@bongos/core 1.24.68 → 1.24.70

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.68",
+  "version": "1.24.70",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.68",
+      "version": "1.24.70",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.68",
+  "version": "1.24.70",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11411,5 +11411,39 @@
       "id": "1005132",
       "text": "The design checker now catches text hidden under a dark overlay (the bug that made the components page unreadable in dark mode), instead of reporting it clean."
     }
+  ],
+  "1.24.70": [
+    {
+      "id": "1005100",
+      "text": "In a project that installs Bongos from npm (like toast), the docs check and the pre-ship check now look at the project itself instead of Bongos's own installed files, so they stop failing on nothing and stop reporting fresh fi"
+    },
+    {
+      "id": "1005033",
+      "text": "Signing in to the command line on Windows is smoother: Settings now shows a command that works in PowerShell, says to go to your project folder first, and the tool can ask for the token instead of it sitting in the command."
+    },
+    {
+      "id": "1005113",
+      "text": "In a project that installs Bongos from npm (like toast), the claim card now tells you to finish with 'npx bongos ship', a command that exists there, instead of a script path that doesn't."
+    },
+    {
+      "id": "1005131",
+      "text": "The status-page docs no longer claim an automatic sync that does not exist. They now say plainly that the off-site status page updates only when someone publishes it by hand, and a test keeps that claim honest."
+    },
+    {
+      "id": "1005022",
+      "text": "The 'you may have made a mistake' nudge no longer fires on automatic messages from other sessions or CI — only on a person's own corrections."
+    },
+    {
+      "id": "1005020",
+      "text": "Status messages now say plainly that cloudbongos.com picks up small (patch) releases on its own — no one has to move it by hand. Only a bigger (minor) release waits for the owner."
+    },
+    {
+      "id": "1005042",
+      "text": "The old-style settings warning no longer promises a removal date that already passed; it now says honestly the old names still work for now."
+    },
+    {
+      "id": "1004949",
+      "text": "When a shell command was blocked by one hook and another hook was missing, the warning about the missing hook vanished. Now both messages show."
+    }
   ]
 }

package/scripts/bongos/claim.js

@@ -763,10 +763,7 @@ async function main() {
     // best-effort and never block the claim.
     const shownLearningKeys = await printRelevantLearnings(task);
     await printClaimRecall(task, { excludeKeys: shownLearningKeys });
-    console.log('\nWhen you finish:');
-    console.log(`  node scripts/bongos/ship.js ${task.id} --notes "..." --summary "..."`);
-    console.log('Or to abandon:');
-    console.log(`  node scripts/bongos/release.js ${task.id}`);
+    for (const line of finishHintLines(task.id)) console.log(line);
     // V3.R13 (#237): post-claim nudge — for a newcomer, this becomes
     // "Next: Ship thy first work" so the path forward is visible. Reuses the
     // /me fetched above for the context pack (no second round-trip).
@@ -802,6 +799,20 @@ async function main() {
 
 // Only auto-run when invoked directly (`node claim.js …`); a `require()` (the
 // unit test) just imports formatClaimFailure without executing the claim flow.
+// task 1005113 - claim card finish: the "When you finish" hint names the command that
+// exists where this claim ran. A project that installs the core from npm has no
+// scripts/bongos/ of its own — the CLI ships in node_modules/@bongos/core and runs as
+// `npx bongos <verb>` — so a node path there points at nothing. isInstalledCore() is the
+// one positive "this core sits under node_modules" check fitness already uses.
+function finishHintLines(taskId, { installed } = {}) {
+  if (installed === undefined) {
+    try { installed = require('./fitness-lib').isInstalledCore(); } catch { installed = false; }
+  }
+  const ship = installed ? `npx bongos ship ${taskId}` : `node scripts/bongos/ship.js ${taskId}`;
+  const release = installed ? `npx bongos release ${taskId}` : `node scripts/bongos/release.js ${taskId}`;
+  return ['\nWhen you finish:', `  ${ship} --notes "..." --summary "..."`, 'Or to abandon:', `  ${release}`];
+}
+
 if (require.main === module) {
   main().catch((err) => {
     console.error('fatal:', err);
@@ -809,4 +820,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan, materializeModeSkills, printRoleLine, worktreeDetectionNote, liveStrandLeases, QUEUE_GATED_EXIT };
+module.exports = { finishHintLines, formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan, materializeModeSkills, printRoleLine, worktreeDetectionNote, liveStrandLeases, QUEUE_GATED_EXIT };

