@bongos/core 1.19.901 → 1.19.903

package/scripts/gds/build-cli-package.js

@@ -77,11 +77,6 @@ const FILES = [
   'scripts/gds/release.js',
   'scripts/gds/worktree-claim-guard.js', // release.js warns through it; pure, zero requires
 
-  // Get onto a real environment without installing one: the cloud dev box.
-  'scripts/gds/shell.js',
-  'scripts/gds/code.js',
-  'scripts/gds/box-connect-lib.js',
-
   // Module files the above touch. Each imports nothing from the kernel at load time.
   'modules/lifecycle/task-classifier.js',
   'modules/lifecycle/task-visuals.js',
@@ -126,7 +121,6 @@ const FORBIDDEN_PREFIXES = [
   'public/',
   'modules/hall-ui/',
   '.github/',
-  'devbox-app/',
 ];
 const FORBIDDEN_BASENAMES = [
   'pool.js', 'auth.js', 'db.js', 'server.js', 'serve-internal.js',
@@ -141,9 +135,6 @@ const VERBS = {
   login:   { script: 'login.js',   group: 'account', summary: 'Sign in to an instance  (bongos login <url> — browser click, no paste)' },
   reauth:  { script: 'reauth.js',  group: 'account', summary: 'Refresh your session' },
   setup:   { script: 'setup.js',   group: 'account', summary: 'Finish builder setup on this instance (disciplines, consent)' },
-  box:     { script: 'api.js', prefixArgs: ['POST', '/api/bongos/box/ensure'], group: 'account', summary: 'Turn on / wake your cloud dev box' },
-  shell:   { script: 'shell.js',   group: 'account', summary: 'Open a terminal on your dev box' },
-  code:    { script: 'code.js',    group: 'account', summary: 'Open VS Code on your dev box over Remote-SSH' },
 
   start:   { script: 'start.js',   group: 'work', summary: 'List tasks you can claim right now' },
   status:  { script: 'status.js',  group: 'work', summary: 'Version / criterion progress  (bongos status C8)', selfHelp: true },
@@ -159,9 +150,11 @@ const VERBS = {
 // the reason and the actual next step, because a newcomer hitting a bare "unknown command" learns
 // nothing — that silence is the exact failure this whole task is fixing.
 //
-// The next step it names is CONDITIONAL prose, not a promise: dev boxes are a control-plane
-// capability many instances run without (task 1003730). The dispatcher has no session or manifest
-// yet, so it must not claim `bongos shell` will work — that verb makes the determination itself.
+// The next step used to be CONDITIONAL prose offering a cloud dev box first. The dev box was
+// retired (task 1003889), so the one unconditional route — a checkout of the project repo — is
+// now the only branch. ADR 0258's exclusion of claim/ship is UNCHANGED and deliberate: this is
+// the PRE-checkout CLI, and a claim that cannot materialise into a checkout is worse than one
+// that says where to go.
 const CHECKOUT_ONLY = {
   claim:   'Claiming a task writes code, so it needs a real checkout and a worktree.',
   ship:    'Shipping grades, merges and deploys from a real checkout.',
@@ -298,8 +291,8 @@ function helpText() {
   }
   lines.push('', '  help        Show this help', '  version     Show the bongos version');
   lines.push('');
-  lines.push('Writing code (claim, ship) happens in a checkout. \`bongos shell\` opens one');
-  lines.push('on a cloud dev box with nothing to install locally.');
+  lines.push('Writing code (claim, ship) happens in a checkout of the project repo,');
+  lines.push('where the full CLI is already installed.');
   return lines.join('\\n');
 }
 
@@ -329,13 +322,8 @@ function main(argv) {
   if (CHECKOUT_ONLY[verb]) {
     process.stderr.write(
       'bongos: "' + verb + '" is not in the public CLI.\\n  ' + CHECKOUT_ONLY[verb] + '\\n\\n' +
-      'If this instance offers cloud dev boxes, you can get a checkout without\\n' +
-      'installing anything locally:\\n' +
-      '  bongos shell            open a terminal on your cloud dev box\\n' +
-      '  bongos code             open VS Code on it over Remote-SSH\\n\\n' +
-      'Not every instance runs dev boxes. If yours does not, bongos shell says so,\\n' +
-      'and the route is a checkout of the project repo instead. The full CLI\\n' +
-      '(including ' + verb + ') is installed in both.\\n'
+      'The route is a checkout of the project repo, where the full CLI\\n' +
+      '(including ' + verb + ') is installed. Ask the project owner for repo access.\\n'
     );
     return 2;
   }
@@ -379,7 +367,7 @@ function packageJsonSource(version) {
   return JSON.stringify({
     name: PACKAGE_NAME,
     version,
-    description: 'The Cloud Bongos CLI — sign in to an instance, see what you can build, and get onto a dev box. Client only: no server.',
+    description: 'The Cloud Bongos CLI — sign in to an instance and see what you can build. Client only: no server.',
     bin: { bongos: 'bin/bongos.js' },
     files: ['bin/', ...roots, 'README.md'],
     engines: { node: '>=20' },
@@ -398,8 +386,8 @@ function packageJsonSource(version) {
 function readmeSource(version) {
   return `# ${PACKAGE_NAME}
 
