@bongos/core 1.21.47 → 1.21.48

package/scripts/gds/provision-units.js

@@ -162,23 +162,10 @@ WantedBy=timers.target
 // branding-file env line is written at all. Reading the neutral pack HERE is still correct: it is
 // the prefix floor an instance inherits unless its own pack overrides envPrefix, and every live
 // co-tenant pack pins `envPrefix: "CLOUDBONGOS"` explicitly.
-const ENV_PREFIX_PACK = 'config/branding.neutral.json';
-
-// The env-var prefix a provisioned instance actually RESOLVES — i.e. the envPrefix
-// of the pack it loads (ENV_PREFIX_PACK). src/instance-config.resolveEnv
-// reads <envPrefix>_<SUFFIX>, and src/branding.resolveBranding applies
-// <envPrefix>_{PUBLIC,BUILDERS,…}_ORIGIN overrides — so a web.env var only takes
-// effect under THIS prefix. Read from the pack (fail-soft to the vanilla default)
-// so it stays in lockstep instead of a magic string. (The prior slug-based prefix
-// was a latent bug: it never matched the neutral pack's CLOUDBONGOS envPrefix, so
-// the OAuth creds were silently unreadable — task 1972.)
-function provisionedEnvPrefix() {
-  const { FALLBACK_ENV_PREFIX } = require('../../src/instance-config');
-  try {
-    const pack = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, ENV_PREFIX_PACK), 'utf8'));
-    return pack.envPrefix || FALLBACK_ENV_PREFIX;
-  } catch { return FALLBACK_ENV_PREFIX; }
-}
+// ENV_PREFIX_PACK + provisionedEnvPrefix (and the task-1004573 pack checks) live in
+// pack-env-prefix.js — provision-repo.js needs them too, and it cannot require this file
+// (this file requires it). Re-exported below so every existing caller is unchanged.
+const { ENV_PREFIX_PACK, provisionedEnvPrefix, envPrefixMismatch, normalizePackEnvPrefix } = require('./pack-env-prefix.js');
 
 // The per-instance secrets file body (the standup runbook's /etc/<inst>/web.env).
 // The OAuth client id/secret are GUIDED/manual inputs (no GitHub create-API) — the
@@ -430,6 +417,8 @@ function renamedEnvCarry(body) {
 
 module.exports = {
   ENV_PREFIX_PACK,
+  envPrefixMismatch,
+  normalizePackEnvPrefix,
   backupScriptPath,
   backupService,
   backupServicePath,

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const crypto = require('node:crypto');
 const retry = require('./intent-retry.js'); // when a failed intent is tried again (task 1004447)
 const { CONFIG, MANIFEST_UA, softFailResult, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { accountPreflight, appUser, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
-const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, renamedEnvCarry, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
+const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, envPrefixMismatch, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, renamedEnvCarry, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { resolveProcessManager } = require('./provision-process.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
@@ -1097,7 +1097,13 @@ async function placeManifestCreds(inst, mrow, deps) {
     if (!authConfigured) {
       // The App now EXISTS on the owner's account — keep its id + slug on the row so
       // the wizard can name it and say why "try again" makes a second one (task 1004572).
-      return { ok: false, codeSpent: true, appId: creds.appId, appSlug: creds.appSlug, error: 'the credentials are placed, but the project did not report sign-in ready in time' };
+      // Say WHY when we can see it: an adopted repo's own pack may read other names (task 1004573).
+      // A cloud-host checkout lives on the control plane (the scaffold reads it the same way), so
+      // this is a plain file read — no shell. An unreadable or non-JSON pack names nothing.
+      let packText = null;
+      if (standalone) { try { packText = (deps.readFile || fs.readFileSync)(path.join(standaloneRoot(inst), 'config', 'branding.json'), 'utf8'); } catch { packText = null; } }
+      const why = envPrefixMismatch(packText);
+      return { ok: false, codeSpent: true, appId: creds.appId, appSlug: creds.appSlug, error: `the credentials are placed, but the project did not report sign-in ready in time${why ? ` — ${why}` : ''}` };
     }
     log('  [oauth-manifest] ✓ /healthz auth_configured=true — sign-in is live');
   } else {