package/scripts/bongos/deploy-divergence.js

@@ -5,7 +5,8 @@
 // modules/lifecycle/merge-reach.js): every instance, the hub included, gets a merge
 // only when a published core release carries it AND that instance's pin moves. The
 // publish lane cuts a release per merge (ADR 0161) only while the integration lane
-// is green; on the hub (cloudbongos.com) the pin move is owner-gated.
+// is green; on the hub (cloudbongos.com) its patch-channel subscription moves the pin
+// on its own (task 1005020), and only a new minor release waits for the owner.
 // Two blanket claims have been wrong here: "Merging to main deploys nothing" (ADR
 // 0137, false since ADR 0161) and "the hub redeploys from main on every merge"
 // (never true — the hub pins a published core). Sessions repeated each to the owner.
@@ -335,8 +336,9 @@ function report(r, { quiet = false } = {}) {
   }
   if (r.behind) {
     say(`  ⚠ UNDEPLOYED — live is ${r.live.coreVersion}, main declares ${r.onMain}.`);
-    say('    A release exists that this instance has not picked up: its pin has not moved. On the hub that move is');
-    say('    owner-gated; on a hosted project it is its update channel or a core-upgrade (docs/recipes/upgrading-the-core.md).');
+    say('    A release exists that this instance has not picked up: its pin has not moved. On the hub its patch-channel');
+    say('    sweep moves it on its own (a new minor waits for the owner); on a hosted project it is its update channel or a');
+    say('    core-upgrade (docs/recipes/upgrading-the-core.md). A gap that stays means the sweep is held or failing.');
   }
   if (r.schemaBehind) {
     const n = r.live.schemaPending;

package/scripts/bongos/docs-entropy.js

@@ -25,7 +25,10 @@ const path = require('node:path');
 const { execFileSync } = require('node:child_process');
 const { hasFlag, cliClient, requireSession, cliExit } = require('./cli-lib');
 
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
+// The tree being scanned (task 1005100): this checkout when the core is a checkout, the
+// PROJECT when the core is installed under node_modules — the package dir is not a repo of
+// its own, so `git ls-files` there found 0 files and fitness died on a "scan defect".
+const REPO_ROOT = require('./fitness-lib.js').resolveWorkRoot();
 const { currentScriptPath } = require('./forwarder.js');
 const MIN_DUPE_CHARS = 120;    // minimum paragraph length to flag as duplicate
 const MAX_DUPES_REPORTED = 20; // cap to avoid flooding the report

package/scripts/bongos/fitness-lib.js

@@ -11,7 +11,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-config'); // ADR 0108 §1: configurable-root
+const { resolveCoreRoot, resolveInstanceRoot, resolveInstanceRootExplicit } = require('../../src/instance-config'); // ADR 0108 §1: configurable-root
 
 
 // ADR 0108 §Consequences #4 (configurable-root W6 / task 1886) — the guardrail walks TWO trees.
@@ -97,6 +97,23 @@ function isInstalledCore(root = CORE_ROOT) {
   } catch { return true; } // a package with no repo around it at all
 }
 
