@bongos/core 1.24.69 → 1.24.71

package/scripts/bongos/fitness-lib.js

@@ -11,7 +11,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-config'); // ADR 0108 §1: configurable-root
+const { resolveCoreRoot, resolveInstanceRoot, resolveInstanceRootExplicit } = require('../../src/instance-config'); // ADR 0108 §1: configurable-root
 
 
 // ADR 0108 §Consequences #4 (configurable-root W6 / task 1886) — the guardrail walks TWO trees.
@@ -97,6 +97,23 @@ function isInstalledCore(root = CORE_ROOT) {
   } catch { return true; } // a package with no repo around it at all
 }
 
+// resolveWorkRoot — the tree a repo-wide tool (docs-entropy, ship-check) works on (task 1005100).
+// A core CHECKOUT works on itself, whatever the cwd, exactly as path.resolve(__dirname,'..','..')
+// always did. An INSTALLED core's package dir is not the project — `git ls-files` there finds
+// nothing and the generators read the package's own files — so it works on the project instead:
+// an explicit pointer (<PREFIX>_INSTANCE_ROOT / bongos.config.json), else the git top of the cwd
+// (`npx bongos exec` runs from the project), else the cwd.
+function gitTopOf(cwd) {
+  try {
+    return require('node:child_process').execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() || null;
+  } catch { return null; }
+}
+function resolveWorkRoot({ installed, cwd = process.cwd(), explicit = resolveInstanceRootExplicit, gitTop = gitTopOf } = {}) {
+  if (installed === undefined) installed = isInstalledCore();
+  if (!installed) return CORE_ROOT;
+  return explicit() || gitTop(cwd) || cwd;
+}
+
 // runChecks — run every fitness check, or none (task 1004737). Every check guards the core's
 // own source, and an INSTALLED core's source is not the project's to change: the core repo's
 // CI ran this gate before publishing it (the same stance ship-merge-gate.js takes for a
@@ -115,6 +132,7 @@ function runChecks(checks, { installed = isInstalledCore() } = {}) {
 
 module.exports = {
   isInstalledCore,
+  resolveWorkRoot,
   runChecks,
   keyTokenRe,
   CORE_ROOT,

package/scripts/bongos/paste-token.js

@@ -8,6 +8,8 @@
 //
 // Usage:
 //   bongos paste-token <token>          # what the hall hands you (task 1003961)
+//   bongos paste-token                  # no argument: asks for the token without echo,
+//                                       # or reads it from stdin when piped (task 1005033)
 //   node scripts/bongos/paste-token.js <token>   # equivalent, inside a core checkout
 //
 // The portal returns the exact invocation as the "paste_command" field, so a
@@ -83,10 +85,71 @@ const ARGS = parseArgs(process.argv.slice(2));
 const RESOLVED = resolveBaseForPaste({ flag: ARGS.apiBase });
 const API_BASE = RESOLVED.base;
 
