@bongos/core 1.21.47 → 1.21.49

package/tests/hall_onboarding_bongos_setup.mjs

@@ -0,0 +1,101 @@
+// task 1004574 — every builders-hall onboarding surface names ONE sign-in
+// command, `npx bongos setup`, the same on every OS. Bare `bongos` is not on a
+// fresh clone's PATH; `npx` resolves the repo's own bin after `npm install`.
+// The old three (`/builder-setup`, `./scripts/setup-builder.sh`,
+// `node scripts/setup-builder.js`) must not come back on these surfaces.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (p) => fs.readFileSync(path.join(ROOT, p), 'utf8');
+const OLD = /\/builder-setup|setup-builder\.(sh|js)/;
+
+// The welcome panel's markup, from the setupSteps literal to the panel's innerHTML.
+function welcomeMarkup() {
+  const src = read('modules/hall-ui/public/hall-render.js');
+  const start = src.indexOf('const setupSteps = `');
+  const end = src.indexOf('body.innerHTML = `', start);
+  assert.ok(start > 0 && end > start, 'welcome panel markup located');
+  return src.slice(start, end).split('\n').filter((l) => !/^\s*\/\//.test(l)).join('\n');
+}
+
+test('welcome panel: the steps and the clone block say npx bongos setup', () => {
+  const w = welcomeMarkup();
+  assert.match(w, /Run <code>npx bongos setup<\/code>/);
+  assert.match(w, /\\nnpm install\\nnpx bongos setup`/, 'clone block ends npm install + npx bongos setup');
+  assert.doesNotMatch(w, OLD, 'no legacy setup command on the welcome panel');
+  assert.doesNotMatch(w, /On Windows, run/, 'one command on every OS — no Windows-only line');
+  assert.match(w, /nodejs\.org/, 'the tooling list names Node, which npm install needs');
+});
+
+test('onboarding checklist: the cli_setup step names npx bongos setup', () => {
+  const src = read('modules/onboarding/onboarding-state.js');
+  const labels = src.slice(src.indexOf('const DISPLAY_LABELS'), src.indexOf('function nextStage'));
+  assert.match(labels, /cli_setup:\s+'Run npx bongos setup'/);
+  assert.match(labels, /cli_setup:\s+'[^']*npx bongos setup[^']*'/);
+  assert.doesNotMatch(labels, OLD);
+});
+
+test('primer: both routes sign in with npx bongos setup', () => {
+  const md = read('docs/onboarding/primer.md');
+  assert.match(md, /```sh\nnpm install\nnpx bongos setup\n```/);
+  // Not inside a `>` quote: the hall's reader garbles a fence there (task 1004575).
+  assert.doesNotMatch(md, /^> ```/m);
+  assert.match(md, /run `npx bongos setup` again/);
+  assert.doesNotMatch(md, OLD);
+});
+
+test('the get-the-code block keeps one command per line (screen and copy)', () => {
+  const css = read('modules/hall-ui/public/style.css');
+  const m = /\.setup__getcode \.welcome__paste\s*\{([^}]*)\}/.exec(css);
+  assert.ok(m, 'scoped rule present');
+  assert.match(m[1], /white-space:\s*pre/, 'copy-on-click reads innerText, so pre is what keeps the line breaks');
+  assert.match(m[1], /overflow-y:\s*hidden/, 'a one-axis strip names both axes');
+});
+
+// task 1004575 — the audit of the above, across the rest of the hall.
+
+test('bin/bongos.js is committed executable, so npx leaves a fresh clone clean', () => {
+  // Committed 100644, `npx bongos` chmods it on first run: the clone then reads as
+  // changed, and a reverted mode makes the next run fail "Permission denied".
+  const entry = execFileSync('git', ['ls-files', '-s', 'bin/bongos.js'], { cwd: ROOT, encoding: 'utf8' });
+  assert.match(entry, /^100755 /, `expected mode 100755, got: ${entry.trim()}`);
+});
+
+test('welcome intro and checklist lead ask only for what a builder needs', () => {
+  const src = read('modules/hall-ui/public/hall-render.js');
+  assert.doesNotMatch(src, /run the platform locally/, 'a builder does not run the platform');
+  assert.match(src, /Clone the project to your machine and run <code>npm install<\/code> in it\./);
+  const st = read('modules/onboarding/onboarding-state.js');
+  assert.doesNotMatch(st, /Device Flow or the web sign-in/);
+  assert.match(st, /auth_complete:\s+'[^']*npx bongos setup[^']*'/);
+});
+
+test('primer no-terminal route installs dependencies (and Node) before signing in', () => {
+  const md = read('docs/onboarding/primer.md');
+    assert.match(md, /Node\*\* \(version 22 or newer\)/);
+  assert.match(md, /send this one message — \*Install this project's dependencies, then run npx bongos setup\.\* —/);
+  assert.match(md, /have four things ready/);
+});
+
+test('Settings CLI access says where to paste the npx command', () => {
+  const html = read('modules/hall-ui/public/settings.html');
+  const js = read('modules/hall-ui/public/settings.js');
+  assert.match(html, /into a terminal in your project folder/);
+  assert.doesNotMatch(html, /bypasses Device Flow/);
+  assert.match(js, /Paste this into a terminal in your project folder:/);
+});
+
+test('the npx paste command Settings hands out is pre-approved for a Claude session', () => {
+  // Both lists: the core's own settings (Bash + PowerShell twins) and the starter
+  // list materialized into every instance. Without them the copied command prompts.
+  const settings = JSON.parse(read('.claude/settings.json'));
+  for (const tool of ['Bash', 'PowerShell']) {
+    assert.ok(settings.permissions.allow.includes(`${tool}(npx bongos paste-token:*)`), `${tool} twin`);
+  }
+  assert.match(read('scripts/gds/claude-materialize.js'), /^\s*'npx bongos paste-token:\*',$/m);
+});

