringGap(res && res.stdout, { ...opts, caddyfile });
+}
 function healthzCmd(inst) {
   return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/healthz`;
 }
@@ -281,6 +311,8 @@ module.exports = {
   DNS_BLACKHOLE_IP,
   caddyBlock,
   caddySnippetPath,
+  caddyWiringGap,
+  checkCaddyWiring,
   checkDnsTokenScope,
   classifyZoneScope,
   dnsReleaseEnv,

package/scripts/gds/provision.js

@@ -52,7 +52,7 @@ const crypto = require('node:crypto');
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
-const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
+const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
 const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
 const { teardownInstance } = require('./provision-teardown.js');
@@ -263,6 +263,13 @@ async function provisionInstance(inst, deps) {
       log(`  [preflight] would verify the Cloudflare token can reach zone ${zoneForDomain(inst.domain)} before the address step`);
     }
   }
+  // Caddy preflight (task 1002860, ADR 0303): a box whose base Caddyfile has no tls-check ask
+  // can never certify this domain, so refuse before touching it. Injectable like the DNS check.
+  const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;
+  if (inst.domain && inst.hosting_shape !== 'dedicated' && apply) {
+    const gap = caddyCheck(boxExec, { domain: inst.domain });
+    if (gap) return { ok: false, error: `Caddy preflight failed: ${gap}` };
+  }
   const room = await capacityPreflight(inst, deps);   // box capacity (ADR 0285, task 1003927): an honest refusal BEFORE the status flip — never a silent oversubscribe
   if (room.ok === false) return room;
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'provisioning');
@@ -502,11 +509,14 @@ async function provisionInstance(inst, deps) {
   // Write the instance's OWN <slug>.caddy snippet (idempotent overwrite via the
   // injected writeFile — no read-modify-append to a shared Caddyfile), then reload.
   // The main Caddyfile carries a one-time `import <snippetDir>/*.caddy` (operator
-  // setup). The on-demand-ACME TLS hardening of this block is task P4 (#1945).
+  // setup) — verified after the write, since only a written snippet proves the import
+  // reaches it. The reload is loud: Caddy keeps its old config when it rejects the new one.
   log('  [caddy] write site snippet + reload');
   if (local) {
     boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
-    boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
+    const gap = inst.domain && apply ? caddyCheck(boxExec, { domain: inst.domain, requireHost: true }) : null;
+    if (gap) return { ok: false, error: `Caddy wiring failed: ${gap}` };
+    boxExec(`${sudoP}systemctl reload caddy`);
   } else { log('    (Caddy on the droplet via cloud-init)'); }
 
   // ── step 7: healthz ───────────────────────────────────────────────────────
@@ -740,6 +750,11 @@ async function domainAttachInstance(inst, deps) {
     }
     log(`  [preflight] DNS token can reach zone ${scope.zone} ✓`);
   }
+  const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;   // Caddy preflight (task 1002860, ADR 0303)
+  if (apply) {
+    const gap = caddyCheck(boxExec, { domain: inst.domain });
+    if (gap) return { ok: false, error: `Caddy preflight failed: ${gap}` };
+  }
 
   // The A-record target — the same derivation as provisionInstance step 1.
   const recordIp = standalone
@@ -791,7 +806,9 @@ async function domainAttachInstance(inst, deps) {
   // (and tls-check stops vouching for it) with no separate un-wire step.
   log('  [caddy] write site snippet + reload');
   boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
-  boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
+  const gap = apply ? caddyCheck(boxExec, { domain: inst.domain, requireHost: true }) : null;
+  if (gap) return { ok: false, error: `Caddy wiring failed: ${gap}` };
+  boxExec(`${sudoP}systemctl reload caddy`);
 