+// READ THE TOKEN WITHOUT PUTTING IT ON THE COMMAND LINE (task 1005033). A token passed
+// as an argument lands in shell history. With no argument we ask for it: on a terminal
+// the read is raw and nothing is echoed (a 64-char secret has no business on screen
+// either); piped (`... | bongos paste-token`) we take the first word of stdin. The
+// argument form still works — the hall's one-liner uses it, and older instances hand
+// out nothing else. Exported so the no-echo read is tested, not assumed.
+function readTokenFromInput({ input = process.stdin, output = process.stderr } = {}) {
+  if (!input.isTTY) {
+    // Piped: settle on the FIRST line, not at end of stream — a pipe that never closes
+    // must not hang the paste, and nothing after the token is ours to buffer.
+    return new Promise((resolve, reject) => {
+      let data = '';
+      let settled = false;
+      const settle = () => {
+        if (settled) return;
+        settled = true;
+        input.removeListener('data', onData);
+        input.pause();
+        resolve(data.trim().split(/\s+/)[0] || '');
+      };
+      function onData(c) {
+        data += c;
+        if (data.replace(/^\s+/, '').includes('\n')) settle();
+      }
+      input.setEncoding('utf8');
+      input.on('data', onData);
+      input.on('end', settle);
+      input.on('error', (err) => { if (!settled) { settled = true; reject(err); } });
+    });
+  }
+  output.write('Paste your CLI token (Settings → CLI Access) and press Enter: ');
+  return new Promise((resolve, reject) => {
+    let buf = '';
+    const raw = typeof input.setRawMode === 'function';
+    if (raw) input.setRawMode(true);
+    input.setEncoding('utf8');
+    input.resume();
+    function finish(err) {
+      input.removeListener('data', onData);
+      if (raw) input.setRawMode(false);
+      input.pause();
+      output.write('\n');
+      if (err) reject(err); else resolve(buf.trim());
+    }
+    function onData(chunk) {
+      for (const ch of String(chunk)) {
+        if (ch === '\r' || ch === '\n') { finish(); return; }
+        // Ctrl+C always cancels; Ctrl+D (end of input) cancels too unless a token is typed.
+        if (ch === '\u0003' || (ch === '\u0004' && !buf.trim())) { finish(new Error('cancelled — nothing was saved')); return; }
+        if (ch === '\u0004') { finish(); return; }
+        if (ch === '\u007f' || ch === '\b') { buf = buf.slice(0, -1); continue; }
+        buf += ch;
+      }
+    }
+    input.on('data', onData);
+  });
+}
+
 function usage(extra) {
   if (extra) console.error(extra);
   console.error('');
-  console.error('Usage: npx bongos paste-token <token> [--api-base <url>]');
+  console.error('Usage: npx bongos paste-token [<token>] [--api-base <url>]');
+  console.error('   Leave out <token> and it asks for it, so the token stays out of shell history.');
+  console.error('   Run it from inside your project folder (cd there first).');
+  console.error('   In Windows PowerShell type npx.cmd instead of npx.');
   console.error('   (inside a core checkout: node scripts/bongos/paste-token.js <token>)');
   console.error('');
   // Fall back to the inferred base for this hint when --api-base was the thing that
@@ -103,9 +166,17 @@ async function main() {
     usage(`--api-base must be an http(s) URL, got: ${ARGS.apiBase}`);
     process.exit(2);
   }
-  const token = ARGS.token;
+  let token = ARGS.token;
+  if (!token) {
+    try {
+      token = await readTokenFromInput();
+    } catch (err) {
+      console.error(`paste-token: ${err.message}`);
+      process.exit(2);
+    }
+  }
   if (!token) {
-    usage('No token argument provided.');
+    usage('No token given.');
     process.exit(2);
   }
   // Tokens are hex-encoded crypto.randomBytes(32) → 64 lowercase hex chars.
@@ -209,4 +280,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { parseArgs, resolveBaseForPaste };
+module.exports = { parseArgs, resolveBaseForPaste, readTokenFromInput };

package/scripts/bongos/provision-repo.js

@@ -533,7 +533,9 @@ function installedCoreTarball({ instanceRoot, fsImpl = fs } = {}) {
 // nothing either way. The file: pin is kept for the reason in ADR 0168 — a child is born
 // on the core its parent actually runs — not for access control.) Returns { dir, version, tarballName } or null
 // (a file: pin, an uninstalled dep, or a source checkout). fs reads only → dry-run safe.
-function installedCorePackDir({ instanceRoot, fsImpl = fs } = {}) {
+// `includeFilePins` (task 1002450): the stale-pin recovery below packs the core a
+// file:-pinned hub has INSTALLED, so it must not skip the file: spec the default does.
+function installedCorePackDir({ instanceRoot, fsImpl = fs, includeFilePins = false } = {}) {
   const root = instanceRoot || process.env.BONGOS_INSTANCE_ROOT || process.cwd();
   let pkg;
   try { pkg = JSON.parse(fsImpl.readFileSync(path.join(root, 'package.json'), 'utf8')); }
@@ -541,7 +543,7 @@ function installedCorePackDir({ instanceRoot, fsImpl = fs } = {}) {
   const deps = Object.assign({}, pkg.dependencies, pkg.devDependencies);
   for (const name of ['@bongos/core', '@cloudbongos/core']) {
     const spec = String(deps[name] || '').trim();
-    if (!spec || spec.startsWith('file:')) continue;   // file: pins belong to installedCoreTarball
+    if (!spec || (spec.startsWith('file:') && !includeFilePins)) continue;   // file: pins belong to installedCoreTarball
     const dir = path.join(root, 'node_modules', ...name.split('/'));
     try {
       const installed = JSON.parse(fsImpl.readFileSync(path.join(dir, 'package.json'), 'utf8'));
@@ -568,13 +570,113 @@ function coreCheckoutHasGit({ repoRoot = REPO_ROOT, fsImpl = fs } = {}) {
 // The core version THIS control plane runs — what the ladder below would vend: the
 // pinned tarball's version, else the registry-installed package's, else the checkout's
 // CORE_VERSION. fs reads only → dry-run safe.
+// A pinned tarball whose label disagrees with coreV is STALE (task 1002450): the hall runs
+// coreV, so that is its running version, not the leftover tarball's label.
 function runningCoreVersion({ instanceRoot, coreV }) {
   const pinned = installedCoreTarball({ instanceRoot });
-  if (pinned) return require('./upgrade').versionFromTgzPath(path.basename(pinned)) || coreV;
+  if (pinned) {
+    const pinnedV = pinnedTarballVersion(pinned);
+    return (coreV && pinnedV && pinnedV !== coreV) ? coreV : (pinnedV || coreV);
+  }
   const packSrc = installedCorePackDir({ instanceRoot });
   return packSrc ? packSrc.version : coreV;
 }
 
