@bongos/core 1.19.844 → 1.19.846

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.844",
-  "core_contract": "1.19.844",
-  "source_commit": "980c92b65de8a99f2772b86fb7f69e365eed4dc6",
+  "core_version": "1.19.846",
+  "core_contract": "1.19.846",
+  "source_commit": "7875bef1fd719fda2b08d1c47132af0bf09470c0",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T18:59:26.454Z",
+  "built_at": "2026-09-17T19:26:58.935Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 495,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2272,
+    "functional_verbatim": 2273,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2793,
-  "tree_sha256": "af2219bd2cdea4b5ebb159bd2cc60e9d015182c15121196f16e1cbb9b4ac7bf5",
+  "file_count": 2794,
+  "tree_sha256": "0ce103dd9544b2dc4d8ad8534a617c7e83884733163303d5eb381d4d44f49cb3",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2567,7 +2567,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "b575f34143de0be30fadfd63bea76f77305fa175beee3960291414ff6b55d611"
+      "sha256": "eaa7dca723187a394a3b6ee252bbb81b13b76cc384a4651b6ee74a859af9d611"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2577,7 +2577,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "185ae1211c5c546bf5d0a57acd5c97ad56b4e98133ba2aceded36bf2cc95c4ca"
+      "sha256": "d764a731750a2e1028c95a1fb94148e35ed3450b7394323d66c774959888105b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7902,12 +7902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a6133e7d6f098080ea0b2d2d21d3bbf35c90a716dc20a4436a68c74c6416da84"
+      "sha256": "4c1cac911818d09a26f42a791f1a2ce4a7add73cb38a8f7186ee0fd3d6425a3b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "65a0092e9c2f20b87c7de5d89e552e005820a70cc5c00fb228d904363d842b22"
+      "sha256": "d9c4e3866e590697c2a303536f799c9a7a99925295201df566d80e8c1b91f59f"
     },
     {
       "path": "public-docs/index.html",
@@ -9842,7 +9842,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a97295bdd0b3f0fe6b6c903b910a2512e7fffcc4a98f6d2844096cbc6015d7a7"
+      "sha256": "7ed9c1945c4d366375bd4009c00e90dbcfb847de0fc086bcd73e4fbf33589b36"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11127,7 +11127,7 @@
     {
       "path": "tests/git_guard.mjs",
       "mode": "0000644",
-      "sha256": "1b0b13310fb1afa544784d18fe0fa3ac2abc0f5ecc01e3ec0cb71c227df296ae"
+      "sha256": "95ec763418aceec86f239edc1e78154c0fb9f67ffcb566c3062c75eceeb09b24"
     },
     {
       "path": "tests/git_merge_regen.mjs",
@@ -11744,6 +11744,11 @@
       "mode": "0000644",
       "sha256": "7035673d4b9e55166acc19d5c40a2128c0aceb233bca6856eace34bebc1139e4"
     },
+    {
+      "path": "tests/hook_shell_tools.mjs",
+      "mode": "0000644",
+      "sha256": "88db0fedd800ad8a8f6fd9d912844238bfb7bb944d5bf648eb8818eca6854466"
+    },
     {
       "path": "tests/hook_user_agents.mjs",
       "mode": "0000644",
@@ -12052,7 +12057,7 @@
     {
       "path": "tests/lifecycle-card.mjs",
       "mode": "0000644",
-      "sha256": "3bf8585f0cb4afa7db94d3a8db37d0fea34336dfab3053f518aae029199b1563"
+      "sha256": "a308fb62ff11b442c20e3eeb3eb9617a1b3ad1abcba4ec4b2cc6b349b3e6aa5e"
     },
     {
       "path": "tests/lifecycle_breakdown_view.mjs",
@@ -13152,7 +13157,7 @@
     {
       "path": "tests/secret_gate.mjs",
       "mode": "0000644",
-      "sha256": "20de62b7d869763c703317dae4bc3896cbf4308d1211c8fcbffbfbd32465b1b5"
+      "sha256": "46ea51955dbcc4874684fdb06b298e744e7e019d2f3971ae7953d37ede96958a"
     },
     {
       "path": "tests/security_docs.mjs",
@@ -13437,7 +13442,7 @@
     {
       "path": "tests/skill_friction_kind.mjs",
       "mode": "0000644",
-      "sha256": "baaf5935cc748e7eb9596d1c96c3c20aa2ee3917377d32b9104408b7b07165a4"
+      "sha256": "28d88f97e66c1ca8728d311a3cc8c58bb6df058dd9ee91aa632028faa5b5bdcf"
     },
     {
       "path": "tests/skill_grade_audit.mjs",

