@bongos/core 1.19.883 → 1.19.885

package/tests/session_rename_fallback.mjs

@@ -12,9 +12,9 @@
 // So these tests assert the FALLBACK path fires — a happy-path test on the new name alone would
 // pass just as well with the back-compat deleted, which is exactly the regression that matters.
 //
-// Three of the read-lists are DUPLICATED rather than imported, because their modules cannot reach
-// the canonical one (dependency-free middleware, a separately-bundled Electron app). Those copies
-// are pinned here against the real list by parsing the source — an unpinned copy is how a rename
+// Some of the read-lists are DUPLICATED rather than imported, because their modules cannot reach
+// the canonical one (dependency-free middleware, static browser surfaces). Those copies are
+// pinned here against the real list by parsing the source — an unpinned copy is how a rename
 // half-lands.
 
 import test from 'node:test';
@@ -235,6 +235,11 @@ test('routes/auth.js sets ONLY the head name and derives the clear-list from the
 });
 
 // ── 5. the duplicated copies are pinned to the canonical lists ──────────────────────────────
+//
+// There used to be a third copy here and a whole section 7 exercising it: the Dev Box Electron
+// app shipped as its own bundle, so it could not import instance-config and carried its own
+// read-list. Task 1003891 deleted that app, so the copy it was pinned against no longer exists
+// and the cases went with it — there is nothing left to drift.
 
 test('rate-limit.js — its dependency-free copy of the cookie names matches the real list', () => {
   const src = read('src/bongos/middleware/rate-limit.js');
@@ -245,19 +250,6 @@ test('rate-limit.js — its dependency-free copy of the cookie names matches the
     'the limiter’s copy drifted from src/bongos/auth.js SESSION_COOKIE_NAMES');
 });
 
-test('dev-box session-store — its bundled copy of the filenames matches the real list', () => {
-  const src = read('modules/dev-box/app/src/session-store.js');
-  const head = /const FILE = path\.join\(DIR, '([^']+)'\)/.exec(src);
-  assert.ok(head, 'FILE not found in the dev-box session store');
-  const legacy = /const FILES_LEGACY = \[([^\]]*)\]/.exec(src);
-  assert.ok(legacy, 'FILES_LEGACY not found — the app would stop reading un-migrated sessions');
-  const names = [head[1], ...[...legacy[1].matchAll(/'([^']+\.json)'/g)].map((x) => x[1])];
-  assert.deepEqual(names, ic.SESSION_FILENAMES,
-    'the dev-box app’s copy drifted from src/instance-config.js SESSION_FILENAMES');
-  // It must WRITE only the head name.
-  assert.doesNotMatch(src, /writeFileSync\(\s*FILES_LEGACY/, 'the app must never write a legacy name');
-});
-
 test('the browser logout clears every session-cookie name', () => {
   // Three static surfaces expire the cookie client-side. One that misses the current name leaves a
   // live cookie behind after "sign out".
@@ -288,80 +280,6 @@ test('the baked box scripts scan BOTH session filenames', () => {
   }
 });
 
