@bongos/core 1.24.69 → 1.24.70

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/bongos/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 3133,
-    "unique_ids": 2474,
-    "certain": 3133,
+    "strings": 3137,
+    "unique_ids": 2478,
+    "certain": 3137,
     "heuristic": 0,
     "duplicate_ids": 262
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 171,
-      "strings": 2021
+      "strings": 2025
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -723,7 +723,7 @@
         "modules/hall-ui/public/settings-usage-reports.js:67",
         "modules/hall-ui/public/settings.js:401",
         "modules/hall-ui/public/settings.js:489",
-        "modules/hall-ui/public/settings.js:773"
+        "modules/hall-ui/public/settings.js:817"
       ]
     },
     {
@@ -1462,7 +1462,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings-ai-keys.js:101",
-        "modules/hall-ui/public/settings.js:834"
+        "modules/hall-ui/public/settings.js:878"
       ]
     },
     {
@@ -1472,7 +1472,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings-ai-keys.js:88",
-        "modules/hall-ui/public/settings.js:774"
+        "modules/hall-ui/public/settings.js:818"
       ]
     },
     {
@@ -1752,7 +1752,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings-ai-keys.js:102",
-        "modules/hall-ui/public/settings.js:829"
+        "modules/hall-ui/public/settings.js:873"
       ]
     },
     {
@@ -2042,7 +2042,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings-ai-keys.js:78",
-        "modules/hall-ui/public/settings.js:749"
+        "modules/hall-ui/public/settings.js:793"
       ]
     },
     {
@@ -2222,7 +2222,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings-ai-keys.js:21",
-        "modules/hall-ui/public/settings.js:685"
+        "modules/hall-ui/public/settings.js:729"
       ]
     },
     {
@@ -2552,7 +2552,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings.js:483",
-        "modules/hall-ui/public/settings.js:1043"
+        "modules/hall-ui/public/settings.js:1087"
       ]
     },
     {
@@ -4925,7 +4925,7 @@
       "surface": "builders-hall",
       "text": "Checking your key…",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 750,
+      "line": 794,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5307,6 +5307,15 @@
       "origin": "js-text-assign",
       "confidence": "certain"
     },
+    {
+      "id": "0279e7634291",
+      "surface": "builders-hall",
+      "text": "Copy command",
+      "file": "modules/hall-ui/public/settings.js",
+      "line": 657,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "12ee050d0180",
       "surface": "builders-hall",
@@ -5469,6 +5478,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "8a1c2e87fc2d",
+      "surface": "builders-hall",
+      "text": "Copy token",
+      "file": "modules/hall-ui/public/settings.js",
+      "line": 660,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "301afa9a94b9",
       "surface": "builders-hall",
@@ -5564,7 +5582,7 @@
       "surface": "builders-hall",
       "text": "Could not copy automatically — select and copy manually. ({…})",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 629,
+      "line": 670,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5771,7 +5789,7 @@
       "surface": "builders-hall",
       "text": "Could not load your account. Reload the page to try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1026,
+      "line": 1070,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5807,7 +5825,7 @@
       "surface": "builders-hall",
       "text": "Could not load your settings.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1029,
+      "line": 1073,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5915,7 +5933,7 @@
       "surface": "builders-hall",
       "text": "Could not remove your key. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 834,
+      "line": 878,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5924,7 +5942,7 @@
       "surface": "builders-hall",
       "text": "Could not remove. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 833,
+      "line": 877,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5996,7 +6014,7 @@
       "surface": "builders-hall",
       "text": "Could not save your key. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 774,
+      "line": 818,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6077,7 +6095,7 @@
       "surface": "builders-hall",
       "text": "Could not save. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 773,
+      "line": 817,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6113,7 +6131,7 @@
       "surface": "builders-hall",
       "text": "Could not set up key storage. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 810,
+      "line": 854,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6122,7 +6140,7 @@
       "surface": "builders-hall",
       "text": "Could not set up storage. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 809,
+      "line": 853,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7090,11 +7108,20 @@
       "confidence": "certain"
     },
     {
-      "id": "36ecb5d3686c",
+      "id": "061f6f62c36a",