-The [Cloud Bongos](https://cloudbongos.com) CLI. Sign in to an instance, see what you can pick
-up, and get onto a dev box — from a terminal, with nothing installed.
+The [Cloud Bongos](https://cloudbongos.com) CLI. Sign in to an instance and see what you can
+pick up — from a terminal, with nothing installed.
 
 ## Start here
 
@@ -421,9 +409,8 @@ bongos start
 
 ## Commands
 
-Run \`bongos help\` for the current list. In short: \`login\`, \`reauth\`, \`setup\`, \`box\`,
-\`shell\`, \`code\` for your account and environment; \`start\`, \`status\`, \`task\`, \`recall\`,
-\`cost\`, \`release\`, \`api\` for the work.
+Run \`bongos help\` for the current list. In short: \`login\`, \`reauth\`, \`setup\` for your
+account; \`start\`, \`status\`, \`task\`, \`recall\`, \`cost\`, \`release\`, \`api\` for the work.
 
 \`bongos api\` is the escape hatch — it calls any endpoint on the instance as you, so anything
 the web hall can do is reachable from the terminal:
@@ -434,14 +421,9 @@ bongos api GET /api/bongos/me
 
 ## Writing code
 
-\`claim\` and \`ship\` need a real checkout, so they aren't in this package. The shortest path to
-one is a cloud dev box, which needs nothing on your machine:
-
-\`\`\`sh
-bongos box       # turn it on
-bongos shell     # a terminal on it, full CLI already installed
-bongos code      # or VS Code over Remote-SSH
-\`\`\`
+\`claim\` and \`ship\` need a real checkout, so they aren't in this package. Ask the project's
+owner for repo access and clone it — the full CLI is installed there, and every command in
+this package works the same way from inside it.
 
 ## What this package is
 

package/scripts/gds/claude-materialize.js

@@ -37,7 +37,7 @@ const { renderInstanceClaudeMd } = require('./claude-md-template'); // task 2104
 
 // script basename (e.g. "ship.js") → dedicated bongos verb, for verbs that map to a bare script with
 // NO prefixArgs. Verbs whose script is driven by prefixArgs (box → api.js) are EXCLUDED so a generic
-// `node scripts/gds/api.js …` never mis-maps to `bongos box`; those fall to `bongos exec`. `exec`
+// `node scripts/gds/dev.js …` never mis-maps to `bongos serve`; those fall to `bongos exec`. `exec`
 // itself has no script and is skipped.
 function scriptToVerb(verbs = VERBS) {
   const m = {};

package/scripts/gds/cli-lib.js

@@ -533,50 +533,6 @@ function printUnauthGuidanceAndExit() {
   process.exit(2);
 }
 