package/tests/instance_config.mjs

@@ -235,3 +235,56 @@ test('resolveApiBase: session:null does not read the session file from disk', ()
   // and callers that already know there is no session get a deterministic answer.
   assert.equal(ic.resolveApiBase({ session: null, env: {}, b: BRAND_B }), 'https://instance-b.example');
 });
+
+// ── task 1004573: the platform's BONGOS_* spelling is always heard ────────────
+// The platform writes every hosted project's web.env as BONGOS_*. Mercury's adopted
+// config/branding.json said envPrefix CLOUDBONGOS, so it read none of it — not its
+// sign-in credentials, not its address, not one setting (live, 2026-10-04).
+
+test('resolveEnv: a pack naming another prefix still reads the platform\'s BONGOS_* (task 1004573)', () => {
+  const env = { BONGOS_GITHUB_CLIENT_ID: 'Iv23-platform' };
+  assert.equal(resolveEnv('GITHUB_CLIENT_ID', { prefix: 'CLOUDBONGOS', env, warn: () => {}, warnPack: () => {} }), 'Iv23-platform');
+  assert.equal(resolveEnv('GITHUB_CLIENT_ID', { prefix: 'OTB', env, warn: () => {}, warnPack: () => {} }), 'Iv23-platform');
+});
+
+test('resolveEnv: the pack\'s own spelling still WINS over the platform\'s (task 1004573)', () => {
+  const env = { CLOUDBONGOS_PUBLIC_ORIGIN: 'https://own.example', BONGOS_PUBLIC_ORIGIN: 'https://platform.example' };
+  assert.equal(resolveEnv('PUBLIC_ORIGIN', { prefix: 'CLOUDBONGOS', env, warn: () => {}, warnPack: () => {} }), 'https://own.example');
+});
+
+test('resolveEnv: BONGOS_* is read BEFORE the legacy list, and is never called deprecated (task 1004573)', () => {
+  const legacyWarnings = [];
+  const v = resolveEnv('JOINABILITY', { prefix: 'OTB', env: { BONGOS_JOINABILITY: 'open', PMS_JOINABILITY: 'closed' }, warn: (w) => legacyWarnings.push(w), warnPack: () => {} });
+  assert.equal(v, 'open', 'the canonical platform spelling beats a legacy one');
+  assert.ok(!legacyWarnings.some((w) => /^BONGOS_/.test(w.legacyName)), 'BONGOS_ is the canonical name — no deprecation warning names it');
+});
+
+test('resolveEnv: when it has to read BONGOS_*, it says to fix the pack — and only then (task 1004573)', () => {
+  const calls = [];
+  const warnPack = (w) => calls.push(w);
+  resolveEnv('LOOK', { prefix: 'CLOUDBONGOS', env: { BONGOS_LOOK: 'own' }, warn: () => {}, warnPack });
+  assert.deepEqual(calls, [{ prefix: 'CLOUDBONGOS', name: 'BONGOS_LOOK' }], 'names the pack prefix and the name it fell back to');
+  resolveEnv('LOOK', { prefix: 'CLOUDBONGOS', env: { CLOUDBONGOS_LOOK: 'x', BONGOS_LOOK: 'own' }, warn: () => {}, warnPack });
+  resolveEnv('LOOK', { prefix: 'BONGOS', env: { BONGOS_LOOK: 'own' }, warn: () => {}, warnPack });
+  assert.equal(calls.length, 1, 'silent when the pack\'s own spelling won, and when the pack is already BONGOS');
+});
+
+test('resolveEnv: the default pack warning names the fix, once per process (task 1004573)', () => {
+  const seen = [];
+  const orig = console.warn;
+  console.warn = (m) => seen.push(String(m));
+  try {
+    // the default warnPack — the real wiring, not a hand-called helper
+    resolveEnv('ONE', { prefix: 'CLOUDBONGOS', env: { BONGOS_ONE: '1' }, warn: () => {} });
+    resolveEnv('TWO', { prefix: 'CLOUDBONGOS', env: { BONGOS_TWO: '2' }, warn: () => {} });
+  } finally { console.warn = orig; }
+  const lines = seen.filter((m) => /envPrefix "CLOUDBONGOS"/.test(m));
+  assert.equal(lines.length, 1, 'one line, not one per setting');
+  assert.match(lines[0], /BONGOS_ONE/);
+  assert.match(lines[0], /Set envPrefix to "BONGOS"/);
+});
+
+test('resolveEnv: a pack already on BONGOS is unchanged (task 1004573)', () => {
+  assert.equal(resolveEnv('X', { prefix: 'BONGOS', env: { BONGOS_X: 'a', PMS_X: 'b' }, warn: () => {}, warnPack: () => {} }), 'a');
+  assert.equal(resolveEnv('X', { prefix: 'BONGOS', env: {}, warn: () => {}, warnPack: () => {} }), undefined);
+});

