@bongos/core 1.21.174 → 1.21.176

package/tests/cli_sessions.mjs

@@ -26,7 +26,7 @@ import { spawnSync } from 'node:child_process';
 const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 const require = createRequire(import.meta.url);
 const ic  = require(path.join(REPO_ROOT, 'src', 'instance-config.js'));
-const lib = require(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'));
+const lib = require(path.join(REPO_ROOT, 'scripts', 'bongos', 'cli-lib.js'));
 
 // SESSION_PATH is frozen at module load from os.homedir(), so anything touching the real save path
 // runs in a child with its own home directory.
@@ -97,7 +97,7 @@ function inSandbox(body) {
           + ' — this platform does not take the home override, and writing here would clobber the real session store.');
         process.exit(2);
       }
-      const lib=require(R+'/scripts/gds/cli-lib.js');
+      const lib=require(R+'/scripts/bongos/cli-lib.js');
       const ic=require(R+'/src/instance-config.js');
       const fs=require('node:fs'), path=require('node:path');
       (async()=>{ ${body} })().catch((e)=>{ console.error('ERR '+e.message); process.exit(1); });`;
@@ -136,7 +136,7 @@ test('the store anchor is FIXED, not brand-derived — that is the whole fix', (
   // A brand-derived anchor is what split in-repo from standalone in the first place. If someone
   // "helpfully" routes this through configHome() again, the two diverge and the bug is back.
   assert.equal(lib.sessionStoreDir(), path.join(os.homedir(), '.config', ic.FALLBACK_DIR, 'instances'));
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'), 'utf8');
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'cli-lib.js'), 'utf8');
   const body = src.slice(src.indexOf('function sessionStoreDir()'));
   const fn = body.slice(0, body.indexOf('\n}') + 2);
   assert.ok(!/configHome|configDirName|safeBrand/.test(fn), `sessionStoreDir must not read the brand:\n${fn}`);
@@ -255,7 +255,7 @@ test('a corrupt store entry is skipped, never fatal', () => {
 // ── 3. Switching back ───────────────────────────────────────────────────────────────────────
 
 test('login VERIFIES a stored token before trusting it, and can be forced past', () => {
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'login.js'), 'utf8');
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'login.js'), 'utf8');
   // A stored token may be expired or revoked. Reinstating one unchecked would leave the builder
   // "signed in" to a session every later command then fails on.
   assert.match(src, /loadStoredSession\(base\)/);
@@ -265,7 +265,7 @@ test('login VERIFIES a stored token before trusting it, and can be forced past',
 });
 
 test('login names the other instances and how to move between them', () => {
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'login.js'), 'utf8');
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'login.js'), 'utf8');
   assert.match(src, /function logOtherInstances/);
   assert.match(src, /Also signed in to/);
   // Terminal reader: no slash command may appear in that guidance (task 1003730's rule).

package/tests/cli_surface.mjs

@@ -17,7 +17,7 @@ import { createRequire } from 'node:module';
 
 const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 const require = createRequire(import.meta.url);
-const surface = require(path.join(REPO_ROOT, 'scripts', 'gds', 'surface.js'));
+const surface = require(path.join(REPO_ROOT, 'scripts', 'bongos', 'surface.js'));
 
 const AGENT_ENV = {};
 const TERM_ENV = { BONGOS_SURFACE: 'terminal' };
@@ -40,7 +40,7 @@ test('terminal is opt-in, case- and space-insensitive', () => {
 test('the surface is never inferred from isTTY', () => {
   // A Claude Code session's stdout is not a TTY either, so TTY-sniffing would classify every
   // agent run as a terminal and break the card contract. The module must not consult it.
-  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'surface.js'), 'utf8');
+  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'surface.js'), 'utf8');
   const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
   assert.ok(!/isTTY/.test(code), 'surface.js must not branch on isTTY');
 });
@@ -93,7 +93,7 @@ test('no trailing whitespace on a terminal row', () => {
 // ── 3. The call sites ───────────────────────────────────────────────────────────────────────
 
 test('start.js routes every reader-facing idiom through the surface', () => {
-  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'start.js'), 'utf8');
+  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'start.js'), 'utf8');
   const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
 
   // Two exemptions, both agent-only BY CONSTRUCTION:
@@ -114,7 +114,7 @@ test('start.js routes every reader-facing idiom through the surface', () => {
 });
 
 test('the card directive is suppressed for a terminal reader', () => {
-  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'start.js'), 'utf8');
+  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'start.js'), 'utf8');
   assert.match(
     src,
     /function emitCardDirective\(form\) \{[\s\S]{0,400}?surface\.isTerminal\(\)\) return;/,
@@ -141,7 +141,7 @@ test('the skills still invoke the scripts directly, which is what keeps agents o
   // surface and the card contract would break with no test failing anywhere else.
   const fs = require('node:fs');
   const skill = fs.readFileSync(path.join(REPO_ROOT, '.claude', 'skills', 'builder-start', 'SKILL.md'), 'utf8');
-  assert.match(skill, /node scripts\/gds\/start\.js/, 'builder-start must call the script directly');
+  assert.match(skill, /node scripts\/(?:gds|bongos)\/start\.js/, 'builder-start must call the script directly');
 });
 