       "surface": "builders-hall",
-      "text": "Fresh CLI token issued. Paste this into a terminal in your project folder:",
+      "text": "Fresh CLI token issued. Open PowerShell, cd into your project folder first (the command only runs there), then paste this:",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 609,
+      "line": 626,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
+    {
+      "id": "67ad9b9f11c8",
+      "surface": "builders-hall",
+      "text": "Fresh CLI token issued. Open a terminal, cd into your project folder first (the command only runs there), then paste this:",
+      "file": "modules/hall-ui/public/settings.js",
+      "line": 627,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7193,7 +7220,7 @@
       "surface": "builders-hall",
       "text": "Get a free key ↗",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 653,
+      "line": 697,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7868,7 +7895,7 @@
       "surface": "builders-hall",
       "text": "Image key removed.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 830,
+      "line": 874,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8268,6 +8295,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "e3bbba45305c",
+      "surface": "builders-hall",
+      "text": "Keep the token out of your shell history",
+      "file": "modules/hall-ui/public/settings.js",
+      "line": 650,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "08764cf156cc",
       "surface": "builders-hall",
@@ -8309,7 +8345,7 @@
       "surface": "builders-hall",
       "text": "Key removed.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 829,
+      "line": 873,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8327,7 +8363,7 @@
       "surface": "builders-hall",
       "text": "Key storage is being set up by an Archon — check back shortly. {…}",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 704,
+      "line": 748,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8345,7 +8381,7 @@
       "surface": "builders-hall",
       "text": "Key storage isn't set up yet. As an Archon you can turn it on now — the server generates and safely stores the master key (no terminal needed).",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 700,
+      "line": 744,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9641,7 +9677,7 @@
       "surface": "builders-hall",
       "text": "No builder account found for this sign-in.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1034,
+      "line": 1078,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -11184,15 +11220,6 @@
       "origin": "js-text-assign",
       "confidence": "certain"
     },
-    {
-      "id": "cf68a394cfa5",
-      "surface": "builders-hall",
-      "text": "Paste command copied.",
-      "file": "modules/hall-ui/public/settings.js",
-      "line": 628,
-      "origin": "js-notice",
-      "confidence": "certain"
-    },
     {
       "id": "6036f69e13bd",
       "surface": "builders-hall",
@@ -11216,7 +11243,7 @@
       "surface": "builders-hall",
       "text": "Paste your key first.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 749,
+      "line": 793,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -11837,7 +11864,7 @@
       "surface": "builders-hall",
       "text": "Re-issue failed: {…}",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 633,
+      "line": 677,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -12462,6 +12489,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "4c1e8ab8e1de",
+      "surface": "builders-hall",
+      "text": "Run this command instead (same folder). When it asks for the token, click Copy token and paste it there; nothing is shown as you paste.",
+      "file": "modules/hall-ui/public/settings.js",
+      "line": 652,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "48e5f1d19e90",
       "surface": "builders-hall",
@@ -12530,7 +12566,7 @@
       "surface": "builders-hall",
       "text": "Save key",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 685,
+      "line": 729,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12980,7 +13016,7 @@
       "surface": "builders-hall",
       "text": "Set up key storage",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 701,
+      "line": 745,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12989,7 +13025,7 @@
       "surface": "builders-hall",
       "text": "Setting up key storage…",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 785,
+      "line": 829,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -17210,7 +17246,7 @@
       "surface": "builders-hall",
       "text": "Your image-generation key settings could not be loaded. Reload the page to try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 860,
+      "line": 904,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17219,7 +17255,7 @@
       "surface": "builders-hall",
       "text": "Your key",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 681,
+      "line": 725,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17273,7 +17309,7 @@
       "surface": "builders-hall",
       "text": "Your preferences, {…}.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1043,