   // Release what the re-point moved off, AFTER the new address is wired: the DNS
   // record is the only half of an abandoned address the platform still holds, and

package/scripts/gds/ship-land.js

@@ -209,6 +209,8 @@ async function ciLandServer(taskId, branch, valueSummary) {
       return landBailed(`server publish failed — ${e}`, strandCommand(taskId, 'server'));
     }
     console.log(`  ci-land: server pushed ${branch} + PR ${r.data.pr_url} (auto-merge ${r.data.auto_merge ? 'enabled' : 'NOT enabled — merge it on GitHub'}).`);
+    const assigneeLine = prAssigneeLine(r.data.pr_assignee);
+    if (assigneeLine) console.log(assigneeLine);
     return pollServerPublish(taskId, branch);
   } finally {
     try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch (_) { /* best-effort */ }
@@ -332,6 +334,15 @@ function reconcileBlockedLines(taskId, reason) {
   ];
 }
 
+// task 1003991 — the server opens the PR with ITS credential, so "created by me" on
+// GitHub is empty for the builder; it assigns the PR to them instead, and this says
+// where that makes it findable. Null when the server assigned nobody. Pure + exported.
+function prAssigneeLine(login) {
+  return /^[A-Za-z\d_-]{1,39}$/.test(String(login || ''))
+    ? `  ci-land: the PR is assigned to @${login} — on GitHub it is under Pull requests → Assigned to you (the server opened it, so "Created by you" stays empty).`
+    : null;
+}
+
 // task 1003988 — what to tell a builder while their PR sits RED. The poll used to
 // wait out its nine minutes in silence, so a credential-less box learned only that
 // the land was "pending" and pushed the same commit again (PR 922: nine red runs).
@@ -724,6 +735,7 @@ module.exports = {
   landed,
   pickStaleGateReviewRun,
   reconcileBlockedLines,
+  prAssigneeLine,
   redPrLine,
   redPrLines,
   reconciledCardStatus,

package/src/bongos/routes/auth.js

@@ -1066,20 +1066,41 @@ module.exports = function buildAuthRouter() {
         // The builder kills it from this same Settings page, under Active sessions.
         expiresAt: null,
       });
+      // NAME THE INSTANCE THAT MINTED THIS (task 1003722). A bearer is only
+      // meaningful against the instance that issued it, and the CLI cannot work
+      // that out on its own: paste-token resolves its base as env → the EXISTING
+      // session's api_base → branding default. So on any machine that has talked
+      // to another instance, the STALE api_base wins and a perfectly good token is
+      // verified against — and then bound to — the wrong host. That is the reported
+      // bug: a token minted here landed as a token for a different instance.
+      //
+      // The issuer is the one fact that cannot be recovered at the other end, so it
+      // travels with the token. Same discipline as configuredOAuthOrigin() above:
+      // this instance may state its OWN identity and must assume nothing about the
+      // recipient's machine.
+      const issuer = String(resolveEnv('PUBLIC_ORIGIN') || configuredOAuthOrigin() || '')
+        .trim().replace(/\/+$/, '');
       res.json({
         ok: true,
         token,
         expires_at: row.expires_at,
         builder_login: req.builder.github_login,
+        api_base: issuer || null,
         // A VERB, never a path (task 1003961). This string is composed HERE and run
         // THERE — on an instance, where the core is an installed dependency and
         // `scripts/gds/` does not exist, so the previous
         // `node scripts/gds/paste-token.js <token>` named a file the builder did not
         // have and the copy button handed out a command that could not run. `bongos`
         // is on PATH in any installed instance, so the verb form is layout- and
-        // directory-independent. Same discipline as configuredOAuthOrigin() above:
-        // nothing about the RECIPIENT's filesystem may be assumed here.
-        paste_command: `bongos paste-token ${token}`,
+        // directory-independent.
+        //
+        // The --api-base flag carries the issuer above. Omitted when this instance
+        // cannot state its own origin, because a flag with an empty value would be
+        // worse than none: paste-token would take '' as an explicit instruction and
+        // stop falling back to the resolution that works today.
+        paste_command: issuer
+          ? `bongos paste-token ${token} --api-base ${issuer}`
+          : `bongos paste-token ${token}`,
       });
     } catch (err) {
       log.error('[gds] POST /auth/cli-token/issue', err);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.839'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.840'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bongos_cli.mjs