+// ── the stale-pin guard (task 1002450) ────────────────────────────────────────────
+// Rung 1 below trusted a file:-pinned hub's own vendored tarball unconditionally ("the
+// child pins the SAME core the hub runs"). Two ways that was false, both seen live: an
+// out-of-band upgrade swaps node_modules/@bongos/core without rewriting vendor/*.tgz, so
+// the label trails the core the hub RUNS; and the same label can name different bytes —
+// an early instance was born on a 1.18.14 tarball 15 kB smaller than the published 1.18.14,
+// missing the task-1002419 poller fix, so its first ship never left 'confirmed'. Quiet
+// failure, so this guard is loud.
+//
+// The two sibling gaps are closed elsewhere, on purpose — tests/provision.mjs proves each:
+//   - PUBLISHING one version twice as different bytes: the npm registry refuses it (a
+//     version is immutable), and .github/workflows/publish.yml fails the run loudly on
+//     that refusal (task 1004886). What escaped was a LOCAL build carrying a published
+//     label — the vendoring this guard checks.
+//   - a hub BEHIND upstream: projectCoreDecision gives a new project the release when
+//     the runner is behind it (task 1004556), and that target short-circuits this ladder.
+// The integrity read costs one `npm view` on the reuse path; projectCoreTarget already
+// makes one per scaffold, and both fail open when the registry is unreachable.
+
+// The version a core tarball's FILENAME carries — both scope aliases (bongos-core-*,
+// cloudbongos-core-*), which upgrade.versionFromTgzPath (bongos-core only) would miss.
+// Digits, dots and [A-Za-z0-9.+-] only, so the result is shell-safe. PURE.
+function pinnedTarballVersion(p) {
+  const m = /(?:^|-)core-(\d+\.\d+\.\d+[A-Za-z0-9.+-]*)\.tgz$/.exec(path.basename(String(p || '')));
+  return m ? m[1] : null;
+}
+
+// A version that may enter a shell command, or null — the same character set as
+// safeVersionLabel, the file's interpolation chokepoint. PURE.
+function shellSafeVersion(v) {
+  const s = safeVersionLabel(v);
+  return s === '(unversioned)' ? null : s;
+}
+
+// npm's dist.integrity form for a file: sha512, base64. fs injectable for tests.
+function tarballIntegrity(p, fsImpl = fs) {
+  return 'sha512-' + crypto.createHash('sha512').update(fsImpl.readFileSync(p)).digest('base64');
+}
+
+// Is the pinned tarball the core this hub runs, AND the bytes the registry published
+// under that label? → { verdict, pinnedV, reason }:
+//   'stale-version' — its label is not coreV (the hub moved on, the tarball did not);
+//   'stale-bytes'   — the label matches but the registry's integrity for it differs
+//                     (the charter case: same version, different artifact);
+//   'unverifiable'  — no coreV, an unparseable label, or no registry answer: reuse it
+//                     (fail-open, never block a scaffold on a resolution gap) but SAY so;
+//   'fresh'         — both checks pass.
+// The registry read goes through the injected exec, so a dry run never hits the network.
+function checkPinnedTarball({ pinned, coreV, exec, fsImpl = fs }) {
+  const pinnedV = shellSafeVersion(pinnedTarballVersion(pinned));
+  if (!pinnedV) return { verdict: 'unverifiable', pinnedV, reason: 'no version in its filename' };
+  if (!coreV) return { verdict: 'unverifiable', pinnedV, reason: 'the running core version is unknown' };
+  if (pinnedV !== coreV) return { verdict: 'stale-version', pinnedV, reason: `it is ${pinnedV} but this control plane runs ${coreV}` };
+  const res = exec(`npm view ${CORE_PKG}@${pinnedV} dist.integrity`, { allowFail: true });
+  const published = String((res && res.ok !== false && res.stdout) || '').trim();
+  if (!/^sha512-/.test(published)) return { verdict: 'unverifiable', pinnedV, reason: `the registry gave no integrity for ${pinnedV}` };
+  let local;
+  try { local = tarballIntegrity(pinned, fsImpl); } catch { return { verdict: 'unverifiable', pinnedV, reason: 'it could not be read' }; }
+  if (local !== published) return { verdict: 'stale-bytes', pinnedV, reason: `its bytes are not the ${pinnedV} the registry published (a different build under the same version label)` };
+  return { verdict: 'fresh', pinnedV, reason: 'matches the running core and the published bytes' };
+}
+
+// Where a stale pin goes instead. NEVER to the package-core.js rungs: on a file:-pinned
+// consumer hub those abort on an empty core set and leave the new repo empty (task 1002275).
+//   stale-bytes   → the registry's own bytes for that version (canonical by definition);