 // ── 4. The rest of the shipped CLI, not just start.js (task 1003730) ────────────────────────
@@ -156,12 +156,12 @@ import fs from 'node:fs';
 // Every script a TERMINAL reader can actually invoke, read out of bin/bongos.js's verb
 // table so a newly-added verb is covered the day it lands.
 //
-// This used to read the FILES manifest of scripts/gds/build-cli-package.js. That package
+// This used to read the FILES manifest of scripts/bongos/build-cli-package.js. That package
 // (@cloudbongos/cli) was retired with the manifest (task 1004144), but the rule it fed
 // did not go with it: a script that prints a `/builder-*` slash command to someone in a
 // terminal is telling them to run something they do not have.
 //
-// The verb table is the right heir, not `readdirSync` of scripts/gds/. What made the old
+// The verb table is the right heir, not `readdirSync` of scripts/bongos/. What made the old
 // set meaningful was never "these files were published" — it was "a terminal user can
 // reach these", and the dispatcher's VERBS is exactly that set today. Scanning the whole
 // directory instead looks stricter and is actually a different test: it immediately
@@ -170,7 +170,7 @@ import fs from 'node:fs';
 // findings imported into a packaging task rather than a stronger guard.
 function shippedScripts() {
   const src = fs.readFileSync(path.join(REPO_ROOT, 'bin', 'bongos.js'), 'utf8');
-  const out = [...new Set([...src.matchAll(/script:\s*'([A-Za-z0-9._-]+\.js)'/g)].map((m) => `scripts/gds/${m[1]}`))].sort();
+  const out = [...new Set([...src.matchAll(/script:\s*'([A-Za-z0-9._-]+\.js)'/g)].map((m) => `scripts/bongos/${m[1]}`))].sort();
   // A scan that matches nothing passes every assertion below for free.
   assert.ok(out.length > 10, `only ${out.length} verb script(s) found in bin/bongos.js — the scan is reading the wrong shape`);
   return out;
@@ -180,7 +180,7 @@ function shippedScripts() {
 // everything it wrote. HOME is pointed at nothing so no real session can satisfy requireSession.
 function runGuidance(fn, env) {
   const code =
-    `const l=require(${JSON.stringify(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'))});` +
+    `const l=require(${JSON.stringify(path.join(REPO_ROOT, 'scripts', 'bongos', 'cli-lib.js'))});` +
     `Promise.resolve(l[${JSON.stringify(fn)}]()).catch(()=>{});`;
   // HOME ALONE IS NOT ISOLATION ON WINDOWS (task 1003941). cli-lib resolves the
   // session through os.homedir(), which on win32 reads USERPROFILE and ignores
@@ -225,7 +225,7 @@ test('no guidance path speaks slash commands to a terminal reader', () => {
     const out = guidanceOutput(fn, { BONGOS_SURFACE: 'terminal' });
     const leaks = [...out.matchAll(/\/builder-[a-z-]+/g)].map((m) => m[0]);
     assert.deepEqual(leaks, [], `${fn} leaked to a terminal reader: ${leaks.join(', ')}\n${out}`);
-    assert.ok(!/node scripts\/gds\//.test(out), `${fn} told a terminal reader to run a repo script:\n${out}`);
+    assert.ok(!/node scripts\/(?:gds|bongos)\//.test(out), `${fn} told a terminal reader to run a repo script:\n${out}`);
   }
 });
 
@@ -241,10 +241,10 @@ test('every shipped script that names a slash command routes it through the surf
   // branches, require that any shipped file printing one also consults the switch — and pin the
   // set, so a NEW unguarded file fails here instead of on a newcomer's laptop.
   const ALLOWED = new Set([
-    'scripts/gds/cli-lib.js',        // agent side of the three branches, proven above
-    'scripts/gds/setup.js',          // re-run + newcomer-path lines, asserted below
-    'scripts/gds/surface.js',        // the switch itself
-    'scripts/gds/start.js',          // section 3's documented agent-only exemptions
+    'scripts/bongos/cli-lib.js',        // agent side of the three branches, proven above
+    'scripts/bongos/setup.js',          // re-run + newcomer-path lines, asserted below
+    'scripts/bongos/surface.js',        // the switch itself
+    'scripts/bongos/start.js',          // section 3's documented agent-only exemptions
   ]);
   const offenders = [];
   for (const rel of shippedScripts()) {
@@ -260,7 +260,7 @@ test('every shipped script that names a slash command routes it through the surf
 });
 
 test('setup.js routes its newcomer path and re-run lines through the surface', () => {
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'setup.js'), 'utf8');
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'setup.js'), 'utf8');
   // The completion footer is the worst possible place for a wrong command: it is the first thing
   // a brand-new builder reads after registering.
   assert.match(src, /Survey work:\s*\$\{surfaceAction\('start'\)\}/, 'the newcomer path must use surfaceAction');

package/tests/cli_token_reissue.mjs

@@ -39,7 +39,7 @@ function t(name, fn) {
 console.log('paste-token.js merge invariants:');
 
 function mergeSession(existing, freshMe, freshToken, apiBase) {
-  // MUST match the implementation in scripts/gds/paste-token.js (function main,
+  // MUST match the implementation in scripts/bongos/paste-token.js (function main,
   // step 3). If the script changes, this test will diverge — that's the point.
   return {
     ...existing,
@@ -164,7 +164,7 @@ t('returns a paste_command field the portal can show verbatim', () => {
 