-// task 1050 (C): is this response the dev-box bootstrap-scoped 403? A box's baked
-// session (source='box', #919/ADR 0053) may only call the 4 on-box bootstrap
-// endpoints; everything else (claim/ship/me/…) returns a 403 box_scope.
-//
-// task 1002162: accept BOTH body shapes. The live server emits the ADR 0116 (R01)
-// envelope — `{ error: { code, message, details? } }` from api-errors.js
-// `envelope()` — so `res.data.error` is an OBJECT and the old `=== 'box_scope'`
-// string test could never match. Both call sites below were therefore dead code
-// (box-scope was only ever caught by box-auth-check.js instead). Older/flat paths
-// still return `{ error: 'box_scope' }`, so normalize the same way
-// claim.js:formatClaimFailure does rather than swapping one shape for the other.
-//
-// Pure + exported so the detector is unit-tested against the real envelope.
-function isBoxScope(res) {
-  if (!res || res.status !== 403 || !res.data) return false;
-  const errRaw = res.data.error;
-  const code = errRaw !== null && typeof errRaw === 'object' ? errRaw.code : errRaw;
-  return code === 'box_scope';
-}
-
-let _boxScopeExitInFlight = false;
-
-// task 1050 (C): a box_scope 403 used to surface as a raw `failed to load
-// profile: { error: 'box_scope', … }` dump (the #1027 nightmare's first wall).
-// Turn it into the same UI-first guided recovery as a broken session: tell the
-// builder this is a bootstrap-only box session and walk them to re-auth. PRINT
-// only (no auto-open: the command runs ON the box, but the builder's browser is
-// on their own machine — they open the hall there).
-function printBoxScopeGuidanceAndExit() {
-  console.error('');
-  console.error('✖ This is a box-scoped session — it can only run dev-box bootstrap calls,');
-  console.error('  not claim / ship / grade / etc. (the box holds no full-authority token by');
-  console.error('  design — ADR 0053). Re-auth to a real CLI session, then re-run:');
-  console.error('');
-  console.error(isTerminalSurface() ? '    bongos reauth' : '    /builder-reauth      (or: node scripts/gds/reauth.js)');
-  console.error('');
-  console.error(`  It opens your Settings page (${hallBase()}/settings) on`);
-  console.error('  YOUR machine — under "CLI Access" click "Re-issue CLI token", copy the one-liner, paste it back.');
-  console.error('  No terminal Device Flow. Once re-authed, re-run whichever command you were');
-  console.error('  trying — if it had already done work, it resumes from where it stopped (task 941).');
-  for (const line of plainCardLines('box_scope')) console.error(line);
-  console.error('');
-  process.exit(10); // 10 = "re-auth needed" (matches reauth.js's exit code)
-}
 
 // ---- fail-closed instance guard (task 2102) --------------------------------
 // A half-configured instance folder used to fail THROUGH: with no local session
@@ -659,7 +615,7 @@ function printInstanceMismatchAndExit({ expected, actual }) {
   console.error(`    ${pfx}_API_BASE=${actual} <your command>`);
   for (const line of plainCardLines('instance_mismatch')) console.error(line);
   console.error('');
-  process.exit(3); // 3 = instance mismatch (distinct from 2 = unauth, 10 = box-scope)
+  process.exit(3); // 3 = instance mismatch (distinct from 2 = unauth)
 }
 
 // Fail-closed instance guard for RAW-fetch READ commands (task 2124 / demo-audit C2).
@@ -689,7 +645,7 @@ async function assertInstanceMatch({ allowInstanceMismatch = false } = {}) {
  * decide whether to re-auth automatically).
  */
 async function apiCall(method, urlPath, body = null, opts = {}) {
-  const { allowUnauthenticated = false, allowBoxScope = false, allowInstanceMismatch = false } = opts;
+  const { allowUnauthenticated = false, allowInstanceMismatch = false } = opts;
   const session = await loadSession();
   // Fail CLOSED (task 2102) if the session we'd authenticate with belongs to a
   // different instance than this repo is configured for — never silently borrow
@@ -740,13 +696,6 @@ async function apiCall(method, urlPath, body = null, opts = {}) {
     _unauthExitInFlight = true;
     printUnauthGuidanceAndExit();
   }
-  // task 1050 (C): a box-scoped session hitting a non-bootstrap endpoint gets a
-  // guided re-auth path instead of a raw box_scope dump. allowUnauthenticated
-  // opts out (e.g. a probe that wants to inspect the 403 itself).
-  if (isBoxScope({ status: res.status, data }) && !allowBoxScope && !allowUnauthenticated && !_boxScopeExitInFlight) {
-    _boxScopeExitInFlight = true;
-    printBoxScopeGuidanceAndExit();
-  }
   return { status: res.status, ok: res.ok, data };
 }
 
