@bongos/core 1.21.175 → 1.21.177

package/tests/cli_dispatcher.mjs

@@ -29,8 +29,8 @@ import http from 'node:http';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const cli = require('../scripts/gds/cli-lib.js');
-const { isConnectionError } = require('../scripts/gds/start.js');
+const cli = require('../scripts/bongos/cli-lib.js');
+const { isConnectionError } = require('../scripts/bongos/start.js');
 
 function incompatError() {
   const cause = new TypeError('invalid onError method');

package/tests/cli_err_code.mjs

@@ -31,7 +31,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { errCode, errDetails } = require(path.join(REPO_ROOT, 'scripts/gds/cli-lib.js'));
+const { errCode, errDetails } = require(path.join(REPO_ROOT, 'scripts/bongos/cli-lib.js'));
 
 // Captured verbatim from cloudbongos.com on 2026-09-22 — not invented.
 const LIVE_ABANDON_SHIPPED = { error: { code: 'cannot_abandon_shipped', message: 'shipped tasks are immutable history' } };
@@ -82,13 +82,13 @@ test('errDetails always returns an object, so callers can destructure safely', (
   }
 });
 
-test('no flat `.error === <string>` comparison survives in scripts/gds', () => {
+test('no flat `.error === <string>` comparison survives in scripts/bongos', () => {
   // The durable half: this is what stops a sixth script reintroducing the bug. It scans
   // source rather than trusting that the sweep was complete — the filed row said 11
   // sites across 6 scripts, a later correction said 4 across 2, and the truth was 8
   // across 5. A count in prose rots; a scan does not.
   const fs = require('node:fs');
-  const dir = path.join(REPO_ROOT, 'scripts/gds');
+  const dir = path.join(REPO_ROOT, 'scripts/bongos');
   const offenders = [];
   for (const f of fs.readdirSync(dir).filter((n) => n.endsWith('.js'))) {
     const src = fs.readFileSync(path.join(dir, f), 'utf8');
@@ -122,7 +122,7 @@ test('no converted branch reads a sibling payload field off the top level', () =
   const MOVED = ['claimWorktree', 'current_status', 'what_to_do', 'required_stage_label', 'required_stage'];
   const offenders = [];
   for (const f of ['abandon.js', 'release.js', 'demote.js', 'setup.js', 'start.js', 'login.js']) {
-    const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts/gds', f), 'utf8');
+    const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts/bongos', f), 'utf8');
     src.split('\n').forEach((line, i) => {
       if (/^\s*(\/\/|\*)/.test(line)) return;
       for (const field of MOVED) {
@@ -138,8 +138,8 @@ test('no converted branch reads a sibling payload field off the top level', () =
 test('every script that compares an error code imports errCode', () => {
   const fs = require('node:fs');
   const missing = [];
-  for (const f of fs.readdirSync(path.join(REPO_ROOT, 'scripts/gds')).filter((n) => n.endsWith('.js'))) {
-    const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts/gds', f), 'utf8');
+  for (const f of fs.readdirSync(path.join(REPO_ROOT, 'scripts/bongos')).filter((n) => n.endsWith('.js'))) {
+    const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts/bongos', f), 'utf8');
     const uses = /\berrCode\s*\(/.test(src);
     const imports = /require\('\.\/cli-lib'\)/.test(src) && /\berrCode\b/.test(src.split('\n').find((l) => l.includes("require('./cli-lib')")) || '');
     if (uses && !imports && f !== 'cli-lib.js') missing.push(f);

package/tests/cli_exit_no_abort.mjs

@@ -13,7 +13,7 @@
 //
 //   Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c, line 76
 //
-// `node scripts/gds/api.js GET /tasks/<id>` reproduced this 5/5: the JSON printed
+// `node scripts/bongos/api.js GET /tasks/<id>` reproduced this 5/5: the JSON printed
 // correctly and THEN the process died with exit 127, so every caller that checks an
 // exit code — CI, shell scripts, the ship pipeline — read a successful command as a
 // failure. Setting process.exitCode and letting the loop drain took it to 0/6.
@@ -38,13 +38,13 @@ import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const API = path.join(ROOT, 'scripts', 'gds', 'api.js');
-const MAIN_AUDIT = path.join(ROOT, 'scripts', 'gds', 'main-audit.js');
-const CLI_LIB = path.join(ROOT, 'scripts', 'gds', 'cli-lib.js');
+const API = path.join(ROOT, 'scripts', 'bongos', 'api.js');
+const MAIN_AUDIT = path.join(ROOT, 'scripts', 'bongos', 'main-audit.js');
+const CLI_LIB = path.join(ROOT, 'scripts', 'bongos', 'cli-lib.js');
 // task 1002592 — the next two CLIs found ABORTING, converted under task 1002734's
 // standing rule (evidence, not a blanket sweep).
-const CLAIM = path.join(ROOT, 'scripts', 'gds', 'claim.js');
-const LAND_WATCH = path.join(ROOT, 'scripts', 'gds', 'land-watch.js');
+const CLAIM = path.join(ROOT, 'scripts', 'bongos', 'claim.js');
+const LAND_WATCH = path.join(ROOT, 'scripts', 'bongos', 'land-watch.js');
 const DEAD_BASE = 'http://127.0.0.1:9'; // discard port — connection refused, instantly
 
