@bongos/core 1.21.174 → 1.21.176

package/scripts/gds/baseline-staleness.js

@@ -1,217 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/baseline-staleness.js — the freeze-forever detector (task 1003210,
-// goal 1000079; docs/audits/ai-dev-redteam-followup.md §9 item 2).
-//
-// THE PROBLEM. `config/fitness-baselines.json` is a SHRINK-ONLY ratchet: a metric
-// may never exceed its baseline, and lowering one is how debt gets paid down. That
-// makes regression impossible — and makes standing still invisible. The follow-up
-// audit measured the whole file at "every metric equal to baseline, 0 reduced" and
-// named the consequence exactly:
-//
-//     "A shrink-only baseline that never shrinks is indistinguishable from
-//      unmanaged debt."
-//
-// The ratchet is GREEN in that state. It is green in the state where the team is
-// actively paying down, and equally green in the state where nobody has looked in
-// a year. This check separates them by adding the one axis the ratchet has no
-// concept of: TIME.
-//
-// WHY A DECLARED FLOOR IS THE HALF THAT MATTERS. The naive version — "flag every
-// baseline that hasn't moved in N weeks" — fires on metrics that are *finished*.
-// `require_cycle_count: 4` is four deliberate lazy requires with written rationale;
-// `duplicate_window_count` cannot go below ~28 because that much duplication is
-// forced by the module boundary (ADR 0091 §2). Those will never move again, and a
-// check that nags about them weekly is a check everyone learns to skip — the same
-// alert-fatigue failure ADR 0188 §2.4 avoids in the patrol.
-//
-// So a metric may declare a FLOOR with a written reason, and a metric at its floor
-// is DONE, not stale. That converts "this is frozen forever" from silence into an
-// explicit, reviewable claim — which is the actual goal. Silence was the problem.
-//
-// TWO CHECKS, TWO SEVERITIES, ON PURPOSE:
-//
-//   • Floor-declaration rot is HERMETIC and HARD-FAILS. A floor naming a metric
-//     that no longer exists, a floor with no reason, or a floor ABOVE the metric's
-//     current value (the metric improved past the claim and nobody revisited it)
-//     are all defects in the declaration itself — cheap to detect, caused by the
-//     diff at hand, and exactly what a merge gate is for.
-//
-//   • Staleness WARNS, and is filed weekly by the patrol. Age is not a property of
-//     anybody's diff. Hard-failing a PR because ambient debt turned eight weeks old
-//     punishes whoever pushed next and gets the gate disabled. The audit asked for
-//     "the repeatable, SCHEDULED version" of its own manual review, and the patrol
-//     is that: history-wide, time-based, filed for adjudication (ADR 0158 §2).
-//
-// AGE COMES FROM GIT, NOT FROM A STORED TIMESTAMP. A `since:` field in the JSON
-// would be faster and hermetic, and it would also be the thing that silently
-// stops being updated — leaving old debt looking permanently fresh, which is a
-// worse failure than no check at all. Git history cannot be forgotten. When it is
-// unavailable (a shallow clone), this reports DID-NOT-RUN rather than a clean
-// green: the main-audit.js --require-roster doctrine.
-
+// scripts/gds/baseline-staleness.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/baseline-staleness.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { execFileSync } = require('child_process');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-const BASELINE_REL = 'config/fitness-baselines.json';
-
-// Eight weeks. Long enough that a metric someone is actively working is never
-// flagged, short enough that "we'll get to it" cannot quietly become "never".
-const DEFAULT_MAX_AGE_DAYS = Number(process.env.BASELINE_STALE_DAYS) || 56;
-const DAY_MS = 86400000;
-
-// Read the tracked file's value at every commit that touched it, newest first.
-// Committer date, not author date: the question is how long this value has been
-// LANDED, and a rebased author date answers a different one. Returns null when
-// git or the history is unavailable — the caller must treat that as did-not-run.