@@ -759,7 +708,7 @@ async function apiCall(method, urlPath, body = null, opts = {}) {
 //     throws on HTTP status; network errors still reject), so the long-standing
 //     apiCall contract holds and status-inspecting callers port 1:1.
 //   • fetch    — a wrapper that keeps apiCall's behavior: the founder CLI
-//     User-Agent, plus the 401 and box_scope 403 auto-exit guidance.
+//     User-Agent, plus the 401 auto-exit guidance.
 // Named methods (api.tasks.getTasksId({ id })) replace hand-built apiCall paths;
 // api.request(method, path, opts) is the escape hatch for non-spec routes.
 // The generated client is ESM; we import() it once and cache per (base, token,
@@ -767,7 +716,7 @@ async function apiCall(method, urlPath, body = null, opts = {}) {
 let _clientModPromise = null;
 const _clientCache = new Map();
 async function cliClient(opts = {}) {
-  const { allowUnauthenticated = false, allowBoxScope = false, allowInstanceMismatch = false } = opts;
+  const { allowUnauthenticated = false, allowInstanceMismatch = false } = opts;
   const session = await loadSession();
   // Fail CLOSED (task 2102) — the same guard as apiCall, on the OTHER HTTP entry
   // point. cliClient() is the typed client (api.js + newer scripts route through
@@ -783,7 +732,7 @@ async function cliClient(opts = {}) {
   }
   const base = ic.resolveApiBase({ session: session || null });
   const token = (session && session.token) || null;
-  const key = `${base}|${token || ''}|${allowUnauthenticated}|${allowBoxScope}`;
+  const key = `${base}|${token || ''}|${allowUnauthenticated}`;
   if (_clientCache.has(key)) return _clientCache.get(key);
   if (!_clientModPromise) _clientModPromise = import('../../clients/bongos-client/index.mjs');
   const { createClient } = await _clientModPromise;
@@ -796,13 +745,6 @@ async function cliClient(opts = {}) {
       _unauthExitInFlight = true;
       printUnauthGuidanceAndExit();
     }
-    if (res.status === 403 && !allowBoxScope && !allowUnauthenticated && !_boxScopeExitInFlight) {
-      const peek = await res.clone().json().catch(() => null);
-      if (isBoxScope({ status: 403, data: peek })) {
-        _boxScopeExitInFlight = true;
-        printBoxScopeGuidanceAndExit();
-      }
-    }
     return res;
   };
   const client = createClient({ baseUrl: `${base}/api/bongos/v1`, token, fetch: authedFetch, throwOnError: false });
@@ -810,64 +752,6 @@ async function cliClient(opts = {}) {
   return client;
 }
 
-// ---- does this instance even HAVE dev boxes? (task 1003730) -----------------
-// The dev-box module is a CONTROL-PLANE capability: it provisions DigitalOcean droplets, so a
-// hosted co-tenant instance runs without it. The instance manifest has always said so —
-// GET /api/bongos/instance carries modules.enabled — but no CLI script read it, so `bongos shell`
-// on such an instance died with a bare `POST /box/ensure failed (HTTP 404: not_found)`.
-//
-// That mattered far more than a bad error string: the public CLI (ADR 0258) answers
-// `bongos claim` by pointing at `bongos shell`, so on every dev-box-less instance the ONLY route
-// it offered to a checkout was a dead end — a newcomer could see the work and not start it.
-//
-// Cached per process, and FAILS OPEN: a manifest hiccup must never block a working box.
-let _devBoxCheck = null;
-
-// The decision, kept pure so it is testable without a network: does THIS manifest prove the
-// instance has no dev box? Anything short of an explicit module roster answers "assume yes" —
-// an older core, a truncated body or an unreachable manifest must never block a working box.
-function devBoxEnabledInManifest(manifest) {
-  const enabled = manifest && manifest.modules && manifest.modules.enabled;
-  if (!enabled || typeof enabled !== 'object') return true;
-  return enabled['dev-box'] === true;
-}
-
-async function instanceDevBoxSupport() {
-  if (_devBoxCheck) return _devBoxCheck;
-  _devBoxCheck = (async () => {
-    try {
-      const api = await cliClient();
-      const res = await api.instance.getInstance();
-      return { available: devBoxEnabledInManifest(res && res.ok ? res.data : null) };
-    } catch (_) {
-      return { available: true };
-    }
-  })();
-  return _devBoxCheck;
-}
-
-// The explanation a reader can act on. Deliberately does NOT name the instance: a co-tenant's
-// manifest currently reports the platform's name rather than its own, so naming it would be wrong
-// more often than helpful.
-function devBoxUnavailableMessage() {
-  return (
-    `This instance doesn't offer cloud dev boxes.\n` +
-    `  It runs without the dev-box module, so there is no box to open a shell on.\n` +
-    `  Claiming and shipping happen in a checkout of the project's repo, where the full\n` +
-    `  CLI is installed.\n` +
-    `\n` +
-    `  → Ask the project's owner for repo access, then run ${surfaceAction('claim', 'N')} from that checkout.`
-  );
-}
-
-// Throw that explanation when this instance has no dev box. Callers run it BEFORE any box call,
-// so nothing prints a confusing intermediate 404 first.
-async function assertDevBoxAvailable() {
-  const { available } = await instanceDevBoxSupport();
-  if (available) return;
-  throw new Error(devBoxUnavailableMessage());
-}
-
 async function requireSession() {
   const s = await loadSession();
   if (!s || !s.token) {
@@ -1248,13 +1132,7 @@ module.exports = {
   requireSession,
   surfaceAction,
   isTerminalSurface,
-  devBoxEnabledInManifest,
-  instanceDevBoxSupport,
-  devBoxUnavailableMessage,
-  assertDevBoxAvailable,
   printUnauthGuidanceAndExit,
-  isBoxScope,
-  printBoxScopeGuidanceAndExit,
   detectInstanceMismatch,
   assertInstanceMatch,
   instanceOriginHost,

