@bongos/core 1.19.902 → 1.19.904

package/modules/hall-ui/public/collab.js

@@ -418,11 +418,25 @@
     const whoName = o.name || o.login || `builder ${o.id}`;
     const who = escapeHtml(whoName);
     const face = { kind: 'person', id: o.id, name: whoName, avatar: null, initial: L.initialOf(whoName) };
+
+    // A SENTENCE TAKES roleWord() — the rule dom-utils.js writes down beside the helper
+    // (task 1004041). This row took neither helper and interpolated the raw column, so a
+    // pair whose role was unset rendered the database's own word: "A unclassified — you
+    // are a engineer", which is V2's named failure and a wrong article in the same line.
+    // Where a role is missing the comparison has nothing to compare, so the row says the
+    // one thing that is still true rather than naming a value nobody chose.
+    // roleIsUnset() is how a caller asks (dom-utils.js:198). Spelling 'unclassified' here
+    // would be a second definition of the axis in a third file — the drift V1 forbids, and
+    // the exact shape this review was filed to remove.
+    const theirs = window.OTB.roleIsUnset(o.craft) ? '' : window.OTB.roleWord(o.craft);
+    const mine = window.OTB.roleIsUnset(o.myCraft) ? '' : window.OTB.roleWord(o.myCraft);
+    const pairLine = L.pairSentence(theirs, mine);
+
     return `<li class="ov-row ov-row--lead cb-row">
       ${faceHtml(face)}
       <div class="ov-row__main">
         <a class="ov-row__title" href="/builders/profile?id=${escapeHtml(String(o.id))}">${who}</a>
-        <p class="ov-row__sub">A ${escapeHtml(String(o.craft))} — you are a ${escapeHtml(String(o.myCraft))}. Mingle pairs across roles.</p>
+        <p class="ov-row__sub">${escapeHtml(pairLine)}</p>
       </div>
       <div class="ov-row__right">
         <div class="ov-row__actions">
@@ -511,6 +525,7 @@
 
   load().catch(() => {
     const sub = $('#cb-sub');
-    if (sub) sub.textContent = 'Could not load requests.';
+    // V6: a message that stops someone points at the next move in the same breath.
+    if (sub) sub.textContent = 'Could not load requests — reload to try again.';
   });
 })();

package/modules/hall-ui/public/hall-kit.js

@@ -1141,7 +1141,13 @@
       activeDays += 1;
       totalShips += c;
     }
-    return { counts, startSun, endOrd, weeks, activeDays, totalShips };
+    // The window's NAME belongs with the window (task 1003621, artist review of 1003583).
+    // The aria summary described it as "the last year" while the caption under the same
+    // grid said "this year" — a rolling 53 weeks and a calendar year are not the same
+    // span, and V3 asks the accessible line and the visible one to state the same fact.
+    // Both now read this.
+    const spanLabel = weeks === 53 ? 'the last year' : `the last ${weeks} week${weeks === 1 ? '' : 's'}`;
+    return { counts, startSun, endOrd, weeks, activeDays, totalShips, spanLabel };
   }
 
   // calendarGridHtml(days, opts) — a year of ship-days as a contribution calendar:
@@ -1168,7 +1174,7 @@
   function calendarGridHtml(days, opts = {}) {
     const win = calendarWindow(days, opts);
     if (!win) return ''; // nothing real to draw → caller's empty state
-    const { counts, startSun, endOrd, weeks, activeDays, totalShips } = win;
+    const { counts, startSun, endOrd, weeks, activeDays, totalShips, spanLabel } = win;
     const ordToYmd = calOrdToYmd;
 
     // level 0 = empty; 1..5 map to the anti-gaming daily cap (streak.js caps a day at
@@ -1188,10 +1194,10 @@
     }
 
     // The window is DESCRIBED, not assumed: a caller passing weeks:6 used to be handed
-    // an aria label saying "over the last year" (task 1003583).
-    const span = weeks === 53 ? 'the last year' : `the last ${weeks} week${weeks === 1 ? '' : 's'}`;
+    // an aria label saying "over the last year" (task 1003583). The phrase now comes from
+    // calendarWindow so the caption beneath the grid can say the same words.
     const summary = opts.ariaLabel
-      || `Ships per day over ${span}: ${totalShips} ship${totalShips === 1 ? '' : 's'} across ${activeDays} day${activeDays === 1 ? '' : 's'}.`;
+      || `Ships per day over ${spanLabel}: ${totalShips} ship${totalShips === 1 ? '' : 's'} across ${activeDays} day${activeDays === 1 ? '' : 's'}.`;
     // The legend is aria-hidden: it decorates the bands, it carries no fact the cell
     // titles and the summary do not already state in words.
     const legend = '<div class="kit-cal__key" aria-hidden="true"><span class="kit-cal__key-label">less</span>'