 // The regression this pins (task 1003961): paste_command is composed on the SERVER
 // and run on an INSTANCE, where the core is an installed dependency and there is no
-// `scripts/gds/` directory. Emitting a repo-relative script path handed every
+// `scripts/bongos/` directory. Emitting a repo-relative script path handed every
 // instance builder a command naming a file they did not have. A verb has no such
 // coupling — `bongos` is on PATH wherever the core is installed.
 t('paste_command names a CLI VERB, never a filesystem path', () => {

package/tests/client_baseurl_guard.mjs

@@ -16,7 +16,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { checkClientBaseUrl, scanPages } = require('../scripts/gds/client-baseurl-guard.js');
+const { checkClientBaseUrl, scanPages } = require('../scripts/bongos/client-baseurl-guard.js');
 
 let passed = 0;
 let failed = 0;

package/tests/client_bundle_route.mjs

@@ -2,7 +2,7 @@
 //
 // The generated typed client is served to classic <script> web pages at
 // /lib/bongos-client.js (task 1996 / R09). This guards that serve-internal
-// actually serves the COMMITTED browser-global build there — with the right
+// actually serves the browser-global build there — with the right
 // MIME + the BongosClient global — so the hall/status pages can consume the same
 // client the CLI uses. serve-internal is DB-free (the pg pool connects lazily),
 // so we mount it on a throwaway express app and hit the route over loopback.
@@ -13,6 +13,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -34,14 +35,44 @@ async function withServer(fn) {
   }
 }
 
-test('/lib/bongos-client.js serves the committed browser-global build', async () => {
+// task 1004866: the client is gitignored, so a fresh checkout has no file on disk. The
+// route serves the packaged file when there is one, else a client generated from the
+// live routes — so the expected bytes are whichever of those this checkout resolves to.
+const BUNDLE = path.join(ROOT, 'clients/bongos-client/bongos-client.global.js');
+
+test('/lib/bongos-client.js serves the browser-global build (file, else generated)', async () => {
+  const { generateClientBundleJs } = require('../src/bongos/serve-internal.js');
   await withServer(async (base) => {
     const res = await fetch(base + '/lib/bongos-client.js');
     assert.equal(res.status, 200);
     assert.match(res.headers.get('content-type') || '', /javascript/);
     const body = await res.text();
-    const onDisk = fs.readFileSync(path.join(ROOT, 'clients/bongos-client/bongos-client.global.js'), 'utf8');
-    assert.equal(body, onDisk, 'served bytes must equal the committed bundle (single source of truth)');
+    const expected = fs.existsSync(BUNDLE) ? fs.readFileSync(BUNDLE, 'utf8') : generateClientBundleJs();
+    assert.equal(body, expected, 'served bytes must equal the resolved bundle (single source of truth)');
     assert.match(body, /global\.BongosClient =/, 'bundle exposes window.BongosClient');
   });
 });
+
+test('the generate tier is the same client the generators write (fresh checkout)', () => {
+  const { generateClientBundleJs } = require('../src/bongos/serve-internal.js');
+  const { buildApiArtifacts } = require('../scripts/bongos/api-artifacts.js');
+  assert.equal(generateClientBundleJs(), buildApiArtifacts()['clients/bongos-client/bongos-client.global.js']);
+});
+
+test('resolveClientBundleJs: absent file → generated; present → the file; all fail → empty', () => {
+  const { resolveClientBundleJs } = require('../src/bongos/serve-internal.js');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'client-bundle-'));
+  try {
+    const missing = path.join(tmp, 'nope.js');
+    assert.equal(resolveClientBundleJs({ candidates: [missing], generate: () => 'GEN' }), 'GEN',
+      'a fresh checkout (no file) must fall through to in-process generation');
+    const present = path.join(tmp, 'bundle.js');
+    fs.writeFileSync(present, 'FILE');
+    assert.equal(resolveClientBundleJs({ candidates: [present], generate: () => 'GEN' }), 'FILE',
+      'a packaged file wins over generation');
+    assert.equal(resolveClientBundleJs({ candidates: [missing], generate: () => { throw new Error('x'); } }), '',
+      'a failing generator yields empty (→ 404), never a throw at boot');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});

package/tests/cloud_bongos_pack.mjs

@@ -43,7 +43,7 @@ test('R74: the vanilla pack carries the Cloud Bongos LOOK (chrome palette, Manro
   assert.match(c.theme.fonts.display, /Manrope/);
   assert.match(c.theme.fonts.body, /Manrope/);
   assert.ok(c.theme.fonts.links.some((l) => /JetBrains\+Mono/.test(l) && /Manrope/.test(l)), 'loads Manrope + JetBrains Mono');
-  assert.match(c.theme.favicon, /circle/, 'bongo-pair favicon (circles), not the Greek Α');
+  assert.match(c.theme.favicon, /circle/, 'the moon-in-the-gap favicon (circles), not the Greek Α');
   assert.doesNotMatch(c.theme.favicon, /font-family='serif'>Α/);
   // the backdrop is the TOKEN, not a hex: the served body follows the mode,
   // because the sheets' dark blocks are (0,2,0) and outrank the injected :root.

