@bongos/core 1.21.174 → 1.21.176

package/scripts/bongos/push-path-brief.js

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+'use strict';
+//
+// scripts/bongos/push-path-brief.js — say out loud, at session start, that this machine
+// cannot push (task 1003259 / idea 1000838).
+//
+// THE GAP. On 2026-08-24 an agent on a credential-less checkout hit auth failures on
+// every raw git probe, concluded "no push credential exists", and asked the owner to
+// mint a fine-grained PAT and store it in ~/.git-credentials — the exact anti-pattern
+// the server-mediated publish path (ADR 0055) exists to avoid. The agent was not being
+// careless: on that checkout every direct GitHub probe failed BY DESIGN (the
+// clone token was one-shot and scrubbed from .git/config after each fetch — ADR 0031 §6),
+// so "missing credential" is the only story the local evidence supports, and the true
+// state at the time (branch already pushed, PR open, CI red) was invisible to it.
+// Nothing the session loads says the model out loud. This says it out loud.
+//
+// SO: the third SessionStart truth-teller, beside deploy-divergence.js and
+// strand-watch.js. On the server-publish path (pushVia() 'server' — no authenticated
+// gh, i.e. any credential-less checkout) it prints ONE line stating the
+// credential model and where the truth about published work lives
+// (GET /api/bongos/tasks/:id/publish-status). On a laptop that pushes locally
+// (pushVia() 'local') it prints NOTHING — a line that fires on every healthy laptop
+// becomes wallpaper and the real one gets scrolled past (the strand-watch lesson).
+//
+// STATIC TEXT ONLY. Nothing builder-authored is interpolated, so this adds no
+// prompt-injection surface (the same trust-boundary rule as strand-watch's
+// no-titles) — the test pins the line to the exported constant.
+//
+// Usage:
+//   node scripts/bongos/push-path-brief.js          # human-readable: which path + why
+//   node scripts/bongos/push-path-brief.js --line   # ONE line or nothing; always exit 0
+//
+// Detection override (tests / forcing): <PREFIX>_PUSH_VIA_SERVER=1 (server) / =0 (local)
+// — BONGOS_PUSH_VIA_SERVER on a vanilla instance; the legacy OTB_ spelling is still read.
+
+const { hasFlag } = require('./cli-lib');
+const { plainCardLines } = require('./plain-cards');
+
+// ---- pure core ---------------------------------------------------------------
+
+const BRIEF = 'This machine holds NO GitHub push credential — BY DESIGN (ADR 0031 §6 / ADR 0055): '
+  + 'git push / ls-remote / fetch against origin fail with auth errors here, and that is not a fault to fix. '
+  + 'Landing is server-mediated — /builder-ship uploads a git bundle and the SERVER pushes, opens the PR, and lands it. '
+  + 'NEVER ask the owner for a PAT or credential; that request is always wrong on this machine. '
+  + 'To see whether work reached GitHub, use GET /api/bongos/tasks/:id/publish-status — never raw git probes. '
+  + 'When a PR is red, that response names the failing tests in merge_driver.failing_tests; '
+  + 'checks_unreadable: true means the check list is blind here, so re-pushing unchanged work cannot help — '
+  + 'run the named test (or npm test) locally, fix it, then ship again.';
+
+// briefLine(via) — the unit-testable core: the SessionStart line for this publish
+// path, or null. Null IS the silence (the laptop case, and the undetermined case —
+// a detection failure must not manufacture a warning).
+function briefLine(via) {
+  return via === 'server' ? BRIEF : null;
+}
+
+// ---- detection ---------------------------------------------------------------
+
+// Lazy require so a broken or partial checkout degrades to silence, not a stack
+// trace injected into the session. pushVia() honors <PREFIX>_PUSH_VIA_SERVER, else
+// probes for an authenticated gh (absent on a credential-less checkout → 'server' instantly).