-// ── 7. the dev-box app's own copy of the fallback, and its sign-out ─────────────────────────
-//
-// The Electron app shares the CLI's session file on purpose (ADR 0045). It ships as its own
-// bundle, so it cannot import instance-config and carries its own read-list — which means its
-// fallback needs exercising, not just pinning.
-function inDevBoxSandbox(body) {
-  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-devbox-'));
-  try {
-    const code = `const R=${JSON.stringify(REPO_ROOT)};
-      const SANDBOX=${JSON.stringify(home)};
-      const os=require('node:os');
-      if (os.homedir() !== SANDBOX) {
-        console.error('ERR sandbox-escape: os.homedir()=' + os.homedir() + ' but the sandbox is ' + SANDBOX);
-        process.exit(2);
-      }
-      const fs=require('node:fs'), path=require('node:path');
-      const brand=require(R+'/modules/dev-box/app/src/brand.js');
-      const CFG=path.join(os.homedir(), '.config', brand.CONFIG_DIR);
-      const store=require(R+'/modules/dev-box/app/src/session-store.js');
-      const w=(name,obj)=>{fs.mkdirSync(CFG,{recursive:true});fs.writeFileSync(path.join(CFG,name),JSON.stringify(obj,null,2));};
-      const has=(name)=>fs.existsSync(path.join(CFG,name));
-      const j=(name)=>JSON.parse(fs.readFileSync(path.join(CFG,name),'utf8'));
-      (async()=>{ ${body} })().catch((e)=>{ console.error('ERR '+e.message); process.exit(1); });`;
-    const r = spawnSync(process.execPath, ['-e', code], { encoding: 'utf8', env: sandboxEnv(home) });
-    return { out: `${r.stdout || ''}${r.stderr || ''}`, status: r.status };
-  } finally {
-    fs.rmSync(home, { recursive: true, force: true });
-  }
-}
-
-test('dev-box: reads an old-name session, and writes migrate to the new name', () => {
-  const { out, status } = inDevBoxSandbox(`
-    w('gds-session.json', { token:'TOK-OLD', api_base:'https://x.example.com', gemini_api_key:'KEEP' });
-    const got = store.read();
-    store.write({ token:'TOK-NEW', apiBase:'https://x.example.com' });
-    console.log(JSON.stringify({
-      readOld: got && got.token,
-      newFile: has('bongos-session.json') && j('bongos-session.json').token,
-      keptExtra: has('bongos-session.json') && j('bongos-session.json').gemini_api_key,
-      oldKept: has('gds-session.json'),
-    }));`);
-  assert.equal(status, 0, out);
-  const r = JSON.parse(out.trim().split('\n').pop());
-  assert.equal(r.readOld, 'TOK-OLD', 'the app must still read an un-migrated session');
-  assert.equal(r.newFile, 'TOK-NEW', 'a write must land on the new name');
-  assert.equal(r.keptExtra, 'KEEP', 'merge-preserving write must carry unknown fields across the rename');
-  assert.equal(r.oldKept, true, 'the app must not delete the old file either');
-});
-
-test('dev-box: sign-out strips the credential from EVERY accepted filename', () => {
-  // THE BUG THIS PINS. clear() rewrote only the CURRENT filename, but read() falls through to an
-  // older name when the current file carries no token — so sign-out left a live token in the
-  // superseded file and the very next read signed the builder straight back in. Harmless while
-  // the only legacy name was the long-dead pms-session.json; the common case the moment
-  // gds-session.json joined the read-list (task 1003704).
-  const { out, status } = inDevBoxSandbox(`
-    w('bongos-session.json', { token:'TOK-NEW', api_base:'https://x.example.com' });
-    w('gds-session.json',    { token:'TOK-OLD', api_base:'https://x.example.com', gemini_api_key:'KEEP' });
-    store.clear();
-    console.log(JSON.stringify({
-      stillSignedIn: !!store.read(),
-      newToken: j('bongos-session.json').token ?? null,
-      oldToken: j('gds-session.json').token ?? null,
-      keptExtra: j('gds-session.json').gemini_api_key,
-    }));`);
-  assert.equal(status, 0, out);
-  const r = JSON.parse(out.trim().split('\n').pop());
-  assert.equal(r.stillSignedIn, false, 'sign-out must not leave a readable session under ANY name');
-  assert.equal(r.newToken, null, 'the current file must lose its token');
-  assert.equal(r.oldToken, null, 'the superseded file must lose its token too — this is the bug');
-  // Sign-out drops credentials only; CLI-adjacent config must survive in every file it touches.
-  assert.equal(r.keptExtra, 'KEEP', 'clear() must preserve non-credential fields');
-});
-
 // ── 8. the credential detector follows the rename ───────────────────────────────────────────
 