package/tests/community_leaderboard_db.mjs

@@ -12,7 +12,7 @@
 // under test.
 //
 // Real-DB integration test: self-skips without a reachable Postgres; in the
-// INTEGRATION set (scripts/gds/run-unit-tests.js) so the DB-free lane never runs it.
+// INTEGRATION set (scripts/bongos/run-unit-tests.js) so the DB-free lane never runs it.
 //
 // Run:  DATABASE_URL=... node tests/community_leaderboard_db.mjs
 

package/tests/conductor.mjs

@@ -208,34 +208,34 @@ test('outside-touches does NOT fire when the claim has empty touches[] (fresh ta
 // named. Under the pool this fired with ONE file; it must name both.
 test('outside-touches ignores a CONCURRENT claim\'s touches[] — the under-report', () => {
   const a = conductor.evaluateTriggers({
-    changedFiles: ['modules/hall-ui/public/studio.js', 'scripts/gds/ship.js', 'docs/adr/0280-x.md'],
+    changedFiles: ['modules/hall-ui/public/studio.js', 'scripts/bongos/ship.js', 'docs/adr/0280-x.md'],
     prompt: 'edits',
     activeClaims: [
       { task_id: 1, title: 'mine', touches: ['modules/hall-ui/public/studio.js'], worktree_name: 'task-1' },
-      { task_id: 2, title: 'theirs', touches: ['scripts/gds/', 'src/bongos/', 'modules/', 'clients/'], worktree_name: 'task-2' },
+      { task_id: 2, title: 'theirs', touches: ['scripts/bongos/', 'src/bongos/', 'modules/', 'clients/'], worktree_name: 'task-2' },
     ],
     worktree: 'task-1',
   });
   const outside = a.find((x) => x.id === 'outside-touches');
   assert.ok(outside, 'expected outside-touches advisory');
   // studio.js is covered by MY claim; the other two are not covered by anything
-  // of mine. Under the pool, `modules/` and `scripts/gds/` swallowed them and
+  // of mine. Under the pool, `modules/` and `scripts/bongos/` swallowed them and
   // the line read "1 changed file(s)".
   assert.match(outside.text, /^2 changed file\(s\)/, 'both uncovered files must be counted, not one');
 });
 
 test('outside-touches counts only what MY claim fails to cover', () => {
   const a = conductor.evaluateTriggers({
-    changedFiles: ['modules/hall-ui/public/studio.js', 'scripts/gds/ship.js', 'docs/adr/0280-x.md'],
+    changedFiles: ['modules/hall-ui/public/studio.js', 'scripts/bongos/ship.js', 'docs/adr/0280-x.md'],
     prompt: 'edits',
     activeClaims: [
       { task_id: 1, title: 'mine', touches: ['modules/hall-ui/public/studio.js'], worktree_name: 'task-1' },
-      { task_id: 2, title: 'theirs', touches: ['scripts/gds/', 'modules/'], worktree_name: 'task-2' },
+      { task_id: 2, title: 'theirs', touches: ['scripts/bongos/', 'modules/'], worktree_name: 'task-2' },
     ],
     worktree: 'task-1',
   });
   const outside = a.find((x) => x.id === 'outside-touches');
-  assert.match(outside.text, /scripts\/gds\/ship\.js/, "the other claim's directory must not cover my diff");
+  assert.match(outside.text, /scripts\/(?:gds|bongos)\/ship\.js/, "the other claim's directory must not cover my diff");
   assert.match(outside.text, /docs\/adr\/0280-x\.md/);
   assert.doesNotMatch(outside.text, /studio\.js/, 'my own declared file is still covered');
 });
@@ -245,10 +245,10 @@ test('outside-touches counts only what MY claim fails to cover', () => {
 // number derived from another claim's touches[] is the defect, not a degraded
 // version of it. Trigger 1 still covers having no claim at all.
 test('outside-touches is SILENT when no claim is bound to this worktree', () => {
-  const claims = [{ task_id: 2, title: 'theirs', touches: ['scripts/gds/'], worktree_name: 'task-2' }];
+  const claims = [{ task_id: 2, title: 'theirs', touches: ['scripts/bongos/'], worktree_name: 'task-2' }];
   for (const worktree of ['cloud-bongos', null, undefined, '']) {
     const a = conductor.evaluateTriggers({
-      changedFiles: ['server.js', 'scripts/gds/ship.js'], prompt: 'edits', activeClaims: claims, worktree,
+      changedFiles: ['server.js', 'scripts/bongos/ship.js'], prompt: 'edits', activeClaims: claims, worktree,
     });
     assert.ok(!ids(a).includes('outside-touches'), `unbound tree (${String(worktree)}) must not borrow another claim's touches[]`);
   }
@@ -436,7 +436,7 @@ test('render: showDispatch=false emits the milder already-reviewed form', () =>
 });
 