+function detectVia() {
+  return require('./ship-deploy-target.js').pushVia();
+}
+
+// ---- rendering ---------------------------------------------------------------
+
+function report(via) {
+  console.log('');
+  console.log('  Publish path');
+  console.log('  ──────────────────────────────────────────────────────────');
+  if (via === 'server') {
+    console.log('  server-mediated (no authenticated gh — a credential-less checkout).');
+    console.log(`  ${BRIEF}`);
+    for (const line of plainCardLines('no_push_credential')) console.log(line);
+  } else if (via === 'local') {
+    console.log('  local — this machine pushes with its own git + gh credentials.');
+  } else {
+    console.log('  undetermined — could not probe the publish path on this machine.');
+  }
+  console.log('');
+}
+
+function main() {
+  let via = null;
+  try { via = detectVia(); } catch (_) { via = null; }
+  if (hasFlag('--line')) {
+    // FAIL-OPEN, like the other SessionStart lines: silence on 'local' and on any
+    // detection failure; never a nonzero exit on the path every session rides in on.
+    const l = briefLine(via);
+    if (l) console.log(l);
+    process.exitCode = 0;
+    return;
+  }
+  report(via);
+}
+
+module.exports = { briefLine, BRIEF };
+
+if (require.main === module) main();

package/scripts/bongos/read-session-export.js

@@ -0,0 +1,359 @@
+#!/usr/bin/env node
+// read-session-export.js — READ a Claude Code `/export` zip, fast.
+//
+// Claude Code's built-in `/export` already produces the zip. This does NOT make
+// another one — it READS the existing one: it cracks the zip, finds the single
+// transcript file (the format is identical every time), and prints a compact,
+// skimmable conversation — your prompts, Claude's THINKING ("the thoughts"),
+// its replies, and one-line tool calls — straight to stdout for the session to
+// read. The ~30 `logs/*.log` debug files (tens of MB) are ignored.
+//
+// The point is reading effectively and swiftly, so the output is trimmed for
+// comprehension, not archived to a file. Thoughts and replies print in full;
+// tool results are clipped (use --full to loosen).
+//
+// Zero dependencies: a tiny ZIP reader on the Node `zlib` stdlib.
+//
+// Usage:
+//   node scripts/bongos/read-session-export.js <export.zip>     # read it
+//   node scripts/bongos/read-session-export.js --latest         # newest in ~/Downloads
+//   node scripts/bongos/read-session-export.js <zip> --thoughts # just the thinking
+//   node scripts/bongos/read-session-export.js <zip> --meta     # header summary only
+//   node scripts/bongos/read-session-export.js <zip> --full     # don't clip tool results
+//
+// Exit codes: 0 ok · 1 runtime/IO error · 2 bad invocation
+
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const zlib = require('node:zlib');
+
+// ───────────────────────── minimal ZIP reader (stdlib only) ─────────────────
+// Random-access via fd: find the end-of-central-directory in the tail, read the
+// central directory for entry sizes/offsets (so we're safe against data-
+// descriptor entries), then inflate only the few entries we actually read —
+// never the giant logs/*.log.
+
+const SIG_EOCD = 0x06054b50;
+const SIG_CEN = 0x02014b50;
+const SIG_LOC = 0x04034b50;
+
+function readFull(fd, buf, position) {
+  let off = 0;
+  while (off < buf.length) {
+    const n = fs.readSync(fd, buf, off, buf.length - off, position + off);
+    if (n === 0) break;
+    off += n;
+  }
+  return off;
+}
+
+function openZip(filePath) {
+  const fd = fs.openSync(filePath, 'r');
+  try {
+    const size = fs.fstatSync(fd).size;
+    const tailLen = Math.min(size, 65557); // max EOCD comment (65535) + 22
+    const tail = Buffer.alloc(tailLen);
+    readFull(fd, tail, size - tailLen);
+    let eocd = -1;
+    for (let i = tail.length - 22; i >= 0; i--) {
+      if (tail.readUInt32LE(i) === SIG_EOCD) { eocd = i; break; }
+    }
+    if (eocd < 0) throw new Error('not a zip archive (no end-of-central-directory record)');
+    const cdEntries = tail.readUInt16LE(eocd + 10);
+    const cdSize = tail.readUInt32LE(eocd + 12);