package/scripts/gds/go-live.js

@@ -375,7 +375,7 @@ const ARTIST_GATE_LEVELS = ['off', 'advisory', 'strict'];
 
 async function readArtistGate(call = apiCall) {
   try {
-    const res = await call('GET', ARTIST_GATE_PATH, null, { allowUnauthenticated: true, allowBoxScope: true });
+    const res = await call('GET', ARTIST_GATE_PATH, null, { allowUnauthenticated: true });
     if (res.status === 404) return { unread: `this instance does not serve ${ARTIST_GATE_PATH} — it predates ADR 0241` };
     // A 5xx is a gate that EXISTS and BROKE, which is not the same class of
     // unknown as "no session" or "too old to have the route". The gate is

package/scripts/gds/login.js

@@ -324,7 +324,7 @@ async function main() {
   log('');
   log(`  ✓ Signed in to ${instanceName} as ${who}.`);
   logOtherInstances(base, log);
-  log('  Next:  bongos start  (see what you can claim)  ·  bongos code / bongos shell  (get on your dev box)');
+  log('  Next:  bongos start  (see what you can claim)');
 }
 
 // Name the OTHER instances this machine is signed into, and how to move between them (task

package/scripts/gds/plain-cards.js

@@ -295,18 +295,10 @@ const CARDS = Object.freeze({
     'Your sign-in to the project has ended.',
     'I will walk you through signing in again — Settings, then one copy and paste.',
     'You, to sign in again.', RULE),
-  box_scope: card(
-    'This sign-in is limited on purpose: it can do the work, but not hand it in.',
-    'I will walk you through the full sign-in, then hand the work in.',
-    'You, to sign in again.', RULE),
   instance_mismatch: card(
     'This computer is signed in to a different project than the one this folder belongs to.',
     'I will show which project each one is, and help you sign in to the right one.',
     'You, to choose the project.', FAULT),
-  dev_box_unavailable: card(
-    'This project does not offer hosted computers to work from.',
-    'We can work from this computer instead.',
-    null, RULE),
   no_push_credential: card(
     'This computer is not allowed to send work to the code host itself. That is deliberate: the server sends it for you.',
     'I will hand the work in with /builder-ship and read its progress from the server. I will never ask anyone for a password, key or sign-in to work round this.',

package/scripts/gds/ship-land.js

@@ -11,7 +11,7 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { cliClient, isBoxScope } = require('./cli-lib');
+const { cliClient } = require('./cli-lib');
 const { gitArgvOk, gitOk, sanitizeGitHubRefs, shellOk } = require('./ship-git.js');
 const { buildPrCreateArgv, buildPrMergeArgv, deployRunSucceeded, deployedCommitStatus, fetchDeployedVersion, ghArgvOk, ghJson, pushVia, resolveInstanceBase } = require('./ship-deploy-target.js');
 const { normalizeApiError } = require('./ship-io.js');
@@ -177,26 +177,10 @@ async function ciLandServer(taskId, branch, valueSummary) {
       return landBailed('could not build the branch bundle', strandCommand(taskId, 'server'));
     }
     const bundleB64 = fs.readFileSync(bundlePath).toString('base64');
-    // allowBoxScope: handle the box_scope 403 locally (graceful "stays at
-    // confirmed, re-auth + re-ship") instead of cli-lib's central exit — task
-    // 1050. (In practice unreachable: a box session can't have claimed/confirmed
-    // to get here. Kept as a defensive, graceful path.)
-    const r = await (await cliClient({ allowBoxScope: true })).tasks.postTasksIdPublishBranch({
+    const r = await (await cliClient()).tasks.postTasksIdPublishBranch({
       id: taskId,
       body: { branch, head_sha: headSha, value_summary: valueSummary, bundle_b64: bundleB64 },
     });
-    // task 1002593: ONE definition of "is this a box-scope refusal". This site used
-    // to hand-roll the comparison, which is how it silently died when routes moved
-    // to the object error envelope — `r.data.error` stopped being the bare string
-    // and the branch could never fire. Normalizing here fixed the symptom but left
-    // a SECOND predicate for the same question, and two copies of a predicate are
-    // how one of them gets a fix the other never sees (migration 177 dropping 176's
-    // blocker clause is the same shape). cli-lib's isBoxScope is the one every
-    // other caller already uses; this is the last site that did not.
-    if (isBoxScope(r)) {
-      console.log('  ci-land: this session is BOX-SCOPED — run /builder-reauth (browser, no terminal) to mint a real session, then re-ship. Task stays at confirmed.');
-      return landBailed('this CLI session is box-scoped', '/builder-reauth');
-    }
     if (r.status === 503) {
       console.log('  ci-land: server-mediated push is not configured on the server yet (no GitHub App nor GITHUB_PUSH_TOKEN — operator action, ADR 0055). Task stays at confirmed.');
       return landBailed('server-mediated push is not configured (operator action)', strandCommand(taskId, 'server'));

