@bongos/core 1.19.884 → 1.19.886

package/tests/instance_release_config.mjs

@@ -1,15 +1,16 @@
 // tests/instance_release_config.mjs
 //
-// serve-internal mounts /downloads/devbox/* and /downloads/bongos/* only when the
-// instance ships the matching RELEASE config (config/devbox-app.json,
-// config/bongos-cli.json). Those configs are boundary-EXCLUDED from the packaged core,
+// serve-internal mounts /downloads/bongos/* only when the instance ships the matching
+// RELEASE config (config/bongos-cli.json). That config is boundary-EXCLUDED from the packaged core,
 // so they live at the INSTANCE root — which on a vendored instance (@bongos/core in
 // node_modules, ADR 0108) is a DIFFERENT directory from the core package dir
 // serve-internal.js sits in. The old core-relative `require('../../config/…')` looked
-// only in node_modules/@bongos/core/config/, so a vendored instance's Dev Box download
-// routes never mounted (task 1002371; ADR 0145 papered over it by copying the config
-// into node_modules — lost on the next npm ci). Same class as ADR 0144's vendored
-// infra/ path bug.
+// only in node_modules/@bongos/core/config/, so a vendored instance's download routes
+// never mounted (task 1002371; ADR 0145 papered over it by copying the config into
+// node_modules — lost on the next npm ci). Same class as ADR 0144's vendored infra/
+// path bug. This test was written against the /downloads/devbox/* twin, which task
+// 1003891 deleted with the Dev Box app; it now proves the SAME ladder against
+// /downloads/bongos/*, the surviving surface that still depends on it.
 //
 // The first test is THE regression: a config present ONLY at the instance root must be
 // found. It fails against the old resolution (which could not see the instance root at
@@ -29,12 +30,12 @@ import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 
-// A minimal but VALID release config — buildDevboxDownloads rejects a bad
+// A minimal but VALID release config — buildBongosDownloads rejects a bad
 // releases_repo/version at boot, so the end-to-end mount below proves real parsing.
-const DEVBOX_CFG = {
-  releases_repo: 'example-owner/example-devbox',
+const CLI_CFG = {
+  releases_repo: 'example-owner/example-cli',
   version: '9.9.9',
-  assets: { 'mac-arm64': 'Example-Dev-Box-9.9.9-arm64.dmg' },
+  assets: { 'mac-arm64': 'bongos-9.9.9-macos-arm64' },
   aliases: { mac: 'mac-arm64' },
 };
 
@@ -50,23 +51,23 @@ function makeRoot(name, contents) {
 
 // Point the process at a temp INSTANCE root BEFORE serve-internal loads, so the default
 // (uninjected) resolution runs the vendored shape: config at the instance root, absent
-// from the core package dir. This checkout ships no config/devbox-app.json — it is
+// from the core package dir. This checkout ships no config/bongos-cli.json — it is
 // instance-only — so the core tier genuinely has nothing to find, exactly like a
 // freshly-vendored box.
-const INSTANCE_ROOT = makeRoot('devbox-app.json', JSON.stringify(DEVBOX_CFG));
+const INSTANCE_ROOT = makeRoot('bongos-cli.json', JSON.stringify(CLI_CFG));
 process.env.CLOUDBONGOS_INSTANCE_ROOT = INSTANCE_ROOT;
 const { tryLoadInstanceConfig, mountInternalSurfaces } = require('../src/bongos/serve-internal.js');
 
 test('finds a release config that exists ONLY at the instance root (the vendored bug)', () => {
-  const instance = makeRoot('devbox-app.json', '{"version":"1.0.0"}');
+  const instance = makeRoot('bongos-cli.json', '{"version":"1.0.0"}');
   const core = makeRoot(null);
-  assert.deepEqual(tryLoadInstanceConfig('devbox-app.json', [instance, core]), { version: '1.0.0' });
+  assert.deepEqual(tryLoadInstanceConfig('bongos-cli.json', [instance, core]), { version: '1.0.0' });
 });
 