 // Point a CLI at a base URL. DERIVED, not hardcoded: instance-config resolves
@@ -351,7 +351,7 @@ test('land-watch.js exits 0 after a REAL request — the teardown that aborted 3
 // The stub refuses with REBASE_REQUIRED, the queue-wide gate, which exits with its
 // own code since task 1004396 (QUEUE_GATED_EXIT) so an unattended caller can tell a
 // gate from a task refusal. The abort this guards against shows as 127 either way.
-const { QUEUE_GATED_EXIT } = createRequire(import.meta.url)('../scripts/gds/claim.js');
+const { QUEUE_GATED_EXIT } = createRequire(import.meta.url)('../scripts/bongos/claim.js');
 
 test('claim.js exits with its refusal code without aborting on a REFUSED claim — measured 3/3 aborting before', async () => {
   const { proc, port } = await startStub({ claimStatus: 409 });

package/tests/cli_lib_formatters.mjs

@@ -1,6 +1,6 @@
 // tests/cli_lib_formatters.mjs
 //
-// Unit test for the PURE display formatters exported from scripts/gds/cli-lib.js
+// Unit test for the PURE display formatters exported from scripts/bongos/cli-lib.js
 // (task 1491). These are the helpers the /builder-* CLI uses to render task rows:
 //   - fmtMinutes(m)   → human duration ("45m", "1h30m", "2h"; null → "—")
 //   - fmtUsd(n)       → "$X.XX" (null → "—")
@@ -13,7 +13,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const cli = require('../scripts/gds/cli-lib.js');
+const cli = require('../scripts/bongos/cli-lib.js');
 
 let passed = 0;
 let failed = 0;

package/tests/cli_sessions.mjs

@@ -26,7 +26,7 @@ import { spawnSync } from 'node:child_process';
 const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 const require = createRequire(import.meta.url);
 const ic  = require(path.join(REPO_ROOT, 'src', 'instance-config.js'));
-const lib = require(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'));
+const lib = require(path.join(REPO_ROOT, 'scripts', 'bongos', 'cli-lib.js'));
 
 // SESSION_PATH is frozen at module load from os.homedir(), so anything touching the real save path
 // runs in a child with its own home directory.
@@ -97,7 +97,7 @@ function inSandbox(body) {
           + ' — this platform does not take the home override, and writing here would clobber the real session store.');
         process.exit(2);
       }
-      const lib=require(R+'/scripts/gds/cli-lib.js');
+      const lib=require(R+'/scripts/bongos/cli-lib.js');
       const ic=require(R+'/src/instance-config.js');
       const fs=require('node:fs'), path=require('node:path');
       (async()=>{ ${body} })().catch((e)=>{ console.error('ERR '+e.message); process.exit(1); });`;
@@ -136,7 +136,7 @@ test('the store anchor is FIXED, not brand-derived — that is the whole fix', (
   // A brand-derived anchor is what split in-repo from standalone in the first place. If someone
   // "helpfully" routes this through configHome() again, the two diverge and the bug is back.
   assert.equal(lib.sessionStoreDir(), path.join(os.homedir(), '.config', ic.FALLBACK_DIR, 'instances'));
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'), 'utf8');
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'cli-lib.js'), 'utf8');
   const body = src.slice(src.indexOf('function sessionStoreDir()'));
   const fn = body.slice(0, body.indexOf('\n}') + 2);
   assert.ok(!/configHome|configDirName|safeBrand/.test(fn), `sessionStoreDir must not read the brand:\n${fn}`);
@@ -255,7 +255,7 @@ test('a corrupt store entry is skipped, never fatal', () => {
 // ── 3. Switching back ───────────────────────────────────────────────────────────────────────
 
 test('login VERIFIES a stored token before trusting it, and can be forced past', () => {
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'login.js'), 'utf8');
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'login.js'), 'utf8');
   // A stored token may be expired or revoked. Reinstating one unchecked would leave the builder
   // "signed in" to a session every later command then fails on.
   assert.match(src, /loadStoredSession\(base\)/);
@@ -265,7 +265,7 @@ test('login VERIFIES a stored token before trusting it, and can be forced past',
 });
 
 test('login names the other instances and how to move between them', () => {
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'login.js'), 'utf8');
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'login.js'), 'utf8');
   assert.match(src, /function logOtherInstances/);
   assert.match(src, /Also signed in to/);
   // Terminal reader: no slash command may appear in that guidance (task 1003730's rule).

