@bongos/core 1.21.175 → 1.21.177

package/scripts/bongos/feedback-send.js

@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+// Send feedback about Bongos itself to the Cloud Bongos maintainers (tasks 1004462, 1004591).
+//
+// Usage:
+//   bongos feedback "the claim command hung for two minutes"
+//   bongos feedback --idea "let me filter the task list by goal"
+//   bongos feedback --message-file notes.md      (or --message-file - for stdin)
+//   [--wait]   send in the foreground and print the outcome (debugging)
+//
+// Straight to the hub, never through the project: a project with no hub link can
+// still send. The builder's OWN project vouches for who sent it — the CLI asks it
+// for a one-time receipt (src/bongos/routes/feedback.js) and the hub redeems that
+// receipt before filing (modules/platform-identity/instance-feedback.js). So a
+// signed-in builder does nothing extra.
+//
+// Fast and quiet by design (the owner, 2026-10-06): the command prints one line
+// and returns at once; a detached background process sends to the hub. The one
+// call made in the foreground is the receipt from the builder's own project, so
+// "Sent" is never printed for a report the project could not vouch for (task
+// 1004759: a project on an older core has no receipt door, and the background
+// 404 was invisible). No task number comes back. Only the typed text
+// (secret-scrubbed) and version stamps travel.
+
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { spawn } = require('node:child_process');
+const { cliClient, requireSession, loadSessionSync, argText, hasFlag, errCode, cliExit } = require('./cli-lib');
+const ic = require('../../src/instance-config');
+
+const USAGE = [
+  'usage:',
+  '  npx bongos feedback "what went wrong"          report a problem with Bongos',
+  '  npx bongos feedback --idea "what you wish for" suggest an improvement',
+  '  npx bongos feedback --message-file notes.md    send a longer note from a file (- for stdin)',
+  '',
+  'Goes to the Cloud Bongos maintainers. Only the text you type and the Bongos',
+  'versions you run are sent — no code, chat or files from your project.',
+].join('\n');
+
+const SENT_LINE = 'Sent to the Bongos team.';
+const REPEAT_WINDOW_MS = 6 * 60 * 60 * 1000;
+
+// Plain lines for the refusals the builder can see (everything else happens in
+// the background and is written to the outcome file, never to the terminal).
+const REFUSALS = {
+  message_required: 'Nothing to send — add your feedback after the command, in quotes.',
+  too_long: 'That is too long to send — keep it under 4,000 characters, or split it into two.',
+  local_only: 'This project runs only on your computer, so Cloud Bongos cannot confirm who sent the report. Nothing was sent.',
+  no_scrubber: 'Feedback was not sent: the secret filter that checks every report is missing from this install.',
+  project_too_old: "Not sent: this project's live site runs an older Bongos that cannot send feedback yet. It will work once the project is upgraded.",
+  receipt_failed: "Not sent: this project's live site did not confirm who sent it",
+};
+
+function stateDir() { return path.join(os.homedir(), '.config', ic.FALLBACK_DIR || 'cloudbongos'); }
+
+// The CLI release, as `bongos version` reports it. Read from disk, never required.
+function cliVersion() {
+  for (const rel of ['../../config/bongos-cli.json', '../../package.json']) {
+    try {
+      const f = path.join(__dirname, rel);
+      if (fs.existsSync(f)) { const v = JSON.parse(fs.readFileSync(f, 'utf8')).version; if (v) return v; }
+    } catch { /* try the next */ }
+  }
+  return null;
+}
+
+// The message: --message / --message-file (incl. - for stdin), else every
+// positional word joined, else whatever was piped in.
+function readMessage(args, io = {}) {
+  if (args.includes('--message') || args.includes('--message-file')) return argText('--message', args, io).value || '';
+  const words = args.filter((a) => !a.startsWith('--')).join(' ');
+  if (words) return words;
+  const stdinIsPiped = io.stdinIsPiped !== undefined ? io.stdinIsPiped : !process.stdin.isTTY;
+  if (!stdinIsPiped) return '';
+  try { return (io.readStdin || (() => fs.readFileSync(0, 'utf8')))(); } catch { return ''; }
+}
+
+// Every report goes through the transcript-grade secret scrubber before it leaves
+// this machine (task 1004467). FAIL CLOSED: no scrubber, nothing is sent.
