@bongos/core 1.24.68 → 1.24.70

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.68",
-  "core_contract": "1.24.68",
-  "source_commit": "11d18a24f88e4a0dc0348653d46f1436332533b7",
+  "core_version": "1.24.70",
+  "core_contract": "1.24.70",
+  "source_commit": "a350b334d96df595a8aa73fb65c596295bd6cfb7",
   "source_ref": "HEAD",
-  "built_at": "2026-11-09T20:26:36.856Z",
+  "built_at": "2026-11-09T21:11:38.880Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 638,
     "agent_docs_stubbed": 32,
-    "functional_verbatim": 3904,
+    "functional_verbatim": 3908,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4575,
-  "tree_sha256": "55f8f3d3ffc2f4ed3ccf4c3dfbc91607b1a72f70d465e1930d322a45ed7438dd",
+  "file_count": 4579,
+  "tree_sha256": "3dabfd3600f3905906abbcb8d0156b813445a0a8dbfd20939c189c6e5d3b238a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -352,7 +352,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "77166efc6944d67f1ffe5b2bc9202ab72ae8331acdf341dffebe4cb034abe56d"
+      "sha256": "6d1fb838c88cc18ecc3d707920d38bff0a3b0390bd45499ed438f91658efc92c"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -557,7 +557,7 @@
     {
       "path": "docs/adr/0029-status-page-outage-resilience.md",
       "mode": "0000644",
-      "sha256": "ec0298ea8652e72c00f90546a57a08a1aca9d0208593bb56bde0a7254aa1e851"
+      "sha256": "199fc3e775f32f46a658294bbbe83783a7455cff2b554f8680f4235b1ae0ece1"
     },
     {
       "path": "docs/adr/0030-builders-hall-live-updates.md",
@@ -2467,7 +2467,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "eef94b4f6e03a937b12238548480a9a9b86d4703e43c9488c58dda8deb3b0fe7"
+      "sha256": "c9a5331ff4b4473ff3176e3221fbe36e815376be79d6b7eb24851780ddc6843c"
     },
     {
       "path": "docs/architecture.md",
@@ -2492,12 +2492,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "bd5ef906397529dae368125b3ffc2a315b60816912d19e255d350b4751f8486b"
+      "sha256": "73c9d6e7637bed0c5451c3127a67f65210665d9fc430a8e34290faecb39a15c8"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "8163fd272d96d4401673aa30b150c42f5caca342ab4a3f79ed5662f88d0caf73"
+      "sha256": "d6ead2b50a53579c4537279c5e950509d19e819fb9d92dcd641a012c2bba2af8"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -3007,7 +3007,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "15027e86a94259e4ea08d9d2b47234bd92e4ee8b205677ee27ef20b6579e30a2"
+      "sha256": "851492664b3fffc2ca8ac33748272b99487c48eb021924b50d9e6530f20c69ee"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3097,7 +3097,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "f6ed00806ce3b4e851fdd0ef1099760f94f4aeb5e44f4f539f99fb1d404997d1"
+      "sha256": "b6adc8c75a1f4650bebe3be30eb8da5966870c435e8baf192136ffad738c755d"
     },
     {
       "path": "docs/project-context.template.md",
@@ -3127,7 +3127,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "c5840a0cae12bde4eef54a5b2785046fe3bfbb750bb7be7bc3808e4eb3491d0d"
+      "sha256": "09cb01eeb9aa79bca4380b11498c05dd30e4985358e8cb8fdec7497b2a9581b6"
     },
     {
       "path": "docs/recipes/failed-ship-recovery-proof.md",
@@ -7027,7 +7027,7 @@
     {
       "path": "modules/hall-ui/public/settings.js",
       "mode": "0000644",
-      "sha256": "72431e5ee67272477e653ac0401b2898c3ec88a0f4ad58187697e2b79df8c56c"
+      "sha256": "c5fa5af5142ceab44d0589323a70cbc581a5367dd2846894e9f6c6d8f5b9e55c"
     },
     {
       "path": "modules/hall-ui/public/settings.states.json",
@@ -8157,7 +8157,7 @@