package/tests/cli_surface.mjs

@@ -17,7 +17,7 @@ import { createRequire } from 'node:module';
 
 const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 const require = createRequire(import.meta.url);
-const surface = require(path.join(REPO_ROOT, 'scripts', 'gds', 'surface.js'));
+const surface = require(path.join(REPO_ROOT, 'scripts', 'bongos', 'surface.js'));
 
 const AGENT_ENV = {};
 const TERM_ENV = { BONGOS_SURFACE: 'terminal' };
@@ -40,7 +40,7 @@ test('terminal is opt-in, case- and space-insensitive', () => {
 test('the surface is never inferred from isTTY', () => {
   // A Claude Code session's stdout is not a TTY either, so TTY-sniffing would classify every
   // agent run as a terminal and break the card contract. The module must not consult it.
-  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'surface.js'), 'utf8');
+  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'surface.js'), 'utf8');
   const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
   assert.ok(!/isTTY/.test(code), 'surface.js must not branch on isTTY');
 });
@@ -93,7 +93,7 @@ test('no trailing whitespace on a terminal row', () => {
 // ── 3. The call sites ───────────────────────────────────────────────────────────────────────
 
 test('start.js routes every reader-facing idiom through the surface', () => {
-  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'start.js'), 'utf8');
+  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'start.js'), 'utf8');
   const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
 
   // Two exemptions, both agent-only BY CONSTRUCTION:
@@ -114,7 +114,7 @@ test('start.js routes every reader-facing idiom through the surface', () => {
 });
 
 test('the card directive is suppressed for a terminal reader', () => {
-  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'start.js'), 'utf8');
+  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'start.js'), 'utf8');
   assert.match(
     src,
     /function emitCardDirective\(form\) \{[\s\S]{0,400}?surface\.isTerminal\(\)\) return;/,
@@ -141,7 +141,7 @@ test('the skills still invoke the scripts directly, which is what keeps agents o
   // surface and the card contract would break with no test failing anywhere else.
   const fs = require('node:fs');
   const skill = fs.readFileSync(path.join(REPO_ROOT, '.claude', 'skills', 'builder-start', 'SKILL.md'), 'utf8');
-  assert.match(skill, /node scripts\/gds\/start\.js/, 'builder-start must call the script directly');
+  assert.match(skill, /node scripts\/(?:gds|bongos)\/start\.js/, 'builder-start must call the script directly');
 });
 