+function scrubReport(message, env = process.env) {
+  let scrub;
+  try { scrub = require('../../modules/security/secret-scrub.js'); } catch { return null; }
+  const text = scrub.scrubSecrets(message, scrub.collectEnvSecrets(env));
+  const removed = text.split(scrub.REDACTED).length - message.split(scrub.REDACTED).length;
+  return { text, removed };
+}
+
+// A project the hub cannot reach can never vouch for a report — say so up front
+// rather than send something that is certain to be dropped.
+function isLocalBase(base) {
+  let host;
+  try { host = new URL(base).hostname.toLowerCase(); } catch { return true; }
+  if (require('node:net').isIP(host.replace(/^\[|\]$/g, ''))) return true;
+  return !host.includes('.') || /(^|\.)(localhost|local|internal|test|invalid)$/.test(host);
+}
+
+// Repeat guard: the same report (same first line) inside REPEAT_WINDOW_MS is not
+// sent twice, so an assistant filing on every rant cannot spam the maintainers.
+function repeatKey(message) {
+  const first = String(message).split('\n').map((l) => l.trim().toLowerCase()).find(Boolean) || '';
+  return crypto.createHash('sha256').update(first).digest('hex').slice(0, 16);
+}
+// `record: false` only looks: the CLI records a report once its project has
+// vouched for it, so a report that never left is not "already sent" (task 1004759).
+function checkAndRecordRepeat(message, { file = path.join(stateDir(), 'feedback-sent.json'), now = Date.now(), record = true } = {}) {
+  let seen = {};
+  try { seen = JSON.parse(fs.readFileSync(file, 'utf8')) || {}; } catch { /* first report */ }
+  for (const [k, t] of Object.entries(seen)) if (!(now - t < REPEAT_WINDOW_MS)) delete seen[k];
+  const key = repeatKey(message);
+  if (Object.prototype.hasOwnProperty.call(seen, key)) return true;
+  if (!record) return false;
+  seen[key] = now;
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(seen), { mode: 0o600 });
+  } catch { /* a guard that cannot write still lets the report through */ }
+  return false;
+}
+
+// requestReceipt — the project vouches for this exact text. Foreground: one call
+// to the builder's own project. A 404 means the project's core predates the
+// receipt door (task 1004591), which no retry fixes until it is upgraded.
+async function requestReceipt({ message, kind }, deps = {}) {
+  const api = deps.api || await cliClient();
+  const base = deps.base || ic.resolveApiBase({ session: loadSessionSync() });
+  const sha256 = crypto.createHash('sha256').update(message, 'utf8').digest('hex');
+  const r = await api.request('POST', '/feedback/receipt', { body: { sha256, kind } });
+  if (!r.ok) return { ok: false, step: 'receipt', code: r.status === 404 ? 'project_too_old' : (errCode(r.data) || `http_${r.status}`) };
+  const origin = new URL(base).origin;
+  const hub = String((r.data && r.data.hub) || origin).replace(/\/+$/, '');
+  return { ok: true, receipt: r.data.receipt, origin, hub };
+}
+
+// sendToHub — the vouched report straight to the hub. Returns an outcome
+// object; never prints. Runs in the background child.
+async function sendToHub({ message, kind, receipt, origin, hub }, deps = {}) {
+  const doFetch = deps.fetchImpl || fetch;
+  const res = await doFetch(`${hub}/api/bongos/sso/feedback/direct`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({
+      origin, receipt, message, kind,
+      context: { cli_version: cliVersion(), os: `${os.platform()} ${os.release()}` },
+    }),
+    signal: AbortSignal.timeout(15000),
+  });
+  if (res.status === 202) return { ok: true, hub };
+  let body = null;
+  try { body = await res.json(); } catch { /* non-JSON */ }
+  return { ok: false, step: 'hub', code: errCode(body) || `http_${res.status}` };
+}
+
+// deliver — both halves in one go.