+    const cdOffset = tail.readUInt32LE(eocd + 16);
+    if (cdOffset === 0xffffffff || cdSize === 0xffffffff || cdEntries === 0xffff) {
+      throw new Error('ZIP64 archives are not supported');
+    }
+    const cd = Buffer.alloc(cdSize);
+    readFull(fd, cd, cdOffset);
+    const entries = [];
+    let p = 0;
+    for (let n = 0; n < cdEntries && p + 46 <= cd.length; n++) {
+      if (cd.readUInt32LE(p) !== SIG_CEN) break;
+      const method = cd.readUInt16LE(p + 10);
+      const nameLen = cd.readUInt16LE(p + 28);
+      const extraLen = cd.readUInt16LE(p + 30);
+      const commentLen = cd.readUInt16LE(p + 32);
+      const localOffset = cd.readUInt32LE(p + 42);
+      const compSize = cd.readUInt32LE(p + 20);
+      const name = cd.toString('utf8', p + 46, p + 46 + nameLen);
+      entries.push({ name, method, compSize, localOffset });
+      p += 46 + nameLen + extraLen + commentLen;
+    }
+    return { fd, entries };
+  } catch (err) {
+    fs.closeSync(fd);
+    throw err;
+  }
+}
+
+function readEntry(fd, entry) {
+  const lh = Buffer.alloc(30);
+  readFull(fd, lh, entry.localOffset);
+  if (lh.readUInt32LE(0) !== SIG_LOC) throw new Error(`bad local header for ${entry.name}`);
+  const nameLen = lh.readUInt16LE(26);
+  const extraLen = lh.readUInt16LE(28);
+  const dataOffset = entry.localOffset + 30 + nameLen + extraLen;
+  const comp = Buffer.alloc(entry.compSize);
+  readFull(fd, comp, dataOffset);
+  if (entry.method === 0) return comp;
+  if (entry.method === 8) return zlib.inflateRawSync(comp);
+  throw new Error(`unsupported compression method ${entry.method}`);
+}
+
+// ───────────────────────── the constant export layout ──────────────────────
+// A `/export` zip is the same shape every time:
+//   metadata.json                       — model, effort, title, cwd, dates
+//   <cliSessionId>.jsonl                — THE transcript (one JSON record/line)
+//   <cliSessionId>/subagents/agent-*.jsonl(+.meta.json)  — subagent transcripts
+//   <cliSessionId>/tool-results/*.txt   — tool outputs too big to inline
+//   logs/*.log                          — app debug logs (ignored)
+
+function loadExport(zipPath) {
+  const { fd, entries } = openZip(zipPath);
+  try {
+    const byName = new Map(entries.map((e) => [e.name, e]));
+    const readText = (e) => readEntry(fd, e).toString('utf8');
+
+    let metadata = {};
+    if (byName.has('metadata.json')) {
+      try { metadata = JSON.parse(readText(byName.get('metadata.json'))); } catch { /* tolerate */ }
+    }
+
+    const topJsonl = entries.filter((e) => e.name.endsWith('.jsonl') && !e.name.includes('/'));
+    const mainEntry = (metadata.cliSessionId && byName.get(`${metadata.cliSessionId}.jsonl`)) || topJsonl[0];
+    if (!mainEntry) throw new Error('no transcript (.jsonl) found in this zip');
+    const records = parseJsonl(readText(mainEntry));
+
+    const subagents = [];
+    for (const e of entries) {
+      if (/\/subagents\/agent-[^/]+\.jsonl$/.test(e.name)) {
+        const metaName = e.name.replace(/\.jsonl$/, '.meta.json');
+        let meta = {};
+        if (byName.has(metaName)) { try { meta = JSON.parse(readText(byName.get(metaName))); } catch { /* tolerate */ } }
+        subagents.push({ meta, records: parseJsonl(readText(e)) });
+      }
+    }
+    const logCount = entries.filter((e) => e.name.startsWith('logs/')).length;
+    return { metadata, records, subagents, logCount };
+  } finally {
+    fs.closeSync(fd); // the reader holds nothing open — everything is in memory now
+  }
+}
+
+function parseJsonl(text) {
+  const out = [];
+  for (const line of text.split('\n')) {
+    const s = line.trim();
+    if (!s) continue;
+    try { out.push(JSON.parse(s)); } catch { /* skip a malformed line */ }
+  }
+  return out;
+}
+
+// ──────────────────────── transcript reduction ─────────────────────────────
+// Reduce raw records to readable turns: user prompts, and assistant turns whose
+// blocks are thinking / text / tool (with the tool's result attached by id).
+// Tool-result-carrier user records are folded into their tool call, not shown
+// as turns. system/queue/last-prompt records are dropped (noise).