package/tests/instance_feedback.mjs

@@ -312,6 +312,18 @@ test('the skill files unasked on a Bongos rant, and the kernel tells every sessi
   assert.match(kernel, /vents that Bongos itself is broken.*\/bongos-feedback/);
 });
 
+// task 1004576: "Bongos feedback: …" (a calm wish, not a rant) fired no skill — the
+// listing only described venting, and a since-deleted /feedback skill owned the phrase.
+test('a labelled message or a wish about Bongos triggers the skill too, and nothing else claims the phrase', () => {
+  const skill = fs.readFileSync(path.join(ROOT, '.claude/skills/bongos-feedback/SKILL.md'), 'utf8');
+  const description = skill.split('\n---')[0];
+  assert.match(description, /Bongos feedback:/, 'the literal label is a trigger');
+  assert.match(description, /Bongos should/, 'a wish is a trigger');
+  assert.match(skill, /Suggestions count/);
+  assert.match(skill, /\*\*is\*\* the go/, 'a labelled message is sent without a second ask');
+  assert.ok(!fs.existsSync(path.join(ROOT, '.claude/skills/feedback')), 'no second skill competes for "feedback"');
+});
+
 test('every report is secret-scrubbed before it leaves the machine, and never sent unscrubbed', async () => {
   const { scrubReport } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
   const token = 'ghp_' + 'a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8';

package/tests/provision.mjs

@@ -1330,6 +1330,59 @@ await ta('scaffoldStandaloneRepo(adopt): does NOT clobber an existing .gitignore
   assert.match(String(gi.body), /node_modules\//, 'and the entries `npm ci` + the deploy require are added');
 });
 