 test('the instance root wins over the core package dir when both carry a copy', () => {
-  const instance = makeRoot('devbox-app.json', '{"from":"instance"}');
-  const core = makeRoot('devbox-app.json', '{"from":"core"}');
-  assert.equal(tryLoadInstanceConfig('devbox-app.json', [instance, core]).from, 'instance');
+  const instance = makeRoot('bongos-cli.json', '{"from":"instance"}');
+  const core = makeRoot('bongos-cli.json', '{"from":"core"}');
+  assert.equal(tryLoadInstanceConfig('bongos-cli.json', [instance, core]).from, 'instance');
 });
 
 test('falls back to the core package dir (single checkout + the copied-in workaround)', () => {
@@ -76,16 +77,16 @@ test('falls back to the core package dir (single checkout + the copied-in workar
 });
 
 test('absent from every root → null, so the download surface just does not mount', () => {
-  assert.equal(tryLoadInstanceConfig('devbox-app.json', [makeRoot(null), makeRoot(null)]), null);
-  assert.equal(tryLoadInstanceConfig('devbox-app.json', []), null);
+  assert.equal(tryLoadInstanceConfig('bongos-cli.json', [makeRoot(null), makeRoot(null)]), null);
+  assert.equal(tryLoadInstanceConfig('bongos-cli.json', []), null);
 });
 
 test('a MALFORMED config still throws — only a MISSING file is tolerated', () => {
-  const bad = makeRoot('devbox-app.json', '{ this is not valid json ');
-  assert.throws(() => tryLoadInstanceConfig('devbox-app.json', [bad]), SyntaxError);
+  const bad = makeRoot('bongos-cli.json', '{ this is not valid json ');
+  assert.throws(() => tryLoadInstanceConfig('bongos-cli.json', [bad]), SyntaxError);
 });
 
-test('/downloads/devbox/version mounts from an INSTANCE-root config (end to end)', async () => {
+test('/downloads/bongos/version mounts from an INSTANCE-root config (end to end)', async () => {
   const express = require('express');
   const app = express();
   mountInternalSurfaces(app);
@@ -93,11 +94,11 @@ test('/downloads/devbox/version mounts from an INSTANCE-root config (end to end)
     const s = app.listen(0, () => resolve(s));
   });
   try {
-    const res = await fetch(`http://127.0.0.1:${server.address().port}/downloads/devbox/version`);
+    const res = await fetch(`http://127.0.0.1:${server.address().port}/downloads/bongos/version`);
     assert.equal(res.status, 200, 'the route must mount when only the INSTANCE root has the config');
     const body = await res.json();
-    assert.equal(body.version, DEVBOX_CFG.version);
-    assert.match(body.assets['mac-arm64'], /^https:\/\/github\.com\/example-owner\/example-devbox\//);
+    assert.equal(body.version, CLI_CFG.version);
+    assert.match(body.assets['mac-arm64'], /^https:\/\/github\.com\/example-owner\/example-cli\//);
   } finally {
     await new Promise((r) => server.close(r));
   }

package/tests/session_rename_fallback.mjs

@@ -12,9 +12,9 @@
 // So these tests assert the FALLBACK path fires — a happy-path test on the new name alone would
 // pass just as well with the back-compat deleted, which is exactly the regression that matters.
 //
-// Three of the read-lists are DUPLICATED rather than imported, because their modules cannot reach
-// the canonical one (dependency-free middleware, a separately-bundled Electron app). Those copies
-// are pinned here against the real list by parsing the source — an unpinned copy is how a rename
+// Some of the read-lists are DUPLICATED rather than imported, because their modules cannot reach
+// the canonical one (dependency-free middleware, static browser surfaces). Those copies are
+// pinned here against the real list by parsing the source — an unpinned copy is how a rename
 // half-lands.
 