     {
       "path": "modules/lifecycle/merge-reach.js",
       "mode": "0000644",
-      "sha256": "77ee8eb1615feb977701f8f50f14a080b9ebb0cda07dbc5ce0a5061ab2063fb8"
+      "sha256": "422b941660edc139d0353cccb110c8d130827c02200511da372d23456f133e51"
     },
     {
       "path": "modules/lifecycle/migrations/lifecycle_001_goal_first_leads.sql",
@@ -11902,12 +11902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ae81a9706d5fb007fa6ab9d3fa6783616f3adb642fd256c5478bf30a211026f6"
+      "sha256": "7c4c05af121a62f8295aba963f5311e96710d500228c7ee10f37104ee682801e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cd129832a4eea52b6613553aa6da6fb2ce7f853bff8d1032d5adfd233e53710c"
+      "sha256": "bc8dfa759d28726c17917ec87eaa4b53aece326d188dd188d9ed610a0d57ed1c"
     },
     {
       "path": "public-docs/index.html",
@@ -11927,7 +11927,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "24f4dda6011cf1e1c255226457e1647e80821260e443a11b76e858193073b8eb"
+      "sha256": "443fde562e11006c7aa2d82437d1101fa561c9b2451fa659cc81a2939a9aee2d"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12182,7 +12182,7 @@
     {
       "path": "scripts/bongos/claim.js",
       "mode": "0000644",
-      "sha256": "bb8b7a0104622d725c7057f04aea6b82f0586f6323a761302afdb3942fb65ae2"
+      "sha256": "377cd8c4aa3bff219bf2d071cdfe0f918a3ceb30b775d8c881f329f36173f1e0"
     },
     {
       "path": "scripts/bongos/claude-materialize.js",
@@ -12292,7 +12292,7 @@
     {
       "path": "scripts/bongos/deploy-divergence.js",
       "mode": "0000644",
-      "sha256": "bf18a79242d650a5974b40607dbedcf2d40c9c65d86ddc61cdf19e242cc4f2cb"
+      "sha256": "82b9f7657d6fcd5ed8bd79e4e7104e3b960b649eaf122d6ab871f48b86494ad9"
     },
     {
       "path": "scripts/bongos/deploy-main-audit-gate.sh",
@@ -12372,7 +12372,7 @@
     {
       "path": "scripts/bongos/docs-entropy.js",
       "mode": "0000644",
-      "sha256": "a5892548ea37b1722554869334e1baa1dcc800740f582e3cb0492e3164ffe36b"
+      "sha256": "cd5fd3f0987de9b6e5af0efdf9dcdd2f8b4589e6754732e869eafd85086bea78"
     },
     {
       "path": "scripts/bongos/doctor.js",
@@ -12452,7 +12452,7 @@
     {
       "path": "scripts/bongos/fitness-lib.js",
       "mode": "0000644",
-      "sha256": "826ae1aef8e287ec92b0f4ba0e5da8ddf8a50b26eb4c9711fb3b667bde4461d0"
+      "sha256": "d8d931588338aae3f29b60b6746b946a7a67e42d7e9ba35f6eaaa36ae62c9697"
     },
     {
       "path": "scripts/bongos/fitness-migration-contraction.js",
@@ -12902,7 +12902,7 @@
     {
       "path": "scripts/bongos/paste-token.js",
       "mode": "0000644",
-      "sha256": "77f3d0fa9173c133695f4bb352d529a9c6a7a54dc05c0170a9a88d368636f80d"
+      "sha256": "723d12775c925192d3a088470abbb59563a529d8d36cec56c4851f4159c07dea"
     },
     {
       "path": "scripts/bongos/plain-cards.js",
@@ -13287,7 +13287,7 @@
     {
       "path": "scripts/bongos/ship-check.js",
       "mode": "0000644",
-      "sha256": "e81fc260cceef6c8ccaf90aaa09aa189183d89d8696bcc20aca2f3ea9610b2d7"
+      "sha256": "26d22c6dbd372974911e0ab096844ab37491e882da2fb972ec5e40e2df0275d1"
     },
     {
       "path": "scripts/bongos/ship-deploy-target.js",
@@ -15444,6 +15444,11 @@
       "mode": "0000644",
       "sha256": "cc2d0e61bde18cbaabe4fe850f70b3052ae8815686133c05691397faa90d91e3"
     },
+    {
+      "path": "src/bongos/device-flow-blocker.js",
+      "mode": "0000644",
+      "sha256": "f34153ac5fd891904dd6ef06e2c4b3c1f860f487a2b11c9a41c1109369ac570f"
+    },
     {