+// Task 1004573: adopt layers config only where ABSENT, so an owner's config/branding.json
+// kept whatever envPrefix it carried while web.env was written under the platform's —
+// mercury's said CLOUDBONGOS and read none of its credentials or settings.
+async function adoptWithPack(packText, mode = 'adopt') {
+  const base = mkdtempSync(join(tmpdir(), `pack-${mode}-`));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    mkdirSync(join(base, 'demo', 'config'), { recursive: true });
+    writeFileSync(join(base, 'demo', 'config', 'branding.json'), packText);
+    const { deps } = recorder({ apply: true });
+    const seq = [];
+    deps.exec = (cmd) => { seq.push(`exec ${cmd}`); return { ok: true, stdout: '' }; };
+    deps.writeFile = (p, body) => { seq.push(`write ${p}`); seq.writes = (seq.writes || []).concat([{ p, body }]); return { ok: true }; };
+    deps.getGithubToken = async () => ({ token: 'gho_TOK', scope: 'repo' });
+    await P.scaffoldStandaloneRepo(
+      { slug: 'demo', hosting_shape: 'cloud-host', target_ref: 'example-owner/demo', owner_builder_id: 7, onboard_mode: mode },
+      { ...deps, instanceRoot: base },
+    );
+    return { seq, writes: seq.writes || [] };
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    rmSync(base, { recursive: true, force: true });
+  }
+}
+const U2 = require('../scripts/gds/provision-units.js');
+
+await ta('scaffoldStandaloneRepo(adopt): an owner pack on another envPrefix is corrected IN the adopt commit (task 1004573)', async () => {
+  const owner = '{\n  "identity": { "productName": "mercury" },\n  "envPrefix": "CLOUDBONGOS",\n  "configDir": "cloudbongos"\n}\n';
+  const { seq, writes } = await adoptWithPack(owner);
+  const w = writes.find((x) => /config\/branding\.json$/.test(x.p));
+  assert.ok(w, 'the pack was rewritten');
+  assert.equal(JSON.parse(w.body).envPrefix, U2.provisionedEnvPrefix(), 'to the prefix web.env is written under');
+  assert.equal(w.body, owner.replace('"envPrefix": "CLOUDBONGOS"', `"envPrefix": "${U2.provisionedEnvPrefix()}"`), 'and NOTHING else in the owner\'s file moved');
+  const wrote = seq.findIndex((s) => /^write .*config\/branding\.json$/.test(s));
+  const added = seq.findIndex((s) => /git -C \S+ add -A/.test(s));
+  assert.ok(wrote >= 0 && added > wrote, 'written before `git add -A`, so it rides the adopt commit to the owner\'s repo');
+});
+
+await ta('scaffoldStandaloneRepo: a pack that already agrees, and a greenfield scaffold, are left alone (task 1004573)', async () => {
+  const agree = await adoptWithPack(JSON.stringify({ envPrefix: U2.provisionedEnvPrefix() }));
+  assert.ok(!agree.writes.some((x) => /config\/branding\.json$/.test(x.p)), 'agreeing pack untouched');
+  const green = await adoptWithPack(JSON.stringify({ envPrefix: 'CLOUDBONGOS' }), 'greenfield');
+  assert.ok(!green.writes.some((x) => /config\/branding\.json$/.test(x.p)), 'greenfield owns its config through init; no rewrite here');
+});
+
+await ta('normalizePackEnvPrefix: rewrites only the value, refuses what it cannot rewrite safely (task 1004573)', async () => {
+  assert.deepEqual(U2.normalizePackEnvPrefix('{"envPrefix":"OTB","x":1}', 'BONGOS'), { text: '{"envPrefix":"BONGOS","x":1}', from: 'OTB' });
+  assert.equal(U2.normalizePackEnvPrefix('{"envPrefix":"BONGOS"}', 'BONGOS'), null);
+  assert.equal(U2.normalizePackEnvPrefix('{"identity":{}}', 'BONGOS'), null, 'no envPrefix → nothing to correct');
+  assert.equal(U2.normalizePackEnvPrefix('not json', 'BONGOS'), null);
+});
+
 await ta('scaffoldStandaloneRepo(adopt): a default branch that is not `main` fails LOUDLY, not silently', async () => {
   // The rest of provisioning is main-only (git pull --ff-only origin main; the box deploy
   // does git reset --hard origin/main), so layering onto another branch would push somewhere
@@ -1776,6 +1829,56 @@ await ta('a failure BEFORE GitHub handed over credentials claims no App (task 10
   assert.ok(resolves.every((x) => !('app_slug' in x.patch)), 'no App is named when none was handed over');
 });
 