 // pickSpecialists lives in the dispatcher CLI (pure, exported).
-const dispatch = require('../scripts/gds/conductor-dispatch.js');
+const dispatch = require('../scripts/bongos/conductor-dispatch.js');
 
 test('pickSpecialists: hacker when a security surface is in the diff', () => {
   assert.deepEqual(dispatch.pickSpecialists(['src/bongos/routes/tasks.js']), ['hacker']);
@@ -453,9 +453,9 @@ test('pickSpecialists: nothing auto-picked when no security surface changed', ()
 test('bestMatchingClaim: picks the claim whose touches[] best overlap the diff', () => {
   const claims = [
     { task_id: 415, touches: ['migrations/'] },                       // 0 overlap
-    { task_id: 439, touches: ['scripts/gds/conductor-dispatch.js', '.claude/hooks/conductor.js'] }, // 2
+    { task_id: 439, touches: ['scripts/bongos/conductor-dispatch.js', '.claude/hooks/conductor.js'] }, // 2
   ];
-  const changed = ['scripts/gds/conductor-dispatch.js', '.claude/hooks/conductor.js'];
+  const changed = ['scripts/bongos/conductor-dispatch.js', '.claude/hooks/conductor.js'];
   assert.equal(dispatch.bestMatchingClaim(claims, changed).task_id, 439);
 });
 
@@ -493,7 +493,7 @@ const CLAIM_1003704 = {
   task_id: '1003704',
   title: 'C3b: rename gds-session.json and the gds_session cookie',
   worktree_name: 'task-1003704',
-  touches: ['scripts/gds/', 'src/bongos/', 'modules/', 'clients/'],
+  touches: ['scripts/bongos/', 'src/bongos/', 'modules/', 'clients/'],
 };
 const CLAIM_1003829 = {
   task_id: '1003829',
@@ -542,10 +542,10 @@ test('attribution: specificity beats breadth, so the honest touches[] no longer
 
 test('attribution: volume still counts — a genuinely broad claim keeps its diff', () => {
   // Specificity must not invert the heuristic: a rename touching fifty files
-  // under scripts/gds/ should not lose to a claim sharing one exact file.
-  const broad = { task_id: 'broad', touches: ['scripts/gds/'] };
-  const narrow = { task_id: 'narrow', touches: ['scripts/gds/one.js'] };
-  const files = Array.from({ length: 50 }, (_, i) => `scripts/gds/f${i}.js`).concat('scripts/gds/one.js');
+  // under scripts/bongos/ should not lose to a claim sharing one exact file.
+  const broad = { task_id: 'broad', touches: ['scripts/bongos/'] };
+  const narrow = { task_id: 'narrow', touches: ['scripts/bongos/one.js'] };
+  const files = Array.from({ length: 50 }, (_, i) => `scripts/bongos/f${i}.js`).concat('scripts/bongos/one.js');
   assert.equal(dispatch.attributeClaim([narrow, broad], files, null).claim.task_id, 'broad');
 });
 
@@ -687,7 +687,7 @@ test('selectAutonomousDispatch: GO + feed → picks rows[0] and shapes the claim
   );
   assert.equal(r.ok, true);
   assert.equal(r.task.id, 458, 'takes the top (already-ordered, protected-filtered) row');
-  assert.equal(r.command, 'node scripts/gds/claim.js 458');
+  assert.equal(r.command, 'node scripts/bongos/claim.js 458');
   assert.match(r.directive, /#458/);
   assert.match(r.directive, /\/builder-ship/);
 });
@@ -720,7 +720,7 @@ test('autoDispatch: GO → fetches the autonomous feed and emits a directive', a
   assert.deepEqual(feedOpts, { fit: 'autonomous' }, 'asks for the protected-filtered autonomous feed');
   assert.equal(out.ok, true);
   assert.equal(out.task.id, 458);
-  assert.equal(out.command, 'node scripts/gds/claim.js 458');
+  assert.equal(out.command, 'node scripts/bongos/claim.js 458');
 });
 
 test('autoDispatch: a thrown precheck degrades to NO-GO (fail-safe, no dispatch)', async () => {

package/tests/conflict_resolve.mjs

@@ -139,7 +139,7 @@ test('the otb-regen driver is pinned to the server checkout, not the clone', asy
   await cr.resolveBranchConflicts({ branch: 'claude/wt-1' }, deps);
   const script = deps._regOpts[0] && deps._regOpts[0].driverScript;
   assert.ok(script, 'registration must pass a driverScript');
-  assert.equal(path.resolve(script), path.resolve('/srv/repo', 'scripts', 'gds', 'git-merge-regen.js'));
+  assert.equal(path.resolve(script), path.resolve('/srv/repo', 'scripts', 'bongos', 'git-merge-regen.js'));
   assert.ok(!path.resolve(script).startsWith(path.resolve('/tmp/otb-resolve-test')), 'never inside the clone');
 });
 