-function readHistory(rel = BASELINE_REL, { cwd = ROOT, exec = execFileSync } = {}) {
-  let lines;
-  try {
-    lines = exec('git', ['log', '--format=%H|%cI', '--', rel], { cwd, encoding: 'utf8', stdio: 'pipe' })
-      .trim().split('\n').filter(Boolean);
-  } catch (_) {
-    return null;
-  }
-  if (!lines.length) return null;
-  const out = [];
-  for (const line of lines) {
-    const [sha, date] = line.split('|');
-    let parsed;
-    try { parsed = JSON.parse(exec('git', ['show', `${sha}:${rel}`], { cwd, encoding: 'utf8', stdio: 'pipe' })); }
-    catch (_) { continue; } // a commit that deleted/renamed the file — skip, don't guess
-    out.push({ sha, date, metrics: (parsed && parsed.metrics) || {} });
-  }
-  return out.length ? out : null;
-}
-
-// Pure: the ISO date at which each metric's CURRENT value was first set. Walks
-// newest→oldest while the value is unchanged; the oldest commit still carrying it
-// is when it last moved. A metric absent from an older commit was introduced at
-// the one after it, and its introduction date IS its age — a baseline recorded
-// once and never revisited is precisely what this looks for.
-function lastChangedByMetric(history) {
-  const out = {};
-  if (!history || !history.length) return out;
-  for (const [name, value] of Object.entries(history[0].metrics)) {
-    let i = 0;
-    while (i + 1 < history.length && history[i + 1].metrics[name] === value) i += 1;
-    out[name] = history[i].date;
-  }
-  return out;
-}
-
-function ageDays(iso, now) {
-  const t = Date.parse(iso);
-  return Number.isFinite(t) ? (now - t) / DAY_MS : null;
-}
-
-// Pure verdict — exported for the hermetic test.
-//
-// `floors[name]` is `{ value, why }`. An undeclared metric floors at 0, so a
-// metric already at 0 is never stale: it cannot shrink and there is nothing to
-// declare. `lastChanged === null` (no history) is reported as unknown, never as
-// fresh — an unmeasurable age must not read as a passing one.
-function evaluate({ metrics = {}, floors = {}, lastChanged = {}, now = 0, maxAgeDays = DEFAULT_MAX_AGE_DAYS } = {}) {
-  const violations = [];
-  const stale = [];
-  const atFloor = [];  // exempt by a WRITTEN floor claim
-  const atZero = [];   // exempt because there is nothing left to reduce
-
-  for (const [name, spec] of Object.entries(floors)) {
-    if (!(name in metrics)) {
-      violations.push(`floor declared for "${name}", which is not a metric in ${BASELINE_REL} — remove the floor or restore the metric`);
-      continue;
-    }
-    const value = spec && typeof spec === 'object' ? spec.value : spec;
-    const why = spec && typeof spec === 'object' ? spec.why : null;
-    if (!Number.isFinite(value)) {
-      violations.push(`floor for "${name}" has no numeric value — a floor is a claim about what cannot be reduced, so it must be a number`);
-      continue;
-    }
-    if (!why || String(why).trim().length < 20) {
-      violations.push(`floor for "${name}" has no reason — a floor exempts a metric from staleness forever, so it must say WHY it cannot go lower`);
-    }
-    if (metrics[name] < value) {
-      violations.push(`floor for "${name}" is ${value} but the metric is already ${metrics[name]} — the floor was passed and never revisited; lower it to the real limit`);
-    }
-  }
-
-  for (const [name, value] of Object.entries(metrics)) {
-    if (value === null || value === undefined) continue;
-    const spec = floors[name];
-    const floor = spec && typeof spec === 'object' ? spec.value : (Number.isFinite(spec) ? spec : 0);
-    if (value <= floor) { (floor > 0 ? atFloor : atZero).push(name); continue; }
-    const since = lastChanged[name];
-    if (!since) { stale.push({ name, value, floor, days: null, since: null }); continue; }
-    const days = ageDays(since, now);
-    if (days !== null && days > maxAgeDays) stale.push({ name, value, floor, days, since });
-  }
-  return { violations, stale, atFloor, atZero };
-}
-
-function readBaselineFile(rel = BASELINE_REL) {
-  try { return JSON.parse(fs.readFileSync(path.join(ROOT, rel), 'utf8')) || {}; }
-  catch (_) { return {}; }
-}
-
-// One line per stale metric, in the voice the reader needs: what it is, how long
-// it has not moved, and the two legitimate ways out (reduce it, or declare a floor
-// saying why it cannot be reduced). "Do something" beats "something is wrong".