package/docs/file-map.md

@@ -475,10 +475,10 @@ To install on a new machine, symlink each routine's directory under `~/.claude/s
 
 ```
 .claude/hooks/
-├── secret-gate.js            ← PreToolUse (Edit|Write|MultiEdit|NotebookEdit|Bash): cooperative, fail-OPEN block of secret-shaped content before it reaches the tree or a shell (task 1003125, ADR 0022)
+├── secret-gate.js            ← PreToolUse (Edit|Write|MultiEdit|NotebookEdit|Bash|PowerShell): cooperative, fail-OPEN block of secret-shaped content before it reaches the tree or a shell (task 1003125, ADR 0022)
 ├── run-node.sh               ← the node resolver every hook command runs through (task 1003548): $OTB_NODE_BIN → PATH → known install dirs → nvm; one actionable line + exit 1 when none is found. 1,055 hook runs had died silently with `node: command not found`
 ├── edit-hints.js             ← PostToolUse (Edit|Write|MultiEdit): lints a saved SKILL.md's frontmatter (scripts/gds/skill-lint.js) and names the generator an edited path makes stale (copy-registry, repo-map blocks, file-map, openapi, §13 snippet) with its command (task 1003548)
-├── git-guard.js              ← PreToolUse (Bash): same contract as secret-gate — blocks `git stash` (repo-global stack, learning 1000215), raw `git worktree remove` (follows the node_modules junction, task 1002809), `git push origin main` (PR-only) and `git branch -D`, each with its remedy; kill-switch BONGOS_GIT_GUARD_OFF=1 (task 1003365)
+├── git-guard.js              ← PreToolUse (Bash|PowerShell): same contract as secret-gate — blocks `git stash` (repo-global stack, learning 1000215), raw `git worktree remove` (follows the node_modules junction, task 1002809), `git push origin main` (PR-only) and `git branch -D`, each with its remedy; kill-switch BONGOS_GIT_GUARD_OFF=1 (task 1003365)
 ├── _core-resolve.js          ← shared helper, not a hook: locates a core module/script across the monolith vs `node_modules/@cloudbongos/core` layouts; required by most hooks here and by four routine scripts under `.claude/scheduled-tasks/`
 ├── cascade-route.js          ← PreToolUse (Task|Agent): cheapest-sufficient start-model advisory for a subagent spawn (ADR 0024); inert unless OTB_AUTONOMY_ENABLED=1
 ├── land-watch-card.js        ← UserPromptSubmit: delivers the SHIPPED banner once an async CI land completes (reads `scripts/gds/land-watch.js`)
@@ -489,8 +489,9 @@ To install on a new machine, symlink each routine's directory under `~/.claude/s
 ├── recall-hints.js           ← SessionStart: when the session opens holding a claim, surface the top project-knowledge hits for that task via POST /api/gds/search (#963/V4.R25, ADR 0060)
 ├── conductor.js              ← UserPromptSubmit: MAS Conductor advisory + dispatch directive (#427/#439); self-gates on OTB_CONDUCTOR_OFF / OTB_SUBAGENT
 ├── session-cards.js          ← UserPromptSubmit: deterministic delivery of READ-ONLY in-session cards (builder-start, status) — pre-renders the card + injects a one-step render directive (task 1288)
-├── lifecycle-card.js         ← PostToolUse: deterministic delivery of MUTATING lifecycle cards (claim/ship/release) — the write-side mirror of session-cards.js (task 1288)
+├── lifecycle-card.js         ← PostToolUse (Bash|PowerShell): deterministic delivery of MUTATING lifecycle cards (claim/ship/release) — the write-side mirror of session-cards.js (task 1288)
 ├── stuck-detector.js         ← PostToolUse + PostToolUseFailure (Bash|PowerShell): the third time one session hits the same wall — the same `[otb-plain]` card for the same task id, or the same red check — it injects ONE instruction: stop retrying, diagnose (path named), or /ask-for-help. Never blocks; silent with no card; kill-switch BONGOS_STUCK_DETECTOR_OFF=1 (task 1003990)