+//   stale-version → the core the hub has INSTALLED, when it is coreV; else the registry's coreV;
+//   neither       → refuse, loudly: no project is born on a core nobody can name.
+function recoverFromStalePin({ instanceRoot, exec, log, tag, coreV, check }) {
+  const fromRegistry = (raw) => {
+    const v = shellSafeVersion(raw);   // interpolated into a shell command below
+    if (!v) return null;
+    const packDest = path.join(os.tmpdir(), `bongos-core-registry-${v}`);
+    exec(`mkdir -p ${packDest}`);
+    const res = exec(`npm pack ${CORE_PKG}@${v} --pack-destination ${packDest}`, { allowFail: true });
+    if (res && res.ok === false) { exec(`rm -rf ${packDest}`); return null; }
+    log(`  ${tag} packed the published ${v} from the registry instead (task 1002450)`);
+    return { tgz: path.join(packDest, `bongos-core-${v}.tgz`), packDest };
+  };
+  if (check.verdict === 'stale-version') {
+    const installed = installedCorePackDir({ instanceRoot, includeFilePins: true });
+    const v = installed && shellSafeVersion(installed.version);   // interpolated into a shell command below
+    if (v && v === coreV) {
+      const packDest = path.join(os.tmpdir(), `bongos-core-pack-${v}`);
+      log(`  ${tag} packing the installed core this control plane runs (v${v}) instead (task 1002450)`);
+      exec(`mkdir -p ${packDest}`);
+      exec(`npm pack ${installed.dir} --pack-destination ${packDest}`);
+      return { tgz: path.join(packDest, installed.tarballName), packDest };
+    }
+  }
+  const v = check.verdict === 'stale-bytes' ? check.pinnedV : coreV;
+  const got = fromRegistry(v);
+  if (got) return got;
+  throw new Error(`refusing to give a new project a stale core: the pinned tarball ${check.reason}, and neither an installed core ${coreV} nor a published ${v} could be packed. Re-run \`bongos upgrade\` on this control plane so its vendor/ tarball matches the core it runs, then retry (task 1002450).`);
+}
+
 // Which core a hosted project is given (task 1004299, ADR 0361 D5). PURE. Since merges
 // publish as candidates, the platform hall runs ahead of the registry's `latest` label by
 // design — and the ladder below vends whatever the hall runs, so every new project would
@@ -617,7 +719,8 @@ function projectCoreTarget({ instanceRoot, coreV, exec, log, tag = '[core]' }) {
 // project gets the released version packed from the registry, not this hall's core.
 //   1. a `file:`-pinned control plane reuses its own pinned tarball (task 1002275 —
 //      rebuilding via package-core.js aborts with an EMPTY core set when this runner
-//      IS a consumer instance, leaving new repos empty);
+//      IS a consumer instance, leaving new repos empty) — unless checkPinnedTarball
+//      finds it STALE, when recoverFromStalePin replaces it (task 1002450);
 //   2. a REGISTRY-pinned consumer (the post-1002621 mothership shape) packs the core
 //      it has INSTALLED — the child pins the SAME, CURRENT core the hub runs, ending
 //      the frozen-old-tarball births (task 1002706, gap 13) without requiring the
@@ -641,8 +744,14 @@ function resolveVendorableCoreTarball({ instanceRoot, repoRoot = REPO_ROOT, exec
   }
   const pinned = installedCoreTarball({ instanceRoot });
   if (pinned) {
-    log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(pinned)}) — no source rebuild (task 1002275)`);
-    return { tgz: pinned, packDest: null };
+    const check = checkPinnedTarball({ pinned, coreV, exec });
+    if (check.verdict === 'fresh' || check.verdict === 'unverifiable') {
+      if (check.verdict === 'unverifiable') log(`  ${tag} WARNING: cannot verify the pinned core tarball ${path.basename(pinned)} — ${check.reason}; reusing it anyway (task 1002450)`);
+      log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(pinned)}) — no source rebuild (task 1002275)`);
+      return { tgz: pinned, packDest: null };
+    }
+    log(`  ${tag} STALE pinned core tarball ${path.basename(pinned)} — ${check.reason}. NOT vendoring it into a new project (task 1002450)`);
+    return recoverFromStalePin({ instanceRoot, exec, log, tag, coreV, check });
   }
   const packSrc = installedCorePackDir({ instanceRoot });
   if (packSrc) {
@@ -1294,6 +1403,7 @@ module.exports = {
   ownerLoginOf,
   asPostgres,
   buildCorePinRefreshCommit,
+  checkPinnedTarball,
   coreCheckoutHasGit,
   dbCreateCmd,
   dbName,
@@ -1318,6 +1428,7 @@ module.exports = {
   migrateCmd,
   onboardMode,
   parseTargetRef,
+  pinnedTarballVersion,
   planCorePinRefresh,
   refreshStandaloneCorePin,
   resolveOwnerGithubToken,