package/modules/hall-ui/public/profile-charts.js

@@ -284,7 +284,7 @@
     // The scalars in words, in the .pchart__read slot the other figures use for their
     // crosshair readout — here it is static because the calendar's reading is per-cell.
     const read = `Current streak ${cur} day${cur === 1 ? '' : 's'} \u00b7 longest ${lng} \u00b7 `
-      + `${active} day${active === 1 ? '' : 's'} shipped this year`;
+      + `${active} day${active === 1 ? '' : 's'} shipped in ${win ? win.spanLabel : 'the last year'}`;
     const html = `<figure class="pchart" id="${esc(id)}">
       <figcaption class="pchart__title">Your shipping year</figcaption>
       <p class="pchart__read">${esc(read)}</p>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.902",
+  "version": "1.19.904",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.902",
+      "version": "1.19.904",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.902",
+  "version": "1.19.904",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/api.js

@@ -18,9 +18,7 @@
 // on a 2xx, 1 on any non-2xx or transport error, 2 on bad invocation.
 
 const fs = require('node:fs');
-const { cliClient, arg, stripBom, resolveQuiet, isBoxScope, printBoxScopeGuidanceAndExit, cliExit, repairMsysMangledPath,
-  instanceDevBoxSupport, devBoxUnavailableMessage } = require('./cli-lib');
-const { plainCardLines } = require('./plain-cards');
+const { cliClient, arg, stripBom, resolveQuiet, cliExit, repairMsysMangledPath } = require('./cli-lib');
 
 
 (async () => {
@@ -77,31 +75,9 @@ const { plainCardLines } = require('./plain-cards');
     return cliExit(1); // task 1002734: never process.exit() after a request
   }
   if (!quiet) console.error(`${method} ${urlPath} → ${res.status}`);
-  // task 1501: on a dev box the baked session is box-scoped (ADR 0053) and every
-  // non-bootstrap call (e.g. /me, /inbox) returns 403 box_scope. We pass
-  // allowUnauthenticated above (so a 401 stays a plain error, not the setup
-  // short-circuit), which ALSO suppresses apiCall's own box_scope guidance — so
-  // surface it here. Without this the raw {error:'box_scope'} body was dumped and
-  // rank-gated skills (/idea-triage, /blocker-review, …) read the missing `rank`
-  // as "pre-rank passthrough" and silently did nothing (reported an empty inbox
-  // on a dev box). The guided message tells the builder to /builder-reauth.
-  if (isBoxScope(res)) {
-    printBoxScopeGuidanceAndExit(); // prints the re-auth guidance + exit(10)
-  }
   if (res.data !== undefined && res.data !== null) {
     console.log(JSON.stringify(res.data, null, 2));
   }
-  // task 1003730: `bongos box` in the public CLI is this passthrough aimed at
-  // POST /box/ensure, so on an instance without the dev-box module a builder got a raw
-  // 404 body and no idea why. api.js stays generic — it just adds the one explanation
-  // that a /box/ 404 always means — and only for a reader who typed a box command.
-  if (res.status === 404 && /^\/api\/(?:bongos\/v1|bongos|gds)\/box\b/.test(urlPath)) {
-    const { available } = await instanceDevBoxSupport();
-    if (!available) {
-      console.error(`\n✖ ${devBoxUnavailableMessage()}`);
-      for (const line of plainCardLines('dev_box_unavailable')) console.error(line);
-    }
-  }
   // task 1002734: process.exit() here aborted node 5/5 on Windows —
   // "Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c"
   // — AFTER the JSON had already printed, so every caller that checks the exit code

package/scripts/gds/build-cli-package.js

@@ -77,11 +77,6 @@ const FILES = [
   'scripts/gds/release.js',
   'scripts/gds/worktree-claim-guard.js', // release.js warns through it; pure, zero requires
 