+async function deliver(job, deps = {}) {
+  const r = await requestReceipt(job, deps);
+  if (!r.ok) return r;
+  return sendToHub({ ...job, receipt: r.receipt, origin: r.origin, hub: r.hub }, deps);
+}
+
+// A report the project could not vouch for is kept, so it can be sent after the
+// upgrade (`--message-file <it>`) instead of being written again.
+function keepUnsent(message, { dir = stateDir(), now = new Date() } = {}) {
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    const file = path.join(dir, `feedback-unsent-${now.toISOString().replace(/[:.]/g, '-')}.md`);
+    fs.writeFileSync(file, message, { mode: 0o600 });
+    return file;
+  } catch { return null; }
+}
+
+// The background child: read the queued report, deliver it, record the outcome
+// where a curious builder (or a maintainer helping them) can look.
+async function runDeliverChild(file) {
+  let job;
+  try { job = JSON.parse(fs.readFileSync(file, 'utf8')); } finally { fs.rmSync(path.dirname(file), { recursive: true, force: true }); }
+  let outcome;
+  try { outcome = job.receipt ? await sendToHub(job) : await deliver(job); } catch (e) { outcome = { ok: false, step: 'network', code: String(e && e.message || e).slice(0, 200) }; }
+  try {
+    fs.writeFileSync(path.join(stateDir(), 'feedback-last.json'), JSON.stringify({ at: new Date().toISOString(), ...outcome }), { mode: 0o600 });
+  } catch { /* nowhere to record — the report itself is what mattered */ }
+  return outcome.ok ? 0 : 1;
+}
+
+// Hand the job to a detached child and return. The job travels in a 0600 temp
+// file, never argv (visible in ps) or env.
+function spawnDelivery(job, { spawnImpl = spawn } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-feedback-'));
+  const file = path.join(dir, 'job.json');
+  fs.writeFileSync(file, JSON.stringify(job), { mode: 0o600 });
+  const child = spawnImpl(process.execPath, [__filename, '--deliver', file], { detached: true, stdio: 'ignore' });
+  if (child && child.unref) child.unref();
+  return file;
+}
+
+async function main(argv = process.argv.slice(2), deps = {}) {
+  if (hasFlag('--help', argv) || hasFlag('-h', argv)) { console.log(USAGE); return 0; }
+  const kind = hasFlag('--idea', argv) ? 'idea' : 'bug';
+  const message = String(readMessage(argv, deps.io) || '').trim();
+  if (!message) { console.error(REFUSALS.message_required); return 2; }
+  if (message.length > 4000) { console.error(REFUSALS.too_long); return 2; }
+
+  const scrubbed = scrubReport(message);
+  if (!scrubbed) { console.error(REFUSALS.no_scrubber); return 1; }
+
+  const session = await (deps.requireSession || requireSession)();
+  const base = deps.base || ic.resolveApiBase({ session });
+  if (isLocalBase(base)) { console.error(REFUSALS.local_only); return 1; }
+
+  const job = { message: scrubbed.text, kind };
+  const checkRepeat = deps.checkRepeat || checkAndRecordRepeat;
+  if (checkRepeat(job.message, { record: false })) {
+    console.log('Already sent — the Bongos team has this one.');
+    return 0;
+  }
+  // The receipt in the foreground: "Sent" only once the project has vouched.
+  const r = await (deps.requestReceipt || requestReceipt)(job, { base });
+  if (!r.ok) {
+    const kept = (deps.keepUnsent || keepUnsent)(job.message);
+    const why = r.code === 'project_too_old' ? REFUSALS.project_too_old : `${REFUSALS.receipt_failed} (${r.code}).`;
+    console.error(kept ? `${why} Your note is saved in ${kept}` : why);
+    return 1;
+  }
+  checkRepeat(job.message);
+  const vouched = { ...job, receipt: r.receipt, origin: r.origin, hub: r.hub };
+  if (hasFlag('--wait', argv)) {
+    const outcome = await (deps.sendToHub || sendToHub)(vouched);
+    console.log(outcome.ok ? SENT_LINE : `Not sent (${outcome.step}: ${outcome.code}).`);
+    return outcome.ok ? 0 : 1;
+  }
+  (deps.spawnDelivery || spawnDelivery)(vouched);
+  console.log(SENT_LINE);
+  return 0;
+}
+
+if (require.main === module) {
+  const argv = process.argv.slice(2);
+  const run = argv[0] === '--deliver' ? runDeliverChild(argv[1]) : main(argv);
+  // cliExit, never process.exit, after a request (task 1002734 — the Windows abort).
