@bongos/core 1.21.175 → 1.21.176

package/scripts/gds/push-main.js

@@ -1,56 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/push-main.js — the ONE sanctioned client-side push to `main`.
-//
-// This is the deploy step of the GRADED GDS pipeline: ship.js's auto-merge and
-// /merge-mode call it after a task has passed the grader + the Archon-only
-// confirm gate. It carries the <PREFIX>_ALLOW_MAIN_PUSH override so the SEC #863
-// pre-push hook lets the legitimate, already-gated pipeline land main while
-// still blocking an ad-hoc `git push origin main` (the Builder 25 move).
-//
-// NOT a security boundary — anyone could run this script, just as anyone could
-// `git push --no-verify`. The enforcement is the POST-push main audit
-// (scripts/gds/main-audit.js, ADR 0043): it reads the real git history + real
-// builder ranks server-side and reverts un-graded / sub-Metic-permission-path
-// commits regardless of HOW they were pushed. push-main.js only distinguishes
-// "the pipeline's deploy push" from "a human bypassing the pipeline" so the
-// hook's friction lands on the latter.
-//
-// Under FULL Option A (server-side merge+deploy, gated behind SERVER_SIDE_DEPLOY
-// — see ADR 0043 + blockers), this client-side push goes away entirely and
-// builders never hold main-push at all.
-
+// scripts/gds/push-main.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/push-main.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const { execFileSync } = require('node:child_process');
-const { envPrefix } = require('../../src/instance-config');
-
-// The push's environment: the caller's, plus the override under its CANONICAL
-// spelling for this instance — <PREFIX>_ALLOW_MAIN_PUSH, BONGOS_ on a vanilla
-// instance (task 1001441). The hook reads it through resolveEnv, where the
-// canonical name is tried first; writing the legacy OTB_ spelling instead would
-// still work until the legacy prefixes retire, and would earn a deprecation
-// warning on every deploy push in the meantime.
-function pushEnv(env = process.env) {
-  return { ...env, [`${envPrefix()}_ALLOW_MAIN_PUSH`]: '1' };
-}
-
-function pushMain(extra = []) {
-  execFileSync('git', ['push', 'origin', 'main', ...extra], {
-    stdio: 'inherit',
-    env: pushEnv(),
-    shell: false,
-  });
-}
-
-// Only push when run directly — never on require (requiring this file must not
-// trigger a push). ship.js / merge-mode invoke it as `node push-main.js`.
-if (require.main === module) {
-  try {
-    pushMain(process.argv.slice(2)); // optional extra args (rare; e.g. --force-with-lease)
-    process.exit(0);
-  } catch (_) {
-    process.exit(1);
-  }
-}
-
-module.exports = { pushMain, pushEnv };
+require('../bongos/forwarder.js').forward(module, 'push-main.js');

package/scripts/gds/push-path-brief.js

@@ -1,100 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/push-path-brief.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/push-path-brief.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-//
-// scripts/gds/push-path-brief.js — say out loud, at session start, that this machine
-// cannot push (task 1003259 / idea 1000838).
-//
-// THE GAP. On 2026-08-24 an agent on a credential-less checkout hit auth failures on
-// every raw git probe, concluded "no push credential exists", and asked the owner to
-// mint a fine-grained PAT and store it in ~/.git-credentials — the exact anti-pattern
-// the server-mediated publish path (ADR 0055) exists to avoid. The agent was not being
-// careless: on that checkout every direct GitHub probe failed BY DESIGN (the
-// clone token was one-shot and scrubbed from .git/config after each fetch — ADR 0031 §6),
-// so "missing credential" is the only story the local evidence supports, and the true
-// state at the time (branch already pushed, PR open, CI red) was invisible to it.
-// Nothing the session loads says the model out loud. This says it out loud.
-//
-// SO: the third SessionStart truth-teller, beside deploy-divergence.js and
-// strand-watch.js. On the server-publish path (pushVia() 'server' — no authenticated
-// gh, i.e. any credential-less checkout) it prints ONE line stating the
-// credential model and where the truth about published work lives
-// (GET /api/bongos/tasks/:id/publish-status). On a laptop that pushes locally
-// (pushVia() 'local') it prints NOTHING — a line that fires on every healthy laptop
-// becomes wallpaper and the real one gets scrolled past (the strand-watch lesson).