 // ── 4. The rest of the shipped CLI, not just start.js (task 1003730) ────────────────────────
@@ -156,12 +156,12 @@ import fs from 'node:fs';
 // Every script a TERMINAL reader can actually invoke, read out of bin/bongos.js's verb
 // table so a newly-added verb is covered the day it lands.
 //
-// This used to read the FILES manifest of scripts/gds/build-cli-package.js. That package
+// This used to read the FILES manifest of scripts/bongos/build-cli-package.js. That package
 // (@cloudbongos/cli) was retired with the manifest (task 1004144), but the rule it fed
 // did not go with it: a script that prints a `/builder-*` slash command to someone in a
 // terminal is telling them to run something they do not have.
 //
-// The verb table is the right heir, not `readdirSync` of scripts/gds/. What made the old
+// The verb table is the right heir, not `readdirSync` of scripts/bongos/. What made the old
 // set meaningful was never "these files were published" — it was "a terminal user can
 // reach these", and the dispatcher's VERBS is exactly that set today. Scanning the whole
 // directory instead looks stricter and is actually a different test: it immediately
@@ -170,7 +170,7 @@ import fs from 'node:fs';
 // findings imported into a packaging task rather than a stronger guard.
 function shippedScripts() {
   const src = fs.readFileSync(path.join(REPO_ROOT, 'bin', 'bongos.js'), 'utf8');
-  const out = [...new Set([...src.matchAll(/script:\s*'([A-Za-z0-9._-]+\.js)'/g)].map((m) => `scripts/gds/${m[1]}`))].sort();
+  const out = [...new Set([...src.matchAll(/script:\s*'([A-Za-z0-9._-]+\.js)'/g)].map((m) => `scripts/bongos/${m[1]}`))].sort();
   // A scan that matches nothing passes every assertion below for free.
   assert.ok(out.length > 10, `only ${out.length} verb script(s) found in bin/bongos.js — the scan is reading the wrong shape`);
   return out;
@@ -180,7 +180,7 @@ function shippedScripts() {
 // everything it wrote. HOME is pointed at nothing so no real session can satisfy requireSession.
 function runGuidance(fn, env) {
   const code =
-    `const l=require(${JSON.stringify(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'))});` +
+    `const l=require(${JSON.stringify(path.join(REPO_ROOT, 'scripts', 'bongos', 'cli-lib.js'))});` +
     `Promise.resolve(l[${JSON.stringify(fn)}]()).catch(()=>{});`;
   // HOME ALONE IS NOT ISOLATION ON WINDOWS (task 1003941). cli-lib resolves the
   // session through os.homedir(), which on win32 reads USERPROFILE and ignores
@@ -225,7 +225,7 @@ test('no guidance path speaks slash commands to a terminal reader', () => {
     const out = guidanceOutput(fn, { BONGOS_SURFACE: 'terminal' });
     const leaks = [...out.matchAll(/\/builder-[a-z-]+/g)].map((m) => m[0]);
     assert.deepEqual(leaks, [], `${fn} leaked to a terminal reader: ${leaks.join(', ')}\n${out}`);
-    assert.ok(!/node scripts\/gds\//.test(out), `${fn} told a terminal reader to run a repo script:\n${out}`);
+    assert.ok(!/node scripts\/(?:gds|bongos)\//.test(out), `${fn} told a terminal reader to run a repo script:\n${out}`);
   }
 });
 
@@ -241,10 +241,10 @@ test('every shipped script that names a slash command routes it through the surf
   // branches, require that any shipped file printing one also consults the switch — and pin the
   // set, so a NEW unguarded file fails here instead of on a newcomer's laptop.
   const ALLOWED = new Set([
-    'scripts/gds/cli-lib.js',        // agent side of the three branches, proven above
-    'scripts/gds/setup.js',          // re-run + newcomer-path lines, asserted below
-    'scripts/gds/surface.js',        // the switch itself
-    'scripts/gds/start.js',          // section 3's documented agent-only exemptions
+    'scripts/bongos/cli-lib.js',        // agent side of the three branches, proven above
+    'scripts/bongos/setup.js',          // re-run + newcomer-path lines, asserted below
+    'scripts/bongos/surface.js',        // the switch itself
+    'scripts/bongos/start.js',          // section 3's documented agent-only exemptions
   ]);
   const offenders = [];
   for (const rel of shippedScripts()) {
@@ -260,7 +260,7 @@ test('every shipped script that names a slash command routes it through the surf
 });
 
 test('setup.js routes its newcomer path and re-run lines through the surface', () => {
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'setup.js'), 'utf8');
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'bongos', 'setup.js'), 'utf8');
   // The completion footer is the worst possible place for a wrong command: it is the first thing
   // a brand-new builder reads after registering.
   assert.match(src, /Survey work:\s*\$\{surfaceAction\('start'\)\}/, 'the newcomer path must use surfaceAction');

package/tests/cli_token_reissue.mjs

@@ -39,7 +39,7 @@ function t(name, fn) {
 console.log('paste-token.js merge invariants:');
 
 function mergeSession(existing, freshMe, freshToken, apiBase) {
-  // MUST match the implementation in scripts/gds/paste-token.js (function main,
+  // MUST match the implementation in scripts/bongos/paste-token.js (function main,
   // step 3). If the script changes, this test will diverge — that's the point.
   return {
     ...existing,
@@ -164,7 +164,7 @@ t('returns a paste_command field the portal can show verbatim', () => {
 