package/scripts/bongos/ship-check.js

@@ -21,7 +21,12 @@ const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
 
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
+// Two roots (task 1005100). CORE_ROOT is where the step scripts live; WORK_ROOT is the tree they
+// check. In a project that installs the core they differ: running the generators from the
+// package dir checked the package's files, so gen-api-docs read STALE while the same --check
+// run from the project said up to date. In a core checkout both are this checkout.
+const CORE_ROOT = path.resolve(__dirname, '..', '..');
+const WORK_ROOT = require('./fitness-lib.js').resolveWorkRoot();
 
 // Each step: a label, the argv to run (node scripts run with THIS node), the command that heals it,
 // and how to read a non-zero exit. `optional` steps are skipped when their script is absent. An `advisory`
@@ -45,8 +50,11 @@ const STEPS = [
   { key: 'tests', label: 'DB-free unit lane (npm test)', argv: ['scripts/bongos/run-unit-tests.js'], fix: 'read the FAIL lines; compare against origin/main before calling any of them environmental', onlyWith: '--tests', slow: true },
 ];
 
-function runStep(step, { cwd = REPO_ROOT } = {}) {
-  const script = path.join(cwd, step.argv[0]);
+// A caller that passes only `cwd` (tests) gets scripts resolved there too, as before.
+function runStep(step, { cwd, coreRoot } = {}) {
+  coreRoot = coreRoot || cwd || CORE_ROOT;
+  cwd = cwd || WORK_ROOT;
+  const script = path.join(coreRoot, step.argv[0]);
   if (!fs.existsSync(script)) return { ...step, status: step.optional ? 'skipped' : 'missing', ms: 0, tail: `${step.argv[0]} not present` };
   const t0 = Date.now();
   const r = spawnSync(process.execPath, [script, ...step.argv.slice(1)], { cwd, encoding: 'utf8', timeout: step.slow ? 15 * 60 * 1000 : 5 * 60 * 1000, env: { ...process.env, GDS_QUIET: '1' } });