+// resolveWorkRoot — the tree a repo-wide tool (docs-entropy, ship-check) works on (task 1005100).
+// A core CHECKOUT works on itself, whatever the cwd, exactly as path.resolve(__dirname,'..','..')
+// always did. An INSTALLED core's package dir is not the project — `git ls-files` there finds
+// nothing and the generators read the package's own files — so it works on the project instead:
+// an explicit pointer (<PREFIX>_INSTANCE_ROOT / bongos.config.json), else the git top of the cwd
+// (`npx bongos exec` runs from the project), else the cwd.
+function gitTopOf(cwd) {
+  try {
+    return require('node:child_process').execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() || null;
+  } catch { return null; }
+}
+function resolveWorkRoot({ installed, cwd = process.cwd(), explicit = resolveInstanceRootExplicit, gitTop = gitTopOf } = {}) {
+  if (installed === undefined) installed = isInstalledCore();
+  if (!installed) return CORE_ROOT;
+  return explicit() || gitTop(cwd) || cwd;
+}
+
 // runChecks — run every fitness check, or none (task 1004737). Every check guards the core's
 // own source, and an INSTALLED core's source is not the project's to change: the core repo's
 // CI ran this gate before publishing it (the same stance ship-merge-gate.js takes for a
@@ -115,6 +132,7 @@ function runChecks(checks, { installed = isInstalledCore() } = {}) {
 
 module.exports = {
   isInstalledCore,
+  resolveWorkRoot,
   runChecks,
   keyTokenRe,
   CORE_ROOT,

package/scripts/bongos/paste-token.js

@@ -8,6 +8,8 @@
 //
 // Usage:
 //   bongos paste-token <token>          # what the hall hands you (task 1003961)
+//   bongos paste-token                  # no argument: asks for the token without echo,
+//                                       # or reads it from stdin when piped (task 1005033)
 //   node scripts/bongos/paste-token.js <token>   # equivalent, inside a core checkout
 //
 // The portal returns the exact invocation as the "paste_command" field, so a
@@ -83,10 +85,71 @@ const ARGS = parseArgs(process.argv.slice(2));
 const RESOLVED = resolveBaseForPaste({ flag: ARGS.apiBase });
 const API_BASE = RESOLVED.base;
 