 import test from 'node:test';
@@ -235,6 +235,11 @@ test('routes/auth.js sets ONLY the head name and derives the clear-list from the
 });
 
 // ── 5. the duplicated copies are pinned to the canonical lists ──────────────────────────────
+//
+// There used to be a third copy here and a whole section 7 exercising it: the Dev Box Electron
+// app shipped as its own bundle, so it could not import instance-config and carried its own
+// read-list. Task 1003891 deleted that app, so the copy it was pinned against no longer exists
+// and the cases went with it — there is nothing left to drift.
 
 test('rate-limit.js — its dependency-free copy of the cookie names matches the real list', () => {
   const src = read('src/bongos/middleware/rate-limit.js');
@@ -245,19 +250,6 @@ test('rate-limit.js — its dependency-free copy of the cookie names matches the
     'the limiter’s copy drifted from src/bongos/auth.js SESSION_COOKIE_NAMES');
 });
 
-test('dev-box session-store — its bundled copy of the filenames matches the real list', () => {
-  const src = read('modules/dev-box/app/src/session-store.js');
-  const head = /const FILE = path\.join\(DIR, '([^']+)'\)/.exec(src);
-  assert.ok(head, 'FILE not found in the dev-box session store');
-  const legacy = /const FILES_LEGACY = \[([^\]]*)\]/.exec(src);
-  assert.ok(legacy, 'FILES_LEGACY not found — the app would stop reading un-migrated sessions');
-  const names = [head[1], ...[...legacy[1].matchAll(/'([^']+\.json)'/g)].map((x) => x[1])];
-  assert.deepEqual(names, ic.SESSION_FILENAMES,
-    'the dev-box app’s copy drifted from src/instance-config.js SESSION_FILENAMES');
-  // It must WRITE only the head name.
-  assert.doesNotMatch(src, /writeFileSync\(\s*FILES_LEGACY/, 'the app must never write a legacy name');
-});
-
 test('the browser logout clears every session-cookie name', () => {
   // Three static surfaces expire the cookie client-side. One that misses the current name leaves a
   // live cookie behind after "sign out".
@@ -288,80 +280,6 @@ test('the baked box scripts scan BOTH session filenames', () => {
   }
 });
 