-  // Get onto a real environment without installing one: the cloud dev box.
-  'scripts/gds/shell.js',
-  'scripts/gds/code.js',
-  'scripts/gds/box-connect-lib.js',
-
   // Module files the above touch. Each imports nothing from the kernel at load time.
   'modules/lifecycle/task-classifier.js',
   'modules/lifecycle/task-visuals.js',
@@ -126,7 +121,6 @@ const FORBIDDEN_PREFIXES = [
   'public/',
   'modules/hall-ui/',
   '.github/',
-  'devbox-app/',
 ];
 const FORBIDDEN_BASENAMES = [
   'pool.js', 'auth.js', 'db.js', 'server.js', 'serve-internal.js',
@@ -141,9 +135,6 @@ const VERBS = {
   login:   { script: 'login.js',   group: 'account', summary: 'Sign in to an instance  (bongos login <url> — browser click, no paste)' },
   reauth:  { script: 'reauth.js',  group: 'account', summary: 'Refresh your session' },
   setup:   { script: 'setup.js',   group: 'account', summary: 'Finish builder setup on this instance (disciplines, consent)' },
-  box:     { script: 'api.js', prefixArgs: ['POST', '/api/bongos/box/ensure'], group: 'account', summary: 'Turn on / wake your cloud dev box' },
-  shell:   { script: 'shell.js',   group: 'account', summary: 'Open a terminal on your dev box' },
-  code:    { script: 'code.js',    group: 'account', summary: 'Open VS Code on your dev box over Remote-SSH' },
 
   start:   { script: 'start.js',   group: 'work', summary: 'List tasks you can claim right now' },
   status:  { script: 'status.js',  group: 'work', summary: 'Version / criterion progress  (bongos status C8)', selfHelp: true },
@@ -159,9 +150,11 @@ const VERBS = {
 // the reason and the actual next step, because a newcomer hitting a bare "unknown command" learns
 // nothing — that silence is the exact failure this whole task is fixing.
 //
-// The next step it names is CONDITIONAL prose, not a promise: dev boxes are a control-plane
-// capability many instances run without (task 1003730). The dispatcher has no session or manifest
-// yet, so it must not claim `bongos shell` will work — that verb makes the determination itself.
+// The next step used to be CONDITIONAL prose offering a cloud dev box first. The dev box was
+// retired (task 1003889), so the one unconditional route — a checkout of the project repo — is
+// now the only branch. ADR 0258's exclusion of claim/ship is UNCHANGED and deliberate: this is
+// the PRE-checkout CLI, and a claim that cannot materialise into a checkout is worse than one
+// that says where to go.
 const CHECKOUT_ONLY = {
   claim:   'Claiming a task writes code, so it needs a real checkout and a worktree.',
   ship:    'Shipping grades, merges and deploys from a real checkout.',
@@ -298,8 +291,8 @@ function helpText() {
   }
   lines.push('', '  help        Show this help', '  version     Show the bongos version');
   lines.push('');
-  lines.push('Writing code (claim, ship) happens in a checkout. \`bongos shell\` opens one');
-  lines.push('on a cloud dev box with nothing to install locally.');
+  lines.push('Writing code (claim, ship) happens in a checkout of the project repo,');
+  lines.push('where the full CLI is already installed.');
   return lines.join('\\n');
 }
 
@@ -329,13 +322,8 @@ function main(argv) {
   if (CHECKOUT_ONLY[verb]) {
     process.stderr.write(
       'bongos: "' + verb + '" is not in the public CLI.\\n  ' + CHECKOUT_ONLY[verb] + '\\n\\n' +
-      'If this instance offers cloud dev boxes, you can get a checkout without\\n' +
-      'installing anything locally:\\n' +
-      '  bongos shell            open a terminal on your cloud dev box\\n' +
-      '  bongos code             open VS Code on it over Remote-SSH\\n\\n' +
-      'Not every instance runs dev boxes. If yours does not, bongos shell says so,\\n' +
-      'and the route is a checkout of the project repo instead. The full CLI\\n' +
-      '(including ' + verb + ') is installed in both.\\n'
+      'The route is a checkout of the project repo, where the full CLI\\n' +
+      '(including ' + verb + ') is installed. Ask the project owner for repo access.\\n'
     );
     return 2;
   }
@@ -379,7 +367,7 @@ function packageJsonSource(version) {
   return JSON.stringify({
     name: PACKAGE_NAME,
     version,
-    description: 'The Cloud Bongos CLI — sign in to an instance, see what you can build, and get onto a dev box. Client only: no server.',
+    description: 'The Cloud Bongos CLI — sign in to an instance and see what you can build. Client only: no server.',
     bin: { bongos: 'bin/bongos.js' },
     files: ['bin/', ...roots, 'README.md'],
     engines: { node: '>=20' },
@@ -398,8 +386,8 @@ function packageJsonSource(version) {
 function readmeSource(version) {
   return `# ${PACKAGE_NAME}
 