package/src/instance-config.js

@@ -190,7 +190,7 @@ function readConfigFileSync(name, { encoding = 'utf8', b = safeBrand() } = {}) {
 // per process naming the old spelling, the new one, and the release the old
 // stops working in; see warnLegacyEnv below. `warn` is injectable so a test can
 // assert the warning fires rather than only that the value resolves.
-function resolveEnv(suffix, { env = process.env, prefix = envPrefix(), legacy = LEGACY_ENV_PREFIXES, warn = warnLegacyEnv } = {}) {
+function resolveEnv(suffix, { env = process.env, prefix = envPrefix(), legacy = LEGACY_ENV_PREFIXES, warn = warnLegacyEnv, warnPack = warnPackPrefix } = {}) {
   const canonical = `${prefix}_${suffix}`;
   const canonicalValue = prefix ? env[canonical] : undefined;
   const canonicalSet = canonicalValue !== undefined && canonicalValue !== '';
@@ -200,6 +200,22 @@ function resolveEnv(suffix, { env = process.env, prefix = envPrefix(), legacy =
   // on the winner would leave the "both set" operator with no notice at all.
   const seen = new Set([prefix].filter(Boolean));
   let winner = canonicalSet ? canonicalValue : undefined;
+  // THE PLATFORM'S SPELLING IS ALWAYS HEARD (task 1004573). The platform writes
+  // every hosted project's web.env as BONGOS_* whatever that project's own pack
+  // says. A project adopted from a repo whose config/branding.json still carried
+  // envPrefix CLOUDBONGOS read none of it — not its sign-in credentials, not its
+  // address, not one setting its owner chose — and nothing said so (mercury,
+  // 2026-10-04). So when the pack names another prefix, BONGOS_* is read right
+  // after it, ahead of the legacy list. The pack's own spelling still wins.
+  if (prefix && prefix !== FALLBACK_ENV_PREFIX) {
+    seen.add(FALLBACK_ENV_PREFIX);
+    const name = `${FALLBACK_ENV_PREFIX}_${suffix}`;
+    const v = env[name];
+    if (!canonicalSet && v !== undefined && v !== '') {
+      winner = v;
+      warnPack({ prefix, name });
+    }
+  }
   for (const pfx of legacy) {
     if (!pfx || seen.has(pfx)) continue;
     seen.add(pfx);
@@ -229,6 +245,17 @@ function warnLegacyEnv({ legacyName, canonicalName, shadowed, differs, log = con
   return true;
 }
 
+// One line per process when a value had to come from the platform's BONGOS_*
+// spelling because this project's pack names another prefix. Not a deprecation —
+// BONGOS_ is the canonical name — so it says what to change instead: the pack.
+let _packPrefixWarned = false;
+function warnPackPrefix({ prefix, name, log = console } = {}) {
+  if (_packPrefixWarned) return false;
+  _packPrefixWarned = true;
+  log.warn(`[bongos] config/branding.json sets envPrefix "${prefix}", but ${name} (the platform's spelling) is what is set — reading it. Set envPrefix to "${FALLBACK_ENV_PREFIX}" to match.`);
+  return true;
+}
+
 // NOT exported, deliberately: warnLegacyEnv, LEGACY_ENV_SUNSET_RELEASE and the
 // ledger are internals. resolveEnv's injectable `warn` is the whole test seam a
 // caller needs, and a test of the DEFAULT path captures console.warn — which

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.47'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.48'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/instance_config.mjs