@@ -558,25 +558,26 @@ test('1003546 a failing post-merge commit is reported, not pushed', async () =>
 // to the first and not the second, so the copy registry was "covered" by the driver
 // and regenerated by nobody. Pin them as one set, via each artifact's PRODUCER.
 test('1003546 every REGENERABLE artifact has a producer, and every producer is in GENERATOR_SCRIPTS', async () => {
-  const regen = require('../scripts/gds/git-merge-regen.js');
-  const G = require('../scripts/gds/gen-repo-map.js');
-  const CI = require('../scripts/gds/copy-inventory.js');
+  const regen = require('../scripts/bongos/git-merge-regen.js');
+  const G = require('../scripts/bongos/gen-repo-map.js');
+  const CI = require('../scripts/bongos/copy-inventory.js');
 
   // Derived from each generator's own exports where it publishes them, so this map
   // cannot silently drift from the generator it names.
   const PRODUCED_BY = new Map([
-    ['docs/repo-map.md', 'scripts/gds/gen-repo-map.js'],
-    ['docs/file-map.md', 'scripts/gds/gen-file-map.js'],
-    ['docs/session-log-index.md', 'scripts/gds/gen-session-index.js'],
+    ['docs/repo-map.md', 'scripts/bongos/gen-repo-map.js'],
+    ['docs/file-map.md', 'scripts/bongos/gen-file-map.js'],
+    ['docs/session-log-index.md', 'scripts/bongos/gen-session-index.js'],
     // task 1001431 — the ROOT CLAUDE.md joined REGENERABLE for its §13 snippet block.
     // gen-session-index.js writes BOTH the (gitignored) whole index and that tracked
     // snippet, and it is already in GENERATOR_SCRIPTS, so the server's post-merge
     // regeneration covers the new entry with no change to the generator list.
-    ['CLAUDE.md', 'scripts/gds/gen-session-index.js'],
-    [CI.REGISTRY_REL, 'scripts/gds/copy-inventory.js'],
-    [CI.REPORT_REL, 'scripts/gds/copy-inventory.js'],
-    ...G.NESTED_DIRS.map((d) => [`${d}/CLAUDE.md`, 'scripts/gds/gen-repo-map.js']),
-    // task 1003537 — the generated API contract + client joined REGENERABLE. Mapped by
+    ['CLAUDE.md', 'scripts/bongos/gen-session-index.js'],
+    [CI.REGISTRY_REL, 'scripts/bongos/copy-inventory.js'],
+    [CI.REPORT_REL, 'scripts/bongos/copy-inventory.js'],
+    ...G.NESTED_DIRS.map((d) => [`${d}/CLAUDE.md`, 'scripts/bongos/gen-repo-map.js']),
+    // task 1003537 — the generated API pointer stub is in REGENERABLE (the spec, reference
+    // and client left it under task 1004866: gitignored, nothing to heal). Mapped by
     // PATH PREFIX rather than by calling the generators: this suite deliberately sets
     // *_INSTANCE_ROOT (see the env-hardening case above), which repoints their docs root
     // at a fake server checkout, so a build() here reads a file that does not exist.
@@ -585,10 +586,7 @@ test('1003546 every REGENERABLE artifact has a producer, and every producer is i
     // under either prefix is picked up here automatically.
     ...[...regen.REGENERABLE]
       .filter((p) => p.startsWith('docs/api/') || p === 'docs/api-reference.md' || p === 'docs/routes-permissions.md')
-      .map((p) => [p, 'scripts/gds/gen-api-docs.js']),
-    ...[...regen.REGENERABLE]
-      .filter((p) => p.startsWith('clients/bongos-client/'))
-      .map((p) => [p, 'scripts/gds/gen-api-client.js']),
+      .map((p) => [p, 'scripts/bongos/gen-api-docs.js']),
   ]);
 
   // task 1004775 — docs/page-readings.json is merged per page FROM THE THREE MERGE

package/tests/consumer_layout_boot.mjs

@@ -20,7 +20,7 @@
 // ever exercised that shape. This harness closes the blind spot end to end.
 //
 // WHAT IT PROVES (the two-root checks all go RED against the pre-2133 loader):
-//   1. package  — scripts/gds/package-core.js builds an installable .tgz.
+//   1. package  — scripts/bongos/package-core.js builds an installable .tgz.
 //   2. install  — `npm install <tgz>` lands it at node_modules/@bongos/core.
 //   3. roots    — resolveCoreRoot() is UNDER node_modules/@bongos/core while
 //                 resolveInstanceRoot() is the consumer tree: two DIFFERENT dirs, so
@@ -33,7 +33,7 @@
 //                 cannot find consumer-probe → this IS the task-2133 done-when.
 //   6. fitness  — the packaged fitness.js discoveredModuleKeys() spans both roots.
 //   7. gen-file-map — reads the INSTANCE root (lists the consumer's .claude/skills).
-//   8. gen-repo-map — maps CORE code (scripts/gds/fitness.js) from node_modules.
+//   8. gen-repo-map — maps CORE code (scripts/bongos/fitness.js) from node_modules.
 //   9. npm ci   — the lockfile SHIPPED inside the package (package-core prunes it to the
 //                 core's own dependency closure) installs with `npm ci` on its own: in step
 //                 with the package.json it ships beside, and every integrity hash verifies.
@@ -54,7 +54,7 @@
 //                 — the gap the task-1004030 foreign-key break hid in.
 //
 // WHERE IT RUNS. This is an INTEGRATION harness (a package build, two installs, live boots
-// and a Postgres), so it sits in the INTEGRATION set of scripts/gds/run-unit-tests.js — the
+// and a Postgres), so it sits in the INTEGRATION set of scripts/bongos/run-unit-tests.js — the
 // per-PR unit gate never pays for it — and the `integration` job of
 // .github/workflows/integration.yml runs it on every push to main via
 // `run-unit-tests.js --integration`. That job's Postgres service supplies checks 10-12, but
@@ -105,7 +105,7 @@ const NPM_BIN = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 const CORE_VERSION_RANGE = '^1.0.0'; // consumer-probe's coreVersion — satisfied by any 1.x core.
 // The consumer's package.json is scaffolded by the SAME function `bongos init` uses for a
 // greenfield instance, so its `migrate` script is the real one rather than a copy that could drift.
-const { buildInstancePackageJson } = createRequire(import.meta.url)(join(REPO_ROOT, 'scripts', 'gds', 'init.js'));
+const { buildInstancePackageJson } = createRequire(import.meta.url)(join(REPO_ROOT, 'scripts', 'bongos', 'init.js'));
 