+
+function reduce(records) {
+  const toolResults = new Map();
+  for (const r of records) {
+    const c = r.type === 'user' && r.message && r.message.content;
+    if (Array.isArray(c)) {
+      for (const b of c) {
+        if (b && b.type === 'tool_result') toolResults.set(b.tool_use_id, { text: flatten(b.content), isError: !!b.is_error });
+      }
+    }
+  }
+
+  const turns = [];
+  let visible = 0, redacted = 0, tools = 0, prompts = 0;
+  for (const r of records) {
+    if (r.type === 'user') {
+      const c = r.message && r.message.content;
+      if (Array.isArray(c) && c.some((b) => b && b.type === 'tool_result')) continue; // carrier
+      prompts++;
+      turns.push({ role: 'user', text: typeof c === 'string' ? c : flatten(c) });
+    } else if (r.type === 'attachment') {
+      const a = r.attachment || {};
+      turns.push({ role: 'attachment', label: a.fileName || a.name || a.path || a.type || 'attachment' });
+    } else if (r.type === 'assistant') {
+      const blocks = [];
+      for (const b of (r.message && r.message.content) || []) {
+        if (!b || typeof b !== 'object') continue;
+        if (b.type === 'thinking') {
+          if ((b.thinking || '').trim()) { visible++; blocks.push({ k: 'think', text: b.thinking.trim() }); }
+          else { redacted++; blocks.push({ k: 'think_redacted' }); }
+        } else if (b.type === 'redacted_thinking') {
+          redacted++; blocks.push({ k: 'think_redacted' });
+        } else if (b.type === 'text') {
+          if ((b.text || '').trim()) blocks.push({ k: 'text', text: b.text.trim() });
+        } else if (b.type === 'tool_use') {
+          tools++;
+          const res = toolResults.get(b.id);
+          blocks.push({ k: 'tool', name: b.name, input: b.input, result: res ? res.text : null, isError: res ? res.isError : false });
+        }
+      }
+      // Merge into the previous assistant turn — Claude Code streams each block
+      // (think / text / tool) as its own record, so one reply spans several.
+      const last = turns[turns.length - 1];
+      if (last && last.role === 'assistant') last.blocks.push(...blocks);
+      else turns.push({ role: 'assistant', blocks });
+    }
+  }
+  return { turns, stats: { prompts, visible, redacted, tools } };
+}
+
+function flatten(content) {
+  if (typeof content === 'string') return content;
+  if (Array.isArray(content)) return content.map((b) => (typeof b === 'string' ? b : (b && b.text) || '')).join('\n');
+  return content == null ? '' : String(content);
+}
+
+// ──────────────────────────── compact rendering ────────────────────────────
+
+function clip(s, max) {
+  s = (s == null ? '' : String(s)).replace(/\s+$/, '');
+  if (s.length <= max) return s;
+  return `${s.slice(0, max).replace(/\s+\S*$/, '')} … (+${s.length - max} chars)`;
+}
+
+function oneLineInput(name, input) {
+  if (input == null) return '';
+  if (name === 'Bash' && input.command) return '`' + clip(input.command.replace(/\n/g, ' '), 140) + '`';
+  if (input.file_path) return input.file_path;
+  if (input.path) return input.path;
+  if (input.pattern) return `/${input.pattern}/`;
+  if (input.query) return clip(String(input.query), 100);
+  if (input.description) return input.description;
+  const keys = Object.keys(input);
+  return keys.length ? clip(keys.map((k) => `${k}=${JSON.stringify(input[k])}`).join(' '), 120) : '';
+}
+
+function isoOr(ms) {
+  if (!ms && ms !== 0) return '?';
+  try { return new Date(ms).toISOString().slice(0, 16).replace('T', ' '); } catch { return '?'; }
+}
+
+function renderTurns(turns, opts, out, prefix = '') {
+  const resultCap = opts.full ? 4000 : 200;
+  for (const turn of turns) {
+    if (opts.thoughtsOnly && turn.role !== 'assistant') continue;
+
+    if (turn.role === 'user') {
+      out.push(`\n${prefix}## 👤 You`);
+      out.push(`${prefix}${clip(turn.text, 4000) || '_(empty)_'}`);
+    } else if (turn.role === 'attachment') {
+      if (!opts.thoughtsOnly) out.push(`${prefix}📎 _attachment: ${turn.label}_`);
+    } else if (turn.role === 'assistant') {
+      // Redacted thinking adds no readable signal per-block — the header already
+      // reports the count + an all-redacted banner — so it's dropped from the
+      // body to keep the read clean. The reasoning you CAN see is the text + the
+      // tool sequence, which is exactly what we surface.