@@ -235,3 +235,56 @@ test('resolveApiBase: session:null does not read the session file from disk', ()
   // and callers that already know there is no session get a deterministic answer.
   assert.equal(ic.resolveApiBase({ session: null, env: {}, b: BRAND_B }), 'https://instance-b.example');
 });
+
+// ── task 1004573: the platform's BONGOS_* spelling is always heard ────────────
+// The platform writes every hosted project's web.env as BONGOS_*. Mercury's adopted
+// config/branding.json said envPrefix CLOUDBONGOS, so it read none of it — not its
+// sign-in credentials, not its address, not one setting (live, 2026-10-04).
+
+test('resolveEnv: a pack naming another prefix still reads the platform\'s BONGOS_* (task 1004573)', () => {
+  const env = { BONGOS_GITHUB_CLIENT_ID: 'Iv23-platform' };
+  assert.equal(resolveEnv('GITHUB_CLIENT_ID', { prefix: 'CLOUDBONGOS', env, warn: () => {}, warnPack: () => {} }), 'Iv23-platform');
+  assert.equal(resolveEnv('GITHUB_CLIENT_ID', { prefix: 'OTB', env, warn: () => {}, warnPack: () => {} }), 'Iv23-platform');
+});
+
+test('resolveEnv: the pack\'s own spelling still WINS over the platform\'s (task 1004573)', () => {
+  const env = { CLOUDBONGOS_PUBLIC_ORIGIN: 'https://own.example', BONGOS_PUBLIC_ORIGIN: 'https://platform.example' };
+  assert.equal(resolveEnv('PUBLIC_ORIGIN', { prefix: 'CLOUDBONGOS', env, warn: () => {}, warnPack: () => {} }), 'https://own.example');
+});
+
+test('resolveEnv: BONGOS_* is read BEFORE the legacy list, and is never called deprecated (task 1004573)', () => {
+  const legacyWarnings = [];
+  const v = resolveEnv('JOINABILITY', { prefix: 'OTB', env: { BONGOS_JOINABILITY: 'open', PMS_JOINABILITY: 'closed' }, warn: (w) => legacyWarnings.push(w), warnPack: () => {} });
+  assert.equal(v, 'open', 'the canonical platform spelling beats a legacy one');
+  assert.ok(!legacyWarnings.some((w) => /^BONGOS_/.test(w.legacyName)), 'BONGOS_ is the canonical name — no deprecation warning names it');
+});
+
+test('resolveEnv: when it has to read BONGOS_*, it says to fix the pack — and only then (task 1004573)', () => {
+  const calls = [];
+  const warnPack = (w) => calls.push(w);
+  resolveEnv('LOOK', { prefix: 'CLOUDBONGOS', env: { BONGOS_LOOK: 'own' }, warn: () => {}, warnPack });
+  assert.deepEqual(calls, [{ prefix: 'CLOUDBONGOS', name: 'BONGOS_LOOK' }], 'names the pack prefix and the name it fell back to');
+  resolveEnv('LOOK', { prefix: 'CLOUDBONGOS', env: { CLOUDBONGOS_LOOK: 'x', BONGOS_LOOK: 'own' }, warn: () => {}, warnPack });
+  resolveEnv('LOOK', { prefix: 'BONGOS', env: { BONGOS_LOOK: 'own' }, warn: () => {}, warnPack });
+  assert.equal(calls.length, 1, 'silent when the pack\'s own spelling won, and when the pack is already BONGOS');
+});
+
+test('resolveEnv: the default pack warning names the fix, once per process (task 1004573)', () => {
+  const seen = [];
+  const orig = console.warn;
+  console.warn = (m) => seen.push(String(m));
+  try {
+    // the default warnPack — the real wiring, not a hand-called helper
+    resolveEnv('ONE', { prefix: 'CLOUDBONGOS', env: { BONGOS_ONE: '1' }, warn: () => {} });
+    resolveEnv('TWO', { prefix: 'CLOUDBONGOS', env: { BONGOS_TWO: '2' }, warn: () => {} });
+  } finally { console.warn = orig; }
+  const lines = seen.filter((m) => /envPrefix "CLOUDBONGOS"/.test(m));
+  assert.equal(lines.length, 1, 'one line, not one per setting');
+  assert.match(lines[0], /BONGOS_ONE/);
+  assert.match(lines[0], /Set envPrefix to "BONGOS"/);
+});
+
+test('resolveEnv: a pack already on BONGOS is unchanged (task 1004573)', () => {
+  assert.equal(resolveEnv('X', { prefix: 'BONGOS', env: { BONGOS_X: 'a', PMS_X: 'b' }, warn: () => {}, warnPack: () => {} }), 'a');
+  assert.equal(resolveEnv('X', { prefix: 'BONGOS', env: {}, warn: () => {}, warnPack: () => {} }), undefined);
+});

package/tests/instance_feedback.mjs

@@ -312,6 +312,18 @@ test('the skill files unasked on a Bongos rant, and the kernel tells every sessi
   assert.match(kernel, /vents that Bongos itself is broken.*\/bongos-feedback/);
 });
 
+// task 1004576: "Bongos feedback: …" (a calm wish, not a rant) fired no skill — the
+// listing only described venting, and a since-deleted /feedback skill owned the phrase.
+test('a labelled message or a wish about Bongos triggers the skill too, and nothing else claims the phrase', () => {
+  const skill = fs.readFileSync(path.join(ROOT, '.claude/skills/bongos-feedback/SKILL.md'), 'utf8');
+  const description = skill.split('\n---')[0];
+  assert.match(description, /Bongos feedback:/, 'the literal label is a trigger');
+  assert.match(description, /Bongos should/, 'a wish is a trigger');
+  assert.match(skill, /Suggestions count/);
+  assert.match(skill, /\*\*is\*\* the go/, 'a labelled message is sent without a second ask');
+  assert.ok(!fs.existsSync(path.join(ROOT, '.claude/skills/feedback')), 'no second skill competes for "feedback"');
+});
+
 test('every report is secret-scrubbed before it leaves the machine, and never sent unscrubbed', async () => {
   const { scrubReport } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
   const token = 'ghp_' + 'a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8';

package/tests/provision.mjs

@@ -1330,6 +1330,59 @@ await ta('scaffoldStandaloneRepo(adopt): does NOT clobber an existing .gitignore
   assert.match(String(gi.body), /node_modules\//, 'and the entries `npm ci` + the deploy require are added');
 });
 