-//
-// STATIC TEXT ONLY. Nothing builder-authored is interpolated, so this adds no
-// prompt-injection surface (the same trust-boundary rule as strand-watch's
-// no-titles) — the test pins the line to the exported constant.
-//
-// Usage:
-//   node scripts/gds/push-path-brief.js          # human-readable: which path + why
-//   node scripts/gds/push-path-brief.js --line   # ONE line or nothing; always exit 0
-//
-// Detection override (tests / forcing): <PREFIX>_PUSH_VIA_SERVER=1 (server) / =0 (local)
-// — BONGOS_PUSH_VIA_SERVER on a vanilla instance; the legacy OTB_ spelling is still read.
-
-const { hasFlag } = require('./cli-lib');
-const { plainCardLines } = require('./plain-cards');
-
-// ---- pure core ---------------------------------------------------------------
-
-const BRIEF = 'This machine holds NO GitHub push credential — BY DESIGN (ADR 0031 §6 / ADR 0055): '
-  + 'git push / ls-remote / fetch against origin fail with auth errors here, and that is not a fault to fix. '
-  + 'Landing is server-mediated — /builder-ship uploads a git bundle and the SERVER pushes, opens the PR, and lands it. '
-  + 'NEVER ask the owner for a PAT or credential; that request is always wrong on this machine. '
-  + 'To see whether work reached GitHub, use GET /api/bongos/tasks/:id/publish-status — never raw git probes. '
-  + 'When a PR is red, that response names the failing tests in merge_driver.failing_tests; '
-  + 'checks_unreadable: true means the check list is blind here, so re-pushing unchanged work cannot help — '
-  + 'run the named test (or npm test) locally, fix it, then ship again.';
-
-// briefLine(via) — the unit-testable core: the SessionStart line for this publish
-// path, or null. Null IS the silence (the laptop case, and the undetermined case —
-// a detection failure must not manufacture a warning).
-function briefLine(via) {
-  return via === 'server' ? BRIEF : null;
-}
-
-// ---- detection ---------------------------------------------------------------
-
-// Lazy require so a broken or partial checkout degrades to silence, not a stack
-// trace injected into the session. pushVia() honors <PREFIX>_PUSH_VIA_SERVER, else
-// probes for an authenticated gh (absent on a credential-less checkout → 'server' instantly).
-function detectVia() {
-  return require('./ship-deploy-target.js').pushVia();
-}
-
-// ---- rendering ---------------------------------------------------------------
-
-function report(via) {
-  console.log('');
-  console.log('  Publish path');
-  console.log('  ──────────────────────────────────────────────────────────');
-  if (via === 'server') {
-    console.log('  server-mediated (no authenticated gh — a credential-less checkout).');
-    console.log(`  ${BRIEF}`);
-    for (const line of plainCardLines('no_push_credential')) console.log(line);
-  } else if (via === 'local') {
-    console.log('  local — this machine pushes with its own git + gh credentials.');
-  } else {
-    console.log('  undetermined — could not probe the publish path on this machine.');
-  }
-  console.log('');
-}
-
-function main() {
-  let via = null;
-  try { via = detectVia(); } catch (_) { via = null; }
-  if (hasFlag('--line')) {
-    // FAIL-OPEN, like the other SessionStart lines: silence on 'local' and on any
-    // detection failure; never a nonzero exit on the path every session rides in on.
-    const l = briefLine(via);
-    if (l) console.log(l);
-    process.exitCode = 0;
-    return;
-  }
-  report(via);
-}
-
-module.exports = { briefLine, BRIEF };
-
-if (require.main === module) main();
+require('../bongos/forwarder.js').forward(module, 'push-path-brief.js');

package/scripts/gds/read-session-export.js

@@ -1,359 +1,7 @@
 #!/usr/bin/env node
-// read-session-export.js — READ a Claude Code `/export` zip, fast.
-//
-// Claude Code's built-in `/export` already produces the zip. This does NOT make
-// another one — it READS the existing one: it cracks the zip, finds the single
-// transcript file (the format is identical every time), and prints a compact,
-// skimmable conversation — your prompts, Claude's THINKING ("the thoughts"),
-// its replies, and one-line tool calls — straight to stdout for the session to
-// read. The ~30 `logs/*.log` debug files (tens of MB) are ignored.
-//
-// The point is reading effectively and swiftly, so the output is trimmed for
-// comprehension, not archived to a file. Thoughts and replies print in full;
-// tool results are clipped (use --full to loosen).