-function describe(s) {
-  const age = s.days === null ? 'age UNKNOWN (no git history here)' : `unchanged for ${Math.floor(s.days)} days`;
-  return `${s.name}=${s.value} ${age}${s.floor ? ` (floor ${s.floor})` : ''} — reduce it, or declare a floor in ${BASELINE_REL} saying why it cannot go lower`;
-}
-
-function run({ now = Date.now(), maxAgeDays = DEFAULT_MAX_AGE_DAYS } = {}) {
-  const file = readBaselineFile();
-  const history = readHistory();
-  const lastChanged = history ? lastChangedByMetric(history) : {};
-  const r = evaluate({ metrics: file.metrics || {}, floors: file.floors || {}, lastChanged, now, maxAgeDays });
-  return { ...r, historyAvailable: history !== null, maxAgeDays };
-}
-
-// The fitness.js check. Hard-fails ONLY on floor-declaration rot (hermetic, caused
-// by the diff at hand); staleness is a warning here and a filed report in the
-// weekly patrol — see the header.
-function checkBaselineFloors() {
-  const r = run();
-  const warnings = r.stale.map(describe);
-  if (!r.historyAvailable) {
-    warnings.push(`baseline age could not be measured — no git history for ${BASELINE_REL} here (shallow clone?). Reported as unknown rather than passing.`);
-  }
-  return {
-    name: 'a shrink-only baseline cannot silently freeze forever (task 1003210)',
-    ok: r.violations.length === 0,
-    hardFail: r.violations.length > 0,
-    violations: r.violations,
-    warnings,
-    note: `${Object.keys(readBaselineFile().metrics || {}).length} baseline(s): ${r.atZero.length} at zero, ${r.atFloor.length} at a declared floor (done), ${r.stale.length} unchanged for >${r.maxAgeDays}d. A floor must name a reason; age comes from git, never a stored timestamp.`,
-  };
-}
-
-// The patrol class (ADR 0188): the SCHEDULED version of the audit's manual review.
-// Severity is low — this is a prompt to look, not a defect. Returns [] when there
-// is nothing to say, so the patrol files no report on a healthy week.
-function stalenessFindings(opts = {}) {
-  const r = run(opts);
-  return r.stale.map((s) => ({ severity: 'low', item: describe(s) }));
-}
-
-function main() {
-  const r = run();
-  for (const v of r.violations) console.error(`✗ ${v}`);
-  for (const w of r.stale.map(describe)) console.warn(`⚠ ${w}`);
-  if (!r.historyAvailable) console.warn('⚠ no git history for the baseline file — age is UNKNOWN, not fresh');
-  console.log(`${r.violations.length ? 'FAIL' : 'PASS'}  ${r.atZero.length} at zero · ${r.atFloor.length} at a declared floor · ${r.stale.length} stale (>${r.maxAgeDays}d)`);
-  process.exit(r.violations.length ? 1 : 0);
-}
-
-if (require.main === module) main();
-
-module.exports = {
-  checkBaselineFloors, stalenessFindings, evaluate, lastChangedByMetric,
-  readHistory, run, describe, DEFAULT_MAX_AGE_DAYS, BASELINE_REL,
-};
+require('../bongos/forwarder.js').forward(module, 'baseline-staleness.js');

package/scripts/gds/bfg-principal-token.js

@@ -1,65 +1,7 @@
 #!/usr/bin/env node
-// Mint (or rotate) a session token for the BFG service principal so the 6C.2
-// routine can authenticate AS the principal to call the cross-builder write
-// endpoint (ADR 0026 §6C). Archon-run, on a box with DATABASE_URL (the droplet).
-//
-// Why a dedicated token (not the operator's Archon session): the write endpoint
-// gates on the EXACT principal identity (system_role='bfg'), and an Archon token
-// is deliberately rejected there. So the routine needs the principal's OWN
-// token. This is the one privileged bootstrap; it lives outside any self-serve
-// route (you must have DB access to run it), which is what keeps "an Archon
-// can't act as the BFG" true.