+// Task 1004573: adopt layers config only where ABSENT, so an owner's config/branding.json
+// kept whatever envPrefix it carried while web.env was written under the platform's —
+// mercury's said CLOUDBONGOS and read none of its credentials or settings.
+async function adoptWithPack(packText, mode = 'adopt') {
+  const base = mkdtempSync(join(tmpdir(), `pack-${mode}-`));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    mkdirSync(join(base, 'demo', 'config'), { recursive: true });
+    writeFileSync(join(base, 'demo', 'config', 'branding.json'), packText);
+    const { deps } = recorder({ apply: true });
+    const seq = [];
+    deps.exec = (cmd) => { seq.push(`exec ${cmd}`); return { ok: true, stdout: '' }; };
+    deps.writeFile = (p, body) => { seq.push(`write ${p}`); seq.writes = (seq.writes || []).concat([{ p, body }]); return { ok: true }; };
+    deps.getGithubToken = async () => ({ token: 'gho_TOK', scope: 'repo' });
+    await P.scaffoldStandaloneRepo(
+      { slug: 'demo', hosting_shape: 'cloud-host', target_ref: 'example-owner/demo', owner_builder_id: 7, onboard_mode: mode },
+      { ...deps, instanceRoot: base },
+    );
+    return { seq, writes: seq.writes || [] };
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    rmSync(base, { recursive: true, force: true });
+  }
+}
+const U2 = require('../scripts/gds/provision-units.js');
+
+await ta('scaffoldStandaloneRepo(adopt): an owner pack on another envPrefix is corrected IN the adopt commit (task 1004573)', async () => {
+  const owner = '{\n  "identity": { "productName": "mercury" },\n  "envPrefix": "CLOUDBONGOS",\n  "configDir": "cloudbongos"\n}\n';
+  const { seq, writes } = await adoptWithPack(owner);
+  const w = writes.find((x) => /config\/branding\.json$/.test(x.p));
+  assert.ok(w, 'the pack was rewritten');
+  assert.equal(JSON.parse(w.body).envPrefix, U2.provisionedEnvPrefix(), 'to the prefix web.env is written under');
+  assert.equal(w.body, owner.replace('"envPrefix": "CLOUDBONGOS"', `"envPrefix": "${U2.provisionedEnvPrefix()}"`), 'and NOTHING else in the owner\'s file moved');
+  const wrote = seq.findIndex((s) => /^write .*config\/branding\.json$/.test(s));
+  const added = seq.findIndex((s) => /git -C \S+ add -A/.test(s));
+  assert.ok(wrote >= 0 && added > wrote, 'written before `git add -A`, so it rides the adopt commit to the owner\'s repo');
+});
+
+await ta('scaffoldStandaloneRepo: a pack that already agrees, and a greenfield scaffold, are left alone (task 1004573)', async () => {
+  const agree = await adoptWithPack(JSON.stringify({ envPrefix: U2.provisionedEnvPrefix() }));
+  assert.ok(!agree.writes.some((x) => /config\/branding\.json$/.test(x.p)), 'agreeing pack untouched');
+  const green = await adoptWithPack(JSON.stringify({ envPrefix: 'CLOUDBONGOS' }), 'greenfield');
+  assert.ok(!green.writes.some((x) => /config\/branding\.json$/.test(x.p)), 'greenfield owns its config through init; no rewrite here');
+});
+
+await ta('normalizePackEnvPrefix: rewrites only the value, refuses what it cannot rewrite safely (task 1004573)', async () => {
+  assert.deepEqual(U2.normalizePackEnvPrefix('{"envPrefix":"OTB","x":1}', 'BONGOS'), { text: '{"envPrefix":"BONGOS","x":1}', from: 'OTB' });
+  assert.equal(U2.normalizePackEnvPrefix('{"envPrefix":"BONGOS"}', 'BONGOS'), null);
+  assert.equal(U2.normalizePackEnvPrefix('{"identity":{}}', 'BONGOS'), null, 'no envPrefix → nothing to correct');
+  assert.equal(U2.normalizePackEnvPrefix('not json', 'BONGOS'), null);
+});
+
 await ta('scaffoldStandaloneRepo(adopt): a default branch that is not `main` fails LOUDLY, not silently', async () => {
   // The rest of provisioning is main-only (git pull --ff-only origin main; the box deploy
   // does git reset --hard origin/main), so layering onto another branch would push somewhere
@@ -1776,6 +1829,56 @@ await ta('a failure BEFORE GitHub handed over credentials claims no App (task 10
   assert.ok(resolves.every((x) => !('app_slug' in x.patch)), 'no App is named when none was handed over');
 });
 