+      const blocks = (opts.thoughtsOnly
+        ? turn.blocks.filter((b) => b.k === 'think')
+        : turn.blocks).filter((b) => b.k !== 'think_redacted');
+      if (!blocks.length) continue;
+      out.push(`\n${prefix}## 🤖 Claude`);
+      for (const b of blocks) {
+        if (b.k === 'think') { out.push(`\n${prefix}💭 **Thinking**`); out.push(`${prefix}${b.text.replace(/\n/g, `\n${prefix}`)}`); }
+        else if (b.k === 'text') { out.push(`\n${prefix}${b.text.replace(/\n/g, `\n${prefix}`)}`); }
+        else if (b.k === 'tool') {
+          const inp = oneLineInput(b.name, b.input);
+          out.push(`${prefix}🔧 \`${b.name}\`${inp ? ` ${inp}` : ''}${b.isError ? '  ⚠️' : ''}`);
+          if (b.result != null && !opts.thoughtsOnly) {
+            const r = clip(b.result.replace(/^\s+/, ''), resultCap).replace(/\n/g, `\n${prefix}   `);
+            if (r) out.push(`${prefix}   ↳ ${r}`);
+          }
+        }
+      }
+    }
+  }
+}
+
+function render(data, opts) {
+  const m = data.metadata || {};
+  const { turns, stats } = reduce(data.records);
+  const out = [];
+
+  out.push(`# 📄 ${m.title || 'Session'}`);
+  out.push(`${m.model || '?'}${m.effort ? ` · ${m.effort}` : ''} · ${isoOr(m.createdAt)} → ${isoOr(m.lastActivityAt)}`);
+  if (m.cwd) out.push(`cwd: \`${m.cwd}\`${m.branch ? ` · branch \`${m.branch}\`` : ''}`);
+  out.push(`${stats.prompts} prompts · 💭 ${stats.visible} thoughts${stats.redacted ? ` (+${stats.redacted} redacted)` : ''} · 🔧 ${stats.tools} tool calls · ${data.subagents.length} subagents · ${data.logCount} app-logs ignored`);
+  if (stats.visible === 0 && stats.redacted > 0) {
+    out.push(`\n> ⚠️ All thinking in this session is **redacted** — this was an Opus session, and Opus exports carry only encrypted reasoning, not the plaintext thoughts. (Sonnet sessions export readable thinking.)`);
+  }
+
+  if (opts.meta) { process.stdout.write(out.join('\n') + '\n'); return; }
+
+  renderTurns(turns, opts, out);
+
+  for (const sa of data.subagents) {
+    out.push(`\n---\n\n# ⤷ Subagent: ${sa.meta.agentType || 'agent'}${sa.meta.description ? ` — ${sa.meta.description}` : ''}`);
+    const sub = reduce(sa.records);
+    renderTurns(sub.turns, opts, out, '> ');
+  }
+
+  process.stdout.write(out.join('\n') + '\n');
+}
+
+// ───────────────────────────────── CLI ─────────────────────────────────────
+
+function findLatest(dir) {
+  const d = dir || path.join(os.homedir(), 'Downloads');
+  let files;
+  try { files = fs.readdirSync(d); } catch { throw { code: 1, msg: `cannot read directory: ${d}` }; }
+  const cands = files.filter((f) => /^session-export-.*\.zip$/i.test(f))
+    .map((f) => ({ p: path.join(d, f), m: fs.statSync(path.join(d, f)).mtimeMs }))
+    .sort((a, b) => b.m - a.m);
+  if (!cands.length) throw { code: 1, msg: `no session-export-*.zip in ${d}` };
+  return cands[0].p;
+}
+
+const HELP = `read-session-export — read a Claude Code /export zip, fast (the format is the same every time)
+
+  node scripts/bongos/read-session-export.js <export.zip>   read it (compact transcript → stdout)
+  node scripts/bongos/read-session-export.js --latest       newest session-export-*.zip in ~/Downloads
+  --thoughts   only the thinking blocks (fast reasoning skim)
+  --meta       header summary only (model, dates, counts)
+  --full       don't clip tool results
+  --latest [dir]   pick the newest export in dir (default ~/Downloads)`;
+
+function main() {
+  const argv = process.argv.slice(2);
+  const opts = { zip: null, thoughtsOnly: false, meta: false, full: false, latest: false, latestDir: null };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '-h' || a === '--help') { console.log(HELP); return; }
+    else if (a === '--thoughts') opts.thoughtsOnly = true;
+    else if (a === '--meta') opts.meta = true;