 // The regression this pins (task 1003961): paste_command is composed on the SERVER
 // and run on an INSTANCE, where the core is an installed dependency and there is no
-// `scripts/gds/` directory. Emitting a repo-relative script path handed every
+// `scripts/bongos/` directory. Emitting a repo-relative script path handed every
 // instance builder a command naming a file they did not have. A verb has no such
 // coupling — `bongos` is on PATH wherever the core is installed.
 t('paste_command names a CLI VERB, never a filesystem path', () => {

package/tests/client_baseurl_guard.mjs

@@ -16,7 +16,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { checkClientBaseUrl, scanPages } = require('../scripts/gds/client-baseurl-guard.js');
+const { checkClientBaseUrl, scanPages } = require('../scripts/bongos/client-baseurl-guard.js');
 
 let passed = 0;
 let failed = 0;

package/tests/client_bundle_route.mjs

@@ -2,7 +2,7 @@
 //
 // The generated typed client is served to classic <script> web pages at
 // /lib/bongos-client.js (task 1996 / R09). This guards that serve-internal
-// actually serves the COMMITTED browser-global build there — with the right
+// actually serves the browser-global build there — with the right
 // MIME + the BongosClient global — so the hall/status pages can consume the same
 // client the CLI uses. serve-internal is DB-free (the pg pool connects lazily),
 // so we mount it on a throwaway express app and hit the route over loopback.
@@ -13,6 +13,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -34,14 +35,44 @@ async function withServer(fn) {
   }
 }
 
-test('/lib/bongos-client.js serves the committed browser-global build', async () => {
+// task 1004866: the client is gitignored, so a fresh checkout has no file on disk. The
+// route serves the packaged file when there is one, else a client generated from the
+// live routes — so the expected bytes are whichever of those this checkout resolves to.
+const BUNDLE = path.join(ROOT, 'clients/bongos-client/bongos-client.global.js');
+
+test('/lib/bongos-client.js serves the browser-global build (file, else generated)', async () => {
+  const { generateClientBundleJs } = require('../src/bongos/serve-internal.js');
   await withServer(async (base) => {
     const res = await fetch(base + '/lib/bongos-client.js');
     assert.equal(res.status, 200);
     assert.match(res.headers.get('content-type') || '', /javascript/);
     const body = await res.text();
-    const onDisk = fs.readFileSync(path.join(ROOT, 'clients/bongos-client/bongos-client.global.js'), 'utf8');
-    assert.equal(body, onDisk, 'served bytes must equal the committed bundle (single source of truth)');
+    const expected = fs.existsSync(BUNDLE) ? fs.readFileSync(BUNDLE, 'utf8') : generateClientBundleJs();
+    assert.equal(body, expected, 'served bytes must equal the resolved bundle (single source of truth)');
     assert.match(body, /global\.BongosClient =/, 'bundle exposes window.BongosClient');
   });
 });
+
+test('the generate tier is the same client the generators write (fresh checkout)', () => {
+  const { generateClientBundleJs } = require('../src/bongos/serve-internal.js');
+  const { buildApiArtifacts } = require('../scripts/bongos/api-artifacts.js');
+  assert.equal(generateClientBundleJs(), buildApiArtifacts()['clients/bongos-client/bongos-client.global.js']);
+});
+
+test('resolveClientBundleJs: absent file → generated; present → the file; all fail → empty', () => {
+  const { resolveClientBundleJs } = require('../src/bongos/serve-internal.js');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'client-bundle-'));
+  try {
+    const missing = path.join(tmp, 'nope.js');
+    assert.equal(resolveClientBundleJs({ candidates: [missing], generate: () => 'GEN' }), 'GEN',
+      'a fresh checkout (no file) must fall through to in-process generation');
+    const present = path.join(tmp, 'bundle.js');
+    fs.writeFileSync(present, 'FILE');
+    assert.equal(resolveClientBundleJs({ candidates: [present], generate: () => 'GEN' }), 'FILE',
+      'a packaged file wins over generation');
+    assert.equal(resolveClientBundleJs({ candidates: [missing], generate: () => { throw new Error('x'); } }), '',
+      'a failing generator yields empty (→ 404), never a throw at boot');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});

package/tests/cloud_bongos_pack.mjs

@@ -43,7 +43,7 @@ test('R74: the vanilla pack carries the Cloud Bongos LOOK (chrome palette, Manro
   assert.match(c.theme.fonts.display, /Manrope/);
   assert.match(c.theme.fonts.body, /Manrope/);
   assert.ok(c.theme.fonts.links.some((l) => /JetBrains\+Mono/.test(l) && /Manrope/.test(l)), 'loads Manrope + JetBrains Mono');
-  assert.match(c.theme.favicon, /circle/, 'bongo-pair favicon (circles), not the Greek Α');
+  assert.match(c.theme.favicon, /circle/, 'the moon-in-the-gap favicon (circles), not the Greek Α');
   assert.doesNotMatch(c.theme.favicon, /font-family='serif'>Α/);
   // the backdrop is the TOKEN, not a hex: the served body follows the mode,
   // because the sheets' dark blocks are (0,2,0) and outrank the injected :root.