+// READ THE TOKEN WITHOUT PUTTING IT ON THE COMMAND LINE (task 1005033). A token passed
+// as an argument lands in shell history. With no argument we ask for it: on a terminal
+// the read is raw and nothing is echoed (a 64-char secret has no business on screen
+// either); piped (`... | bongos paste-token`) we take the first word of stdin. The
+// argument form still works — the hall's one-liner uses it, and older instances hand
+// out nothing else. Exported so the no-echo read is tested, not assumed.
+function readTokenFromInput({ input = process.stdin, output = process.stderr } = {}) {
+  if (!input.isTTY) {
+    // Piped: settle on the FIRST line, not at end of stream — a pipe that never closes
+    // must not hang the paste, and nothing after the token is ours to buffer.
+    return new Promise((resolve, reject) => {
+      let data = '';
+      let settled = false;
+      const settle = () => {
+        if (settled) return;
+        settled = true;
+        input.removeListener('data', onData);
+        input.pause();
+        resolve(data.trim().split(/\s+/)[0] || '');
+      };
+      function onData(c) {
+        data += c;
+        if (data.replace(/^\s+/, '').includes('\n')) settle();
+      }
+      input.setEncoding('utf8');
+      input.on('data', onData);
+      input.on('end', settle);
+      input.on('error', (err) => { if (!settled) { settled = true; reject(err); } });
+    });
+  }
+  output.write('Paste your CLI token (Settings → CLI Access) and press Enter: ');
+  return new Promise((resolve, reject) => {
+    let buf = '';
+    const raw = typeof input.setRawMode === 'function';
+    if (raw) input.setRawMode(true);
+    input.setEncoding('utf8');
+    input.resume();
+    function finish(err) {
+      input.removeListener('data', onData);
+      if (raw) input.setRawMode(false);
+      input.pause();
+      output.write('\n');
+      if (err) reject(err); else resolve(buf.trim());
+    }
+    function onData(chunk) {
+      for (const ch of String(chunk)) {
+        if (ch === '\r' || ch === '\n') { finish(); return; }
+        // Ctrl+C always cancels; Ctrl+D (end of input) cancels too unless a token is typed.
+        if (ch === '\u0003' || (ch === '\u0004' && !buf.trim())) { finish(new Error('cancelled — nothing was saved')); return; }
+        if (ch === '\u0004') { finish(); return; }
+        if (ch === '\u007f' || ch === '\b') { buf = buf.slice(0, -1); continue; }
+        buf += ch;
+      }
+    }
+    input.on('data', onData);
+  });
+}
+
 function usage(extra) {
   if (extra) console.error(extra);
   console.error('');
-  console.error('Usage: npx bongos paste-token <token> [--api-base <url>]');
+  console.error('Usage: npx bongos paste-token [<token>] [--api-base <url>]');
+  console.error('   Leave out <token> and it asks for it, so the token stays out of shell history.');
+  console.error('   Run it from inside your project folder (cd there first).');
+  console.error('   In Windows PowerShell type npx.cmd instead of npx.');
   console.error('   (inside a core checkout: node scripts/bongos/paste-token.js <token>)');
   console.error('');
   // Fall back to the inferred base for this hint when --api-base was the thing that
@@ -103,9 +166,17 @@ async function main() {
     usage(`--api-base must be an http(s) URL, got: ${ARGS.apiBase}`);
     process.exit(2);
   }
-  const token = ARGS.token;
+  let token = ARGS.token;
+  if (!token) {
+    try {
+      token = await readTokenFromInput();
+    } catch (err) {
+      console.error(`paste-token: ${err.message}`);
+      process.exit(2);
+    }
+  }
   if (!token) {
-    usage('No token argument provided.');
+    usage('No token given.');
     process.exit(2);
   }
   // Tokens are hex-encoded crypto.randomBytes(32) → 64 lowercase hex chars.
@@ -209,4 +280,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { parseArgs, resolveBaseForPaste };
+module.exports = { parseArgs, resolveBaseForPaste, readTokenFromInput };

package/scripts/bongos/ship-check.js

@@ -21,7 +21,12 @@ const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
 
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
+// Two roots (task 1005100). CORE_ROOT is where the step scripts live; WORK_ROOT is the tree they
+// check. In a project that installs the core they differ: running the generators from the
+// package dir checked the package's files, so gen-api-docs read STALE while the same --check
+// run from the project said up to date. In a core checkout both are this checkout.
+const CORE_ROOT = path.resolve(__dirname, '..', '..');
+const WORK_ROOT = require('./fitness-lib.js').resolveWorkRoot();
 
 // Each step: a label, the argv to run (node scripts run with THIS node), the command that heals it,
 // and how to read a non-zero exit. `optional` steps are skipped when their script is absent. An `advisory`
@@ -45,8 +50,11 @@ const STEPS = [
   { key: 'tests', label: 'DB-free unit lane (npm test)', argv: ['scripts/bongos/run-unit-tests.js'], fix: 'read the FAIL lines; compare against origin/main before calling any of them environmental', onlyWith: '--tests', slow: true },
 ];
 
-function runStep(step, { cwd = REPO_ROOT } = {}) {
-  const script = path.join(cwd, step.argv[0]);
+// A caller that passes only `cwd` (tests) gets scripts resolved there too, as before.
+function runStep(step, { cwd, coreRoot } = {}) {
+  coreRoot = coreRoot || cwd || CORE_ROOT;
+  cwd = cwd || WORK_ROOT;
+  const script = path.join(coreRoot, step.argv[0]);
   if (!fs.existsSync(script)) return { ...step, status: step.optional ? 'skipped' : 'missing', ms: 0, tail: `${step.argv[0]} not present` };
   const t0 = Date.now();
   const r = spawnSync(process.execPath, [script, ...step.argv.slice(1)], { cwd, encoding: 'utf8', timeout: step.slow ? 15 * 60 * 1000 : 5 * 60 * 1000, env: { ...process.env, GDS_QUIET: '1' } });