+// Task 1004573: an adopted repo brings its own config/branding.json. Mercury's said
+// envPrefix CLOUDBONGOS while the platform wrote BONGOS_*, so the project never saw
+// its credentials — and the only thing anyone was told was "did not report sign-in
+// ready". When the check fails, the runner now reads the pack and names a mismatch.
+const U = require('../scripts/gds/provision-units.js');
+
+await ta('envPrefixMismatch names a pack that reads other names, and nothing else (task 1004573)', async () => {
+  const m = U.envPrefixMismatch(JSON.stringify({ envPrefix: 'CLOUDBONGOS' }), 'BONGOS');
+  assert.match(m, /reads settings named CLOUDBONGOS_\*, but the platform wrote BONGOS_\*/);
+  assert.match(m, /set its envPrefix to "BONGOS"/);
+  assert.equal(U.envPrefixMismatch(JSON.stringify({ envPrefix: 'BONGOS' }), 'BONGOS'), null, 'agreeing names say nothing');
+  assert.equal(U.envPrefixMismatch(JSON.stringify({ identity: {} }), 'BONGOS'), null, 'a pack with no envPrefix claims nothing');
+  assert.equal(U.envPrefixMismatch('not json', 'BONGOS'), null, 'an unreadable pack claims nothing');
+  assert.equal(U.envPrefixMismatch(null, 'BONGOS'), null);
+});
+
+await ta('a sign-in check that fails on a mismatched pack SAYS so (task 1004573)', async () => {
+  const inst = { ...coTenant, hosting_shape: 'cloud-host', slug: 'mercury', domain: 'mercury.example.com' };
+  const cmds = [], reads = [];
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 1, appSlug: 's' }),
+    exec: (cmd) => { cmds.push(cmd); return { ok: true, stdout: '{"ok":true,"auth_configured":false}' }; },
+    readFile: (p) => { reads.push(p); return JSON.stringify({ envPrefix: 'CLOUDBONGOS' }); },
+    writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /credentials are placed/, 'still owns what DID happen');
+  assert.match(r.error, /reads settings named CLOUDBONGOS_\*, but the platform wrote/, 'and names the cause');
+  assert.deepEqual(reads, [join(P.standaloneRoot(inst), 'config', 'branding.json')], 'reads the project\'s OWN pack, from its checkout');
+  assert.ok(!cmds.some((c) => /branding\.json/.test(c)), 'a plain file read — no shell command carries the path');
+});
+
+await ta('a sign-in check that fails with agreeing names keeps the plain message (task 1004573)', async () => {
+  const inst = { ...coTenant, hosting_shape: 'cloud-host', domain: 'mercury.example.com' };
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 1, appSlug: 's' }),
+    exec: () => ({ ok: true, stdout: '{"ok":true,"auth_configured":false}' }),
+    readFile: () => JSON.stringify({ envPrefix: U.provisionedEnvPrefix() }),
+    writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.error, 'the credentials are placed, but the project did not report sign-in ready in time');
+  // an unreadable pack names nothing either
+  const r2 = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, { ...deps, readFile: () => { throw new Error('ENOENT'); } });
+  assert.equal(r2.error, 'the credentials are placed, but the project did not report sign-in ready in time');
+});
+
 await ta('a PRE-conversion failure stays retryable — the narrowing spared the retry path (F23)', async () => {
   let claims = 0; const resolves = [];
   const deps = {

package/tests/skill_menu_ruling.mjs

@@ -19,7 +19,7 @@ const read = (n) => fs.readFileSync(byName.get(n), 'utf8');
 const info = (n) => lint.lintSkillFile(read(n), { file: byName.get(n) });
 
 // The ruling, as written into the task.
-const LISTED_TRIMMED = ['grade-recover', 'collab-review', 'session-handoff', 'builder-claim', 'builder-sequence', 'blocker-solve', 'design', 'goal-create', 'blocker-review', 'builder-reauth', 'read-session-export', 'recall', 'worktree-clean', 'merge-mode', 'builder-setup', 'builder-key', 'bongos-feedback', 'feedback', 'builder-redteam', 'scan-before-install', 'owner-review'];
+const LISTED_TRIMMED = ['grade-recover', 'collab-review', 'session-handoff', 'builder-claim', 'builder-sequence', 'blocker-solve', 'design', 'goal-create', 'blocker-review', 'builder-reauth', 'read-session-export', 'recall', 'worktree-clean', 'merge-mode', 'builder-setup', 'builder-key', 'bongos-feedback', 'builder-redteam', 'scan-before-install', 'owner-review'];
 const LISTED_AS_IS = ['strand-fix', 'builder-ship', 'builder-start', 'fix-task', 'ask-for-help', 'ship-check', 'status', 'builder-end', 'builder-release', 'builder-stage'];
 const HIDDEN = ['planning-session', 'goal-close', 'grade-sweep', 'builder-exit', 'builder-backup', 'builder-cost', 'new-project', 'design-sync', 'figma-design-sync', 'tweak'];
 const ALIASES = ['backlog-review', 'bug-triage', 'idea-triage', 'priority-session', 'goal-uat', 'goal-review', 'grade-audit', 'grader-health'];