 test('the artifact-scan credential detector flags a read of EVERY session filename', () => {

package/tests/ship_land_proof.mjs

@@ -0,0 +1,218 @@
+// tests/ship_land_proof.mjs
+//
+// task 1004055 — the ship that merges to main and then refuses to record it.
+//
+// ship.js has three land paths. Two of them tell the server which commit is this
+// task's: ciLandLocal posts attest-gate after its push, ciLandServer gets it from
+// publish-branch. The LOCAL-merge path (mergeLocally, 'laptop' deploy mode) merged
+// into main and pushed it ITSELF, and told the server nothing — so
+// claims.published_head_sha stayed NULL. It also opens no PR and deletes the branch
+// on origin, so getPublishStatus finds nothing by head ref either. That left
+// deriveShipAssurance with neither of its two proofs, and the POST /ship three lines
+// later refused with ship_land_not_proven EVERY time, with the work already merged.
+// The task parked at 'confirmed', gating its builder's whole queue, until someone ran
+// attest-gate + ship by hand. Five consecutive ships on 2026-09-19; twelve refusals
+// in that day's audit log.
+//
+// What is pinned here:
+//   1. attestGateTrust REPORTS whether the tip landed, and never throws
+//   2. landProofRecorded's truth table — including the pinned-older-core fallback
+//   3. the warning is in the right TENSE for the path that emits it
+//   4. the local-merge path records a tip, before it deletes the branch
+//
+// DB-free and network-free: the only collaborator attestGateTrust has is cli-lib's
+// cliClient, stubbed through the require cache below. Nothing here spawns git, gh,
+// or a server.
+//
+// Run:  node tests/ship_land_proof.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+
+// The stub MUST be in place before ship-land.js is first required — it destructures
+// cliClient at module load.
+let nextAttest = null;
+const cliLibPath = require.resolve('../scripts/gds/cli-lib');
+require.cache[cliLibPath] = {
+  id: cliLibPath,
+  filename: cliLibPath,
+  loaded: true,
+  exports: {
+    cliClient: async () => ({
+      tasks: {
+        postTasksIdAttestGate: async ({ id, body }) => {
+          if (typeof nextAttest === 'function') return nextAttest({ id, body });
+          return nextAttest;
+        },
+      },
+    }),
+    isBoxScope: () => false,
+  },
+};
+
+const { attestGateTrust, landProofRecorded, landProofWarningLines } = require('../scripts/gds/ship-land.js');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// attestGateTrust narrates to stdout; swallow that so the test output stays readable.
+async function quietly(fn) {
+  const real = console.log;
+  const said = [];
+  console.log = (...a) => said.push(a.join(' '));
+  try { return { value: await fn(), said: said.join('\n') }; }
+  finally { console.log = real; }
+}
+
+const MERGE_SHA = '5c4db10e2a1f4c6b8d3e9f70a1b2c3d4e5f60718';
+
+// --- 1. attestGateTrust reports, and never throws -----------------------------
+
+await t('a 200 carrying tip_recorded:true → recorded, and the sha is what we sent', async () => {
+  let seen = null;
+  nextAttest = ({ id, body }) => {
+    seen = { id, body };
+    return { ok: true, status: 200, data: { ok: true, attested: true, reason: null, tip_recorded: true } };
+  };
+  const { value } = await quietly(() => attestGateTrust(1004055, MERGE_SHA));
+  assert.equal(value.recorded, true);
+  assert.equal(value.attested, true);
+  assert.deepEqual(seen, { id: 1004055, body: { head_sha: MERGE_SHA } });