       "path": "src/bongos/github-repos.js",
       "mode": "0000644",
@@ -15677,7 +15682,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "6348ee00e6e60d899f3e98bc55a75e6b3f88562fcda7a1655a4d4df1c2273393"
+      "sha256": "5dac69f518fb0933f111d3df4dfc400e1573ffd2849abe7599ed16bd0ab63d58"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -15867,7 +15872,7 @@
     {
       "path": "src/instance-config.js",
       "mode": "0000644",
-      "sha256": "17daf4a38c2e208130fbfe5afe56f548d9bc3bfa9fd57a2ab2dbe459748da811"
+      "sha256": "b123541932f206894a652aebf64a13ed0794a4b44e68936a11d65bf49c7a2fc9"
     },
     {
       "path": "src/link-preview.js",
@@ -15877,7 +15882,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c1a27021e0c321c2125b4cac14ae9441f74250c88c3b9fb8fe2d7b562d06924c"
+      "sha256": "d00b511fa641d743ac90571e844a8d150e15010b0e69302e2b237e9c3eeb1c1e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16087,7 +16092,7 @@
     {
       "path": "tests/agent_standing_rules.mjs",
       "mode": "0000644",
-      "sha256": "f296357646d9eb778a5334b75742ef1172ff87e10b26a5e7eaffe0e8fe983120"
+      "sha256": "08edffc3a673b01249586330d7cb0fbb4f31d7dfaaadc80864191899fedb5545"
     },
     {
       "path": "tests/agents_authoring.mjs",
@@ -16647,7 +16652,7 @@
     {
       "path": "tests/bongos_cli.mjs",
       "mode": "0000644",
-      "sha256": "b9bfebce2f0e2a806ce02271ca0a6f45ce2b8cd3dd487ca4cccc91f7fb10a8c5"
+      "sha256": "9592802bf6c47ac1e11acdc8ca99a30c6d101c5fa45669d359cf3f7c7fdb098a"
     },
     {
       "path": "tests/bongos_dispatch.mjs",
@@ -16814,6 +16819,11 @@
       "mode": "0000644",
       "sha256": "8b937f463b8f03dba8c67047d8aca9be84a00839f4821e00ee5d31a96a6bead9"
     },
+    {
+      "path": "tests/claim_finish_hint.mjs",
+      "mode": "0000644",
+      "sha256": "a8c2e33617c23d9f6584f2901a7ad9f77f0ed5588b2dd219ba79b3c4c805b4b0"
+    },
     {
       "path": "tests/claim_from_task_and_home.mjs",
       "mode": "0000644",
@@ -16912,7 +16922,7 @@
     {
       "path": "tests/cli_token_reissue.mjs",
       "mode": "0000644",
-      "sha256": "498bd487692f41f2fd2670d83341d1711be4cea7a137aff3c6792a833eca91fc"
+      "sha256": "ac72b4d3a76f5f81709d97f4a2102b6d1beb45928571c7b7241a3cfa70da80cd"
     },
     {
       "path": "tests/client_baseurl_guard.mjs",
@@ -17397,7 +17407,7 @@
     {
       "path": "tests/deploy_divergence_line.mjs",
       "mode": "0000644",
-      "sha256": "fcf4e6ca24b37e8872ffc1830aafa2dbeb8e28131bec0bebba622114001d3182"
+      "sha256": "b4067239ab71d3aaf3fa7e05fd4a1aaee3938a975970265f3f1679eeab838062"
     },
     {
       "path": "tests/deploy_handoff.mjs",
@@ -18877,7 +18887,7 @@
     {
       "path": "tests/hall_onboarding_bongos_setup.mjs",
       "mode": "0000644",
-      "sha256": "b9252bea41a77f2d101c5133c00947345d9f81ae63d1f40d7a4e6574f116c914"
+      "sha256": "9546e6b737e9689cdf76209debf14930ad5b4058b7b39cb388d471a0d292033c"
     },
     {
       "path": "tests/hall_oversight_tabs.mjs",
@@ -18967,7 +18977,7 @@
     {
       "path": "tests/hall_settings_world.mjs",
       "mode": "0000644",
-      "sha256": "cf50e4a03eb7a0ad0e2452550ead68e3afc781b93b222177d9c1545514876ee5"
+      "sha256": "f9285528215ebf8a5be2d030de76094c51965c15ad4233819adc95cd2101bac3"
     },
     {
       "path": "tests/hall_signout.mjs",
@@ -19517,7 +19527,7 @@
     {
       "path": "tests/instance_config.mjs",
       "mode": "0000644",
-      "sha256": "ba3404f1fd37d33dac3e64ac17a0c71fd8d73a56f7fcef362f5ffd1423136e55"