-The [Cloud Bongos](https://cloudbongos.com) CLI. Sign in to an instance, see what you can pick
-up, and get onto a dev box — from a terminal, with nothing installed.
+The [Cloud Bongos](https://cloudbongos.com) CLI. Sign in to an instance and see what you can
+pick up — from a terminal, with nothing installed.
 
 ## Start here
 
@@ -421,9 +409,8 @@ bongos start
 
 ## Commands
 
-Run \`bongos help\` for the current list. In short: \`login\`, \`reauth\`, \`setup\`, \`box\`,
-\`shell\`, \`code\` for your account and environment; \`start\`, \`status\`, \`task\`, \`recall\`,
-\`cost\`, \`release\`, \`api\` for the work.
+Run \`bongos help\` for the current list. In short: \`login\`, \`reauth\`, \`setup\` for your
+account; \`start\`, \`status\`, \`task\`, \`recall\`, \`cost\`, \`release\`, \`api\` for the work.
 
 \`bongos api\` is the escape hatch — it calls any endpoint on the instance as you, so anything
 the web hall can do is reachable from the terminal:
@@ -434,14 +421,9 @@ bongos api GET /api/bongos/me
 
 ## Writing code
 
-\`claim\` and \`ship\` need a real checkout, so they aren't in this package. The shortest path to
-one is a cloud dev box, which needs nothing on your machine:
-
-\`\`\`sh
-bongos box       # turn it on
-bongos shell     # a terminal on it, full CLI already installed
-bongos code      # or VS Code over Remote-SSH
-\`\`\`
+\`claim\` and \`ship\` need a real checkout, so they aren't in this package. Ask the project's
+owner for repo access and clone it — the full CLI is installed there, and every command in
+this package works the same way from inside it.
 
 ## What this package is
 

package/scripts/gds/claude-materialize.js

@@ -37,7 +37,7 @@ const { renderInstanceClaudeMd } = require('./claude-md-template'); // task 2104
 
 // script basename (e.g. "ship.js") → dedicated bongos verb, for verbs that map to a bare script with
 // NO prefixArgs. Verbs whose script is driven by prefixArgs (box → api.js) are EXCLUDED so a generic
-// `node scripts/gds/api.js …` never mis-maps to `bongos box`; those fall to `bongos exec`. `exec`
+// `node scripts/gds/dev.js …` never mis-maps to `bongos serve`; those fall to `bongos exec`. `exec`
 // itself has no script and is skipped.
 function scriptToVerb(verbs = VERBS) {
   const m = {};

package/scripts/gds/cli-lib.js

@@ -533,50 +533,6 @@ function printUnauthGuidanceAndExit() {
   process.exit(2);
 }
 
-// task 1050 (C): is this response the dev-box bootstrap-scoped 403? A box's baked
-// session (source='box', #919/ADR 0053) may only call the 4 on-box bootstrap
-// endpoints; everything else (claim/ship/me/…) returns a 403 box_scope.
-//
-// task 1002162: accept BOTH body shapes. The live server emits the ADR 0116 (R01)
-// envelope — `{ error: { code, message, details? } }` from api-errors.js
-// `envelope()` — so `res.data.error` is an OBJECT and the old `=== 'box_scope'`
-// string test could never match. Both call sites below were therefore dead code
-// (box-scope was only ever caught by box-auth-check.js instead). Older/flat paths
-// still return `{ error: 'box_scope' }`, so normalize the same way
-// claim.js:formatClaimFailure does rather than swapping one shape for the other.
-//
-// Pure + exported so the detector is unit-tested against the real envelope.
-function isBoxScope(res) {
-  if (!res || res.status !== 403 || !res.data) return false;
-  const errRaw = res.data.error;
-  const code = errRaw !== null && typeof errRaw === 'object' ? errRaw.code : errRaw;
-  return code === 'box_scope';
-}
-
-let _boxScopeExitInFlight = false;
-
-// task 1050 (C): a box_scope 403 used to surface as a raw `failed to load
-// profile: { error: 'box_scope', … }` dump (the #1027 nightmare's first wall).
-// Turn it into the same UI-first guided recovery as a broken session: tell the
-// builder this is a bootstrap-only box session and walk them to re-auth. PRINT
-// only (no auto-open: the command runs ON the box, but the builder's browser is
-// on their own machine — they open the hall there).
-function printBoxScopeGuidanceAndExit() {
-  console.error('');
-  console.error('✖ This is a box-scoped session — it can only run dev-box bootstrap calls,');
-  console.error('  not claim / ship / grade / etc. (the box holds no full-authority token by');
-  console.error('  design — ADR 0053). Re-auth to a real CLI session, then re-run:');
-  console.error('');
-  console.error(isTerminalSurface() ? '    bongos reauth' : '    /builder-reauth      (or: node scripts/gds/reauth.js)');
-  console.error('');
-  console.error(`  It opens your Settings page (${hallBase()}/settings) on`);
-  console.error('  YOUR machine — under "CLI Access" click "Re-issue CLI token", copy the one-liner, paste it back.');
-  console.error('  No terminal Device Flow. Once re-authed, re-run whichever command you were');
-  console.error('  trying — if it had already done work, it resumes from where it stopped (task 941).');
-  for (const line of plainCardLines('box_scope')) console.error(line);
-  console.error('');
-  process.exit(10); // 10 = "re-auth needed" (matches reauth.js's exit code)
-}
 