+  run.then((code) => cliExit(code), (err) => {
+    console.error(`Feedback was not sent: ${err && err.message ? err.message : err}`);
+    cliExit(1);
+  });
+}
+
+module.exports = { main, deliver, requestReceipt, sendToHub, keepUnsent, readMessage, REFUSALS, scrubReport, isLocalBase, repeatKey, checkAndRecordRepeat, SENT_LINE };

package/scripts/bongos/fetch-art-key.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+// scripts/bongos/fetch-art-key.js — mirror the GDS-delivered SHARED Gemini key into
+// the local session file so a newcomer's art pipeline can use it (task 1281).
+//
+// The art pipeline (modules/art-pipeline/pipeline/gen_api.py) runs LOCALLY and can't call the API
+// per generation, so SessionStart runs this once: GET /api/bongos/me/art-key and,
+// based on the builder's live rank, write or remove the `shared_gemini_api_key`
+// field in ~/.config/otb/bongos-session.json. gen_api.py reads that field as a
+// fallback BELOW the builder's own key — so own key always wins, and a newcomer
+// with no own key falls back to the shared one we pay for.
+//
+// This is the SELF-HEALING source of truth for that slot, re-derived every
+// session from the server's rank check:
+//   entitled (xenos) + key delivered → write shared_gemini_api_key
+//   not entitled (thetes+)           → remove it (promotion withdraws the key)
+//   entitled but server has no key   → no-op (pipeline shows its normal message)
+//
+// Best-effort by construction (mirrors fetch-sound-prefs.js):
+//   - No session / not signed in → no-op.
+//   - API down / timeout / any error → leave the file untouched, no-op.
+//   - Read-modify-write preserves every other session field (token, own key, …):
+//     we loadSession() the full object, change ONE field, saveSession() it back.
+
+'use strict';
+
+const { loadSession, saveSession, API_BASE } = require('./cli-lib');
+
+const FETCH_TIMEOUT_MS = 4000;
+const SHARED_FIELD = 'shared_gemini_api_key';
+// The builder's OWN key (task 1013) lands in the same local slot the pipeline
+// already prefers — gemini_api_key. We tag it `_managed` so that REMOVING the key
+// on the server withdraws OUR copy on the next sync WITHOUT clobbering a legacy
+// key a builder hand-entered locally via the CLI (which carries no marker).
+const OWN_FIELD = 'gemini_api_key';
+const OWN_MANAGED_FLAG = 'gemini_api_key_managed';
+
+async function main() {
+  const session = await loadSession();
+  if (!session || !session.token) return; // not signed in — nothing to manage
+
+  const base = session.api_base || API_BASE;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS);
+  let data = null;
+  try {
+    const res = await fetch(`${base}/api/bongos/me/art-key`, {
+      headers: {
+        Authorization: `Bearer ${session.token}`,
+        'User-Agent': require('../../src/branding').userAgent(),
+      },
+      signal: ctrl.signal,
+    });
+    if (!res.ok) return; // 401 / 5xx — leave any existing key alone
+    data = await res.json();
+  } catch (_) {
+    return; // network/timeout — no-op
+  } finally {
+    clearTimeout(timer);
+  }
+  if (!data || typeof data !== 'object') return;
+
+  // Decide the change against the current file contents.
+  let changed = false;
+  if (data.entitled && typeof data.shared_key === 'string' && data.shared_key) {
+    // Entitled and a key was delivered → store it (only if different).
+    if (session[SHARED_FIELD] !== data.shared_key) {
+      session[SHARED_FIELD] = data.shared_key;
+      changed = true;
+    }
+  } else if (data.entitled === false) {
+    // Explicitly not entitled (e.g. promoted to Thetes) → withdraw the key.