-//
-// Zero dependencies: a tiny ZIP reader on the Node `zlib` stdlib.
-//
-// Usage:
-//   node scripts/gds/read-session-export.js <export.zip>     # read it
-//   node scripts/gds/read-session-export.js --latest         # newest in ~/Downloads
-//   node scripts/gds/read-session-export.js <zip> --thoughts # just the thinking
-//   node scripts/gds/read-session-export.js <zip> --meta     # header summary only
-//   node scripts/gds/read-session-export.js <zip> --full     # don't clip tool results
-//
-// Exit codes: 0 ok · 1 runtime/IO error · 2 bad invocation
-
+// scripts/gds/read-session-export.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/read-session-export.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const zlib = require('node:zlib');
-
-// ───────────────────────── minimal ZIP reader (stdlib only) ─────────────────
-// Random-access via fd: find the end-of-central-directory in the tail, read the
-// central directory for entry sizes/offsets (so we're safe against data-
-// descriptor entries), then inflate only the few entries we actually read —
-// never the giant logs/*.log.
-
-const SIG_EOCD = 0x06054b50;
-const SIG_CEN = 0x02014b50;
-const SIG_LOC = 0x04034b50;
-
-function readFull(fd, buf, position) {
-  let off = 0;
-  while (off < buf.length) {
-    const n = fs.readSync(fd, buf, off, buf.length - off, position + off);
-    if (n === 0) break;
-    off += n;
-  }
-  return off;
-}
-
-function openZip(filePath) {
-  const fd = fs.openSync(filePath, 'r');
-  try {
-    const size = fs.fstatSync(fd).size;
-    const tailLen = Math.min(size, 65557); // max EOCD comment (65535) + 22
-    const tail = Buffer.alloc(tailLen);
-    readFull(fd, tail, size - tailLen);
-    let eocd = -1;
-    for (let i = tail.length - 22; i >= 0; i--) {
-      if (tail.readUInt32LE(i) === SIG_EOCD) { eocd = i; break; }
-    }
-    if (eocd < 0) throw new Error('not a zip archive (no end-of-central-directory record)');
-    const cdEntries = tail.readUInt16LE(eocd + 10);
-    const cdSize = tail.readUInt32LE(eocd + 12);
-    const cdOffset = tail.readUInt32LE(eocd + 16);
-    if (cdOffset === 0xffffffff || cdSize === 0xffffffff || cdEntries === 0xffff) {
-      throw new Error('ZIP64 archives are not supported');
-    }
-    const cd = Buffer.alloc(cdSize);
-    readFull(fd, cd, cdOffset);
-    const entries = [];
-    let p = 0;
-    for (let n = 0; n < cdEntries && p + 46 <= cd.length; n++) {
-      if (cd.readUInt32LE(p) !== SIG_CEN) break;
-      const method = cd.readUInt16LE(p + 10);
-      const nameLen = cd.readUInt16LE(p + 28);
-      const extraLen = cd.readUInt16LE(p + 30);
-      const commentLen = cd.readUInt16LE(p + 32);
-      const localOffset = cd.readUInt32LE(p + 42);
-      const compSize = cd.readUInt32LE(p + 20);
-      const name = cd.toString('utf8', p + 46, p + 46 + nameLen);
-      entries.push({ name, method, compSize, localOffset });
-      p += 46 + nameLen + extraLen + commentLen;
-    }
-    return { fd, entries };
-  } catch (err) {
-    fs.closeSync(fd);
-    throw err;
-  }
-}
-
-function readEntry(fd, entry) {
-  const lh = Buffer.alloc(30);
-  readFull(fd, lh, entry.localOffset);
-  if (lh.readUInt32LE(0) !== SIG_LOC) throw new Error(`bad local header for ${entry.name}`);
-  const nameLen = lh.readUInt16LE(26);
-  const extraLen = lh.readUInt16LE(28);
-  const dataOffset = entry.localOffset + 30 + nameLen + extraLen;
-  const comp = Buffer.alloc(entry.compSize);
-  readFull(fd, comp, dataOffset);
-  if (entry.method === 0) return comp;
-  if (entry.method === 8) return zlib.inflateRawSync(comp);
-  throw new Error(`unsupported compression method ${entry.method}`);
-}
-
-// ───────────────────────── the constant export layout ──────────────────────
-// A `/export` zip is the same shape every time:
-//   metadata.json                       — model, effort, title, cwd, dates
-//   <cliSessionId>.jsonl                — THE transcript (one JSON record/line)
-//   <cliSessionId>/subagents/agent-*.jsonl(+.meta.json)  — subagent transcripts
-//   <cliSessionId>/tool-results/*.txt   — tool outputs too big to inline