package/src/bongos/device-flow-blocker.js

@@ -0,0 +1,56 @@
+'use strict';
+// src/bongos/device-flow-blocker.js — tell the OWNER, loudly, that terminal sign-in is off
+// (task 1005033).
+//
+// WHY. GitHub creates an App from a manifest with Device Flow OFF and has no API to switch it
+// on — only a checkbox in the App's settings. Until the owner ticks it, every builder's
+// `bongos setup` / `bongos login` is refused, and the only person told was that builder, in a
+// terminal, who cannot fix it. The provisioning checklist shows the step as optional
+// ("later"), which no owner reads as urgent. So the first time this server sees GitHub's
+// device_flow_disabled refusal it files ONE blocker for the owner, through the ideas
+// module's `ideas.fileBlocker` port (core never imports a module). The writer is idempotent
+// on (source, source_ref), so a thousand refused sign-ins still make one blocker.
+//
+// Best effort by construction: no ideas module, a refused write or a DB hiccup changes
+// nothing about the sign-in reply the builder gets. Never throws, never rejects.
+
+const seams = require('../module-seams');
+
+const SOURCE = 'auth';
+const SOURCE_REF = 'github-device-flow-disabled';
+
+function isDeviceFlowDisabledReason(reason) {
+  return /device_flow_disabled/i.test(String(reason || ''));
+}
+
+function blockerFor(origin) {
+  const settings = origin ? `${origin}/builders/settings` : 'Settings → CLI Access';
+  return {
+    title: 'Terminal sign-in is off: tick "Enable Device Flow" on the GitHub App',
+    bodyMd: [
+      'A builder just tried to sign in from a terminal (`bongos setup` or `bongos login`) and GitHub refused:',
+      'this project\'s GitHub App has **Device Flow switched off**. Apps made by the one-click setup start',
+      'that way, and GitHub offers no way for the setup to switch it on.',
+      '',
+      '**Fix (the project owner, once, about a minute):** GitHub → Settings → Developer settings →',
+      'GitHub Apps → this project\'s app → tick **Enable Device Flow** → Save. Web sign-in is unaffected.',
+      '',
+      `Until then builders can still sign in through the web: ${settings}, "Re-issue CLI token".`,
+    ].join('\n'),
+    source: SOURCE,
+    sourceRef: SOURCE_REF,
+  };
+}
+
+async function raiseDeviceFlowOffBlocker({ reason, origin, resolveOptional = seams.resolveOptional } = {}) {
+  try {
+    if (!isDeviceFlowDisabledReason(reason)) return null;
+    const file = resolveOptional('ideas.fileBlocker', null);
+    if (typeof file !== 'function') return null;
+    return (await file(blockerFor(origin))) || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+module.exports = { raiseDeviceFlowOffBlocker, isDeviceFlowDisabledReason, SOURCE, SOURCE_REF };

package/src/bongos/routes/auth.js

@@ -42,6 +42,7 @@ const { accountExistenceReadRateLimit } = require('../middleware/rate-limit');
 const { branding } = require('../../branding');
 const { resolveEnv, envPrefix } = require('../../instance-config');
 const seams = require('../../module-seams');
+const { raiseDeviceFlowOffBlocker } = require('../device-flow-blocker');
 // task 1003208: structured logging — was console.*. A core file logs through
 // the kernel logger directly; only MODULES go via api.logger (the doorway).
 const log = require('../logger').logger.child({ src: 'auth' });
@@ -623,6 +624,7 @@ module.exports = function buildAuthRouter() {
       // fresh-instance auth failure could only be read via curl on the box itself
       // (finding W2, task 1003052). A 4xx passes the proxy with the JSON intact.
       const reason = String(err && err.message ? err.message : 'internal error').slice(0, 300);
+      raiseDeviceFlowOffBlocker({ reason, origin: WEB_REDIRECT_ORIGIN }); // owner blocker, once (task 1005033)
       res.fail('device_start_failed', { status: 424, message: reason });
     }
   });
@@ -1353,6 +1355,9 @@ module.exports = function buildAuthRouter() {
         paste_command: issuer
           ? `npx bongos paste-token ${token} --api-base ${issuer}`
           : `npx bongos paste-token ${token}`,
+        paste_command_windows: issuer
+          ? `npx.cmd bongos paste-token ${token} --api-base ${issuer}`
+          : `npx.cmd bongos paste-token ${token}`, // task 1005033: PowerShell blocks npx.ps1 by default
       });
     } catch (err) {
       log.error('[gds] POST /auth/cli-token/issue', err);