+      "line": 1087,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -18884,7 +18920,7 @@
       "surface": "builders-hall",
       "text": "paste command",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 611,
+      "line": 629,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -20648,7 +20684,7 @@
       "surface": "builders-hall",
       "text": "{…} · Stored encrypted; never shown again after saving.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 687,
+      "line": 731,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -20657,7 +20693,7 @@
       "surface": "builders-hall",
       "text": "{…} · revoke it any time under Active sessions.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 619,
+      "line": 637,
       "origin": "js-text-assign",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3390,7 +3390,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.66 with no explicit bump. run 42689728958. (task 1002620)
   1.24.68 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.67 with no explicit bump. run 42692736161. (task 1002620)
-  1.24.69 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.24.68 with no explicit bump. run 42698123714. (task 1002620)
+  1.24.70 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.68 with no explicit bump. run 42699948615. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -2449,7 +2449,7 @@
       "surface": "builders",
       "title": "Settings",
       "states_read": ["account","access","preferences","install-reports","sound","update"],
-      "files_hash": "6e7b5e2b903cd72c",
+      "files_hash": "ea8de6fa68c456ab",
       "reading_hash": "085bb32894909ee0",
       "counts": {"lines":137,"placed":90,"shared":9,"unplaced":38},
       "omitted": {"data":16},
@@ -2459,7 +2459,7 @@
         {"key":"L0002","section":"top bar","text":"Settings","placement":"shared"},
         {"key":"L0003","section":"top bar","text":"Update","placement":"shared"},
         {"key":"L0004","section":"top bar","text":"Jump to…","placement":"shared","file":"modules/hall-ui/public/shell.js","line":555,"string_id":"eba610d25523"},
-        {"key":"L0005","section":"top bar","text":"⌘K","placement":"shared"},
+        {"key":"L0005","section":"top bar","text":"Ctrl K","placement":"shared"},
         {"key":"L0006","section":"top bar","text":"Building","placement":"shared"},
         {"key":"L0007","section":"top bar","text":"Artistry","placement":"shared"},
         {"key":"L0008","section":"top bar","text":"Ideating","placement":"shared"},
@@ -2531,16 +2531,16 @@
         {"key":"L0074","section":"Your Autobongos runner","text":"The project has not allowed any goals for runners yet, so there is nothing to choose from.","placement":"unplaced","state":"access"},
         {"key":"L0075","section":"Image-generation key","text":"Image-generation key","placement":"placed","file":"modules/hall-ui/public/settings.html","line":244,"string_id":"783853467d52","state":"access","occurrences":2},
         {"key":"L0076","section":"Image-generation key","text":"The art pipeline draws tiles and sprites with Google AI Studio (Gemini). Needed only if you generate art — your key, your bill, paid only for what you make.","placement":"placed","file":"modules/hall-ui/public/settings.html","line":245,"string_id":"600b90074021","state":"access"},
-        {"key":"L0077","section":"Image-generation key","text":"Your key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":681,"string_id":"51fd6f1ecb2f","state":"access"},
+        {"key":"L0077","section":"Image-generation key","text":"Your key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":725,"string_id":"51fd6f1ecb2f","state":"access"},
         {"key":"L0078","section":"Image-generation key","text":"Paste your {…} key","placement":"placed","file":"modules/hall-ui/public/settings-ai-keys.js","line":21,"string_id":"d7f9662b38fb","attr":"placeholder","state":"access"},
-        {"key":"L0079","section":"Image-generation key","text":"Save key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":685,"string_id":"0c79b504aebe","state":"access"},
-        {"key":"L0080","section":"Image-generation key","text":"Get a free key ↗","placement":"placed","file":"modules/hall-ui/public/settings.js","line":653,"string_id":"2ae2114b61db","state":"access"},
-        {"key":"L0081","section":"Image-generation key","text":"· Stored encrypted; never shown again after saving.","placement":"placed","file":"modules/hall-ui/public/settings.js","line":687,"string_id":"b3757ba3bb46","state":"access"},
+        {"key":"L0079","section":"Image-generation key","text":"Save key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":729,"string_id":"0c79b504aebe","state":"access"},
+        {"key":"L0080","section":"Image-generation key","text":"Get a free key ↗","placement":"placed","file":"modules/hall-ui/public/settings.js","line":697,"string_id":"2ae2114b61db","state":"access"},
+        {"key":"L0081","section":"Image-generation key","text":"· Stored encrypted; never shown again after saving.","placement":"placed","file":"modules/hall-ui/public/settings.js","line":731,"string_id":"b3757ba3bb46","state":"access"},