package/.claude/skills/feedback/SKILL.md

@@ -1,39 +0,0 @@
----
-name: feedback
-description: >-
-  Pull the latest Bongos feedback bundle (walkthrough transcript, screenshots) into this session; read-only. Triggers: "/feedback", "pull in my latest feedback", "load my bongos feedback", "I just recorded a walkthrough", "act on my screen recording".
-plain: >-
-  Loads your most recent recorded walkthrough, what you said and the screenshots, into this conversation.
-reach-for: >-
-  Right after you have recorded feedback on the project and want your assistant to act on it.
-cost: >-
-  Free, and it changes nothing. It only reads files on your computer.
----
-
-You are pulling in the **latest Bongos feedback bundle** — a self-contained capture the user just recorded with the Bongos desktop app (BV1.R13 / [ADR 0087](../../../docs/adr/0087-bongos-app-architecture-and-handoff-contract.md)). The app turns a spoken screen walkthrough into a model-agnostic `prompt.md` (a timestamped transcript + an ask) plus a handful of screenshots, all under `~/CloudBongos/feedback/`. This skill loads that bundle so you can act on it directly — no copy-paste, no clipboard-image fiddling.
-
-## Steps
-
-1. **Resolve + print the latest bundle:**
-
-   ```bash
-   node scripts/gds/feedback-latest.js
-   ```
-
-   This prints the full `prompt.md` body followed by an `attached frames` list — one **absolute image path** per line. (Add `--json` if you want structured output instead.)
-
-2. **If it says "No feedback bundle found"** — tell the user there's nothing to load yet: record a walkthrough in the Bongos app and stop the capture (that writes the bundle), then run `/feedback` again. Stop here.
-
-3. **Read every listed frame.** For each absolute path under `attached frames`, call the **Read** tool on it so the screenshots enter your context as images. The paths are real files on disk — Read them directly; do not ask the user to paste anything.
-
-4. **Act on the bundle.** Treat the transcript in `prompt.md` as the request and the screenshots as ground truth for what the user was looking at (the timestamps line the words up with the images). Work out what they want changed or fixed and do it. Ask a question only if you are genuinely blocked.
-
-## Notes
-
-- **Read-only + local.** The helper only reads files under `~/CloudBongos/feedback/`; it needs no Bongos session and no network.
-- **"Latest" = most recently produced.** The Bongos app updates a `latest` pointer every time a capture is stopped, so this always loads the newest walkthrough. To act on an older one, point the user at the specific dir under `~/CloudBongos/feedback/`.
-- **The frames are file paths, never base64** — that's the whole point of the bundle format (it keeps the text prompt tiny and lets your Read tool load the images). See [ADR 0087](../../../docs/adr/0087-bongos-app-architecture-and-handoff-contract.md) for the full bundle contract.
-
-## Files this skill touches
-
-- Runs: `node scripts/gds/feedback-latest.js` (resolves the ADR 0087 `latest` pointer itself — the app source is off-repo, ADR 0098).

package/scripts/bongos-mcp.js

@@ -1,28 +0,0 @@
-#!/usr/bin/env node
-// scripts/bongos-mcp.js — R14 launcher for the Bongos feedback MCP server.
-//
-// This is the entry point a Claude MCP config points at. The server itself
-// lives in bongos-app/src/mcp-server.js (bundled with the app); this thin
-// launcher lets it run from a repo checkout / a stable path without depending
-// on the app's process.
-//
-// Register it with Claude Code:
-//   claude mcp add bongos-feedback -- node /ABSOLUTE/PATH/scripts/bongos-mcp.js
-//
-// Or in a Claude Desktop / Code MCP config:
-//   { "mcpServers": { "bongos-feedback": {
-//       "command": "node",
-//       "args": ["/ABSOLUTE/PATH/scripts/bongos-mcp.js"] } } }
-//
-// Then call the get_latest_feedback tool to pull the latest bundle (prompt text
-// + screenshot file paths). See bongos-app/README.md for the full contract.
-
-'use strict';
-
-const path = require('node:path');
-const { main } = require(path.join(__dirname, '..', 'bongos-app', 'src', 'mcp-server.js'));
-
-main().catch((err) => {
-  process.stderr.write(`bongos-mcp: ${err.message}\n`);
-  process.exit(1);
-});