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.901'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.903'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bongos_dispatch.mjs

@@ -15,7 +15,7 @@ const { VERBS, GDS_DIR, helpText } = bongos;
 const BIN = fileURLToPath(new URL('../bin/bongos.js', import.meta.url));
 
 // The 7 verbs the task's "done when" explicitly requires to dispatch.
-const REQUIRED = ['start', 'claim', 'ship', 'box', 'cost', 'status', 'recall'];
+const REQUIRED = ['start', 'claim', 'ship', 'cost', 'status', 'recall'];
 
 test('every required verb is registered', () => {
   for (const v of REQUIRED) assert.ok(VERBS[v], `missing required verb: ${v}`);
@@ -68,7 +68,7 @@ test('bare `bongos` prints help and exits 0', () => {
   assert.match(r.stdout, /Usage:  bongos/);
 });
 
-test('a prefix-args verb (box) targets the generic api.js caller', () => {
-  assert.equal(VERBS.box.script, 'api.js');
-  assert.deepEqual(VERBS.box.prefixArgs, ['POST', '/api/gds/box/ensure']);
+test('a prefix-args verb (serve) carries the args pinned in front of the user\'s', () => {
+  assert.equal(VERBS.serve.script, 'dev.js');
+  assert.deepEqual(VERBS.serve.prefixArgs, ['--server']);
 });

package/tests/claude_materialize.mjs

@@ -5,7 +5,7 @@
 //   1. bongosify — dedicated verb where one exists (bongos ship), else `bongos exec scripts/gds/<x>.js`;
 //      $CLAUDE_PROJECT_DIR/quotes stripped; args preserved; .claude/hooks/ refs left instance-local;
 //      idempotent.
-//   2. scriptToVerb — excludes prefixArgs verbs so api.js never mis-maps to `bongos box`.
+//   2. scriptToVerb — excludes prefixArgs verbs so dev.js never mis-maps to `bongos serve`.
 //   3. transformSettings — rewrites the scripts/gds hook commands AND permission rules, keeps .claude/hooks/ ones.
 //   4. materializeClaude — copies + transforms skills into a target dir (no leftover node scripts/gds),
 //      writes settings.json, copies hooks; and NO-OPS when the target IS the core root (self-copy guard).

package/tests/cli_package.mjs

@@ -219,9 +219,6 @@ test('the packed tarball installs and every verb runs with no repo present', (t)
     // guidance, still exits 10, so every assertion below is unchanged.
     reauth:  ['reauth', '--no-open'],
     setup:   ['setup'],
-    box:     ['box'],
-    shell:   ['shell'],
-    code:    ['code'],
     start:   ['start'],
     status:  ['status'],
     task:    ['task', 'show', '1'],
@@ -290,7 +287,7 @@ test('the packed tarball installs and every verb runs with no repo present', (t)
     const res = runVerb([verb]);
     const all = `${res.stdout}\n${res.stderr}`;
     assert.match(all, /is not in the public CLI/, `bongos ${verb} must say why it is absent`);
-    assert.match(all, /bongos shell/, `bongos ${verb} must point at a way to get a checkout`);
+    assert.match(all, /checkout of the project repo/, `bongos ${verb} must point at a way to get a checkout`);
     assert.ok(!/unknown command/.test(all), `bongos ${verb} must not read as a typo`);
   }
 