package/tests/community_leaderboard_db.mjs

@@ -12,7 +12,7 @@
 // under test.
 //
 // Real-DB integration test: self-skips without a reachable Postgres; in the
-// INTEGRATION set (scripts/gds/run-unit-tests.js) so the DB-free lane never runs it.
+// INTEGRATION set (scripts/bongos/run-unit-tests.js) so the DB-free lane never runs it.
 //
 // Run:  DATABASE_URL=... node tests/community_leaderboard_db.mjs
 

package/tests/conductor.mjs

@@ -208,34 +208,34 @@ test('outside-touches does NOT fire when the claim has empty touches[] (fresh ta
 // named. Under the pool this fired with ONE file; it must name both.
 test('outside-touches ignores a CONCURRENT claim\'s touches[] — the under-report', () => {
   const a = conductor.evaluateTriggers({
-    changedFiles: ['modules/hall-ui/public/studio.js', 'scripts/gds/ship.js', 'docs/adr/0280-x.md'],
+    changedFiles: ['modules/hall-ui/public/studio.js', 'scripts/bongos/ship.js', 'docs/adr/0280-x.md'],
     prompt: 'edits',
     activeClaims: [
       { task_id: 1, title: 'mine', touches: ['modules/hall-ui/public/studio.js'], worktree_name: 'task-1' },
-      { task_id: 2, title: 'theirs', touches: ['scripts/gds/', 'src/bongos/', 'modules/', 'clients/'], worktree_name: 'task-2' },
+      { task_id: 2, title: 'theirs', touches: ['scripts/bongos/', 'src/bongos/', 'modules/', 'clients/'], worktree_name: 'task-2' },
     ],
     worktree: 'task-1',
   });
   const outside = a.find((x) => x.id === 'outside-touches');
   assert.ok(outside, 'expected outside-touches advisory');
   // studio.js is covered by MY claim; the other two are not covered by anything
-  // of mine. Under the pool, `modules/` and `scripts/gds/` swallowed them and
+  // of mine. Under the pool, `modules/` and `scripts/bongos/` swallowed them and
   // the line read "1 changed file(s)".
   assert.match(outside.text, /^2 changed file\(s\)/, 'both uncovered files must be counted, not one');
 });
 
 test('outside-touches counts only what MY claim fails to cover', () => {
   const a = conductor.evaluateTriggers({
-    changedFiles: ['modules/hall-ui/public/studio.js', 'scripts/gds/ship.js', 'docs/adr/0280-x.md'],
+    changedFiles: ['modules/hall-ui/public/studio.js', 'scripts/bongos/ship.js', 'docs/adr/0280-x.md'],
     prompt: 'edits',
     activeClaims: [
       { task_id: 1, title: 'mine', touches: ['modules/hall-ui/public/studio.js'], worktree_name: 'task-1' },
-      { task_id: 2, title: 'theirs', touches: ['scripts/gds/', 'modules/'], worktree_name: 'task-2' },
+      { task_id: 2, title: 'theirs', touches: ['scripts/bongos/', 'modules/'], worktree_name: 'task-2' },
     ],
     worktree: 'task-1',
   });
   const outside = a.find((x) => x.id === 'outside-touches');
-  assert.match(outside.text, /scripts\/gds\/ship\.js/, "the other claim's directory must not cover my diff");
+  assert.match(outside.text, /scripts\/(?:gds|bongos)\/ship\.js/, "the other claim's directory must not cover my diff");
   assert.match(outside.text, /docs\/adr\/0280-x\.md/);
   assert.doesNotMatch(outside.text, /studio\.js/, 'my own declared file is still covered');
 });
@@ -245,10 +245,10 @@ test('outside-touches counts only what MY claim fails to cover', () => {
 // number derived from another claim's touches[] is the defect, not a degraded
 // version of it. Trigger 1 still covers having no claim at all.
 test('outside-touches is SILENT when no claim is bound to this worktree', () => {
-  const claims = [{ task_id: 2, title: 'theirs', touches: ['scripts/gds/'], worktree_name: 'task-2' }];
+  const claims = [{ task_id: 2, title: 'theirs', touches: ['scripts/bongos/'], worktree_name: 'task-2' }];
   for (const worktree of ['cloud-bongos', null, undefined, '']) {
     const a = conductor.evaluateTriggers({
-      changedFiles: ['server.js', 'scripts/gds/ship.js'], prompt: 'edits', activeClaims: claims, worktree,
+      changedFiles: ['server.js', 'scripts/bongos/ship.js'], prompt: 'edits', activeClaims: claims, worktree,
     });
     assert.ok(!ids(a).includes('outside-touches'), `unbound tree (${String(worktree)}) must not borrow another claim's touches[]`);
   }
@@ -436,7 +436,7 @@ test('render: showDispatch=false emits the milder already-reviewed form', () =>
 });
 