 // ---- fail-closed instance guard (task 2102) --------------------------------
 // A half-configured instance folder used to fail THROUGH: with no local session
@@ -659,7 +615,7 @@ function printInstanceMismatchAndExit({ expected, actual }) {
   console.error(`    ${pfx}_API_BASE=${actual} <your command>`);
   for (const line of plainCardLines('instance_mismatch')) console.error(line);
   console.error('');
-  process.exit(3); // 3 = instance mismatch (distinct from 2 = unauth, 10 = box-scope)
+  process.exit(3); // 3 = instance mismatch (distinct from 2 = unauth)
 }
 
 // Fail-closed instance guard for RAW-fetch READ commands (task 2124 / demo-audit C2).
@@ -689,7 +645,7 @@ async function assertInstanceMatch({ allowInstanceMismatch = false } = {}) {
  * decide whether to re-auth automatically).
  */
 async function apiCall(method, urlPath, body = null, opts = {}) {
-  const { allowUnauthenticated = false, allowBoxScope = false, allowInstanceMismatch = false } = opts;
+  const { allowUnauthenticated = false, allowInstanceMismatch = false } = opts;
   const session = await loadSession();
   // Fail CLOSED (task 2102) if the session we'd authenticate with belongs to a
   // different instance than this repo is configured for — never silently borrow
@@ -740,13 +696,6 @@ async function apiCall(method, urlPath, body = null, opts = {}) {
     _unauthExitInFlight = true;
     printUnauthGuidanceAndExit();
   }
-  // task 1050 (C): a box-scoped session hitting a non-bootstrap endpoint gets a
-  // guided re-auth path instead of a raw box_scope dump. allowUnauthenticated
-  // opts out (e.g. a probe that wants to inspect the 403 itself).
-  if (isBoxScope({ status: res.status, data }) && !allowBoxScope && !allowUnauthenticated && !_boxScopeExitInFlight) {
-    _boxScopeExitInFlight = true;
-    printBoxScopeGuidanceAndExit();
-  }
   return { status: res.status, ok: res.ok, data };
 }
 