-//
-// The token is written to ~/.config/otb/bfg-principal.json (0600). The routine
-// reads it and sends `Authorization: Bearer <token>`. Re-running mints a fresh
-// token (the old one keeps working until revoked via /auth/revoke); rotate by
-// re-running then revoking the prior session id.
-//
-//   node scripts/gds/bfg-principal-token.js          # mint + write the file
-//   node scripts/gds/bfg-principal-token.js --print  # also echo the token to stdout
-//
-// NOTE: the write path stays DISABLED until BFG_WRITE_ENABLED=true in the
-// server env (the kill-switch, 6C.1) — minting a token does NOT enable writes.
-
-const crypto = require('node:crypto');
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const { pool } = require('../../src/bongos/pool');
-const { createSession } = require('../../src/bongos/db');
-
-async function main() {
-  const printToken = process.argv.includes('--print');
-  const { rows } = await pool.query(`SELECT id, github_login FROM builders WHERE system_role = 'bfg'`);
-  if (!rows[0]) {
-    console.error("No BFG principal found (system_role='bfg'). Apply migration 065 first, then re-run.");
-    process.exitCode = 1;
-    return;
-  }
-  const principal = rows[0];
-  const token = crypto.randomBytes(32).toString('hex'); // matches the extractToken [a-zA-Z0-9] shape
-  // No-expiry CLI-shaped session (like the operator's CLI token); revocable.
-  await createSession({ builderId: principal.id, token, source: 'cli', userAgent: 'bfg-principal-provision', expiresAt: null });
-
-  const dir = require('../../src/instance-config').configHome();
-  fs.mkdirSync(dir, { recursive: true });
-  const file = path.join(dir, 'bfg-principal.json');
-  fs.writeFileSync(
-    file,
-    JSON.stringify({ token, builder_id: principal.id, github_login: principal.github_login, minted_at: new Date().toISOString() }, null, 2),
-    { mode: 0o600 }
-  );
-  fs.chmodSync(file, 0o600); // ensure 0600 even if the file pre-existed
-
-  console.log(`Minted BFG principal session for builder #${principal.id} (${principal.github_login}).`);
-  console.log(`Wrote ${file} (0600). The 6C.2 routine reads its token from there.`);
-  console.log('Reminder: writes stay OFF until BFG_WRITE_ENABLED=true in the server env (the 6C.1 kill-switch).');
-  if (printToken) console.log(`token: ${token}`);
-}
-
-main()
-  .catch((err) => {
-    console.error('bfg-principal-token failed:', err && err.message ? err.message : err);
-    process.exitCode = 1;
-  })
-  .finally(() => pool.end().catch(() => {}));
+// scripts/gds/bfg-principal-token.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/bfg-principal-token.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'bfg-principal-token.js');

package/scripts/gds/bug-attachment-audit.js

@@ -1,149 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/bug-attachment-audit.js — do the images our task descriptions
-// promise actually exist? (task 1003918)
-//
-// WHY THIS EXISTS. A re-hosted #bugs screenshot is the hardest artefact in this
-// system to get back: the Discord CDN URL it was copied from carries a signature
-// that expires in about a day. The FILE does not expire — Discord keeps it while
-// the message exists, and bug-attachment-recover.js re-fetches it by the message
-// id the filename carries (task 1004667) — but once that message or the channel
-// history is gone, our copy IS the image. They live on disk
-// under var/bug-attachments — outside Postgres, outside git — and nothing
-// noticed when all five this instance had ever stored disappeared in the
-// 2026-07-05 droplet move. The loss surfaced on 2026-09-14, two months later,
-// because somebody happened to open an old bug task and saw a broken image.
-//
-// So: read the descriptions, extract every attachment link they promise, and ask
-// the disk whether it can keep that promise. A count of broken promises is the
-// thing that should have been non-zero and visible in July.
-//
-// Usage:
-//   node scripts/gds/bug-attachment-audit.js          # human report; exit 1 if any are missing
-//   node scripts/gds/bug-attachment-audit.js --json   # { described, present, missing: [...] }
-//   node scripts/gds/bug-attachment-audit.js --line   # one line, or nothing; always exit 0
-//
-// Read-only. It never writes, never deletes, and never touches Discord.