+});
+
+// The case the field exists for: the attestation succeeded, so the old code called
+// the whole thing a success — but no claim row matched, so nothing was recorded and
+// the ship was already doomed.
+await t('a 200 whose claim lookup matched nothing → NOT recorded, even though attested', async () => {
+  nextAttest = { ok: true, status: 200, data: { ok: true, attested: true, reason: null, tip_recorded: false } };
+  const { value } = await quietly(() => attestGateTrust(1004055, MERGE_SHA));
+  assert.equal(value.attested, true, 'the gate attestation did succeed');
+  assert.equal(value.recorded, false, 'but the land proof did not land');
+});
+
+await t('a 503 push_unconfigured still recorded the tip (the write precedes the credential check)', async () => {
+  nextAttest = { ok: false, status: 503, data: { error: { code: 'push_unconfigured', details: { tip_recorded: true } } } };
+  const { value } = await quietly(() => attestGateTrust(1004055, MERGE_SHA));
+  assert.equal(value.recorded, true);
+  assert.equal(value.attested, false);
+});
+
+await t('a 403 never reached the write → NOT recorded', async () => {
+  nextAttest = { ok: false, status: 403, data: { error: { code: 'not_your_task' } } };
+  const { value } = await quietly(() => attestGateTrust(1004055, MERGE_SHA));
+  assert.equal(value.recorded, false);
+});
+
+// The quietest of the old failure shapes: a bare `catch (_) {}` left no trace at all.
+await t('a thrown request is reported, not swallowed, and never propagates', async () => {
+  nextAttest = () => { throw new Error('fetch failed'); };
+  const { value, said } = await quietly(() => attestGateTrust(1004055, MERGE_SHA));
+  assert.equal(value.recorded, false);
+  assert.match(value.reason, /fetch failed/);
+  assert.match(said, /fetch failed/, 'the failure must reach the log too, not only the return value');
+});
+
+await t('no head SHA → not recorded, and no request is attempted', async () => {
+  nextAttest = () => { throw new Error('should not have been called'); };
+  const { value } = await quietly(() => attestGateTrust(1004055, null));
+  assert.equal(value.recorded, false);
+});
+
+// --- 2. landProofRecorded: the truth table ------------------------------------
+
+await t('explicit tip_recorded wins over any status reading', () => {
+  assert.equal(landProofRecorded({ ok: true, status: 200, data: { tip_recorded: true } }), true);
+  assert.equal(landProofRecorded({ ok: true, status: 200, data: { tip_recorded: false } }), false);
+  assert.equal(landProofRecorded({ ok: false, status: 503, data: { error: { details: { tip_recorded: false } } } }), false);
+});
+
+// A live instance runs a PINNED core, so it lags main by however long the pin sits
+// still — cloudbongos.com was serving 1.19.871 against a main declaring 1.19.881 on
+// the day this was diagnosed. Those servers send no tip_recorded at all, and reading
+// its absence as "not recorded" would make every healthy land cry wolf.
+await t('older core, no tip_recorded: 200 and 503 both mean the tip landed', () => {
+  assert.equal(landProofRecorded({ ok: true, status: 200, data: { ok: true, attested: false, reason: 'rank_below_metic' } }), true);
+  assert.equal(landProofRecorded({ ok: false, status: 503, data: { error: { code: 'push_unconfigured' } } }), true);
+});
+
+await t('older core: every other status → NOT recorded', () => {
+  for (const status of [400, 403, 404, 409, 500, 502]) {
+    assert.equal(