package/src/bongos/device-flow-blocker.js

@@ -0,0 +1,56 @@
+'use strict';
+// src/bongos/device-flow-blocker.js — tell the OWNER, loudly, that terminal sign-in is off
+// (task 1005033).
+//
+// WHY. GitHub creates an App from a manifest with Device Flow OFF and has no API to switch it
+// on — only a checkbox in the App's settings. Until the owner ticks it, every builder's
+// `bongos setup` / `bongos login` is refused, and the only person told was that builder, in a
+// terminal, who cannot fix it. The provisioning checklist shows the step as optional
+// ("later"), which no owner reads as urgent. So the first time this server sees GitHub's
+// device_flow_disabled refusal it files ONE blocker for the owner, through the ideas
+// module's `ideas.fileBlocker` port (core never imports a module). The writer is idempotent
+// on (source, source_ref), so a thousand refused sign-ins still make one blocker.
+//
+// Best effort by construction: no ideas module, a refused write or a DB hiccup changes
+// nothing about the sign-in reply the builder gets. Never throws, never rejects.
+
+const seams = require('../module-seams');
+
+const SOURCE = 'auth';
+const SOURCE_REF = 'github-device-flow-disabled';
+
+function isDeviceFlowDisabledReason(reason) {
+  return /device_flow_disabled/i.test(String(reason || ''));
+}
+
+function blockerFor(origin) {
+  const settings = origin ? `${origin}/builders/settings` : 'Settings → CLI Access';
+  return {
+    title: 'Terminal sign-in is off: tick "Enable Device Flow" on the GitHub App',
+    bodyMd: [
+      'A builder just tried to sign in from a terminal (`bongos setup` or `bongos login`) and GitHub refused:',
+      'this project\'s GitHub App has **Device Flow switched off**. Apps made by the one-click setup start',
+      'that way, and GitHub offers no way for the setup to switch it on.',
+      '',
+      '**Fix (the project owner, once, about a minute):** GitHub → Settings → Developer settings →',
+      'GitHub Apps → this project\'s app → tick **Enable Device Flow** → Save. Web sign-in is unaffected.',
+      '',
+      `Until then builders can still sign in through the web: ${settings}, "Re-issue CLI token".`,
+    ].join('\n'),
+    source: SOURCE,
+    sourceRef: SOURCE_REF,
+  };
+}
+
+async function raiseDeviceFlowOffBlocker({ reason, origin, resolveOptional = seams.resolveOptional } = {}) {
+  try {
+    if (!isDeviceFlowDisabledReason(reason)) return null;
+    const file = resolveOptional('ideas.fileBlocker', null);
+    if (typeof file !== 'function') return null;
+    return (await file(blockerFor(origin))) || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+module.exports = { raiseDeviceFlowOffBlocker, isDeviceFlowDisabledReason, SOURCE, SOURCE_REF };

package/src/bongos/routes/auth.js

@@ -42,6 +42,7 @@ const { accountExistenceReadRateLimit } = require('../middleware/rate-limit');
 const { branding } = require('../../branding');
 const { resolveEnv, envPrefix } = require('../../instance-config');
 const seams = require('../../module-seams');
+const { raiseDeviceFlowOffBlocker } = require('../device-flow-blocker');
 // task 1003208: structured logging — was console.*. A core file logs through
 // the kernel logger directly; only MODULES go via api.logger (the doorway).
 const log = require('../logger').logger.child({ src: 'auth' });
@@ -623,6 +624,7 @@ module.exports = function buildAuthRouter() {
       // fresh-instance auth failure could only be read via curl on the box itself
       // (finding W2, task 1003052). A 4xx passes the proxy with the JSON intact.
       const reason = String(err && err.message ? err.message : 'internal error').slice(0, 300);
+      raiseDeviceFlowOffBlocker({ reason, origin: WEB_REDIRECT_ORIGIN }); // owner blocker, once (task 1005033)
       res.fail('device_start_failed', { status: 424, message: reason });
     }
   });
@@ -1353,6 +1355,9 @@ module.exports = function buildAuthRouter() {
         paste_command: issuer
           ? `npx bongos paste-token ${token} --api-base ${issuer}`
           : `npx bongos paste-token ${token}`,
+        paste_command_windows: issuer
+          ? `npx.cmd bongos paste-token ${token} --api-base ${issuer}`
+          : `npx.cmd bongos paste-token ${token}`, // task 1005033: PowerShell blocks npx.ps1 by default
       });
     } catch (err) {
       log.error('[gds] POST /auth/cli-token/issue', err);