-
+// scripts/gds/bug-attachment-audit.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/bug-attachment-audit.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-// The link shape the bot embeds in a description. Deliberately matched against
-// the SERVE ROUTE's path rather than any filename found on disk: what matters is
-// what a reader will click, and a file nothing links to is not a broken promise.
-const LINK_RE = /\/api\/(?:gds|bongos)\/bug-attachments\/(bug-[a-z0-9]{1,40}-[0-9a-f]{16}\.(?:png|jpg|gif|webp))/gi;
-
-// PURE — every attachment name a body of text promises, deduped, in first-seen
-// order. Exported so the extraction is testable without a database or a disk.
-function describedAttachments(text) {
-  const out = [];
-  const seen = new Set();
-  for (const m of String(text || '').matchAll(LINK_RE)) {
-    const name = m[1];
-    if (!seen.has(name)) { seen.add(name); out.push(name); }
-  }
-  return out;
-}
-
-// PURE — split the promised names into kept and broken, given an existence test.
-// `rows` are { id, title, description }; the result names the TASK for each
-// missing file, because "three files are gone" is not actionable and "the image
-// in task N is gone" is.
-function auditRows(rows, exists) {
-  const described = [];
-  const missing = [];
-  for (const row of rows || []) {
-    for (const name of describedAttachments(row && row.description)) {
-      described.push({ name, taskId: row.id });
-      if (!exists(name)) missing.push({ name, taskId: row.id, title: row.title || '' });
-    }
-  }
-  return { described, missing, present: described.length - missing.length };
-}
-
-// EVERY status, explicitly, and paged. Two ways to get a comfortable zero here,
-// both of which I hit while building this:
-//
-//   - GET /tasks omits abandoned rows unless you ask for them. The five files this
-//     audit exists for are described in tasks that are now abandoned or shipped, so
-//     the obvious query returned '0 linked, 0 missing' — indistinguishable from
-//     'nothing is broken'.
-//   - the route clamps `limit`, so one page is not the table.
-//
-// A probe whose failure mode is a clean bill of health is worse than no probe, so
-// the status list is spelled out rather than defaulted.
-// 'claimed' is not one — claimTask sets status='active' (db-claims.js). Listing it
-// only bought a no-op query, and a comment promising EVERY status should be right.
-const TASK_STATUSES = ['backlog', 'ready', 'active', 'completed', 'confirmed', 'shipped', 'abandoned'];
-
-async function fetchRows() {
-  const { cliClient } = require('./cli-lib');
-  const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../../modules/lifecycle/task-list-limits.js');
-  const api = await cliClient();
-  const byId = new Map();
-  for (const status of TASK_STATUSES) {
-    let offset = 0;
-    for (let page = 0; page < 100; page++) {
-      const q = buildTaskPageQuery({ kind: 'bug', status, limit: TASK_LIST_MAX_LIMIT, offset });
-      const r = await api.tasks.getTasks({ query: q });
-      if (!r || !r.ok) throw new Error(`could not list ${status} tasks (${r && r.status})`);
-      const rows = (r.data && r.data.tasks) || [];
-      for (const t of rows) byId.set(String(t.id), t);
-      // A short page is the end. Compare against the limit the route HONOURED.
-      if (rows.length < q.limit) break;
-      offset += q.limit;
-    }
-  }
-  return [...byId.values()];
-}
-
-async function main() {
-  const argv = process.argv.slice(2);
-  const dir = require('../../modules/discord/bug-attachments.js').attachmentsDir();
-  let rows;
-  try {
-    rows = await fetchRows();
-  } catch (e) {
-    if (argv.includes('--line')) process.exit(0); // a probe never blocks a session
-    console.error(`bug-attachment-audit: undetermined — ${e.message || e}`);
-    process.exit(2);
-  }
-  // Through the serve route's OWN resolver, not a bare path.join. The name pattern
-  // already excludes slashes and dots, and a test pins that '../../etc/passwd' is
-  // never extracted — but the route that actually opens these files defends itself
-  // with a resolved-path prefix check, and a probe that reads the same store should
-  // not hold itself to a weaker rule than the thing it audits.