+      "sha256": "355349970d4a6f903a55bebacdde11eaca4283b22c8ee8266b346a9ecdd8a8ca"
     },
     {
       "path": "tests/instance_db_migrated_on_code_move.mjs",
@@ -20564,6 +20574,11 @@
       "mode": "0000644",
       "sha256": "d4c5b74926721f9449190f262e4aade893095197796f79ac8ab9e71c43a3b566"
     },
+    {
+      "path": "tests/paste_token_windows.mjs",
+      "mode": "0000644",
+      "sha256": "7a29edcbbad11dd2038bc1937905c2bae3c02970494149e88106939eb0741fff"
+    },
     {
       "path": "tests/patch_gate_ordering.mjs",
       "mode": "0000644",
@@ -21862,7 +21877,7 @@
     {
       "path": "tests/shell_hooks.mjs",
       "mode": "0000644",
-      "sha256": "3105a2a2c7a911e1993efd83af537fb2294b332cd5262ab83b41cc720e98a3da"
+      "sha256": "efafe5abb508560bae1287e6e811f9efb907280b1c032e5bb07e6027f6b17add"
     },
     {
       "path": "tests/shell_stat_portability.mjs",
@@ -22267,7 +22282,7 @@
     {
       "path": "tests/status_mirror_sync.mjs",
       "mode": "0000644",
-      "sha256": "78d32bb02f7e40885d3c1a0a23209f92531d3eaabe212728d1993af0b7cccaea"
+      "sha256": "9112bd164ed3eaf73826677a646e37819d8400c2f857cb2ff668ae9a8173d5d7"
     },
     {
       "path": "tests/status_page_chrome.mjs",
@@ -22679,6 +22694,11 @@
       "mode": "0000644",
       "sha256": "6b816f0428dc3212f68b565fa14c3e8ee71900ea5cd5b0df64fc5217f3d61384"
     },
+    {
+      "path": "tests/vendored_work_root.mjs",
+      "mode": "0000644",
+      "sha256": "f69c0eed68cde524593aedfd1e80955eda1a1fe66d4185d1946268248f8168b5"
+    },
     {
       "path": "tests/verify_task_guard.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -315,7 +315,7 @@ export interface PostAiStudioUploadsRequest { content_type: string; data: string
 export interface PostAiStudioUploadsResponse { file: unknown }
 export interface PostAuthBackchannelLogoutRequest { logout_token: string }
 export interface PostAuthBackchannelLogoutResponse { ok: boolean }
-export interface PostAuthCliTokenIssueResponse { ok: boolean; token: unknown; expires_at: unknown; builder_login: unknown; api_base: unknown; paste_command: unknown }
+export interface PostAuthCliTokenIssueResponse { ok: boolean; token: unknown; expires_at: unknown; builder_login: unknown; api_base: unknown; paste_command: unknown; paste_command_windows: unknown }
 export interface PostAuthDeviceApproveRequest { user_code: string; decision: "approve" | "deny" }
 export interface PostAuthDeviceExchangeRequest { assertion: string }
 export interface PostAuthDeviceExchangeResponse { token: unknown; builder: unknown }

package/docs/adr/0029-status-page-outage-resilience.md

@@ -1,6 +1,6 @@
 # 0029 — Status-page outage resilience: measure from outside, host off-box, prevent at the source
 
-- **Status:** Accepted. **Slice 1 (external prober) built this session** under task **[#565](https://example.com/builders#/task/565)**: `.github/workflows/status-probe.yml` + `scripts/status-probe.mjs` + this ADR. **Follow-up B (page off-box) has since SHIPPED** — `status.example.com` is served off the droplet from GitHub Pages (repo `example-owner/example-status`), synced by `.github/workflows/sync-status-mirror.yml`. Incident-backfill (follow-up C) is **not yet built**. **Since removed (task 1004858, 2026-10-25):** the in-process `uptime-poller.js` (nothing started it), the `status-probe.mjs` prober (its workflow was already gone) and the `/public/uptime` feed — the file references below are history.