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.69'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.71'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/bongos_cli.mjs

@@ -76,7 +76,8 @@ test('the server emits exactly the verb the CLI registers', () => {
   assert.ok(cmds.length > 0, 'auth.js should emit at least one paste_command template literal');
   for (const cmd of cmds) {
     // `npx bongos <verb> …` since task 1004575 — a clone has no bare `bongos` on PATH.
-    const verb = cmd.replace(/^npx /, '').split(' ')[1];
+    // npx.cmd is the Windows PowerShell form (task 1005033) — same verb after it.
+    const verb = cmd.replace(/^npx(\.cmd)? /, '').split(' ')[1];
     assert.ok(cli.VERBS[verb], `server emits "bongos ${verb}" but the CLI has no such verb`);
   }
 });

package/tests/cli_token_reissue.mjs

@@ -174,11 +174,13 @@ t('paste_command names a CLI VERB, never a filesystem path', () => {
   // applying without anyone editing it.
   const tail = issueBlock.slice(issueBlock.indexOf('paste_command:'));
   const cmds = [...tail.matchAll(/`([^`]*bongos paste-token[^`]*)`/g)].map((m) => m[1]);
-  assert.equal(cmds.length, 2, `expected both ternary branches, got ${cmds.length}`);
+  // Four since task 1005033: paste_command's two branches, then paste_command_windows'
+  // two — the same line with npx.cmd, because npx.ps1 is blocked in a default PowerShell.
+  assert.equal(cmds.length, 4, `expected both ternary branches of both fields, got ${cmds.length}`);
   for (const cmd of cmds) {
   // Through npx (task 1004575): a builder's clone does not put bare `bongos` on
   // PATH, so a bare verb was "command not found" when pasted in the project folder.
-  assert.ok(/^npx bongos paste-token /.test(cmd),
+  assert.ok(/^npx(\.cmd)? bongos paste-token /.test(cmd),
     `paste_command must start with the npx verb form, got: ${cmd}`);
   // The invariant is "names no FILE ON THE RECIPIENT'S DISK", which the original
   // spelling approximated as "contains no slash". That was too broad once the command

package/tests/hall_onboarding_bongos_setup.mjs

@@ -87,7 +87,9 @@ test('Settings CLI access says where to paste the npx command', () => {
   const js = read('modules/hall-ui/public/settings.js');
   assert.match(html, /into a terminal in your project folder/);
   assert.doesNotMatch(html, /bypasses Device Flow/);
-  assert.match(js, /Paste this into a terminal in your project folder:/);
+  // Both spellings (task 1005033) name the project folder AND the cd that gets there.
+  assert.match(js, /Open a terminal, cd into your project folder first \(the command only runs there\), then paste this:/);
+  assert.match(js, /Open PowerShell, cd into your project folder first \(the command only runs there\), then paste this:/);
 });
 
 test('the npx paste command Settings hands out is pre-approved for a Claude session', () => {

package/tests/hall_settings_world.mjs

@@ -338,8 +338,8 @@ test('the CLI token reaches the page as text, not as markup', () => {
   // The secret and the clipboard read the SAME resolved value, so the button can
   // never copy a different string than the one on screen — nor the literal
   // "undefined", which writeText(body.paste_command) produced on a body without one.
-  assert.match(fn[0], /const pasteCommand = body\.paste_command \|\| ''/, 'one resolved value');
-  assert.match(fn[0], /writeText\(pasteCommand\)/, 'the clipboard copies that same value');
+  assert.match(fn[0], /const pasteCommand = \(windows && body\.paste_command_windows\) \|\| body\.paste_command \|\| ''/, 'one resolved value');
+  assert.match(fn[0], /copy\(pasteCommand, /, 'the clipboard copies that same value');
   assert.match(fn[0], /result\.textContent = ''/, 're-issuing replaces the previous token rather than stacking a second');
 });