-// ── 7. the dev-box app's own copy of the fallback, and its sign-out ─────────────────────────
-//
-// The Electron app shares the CLI's session file on purpose (ADR 0045). It ships as its own
-// bundle, so it cannot import instance-config and carries its own read-list — which means its
-// fallback needs exercising, not just pinning.
-function inDevBoxSandbox(body) {
-  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-devbox-'));
-  try {
-    const code = `const R=${JSON.stringify(REPO_ROOT)};
-      const SANDBOX=${JSON.stringify(home)};
-      const os=require('node:os');
-      if (os.homedir() !== SANDBOX) {
-        console.error('ERR sandbox-escape: os.homedir()=' + os.homedir() + ' but the sandbox is ' + SANDBOX);
-        process.exit(2);
-      }
-      const fs=require('node:fs'), path=require('node:path');
-      const brand=require(R+'/modules/dev-box/app/src/brand.js');
-      const CFG=path.join(os.homedir(), '.config', brand.CONFIG_DIR);
-      const store=require(R+'/modules/dev-box/app/src/session-store.js');
-      const w=(name,obj)=>{fs.mkdirSync(CFG,{recursive:true});fs.writeFileSync(path.join(CFG,name),JSON.stringify(obj,null,2));};
-      const has=(name)=>fs.existsSync(path.join(CFG,name));
-      const j=(name)=>JSON.parse(fs.readFileSync(path.join(CFG,name),'utf8'));
-      (async()=>{ ${body} })().catch((e)=>{ console.error('ERR '+e.message); process.exit(1); });`;
-    const r = spawnSync(process.execPath, ['-e', code], { encoding: 'utf8', env: sandboxEnv(home) });
-    return { out: `${r.stdout || ''}${r.stderr || ''}`, status: r.status };
-  } finally {
-    fs.rmSync(home, { recursive: true, force: true });
-  }
-}
-
-test('dev-box: reads an old-name session, and writes migrate to the new name', () => {
-  const { out, status } = inDevBoxSandbox(`
-    w('gds-session.json', { token:'TOK-OLD', api_base:'https://x.example.com', gemini_api_key:'KEEP' });
-    const got = store.read();
-    store.write({ token:'TOK-NEW', apiBase:'https://x.example.com' });
-    console.log(JSON.stringify({
-      readOld: got && got.token,
-      newFile: has('bongos-session.json') && j('bongos-session.json').token,
-      keptExtra: has('bongos-session.json') && j('bongos-session.json').gemini_api_key,
-      oldKept: has('gds-session.json'),
-    }));`);
-  assert.equal(status, 0, out);
-  const r = JSON.parse(out.trim().split('\n').pop());
-  assert.equal(r.readOld, 'TOK-OLD', 'the app must still read an un-migrated session');
-  assert.equal(r.newFile, 'TOK-NEW', 'a write must land on the new name');
-  assert.equal(r.keptExtra, 'KEEP', 'merge-preserving write must carry unknown fields across the rename');
-  assert.equal(r.oldKept, true, 'the app must not delete the old file either');
-});
-
-test('dev-box: sign-out strips the credential from EVERY accepted filename', () => {
-  // THE BUG THIS PINS. clear() rewrote only the CURRENT filename, but read() falls through to an
-  // older name when the current file carries no token — so sign-out left a live token in the
-  // superseded file and the very next read signed the builder straight back in. Harmless while
-  // the only legacy name was the long-dead pms-session.json; the common case the moment
-  // gds-session.json joined the read-list (task 1003704).
-  const { out, status } = inDevBoxSandbox(`
-    w('bongos-session.json', { token:'TOK-NEW', api_base:'https://x.example.com' });
-    w('gds-session.json',    { token:'TOK-OLD', api_base:'https://x.example.com', gemini_api_key:'KEEP' });
-    store.clear();
-    console.log(JSON.stringify({
-      stillSignedIn: !!store.read(),
-      newToken: j('bongos-session.json').token ?? null,
-      oldToken: j('gds-session.json').token ?? null,
-      keptExtra: j('gds-session.json').gemini_api_key,
-    }));`);
-  assert.equal(status, 0, out);
-  const r = JSON.parse(out.trim().split('\n').pop());
-  assert.equal(r.stillSignedIn, false, 'sign-out must not leave a readable session under ANY name');
-  assert.equal(r.newToken, null, 'the current file must lose its token');
-  assert.equal(r.oldToken, null, 'the superseded file must lose its token too — this is the bug');
-  // Sign-out drops credentials only; CLI-adjacent config must survive in every file it touches.
-  assert.equal(r.keptExtra, 'KEEP', 'clear() must preserve non-credential fields');
-});
-
 // ── 8. the credential detector follows the rename ───────────────────────────────────────────
 
 test('the artifact-scan credential detector flags a read of EVERY session filename', () => {