+    if (Object.prototype.hasOwnProperty.call(session, SHARED_FIELD)) {
+      delete session[SHARED_FIELD];
+      changed = true;
+    }
+  }
+  // entitled but no key delivered (configured:false) → leave the file as-is.
+
+  // The builder's OWN server-stored key (task 1013 / ADR 0073). Mirrors the
+  // shared-key logic but writes the gemini_api_key slot (which wins over the
+  // shared key in the pipeline cascade) and only ever removes a copy WE wrote.
+  if (typeof data.own_key === 'string' && data.own_key) {
+    if (session[OWN_FIELD] !== data.own_key || session[OWN_MANAGED_FLAG] !== true) {
+      session[OWN_FIELD] = data.own_key;
+      session[OWN_MANAGED_FLAG] = true;
+      changed = true;
+    }
+  } else if (data.own_key_set === false && session[OWN_MANAGED_FLAG] === true) {
+    // Server says no own key, and the local copy is one we manage → withdraw it.
+    delete session[OWN_FIELD];
+    delete session[OWN_MANAGED_FLAG];
+    changed = true;
+  }
+  // own_key_set true but no plaintext delivered (storage not configured), or a
+  // legacy local key with no marker → leave the file as-is.
+
+  if (changed) {
+    try {
+      await saveSession(session); // writes the full object back, mode 600
+    } catch (_) {
+      /* best-effort — a failed write just leaves the pipeline to fall through */
+    }
+  }
+}
+
+main().then(() => process.exit(0)).catch(() => process.exit(0));

package/scripts/bongos/fetch-sound-prefs.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+// scripts/bongos/fetch-sound-prefs.js — mirror the builder's per-sound prefs to a
+// local file the offline player reads (V3.R91 / #786).
+//
+// The toggle lives server-side (builders.sound_prefs), but the sound plays from
+// a LOCAL Stop hook + ship.js via .claude/sounds/play.js — which can't make a
+// network call on every turn. So SessionStart runs this once: fetch
+// GET /api/bongos/me/sound-prefs and write its effective_map to
+// ~/.config/otb/sound-prefs.json. play.js reads that file and skips muted sounds.
+//
+// Best-effort by construction:
+//   - No session token / not signed in → no-op (player fails OPEN = plays all).
+//   - API down / timeout / any error → leave any existing file untouched, no-op.
+//   - A stale file is harmless: it just reflects the builder's last-known prefs
+//     until the next successful session start refreshes it.
+//
+// Mirrors the auth + atomic-write patterns in pull-memory.js.
+
+'use strict';
+
+const fs   = require('node:fs');
+const os   = require('node:os');
+const path = require('node:path');
+const { readSessionToken } = require('./cli-lib');
+
+const FETCH_TIMEOUT_MS = 4000;
+
+
+const PREFS_PATH = require('../../src/instance-config').configPath('sound-prefs.json');
+
+function writeAtomic(targetPath, contents) {
+  const dir = path.dirname(targetPath);
+  fs.mkdirSync(dir, { recursive: true });
+  const tmp = path.join(dir, `.sound-prefs.${process.pid}.tmp`);
+  fs.writeFileSync(tmp, contents);
+  fs.renameSync(tmp, targetPath);
+}
+
+// The network half, on its own so probe-cache can own it: cached() records a value
+// only when its producer RESOLVES, so a failed fetch leaves nothing cached and the
+// next session retries instead of inheriting a minute of "already done".
+//
+// Returns { soundData, eventData } or null. Null is an ordinary outcome — offline, a
+// timeout, or both endpoints refusing — and the caller writes nothing, which leaves
+// the prefs file exactly as the last good run left it (fail-open).
+async function fetchPrefs() {
+  const sess = readSessionToken();
+  if (!sess) return null;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS);
+  let soundData = null;
+  let eventData = null;
+  try {
+    // Fetch both prefs in parallel; a failure on either leaves both at their
+    // existing cached state (fail-open).