package/src/instance-config.js

@@ -46,12 +46,10 @@ const LEGACY_DIRS = ['otb'];
 // test that it FIRES rather than one that merely tolerates it.
 const LEGACY_ENV_PREFIXES = ['CLOUDBONGOS', 'OTB', 'GDS', 'PMS'];
 
-// The core release in which the legacy prefixes above stop being read. Named in
-// every deprecation warning so an operator learns the deadline from the warning
-// itself rather than from a changelog they will not read. This lands in 1.19.x,
-// so 1.21 leaves a full minor of overlap; task 1003706 is the task that both
-// removes the fallback and moves this constant's meaning to "already gone".
-const LEGACY_ENV_SUNSET_RELEASE = '1.21';
+// The deprecation warning names no removal release (task 1005042 - legacy env
+// warning): it promised 1.21, the retirement (task 1003706 - C3d) was abandoned,
+// and 1.24 still read the old names. Name a real release only in the diff that
+// deletes the fallback.
 
 // Lazy require (ADR 0108 §1 made this a two-way edge: branding.js now requires
 // resolveCoreRoot()/resolveInstanceRoot() from this module, so a top-level
@@ -267,7 +265,7 @@ function warnLegacyEnv({ legacyName, canonicalName, shadowed, differs, log = con
     : shadowed
       ? `${canonicalName} is also set and wins`
       : `rename it to ${canonicalName}`;
-  log.warn(`[bongos] deprecated env ${legacyName} — ${fate}. The legacy spelling stops being read in core ${LEGACY_ENV_SUNSET_RELEASE}.`);
+  log.warn(`[bongos] deprecated env ${legacyName} — ${fate}. The legacy spelling is still read for now, but will stop being read in a future core release.`);
   return true;
 }
 
@@ -282,11 +280,10 @@ function warnPackPrefix({ prefix, name, log = console } = {}) {
   return true;
 }
 
-// NOT exported, deliberately: warnLegacyEnv, LEGACY_ENV_SUNSET_RELEASE and the
-// ledger are internals. resolveEnv's injectable `warn` is the whole test seam a
+// NOT exported, deliberately: warnLegacyEnv and the ledger are internals. resolveEnv's injectable `warn` is the whole test seam a
 // caller needs, and a test of the DEFAULT path captures console.warn — which
 // exercises the real wiring rather than a hand-called helper. Exporting them
-// would also add three untraceable entries to the knip dead-code ratchet.
+// would also add untraceable entries to the knip dead-code ratchet.
 
 // resolveCoreRoot() / resolveInstanceRoot() — the ADR 0108 §1 configurable-root
 // resolvers, extending this module's established zero-risk pattern from

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.68'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.70'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/agent_standing_rules.mjs

@@ -112,6 +112,20 @@ t('the app\'s own status messages never trigger the slop check (task 1005023)',
   assert.ok(conductor.evaluateTriggers({ prompt: "that's wrong, it's already live" }).some((x) => x.id === 'slop-check'), 'a real correction still fires');
 });
 