package/modules/dev-box/app/README.md

@@ -1,74 +0,0 @@
-# OTB Dev Box — the desktop switch for a builder's hosted box
-
-A menu-bar (macOS) / system-tray (Windows) app that turns a builder's hosted
-dev box on and off with one switch. Built for the newcomer who should never
-see a terminal: sign in with browser clicks (app pairing, ADR 0045), flip the
-switch, and connect from Claude Desktop or the browser terminal.
-
-What it does beyond the switch — each fixing a failure observed in the
-2026-06-10 onboarding sessions that killed the old `curl | bash` flow:
-
-- **Pairing sign-in** — opens the builders' hall, one Approve click, token
-  delivered over the app's own secret channel (`/api/bongos/auth/app-pair/*`).
-  The session is written to `~/.config/otb/gds-session.json`, the same file
-  the `/builder-*` CLI uses — pairing the app signs in the CLI too.
-- **SSH key done right** — generates `~/.ssh/otb_builder` (ed25519) with real
-  600 perms (icacls ACL on Windows) and registers it via `POST /box/ssh-key`.
-- **known_hosts kept fresh** — Claude Desktop's embedded ssh2 reads ONLY
-  `~/.ssh/known_hosts`, and host keys change on every re-provision; the app
-  re-scans and replaces entries each time the box turns active.
-- **Claude Desktop connection file** — installs the managed-settings file to
-  the system path with a native elevation prompt (osascript / UAC), the step
-  the agent-driven flow could never finish.
-- **Native notifications** — box ready, rested while idle.
-- **No heartbeats** — the app never sends `claude_active`; the droplet's idle
-  sweep stays authoritative so an unused box still reclaims itself (~10 min).
-
-## Layout
-
-- `src/main.js` — Electron main: tray, window, IPC, wiring.
-- `src/brand.js` — every brand string (ADR 0004: the civ name lives here only).
-- `src/{pairing,box-controller,gds-client,session-store,ssh-setup,updater}.js` — the
-  logic, Electron-free and unit-tested in `test/unit.mjs`.
-- `src/updater.js` — in-app update check (#924): semver compare + platform→target
-  resolution. `main.js` polls `GET /downloads/devbox/version` on open + every 12h
-  and, when the published release is strictly newer, shows the Update banner; the
-  Update button downloads the installer and hands it to the OS (browser-download
-  fallback on any error). **Bumping `config/devbox-app.json` version is what makes
-  the banner appear in the field.**
-- `renderer/` — the panel UI (sandboxed, contextIsolated; preload exposes
-  named verbs only).
-- `scripts/gen-icons.js` — regenerates all icons from pixel grids (`npm run
-  icons`; borrows `sharp` from the repo root's node_modules).
-
-## Develop
-
-```
-cd devbox-app
-npm install
-npm test          # hermetic unit tests, no Electron needed
-npm start         # run against prod (or OTB_DEVBOX_API_BASE=http://… npm start)
-```
-
-Dev/test env hooks: `OTB_DEVBOX_API_BASE` (point at a stub/staging GDS),
-`OTB_DEVBOX_NO_ELEVATE=1` (skip the managed-settings elevation prompt),
-`OTB_DEVBOX_SCREENSHOT_DIR` (write a PNG of the panel on every state change —
-how CI/verification captures proof).
-
-## Build & release
-
-```
-npm run dist:mac   # dmg, arm64 + x64 (unsigned → ad-hoc)
-npm run dist:win   # NSIS one-click installer, x64 + arm64
-```
-
-CI builds both on every push that touches `devbox-app/**`
-(`.github/workflows/build-devbox-app.yml`) and uploads them as artifacts.
-Publishing = attach the artifacts to a release on the PUBLIC releases repo
-named in `config/devbox-app.json`, then bump that config and ship — the
-branded `/downloads/devbox/*` redirects follow the config. (The long-form
-release recipe was retired with the other published dev-box recipes —
-task 1004013, ADR 0305.)
-
-This subproject is self-contained on purpose: its `package.json` never feeds
-the droplet's `npm ci`, and nothing under `devbox-app/` runs server-side.