+├── shell-tools.js            ← shared helper, not a hook: the ONE list of tool names that carry a shell command (`Bash`, `PowerShell`) + the `matcher` string the settings entries must use. git-guard, secret-gate, lifecycle-card and stuck-detector all test through it; four private copies of `Bash` had left every Windows session unguarded, silently (task 1003999, pinned by tests/hook_shell_tools.mjs)
 ├── stuck-strikes.js          ← shared helper, not a hook: the per-session strike counter (hashed signatures in os.tmpdir()) + the static instruction text; stuck-detector.js, git-guard.js and worktree-guard.js all count through it (task 1003990)
 ├── pre-compact.js            ← PreCompact: thin reader around eviction-policy.js — emits an eviction directive (blocks to drop + one-line recovery stubs) at the compaction seam (task 1349)
 ├── eviction-policy.js        ← pure deterministic in-session compaction classifier (transcript turns → eviction set + replacement stubs); no I/O, unit-tested in tests/eviction_policy.mjs; consumed by pre-compact.js (task 1348)

package/docs/module-api-changelog.md

@@ -2162,5 +2162,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.842 with no explicit bump. run 35259608793. (task 1002620)
   1.19.844 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.843 with no explicit bump. run 35262101669. (task 1002620)
+  1.19.845 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.844 with no explicit bump. run 35263096514. (task 1002620)
+  1.19.846 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.845 with no explicit bump. run 35264882014. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.844",
+  "version": "1.19.846",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.844",
+      "version": "1.19.846",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.844",
+  "version": "1.19.846",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.844'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.846'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/git_guard.mjs

@@ -31,6 +31,14 @@ function bash(command, env) {
   return runHook(JSON.stringify({ tool_name: 'Bash', tool_input: { command } }), env);
 }
 
+// The same command as a Windows box sends it. Claude Code's shell tool is named
+// `PowerShell` there, carrying the identical `tool_input.command` — and this hook
+// matched `Bash` alone, so every guarded shape was unguarded on Windows (task
+// 1003999).
+function pwsh(command, env) {
+  return runHook(JSON.stringify({ tool_name: 'PowerShell', tool_input: { command } }), env);
+}
+
 test('blocks every git stash form except the read-only list', () => {
   for (const cmd of [
     'git stash',
@@ -96,7 +104,21 @@ test('allows the read-only, the supported, and the ordinary', () => {
   }
 });
 
-test('non-Bash tools and unknown payload shapes fail open', () => {
+test('a Windows session is guarded: the PowerShell tool blocks the same shapes', () => {
+  for (const cmd of ['git stash', 'git push origin main', 'git worktree remove wt-x', 'git branch -D feature']) {
+    const r = pwsh(cmd);
+    assert.equal(r.status, 2, `PowerShell went unguarded for: ${cmd}`);
+    assert.match(r.stderr, /git-guard: blocked/);
+  }
+});
+
+test('the PowerShell tool keeps the same false-positive floor as Bash', () => {
+  for (const cmd of ['git stash list', 'git push origin my-branch', 'npm test']) {
+    assert.equal(pwsh(cmd).status, 0, `false positive on PowerShell: ${cmd}`);
+  }
+});
+
+test('a non-shell tool and unknown payload shapes still fail open', () => {
   assert.equal(
     runHook(JSON.stringify({ tool_name: 'Write', tool_input: { file_path: 'x.js', content: 'git stash' } })).status,
     0,

package/tests/hook_shell_tools.mjs

@@ -0,0 +1,115 @@
+// tests/hook_shell_tools.mjs — the settings matcher and the in-hook tool check are
+// two halves of one gate, and this pins that they agree (task 1003999).