 let passed = 0;
 let failed = 0;
@@ -307,10 +307,10 @@ async function main() {
     // job packages exactly the code under review). Reuse a prebuilt one via CORE_TGZ.
     // No database settings reach the packager (header: THE CHILD PROCESSES ...).
     let tgz = process.env.CORE_TGZ || '';
-    check('package: scripts/gds/package-core.js builds an installable .tgz', () => {
+    check('package: scripts/bongos/package-core.js builds an installable .tgz', () => {
       if (tgz) { assert.ok(existsSync(tgz), `CORE_TGZ does not exist: ${tgz}`); return; }
       const outDir = join(workRoot, 'dist');
-      const r = spawnSync(process.execPath, [join(REPO_ROOT, 'scripts/gds/package-core.js'), '--out-dir', outDir],
+      const r = spawnSync(process.execPath, [join(REPO_ROOT, 'scripts/bongos/package-core.js'), '--out-dir', outDir],
         { cwd: REPO_ROOT, env: withoutDbEnv(), encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 });
       assert.equal(r.status, 0, `package-core exited ${r.status}\n${r.stderr}`);
       const pinLine = r.stdout.trim().split('\n').filter(Boolean).pop();
@@ -448,7 +448,7 @@ async function main() {
     // --- 6. fitness spans both roots -----------------------------------------
     check('fitness: discoveredModuleKeys() unions the core + instance module roots', () => {
       const r = runNodeJSON(`
-        const f = require(${A('scripts/gds/fitness.js')});
+        const f = require(${A('scripts/bongos/fitness.js')});
         process.stdout.write(JSON.stringify({ keys: f.discoveredModuleKeys() }));
       `, consumer);
       assert.ok(r.keys.includes('consumer-probe'),
@@ -462,7 +462,7 @@ async function main() {
     // --- 7. gen-file-map reads the INSTANCE root ------------------------------
     check('gen-file-map: buildModel() lists the INSTANCE root .claude/skills (consumer-probe-skill)', () => {
       const model = runNodeJSON(`
-        const g = require(${A('scripts/gds/gen-file-map.js')});
+        const g = require(${A('scripts/bongos/gen-file-map.js')});
         process.stdout.write(JSON.stringify(g.buildModel()));
       `, consumer);
       const skills = model.find((s) => s.id === 'skills');
@@ -473,14 +473,14 @@ async function main() {
     });
 
     // --- 8. gen-repo-map reads the CORE root ----------------------------------
-    check('gen-repo-map: buildModel() maps CORE code (scripts/gds/fitness.js) from node_modules', () => {
+    check('gen-repo-map: buildModel() maps CORE code (scripts/bongos/fitness.js) from node_modules', () => {
       const model = runNodeJSON(`
-        const g = require(${A('scripts/gds/gen-repo-map.js')});
+        const g = require(${A('scripts/bongos/gen-repo-map.js')});
         const m = g.buildModel();
-        process.stdout.write(JSON.stringify({ files: m.files.length, hasFitness: m.byFile.some((f) => f.rel === 'scripts/gds/fitness.js') }));
+        process.stdout.write(JSON.stringify({ files: m.files.length, hasFitness: m.byFile.some((f) => f.rel === 'scripts/bongos/fitness.js') }));
       `, consumer);
       assert.ok(model.files > 50, `core scan found too few files (${model.files}) — core root not resolved to the package?`);
-      assert.equal(model.hasFitness, true, 'gen-repo-map did not map the core file scripts/gds/fitness.js');
+      assert.equal(model.hasFitness, true, 'gen-repo-map did not map the core file scripts/bongos/fitness.js');
     });
 