+    else if (a === '--full') opts.full = true;
+    else if (a === '--latest') { opts.latest = true; if (argv[i + 1] && !argv[i + 1].startsWith('-')) opts.latestDir = argv[++i]; }
+    else if (a.startsWith('-')) { console.error(`✖ unknown option: ${a}\n\n${HELP}`); process.exit(2); }
+    else opts.zip = a;
+  }
+
+  let zipPath = opts.zip;
+  try { if (opts.latest) zipPath = findLatest(opts.latestDir); }
+  catch (e) { console.error(`✖ ${e.msg || e.message}`); process.exit(e.code || 1); }
+  if (!zipPath) { console.error(`✖ no zip given. Pass a path, or use --latest.\n\n${HELP}`); process.exit(2); }
+  zipPath = path.resolve(zipPath);
+  if (!fs.existsSync(zipPath)) { console.error(`✖ file not found: ${zipPath}`); process.exit(1); }
+
+  try {
+    render(loadExport(zipPath), opts);
+  } catch (e) {
+    console.error(`✖ ${e.message}`);
+    process.exit(1);
+  }
+}
+
+if (require.main === module) main();
+
+module.exports = { loadExport, reduce, render, openZip, readEntry };

package/scripts/bongos/reauth.js

@@ -0,0 +1,155 @@
+#!/usr/bin/env node
+// scripts/bongos/reauth.js — #504.
+//
+// The fast, UI-first path to refresh an expired/invalid GDS CLI session.
+//
+// Why this exists: a CLI session can stop working — revoked from the hall's
+// "Sign out everywhere", swept by a demotion, or invalidated by an auth-changing
+// deploy. (It no longer stops working from mere disuse: ADR 0294 removed the idle
+// expiry, because the timer only ever signed out the legitimate holder while
+// refresh-on-use kept a thief's copy alive.) Whatever killed it, the friction of
+// getting back in — the slow Device Flow, terminal codes, Gemini-key prompts — is
+// not something to keep. This script is the fix:
+//
+//   1. Detect — is the current session still valid? (GET /api/bongos/me)
+//        valid   → print who you are + exit 0. Nothing to do.
+//        invalid → exit 10 ("re-auth needed") after opening the browser.
+//   2. Guide — open the builder's Settings page in the default browser (where
+//      the builder is already signed in via the httpOnly cookie) and print the
+//      exact click-path: Settings → CLI Access → Re-issue CLI token → Copy.
+//      The page hands back a one-liner: `bongos paste-token
+//      <token>`. The builder pastes that one line back into Claude; the
+//      /builder-reauth skill runs it (paste-token.js verifies + writes safely).
+//
+// This script never touches the session file itself — paste-token.js owns the
+// write (and its verify-before-write safety contract). reauth.js is detect +
+// open + instruct only, so a failed re-auth can never corrupt a good session.
+//
+// Honors Lars's UI-first rule as far as guided-paste allows: browser clicks +
+// a single copy/paste, no Device-Flow code entry. (A true zero-paste loopback
+// flow is a deferred follow-up.)
+//
+// Usage:
+//   node scripts/bongos/reauth.js            # detect; if invalid, open Settings + guide
+//   node scripts/bongos/reauth.js --no-open  # detect + guide, but don't open browser
+//
+// Exit codes:
+//   0  — session is valid (no re-auth needed)
+//   10 — re-auth needed (browser opened, instructions printed)
+//   2  — could not reach the API to check (network); guidance still printed
+
+const { spawn } = require('node:child_process');
+const lib = require('./cli-lib');
+
+// lib.API_BASE is session-aware (task 1002427), so both URLs name the instance the
+// builder is actually signed into — not this checkout's branding default, which is
+// what sent a cloudbongos.com builder to a localhost:3000 click-path.
+const HALL_URL = `${lib.API_BASE}/builders`;
+// The "Re-issue CLI token" button lives on the Settings page (under "CLI
+// Access"), not the hall profile — open the builder right where the button is.