-  const { resolveSafe } = require('../../modules/discord/bug-attachments.js');
-  const r = auditRows(rows, (name) => {
-    const p = resolveSafe(name);
-    return Boolean(p) && fs.existsSync(p);
-  });
-
-  if (argv.includes('--json')) {
-    console.log(JSON.stringify({ dir, described: r.described.length, present: r.present, missing: r.missing }, null, 2));
-    return;
-  }
-  if (argv.includes('--line')) {
-    if (r.missing.length) {
-      console.log(`Bug attachments: ${r.missing.length} of ${r.described.length} linked screenshot(s) are MISSING from ${dir} `
-        + '— every task describing one renders a broken image. '
-        + 'Try node scripts/gds/bug-attachment-recover.js --missing (it re-fetches from the original Discord message while that message still exists).');
-    }
-    return;
-  }
-  console.log(`  Bug attachments: ${r.described.length} linked, ${r.present} present, ${r.missing.length} missing`);
-  console.log(`  Store: ${dir}`);
-  for (const m of r.missing) console.log(`    missing  ${m.name}  (task ${m.taskId})`);
-  if (r.missing.length) {
-    console.log('  The stored Discord URL has expired, but only its signature: the message usually still holds the file,');
-    console.log('  and each filename carries its message id. Re-fetch them to their original names with:');
-    console.log('    node scripts/gds/bug-attachment-recover.js --missing');
-    console.log('  If the message is gone, restore from a nightly attachments archive: /var/backups/gds/<db>-attachments-*.tar.gz');
-    process.exit(1);
-  }
-}
-
-if (require.main === module) main();
-
-module.exports = { describedAttachments, auditRows, fetchRows, LINK_RE };
+require('../bongos/forwarder.js').forward(module, 'bug-attachment-audit.js');

package/scripts/gds/bug-attachment-recover.js

@@ -1,198 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/bug-attachment-recover.js — re-fetch a lost #bugs screenshot from
-// the Discord message it came from, back to its ORIGINAL filename (task 1004667).
-//
-// WHY THIS EXISTS. We used to say a lost re-hosted screenshot "cannot be
-// re-fetched — the Discord CDN URL has expired". Only the URL's signature
-// (`?ex=&is=&hm=`) expires. Discord keeps the attachment for as long as its
-// message exists, and GET /channels/{channel}/messages/{message} with the bot
-// token hands back a freshly-signed URL. Every stored filename already carries
-// the message id — discord-bot.js passes msg.id into `bug-<id>-<rand>.<ext>`,
-// and a numeric snowflake survives the slug filter unchanged — so every "lost"
-// file is still addressable. That false claim is what steered task 1003980 to
-// "accept the loss" without anyone trying this.
-//
-// The file is written under the name the task description ALREADY links. A
-// fresh random name would store the bytes and leave the task's image broken.
-// The download itself goes through persistImageFromUrl — same host allowlist,
-// redirect re-validation, magic-byte sniff and size cap — with only the target
-// name supplied; there is no second download path here.
-//
-// Usage (on the box that holds the store and the bot token):
-//   node scripts/gds/bug-attachment-recover.js --missing            # every file the audit finds missing
-//   node scripts/gds/bug-attachment-recover.js <message-id>...      # the missing files from those messages
-//   node scripts/gds/bug-attachment-recover.js <filename>...        # exactly these names (no task lookup)
-//   flags: --channel <id>  (default DISCORD_BUGS_CHANNEL_ID, then bugs_channel_id in discord-bot.json)
-//          --dry-run       (say what would be fetched; write nothing)
-//
-// Matching. A message's k-th described file (in the order the task description
-// links them, which is the order the bot stored them) is fetched from that
-// message's k-th image attachment. Never overwrites a file that is present.
-// Exit 0 when everything asked for is recovered (or nothing was missing), 1 when
-// anything could not be, 2 when it could not even start (no token, no channel).
-
+// scripts/gds/bug-attachment-recover.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/bug-attachment-recover.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-
-const DISCORD_API = 'https://discord.com/api/v10';
-// A Discord snowflake: digits only. Checked before either id goes into a URL.