         {"key":"L0082","section":"Image-generation key","text":"Stored encrypted; never shown again after saving — only its last four digits.","placement":"placed","file":"modules/hall-ui/public/settings.html","line":253,"string_id":"6c6544f5c011","state":"access"},
         {"key":"L0083","section":"Your AI keys","text":"Your AI keys","placement":"placed","file":"modules/hall-ui/public/settings.html","line":261,"string_id":"b22c34b9c30a","state":"access"},
         {"key":"L0084","section":"Your AI keys","text":"Link your own AI account so studio generations run on it and we charge you nothing. Without a key, generations run on ours and come out of your balance.","placement":"placed","file":"modules/hall-ui/public/settings.html","line":262,"string_id":"a0a4aaff6057","state":"access"},
         {"key":"L0085","section":"Your AI keys","text":"Paste your {…} key","placement":"placed","file":"modules/hall-ui/public/settings-ai-keys.js","line":21,"string_id":"d7f9662b38fb","attr":"placeholder","state":"access"},
-        {"key":"L0086","section":"Your AI keys","text":"Save key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":685,"string_id":"0c79b504aebe","state":"access"},
+        {"key":"L0086","section":"Your AI keys","text":"Save key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":729,"string_id":"0c79b504aebe","state":"access"},
         {"key":"L0087","section":"Your AI keys","text":"Get a key ↗","placement":"placed","file":"modules/hall-ui/public/settings-ai-keys.js","line":29,"string_id":"ea60662c296c","state":"access"},
         {"key":"L0088","section":"Your AI keys","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","state":"access"},
         {"key":"L0089","section":"Your AI keys","text":"Key on file ending …{…}{…}. Your generations run on it and we charge nothing.","placement":"placed","file":"modules/hall-ui/public/settings-ai-keys.js","line":36,"string_id":"a4e92424b2a4","state":"access"},

package/modules/hall-ui/public/settings.js

@@ -578,6 +578,19 @@
 
   // ---- section 4: CLI ACCESS (re-issue a CLI bearer, V3.R91 #401) ----------
 
+  // Is this browser on Windows? (task 1005033) There the plain `npx` one-liner fails in
+  // a default PowerShell (npx.ps1 is blocked by the script policy), so the hall shows
+  // the npx.cmd form the server composes alongside it. The browser is the best signal
+  // for the machine the builder will paste into; a wrong guess still leaves a command
+  // that works in cmd, or in a PowerShell that allows scripts.
+  function isWindowsBrowser() {
+    try {
+      const uad = navigator.userAgentData;
+      if (uad && uad.platform) return /windows/i.test(uad.platform);
+      return /windows/i.test(navigator.userAgent || '');
+    } catch (_) { return false; }
+  }
+
   async function issueCliToken() {
     const btn = $('#cli-reissue-btn');
     const result = $('#cli-reissue-result');
@@ -594,7 +607,8 @@
       // plainly. 'unknown' read as a gap in the page's knowledge; the absence of a
       // date is the fact, and the revoke is what replaced the timer.
       const expires = body.expires_at ? `Expires ${new Date(body.expires_at).toLocaleString()}` : 'Never expires';
-      const pasteCommand = body.paste_command || '';
+      const windows = isWindowsBrowser();
+      const pasteCommand = (windows && body.paste_command_windows) || body.paste_command || '';
       // The secret is QUOTED (settings.css `.quote`): a 64-character token cannot
       // be a line of prose, so it sits one tonal step down with its own foot. Same
       // markup as the innerHTML template it replaces (task 1003644) — what changes
@@ -606,7 +620,11 @@
       // three out of the copy registry, blinding the artist's queue to this panel.
       const el = (tag, cls) => Object.assign(document.createElement(tag), { className: cls });
       const say = el('p', 'cli-result__say');
-      say.textContent = 'Fresh CLI token issued. Paste this into a terminal in your project folder:';
+      // Say WHERE it runs (task 1005033): npx finds `bongos` only inside the project
+      // folder, and a new Windows terminal opens in system32, where npm answers "could
+      // not determine executable to run" and nothing points at the cause.
+      if (windows) say.textContent = 'Fresh CLI token issued. Open PowerShell, cd into your project folder first (the command only runs there), then paste this:';
+      else say.textContent = 'Fresh CLI token issued. Open a terminal, cd into your project folder first (the command only runs there), then paste this:';
       const eyebrow = el('p', 'quote__eyebrow');
       eyebrow.textContent = 'paste command';
       const pre = el('pre', 'quote__pre');
@@ -621,13 +639,39 @@
       foot.append(copyBtn, hint);
       const quote = el('div', 'quote');
       quote.append(eyebrow, pre, foot);
+      // THE TOKEN-FREE ROUTE (task 1005033). The one-liner above carries the token, so
+      // it lands in shell history. `paste-token` with no token asks for it without echo;
+      // this offers that: the command without the token, and the token on its own
+      // button. The one-liner stays first because an older CLI in a builder's clone has
+      // no prompt and would stop at "No token given".