+// Task 1004573: an adopted repo brings its own config/branding.json. Mercury's said
+// envPrefix CLOUDBONGOS while the platform wrote BONGOS_*, so the project never saw
+// its credentials — and the only thing anyone was told was "did not report sign-in
+// ready". When the check fails, the runner now reads the pack and names a mismatch.
+const U = require('../scripts/gds/provision-units.js');
+
+await ta('envPrefixMismatch names a pack that reads other names, and nothing else (task 1004573)', async () => {
+  const m = U.envPrefixMismatch(JSON.stringify({ envPrefix: 'CLOUDBONGOS' }), 'BONGOS');
+  assert.match(m, /reads settings named CLOUDBONGOS_\*, but the platform wrote BONGOS_\*/);
+  assert.match(m, /set its envPrefix to "BONGOS"/);
+  assert.equal(U.envPrefixMismatch(JSON.stringify({ envPrefix: 'BONGOS' }), 'BONGOS'), null, 'agreeing names say nothing');
+  assert.equal(U.envPrefixMismatch(JSON.stringify({ identity: {} }), 'BONGOS'), null, 'a pack with no envPrefix claims nothing');
+  assert.equal(U.envPrefixMismatch('not json', 'BONGOS'), null, 'an unreadable pack claims nothing');
+  assert.equal(U.envPrefixMismatch(null, 'BONGOS'), null);
+});
+
+await ta('a sign-in check that fails on a mismatched pack SAYS so (task 1004573)', async () => {
+  const inst = { ...coTenant, hosting_shape: 'cloud-host', slug: 'mercury', domain: 'mercury.example.com' };
+  const cmds = [], reads = [];
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 1, appSlug: 's' }),
+    exec: (cmd) => { cmds.push(cmd); return { ok: true, stdout: '{"ok":true,"auth_configured":false}' }; },
+    readFile: (p) => { reads.push(p); return JSON.stringify({ envPrefix: 'CLOUDBONGOS' }); },
+    writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /credentials are placed/, 'still owns what DID happen');
+  assert.match(r.error, /reads settings named CLOUDBONGOS_\*, but the platform wrote/, 'and names the cause');
+  assert.deepEqual(reads, [join(P.standaloneRoot(inst), 'config', 'branding.json')], 'reads the project\'s OWN pack, from its checkout');
+  assert.ok(!cmds.some((c) => /branding\.json/.test(c)), 'a plain file read — no shell command carries the path');
+});
+
+await ta('a sign-in check that fails with agreeing names keeps the plain message (task 1004573)', async () => {
+  const inst = { ...coTenant, hosting_shape: 'cloud-host', domain: 'mercury.example.com' };
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 1, appSlug: 's' }),
+    exec: () => ({ ok: true, stdout: '{"ok":true,"auth_configured":false}' }),
+    readFile: () => JSON.stringify({ envPrefix: U.provisionedEnvPrefix() }),
+    writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.error, 'the credentials are placed, but the project did not report sign-in ready in time');
+  // an unreadable pack names nothing either
+  const r2 = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, { ...deps, readFile: () => { throw new Error('ENOENT'); } });
+  assert.equal(r2.error, 'the credentials are placed, but the project did not report sign-in ready in time');
+});
+
 await ta('a PRE-conversion failure stays retryable — the narrowing spared the retry path (F23)', async () => {
   let claims = 0; const resolves = [];
   const deps = {

package/tests/skill_menu_ruling.mjs

@@ -19,7 +19,7 @@ const read = (n) => fs.readFileSync(byName.get(n), 'utf8');
 const info = (n) => lint.lintSkillFile(read(n), { file: byName.get(n) });
 