package/scripts/gds/feedback-latest.js

@@ -1,224 +0,0 @@
-#!/usr/bin/env node
-// scripts/gds/feedback-latest.js — R13 (BV1.R13): the engine behind the
-// /feedback Claude Code slash command.
-//
-// Resolves the LATEST feedback bundle the Bongos app wrote to
-// ~/CloudBongos/feedback/ (via the shared `latest` pointer, ADR 0087) and
-// prints it for a Claude Code session:
-//
-//   1. the full prompt.md body (the model-agnostic transcript + ask, R11), and
-//   2. the ABSOLUTE path of every attached frame, on its own line, so Claude's
-//      Read tool can load each image directly.
-//
-// This sidesteps the CLI's unreliable clipboard-image paste: Claude reads the
-// frames from disk by path instead of from a pasted blob.
-//
-// Usage:
-//   node scripts/gds/feedback-latest.js            # human/agent-readable dump
-//   node scripts/gds/feedback-latest.js --json     # { id, dir, promptMarkdown, imagePaths }
-//   node scripts/gds/feedback-latest.js --base DIR # override bundle base dir (tests)
-//
-// Local + read-only: it reads files under your home dir. No GDS session, no
-// network — so it works on any machine the Bongos app runs on.
-//
-// resolveLatest + feedbackBaseDir are ported here from the app's
-// bongos-app/src/handoff.js, which no longer lives in this repo (the desktop
-// apps publish off-repo, ADR 0098 — task 1004356). The contract is ADR 0087's:
-// `latest.json` is authoritative, the `latest/` symlink is a convenience that
-// may be absent, and with neither the reader self-heals by scanning for the
-// newest bundle dir holding a prompt.md.
-
-'use strict';
-
-const fs = require('node:fs/promises');
-const os = require('node:os');
-const path = require('node:path');
-
-const IMAGE_EXT = new Set(['.png', '.jpg', '.jpeg', '.webp', '.gif']);
-
-/** Where the Bongos app writes bundles: ~/CloudBongos/feedback. */
-function feedbackBaseDir() {
-  return path.join(os.homedir(), 'CloudBongos', 'feedback');
-}
-
-async function isBundleDir(dir) {
-  try {
-    return (await fs.stat(path.join(dir, 'prompt.md'))).isFile();
-  } catch {
-    return false;
-  }
-}
-
-// The dir `latest.json` names, or null if it is missing, unreadable or stale.
-// Accepts the pointer by `dir` (absolute) or by `id` (a child of baseDir).
-async function fromPointer(baseDir) {
-  let ptr;
-  try {
-    ptr = JSON.parse(await fs.readFile(path.join(baseDir, 'latest.json'), 'utf8'));
-  } catch {
-    return null;
-  }
-  if (!ptr || typeof ptr !== 'object') return null;
-  const candidates = [];
-  if (typeof ptr.dir === 'string' && ptr.dir) candidates.push(path.resolve(baseDir, ptr.dir));
-  if (typeof ptr.id === 'string' && ptr.id && !/[\\/]/.test(ptr.id)) candidates.push(path.join(baseDir, ptr.id));
-  for (const dir of candidates) if (await isBundleDir(dir)) return dir;
-  return null;
-}
-
-async function fromSymlink(baseDir) {
-  const link = path.join(baseDir, 'latest');
-  if (!(await isBundleDir(link))) return null;
-  try {
-    return await fs.realpath(link);
-  } catch {
-    return null;
-  }
-}
-
-// Self-heal: the newest child dir (by prompt.md mtime, then name) with a prompt.md.
-async function fromScan(baseDir) {
-  let entries;
-  try {
-    entries = await fs.readdir(baseDir, { withFileTypes: true });
-  } catch {
-    return null;
-  }
-  let best = null;
-  for (const e of entries) {
-    if (!e.isDirectory() || e.name === 'latest') continue;
-    const dir = path.join(baseDir, e.name);
-    let st;
-    try {
-      st = await fs.stat(path.join(dir, 'prompt.md'));
-    } catch {
-      continue;
-    }
-    if (!st.isFile()) continue;
-    if (!best || st.mtimeMs > best.mtimeMs || (st.mtimeMs === best.mtimeMs && e.name > best.name)) {
-      best = { dir, name: e.name, mtimeMs: st.mtimeMs };
-    }
-  }
-  return best && best.dir;
-}
-