+      landProofRecorded({ ok: false, status, data: { error: { code: 'not_your_task' } } }),
+      false,
+      `HTTP ${status} must not count as a recorded tip`
+    );
+  }
+});
+
+await t('no response at all → NOT recorded', () => {
+  assert.equal(landProofRecorded(null), false);
+  assert.equal(landProofRecorded(undefined), false);
+  assert.equal(landProofRecorded({}), false);
+});
+
+// --- 3. the warning is in the right tense -------------------------------------
+
+await t('merged path: names the merge sha and gives the full two-call recovery', () => {
+  const lines = landProofWarningLines(1004055, MERGE_SHA).join('\n');
+  assert.match(lines, /NOT recorded/);
+  assert.match(lines, /merge IS on main/);
+  assert.ok(lines.includes(`"head_sha":"${MERGE_SHA}"`), 'must name the exact sha to re-record');
+  assert.match(lines, /POST \/tasks\/1004055\/attest-gate/);
+  assert.match(lines, /POST \/tasks\/1004055\/ship/);
+});
+
+// The PR path has only PUSHED — the land may still be minutes out, and telling a
+// builder their merge is on main when it is not is the same class of lie this whole
+// task is about.
+await t('un-merged path: does not claim the work is on main, and does not ship blind', () => {
+  const lines = landProofWarningLines(1004055, MERGE_SHA, 'HTTP 403', { merged: false }).join('\n');
+  assert.doesNotMatch(lines, /merge IS on main/);
+  assert.match(lines, /the PR still lands normally/);
+  assert.ok(!lines.includes('/ship --body'), 'must not hand over a ship call before anything merged');
+  assert.match(lines, /ship\.js 1004055/);
+});
+
+await t('the reason is surfaced, and a missing sha degrades to a placeholder', () => {
+  assert.match(landProofWarningLines(7, MERGE_SHA, 'HTTP 403').join('\n'), /HTTP 403/);
+  assert.match(landProofWarningLines(7, null).join('\n'), /<the merge commit on main>/);
+});
+
+// --- 4. the local-merge path records a tip at all -----------------------------
+//
+// mergeLocally has no dependency seam — it merges a real second checkout, runs smoke
+// and pushes main — so this is asserted against the source. Weaker than driving it,
+// but it is exactly the assertion that failed before the fix: the file contained no
+// reference to ANY of the three ways to record a tip, and the order of the two calls
+// is the other half of the bug (deleting the branch first destroys the only evidence
+// a later sweep could have used).
+
+const mergeSrc = fs.readFileSync(fileURLToPath(new URL('../scripts/gds/ship-merge.js', import.meta.url)), 'utf8');
+
+await t('ship-merge.js records the merge commit as this task\'s land proof', () => {
+  assert.match(mergeSrc, /attestGateTrust\(taskId, mergeSha\)/,
+    'the local-merge path must record a land proof — before the fix it recorded none');
+});
+
+await t('the proof is recorded BEFORE the origin branch is deleted', () => {
+  const attestAt = mergeSrc.indexOf('attestGateTrust(taskId, mergeSha)');
+  const deleteAt = mergeSrc.indexOf("'--delete'");
+  assert.ok(attestAt > 0, 'the attest call must be present');
+  assert.ok(deleteAt > 0, 'the branch delete must be present');
+  assert.ok(attestAt < deleteAt, 'the land proof must be recorded before the branch is deleted');
+});
+
+await t('a miss reaches the builder at the merge, not as an opaque 409 later', () => {
+  assert.match(mergeSrc, /landProofWarningLines\(taskId, mergeSha, proof\.reason\)/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/modules/dev-box/app/README.md