package/tests/cli_surface.mjs

@@ -205,7 +205,7 @@ function guidanceOutput(fn, env) {
   return out;
 }
 
-const GUIDANCE = ['printUnauthGuidanceAndExit', 'printBoxScopeGuidanceAndExit', 'requireSession'];
+const GUIDANCE = ['printUnauthGuidanceAndExit', 'requireSession'];
 
 test('no guidance path speaks slash commands to a terminal reader', () => {
   for (const fn of GUIDANCE) {
@@ -220,7 +220,6 @@ test('the agent still gets its slash commands from those same paths', () => {
   // The inverse guard: a blanket rewrite that "fixed" the leak by deleting the slash commands
   // would break the reader they were written for, and nothing else here would notice.
   assert.match(runGuidance('printUnauthGuidanceAndExit', {}), /\/builder-reauth/);
-  assert.match(runGuidance('printBoxScopeGuidanceAndExit', {}), /\/builder-reauth/);
   assert.match(runGuidance('requireSession', {}), /\/builder-setup/);
 });
 
@@ -231,7 +230,6 @@ test('every shipped script that names a slash command routes it through the surf
   const ALLOWED = new Set([
     'scripts/gds/cli-lib.js',        // agent side of the three branches, proven above
     'scripts/gds/setup.js',          // re-run + newcomer-path lines, asserted below
-    'scripts/gds/box-connect-lib.js',// key-registration hint, asserted below
     'scripts/gds/surface.js',        // the switch itself
     'scripts/gds/start.js',          // section 3's documented agent-only exemptions
   ]);
@@ -257,88 +255,3 @@ test('setup.js routes its newcomer path and re-run lines through the surface', (
   assert.ok(!/console\.log\('  2\. Survey work:       \/builder-start'\)/.test(src), 'hard-coded /builder-start left in setup.js');
   assert.match(src, /re-run \$\{surfaceAction\('setup'\)\}/, 'the re-run lines must use surfaceAction');
 });
-
-test('box-connect-lib names the box command for the reader it has', () => {
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'box-connect-lib.js'), 'utf8');
-  assert.ok(!/add it via \/builder-box/.test(src), 'hard-coded /builder-box left in box-connect-lib.js');
-  assert.match(src, /add it via \$\{surfaceAction\('box'\)\}/);
-});
-
-// ── 5. The dead end: an instance with no dev box (task 1003730) ─────────────────────────────
-//
-// `bongos claim N` refuses and points at `bongos shell`. On an instance whose manifest carries
-// no dev-box module that call 404s, so the public CLI's only offered route to a checkout was a
-// hard error — a newcomer could see the work and not start it. The manifest always said so;
-// nothing read it.
-
-const cliLib = require(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'));
-
-test('the manifest decides, and only an explicit roster can prove absence', () => {
-  assert.equal(cliLib.devBoxEnabledInManifest({ modules: { enabled: { 'dev-box': true } } }), true);
-  assert.equal(cliLib.devBoxEnabledInManifest({ modules: { enabled: { economy: true } } }), false);
-});
-
-test('the check fails OPEN — a hiccup must never block a working box', () => {
-  // Every one of these is "I could not tell", and the safe answer to that is to proceed and let
-  // the real API call speak. Failing closed here would break `bongos shell` on every instance
-  // running a core too old to publish a module roster.
-  for (const manifest of [null, undefined, {}, { modules: {} }, { modules: { enabled: null } }, 'nonsense']) {
-    assert.equal(cliLib.devBoxEnabledInManifest(manifest), true, `should fail open for ${JSON.stringify(manifest)}`);
-  }
-});
-
-test('the explanation names a command the reader can actually run', () => {
-  // It routes through the same switch as everything else: a terminal reader must not be handed
-  // `/builder-claim`, and an agent in a checkout must still get it.
-  const prev = process.env.BONGOS_SURFACE;
-  try {
-    process.env.BONGOS_SURFACE = 'terminal';
-    const term = cliLib.devBoxUnavailableMessage();
-    assert.ok(!/\/builder-/.test(term), `slash command in the terminal dev-box message: ${term}`);
-    assert.match(term, /bongos claim N/);
-    assert.match(term, /doesn't offer cloud dev boxes/);
-    assert.match(term, /checkout/, 'must name the actual alternative, not just refuse');
-
-    delete process.env.BONGOS_SURFACE;
-    assert.match(cliLib.devBoxUnavailableMessage(), /\/builder-claim N/, 'agents keep the slash command');
-  } finally {
-    if (prev === undefined) delete process.env.BONGOS_SURFACE;
-    else process.env.BONGOS_SURFACE = prev;
-  }
-});
-
-test('both box entry points check BEFORE they touch the box API', () => {
-  // Ordering is the whole point: key registration hits the box API too, so gating only the
-  // ensure call still printed "Could not register your key (not_found)" first.
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'box-connect-lib.js'), 'utf8');
-  assert.match(
-    src,
-    /async function prepareConnection\([^)]*\) \{[\s\S]{0,400}?await assertDevBoxAvailable\(\);[\s\S]{0,200}?ensureSshKey/,
-    'prepareConnection must assert before ensureSshKey/key registration',
-  );
-  assert.match(
-    src,
-    /async function ensureBoxActive\([^)]*\) \{\s*await assertDevBoxAvailable\(\);/,
-    'ensureBoxActive must assert before postBoxEnsure',
-  );
-});
-
-test('the raw box passthrough explains a 404 too', () => {
-  // `bongos box` is api.js aimed at POST /box/ensure, so without this it dumped a bare 404 body.
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'api.js'), 'utf8');
-  assert.match(src, /instanceDevBoxSupport/, 'api.js must consult the dev-box check');
-  assert.match(src, /res\.status === 404/, 'only on a 404');
-  assert.match(src, /\\\/box\\b/, 'and only for a box path — api.js stays generic');
-});
-
-test('the generated dispatcher does not promise a dev box it cannot verify', () => {
-  // The dispatcher has no session or manifest yet, so it must present `bongos shell` as
-  // conditional. Stating it flatly is what sent newcomers into the 404.
-  const gen = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'build-cli-package.js'), 'utf8');
-  assert.ok(
-    !/'To get a checkout without installing anything locally/.test(gen),
-    'the unconditional promise is back in the checkout-only refusal',
-  );
-  assert.match(gen, /If this instance offers cloud dev boxes/);
-  assert.match(gen, /Not every instance runs dev boxes/);
-});