 // The ruling, as written into the task.
-const LISTED_TRIMMED = ['grade-recover', 'collab-review', 'session-handoff', 'builder-claim', 'builder-sequence', 'blocker-solve', 'design', 'goal-create', 'blocker-review', 'builder-reauth', 'read-session-export', 'recall', 'worktree-clean', 'merge-mode', 'builder-setup', 'builder-key', 'bongos-feedback', 'feedback', 'builder-redteam', 'scan-before-install', 'owner-review'];
+const LISTED_TRIMMED = ['grade-recover', 'collab-review', 'session-handoff', 'builder-claim', 'builder-sequence', 'blocker-solve', 'design', 'goal-create', 'blocker-review', 'builder-reauth', 'read-session-export', 'recall', 'worktree-clean', 'merge-mode', 'builder-setup', 'builder-key', 'bongos-feedback', 'builder-redteam', 'scan-before-install', 'owner-review'];
 const LISTED_AS_IS = ['strand-fix', 'builder-ship', 'builder-start', 'fix-task', 'ask-for-help', 'ship-check', 'status', 'builder-end', 'builder-release', 'builder-stage'];
 const HIDDEN = ['planning-session', 'goal-close', 'grade-sweep', 'builder-exit', 'builder-backup', 'builder-cost', 'new-project', 'design-sync', 'figma-design-sync', 'tweak'];
 const ALIASES = ['backlog-review', 'bug-triage', 'idea-triage', 'priority-session', 'goal-uat', 'goal-review', 'grade-audit', 'grader-health'];

package/.claude/skills/feedback/SKILL.md

@@ -1,39 +0,0 @@
----
-name: feedback
-description: >-
-  Pull the latest Bongos feedback bundle (walkthrough transcript, screenshots) into this session; read-only. Triggers: "/feedback", "pull in my latest feedback", "load my bongos feedback", "I just recorded a walkthrough", "act on my screen recording".
-plain: >-
-  Loads your most recent recorded walkthrough, what you said and the screenshots, into this conversation.
-reach-for: >-
-  Right after you have recorded feedback on the project and want your assistant to act on it.
-cost: >-
-  Free, and it changes nothing. It only reads files on your computer.
----
-
-You are pulling in the **latest Bongos feedback bundle** — a self-contained capture the user just recorded with the Bongos desktop app (BV1.R13 / [ADR 0087](../../../docs/adr/0087-bongos-app-architecture-and-handoff-contract.md)). The app turns a spoken screen walkthrough into a model-agnostic `prompt.md` (a timestamped transcript + an ask) plus a handful of screenshots, all under `~/CloudBongos/feedback/`. This skill loads that bundle so you can act on it directly — no copy-paste, no clipboard-image fiddling.
-
-## Steps
-
-1. **Resolve + print the latest bundle:**
-
-   ```bash
-   node scripts/gds/feedback-latest.js
-   ```
-
-   This prints the full `prompt.md` body followed by an `attached frames` list — one **absolute image path** per line. (Add `--json` if you want structured output instead.)
-
-2. **If it says "No feedback bundle found"** — tell the user there's nothing to load yet: record a walkthrough in the Bongos app and stop the capture (that writes the bundle), then run `/feedback` again. Stop here.
-
-3. **Read every listed frame.** For each absolute path under `attached frames`, call the **Read** tool on it so the screenshots enter your context as images. The paths are real files on disk — Read them directly; do not ask the user to paste anything.
-
-4. **Act on the bundle.** Treat the transcript in `prompt.md` as the request and the screenshots as ground truth for what the user was looking at (the timestamps line the words up with the images). Work out what they want changed or fixed and do it. Ask a question only if you are genuinely blocked.
-
-## Notes
-
-- **Read-only + local.** The helper only reads files under `~/CloudBongos/feedback/`; it needs no Bongos session and no network.
-- **"Latest" = most recently produced.** The Bongos app updates a `latest` pointer every time a capture is stopped, so this always loads the newest walkthrough. To act on an older one, point the user at the specific dir under `~/CloudBongos/feedback/`.
-- **The frames are file paths, never base64** — that's the whole point of the bundle format (it keeps the text prompt tiny and lets your Read tool load the images). See [ADR 0087](../../../docs/adr/0087-bongos-app-architecture-and-handoff-contract.md) for the full bundle contract.
-
-## Files this skill touches
-
-- Runs: `node scripts/gds/feedback-latest.js` (resolves the ADR 0087 `latest` pointer itself — the app source is off-repo, ADR 0098).

package/scripts/bongos-mcp.js

@@ -1,28 +0,0 @@
-#!/usr/bin/env node
-// scripts/bongos-mcp.js — R14 launcher for the Bongos feedback MCP server.
-//
-// This is the entry point a Claude MCP config points at. The server itself
-// lives in bongos-app/src/mcp-server.js (bundled with the app); this thin
-// launcher lets it run from a repo checkout / a stable path without depending
-// on the app's process.
-//
-// Register it with Claude Code:
-//   claude mcp add bongos-feedback -- node /ABSOLUTE/PATH/scripts/bongos-mcp.js
-//
-// Or in a Claude Desktop / Code MCP config:
-//   { "mcpServers": { "bongos-feedback": {
-//       "command": "node",
-//       "args": ["/ABSOLUTE/PATH/scripts/bongos-mcp.js"] } } }
-//
-// Then call the get_latest_feedback tool to pull the latest bundle (prompt text
-// + screenshot file paths). See bongos-app/README.md for the full contract.
-
-'use strict';
-
-const path = require('node:path');
-const { main } = require(path.join(__dirname, '..', 'bongos-app', 'src', 'mcp-server.js'));
-
-main().catch((err) => {
-  process.stderr.write(`bongos-mcp: ${err.message}\n`);
-  process.exit(1);
-});