-const SNOWFLAKE_RE = /^\d{15,25}$/;
-const NAME_RE = /^bug-([a-z0-9]{1,40})-[0-9a-f]{16}\.(?:png|jpg|gif|webp)$/;
-
-// PURE — the message id a stored filename carries, or null when the slug is not
-// a snowflake (a name stored with the 'x' fallback, or a hand-made one).
-function messageIdFromName(name) {
-  const m = NAME_RE.exec(String(name || ''));
-  return m && SNOWFLAKE_RE.test(m[1]) ? m[1] : null;
-}
-
-// PURE — group filenames by the message they came from, keeping order within a
-// message (that order is what pairs a name with an attachment). Names with no
-// recoverable message id come back in `unaddressable`.
-function planRecovery(names) {
-  const byMessage = new Map();
-  const unaddressable = [];
-  const seen = new Set();
-  for (const name of names || []) {
-    if (seen.has(name)) continue;
-    seen.add(name);
-    const id = messageIdFromName(name);
-    if (!id) { unaddressable.push(name); continue; }
-    if (!byMessage.has(id)) byMessage.set(id, []);
-    byMessage.get(id).push(name);
-  }
-  return { byMessage, unaddressable };
-}
-
-// PURE — the image attachments of a Discord REST message, in order. The same
-// test the bot applied when it first stored them (discord-bot.js
-// extractImageUrls): an image content type, or a width (Discord sets one only
-// on images). REST returns snake_case `content_type`.
-function imageAttachmentUrls(message) {
-  const out = [];
-  for (const a of (message && message.attachments) || []) {
-    const type = a.content_type || a.contentType || '';
-    if ((type.startsWith('image/') || a.width != null) && a.url) out.push(a.url);
-  }
-  return out;
-}
-
-// Fetch one message and re-host its images under the given names. Returns one
-// { name, ok, reason? } per name; never throws for an expected refusal.
-async function recoverMessage({ channelId, messageId, names, token, fetchImpl = globalThis.fetch, dir, persist }) {
-  if (!SNOWFLAKE_RE.test(String(channelId)) || !SNOWFLAKE_RE.test(String(messageId))) {
-    return names.map((name) => ({ name, ok: false, reason: 'bad_id' }));
-  }
-  let resp;
-  try {
-    resp = await fetchImpl(`${DISCORD_API}/channels/${channelId}/messages/${messageId}`, {
-      headers: { Authorization: `Bot ${token}` },
-    });
-  } catch (e) {
-    return names.map((name) => ({ name, ok: false, reason: 'fetch_failed', error: e.message }));
-  }
-  if (!resp || !resp.ok) {
-    // 404 is the case that ends recovery: the message (or the channel) is gone.
-    const reason = resp && resp.status === 404 ? 'message_gone' : `discord_status_${resp && resp.status}`;
-    return names.map((name) => ({ name, ok: false, reason }));
-  }
-  const urls = imageAttachmentUrls(await resp.json());
-  const results = [];
-  for (let i = 0; i < names.length; i++) {
-    const name = names[i];
-    if (!urls[i]) { results.push({ name, ok: false, reason: 'no_attachment_at_index', index: i, images: urls.length }); continue; }
-    const r = await persist(urls[i], { file: name, fetchImpl, dir });
-    results.push(r.ok ? { name, ok: true, bytes: r.bytes } : { name, ok: false, reason: r.reason });
-  }
-  return results;
-}
-
-function argValue(argv, flag) {
-  const i = argv.indexOf(flag);
-  return i !== -1 && argv[i + 1] ? argv[i + 1] : null;
-}
-
-function loadChannelId(argv) {
-  const flag = argValue(argv, '--channel');
-  if (flag) return flag;
-  if (process.env.DISCORD_BUGS_CHANNEL_ID) return process.env.DISCORD_BUGS_CHANNEL_ID;
-  try {
-    const raw = require('../../src/module-api').readConfigFileSync('discord-bot.json');
-    const cfg = raw ? JSON.parse(raw) : null;
-    if (cfg && cfg.bugs_channel_id) return String(cfg.bugs_channel_id);
-  } catch (_) { /* not configured */ }
-  return null;
-}
-
-async function main() {
-  const argv = process.argv.slice(2);
-  const dryRun = argv.includes('--dry-run');
-  const channelArg = argValue(argv, '--channel');
-  const positional = argv.filter((a) => !a.startsWith('--') && a !== channelArg);
-  const at = require('../../modules/discord/bug-attachments.js');
-
-  // Which names to recover. Explicit filenames need no task lookup; --missing
-  // and message ids need the audit's list of described-but-missing files.