+//
+// THE BUG THIS CLOSES. A hook runs only if its `matcher` in .claude/settings.json
+// names the tool, and acts only if its own `tool_name` check admits it. Widening
+// one without the other changes nothing. Three hooks hard-coded `'Bash'` on both
+// halves, so on a Windows box — where Claude Code's shell tool is named
+// `PowerShell` and carries the identical `tool_input.command` — git-guard did not
+// see a `git push origin main`, secret-gate did not scan a command for
+// credentials, and lifecycle-card printed no claim or ship card.
+//
+// It failed silently in the worst way: the hooks ran, matched nothing and exited
+// 0, which looks exactly like a clean command. So the drift is what gets asserted
+// here, not the behaviour — tests/git_guard.mjs owns the behaviour, with a real
+// PowerShell payload against the live hook.
+//
+// Adding a future shell tool is one edit in .claude/hooks/shell-tools.js; this
+// test then names every settings entry that must follow.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+const { SHELL_TOOLS, MATCHER, isShellTool } = require(
+  path.join(ROOT, '.claude', 'hooks', 'shell-tools.js'),
+);
+
+const settings = JSON.parse(
+  fs.readFileSync(path.join(ROOT, '.claude', 'settings.json'), 'utf8'),
+);
+
+// Every hook whose job is to guard or read a shell command. The bare basename is
+// how the settings `command` string names it.
+const SHELL_HOOKS = [
+  'git-guard.js',
+  'secret-gate.js',
+  'lifecycle-card.js',
+  'stuck-detector.js',
+];
+
+// Flatten settings.hooks into [{event, matcher, command}] so an entry can be found
+// by the hook file it runs, wherever it sits.
+function entries() {
+  const out = [];
+  for (const [event, groups] of Object.entries(settings.hooks || {})) {
+    for (const group of groups || []) {
+      for (const h of group.hooks || []) {
+        out.push({ event, matcher: group.matcher || '', command: h.command || '' });
+      }
+    }
+  }
+  return out;
+}
+
+test('every shell-reading hook is registered, and its matcher names every shell tool', () => {
+  const all = entries();
+  for (const hook of SHELL_HOOKS) {
+    const found = all.filter((e) => e.command.includes(hook));
+    assert.ok(found.length > 0, `${hook} is not registered in settings.json at all`);
+    for (const e of found) {
+      const named = e.matcher.split('|').map((s) => s.trim());
+      for (const tool of SHELL_TOOLS) {
+        assert.ok(
+          named.includes(tool),
+          `${hook} (${e.event}) matcher "${e.matcher}" omits ${tool} — ` +
+            'that shell tool reaches the hook not at all, silently',
+        );
+      }
+    }
+  }
+});
+
+test('no shell-reading hook still hard-codes a single tool name', () => {
+  for (const hook of SHELL_HOOKS) {
+    const src = fs.readFileSync(path.join(ROOT, '.claude', 'hooks', hook), 'utf8');
+    // The precise shape that caused this: an equality test against one tool name.
+    // A hook may still MENTION 'Bash' (comments, a candidateTexts case for a
+    // non-shell tool), so only the comparison is refused.
+    for (const tool of SHELL_TOOLS) {
+      const re = new RegExp(`(!==|===)\\s*['"]${tool}['"]|['"]${tool}['"]\\s*(!==|===)`);
+      assert.doesNotMatch(
+        src, re,
+        `${hook} compares tool_name against '${tool}' directly — use isShellTool()`,
+      );
+    }
+    assert.match(
+      src, /require\(['"]\.\/shell-tools['"]\)/,
+      `${hook} does not share the shell-tool list`,
+    );
+  }
+});
+
+test('MATCHER is built from the list, so it cannot drift from it', () => {
+  assert.equal(MATCHER, SHELL_TOOLS.join('|'));
+  // And it is what the settings entries actually carry, for the bare-shell hooks
+  // (secret-gate also matches the file-writing tools, so it is a superset).