@@ -65,10 +65,19 @@ test('paste-token is bundled into the standalone binary, like reauth', () => {
 
 test('the server emits exactly the verb the CLI registers', () => {
   const routes = readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'bongos', 'routes', 'auth.js'), 'utf8');
-  const m = routes.match(/paste_command:\s*`([^`]+)`/);
-  assert.ok(m, 'auth.js should emit a paste_command template literal');
-  const verb = m[1].split(' ')[1];
-  assert.ok(cli.VERBS[verb], `server emits "bongos ${verb}" but the CLI has no such verb`);
+  // Read EVERY branch, not just a literal sitting immediately after the key. Since
+  // task 1003722 paste_command is a ternary (the issuing instance is stamped in when
+  // known), and a matcher anchored on `paste_command:\s*\`` silently stopped matching
+  // at all — reporting "auth.js should emit a paste_command template literal" for a
+  // field that was right there. A test that cannot find what it checks fails as though
+  // the thing were missing, which sends the reader hunting in the wrong file.
+  const tail = routes.slice(routes.indexOf('paste_command:'));
+  const cmds = [...tail.matchAll(/`([^`]*bongos paste-token[^`]*)`/g)].map((x) => x[1]);
+  assert.ok(cmds.length > 0, 'auth.js should emit at least one paste_command template literal');
+  for (const cmd of cmds) {
+    const verb = cmd.split(' ')[1];
+    assert.ok(cli.VERBS[verb], `server emits "bongos ${verb}" but the CLI has no such verb`);
+  }
 });
 
 test('VERBS: selfHelp is only claimed by scripts that really print their own usage', () => {

package/tests/cli_token_reissue.mjs

@@ -115,10 +115,24 @@ t('POST /auth/cli-token/issue is defined', () => {
 const issueBlock = (() => {
   const start = routeSrc.indexOf("'/auth/cli-token/issue'");
   if (start === -1) return '';
-  // crude but enough: take ~3000 chars from the route literal forward.
-  return routeSrc.slice(start, start + 3000);
+  // Bound the window at the NEXT route registration rather than a fixed char count.
+  // A fixed ~3000-char window silently truncates as soon as the handler grows: adding
+  // a comment to this route pushed paste_command out of the slice, and every assertion
+  // about it failed as though the field had been deleted (task 1003722). A byte budget
+  // is not a unit of code, and a scan that can quietly stop seeing what it checks is
+  // the same failure shape as a scan that quietly finds nothing.
+  const next = routeSrc.indexOf('\n  router.', start);
+  return routeSrc.slice(start, next === -1 ? routeSrc.length : next);
 })();
 