@@ -759,7 +708,7 @@ async function apiCall(method, urlPath, body = null, opts = {}) {
 //     throws on HTTP status; network errors still reject), so the long-standing
 //     apiCall contract holds and status-inspecting callers port 1:1.
 //   • fetch    — a wrapper that keeps apiCall's behavior: the founder CLI
-//     User-Agent, plus the 401 and box_scope 403 auto-exit guidance.
+//     User-Agent, plus the 401 auto-exit guidance.
 // Named methods (api.tasks.getTasksId({ id })) replace hand-built apiCall paths;
 // api.request(method, path, opts) is the escape hatch for non-spec routes.
 // The generated client is ESM; we import() it once and cache per (base, token,
@@ -767,7 +716,7 @@ async function apiCall(method, urlPath, body = null, opts = {}) {
 let _clientModPromise = null;
 const _clientCache = new Map();
 async function cliClient(opts = {}) {
-  const { allowUnauthenticated = false, allowBoxScope = false, allowInstanceMismatch = false } = opts;
+  const { allowUnauthenticated = false, allowInstanceMismatch = false } = opts;
   const session = await loadSession();
   // Fail CLOSED (task 2102) — the same guard as apiCall, on the OTHER HTTP entry
   // point. cliClient() is the typed client (api.js + newer scripts route through
@@ -783,7 +732,7 @@ async function cliClient(opts = {}) {
   }
   const base = ic.resolveApiBase({ session: session || null });
   const token = (session && session.token) || null;
-  const key = `${base}|${token || ''}|${allowUnauthenticated}|${allowBoxScope}`;
+  const key = `${base}|${token || ''}|${allowUnauthenticated}`;
   if (_clientCache.has(key)) return _clientCache.get(key);
   if (!_clientModPromise) _clientModPromise = import('../../clients/bongos-client/index.mjs');
   const { createClient } = await _clientModPromise;
@@ -796,13 +745,6 @@ async function cliClient(opts = {}) {
       _unauthExitInFlight = true;
       printUnauthGuidanceAndExit();
     }
-    if (res.status === 403 && !allowBoxScope && !allowUnauthenticated && !_boxScopeExitInFlight) {
-      const peek = await res.clone().json().catch(() => null);
-      if (isBoxScope({ status: 403, data: peek })) {
-        _boxScopeExitInFlight = true;
-        printBoxScopeGuidanceAndExit();
-      }
-    }
     return res;
   };
   const client = createClient({ baseUrl: `${base}/api/bongos/v1`, token, fetch: authedFetch, throwOnError: false });
@@ -810,64 +752,6 @@ async function cliClient(opts = {}) {
   return client;
 }
 
-// ---- does this instance even HAVE dev boxes? (task 1003730) -----------------
-// The dev-box module is a CONTROL-PLANE capability: it provisions DigitalOcean droplets, so a
-// hosted co-tenant instance runs without it. The instance manifest has always said so —
-// GET /api/bongos/instance carries modules.enabled — but no CLI script read it, so `bongos shell`
-// on such an instance died with a bare `POST /box/ensure failed (HTTP 404: not_found)`.
-//
-// That mattered far more than a bad error string: the public CLI (ADR 0258) answers
-// `bongos claim` by pointing at `bongos shell`, so on every dev-box-less instance the ONLY route
-// it offered to a checkout was a dead end — a newcomer could see the work and not start it.
-//
-// Cached per process, and FAILS OPEN: a manifest hiccup must never block a working box.
-let _devBoxCheck = null;
-
-// The decision, kept pure so it is testable without a network: does THIS manifest prove the
-// instance has no dev box? Anything short of an explicit module roster answers "assume yes" —
-// an older core, a truncated body or an unreachable manifest must never block a working box.
-function devBoxEnabledInManifest(manifest) {
-  const enabled = manifest && manifest.modules && manifest.modules.enabled;
-  if (!enabled || typeof enabled !== 'object') return true;
-  return enabled['dev-box'] === true;
-}
-
-async function instanceDevBoxSupport() {
-  if (_devBoxCheck) return _devBoxCheck;
-  _devBoxCheck = (async () => {
-    try {
-      const api = await cliClient();
-      const res = await api.instance.getInstance();
-      return { available: devBoxEnabledInManifest(res && res.ok ? res.data : null) };
-    } catch (_) {
-      return { available: true };
-    }
-  })();
-  return _devBoxCheck;
-}
-
-// The explanation a reader can act on. Deliberately does NOT name the instance: a co-tenant's
-// manifest currently reports the platform's name rather than its own, so naming it would be wrong
-// more often than helpful.
-function devBoxUnavailableMessage() {
-  return (
-    `This instance doesn't offer cloud dev boxes.\n` +
-    `  It runs without the dev-box module, so there is no box to open a shell on.\n` +
-    `  Claiming and shipping happen in a checkout of the project's repo, where the full\n` +
-    `  CLI is installed.\n` +
-    `\n` +
-    `  → Ask the project's owner for repo access, then run ${surfaceAction('claim', 'N')} from that checkout.`
-  );
-}
-
-// Throw that explanation when this instance has no dev box. Callers run it BEFORE any box call,
-// so nothing prints a confusing intermediate 404 first.
-async function assertDevBoxAvailable() {
-  const { available } = await instanceDevBoxSupport();
-  if (available) return;
-  throw new Error(devBoxUnavailableMessage());
-}
-
 async function requireSession() {
   const s = await loadSession();
   if (!s || !s.token) {
@@ -1248,13 +1132,7 @@ module.exports = {
   requireSession,
   surfaceAction,
   isTerminalSurface,
-  devBoxEnabledInManifest,
-  instanceDevBoxSupport,
-  devBoxUnavailableMessage,
-  assertDevBoxAvailable,
   printUnauthGuidanceAndExit,
-  isBoxScope,
-  printBoxScopeGuidanceAndExit,
   detectInstanceMismatch,
   assertInstanceMatch,
   instanceOriginHost,