package/tests/hall_kit_charts.mjs

@@ -15,6 +15,7 @@
 
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
 import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
@@ -642,6 +643,43 @@ test('CAL: a one-week window says "week", and the full window still says "the la
   assert.match(full, /over the last year/, 'the 53-week window is a year and should read like one');
 });
 
+// --- task 1003621 (artist review of 1003583): ONE name for the drawn window ---------
+
+test('CAL: the window carries its own name, and the aria summary uses that name', () => {
+  // The half the arithmetic fix left behind. 1003583 made the summary and the caption
+  // COUNT the same window; they still DESCRIBED it differently — the aria summary said
+  // "the last year" (a rolling 53 weeks, which is what is drawn) while the caption under
+  // the same grid said "this year" (a calendar year, which is not). V3 asks the
+  // accessible line and the visible one to state the same fact, so the phrase now lives
+  // on the window itself and both read it.
+  for (const weeks of [1, 6, 53]) {
+    const win = kit.calendarWindow([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03', weeks });
+    assert.ok(win && typeof win.spanLabel === 'string' && win.spanLabel.length,
+      `calendarWindow must name its own window (weeks=${weeks})`);
+    const html = kit.calendarGridHtml([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03', weeks });
+    assert.ok(html.includes(`over ${win.spanLabel}:`),
+      `the aria summary must use the window's own name, not a second copy of the rule (weeks=${weeks})`);
+  }
+});
+
+test('CAL: the caption under the grid cannot drift back to "this year"', () => {
+  // The caption is rendered by profile-charts.js from win.spanLabel. What is pinned here
+  // is the phrase it must never go back to: a calendar year is not the window drawn, and
+  // a reader comparing the number to the picture is the person who pays for the gap.
+  const win = kit.calendarWindow([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03', weeks: 53 });
+  assert.equal(win.spanLabel, 'the last year');
+
+  // Asserted against the SOURCE because the caption is assembled in a browser global the
+  // unit lane does not render. The same idiom tests/modules_route_wiring.mjs uses.
+  const src = readFileSync(new URL('../modules/hall-ui/public/profile-charts.js', import.meta.url), 'utf8');
+  assert.match(src, /spanLabel/, 'the caption must take the window name from the window');
+  assert.doesNotMatch(
+    src, /shipped this year/,
+    'the caption said "this year" while the grid drew a rolling 53 weeks and the aria '
+    + 'summary said "the last year" — one window, two names, which is the V3 break',
+  );
+});
+
 test('CAL: the summary counts only the days the grid actually draws', () => {
   // 2026-09-03 is a Thursday, so a 2-week grid starts at Sunday 2026-08-23. A ship on
   // 2026-08-01 is real history the caller supplied, but it is off this picture, and it