+- **Status:** Accepted. **Slice 1 (external prober) built this session** under task **[#565](https://example.com/builders#/task/565)**: `.github/workflows/status-probe.yml` + `scripts/status-probe.mjs` + this ADR. **Follow-up B (page off-box) has since SHIPPED** — `status.example.com` is served off the droplet from GitHub Pages (repo `example-owner/example-status`). **No workflow syncs it** (task 1005131): `sync-status-mirror.yml` is not in this repo, so the page updates only when someone runs `node scripts/status-mirror-sync.js --repo-dir <mirror-checkout> --push` by hand. Incident-backfill (follow-up C) is **not yet built**. **Since removed (task 1004858, 2026-10-25):** the in-process `uptime-poller.js` (nothing started it), the `status-probe.mjs` prober (its workflow was already gone) and the `/public/uptime` feed — the file references below are history.
 - **Date:** 2026-06-03
 - **Deciders:** Lars Kristensen (Archon), Claude
 - **Track:** `internal` (the status dashboard / The Watch)
@@ -29,7 +29,7 @@ An **external prober runs on GitHub-hosted runners** — off our DigitalOcean in
 - `.github/workflows/status-probe.yml` — `*/5` cron + `workflow_dispatch`; publishes the result to an **orphan `status-data` branch** (off-box, web-readable, survives a droplet outage); **fails the job when the site is confirmed down**, which emails the repo owner — the alert.
 
 ### 2. Host the page off-box (follow-up B — SHIPPED)
-`status.example.com` is now served off the droplet from **GitHub Pages** (repo `example-owner/example-status`), synced by [`.github/workflows/sync-status-mirror.yml`](../../.github/workflows/sync-status-mirror.yml); the page no longer shares fate with the product. Original plan, for the record:
+`status.example.com` is now served off the droplet from **GitHub Pages** (repo `example-owner/example-status`), published by hand with `scripts/status-mirror-sync.js` (no workflow runs it — task 1005131); the page no longer shares fate with the product. Original plan, for the record:
 Move `public-status/` to free static hosting **separate from the droplet** (Cloudflare Pages or GitHub Pages). The page shell + the **uptime/incident section** are served off-box and read the `status-data` source, so they stay truthful during an outage. The rich GDS panels (treasury, grades, progress) keep loading client-side from `example.com/api/gds/public/*` and **degrade gracefully** to "origin unreachable" when the droplet is down (requires adding CORS to those public routes). Then repoint `status.example.com` DNS at the off-box host.
 
 ### 3. Prevent at the source + alert (blocker [#6](https://example.com/builders#/blocker/6))

package/docs/api/openapi.json

@@ -36061,7 +36061,8 @@
           "expires_at": {},
           "builder_login": {},
           "api_base": {},
-          "paste_command": {}
+          "paste_command": {},
+          "paste_command_windows": {}
         },
         "required": [
           "ok",
@@ -36069,7 +36070,8 @@
           "expires_at",
           "builder_login",
           "api_base",
-          "paste_command"
+          "paste_command",
+          "paste_command_windows"
         ]
       },
       "PostAuthDeviceApproveRequest": {