+t('side-session events, cross-session messages and CI events never trigger the slop check (task 1005022)', () => {
+  const words = "It's already live, not true, actually it works, you said it was slop";
+  for (const notice of [
+    `<side-sessions-event>Session bug-x ended a turn: ${words}</side-sessions-event>`,
+    `<cross-session-message from="local_abc">${words}</cross-session-message>`,
+    `<teammate-message teammate_id="t1">${words}</teammate-message>`,
+    `<ci-monitor-event pr="12">${words}</ci-monitor-event>`,
+    `  \n<channel source="discord">${words}</channel>`,
+  ]) {
+    assert.ok(!conductor.evaluateTriggers({ prompt: notice }).some((x) => x.id === 'slop-check'), notice);
+  }
+  assert.ok(conductor.evaluateTriggers({ prompt: "<b>that's wrong</b>, it's already live" }).some((x) => x.id === 'slop-check'), 'a person typing a tag still gets checked');
+});
+
 t('ordinary prompts do not trigger the slop check', () => {
   for (const p of ['add a dark mode toggle', 'run the tests', 'what can I work on', 'make the button wider']) {
     assert.ok(!conductor.evaluateTriggers({ prompt: p }).some((x) => x.id === 'slop-check'), p);

package/tests/bongos_cli.mjs

@@ -76,7 +76,8 @@ test('the server emits exactly the verb the CLI registers', () => {
   assert.ok(cmds.length > 0, 'auth.js should emit at least one paste_command template literal');
   for (const cmd of cmds) {
     // `npx bongos <verb> …` since task 1004575 — a clone has no bare `bongos` on PATH.
-    const verb = cmd.replace(/^npx /, '').split(' ')[1];
+    // npx.cmd is the Windows PowerShell form (task 1005033) — same verb after it.
+    const verb = cmd.replace(/^npx(\.cmd)? /, '').split(' ')[1];
     assert.ok(cli.VERBS[verb], `server emits "bongos ${verb}" but the CLI has no such verb`);
   }
 });

package/tests/claim_finish_hint.mjs

@@ -0,0 +1,50 @@
+// tests/claim_finish_hint.mjs
+//
+// task 1005113 - claim card finish: the claim card's "When you finish" hint printed
+// `node scripts/bongos/ship.js N` everywhere. In a project that installs the core from npm
+// (toast), that path is not in the project — the CLI ships inside node_modules/@bongos/core
+// and runs as `npx bongos ship N`. finishHintLines() picks the command for where the core
+// is: a core checkout keeps the node path; an installed core gets the npx verbs.
+//
+// Run:  node tests/claim_finish_hint.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { finishHintLines } = require('../scripts/bongos/claim.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('installed core: ship + release hints use npx bongos, never a scripts/ path', () => {
+  const text = finishHintLines('1005113', { installed: true }).join('\n');
+  assert.match(text, /npx bongos ship 1005113 --notes "\.\.\." --summary "\.\.\."/);
+  assert.match(text, /npx bongos release 1005113/);
+  assert.doesNotMatch(text, /scripts\//);
+});
+
+t('core checkout: hints keep the node scripts/bongos path', () => {
+  const text = finishHintLines('42', { installed: false }).join('\n');
+  assert.match(text, /node scripts\/bongos\/ship\.js 42 --notes/);
+  assert.match(text, /node scripts\/bongos\/release\.js 42/);
+  assert.doesNotMatch(text, /scripts\/gds\//);
+});
+
+t('hint keeps its headings', () => {
+  const lines = finishHintLines('7', { installed: true });
+  assert.equal(lines[0], '\nWhen you finish:');
+  assert.ok(lines.includes('Or to abandon:'));
+});
+
+t('defaults to detecting the core here (this checkout is not installed)', () => {
+  const text = finishHintLines('9').join('\n');
+  assert.match(text, /node scripts\/bongos\/ship\.js 9/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/cli_token_reissue.mjs