-//   logs/*.log                          — app debug logs (ignored)
-
-function loadExport(zipPath) {
-  const { fd, entries } = openZip(zipPath);
-  try {
-    const byName = new Map(entries.map((e) => [e.name, e]));
-    const readText = (e) => readEntry(fd, e).toString('utf8');
-
-    let metadata = {};
-    if (byName.has('metadata.json')) {
-      try { metadata = JSON.parse(readText(byName.get('metadata.json'))); } catch { /* tolerate */ }
-    }
-
-    const topJsonl = entries.filter((e) => e.name.endsWith('.jsonl') && !e.name.includes('/'));
-    const mainEntry = (metadata.cliSessionId && byName.get(`${metadata.cliSessionId}.jsonl`)) || topJsonl[0];
-    if (!mainEntry) throw new Error('no transcript (.jsonl) found in this zip');
-    const records = parseJsonl(readText(mainEntry));
-
-    const subagents = [];
-    for (const e of entries) {
-      if (/\/subagents\/agent-[^/]+\.jsonl$/.test(e.name)) {
-        const metaName = e.name.replace(/\.jsonl$/, '.meta.json');
-        let meta = {};
-        if (byName.has(metaName)) { try { meta = JSON.parse(readText(byName.get(metaName))); } catch { /* tolerate */ } }
-        subagents.push({ meta, records: parseJsonl(readText(e)) });
-      }
-    }
-    const logCount = entries.filter((e) => e.name.startsWith('logs/')).length;
-    return { metadata, records, subagents, logCount };
-  } finally {
-    fs.closeSync(fd); // the reader holds nothing open — everything is in memory now
-  }
-}
-
-function parseJsonl(text) {
-  const out = [];
-  for (const line of text.split('\n')) {
-    const s = line.trim();
-    if (!s) continue;
-    try { out.push(JSON.parse(s)); } catch { /* skip a malformed line */ }
-  }
-  return out;
-}
-
-// ──────────────────────── transcript reduction ─────────────────────────────
-// Reduce raw records to readable turns: user prompts, and assistant turns whose
-// blocks are thinking / text / tool (with the tool's result attached by id).
-// Tool-result-carrier user records are folded into their tool call, not shown
-// as turns. system/queue/last-prompt records are dropped (noise).
-
-function reduce(records) {
-  const toolResults = new Map();
-  for (const r of records) {
-    const c = r.type === 'user' && r.message && r.message.content;
-    if (Array.isArray(c)) {
-      for (const b of c) {
-        if (b && b.type === 'tool_result') toolResults.set(b.tool_use_id, { text: flatten(b.content), isError: !!b.is_error });
-      }
-    }
-  }
-
-  const turns = [];
-  let visible = 0, redacted = 0, tools = 0, prompts = 0;
-  for (const r of records) {
-    if (r.type === 'user') {
-      const c = r.message && r.message.content;
-      if (Array.isArray(c) && c.some((b) => b && b.type === 'tool_result')) continue; // carrier
-      prompts++;
-      turns.push({ role: 'user', text: typeof c === 'string' ? c : flatten(c) });
-    } else if (r.type === 'attachment') {
-      const a = r.attachment || {};
-      turns.push({ role: 'attachment', label: a.fileName || a.name || a.path || a.type || 'attachment' });
-    } else if (r.type === 'assistant') {
-      const blocks = [];
-      for (const b of (r.message && r.message.content) || []) {
-        if (!b || typeof b !== 'object') continue;
-        if (b.type === 'thinking') {
-          if ((b.thinking || '').trim()) { visible++; blocks.push({ k: 'think', text: b.thinking.trim() }); }
-          else { redacted++; blocks.push({ k: 'think_redacted' }); }
-        } else if (b.type === 'redacted_thinking') {
-          redacted++; blocks.push({ k: 'think_redacted' });
-        } else if (b.type === 'text') {
-          if ((b.text || '').trim()) blocks.push({ k: 'text', text: b.text.trim() });
-        } else if (b.type === 'tool_use') {
-          tools++;
-          const res = toolResults.get(b.id);
-          blocks.push({ k: 'tool', name: b.name, input: b.input, result: res ? res.text : null, isError: res ? res.isError : false });
-        }
-      }
-      // Merge into the previous assistant turn — Claude Code streams each block
-      // (think / text / tool) as its own record, so one reply spans several.