package/scripts/gds/feedback-latest.js

@@ -1,224 +0,0 @@
-#!/usr/bin/env node
-// scripts/gds/feedback-latest.js — R13 (BV1.R13): the engine behind the
-// /feedback Claude Code slash command.
-//
-// Resolves the LATEST feedback bundle the Bongos app wrote to
-// ~/CloudBongos/feedback/ (via the shared `latest` pointer, ADR 0087) and
-// prints it for a Claude Code session:
-//
-//   1. the full prompt.md body (the model-agnostic transcript + ask, R11), and
-//   2. the ABSOLUTE path of every attached frame, on its own line, so Claude's
-//      Read tool can load each image directly.
-//
-// This sidesteps the CLI's unreliable clipboard-image paste: Claude reads the
-// frames from disk by path instead of from a pasted blob.
-//
-// Usage:
-//   node scripts/gds/feedback-latest.js            # human/agent-readable dump
-//   node scripts/gds/feedback-latest.js --json     # { id, dir, promptMarkdown, imagePaths }
-//   node scripts/gds/feedback-latest.js --base DIR # override bundle base dir (tests)
-//
-// Local + read-only: it reads files under your home dir. No GDS session, no
-// network — so it works on any machine the Bongos app runs on.
-//
-// resolveLatest + feedbackBaseDir are ported here from the app's
-// bongos-app/src/handoff.js, which no longer lives in this repo (the desktop
-// apps publish off-repo, ADR 0098 — task 1004356). The contract is ADR 0087's:
-// `latest.json` is authoritative, the `latest/` symlink is a convenience that
-// may be absent, and with neither the reader self-heals by scanning for the
-// newest bundle dir holding a prompt.md.
-
-'use strict';
-
-const fs = require('node:fs/promises');
-const os = require('node:os');
-const path = require('node:path');
-
-const IMAGE_EXT = new Set(['.png', '.jpg', '.jpeg', '.webp', '.gif']);
-
-/** Where the Bongos app writes bundles: ~/CloudBongos/feedback. */
-function feedbackBaseDir() {
-  return path.join(os.homedir(), 'CloudBongos', 'feedback');
-}
-
-async function isBundleDir(dir) {
-  try {
-    return (await fs.stat(path.join(dir, 'prompt.md'))).isFile();
-  } catch {
-    return false;
-  }
-}
-
-// The dir `latest.json` names, or null if it is missing, unreadable or stale.
-// Accepts the pointer by `dir` (absolute) or by `id` (a child of baseDir).
-async function fromPointer(baseDir) {
-  let ptr;
-  try {
-    ptr = JSON.parse(await fs.readFile(path.join(baseDir, 'latest.json'), 'utf8'));
-  } catch {
-    return null;
-  }
-  if (!ptr || typeof ptr !== 'object') return null;
-  const candidates = [];
-  if (typeof ptr.dir === 'string' && ptr.dir) candidates.push(path.resolve(baseDir, ptr.dir));
-  if (typeof ptr.id === 'string' && ptr.id && !/[\\/]/.test(ptr.id)) candidates.push(path.join(baseDir, ptr.id));
-  for (const dir of candidates) if (await isBundleDir(dir)) return dir;
-  return null;
-}
-
-async function fromSymlink(baseDir) {
-  const link = path.join(baseDir, 'latest');
-  if (!(await isBundleDir(link))) return null;
-  try {
-    return await fs.realpath(link);
-  } catch {
-    return null;
-  }
-}
-
-// Self-heal: the newest child dir (by prompt.md mtime, then name) with a prompt.md.
-async function fromScan(baseDir) {
-  let entries;
-  try {
-    entries = await fs.readdir(baseDir, { withFileTypes: true });
-  } catch {
-    return null;
-  }
-  let best = null;
-  for (const e of entries) {
-    if (!e.isDirectory() || e.name === 'latest') continue;
-    const dir = path.join(baseDir, e.name);
-    let st;
-    try {
-      st = await fs.stat(path.join(dir, 'prompt.md'));
-    } catch {
-      continue;
-    }
-    if (!st.isFile()) continue;
-    if (!best || st.mtimeMs > best.mtimeMs || (st.mtimeMs === best.mtimeMs && e.name > best.name)) {
-      best = { dir, name: e.name, mtimeMs: st.mtimeMs };
-    }
-  }
-  return best && best.dir;
-}
-