-// The bundle's frames as absolute paths: those prompt.md references (in the
-// order the walkthrough cites them) that exist, then any other image in the dir.
-async function collectImages(dir, promptMarkdown) {
-  const out = [];
-  const seen = new Set();
-  const add = (p) => {
-    const key = process.platform === 'win32' ? p.toLowerCase() : p;
-    if (!seen.has(key)) { seen.add(key); out.push(p); }
-  };
-  for (const m of promptMarkdown.matchAll(/!\[[^\]]*\]\(\s*<?([^)>]+?)>?\s*\)/g)) {
-    const p = path.resolve(dir, m[1]);
-    if (!IMAGE_EXT.has(path.extname(p).toLowerCase())) continue;
-    try {
-      if ((await fs.stat(p)).isFile()) add(p);
-    } catch { /* referenced but absent — skip */ }
-  }
-  const walk = async (d, depth) => {
-    let entries;
-    try {
-      entries = await fs.readdir(d, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
-    for (const e of entries) {
-      const p = path.join(d, e.name);
-      if (e.isDirectory() && depth > 0) await walk(p, depth - 1);
-      else if (e.isFile() && IMAGE_EXT.has(path.extname(e.name).toLowerCase())) add(p);
-    }
-  };
-  await walk(dir, 1);
-  return out;
-}
-
-/**
- * The newest feedback bundle under baseDir, or null if there is none.
- * @returns {Promise<null|{id:string,dir:string,promptPath:string,promptMarkdown:string,imagePaths:string[]}>}
- */
-async function resolveLatest(baseDir = feedbackBaseDir()) {
-  const dir = (await fromPointer(baseDir)) || (await fromSymlink(baseDir)) || (await fromScan(baseDir));
-  if (!dir) return null;
-  const promptPath = path.join(dir, 'prompt.md');
-  const promptMarkdown = await fs.readFile(promptPath, 'utf8');
-  return {
-    id: path.basename(dir),
-    dir,
-    promptPath,
-    promptMarkdown,
-    imagePaths: await collectImages(dir, promptMarkdown),
-  };
-}
-
-function parseArgs(argv) {
-  const out = { json: false, base: undefined };
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === '--json') out.json = true;
-    else if (a === '--base') out.base = argv[++i];
-    else if (a.startsWith('--base=')) out.base = a.slice('--base='.length);
-  }
-  return out;
-}
-
-async function main() {
-  const args = parseArgs(process.argv.slice(2));
-  const baseDir = args.base || feedbackBaseDir();
-
-  const latest = await resolveLatest(baseDir);
-
-  if (!latest) {
-    if (args.json) {
-      process.stdout.write(`${JSON.stringify({ ok: false, reason: 'no_bundle', baseDir })}\n`);
-    } else {
-      process.stdout.write(
-        `No feedback bundle found under ${baseDir}.\n`
-        + 'Record a walkthrough in the Bongos app and stop the capture — that '
-        + 'writes a bundle here — then run /feedback again.\n',
-      );
-    }
-    return;
-  }
-
-  if (args.json) {
-    process.stdout.write(`${JSON.stringify({
-      ok: true,
-      id: latest.id,
-      dir: latest.dir,
-      promptPath: latest.promptPath,
-      imagePaths: latest.imagePaths,
-      promptMarkdown: latest.promptMarkdown,
-    }, null, 2)}\n`);
-    return;
-  }
-
-  const lines = [];
-  lines.push(`# Latest Bongos feedback bundle — ${latest.id}`);
-  lines.push(`# dir: ${latest.dir}`);
-  lines.push('');
-  lines.push('---- prompt.md ----');
-  lines.push('');
-  lines.push(latest.promptMarkdown.trimEnd());
-  lines.push('');
-  lines.push('---- attached frames (Read each path to see the screenshots) ----');
-  if (latest.imagePaths.length === 0) {
-    lines.push('(none — this session had no salient frames or markup)');
-  } else {
-    for (const p of latest.imagePaths) lines.push(p);
-  }
-  lines.push('');
-  process.stdout.write(`${lines.join('\n')}\n`);
-}
-
-module.exports = { resolveLatest, feedbackBaseDir };
-
-if (require.main === module) {
-  main().catch((err) => {
-    process.stderr.write(`feedback-latest: ${err.message}\n`);
-    process.exitCode = 1;
-  });
-}