+      const promptCommand = `${windows ? 'npx.cmd' : 'npx'} bongos paste-token${body.api_base ? ` --api-base ${body.api_base}` : ''}`;
+      const quiet = el('details', 'cli-result__quiet');
+      const quietSum = el('summary', '');
+      quietSum.textContent = 'Keep the token out of your shell history';
+      const quietSay = el('p', 'settings-card__hint');
+      quietSay.textContent = 'Run this command instead (same folder). When it asks for the token, click Copy token and paste it there; nothing is shown as you paste.';
+      const quietPre = el('pre', 'quote__pre');
+      quietPre.textContent = promptCommand;
+      const copyPromptBtn = el('button', 'settings-btn settings-btn--quiet');
+      copyPromptBtn.type = 'button';
+      copyPromptBtn.textContent = 'Copy command';
+      const copyTokenBtn = el('button', 'settings-btn settings-btn--quiet');
+      copyTokenBtn.type = 'button';
+      copyTokenBtn.textContent = 'Copy token';
+      const quietFoot = el('div', 'quote__foot');
+      quietFoot.append(copyPromptBtn, copyTokenBtn);
+      quiet.append(quietSum, quietSay, quietPre, quietFoot);
       result.textContent = ''; // a re-issue replaces the previous token, as innerHTML did
       result.append(say, quote);
+      if (body.token) result.append(quiet);
       result.hidden = false;
-      copyBtn.addEventListener('click', async () => {
-        try { await navigator.clipboard.writeText(pasteCommand); toast('Paste command copied.'); }
+      const copy = async (text, done) => {
+        try { await navigator.clipboard.writeText(text); toast(done); }
         catch (err) { toast(`Could not copy automatically — select and copy manually. (${err.message})`); }
-      });
+      };
+      copyBtn.addEventListener('click', () => copy(pasteCommand, 'Paste command copied.'));
+      copyPromptBtn.addEventListener('click', () => copy(promptCommand, 'Command copied.'));
+      copyTokenBtn.addEventListener('click', () => copy(body.token, 'Token copied.'));
     } catch (err) {
       console.error('[settings] cli token reissue failed', err);
       toast(`Re-issue failed: ${err.message}`);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.69",
+  "version": "1.24.70",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.69",
+      "version": "1.24.70",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.69",
+  "version": "1.24.70",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11412,7 +11412,15 @@
       "text": "The design checker now catches text hidden under a dark overlay (the bug that made the components page unreadable in dark mode), instead of reporting it clean."
     }
   ],
-  "1.24.69": [
+  "1.24.70": [
+    {
+      "id": "1005100",
+      "text": "In a project that installs Bongos from npm (like toast), the docs check and the pre-ship check now look at the project itself instead of Bongos's own installed files, so they stop failing on nothing and stop reporting fresh fi"
+    },
+    {
+      "id": "1005033",
+      "text": "Signing in to the command line on Windows is smoother: Settings now shows a command that works in PowerShell, says to go to your project folder first, and the tool can ask for the token instead of it sitting in the command."
+    },
     {
       "id": "1005113",
       "text": "In a project that installs Bongos from npm (like toast), the claim card now tells you to finish with 'npx bongos ship', a command that exists there, instead of a script path that doesn't."

package/scripts/bongos/docs-entropy.js

@@ -25,7 +25,10 @@ const path = require('node:path');
 const { execFileSync } = require('node:child_process');
 const { hasFlag, cliClient, requireSession, cliExit } = require('./cli-lib');
 
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
+// The tree being scanned (task 1005100): this checkout when the core is a checkout, the
+// PROJECT when the core is installed under node_modules — the package dir is not a repo of
+// its own, so `git ls-files` there found 0 files and fitness died on a "scan defect".
+const REPO_ROOT = require('./fitness-lib.js').resolveWorkRoot();
 const { currentScriptPath } = require('./forwarder.js');
 const MIN_DUPE_CHARS = 120;    // minimum paragraph length to flag as duplicate
 const MAX_DUPES_REPORTED = 20; // cap to avoid flooding the report