@@ -1,74 +0,0 @@
-# OTB Dev Box — the desktop switch for a builder's hosted box
-
-A menu-bar (macOS) / system-tray (Windows) app that turns a builder's hosted
-dev box on and off with one switch. Built for the newcomer who should never
-see a terminal: sign in with browser clicks (app pairing, ADR 0045), flip the
-switch, and connect from Claude Desktop or the browser terminal.
-
-What it does beyond the switch — each fixing a failure observed in the
-2026-06-10 onboarding sessions that killed the old `curl | bash` flow:
-
-- **Pairing sign-in** — opens the builders' hall, one Approve click, token
-  delivered over the app's own secret channel (`/api/bongos/auth/app-pair/*`).
-  The session is written to `~/.config/otb/gds-session.json`, the same file
-  the `/builder-*` CLI uses — pairing the app signs in the CLI too.
-- **SSH key done right** — generates `~/.ssh/otb_builder` (ed25519) with real
-  600 perms (icacls ACL on Windows) and registers it via `POST /box/ssh-key`.
-- **known_hosts kept fresh** — Claude Desktop's embedded ssh2 reads ONLY
-  `~/.ssh/known_hosts`, and host keys change on every re-provision; the app
-  re-scans and replaces entries each time the box turns active.
-- **Claude Desktop connection file** — installs the managed-settings file to
-  the system path with a native elevation prompt (osascript / UAC), the step
-  the agent-driven flow could never finish.
-- **Native notifications** — box ready, rested while idle.
-- **No heartbeats** — the app never sends `claude_active`; the droplet's idle
-  sweep stays authoritative so an unused box still reclaims itself (~10 min).
-
-## Layout
-
-- `src/main.js` — Electron main: tray, window, IPC, wiring.
-- `src/brand.js` — every brand string (ADR 0004: the civ name lives here only).
-- `src/{pairing,box-controller,gds-client,session-store,ssh-setup,updater}.js` — the
-  logic, Electron-free and unit-tested in `test/unit.mjs`.
-- `src/updater.js` — in-app update check (#924): semver compare + platform→target
-  resolution. `main.js` polls `GET /downloads/devbox/version` on open + every 12h
-  and, when the published release is strictly newer, shows the Update banner; the
-  Update button downloads the installer and hands it to the OS (browser-download
-  fallback on any error). **Bumping `config/devbox-app.json` version is what makes
-  the banner appear in the field.**
-- `renderer/` — the panel UI (sandboxed, contextIsolated; preload exposes
-  named verbs only).
-- `scripts/gen-icons.js` — regenerates all icons from pixel grids (`npm run
-  icons`; borrows `sharp` from the repo root's node_modules).
-
-## Develop
-
-```
-cd devbox-app
-npm install
-npm test          # hermetic unit tests, no Electron needed
-npm start         # run against prod (or OTB_DEVBOX_API_BASE=http://… npm start)
-```
-
-Dev/test env hooks: `OTB_DEVBOX_API_BASE` (point at a stub/staging GDS),
-`OTB_DEVBOX_NO_ELEVATE=1` (skip the managed-settings elevation prompt),
-`OTB_DEVBOX_SCREENSHOT_DIR` (write a PNG of the panel on every state change —
-how CI/verification captures proof).
-
-## Build & release
-
-```
-npm run dist:mac   # dmg, arm64 + x64 (unsigned → ad-hoc)
-npm run dist:win   # NSIS one-click installer, x64 + arm64
-```
-
-CI builds both on every push that touches `devbox-app/**`
-(`.github/workflows/build-devbox-app.yml`) and uploads them as artifacts.
-Publishing = attach the artifacts to a release on the PUBLIC releases repo
-named in `config/devbox-app.json`, then bump that config and ship — the
-branded `/downloads/devbox/*` redirects follow the config. (The long-form
-release recipe was retired with the other published dev-box recipes —
-task 1004013, ADR 0305.)
-
-This subproject is self-contained on purpose: its `package.json` never feeds
-the droplet's `npm ci`, and nothing under `devbox-app/` runs server-side.