@@ -174,11 +174,13 @@ t('paste_command names a CLI VERB, never a filesystem path', () => {
   // applying without anyone editing it.
   const tail = issueBlock.slice(issueBlock.indexOf('paste_command:'));
   const cmds = [...tail.matchAll(/`([^`]*bongos paste-token[^`]*)`/g)].map((m) => m[1]);
-  assert.equal(cmds.length, 2, `expected both ternary branches, got ${cmds.length}`);
+  // Four since task 1005033: paste_command's two branches, then paste_command_windows'
+  // two — the same line with npx.cmd, because npx.ps1 is blocked in a default PowerShell.
+  assert.equal(cmds.length, 4, `expected both ternary branches of both fields, got ${cmds.length}`);
   for (const cmd of cmds) {
   // Through npx (task 1004575): a builder's clone does not put bare `bongos` on
   // PATH, so a bare verb was "command not found" when pasted in the project folder.
-  assert.ok(/^npx bongos paste-token /.test(cmd),
+  assert.ok(/^npx(\.cmd)? bongos paste-token /.test(cmd),
     `paste_command must start with the npx verb form, got: ${cmd}`);
   // The invariant is "names no FILE ON THE RECIPIENT'S DISK", which the original
   // spelling approximated as "contains no slash". That was too broad once the command

package/tests/deploy_divergence_line.mjs

@@ -79,7 +79,11 @@ test('the line says who sees a merge, not a blanket rule in either direction', (
   const s = line(behind);
   assert.doesNotMatch(s, /deploys nothing/);
   assert.doesNotMatch(s, /redeploys from main|on every merge|within minutes/);
-  assert.match(s, /cloudbongos[.]com gets a merge only when a published core release carries it and its pin moves [(]owner-gated[)]/);
+  assert.match(s, /cloudbongos[.]com gets a merge only when a published core release carries it and its pin moves/);
+  // task 1005020: the hub's pin is NOT owner-gated for a patch release — its patch-channel
+  // subscription moved cloudbongos.com to core 1.24.12 with no person (task 1005015).
+  assert.doesNotMatch(s, /owner-gated[)]/, 'a patch move on the hub needs no person');
+  assert.match(s, /its patch-channel subscription moves that pin on its own/);
   assert.match(s, /hosted projects: only when a published core release carries the change and their pin moves/);
   assert.match(s, /Never call work live until that instance's \/version shows it/);
 });

package/tests/hall_onboarding_bongos_setup.mjs

@@ -87,7 +87,9 @@ test('Settings CLI access says where to paste the npx command', () => {
   const js = read('modules/hall-ui/public/settings.js');
   assert.match(html, /into a terminal in your project folder/);
   assert.doesNotMatch(html, /bypasses Device Flow/);
-  assert.match(js, /Paste this into a terminal in your project folder:/);
+  // Both spellings (task 1005033) name the project folder AND the cd that gets there.
+  assert.match(js, /Open a terminal, cd into your project folder first \(the command only runs there\), then paste this:/);
+  assert.match(js, /Open PowerShell, cd into your project folder first \(the command only runs there\), then paste this:/);
 });
 
 test('the npx paste command Settings hands out is pre-approved for a Claude session', () => {

package/tests/hall_settings_world.mjs

@@ -338,8 +338,8 @@ test('the CLI token reaches the page as text, not as markup', () => {
   // The secret and the clipboard read the SAME resolved value, so the button can
   // never copy a different string than the one on screen — nor the literal
   // "undefined", which writeText(body.paste_command) produced on a body without one.
-  assert.match(fn[0], /const pasteCommand = body\.paste_command \|\| ''/, 'one resolved value');
-  assert.match(fn[0], /writeText\(pasteCommand\)/, 'the clipboard copies that same value');
+  assert.match(fn[0], /const pasteCommand = \(windows && body\.paste_command_windows\) \|\| body\.paste_command \|\| ''/, 'one resolved value');
+  assert.match(fn[0], /copy\(pasteCommand, /, 'the clipboard copies that same value');
   assert.match(fn[0], /result\.textContent = ''/, 're-issuing replaces the previous token rather than stacking a second');
 });