+    const [soundRes, eventRes] = await Promise.all([
+      fetch(`${sess.apiBase}/api/bongos/me/sound-prefs`, {
+        headers: { Authorization: `Bearer ${sess.token}`, 'User-Agent': require('../../src/branding').userAgent() },
+        signal: ctrl.signal,
+      }),
+      fetch(`${sess.apiBase}/api/bongos/me/event-sound-prefs`, {
+        headers: { Authorization: `Bearer ${sess.token}`, 'User-Agent': require('../../src/branding').userAgent() },
+        signal: ctrl.signal,
+      }),
+    ]);
+    if (!soundRes.ok && !eventRes.ok) return null;
+    if (soundRes.ok) soundData = await soundRes.json();
+    if (eventRes.ok) eventData = await eventRes.json();
+  } catch (_) {
+    return null; // network/timeout — no-op
+  } finally {
+    clearTimeout(timer);
+  }
+
+  return { soundData, eventData };
+}
+
+async function main() {
+  const sess = readSessionToken();
+  if (!sess) return; // not signed in — player fails open
+
+  // SHARED ACROSS CONCURRENT SESSION STARTS (task 1003689). This is the third of the
+  // three SessionStart hooks that call the server, and when four sessions open within
+  // seconds they contend and every hook in all four hits its timeout. Unlike the
+  // truth-tellers, a lost run here is invisible rather than merely silent: the prefs
+  // file simply keeps its previous contents.
+  //
+  // Which is also why skipping the write on a cache hit is correct — the file already
+  // holds what the previous run fetched, and these prefs change when a builder edits
+  // them in Settings, not between two sessions opened three seconds apart.
+  // The cache must be marked fresh only by a SUCCESSFUL fetch. The first cut cached
+  // Date.now() BEFORE fetching, so a failed or timed-out fetch still recorded 'done'
+  // and blocked every retry for the whole TTL - turning a transient network error into
+  // a minute of silently stale prefs. cached() writes its record only when the producer
+  // RESOLVES, so the work belongs inside it, the way strand-watch and deploy-divergence
+  // already do it.
+  const { cached } = require('./probe-cache.js');
+  const { value: fetched, from } = await cached('sound-prefs', async () => fetchPrefs());
+  if (from !== 'fresh') return;   // another session already fetched and wrote the file
+  if (!fetched) return;           // not signed in, offline, or both requests failed
+  const { soundData, eventData } = fetched;
+
+
+  // effective_map is { <sound>: <bool> } for every known sound (defaults
+  // already applied server-side); volume is the master 0-100 (#788). The local
+  // file shape is { sounds: {...}, volume: N, event_sounds: {...} } — play.js
+  // reads both (and still tolerates the legacy flat { <sound>: <bool> } shape).
+  const map = soundData && soundData.effective_map;
+  if (!map || typeof map !== 'object') return;
+  const volume = typeof soundData.volume === 'number' ? soundData.volume : 100;
+  // event_sounds: { <eventId>: <wavName> } — resolved wav per event so the
+  // hook can call playSound(wavName) without knowing the variant→wav mapping.
+  const eventSounds = (eventData && typeof eventData.effective_wav === 'object')
+    ? eventData.effective_wav
+    : {};
+  try {
+    writeAtomic(PREFS_PATH, JSON.stringify({ sounds: map, volume, event_sounds: eventSounds }));
+  } catch (_) {
+    /* best-effort — a failed write just leaves the player to fail open */
+  }
+}
+
+// No process.exit: calling it while undici is still tearing down the fetches above
+// aborts this hook on Windows with the win/async.c UV_HANDLE_CLOSING assertion, so
+// SessionStart reports a hook error. Nothing else holds the loop — it exits on its own.
+main().catch(() => {});

package/scripts/bongos/figma-design-sync.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+'use strict';
+// figma-design-sync.js — thin shim: the Figma push-plan CLI lives in the ui-design
+// module at modules/ui-design/scripts/figma-design-sync.js (task 1003324, ADR 0197).
+//
+// Kept because `node scripts/bongos/<x>.js` is the form the skills and recipes use and
+// the form claude-materialize rewrites to `bongos exec` for a packaged core. Flags
+// pass straight through:
+//   node scripts/bongos/figma-design-sync.js                 — build the Figma push plan, print the manifest
+//   node scripts/bongos/figma-design-sync.js --surface <id>  — limit to one surface
+require('../../modules/ui-design/scripts/figma-design-sync.js');