package/modules/dev-box/app/electron-builder.tmpl.yml

@@ -1,95 +0,0 @@
-# TEMPLATE — rendered to electron-builder.yml by scripts/gen-brand.js from
-# config/branding.json (@@TOKENS@@ are substituted; ${version}/${arch}/${ext}
-# are electron-builder's own and stay literal). Edit THIS file, never the
-# generated electron-builder.yml.
-#
-# Brand strings (appId, productName, copyright, artifact slug) come from the
-# instance branding so one source tree builds any instance's app (ADR 0004,
-# generalised). Signing rides the instance's own CI (main-ref-gated Apple
-# Developer ID; ADR 0072) — an unarmed build ad-hoc-signs the mac app, which
-# arm64 requires to launch at all.
-#
-# Artifact names are pinned (no spaces, no world name inside — ADR 0004) and
-# MUST match config/devbox-app.json's assets map; tests/devbox_downloads.mjs
-# cross-checks the config side.
-
-appId: @@APP_ID@@
-productName: @@PRODUCT_NAME@@
-copyright: @@COPYRIGHT@@
-
-# buildResources is named build-resources (not electron-builder's default
-# `build`) because the repo root .gitignore ignores build/ everywhere and the
-# app icon in here is COMMITTED source, not output.
-directories:
-  buildResources: build-resources
-  output: dist
-
-files:
-  - src/**/*
-  - renderer/**/*
-  - assets/**/*
-  - package.json
-
-asar: true
-
-mac:
-  category: public.app-category.developer-tools
-  icon: build-resources/icon.png
-  target:
-    - target: dmg
-      arch: [arm64, x64]
-  artifactName: @@PRODUCT_SLUG@@-${version}-${arch}.${ext}
-
-dmg:
-  artifactName: @@PRODUCT_SLUG@@-${version}-${arch}.${ext}
-  # On-brand install window (task 912). The backdrop
-  # (build-resources/dmg-background.png + @2x, drawn by
-  # scripts/gen-dmg-backdrop.py) guides the drag from the container (the app)
-  # into Applications. iconSize + window + the contents coords MUST match
-  # the icon-well centers the backdrop draws (LEFT 180,198 / RIGHT 480,198) — if
-  # you move one, re-run the generator. The volume icon is the app icon (the
-  # container). electron-builder auto-picks dmg-background@2x.png on Retina.
-  #
-  # task 1235: this electron-builder DMG is only an INTERMEDIATE. Its window
-  # backdrop does NOT render on macOS >= Sonoma — electron-builder writes a
-  # `pBBk` bookmark Finder can't resolve, so the install window shows up white.
-  # The CI step "Apply install-window backdrop (dmgbuild)" re-packages the
-  # signed+notarized .app out of this DMG into the FINAL DMG via dmgbuild
-  # (scripts/apply-dmg-backdrop.sh + scripts/dmgbuild-settings.py), which writes
-  # an alias-only .DS_Store that DOES render. Keep the coords below in sync with
-  # dmgbuild-settings.py (currently identical: 180,198 / 480,198, 660x400, size 100).
-  icon: build-resources/icon.png
-  background: build-resources/dmg-background.png
-  iconSize: 100
-  window:
-    width: 660
-    height: 400
-  contents:
-    - x: 180
-      y: 198
-      type: file
-    - x: 480
-      y: 198
-      type: link
-      path: /Applications
-
-win:
-  icon: build-resources/icon.png
-  target:
-    - target: nsis
-      # x64 covers Intel/AMD PCs; arm64 is native for ARM Windows (Surface,
-      # Snapdragon laptops, Parallels VMs on Apple-silicon Macs). x64 also
-      # RUNS on arm64 via Windows emulation, so x64 stays the safe default
-      # link; arm64 is the first-class build for those machines (#908).
-      arch: [x64, arm64]
-
-nsis:
-  oneClick: true
-  perMachine: false
-  runAfterFinish: true
-  deleteAppDataOnUninstall: false
-  # ${arch} suffix added in #908 when arm64 joined — two arches can't share
-  # one filename. Must stay in lockstep with config/devbox-app.json assets.
-  artifactName: @@PRODUCT_SLUG@@-Setup-${version}-${arch}.${ext}
-
-publish: null