-// The bundle's frames as absolute paths: those prompt.md references (in the
-// order the walkthrough cites them) that exist, then any other image in the dir.
-async function collectImages(dir, promptMarkdown) {
-  const out = [];
-  const seen = new Set();
-  const add = (p) => {
-    const key = process.platform === 'win32' ? p.toLowerCase() : p;
-    if (!seen.has(key)) { seen.add(key); out.push(p); }
-  };
-  for (const m of promptMarkdown.matchAll(/!\[[^\]]*\]\(\s*<?([^)>]+?)>?\s*\)/g)) {
-    const p = path.resolve(dir, m[1]);
-    if (!IMAGE_EXT.has(path.extname(p).toLowerCase())) continue;
-    try {
-      if ((await fs.stat(p)).isFile()) add(p);
-    } catch { /* referenced but absent — skip */ }
-  }
-  const walk = async (d, depth) => {
-    let entries;
-    try {
-      entries = await fs.readdir(d, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
-    for (const e of entries) {
-      const p = path.join(d, e.name);
-      if (e.isDirectory() && depth > 0) await walk(p, depth - 1);
-      else if (e.isFile() && IMAGE_EXT.has(path.extname(e.name).toLowerCase())) add(p);
-    }
-  };
-  await walk(dir, 1);
-  return out;
-}
-
-/**
- * The newest feedback bundle under baseDir, or null if there is none.
- * @returns {Promise<null|{id:string,dir:string,promptPath:string,promptMarkdown:string,imagePaths:string[]}>}
- */
-async function resolveLatest(baseDir = feedbackBaseDir()) {
-  const dir = (await fromPointer(baseDir)) || (await fromSymlink(baseDir)) || (await fromScan(baseDir));
-  if (!dir) return null;
-  const promptPath = path.join(dir, 'prompt.md');
-  const promptMarkdown = await fs.readFile(promptPath, 'utf8');
-  return {
-    id: path.basename(dir),
-    dir,
-    promptPath,
-    promptMarkdown,
-    imagePaths: await collectImages(dir, promptMarkdown),
-  };
-}
-
-function parseArgs(argv) {
-  const out = { json: false, base: undefined };
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === '--json') out.json = true;
-    else if (a === '--base') out.base = argv[++i];
-    else if (a.startsWith('--base=')) out.base = a.slice('--base='.length);
-  }
-  return out;
-}
-
-async function main() {
-  const args = parseArgs(process.argv.slice(2));
-  const baseDir = args.base || feedbackBaseDir();
-
-  const latest = await resolveLatest(baseDir);
-
-  if (!latest) {
-    if (args.json) {
-      process.stdout.write(`${JSON.stringify({ ok: false, reason: 'no_bundle', baseDir })}\n`);
-    } else {
-      process.stdout.write(
-        `No feedback bundle found under ${baseDir}.\n`
-        + 'Record a walkthrough in the Bongos app and stop the capture — that '
-        + 'writes a bundle here — then run /feedback again.\n',
-      );
-    }
-    return;
-  }
-
-  if (args.json) {
-    process.stdout.write(`${JSON.stringify({
-      ok: true,
-      id: latest.id,
-      dir: latest.dir,
-      promptPath: latest.promptPath,
-      imagePaths: latest.imagePaths,
-      promptMarkdown: latest.promptMarkdown,
-    }, null, 2)}\n`);
-    return;
-  }
-
-  const lines = [];
-  lines.push(`# Latest Bongos feedback bundle — ${latest.id}`);
-  lines.push(`# dir: ${latest.dir}`);
-  lines.push('');
-  lines.push('---- prompt.md ----');
-  lines.push('');
-  lines.push(latest.promptMarkdown.trimEnd());
-  lines.push('');
-  lines.push('---- attached frames (Read each path to see the screenshots) ----');
-  if (latest.imagePaths.length === 0) {
-    lines.push('(none — this session had no salient frames or markup)');
-  } else {
-    for (const p of latest.imagePaths) lines.push(p);
-  }
-  lines.push('');
-  process.stdout.write(`${lines.join('\n')}\n`);
-}
-
-module.exports = { resolveLatest, feedbackBaseDir };
-
-if (require.main === module) {
-  main().catch((err) => {
-    process.stderr.write(`feedback-latest: ${err.message}\n`);
-    process.exitCode = 1;
-  });
-}