+// The window above must actually contain the handler — otherwise every assertion in
+// this file passes or fails for reasons that have nothing to do with the route.
+t('the extracted route window covers the whole handler', () => {
+  assert.ok(issueBlock.includes('sessionCookieToken(req)'), 'window should reach the cookie gate near the top');
+  assert.ok(issueBlock.includes('paste_command'), 'window should reach the response at the bottom');
+  assert.ok(!issueBlock.includes("'/auth/revoke'"), 'window should stop before the next route');
+});
+
 // Refreshed for the current handler (task 1003961). These two assertions named
 // `parseCookie(req, SESSION_COOKIE)` and `res.status(403)`, the shape BEFORE the
 // handler moved to the `sessionCookieToken` helper and the `res.fail` envelope.
@@ -154,15 +168,48 @@ t('returns a paste_command field the portal can show verbatim', () => {
 // instance builder a command naming a file they did not have. A verb has no such
 // coupling — `bongos` is on PATH wherever the core is installed.
 t('paste_command names a CLI VERB, never a filesystem path', () => {
-  const m = issueBlock.match(/paste_command:\s*`([^`]+)`/);
-  assert.ok(m, 'paste_command should be a template literal the test can read');
-  const cmd = m[1];
+  // Read EVERY template literal the field can evaluate to, not just the first. It is a
+  // ternary since task 1003722 (issuer present / absent), and an assertion that saw
+  // only one branch would leave the other unguarded — which is how a rule stops
+  // applying without anyone editing it.
+  const tail = issueBlock.slice(issueBlock.indexOf('paste_command:'));
+  const cmds = [...tail.matchAll(/`([^`]*bongos paste-token[^`]*)`/g)].map((m) => m[1]);
+  assert.equal(cmds.length, 2, `expected both ternary branches, got ${cmds.length}`);
+  for (const cmd of cmds) {
   assert.ok(/^bongos paste-token /.test(cmd),
     `paste_command must start with the verb form, got: ${cmd}`);
-  assert.ok(!cmd.includes('/'),
-    `paste_command must contain no path separator — it runs where the layout differs. Got: ${cmd}`);
+  // The invariant is "names no FILE ON THE RECIPIENT'S DISK", which the original
+  // spelling approximated as "contains no slash". That was too broad once the command
+  // had to carry the issuer URL (task 1003722) — `https://host` is not a filesystem
+  // path, and forbidding every slash would have blocked the fix for a different bug
+  // while protecting nothing extra. Pin what the comment above actually says instead.
+  assert.ok(!/(^|\s)[.~]?\/|\bscripts\b|\.js\b/.test(cmd),
+    `paste_command must name no path or script file — it runs where the layout differs. Got: ${cmd}`);
   assert.ok(!/\bnode\b/.test(cmd),
     `paste_command must not invoke node directly (that assumes a script on disk). Got: ${cmd}`);
+  }
+});
+
+// The bug this pins (task 1003722): a bearer is only valid against the instance that
+// minted it, but paste-token infers its base as env → the EXISTING session's api_base
+// → branding default. On a machine that has used a second instance the stale api_base
+// wins, so a token minted here was bound to the wrong host and every /builder-* command
+// then authenticated somewhere unintended. The issuer cannot be recovered at the other
+// end, so it has to travel with the token.
+t('paste_command carries the issuing instance, so the CLI cannot guess wrong', () => {
+  const m = issueBlock.match(/paste_command:\s*issuer\s*\?\s*`([^`]+)`/);
+  assert.ok(m, 'paste_command should still be a readable template literal');
+  assert.ok(/--api-base \$\{issuer\}/.test(m[1]),
+    `the issuing origin must be stamped into the command, got: ${m[1]}`);
+  assert.ok(/api_base:\s*issuer/.test(issueBlock),
+    'the response should also expose api_base for non-copy-paste consumers');
+});
+
+t('an instance that cannot state its own origin omits the flag rather than sending an empty one', () => {
+  // `--api-base ''` would read at the far end as an explicit instruction and suppress
+  // the fallback that works today — strictly worse than sending no flag at all.
+  assert.ok(/:\s*`bongos paste-token \$\{token\}`/.test(issueBlock),
+    'there must be a flagless branch for the empty-issuer case');
 });
 