-      const last = turns[turns.length - 1];
-      if (last && last.role === 'assistant') last.blocks.push(...blocks);
-      else turns.push({ role: 'assistant', blocks });
-    }
-  }
-  return { turns, stats: { prompts, visible, redacted, tools } };
-}
-
-function flatten(content) {
-  if (typeof content === 'string') return content;
-  if (Array.isArray(content)) return content.map((b) => (typeof b === 'string' ? b : (b && b.text) || '')).join('\n');
-  return content == null ? '' : String(content);
-}
-
-// ──────────────────────────── compact rendering ────────────────────────────
-
-function clip(s, max) {
-  s = (s == null ? '' : String(s)).replace(/\s+$/, '');
-  if (s.length <= max) return s;
-  return `${s.slice(0, max).replace(/\s+\S*$/, '')} … (+${s.length - max} chars)`;
-}
-
-function oneLineInput(name, input) {
-  if (input == null) return '';
-  if (name === 'Bash' && input.command) return '`' + clip(input.command.replace(/\n/g, ' '), 140) + '`';
-  if (input.file_path) return input.file_path;
-  if (input.path) return input.path;
-  if (input.pattern) return `/${input.pattern}/`;
-  if (input.query) return clip(String(input.query), 100);
-  if (input.description) return input.description;
-  const keys = Object.keys(input);
-  return keys.length ? clip(keys.map((k) => `${k}=${JSON.stringify(input[k])}`).join(' '), 120) : '';
-}
-
-function isoOr(ms) {
-  if (!ms && ms !== 0) return '?';
-  try { return new Date(ms).toISOString().slice(0, 16).replace('T', ' '); } catch { return '?'; }
-}
-
-function renderTurns(turns, opts, out, prefix = '') {
-  const resultCap = opts.full ? 4000 : 200;
-  for (const turn of turns) {
-    if (opts.thoughtsOnly && turn.role !== 'assistant') continue;
-
-    if (turn.role === 'user') {
-      out.push(`\n${prefix}## 👤 You`);
-      out.push(`${prefix}${clip(turn.text, 4000) || '_(empty)_'}`);
-    } else if (turn.role === 'attachment') {
-      if (!opts.thoughtsOnly) out.push(`${prefix}📎 _attachment: ${turn.label}_`);
-    } else if (turn.role === 'assistant') {
-      // Redacted thinking adds no readable signal per-block — the header already
-      // reports the count + an all-redacted banner — so it's dropped from the
-      // body to keep the read clean. The reasoning you CAN see is the text + the
-      // tool sequence, which is exactly what we surface.
-      const blocks = (opts.thoughtsOnly
-        ? turn.blocks.filter((b) => b.k === 'think')
-        : turn.blocks).filter((b) => b.k !== 'think_redacted');
-      if (!blocks.length) continue;
-      out.push(`\n${prefix}## 🤖 Claude`);
-      for (const b of blocks) {
-        if (b.k === 'think') { out.push(`\n${prefix}💭 **Thinking**`); out.push(`${prefix}${b.text.replace(/\n/g, `\n${prefix}`)}`); }
-        else if (b.k === 'text') { out.push(`\n${prefix}${b.text.replace(/\n/g, `\n${prefix}`)}`); }
-        else if (b.k === 'tool') {
-          const inp = oneLineInput(b.name, b.input);
-          out.push(`${prefix}🔧 \`${b.name}\`${inp ? ` ${inp}` : ''}${b.isError ? '  ⚠️' : ''}`);
-          if (b.result != null && !opts.thoughtsOnly) {
-            const r = clip(b.result.replace(/^\s+/, ''), resultCap).replace(/\n/g, `\n${prefix}   `);
-            if (r) out.push(`${prefix}   ↳ ${r}`);
-          }
-        }
-      }
-    }
-  }
-}
-
-function render(data, opts) {
-  const m = data.metadata || {};
-  const { turns, stats } = reduce(data.records);
-  const out = [];
-
-  out.push(`# 📄 ${m.title || 'Session'}`);
-  out.push(`${m.model || '?'}${m.effort ? ` · ${m.effort}` : ''} · ${isoOr(m.createdAt)} → ${isoOr(m.lastActivityAt)}`);