 // pickSpecialists lives in the dispatcher CLI (pure, exported).
-const dispatch = require('../scripts/gds/conductor-dispatch.js');
+const dispatch = require('../scripts/bongos/conductor-dispatch.js');
 
 test('pickSpecialists: hacker when a security surface is in the diff', () => {
   assert.deepEqual(dispatch.pickSpecialists(['src/bongos/routes/tasks.js']), ['hacker']);
@@ -453,9 +453,9 @@ test('pickSpecialists: nothing auto-picked when no security surface changed', ()
 test('bestMatchingClaim: picks the claim whose touches[] best overlap the diff', () => {
   const claims = [
     { task_id: 415, touches: ['migrations/'] },                       // 0 overlap
-    { task_id: 439, touches: ['scripts/gds/conductor-dispatch.js', '.claude/hooks/conductor.js'] }, // 2
+    { task_id: 439, touches: ['scripts/bongos/conductor-dispatch.js', '.claude/hooks/conductor.js'] }, // 2
   ];
-  const changed = ['scripts/gds/conductor-dispatch.js', '.claude/hooks/conductor.js'];
+  const changed = ['scripts/bongos/conductor-dispatch.js', '.claude/hooks/conductor.js'];
   assert.equal(dispatch.bestMatchingClaim(claims, changed).task_id, 439);
 });
 
@@ -493,7 +493,7 @@ const CLAIM_1003704 = {
   task_id: '1003704',
   title: 'C3b: rename gds-session.json and the gds_session cookie',
   worktree_name: 'task-1003704',
-  touches: ['scripts/gds/', 'src/bongos/', 'modules/', 'clients/'],
+  touches: ['scripts/bongos/', 'src/bongos/', 'modules/', 'clients/'],
 };
 const CLAIM_1003829 = {
   task_id: '1003829',
@@ -542,10 +542,10 @@ test('attribution: specificity beats breadth, so the honest touches[] no longer
 
 test('attribution: volume still counts — a genuinely broad claim keeps its diff', () => {
   // Specificity must not invert the heuristic: a rename touching fifty files
-  // under scripts/gds/ should not lose to a claim sharing one exact file.
-  const broad = { task_id: 'broad', touches: ['scripts/gds/'] };
-  const narrow = { task_id: 'narrow', touches: ['scripts/gds/one.js'] };
-  const files = Array.from({ length: 50 }, (_, i) => `scripts/gds/f${i}.js`).concat('scripts/gds/one.js');
+  // under scripts/bongos/ should not lose to a claim sharing one exact file.
+  const broad = { task_id: 'broad', touches: ['scripts/bongos/'] };
+  const narrow = { task_id: 'narrow', touches: ['scripts/bongos/one.js'] };
+  const files = Array.from({ length: 50 }, (_, i) => `scripts/bongos/f${i}.js`).concat('scripts/bongos/one.js');
   assert.equal(dispatch.attributeClaim([narrow, broad], files, null).claim.task_id, 'broad');
 });
 
@@ -687,7 +687,7 @@ test('selectAutonomousDispatch: GO + feed → picks rows[0] and shapes the claim
   );
   assert.equal(r.ok, true);
   assert.equal(r.task.id, 458, 'takes the top (already-ordered, protected-filtered) row');
-  assert.equal(r.command, 'node scripts/gds/claim.js 458');
+  assert.equal(r.command, 'node scripts/bongos/claim.js 458');
   assert.match(r.directive, /#458/);
   assert.match(r.directive, /\/builder-ship/);
 });
@@ -720,7 +720,7 @@ test('autoDispatch: GO → fetches the autonomous feed and emits a directive', a
   assert.deepEqual(feedOpts, { fit: 'autonomous' }, 'asks for the protected-filtered autonomous feed');
   assert.equal(out.ok, true);
   assert.equal(out.task.id, 458);
-  assert.equal(out.command, 'node scripts/gds/claim.js 458');
+  assert.equal(out.command, 'node scripts/bongos/claim.js 458');
 });
 
 test('autoDispatch: a thrown precheck degrades to NO-GO (fail-safe, no dispatch)', async () => {

package/tests/conflict_resolve.mjs

@@ -139,7 +139,7 @@ test('the otb-regen driver is pinned to the server checkout, not the clone', asy
   await cr.resolveBranchConflicts({ branch: 'claude/wt-1' }, deps);
   const script = deps._regOpts[0] && deps._regOpts[0].driverScript;
   assert.ok(script, 'registration must pass a driverScript');
-  assert.equal(path.resolve(script), path.resolve('/srv/repo', 'scripts', 'gds', 'git-merge-regen.js'));
+  assert.equal(path.resolve(script), path.resolve('/srv/repo', 'scripts', 'bongos', 'git-merge-regen.js'));
   assert.ok(!path.resolve(script).startsWith(path.resolve('/tmp/otb-resolve-test')), 'never inside the clone');
 });
 