+  const gitGuard = entries().find((e) => e.command.includes('git-guard.js'));
+  assert.equal(gitGuard.matcher, MATCHER);
+});
+
+test('isShellTool admits every listed tool and nothing else, and never throws', () => {
+  for (const tool of SHELL_TOOLS) assert.equal(isShellTool(tool), true, tool);
+  for (const other of ['Write', 'Edit', 'Read', 'bash', 'powershell', '']) {
+    assert.equal(isShellTool(other), false, other);
+  }
+  // A hook must not throw on an odd payload — that is a fail-open on a guard.
+  for (const junk of [undefined, null, 0, {}, []]) {
+    assert.equal(isShellTool(junk), false);
+  }
+});

package/tests/lifecycle-card.mjs

@@ -18,9 +18,17 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { requireHostModule } from './helpers.mjs';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const hook = requireHostModule(require, '../.claude/hooks/lifecycle-card.js');
+const HOOK = path.join(
+  path.dirname(fileURLToPath(import.meta.url)), '..', '.claude', 'hooks', 'lifecycle-card.js',
+);
 
 let passed = 0;
 let failed = 0;
@@ -30,6 +38,43 @@ function test(name, fn) {
 }
 const count = (hay, needle) => hay.split(needle).length - 1;
 
+// main() reads stdin and is not exported, so the tool-name gate is only reachable by
+// spawning the hook the way Claude Code does. That gate matched `Bash` alone, so a
+// claim or ship run from a Windows session — where the shell tool is named
+// `PowerShell` — produced no card at all (task 1003999).
+function runHook(payload) {
+  const r = spawnSync(process.execPath, [HOOK], {
+    input: JSON.stringify(payload), encoding: 'utf8',
+    env: { ...process.env, OTB_SESSION_CARDS_OFF: '', OTB_SUBAGENT: '' },
+  });
+  return r.stdout || '';
+}
+
+// A ship run's output as the hook sees it: the widgets-ON marker naming a card file.
+function shipPayload(toolName, cardPath) {
+  return {
+    tool_name: toolName,
+    tool_input: { command: 'node scripts/gds/ship.js 1003999 --summary x' },
+    tool_response: `shipped\n[otb-card-html] ${cardPath}\n`,
+  };
+}
+
+test('a lifecycle card is emitted for every shell tool, not Bash alone', () => {
+  const cardPath = path.join(os.tmpdir(), `otb-test-card-${process.pid}.html`);
+  fs.writeFileSync(cardPath, '<div id="card">shipped</div>');
+  try {
+    for (const tool of ['Bash', 'PowerShell']) {
+      const out = runHook(shipPayload(tool, cardPath));
+      assert.ok(out.includes('additionalContext'), `${tool} got no card directive`);
+      assert.ok(out.includes('show_widget'), `${tool} card directive is malformed`);
+    }
+    // A tool that carries no shell command still gets nothing.
+    assert.equal(runHook(shipPayload('Write', cardPath)).trim(), '');
+  } finally {
+    try { fs.unlinkSync(cardPath); } catch (_) { /* best effort */ }
+  }
+});
+
 // ---------- matchesLifecycle ----------
 
 test('matches claim / ship / release script invocations', () => {

package/tests/secret_gate.mjs

@@ -65,6 +65,51 @@ test('blocks a Bash command smuggling a literal token; allows ordinary commands'
   }
 });
 
+// The identical command as a Windows session sends it: Claude Code names the shell
+// tool `PowerShell` there (task 1003999).
+//
+// WHERE THE REAL DEFECT WAS, precisely. For THIS gate the load-bearing half was the
+// settings `matcher`, which listed `Bash` and so never ran the hook on a Windows box
+// at all; tests/hook_shell_tools.mjs owns that half. candidateTexts() was survivable
+// on its own, because an unrecognised tool falls through to `JSON.stringify(ti)` —
+// which still contains the command, so decide() blocked anyway. Verified by probe:
+// narrowing candidateTexts() back to `=== 'Bash'` left the decide() assertions below
+// GREEN. They are kept because they pin the end-state contract, but they are not what
+// catches a narrowing, so the last assertion goes at candidateTexts() directly: a
+// shell tool must yield the command FIELD, not a stringified blob that happens to
+// contain it. That distinction is the difference between scanning a command and
+// scanning it by accident.