     // --- 9. npm ci from the SHIPPED, pruned lockfile --------------------------

package/tests/context_pack.mjs

@@ -25,7 +25,7 @@ const {
   formatOs,
   formatContextPack,
   formatContextPackCompact,
-} = require('../scripts/gds/context-pack.js');
+} = require('../scripts/bongos/context-pack.js');
 // The live validators — the pack MUST mirror these, or it would teach builders
 // the wrong enum (the whole point of "generated from the live validators").
 const { VALID_KINDS, VALID_DISCIPLINES, TASK_FIELD_BOUNDS } =
@@ -360,10 +360,10 @@ const url = require('node:url');
 function checkoutWithoutLifecycle() {
   const here = path.dirname(url.fileURLToPath(import.meta.url));
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ctxpack-nolifecycle-'));
-  fs.mkdirSync(path.join(root, 'scripts', 'gds'), { recursive: true });
+  fs.mkdirSync(path.join(root, 'scripts', 'bongos'), { recursive: true });
   fs.mkdirSync(path.join(root, 'src', 'bongos'), { recursive: true });
-  fs.copyFileSync(path.join(here, '..', 'scripts', 'gds', 'context-pack.js'),
-    path.join(root, 'scripts', 'gds', 'context-pack.js'));
+  fs.copyFileSync(path.join(here, '..', 'scripts', 'bongos', 'context-pack.js'),
+    path.join(root, 'scripts', 'bongos', 'context-pack.js'));
   // The ONLY other import. Deliberately copied rather than stubbed: if
   // context-pack grows a second hard dependency, this test fails and that new
   // coupling has to be looked at — which is the point.
@@ -371,7 +371,7 @@ function checkoutWithoutLifecycle() {
     path.join(root, 'src', 'bongos', 'api-prefix.js'));
   // No modules/ — that IS the condition.
   assert.ok(!fs.existsSync(path.join(root, 'modules')), 'the fixture must not carry modules/');
-  return { root, mod: require(path.join(root, 'scripts', 'gds', 'context-pack.js')) };
+  return { root, mod: require(path.join(root, 'scripts', 'bongos', 'context-pack.js')) };
 }
 
 t('a checkout with no modules/lifecycle can still LOAD the pack (the deadlock)', () => {
@@ -414,7 +414,7 @@ t('with the module present the enums are still the LIVE ones, not a local copy',
   const live = require('../modules/lifecycle/task-classifier');
   assert.deepEqual(api.task_kinds, [...live.VALID_KINDS].filter((k) => k !== 'unclassified'));
   assert.deepEqual(api.disciplines, [...live.VALID_DISCIPLINES].filter((d) => d !== 'unclassified'));
-  const src = fs.readFileSync(new URL('../scripts/gds/context-pack.js', import.meta.url), 'utf8');
+  const src = fs.readFileSync(new URL('../scripts/bongos/context-pack.js', import.meta.url), 'utf8');
   assert.doesNotMatch(src, /'(bug|feature|chore|cleanup|verify)'\s*,\s*'/,
     'a literal kind list in this file is the drift the generated design exists to prevent');
 });

package/tests/control_manifest.mjs

@@ -11,7 +11,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const cm = require(path.join(ROOT, 'scripts', 'gds', 'control-manifest.js'));
+const cm = require(path.join(ROOT, 'scripts', 'bongos', 'control-manifest.js'));
 
 test('the live tree passes: every goal-1000076 control is present and wired', () => {
   const r = cm.checkControlsExist();
@@ -42,10 +42,10 @@ test('a present-but-UNWIRED control is caught (the settings.json un-hook case)',
 
 test('a missing companion file (baseline/config) is caught even when the main file exists', () => {
   const controls = [{
-    label: 'audit gate', file: 'scripts/gds/audit-gate.js',
+    label: 'audit gate', file: 'scripts/bongos/audit-gate.js',
     alsoExists: ['config/audit-baseline.json'],
   }];
-  const v = cm.evaluate(controls, { exists: (f) => f === 'scripts/gds/audit-gate.js', read: () => '' });
+  const v = cm.evaluate(controls, { exists: (f) => f === 'scripts/bongos/audit-gate.js', read: () => '' });
   assert.equal(v.length, 1);
   assert.match(v[0], /companion file missing/);
 });
@@ -105,7 +105,7 @@ test('a guard UNWIRED from fitness.js is caught — the one-line deletion', () =
 
 test("G04 is wired via ship-flow, not fitness — it is a module, not a check", () => {
   const row = cm.CONTROLS.find((c) => c.label.includes('(G04)'));
-  assert.equal(row.wiredIn.file, 'scripts/gds/ship-flow.js');
+  assert.equal(row.wiredIn.file, 'scripts/bongos/ship-flow.js');
   const out = cm.evaluate([row], { exists: () => true, read: () => 'nothing requires it' });
   assert.equal(out.length, 1, 'an unrequired ship-honesty is caught');
 });

package/tests/copy_desk_page_reads.mjs

@@ -179,7 +179,7 @@ try {
       const { status, body } = await get(p);
       assert.equal(status, 503, p);
       assert.equal(body.error.code, 'page_inventory_missing', p);
-      assert.equal(body.error.details.run, 'node scripts/gds/page-inventory.js', p);
+      assert.equal(body.error.details.run, 'node scripts/bongos/page-inventory.js', p);
     }
     const tally = await get('/copy-desk/tally', F.ALICE.id);
     assert.equal(tally.status, 200);