@@ -558,25 +558,26 @@ test('1003546 a failing post-merge commit is reported, not pushed', async () =>
 // to the first and not the second, so the copy registry was "covered" by the driver
 // and regenerated by nobody. Pin them as one set, via each artifact's PRODUCER.
 test('1003546 every REGENERABLE artifact has a producer, and every producer is in GENERATOR_SCRIPTS', async () => {
-  const regen = require('../scripts/gds/git-merge-regen.js');
-  const G = require('../scripts/gds/gen-repo-map.js');
-  const CI = require('../scripts/gds/copy-inventory.js');
+  const regen = require('../scripts/bongos/git-merge-regen.js');
+  const G = require('../scripts/bongos/gen-repo-map.js');
+  const CI = require('../scripts/bongos/copy-inventory.js');
 
   // Derived from each generator's own exports where it publishes them, so this map
   // cannot silently drift from the generator it names.
   const PRODUCED_BY = new Map([
-    ['docs/repo-map.md', 'scripts/gds/gen-repo-map.js'],
-    ['docs/file-map.md', 'scripts/gds/gen-file-map.js'],
-    ['docs/session-log-index.md', 'scripts/gds/gen-session-index.js'],
+    ['docs/repo-map.md', 'scripts/bongos/gen-repo-map.js'],
+    ['docs/file-map.md', 'scripts/bongos/gen-file-map.js'],
+    ['docs/session-log-index.md', 'scripts/bongos/gen-session-index.js'],
     // task 1001431 — the ROOT CLAUDE.md joined REGENERABLE for its §13 snippet block.
     // gen-session-index.js writes BOTH the (gitignored) whole index and that tracked
     // snippet, and it is already in GENERATOR_SCRIPTS, so the server's post-merge
     // regeneration covers the new entry with no change to the generator list.
-    ['CLAUDE.md', 'scripts/gds/gen-session-index.js'],
-    [CI.REGISTRY_REL, 'scripts/gds/copy-inventory.js'],
-    [CI.REPORT_REL, 'scripts/gds/copy-inventory.js'],
-    ...G.NESTED_DIRS.map((d) => [`${d}/CLAUDE.md`, 'scripts/gds/gen-repo-map.js']),
-    // task 1003537 — the generated API contract + client joined REGENERABLE. Mapped by
+    ['CLAUDE.md', 'scripts/bongos/gen-session-index.js'],
+    [CI.REGISTRY_REL, 'scripts/bongos/copy-inventory.js'],
+    [CI.REPORT_REL, 'scripts/bongos/copy-inventory.js'],
+    ...G.NESTED_DIRS.map((d) => [`${d}/CLAUDE.md`, 'scripts/bongos/gen-repo-map.js']),
+    // task 1003537 — the generated API pointer stub is in REGENERABLE (the spec, reference
+    // and client left it under task 1004866: gitignored, nothing to heal). Mapped by
     // PATH PREFIX rather than by calling the generators: this suite deliberately sets
     // *_INSTANCE_ROOT (see the env-hardening case above), which repoints their docs root
     // at a fake server checkout, so a build() here reads a file that does not exist.
@@ -585,10 +586,7 @@ test('1003546 every REGENERABLE artifact has a producer, and every producer is i
     // under either prefix is picked up here automatically.
     ...[...regen.REGENERABLE]
       .filter((p) => p.startsWith('docs/api/') || p === 'docs/api-reference.md' || p === 'docs/routes-permissions.md')
-      .map((p) => [p, 'scripts/gds/gen-api-docs.js']),
-    ...[...regen.REGENERABLE]
-      .filter((p) => p.startsWith('clients/bongos-client/'))
-      .map((p) => [p, 'scripts/gds/gen-api-client.js']),
+      .map((p) => [p, 'scripts/bongos/gen-api-docs.js']),
   ]);
 
   // task 1004775 — docs/page-readings.json is merged per page FROM THE THREE MERGE