-  if (m.cwd) out.push(`cwd: \`${m.cwd}\`${m.branch ? ` · branch \`${m.branch}\`` : ''}`);
-  out.push(`${stats.prompts} prompts · 💭 ${stats.visible} thoughts${stats.redacted ? ` (+${stats.redacted} redacted)` : ''} · 🔧 ${stats.tools} tool calls · ${data.subagents.length} subagents · ${data.logCount} app-logs ignored`);
-  if (stats.visible === 0 && stats.redacted > 0) {
-    out.push(`\n> ⚠️ All thinking in this session is **redacted** — this was an Opus session, and Opus exports carry only encrypted reasoning, not the plaintext thoughts. (Sonnet sessions export readable thinking.)`);
-  }
-
-  if (opts.meta) { process.stdout.write(out.join('\n') + '\n'); return; }
-
-  renderTurns(turns, opts, out);
-
-  for (const sa of data.subagents) {
-    out.push(`\n---\n\n# ⤷ Subagent: ${sa.meta.agentType || 'agent'}${sa.meta.description ? ` — ${sa.meta.description}` : ''}`);
-    const sub = reduce(sa.records);
-    renderTurns(sub.turns, opts, out, '> ');
-  }
-
-  process.stdout.write(out.join('\n') + '\n');
-}
-
-// ───────────────────────────────── CLI ─────────────────────────────────────
-
-function findLatest(dir) {
-  const d = dir || path.join(os.homedir(), 'Downloads');
-  let files;
-  try { files = fs.readdirSync(d); } catch { throw { code: 1, msg: `cannot read directory: ${d}` }; }
-  const cands = files.filter((f) => /^session-export-.*\.zip$/i.test(f))
-    .map((f) => ({ p: path.join(d, f), m: fs.statSync(path.join(d, f)).mtimeMs }))
-    .sort((a, b) => b.m - a.m);
-  if (!cands.length) throw { code: 1, msg: `no session-export-*.zip in ${d}` };
-  return cands[0].p;
-}
-
-const HELP = `read-session-export — read a Claude Code /export zip, fast (the format is the same every time)
-
-  node scripts/gds/read-session-export.js <export.zip>   read it (compact transcript → stdout)
-  node scripts/gds/read-session-export.js --latest       newest session-export-*.zip in ~/Downloads
-  --thoughts   only the thinking blocks (fast reasoning skim)
-  --meta       header summary only (model, dates, counts)
-  --full       don't clip tool results
-  --latest [dir]   pick the newest export in dir (default ~/Downloads)`;
-
-function main() {
-  const argv = process.argv.slice(2);
-  const opts = { zip: null, thoughtsOnly: false, meta: false, full: false, latest: false, latestDir: null };
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === '-h' || a === '--help') { console.log(HELP); return; }
-    else if (a === '--thoughts') opts.thoughtsOnly = true;
-    else if (a === '--meta') opts.meta = true;
-    else if (a === '--full') opts.full = true;
-    else if (a === '--latest') { opts.latest = true; if (argv[i + 1] && !argv[i + 1].startsWith('-')) opts.latestDir = argv[++i]; }
-    else if (a.startsWith('-')) { console.error(`✖ unknown option: ${a}\n\n${HELP}`); process.exit(2); }
-    else opts.zip = a;
-  }
-
-  let zipPath = opts.zip;
-  try { if (opts.latest) zipPath = findLatest(opts.latestDir); }
-  catch (e) { console.error(`✖ ${e.msg || e.message}`); process.exit(e.code || 1); }
-  if (!zipPath) { console.error(`✖ no zip given. Pass a path, or use --latest.\n\n${HELP}`); process.exit(2); }
-  zipPath = path.resolve(zipPath);
-  if (!fs.existsSync(zipPath)) { console.error(`✖ file not found: ${zipPath}`); process.exit(1); }
-
-  try {
-    render(loadExport(zipPath), opts);
-  } catch (e) {
-    console.error(`✖ ${e.message}`);
-    process.exit(1);
-  }
-}
-
-if (require.main === module) main();
-
-module.exports = { loadExport, reduce, render, openZip, readEntry };
+require('../bongos/forwarder.js').forward(module, 'read-session-export.js');