package/modules/dev-box/app/electron-builder.yml

@@ -1,95 +0,0 @@
-# TEMPLATE — rendered to electron-builder.yml by scripts/gen-brand.js from
-# config/branding.json (@@TOKENS@@ are substituted; ${version}/${arch}/${ext}
-# are electron-builder's own and stay literal). Edit THIS file, never the
-# generated electron-builder.yml.
-#
-# Brand strings (appId, productName, copyright, artifact slug) come from the
-# instance branding so one source tree builds any instance's app (ADR 0004,
-# generalised). Signing rides the instance's own CI (main-ref-gated Apple
-# Developer ID; ADR 0072) — an unarmed build ad-hoc-signs the mac app, which
-# arm64 requires to launch at all.
-#
-# Artifact names are pinned (no spaces, no world name inside — ADR 0004) and
-# MUST match config/devbox-app.json's assets map; tests/devbox_downloads.mjs
-# cross-checks the config side.
-
-appId: com.cloudbongos.devbox
-productName: Cloud Bongos Dev Box
-copyright: © Cloud Bongos
-
-# buildResources is named build-resources (not electron-builder's default
-# `build`) because the repo root .gitignore ignores build/ everywhere and the
-# app icon in here is COMMITTED source, not output.
-directories:
-  buildResources: build-resources
-  output: dist
-
-files:
-  - src/**/*
-  - renderer/**/*
-  - assets/**/*
-  - package.json
-
-asar: true
-
-mac:
-  category: public.app-category.developer-tools
-  icon: build-resources/icon.png
-  target:
-    - target: dmg
-      arch: [arm64, x64]
-  artifactName: Cloud-Bongos-Dev-Box-${version}-${arch}.${ext}
-
-dmg:
-  artifactName: Cloud-Bongos-Dev-Box-${version}-${arch}.${ext}
-  # On-brand install window (task 912). The backdrop
-  # (build-resources/dmg-background.png + @2x, drawn by
-  # scripts/gen-dmg-backdrop.py) guides the drag from the container (the app)
-  # into Applications. iconSize + window + the contents coords MUST match
-  # the icon-well centers the backdrop draws (LEFT 180,198 / RIGHT 480,198) — if
-  # you move one, re-run the generator. The volume icon is the app icon (the
-  # container). electron-builder auto-picks dmg-background@2x.png on Retina.
-  #
-  # task 1235: this electron-builder DMG is only an INTERMEDIATE. Its window
-  # backdrop does NOT render on macOS >= Sonoma — electron-builder writes a
-  # `pBBk` bookmark Finder can't resolve, so the install window shows up white.
-  # The CI step "Apply install-window backdrop (dmgbuild)" re-packages the
-  # signed+notarized .app out of this DMG into the FINAL DMG via dmgbuild
-  # (scripts/apply-dmg-backdrop.sh + scripts/dmgbuild-settings.py), which writes
-  # an alias-only .DS_Store that DOES render. Keep the coords below in sync with
-  # dmgbuild-settings.py (currently identical: 180,198 / 480,198, 660x400, size 100).
-  icon: build-resources/icon.png
-  background: build-resources/dmg-background.png
-  iconSize: 100
-  window:
-    width: 660
-    height: 400
-  contents:
-    - x: 180
-      y: 198
-      type: file
-    - x: 480
-      y: 198
-      type: link
-      path: /Applications
-
-win:
-  icon: build-resources/icon.png
-  target:
-    - target: nsis
-      # x64 covers Intel/AMD PCs; arm64 is native for ARM Windows (Surface,
-      # Snapdragon laptops, Parallels VMs on Apple-silicon Macs). x64 also
-      # RUNS on arm64 via Windows emulation, so x64 stays the safe default
-      # link; arm64 is the first-class build for those machines (#908).
-      arch: [x64, arm64]
-
-nsis:
-  oneClick: true
-  perMachine: false
-  runAfterFinish: true
-  deleteAppDataOnUninstall: false
-  # ${arch} suffix added in #908 when arm64 joined — two arches can't share
-  # one filename. Must stay in lockstep with config/devbox-app.json assets.
-  artifactName: Cloud-Bongos-Dev-Box-Setup-${version}-${arch}.${ext}
-
-publish: null