package/scripts/gds/go-live.js

@@ -375,7 +375,7 @@ const ARTIST_GATE_LEVELS = ['off', 'advisory', 'strict'];
 
 async function readArtistGate(call = apiCall) {
   try {
-    const res = await call('GET', ARTIST_GATE_PATH, null, { allowUnauthenticated: true, allowBoxScope: true });
+    const res = await call('GET', ARTIST_GATE_PATH, null, { allowUnauthenticated: true });
     if (res.status === 404) return { unread: `this instance does not serve ${ARTIST_GATE_PATH} — it predates ADR 0241` };
     // A 5xx is a gate that EXISTS and BROKE, which is not the same class of
     // unknown as "no session" or "too old to have the route". The gate is

package/scripts/gds/login.js

@@ -324,7 +324,7 @@ async function main() {
   log('');
   log(`  ✓ Signed in to ${instanceName} as ${who}.`);
   logOtherInstances(base, log);
-  log('  Next:  bongos start  (see what you can claim)  ·  bongos code / bongos shell  (get on your dev box)');
+  log('  Next:  bongos start  (see what you can claim)');
 }
 
 // Name the OTHER instances this machine is signed into, and how to move between them (task

package/scripts/gds/plain-cards.js

@@ -295,18 +295,10 @@ const CARDS = Object.freeze({
     'Your sign-in to the project has ended.',
     'I will walk you through signing in again — Settings, then one copy and paste.',
     'You, to sign in again.', RULE),
-  box_scope: card(
-    'This sign-in is limited on purpose: it can do the work, but not hand it in.',
-    'I will walk you through the full sign-in, then hand the work in.',
-    'You, to sign in again.', RULE),
   instance_mismatch: card(
     'This computer is signed in to a different project than the one this folder belongs to.',
     'I will show which project each one is, and help you sign in to the right one.',
     'You, to choose the project.', FAULT),
-  dev_box_unavailable: card(
-    'This project does not offer hosted computers to work from.',
-    'We can work from this computer instead.',
-    null, RULE),
   no_push_credential: card(
     'This computer is not allowed to send work to the code host itself. That is deliberate: the server sends it for you.',
     'I will hand the work in with /builder-ship and read its progress from the server. I will never ask anyone for a password, key or sign-in to work round this.',

package/scripts/gds/ship-land.js

@@ -11,7 +11,7 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { cliClient, isBoxScope } = require('./cli-lib');
+const { cliClient } = require('./cli-lib');
 const { gitArgvOk, gitOk, sanitizeGitHubRefs, shellOk } = require('./ship-git.js');
 const { buildPrCreateArgv, buildPrMergeArgv, deployRunSucceeded, deployedCommitStatus, fetchDeployedVersion, ghArgvOk, ghJson, pushVia, resolveInstanceBase } = require('./ship-deploy-target.js');
 const { normalizeApiError } = require('./ship-io.js');
@@ -177,26 +177,10 @@ async function ciLandServer(taskId, branch, valueSummary) {
       return landBailed('could not build the branch bundle', strandCommand(taskId, 'server'));
     }
     const bundleB64 = fs.readFileSync(bundlePath).toString('base64');
-    // allowBoxScope: handle the box_scope 403 locally (graceful "stays at
-    // confirmed, re-auth + re-ship") instead of cli-lib's central exit — task
-    // 1050. (In practice unreachable: a box session can't have claimed/confirmed
-    // to get here. Kept as a defensive, graceful path.)
-    const r = await (await cliClient({ allowBoxScope: true })).tasks.postTasksIdPublishBranch({
+    const r = await (await cliClient()).tasks.postTasksIdPublishBranch({
       id: taskId,
       body: { branch, head_sha: headSha, value_summary: valueSummary, bundle_b64: bundleB64 },
     });
-    // task 1002593: ONE definition of "is this a box-scope refusal". This site used
-    // to hand-roll the comparison, which is how it silently died when routes moved
-    // to the object error envelope — `r.data.error` stopped being the bare string
-    // and the branch could never fire. Normalizing here fixed the symptom but left
-    // a SECOND predicate for the same question, and two copies of a predicate are
-    // how one of them gets a fix the other never sees (migration 177 dropping 176's
-    // blocker clause is the same shape). cli-lib's isBoxScope is the one every
-    // other caller already uses; this is the last site that did not.
-    if (isBoxScope(r)) {
-      console.log('  ci-land: this session is BOX-SCOPED — run /builder-reauth (browser, no terminal) to mint a real session, then re-ship. Task stays at confirmed.');
-      return landBailed('this CLI session is box-scoped', '/builder-reauth');
-    }
     if (r.status === 503) {
       console.log('  ci-land: server-mediated push is not configured on the server yet (no GitHub App nor GITHUB_PUSH_TOKEN — operator action, ADR 0055). Task stays at confirmed.');
       return landBailed('server-mediated push is not configured (operator action)', strandCommand(taskId, 'server'));