-  let names = positional.filter((a) => NAME_RE.test(a));
-  const ids = positional.filter((a) => SNOWFLAKE_RE.test(a));
-  const junk = positional.filter((a) => !NAME_RE.test(a) && !SNOWFLAKE_RE.test(a));
-  if (junk.length) { console.error(`bug-attachment-recover: not a filename or message id: ${junk.join(', ')}`); process.exitCode = 2; return; }
-  if (argv.includes('--missing') || ids.length) {
-    const audit = require('./bug-attachment-audit.js');
-    const r = audit.auditRows(await audit.fetchRows(), (name) => {
-      const p = at.resolveSafe(name);
-      return Boolean(p) && fs.existsSync(p);
-    });
-    const missing = r.missing.map((m) => m.name);
-    if (argv.includes('--missing')) names.push(...missing);
-    for (const id of ids) {
-      const mine = missing.filter((n) => messageIdFromName(n) === id);
-      if (!mine.length) console.log(`  message ${id}: no missing file names it`);
-      names.push(...mine);
-    }
-  }
-  if (!positional.length && !argv.includes('--missing')) {
-    console.error('usage: bug-attachment-recover.js --missing | <message-id>... | <filename>... [--channel <id>] [--dry-run]');
-    process.exitCode = 2;
-    return;
-  }
-
-  const { byMessage, unaddressable } = planRecovery(names);
-  for (const n of unaddressable) console.log(`  skip     ${n}  (its name carries no Discord message id)`);
-  if (!byMessage.size) {
-    console.log('  Nothing to recover.');
-    if (unaddressable.length) process.exitCode = 1;
-    return;
-  }
-
-  const channelId = loadChannelId(argv);
-  if (!channelId) { console.error('bug-attachment-recover: no #bugs channel id — pass --channel or set DISCORD_BUGS_CHANNEL_ID'); process.exitCode = 2; return; }
-  if (dryRun) {
-    for (const [id, list] of byMessage) for (const n of list) console.log(`  would fetch  ${n}  from message ${id} in channel ${channelId}`);
-    return;
-  }
-  const token = require('../../modules/discord/auth.js').loadDiscordBotToken();
-  if (!token) { console.error('bug-attachment-recover: no Discord bot token on this box (DISCORD_BOT_TOKEN or discord-bot.json)'); process.exitCode = 2; return; }
-
-  let failed = unaddressable.length;
-  for (const [messageId, list] of byMessage) {
-    // Present files are left alone: a re-run after a partial recovery only
-    // fetches what is still missing.
-    const todo = list.filter((n) => { const p = at.resolveSafe(n); return !(p && fs.existsSync(p)); });
-    for (const n of list) if (!todo.includes(n)) console.log(`  present  ${n}`);
-    if (!todo.length) continue;
-    const results = await recoverMessage({ channelId, messageId, names: todo, token, persist: at.persistImageFromUrl });
-    for (const r of results) {
-      if (r.ok) console.log(`  restored ${r.name}  (${r.bytes} bytes)`);
-      else { failed++; console.log(`  FAILED   ${r.name}  (${r.reason})`); }
-    }
-  }
-  if (failed) process.exitCode = 1;
-}
-
-if (require.main === module) {
-  main().catch((e) => { console.error(`bug-attachment-recover: ${e.message || e}`); process.exitCode = 2; });
-}
-
-module.exports = { messageIdFromName, planRecovery, imageAttachmentUrls, recoverMessage, SNOWFLAKE_RE };
+require('../bongos/forwarder.js').forward(module, 'bug-attachment-recover.js');