package/modules/dev-box/app/electron-builder.tmpl.yml

@@ -1,95 +0,0 @@
-# TEMPLATE — rendered to electron-builder.yml by scripts/gen-brand.js from
-# config/branding.json (@@TOKENS@@ are substituted; ${version}/${arch}/${ext}
-# are electron-builder's own and stay literal). Edit THIS file, never the
-# generated electron-builder.yml.
-#
-# Brand strings (appId, productName, copyright, artifact slug) come from the
-# instance branding so one source tree builds any instance's app (ADR 0004,
-# generalised). Signing rides the instance's own CI (main-ref-gated Apple
-# Developer ID; ADR 0072) — an unarmed build ad-hoc-signs the mac app, which
-# arm64 requires to launch at all.
-#
-# Artifact names are pinned (no spaces, no world name inside — ADR 0004) and
-# MUST match config/devbox-app.json's assets map; tests/devbox_downloads.mjs
-# cross-checks the config side.
-
-appId: @@APP_ID@@
-productName: @@PRODUCT_NAME@@
-copyright: @@COPYRIGHT@@
-
-# buildResources is named build-resources (not electron-builder's default
-# `build`) because the repo root .gitignore ignores build/ everywhere and the
-# app icon in here is COMMITTED source, not output.
-directories:
-  buildResources: build-resources
-  output: dist
-
-files:
-  - src/**/*
-  - renderer/**/*
-  - assets/**/*
-  - package.json
-
-asar: true
-
-mac:
-  category: public.app-category.developer-tools
-  icon: build-resources/icon.png
-  target:
-    - target: dmg
-      arch: [arm64, x64]
-  artifactName: @@PRODUCT_SLUG@@-${version}-${arch}.${ext}
-
-dmg:
-  artifactName: @@PRODUCT_SLUG@@-${version}-${arch}.${ext}
-  # On-brand install window (task 912). The backdrop
-  # (build-resources/dmg-background.png + @2x, drawn by
-  # scripts/gen-dmg-backdrop.py) guides the drag from the container (the app)
-  # into Applications. iconSize + window + the contents coords MUST match
-  # the icon-well centers the backdrop draws (LEFT 180,198 / RIGHT 480,198) — if
-  # you move one, re-run the generator. The volume icon is the app icon (the
-  # container). electron-builder auto-picks dmg-background@2x.png on Retina.
-  #
-  # task 1235: this electron-builder DMG is only an INTERMEDIATE. Its window
-  # backdrop does NOT render on macOS >= Sonoma — electron-builder writes a
-  # `pBBk` bookmark Finder can't resolve, so the install window shows up white.
-  # The CI step "Apply install-window backdrop (dmgbuild)" re-packages the
-  # signed+notarized .app out of this DMG into the FINAL DMG via dmgbuild
-  # (scripts/apply-dmg-backdrop.sh + scripts/dmgbuild-settings.py), which writes
-  # an alias-only .DS_Store that DOES render. Keep the coords below in sync with
-  # dmgbuild-settings.py (currently identical: 180,198 / 480,198, 660x400, size 100).
-  icon: build-resources/icon.png
-  background: build-resources/dmg-background.png
-  iconSize: 100
-  window:
-    width: 660
-    height: 400
-  contents:
-    - x: 180
-      y: 198
-      type: file
-    - x: 480
-      y: 198
-      type: link
-      path: /Applications
-
-win:
-  icon: build-resources/icon.png
-  target:
-    - target: nsis
-      # x64 covers Intel/AMD PCs; arm64 is native for ARM Windows (Surface,
-      # Snapdragon laptops, Parallels VMs on Apple-silicon Macs). x64 also
-      # RUNS on arm64 via Windows emulation, so x64 stays the safe default
-      # link; arm64 is the first-class build for those machines (#908).
-      arch: [x64, arm64]
-
-nsis:
-  oneClick: true
-  perMachine: false
-  runAfterFinish: true
-  deleteAppDataOnUninstall: false
-  # ${arch} suffix added in #908 when arm64 joined — two arches can't share
-  # one filename. Must stay in lockstep with config/devbox-app.json assets.
-  artifactName: @@PRODUCT_SLUG@@-Setup-${version}-${arch}.${ext}
-
-publish: null