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.902'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.904'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bongos_dispatch.mjs

@@ -15,7 +15,7 @@ const { VERBS, GDS_DIR, helpText } = bongos;
 const BIN = fileURLToPath(new URL('../bin/bongos.js', import.meta.url));
 
 // The 7 verbs the task's "done when" explicitly requires to dispatch.
-const REQUIRED = ['start', 'claim', 'ship', 'box', 'cost', 'status', 'recall'];
+const REQUIRED = ['start', 'claim', 'ship', 'cost', 'status', 'recall'];
 
 test('every required verb is registered', () => {
   for (const v of REQUIRED) assert.ok(VERBS[v], `missing required verb: ${v}`);
@@ -68,7 +68,7 @@ test('bare `bongos` prints help and exits 0', () => {
   assert.match(r.stdout, /Usage:  bongos/);
 });
 
-test('a prefix-args verb (box) targets the generic api.js caller', () => {
-  assert.equal(VERBS.box.script, 'api.js');
-  assert.deepEqual(VERBS.box.prefixArgs, ['POST', '/api/gds/box/ensure']);
+test('a prefix-args verb (serve) carries the args pinned in front of the user\'s', () => {
+  assert.equal(VERBS.serve.script, 'dev.js');
+  assert.deepEqual(VERBS.serve.prefixArgs, ['--server']);
 });

package/tests/claude_materialize.mjs

@@ -5,7 +5,7 @@
 //   1. bongosify — dedicated verb where one exists (bongos ship), else `bongos exec scripts/gds/<x>.js`;
 //      $CLAUDE_PROJECT_DIR/quotes stripped; args preserved; .claude/hooks/ refs left instance-local;
 //      idempotent.
-//   2. scriptToVerb — excludes prefixArgs verbs so api.js never mis-maps to `bongos box`.
+//   2. scriptToVerb — excludes prefixArgs verbs so dev.js never mis-maps to `bongos serve`.
 //   3. transformSettings — rewrites the scripts/gds hook commands AND permission rules, keeps .claude/hooks/ ones.
 //   4. materializeClaude — copies + transforms skills into a target dir (no leftover node scripts/gds),
 //      writes settings.json, copies hooks; and NO-OPS when the target IS the core root (self-copy guard).

package/tests/cli_package.mjs

@@ -219,9 +219,6 @@ test('the packed tarball installs and every verb runs with no repo present', (t)
     // guidance, still exits 10, so every assertion below is unchanged.
     reauth:  ['reauth', '--no-open'],
     setup:   ['setup'],
-    box:     ['box'],
-    shell:   ['shell'],
-    code:    ['code'],
     start:   ['start'],
     status:  ['status'],
     task:    ['task', 'show', '1'],
@@ -290,7 +287,7 @@ test('the packed tarball installs and every verb runs with no repo present', (t)
     const res = runVerb([verb]);
     const all = `${res.stdout}\n${res.stderr}`;
     assert.match(all, /is not in the public CLI/, `bongos ${verb} must say why it is absent`);
-    assert.match(all, /bongos shell/, `bongos ${verb} must point at a way to get a checkout`);
+    assert.match(all, /checkout of the project repo/, `bongos ${verb} must point at a way to get a checkout`);
     assert.ok(!/unknown command/.test(all), `bongos ${verb} must not read as a typo`);
   }