+test('the PowerShell tool is scanned exactly as Bash is, command field and all', () => {
+  assert.equal(
+    gate.decide({ tool_name: 'PowerShell', tool_input: { command: `echo "${FAKE.anthropic}" >> notes.txt` } }, ENV_OFF).block,
+    true,
+    'a secret in a PowerShell command went unscanned',
+  );
+  for (const cmd of ['npm test', 'git commit -m "feat: rotate the key handling (ADR 0022)"']) {
+    assert.equal(
+      gate.decide({ tool_name: 'PowerShell', tool_input: { command: cmd } }, ENV_OFF).block,
+      false, `false positive on PowerShell: ${cmd}`,
+    );
+  }
+  // And it inherits Bash's rule that a command never gets the path allowlist.
+  assert.equal(
+    gate.decide(
+      { tool_name: 'PowerShell', tool_input: { file_path: 'tests/bfg.mjs', command: `echo ${FAKE.github}` } },
+      ENV_OFF,
+    ).block,
+    true,
+    'the allowlist leaked to a PowerShell command',
+  );
+
+  // The assertion that actually reds when the shell-tool branch narrows: the command
+  // field is chosen for it, not reached through the unknown-tool stringify fallback.
+  assert.deepEqual(
+    gate.candidateTexts('PowerShell', { command: 'echo hi', file_path: 'x.js' }),
+    ['echo hi'],
+    'a shell tool must yield its command field, not a stringified payload',
+  );
+});
+
 test('clean writes pass; short/placeholder shapes below the length floors pass', () => {
   for (const content of [
     'const label = "use your ghp_ token here";', // prefix alone, no 30-char body

package/tests/skill_friction_kind.mjs

@@ -158,6 +158,40 @@ test('the legacy title prefix is still exported and still the nightly routine\'s
   );
 });
 
+// ---- the flip itself (task 1003963) ----------------------------------------
+//
+// The routine filed `--kind cleanup` for as long as the deployed core pin ran
+// behind the migration that made `skill-friction` a real kind. That window is
+// closed and the flip has landed — but the flip lives in prose inside a SKILL.md
+// that an agent reads and follows, so nothing but this assertion stops a later
+// edit from reverting it by accident. Both halves matter: that the new kind IS
+// the one the worked example passes, and that the two pre-`core_244` stand-ins
+// are NOT offered as alternatives beside it (a `--kind cleanup` left in the
+// example would split these rows across kinds again, which is the bug 1003105
+// and 1003963 together exist to close).
+
+test('the nightly routine files --kind skill-friction, not the pre-core_244 stand-ins', () => {
+  const routine = fs.readFileSync(
+    path.join(ROOT, '.claude', 'scheduled-tasks', 'skill-usage-review', 'SKILL.md'), 'utf8'
+  );
+  // Scope BOTH assertions to the runnable example, not to the whole file: the
+  // note above it explains the old stand-ins on purpose and must stay free to
+  // name them — and, the other way round, a `--kind skill-friction` sitting in
+  // that prose would satisfy a file-wide positive match while the example the
+  // agent actually copies still said `cleanup`. (Verified: reverting only the
+  // example left a file-wide match green.)
+  const example = routine.slice(routine.indexOf('node scripts/gds/capture.js'));
+  const block = example.slice(0, example.indexOf('```'));
+  assert.match(
+    block, /--kind skill-friction/,
+    'the capture.js example must pass the real kind'
+  );
+  assert.doesNotMatch(
+    block, /--kind (cleanup|bug)\b/,
+    'the example must not still offer cleanup/bug — that is the split this closed'
+  );
+});
+
 console.log('');
 console.log(`skill-friction kind + visibility gate (task 1003105): ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);