package/modules/dev-box/app/electron-builder.yml

@@ -1,95 +0,0 @@
-# TEMPLATE — rendered to electron-builder.yml by scripts/gen-brand.js from
-# config/branding.json (@@TOKENS@@ are substituted; ${version}/${arch}/${ext}
-# are electron-builder's own and stay literal). Edit THIS file, never the
-# generated electron-builder.yml.
-#
-# Brand strings (appId, productName, copyright, artifact slug) come from the
-# instance branding so one source tree builds any instance's app (ADR 0004,
-# generalised). Signing rides the instance's own CI (main-ref-gated Apple
-# Developer ID; ADR 0072) — an unarmed build ad-hoc-signs the mac app, which
-# arm64 requires to launch at all.
-#
-# Artifact names are pinned (no spaces, no world name inside — ADR 0004) and
-# MUST match config/devbox-app.json's assets map; tests/devbox_downloads.mjs
-# cross-checks the config side.
-
-appId: com.cloudbongos.devbox
-productName: Cloud Bongos Dev Box
-copyright: © Cloud Bongos
-
-# buildResources is named build-resources (not electron-builder's default
-# `build`) because the repo root .gitignore ignores build/ everywhere and the
-# app icon in here is COMMITTED source, not output.
-directories:
-  buildResources: build-resources
-  output: dist
-
-files:
-  - src/**/*
-  - renderer/**/*
-  - assets/**/*
-  - package.json
-
-asar: true
-
-mac:
-  category: public.app-category.developer-tools
-  icon: build-resources/icon.png
-  target:
-    - target: dmg
-      arch: [arm64, x64]
-  artifactName: Cloud-Bongos-Dev-Box-${version}-${arch}.${ext}
-
-dmg:
-  artifactName: Cloud-Bongos-Dev-Box-${version}-${arch}.${ext}
-  # On-brand install window (task 912). The backdrop
-  # (build-resources/dmg-background.png + @2x, drawn by
-  # scripts/gen-dmg-backdrop.py) guides the drag from the container (the app)
-  # into Applications. iconSize + window + the contents coords MUST match
-  # the icon-well centers the backdrop draws (LEFT 180,198 / RIGHT 480,198) — if
-  # you move one, re-run the generator. The volume icon is the app icon (the
-  # container). electron-builder auto-picks dmg-background@2x.png on Retina.
-  #
-  # task 1235: this electron-builder DMG is only an INTERMEDIATE. Its window
-  # backdrop does NOT render on macOS >= Sonoma — electron-builder writes a
-  # `pBBk` bookmark Finder can't resolve, so the install window shows up white.
-  # The CI step "Apply install-window backdrop (dmgbuild)" re-packages the
-  # signed+notarized .app out of this DMG into the FINAL DMG via dmgbuild
-  # (scripts/apply-dmg-backdrop.sh + scripts/dmgbuild-settings.py), which writes
-  # an alias-only .DS_Store that DOES render. Keep the coords below in sync with
-  # dmgbuild-settings.py (currently identical: 180,198 / 480,198, 660x400, size 100).
-  icon: build-resources/icon.png
-  background: build-resources/dmg-background.png
-  iconSize: 100
-  window:
-    width: 660
-    height: 400
-  contents:
-    - x: 180
-      y: 198
-      type: file
-    - x: 480
-      y: 198
-      type: link
-      path: /Applications
-
-win:
-  icon: build-resources/icon.png
-  target:
-    - target: nsis
-      # x64 covers Intel/AMD PCs; arm64 is native for ARM Windows (Surface,
-      # Snapdragon laptops, Parallels VMs on Apple-silicon Macs). x64 also
-      # RUNS on arm64 via Windows emulation, so x64 stays the safe default
-      # link; arm64 is the first-class build for those machines (#908).
-      arch: [x64, arm64]
-
-nsis:
-  oneClick: true
-  perMachine: false
-  runAfterFinish: true
-  deleteAppDataOnUninstall: false
-  # ${arch} suffix added in #908 when arm64 joined — two arches can't share
-  # one filename. Must stay in lockstep with config/devbox-app.json assets.
-  artifactName: Cloud-Bongos-Dev-Box-Setup-${version}-${arch}.${ext}
-
-publish: null