 // ---------------------------------------------------------------------------

package/tests/paste_token_api_base.mjs

@@ -0,0 +1,87 @@
+// tests/paste_token_api_base.mjs — which INSTANCE a pasted CLI token belongs to
+// (task 1003722, re-filed from task 1003312).
+//
+// A bearer is only meaningful against the instance that minted it. paste-token used to
+// decide that entirely by inference — env → the EXISTING session's api_base → branding
+// default — which is correct right up until the builder touches a second instance. The
+// stale api_base then outranks the instance that actually issued the token, so the
+// paste is verified against, and written as, the wrong host. The reported symptom was a
+// token minted on this instance landing as a token for an unrelated one, after which
+// every /builder-* command authenticated somewhere unintended.
+//
+// The hall now stamps the issuer into the paste command, and the flag outranks every
+// inferred source. These exercise the two pure helpers directly rather than scanning
+// the file, because the thing that broke is a DECISION, not a spelling.
+//
+// Run:  node --test tests/paste_token_api_base.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { parseArgs, resolveBaseForPaste } = require(path.join(ROOT, 'scripts', 'gds', 'paste-token.js'));
+
+const STALE = 'https://some-other-instance.example';
+const stale = () => STALE;
+
+test('the flag wins over the inferred base — the whole point of the fix', () => {
+  const r = resolveBaseForPaste({ flag: 'https://cloudbongos.com', resolve: stale });
+  assert.equal(r.base, 'https://cloudbongos.com');
+  assert.equal(r.source, 'flag');
+});
+
+test('no flag keeps the existing resolution exactly as it was', () => {
+  // An older instance's paste command carries no flag. That path must not change, or
+  // this fix trades one wrong-instance bug for another.
+  for (const flag of [undefined, null, '', '   ']) {
+    const r = resolveBaseForPaste({ flag, resolve: stale });
+    assert.equal(r.base, STALE, `flag ${JSON.stringify(flag)} should fall through`);
+    assert.equal(r.source, 'resolved');
+  }
+});
+
+test('a trailing slash is normalised, so the verify URL never doubles it', () => {
+  // API_BASE is concatenated with '/api/bongos/me'; a kept slash makes '//api/...'.
+  assert.equal(resolveBaseForPaste({ flag: 'https://x.example/', resolve: stale }).base, 'https://x.example');
+  assert.equal(resolveBaseForPaste({ flag: 'https://x.example///', resolve: stale }).base, 'https://x.example');
+});
+
+test('a malformed --api-base is refused, never silently ignored', () => {
+  // Refusing matters more than it looks: falling back on a malformed flag would send
+  // the token to the stale host — the exact failure the flag exists to prevent, but
+  // now silent, because the builder believes they named the instance.
+  for (const bad of ['cloudbongos.com', 'ftp://x.example', 'javascript:alert(1)', '/builders', 'https://']) {
+    const r = resolveBaseForPaste({ flag: bad, resolve: stale });
+    assert.equal(r.base, null, `${bad} should not resolve`);
+    assert.equal(r.source, 'invalid');
+  }
+});
+
+test('parseArgs reads the token and both flag spellings', () => {
+  const T = 'a'.repeat(64);
+  assert.deepEqual(parseArgs([T]), { token: T, apiBase: null });
+  assert.deepEqual(parseArgs([T, '--api-base', 'https://x.example']), { token: T, apiBase: 'https://x.example' });
+  assert.deepEqual(parseArgs([T, '--api-base=https://x.example']), { token: T, apiBase: 'https://x.example' });
+  // Order must not matter: the hall composes the command, and a future change to that
+  // string should not be able to break the paste silently.
+  assert.deepEqual(parseArgs(['--api-base', 'https://x.example', T]), { token: T, apiBase: 'https://x.example' });
+});
+
+test('a flag value is never mistaken for the token', () => {
+  // The bug this forecloses: treating argv[2] as the token, as the script used to,
+  // makes `--api-base https://x T` paste the URL as a bearer.
+  assert.equal(parseArgs(['--api-base', 'https://x.example', 'tok']).token, 'tok');
+  assert.equal(parseArgs(['--api-base=https://x.example', 'tok']).token, 'tok');
+});
+
+test('a dangling --api-base does not swallow the token', () => {
+  // `bongos paste-token --api-base` with nothing after it: the flag is empty and
+  // invalid, and main() exits on that rather than pasting whatever followed.
+  const a = parseArgs(['--api-base']);
+  assert.equal(a.apiBase, '');
+  assert.equal(a.token, null);
+});