+const SETTINGS_URL = `${lib.API_BASE}/builders/settings`;
+
+function openInBrowser(url) {
+  // Best-effort. We never fail the run if the browser can't be launched — the
+  // builder can always open the URL by hand (we print it either way).
+  let cmd, args;
+  switch (process.platform) {
+    case 'darwin':
+      cmd = 'open';
+      args = [url];
+      break;
+    case 'win32':
+      // rundll32's FileProtocolHandler opens a URL without going through a
+      // shell, so (unlike `cmd /c start`) shell metacharacters in the URL are
+      // never interpreted. This is now load-bearing, not hypothetical: since
+      // task 1002427 the URL derives from the session file's api_base (via the
+      // session-aware lib.API_BASE), not from a bare env/branding constant. That
+      // file is the builder's own 0600 config, but it IS file-derived input.
+      cmd = 'rundll32';
+      args = ['url.dll,FileProtocolHandler', url];
+      break;
+    default:
+      cmd = 'xdg-open';
+      args = [url];
+      break;
+  }
+  try {
+    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => {}); // swallow ENOENT etc.
+    child.unref();
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+function printGuidance({ opened }) {
+  console.log('');
+  console.log('Refresh your GDS CLI session (UI-first — no Device Flow):');
+  console.log('');
+  // We can't reliably know if the browser actually launched — spawn() reports
+  // a missing-binary error asynchronously, after this prints. So we never claim
+  // success; we say we tried, and always show the URL so no one is stranded.
+  console.log(`  1. ${opened ? 'Opening (or open)' : 'Open'} your Settings page:`);
+  console.log(`       ${SETTINGS_URL}`);
+  console.log("       (if it didn't open, paste that URL into your browser —");
+  console.log("        you're already signed in there via your browser cookie)");
+  console.log('  2. Under the "CLI Access" section, click "Re-issue CLI token".');
+  console.log('  3. Click "Copy" — it copies a one-line command that looks like:');
+  console.log('       npx bongos paste-token <token>');
+  console.log('  4. Paste that one line back to Claude. It will run it for you,');
+  console.log('     verify the token, and write your new session.');
+  console.log('');
+  console.log('  If the page says you are not signed in, sign in at the builders\'');
+  console.log(`  hall first (${HALL_URL}), then return to Settings and click Re-issue.`);
+  console.log('  Fallback (terminal Device Flow): node scripts/bongos/setup.js --force');
+  console.log('');
+}
+
+async function main() {
+  const noOpen = process.argv.includes('--no-open');
+
+  const session = await lib.loadSession();
+  if (!session || !session.token) {
+    console.log('No GDS CLI session found on this machine.');
+    const opened = noOpen ? false : openInBrowser(SETTINGS_URL);
+    printGuidance({ opened });
+    process.exit(10);
+  }
+
+  // Detect: is the existing token still valid? /me is the canonical check
+  // (same endpoint paste-token.js and doctor.js use). allowUnauthenticated so
+  // a 401 returns here instead of triggering cli-lib's exit-with-guidance.
+  let res;
+  try {
+    const api = await lib.cliClient({ allowUnauthenticated: true });
+    res = await api.me.getMe();
+  } catch (err) {
+    console.error(`Could not reach ${lib.API_BASE} to check your session: ${err.message}`);
+    const opened = noOpen ? false : openInBrowser(SETTINGS_URL);
+    printGuidance({ opened });
+    process.exit(2);
+  }
+
+  if (res.ok) {
+    const b = (res.data && res.data.builder) || {};
+    console.log(`Your GDS CLI session is valid — no re-auth needed.`);
+    console.log(`  Signed in as ${b.github_login || '?'}${b.rank ? ` (rank: ${b.rank})` : ''}.`);
+    console.log('  (CLI sessions do not expire — they last until revoked. Kill one from');
+    console.log('   Settings → Active sessions, or "Sign out everywhere".)');
+    process.exit(0);
+  }
+
+  // 401 / 403 / anything not-ok → treat as "needs re-auth".
+  console.log('Your GDS CLI session is no longer valid (expired or revoked).');
+  const opened = noOpen ? false : openInBrowser(SETTINGS_URL);
+  printGuidance({ opened });
+  process.exit(10);
+}
+
+main().catch((err) => {
+  console.error('reauth failed:', err && err.message ? err.message : err);
+  // Still print the manual path so the builder isn't stranded.
+  printGuidance({ opened: false });
+  process.exit(2);
+});